@cmmd-center/forge 0.13.69 → 0.13.71

package/dist/bin.cjs

@@ -66275,7 +66275,7 @@ function normalizeNumberish(value) {
 }
 //#endregion
 //#region package.json
-var version$1 = "0.13.69";
+var version$1 = "0.13.71";
 //#endregion
 //#region src/sentry.ts
 const SERVER_APP_NAME = "forge-server";
@@ -67235,6 +67235,7 @@ const runtimeReplicationPublicationAttemptsTotal = require_Schema$1.counter("t3_
 const runtimeReplicationPublicationRetriesTotal = require_Schema$1.counter("t3_runtime_replication_publication_retries_total", { description: "Total runtime replication retries scheduled after recoverable failures." });
 const runtimeReplicationPublicationLatency = require_Schema$1.timer("t3_runtime_replication_publication_latency", { description: "Time from durable enqueue to canonical CMMD acknowledgement." });
 const cmmdCredentialRefreshTotal = require_Schema$1.counter("t3_cmmd_credential_refresh_total", { description: "CMMD JWT refresh attempts for a Forge session, by rung (self-refresh | grant-redemption) and outcome (attempted | succeeded)." });
+const cmmdTokenMintTotal = require_Schema$1.counter("t3_cmmd_token_mint_total", { description: "CMMD short-lived forge-token mints through the mint lane (forge#3518), by outcome (attempted | succeeded). The legacy rotation ladder keeps reporting t3_cmmd_credential_refresh_total, so the two lanes stay separable in every dashboard." });
 const cmmdRotationFenceAppliedTotal = require_Schema$1.counter("t3_cmmd_rotation_fence_applied_total", { description: "Sessions Forge refused to rotate CMMD credentials for, because the rotation fence applied." });
 const cmmdCredentialRowDeletedTotal = require_Schema$1.counter("t3_cmmd_credential_row_deleted_total", { description: "command_access_tokens rows actually deleted by clearUnrecoverableCmmdAuthForSession, by reason." });
 const metricAttributes = (attributes) => Object.entries(compactMetricAttributes(attributes));
@@ -71265,6 +71266,63 @@ function parseCmmdOAuthRefreshResponse(value) {
 	};
 }
 /**
+* Read the one field the mint lane consumes from CMMD's mint response.
+* Returns null unless `access_token` is present and non-empty.
+*/
+function parseCmmdTokenMintResponse(value) {
+	if (!value || typeof value !== "object") return null;
+	const accessToken = value["access_token"];
+	if (typeof accessToken !== "string" || accessToken.trim().length === 0) return null;
+	return { accessToken: accessToken.trim() };
+}
+/**
+* How long the mint may take before the lane gives up on it. Minting is one
+* grant lookup and one signature on CMMD's side; anything slower is treated
+* like a failure and the resolver falls through to the legacy ladder.
+*/
+const MINT_TIMEOUT_MS = 1e4;
+/**
+* Mint a short-lived forge-scoped access token from a durable session grant
+* (forge#3518 expand phase).
+*
+* The grant is non-rotating and redeemable on demand, so this is the mint
+* lane's entire refresh story: call it again when the short-lived token
+* expires. CMMD answers with `access_token` only (no refresh token, no MCP
+* PAT, nothing durable), so a session that lives entirely on this lane never
+* accumulates long-lived credential state on Forge's side.
+*
+* Returns null for every failure because the resolver wants a value, not a
+* thrown error; the failure modes are logged by status and OAuth error code
+* the same way `refreshCmmdJwt` logs them. A rejection here is never fed to
+* the credential-rejection ledger: the ledger exists to prove a session's
+* *rotation* credential is dead, and the grant dying says nothing about the
+* refresh token the legacy fallback still owns.
+*/
+function mintCmmdShortLivedToken(grantToken) {
+	return fetch(new URL("/api/mcp-server/oauth/token", resolveCommandAppUrl()).toString(), {
+		method: "POST",
+		headers: { "Content-Type": "application/json" },
+		body: JSON.stringify({
+			grant_type: "forge_token_mint",
+			grant_token: grantToken,
+			client_id: "cmmd-forge-web"
+		}),
+		signal: AbortSignal.timeout(MINT_TIMEOUT_MS)
+	}).then(async (response) => {
+		if (!response.ok) {
+			const errorCode = await readOAuthErrorCode(response);
+			console.warn(`[cmmd-auth] CMMD refused a forge token mint with ${response.status}${errorCode === null ? "" : ` (${errorCode})`}`);
+			return null;
+		}
+		const parsed = parseCmmdTokenMintResponse(await response.json());
+		if (!parsed) console.warn("[cmmd-auth] CMMD accepted a forge token mint but returned no usable access token");
+		return parsed;
+	}).catch((cause) => {
+		console.warn(`[cmmd-auth] CMMD forge token mint could not be completed: ${String(cause)}`);
+		return null;
+	});
+}
+/**
 * Redeem a durable CMMD session grant for a fresh credential set.
 *
 * The grant is CMMD's designed recovery path for exactly the case a rotating
@@ -71355,6 +71413,42 @@ async function readOAuthErrorCode(response) {
 	}
 }
 //#endregion
+//#region src/command/cmmdTokenMintLane.ts
+/**
+* The CMMD token-mint lane (forge#3518, expand phase).
+*
+* A new FIRST rung beside the legacy credential ladder: instead of rotating
+* CMMD's single-use refresh tokens, the resolver mints a short-lived
+* forge-scoped access token from the session's durable, non-rotating session
+* grant (`grant_type: forge_token_mint` on CMMD's token endpoint). The mint
+* spends nothing that cannot be spent again, so it cannot race itself into
+* `invalid_grant` the way a rotation can.
+*
+* Behind a config flag that is OFF unless explicitly enabled: production
+* keeps the legacy ladder as the only lane until this is switched on
+* deliberately. When enabled, the lane is tried before the legacy ladder;
+* every legacy rung (rotation fence, self-refresh, grant redemption,
+* bootstrap promotion, subject fallback) still exists below it unchanged and
+* still guards itself with the rejection ledger.
+*/
+/** Env var that enables the mint lane. Unset and anything but an affirmative value is off. */
+const CMMD_TOKEN_MINT_LANE_ENV = "FORGE_CMMD_TOKEN_MINT_LANE";
+const AFFIRMATIVE_VALUES = new Set([
+	"1",
+	"on",
+	"true",
+	"yes"
+]);
+/**
+* Whether the mint lane may run. Default off everywhere: a missing env var is
+* the production posture, and an opt-in flag must not half-default to on in
+* any environment a misconfigured deploy might land in.
+*/
+function isCmmdTokenMintLaneEnabled(env = process.env) {
+	const raw = env[CMMD_TOKEN_MINT_LANE_ENV]?.trim().toLowerCase();
+	return raw !== void 0 && AFFIRMATIVE_VALUES.has(raw);
+}
+//#endregion
 //#region src/command/cmmdRotationFence.ts
 /**
 * Log and count a fence application, without changing the verdict it reports.
@@ -71443,12 +71537,13 @@ function usableCmmdUserJwt(token) {
 function storeResolvedJwt(sessionId, accessToken, refreshToken) {
 	return setCommandJwtForSession(sessionId, accessToken, refreshToken ? { refreshToken } : {}).pipe(require_Schema$1.ignore({ log: true }));
 }
-function logCmmdJwtRung(context, rung, outcome, reason) {
+function logCmmdJwtRung(context, rung, outcome, reason, lane = "legacy") {
 	return (outcome === "failed" ? require_Schema$1.logWarning : require_Schema$1.logInfo)("CMMD JWT resolver rung.", {
 		sessionId: context.sessionId,
 		subject: context.subject,
 		deviceType: context.deviceType,
 		caller: context.caller,
+		lane,
 		rung,
 		outcome,
 		reason
@@ -71461,6 +71556,25 @@ function recordCmmdCredentialRefreshMetric(rung, outcome) {
 	})), 1);
 }
 const inFlightRefreshes = /* @__PURE__ */ new Map();
+/** In-flight mints, keyed by session, same shape as `inFlightRefreshes`. */
+const inFlightMints = /* @__PURE__ */ new Map();
+/**
+* Collapse concurrent mints for one session into a single upstream call. A
+* mint cannot race itself into `invalid_grant` (the grant is non-rotating),
+* so this is call-rate hygiene, not correctness: two tabs observing the same
+* expiry must not both hit CMMD when one mint would do.
+*/
+function mintOnceForSession(sessionId, grantToken) {
+	return require_Schema$1.promise(() => {
+		const existing = inFlightMints.get(sessionId);
+		if (existing) return existing;
+		const pending = mintCmmdShortLivedToken(grantToken).catch(() => null).finally(() => {
+			inFlightMints.delete(sessionId);
+		});
+		inFlightMints.set(sessionId, pending);
+		return pending;
+	});
+}
 function refreshOnceForSession(sessionId, refreshToken) {
 	return require_Schema$1.promise(() => {
 		const existing = inFlightRefreshes.get(sessionId);
@@ -71500,6 +71614,39 @@ function trySelfRefresh(sessionId, context) {
 	});
 }
 /**
+* The mint lane's rung (forge#3518, expand phase): mint a short-lived
+* forge-scoped access token from this session's durable session grant.
+*
+* Tried FIRST, before the rotation fence and the whole legacy ladder, when
+* `FORGE_CMMD_TOKEN_MINT_LANE` is on. Minting spends nothing that cannot be
+* spent again (the grant is non-rotating), so unlike the legacy rungs it is
+* safe for a session the rotation fence fences off, and it never feeds the
+* credential-rejection ledger: this rung failing says nothing about whether
+* the legacy rungs below it can still succeed.
+*
+* Only the JWT is persisted (`setCommandJwtForSession`, no refresh token):
+* the short lifetime is the expiry story, and re-minting is the refresh
+* story. A session that lives entirely on this lane accumulates no new
+* long-lived credential state beyond the grant it already had.
+*/
+function tryMintShortLivedToken(sessionId, context) {
+	const grantToken = readCommandSessionGrantForSession(sessionId);
+	if (!grantToken) return logCmmdJwtRung(context, "mint", "skipped", "no session grant stored for this session", "mint").pipe(require_Schema$1.as(null));
+	return require_Schema$1.gen(function* () {
+		yield* logCmmdJwtRung(context, "mint", "attempted", "minting a short-lived forge-scoped token from this session's grant", "mint");
+		yield* require_Schema$1.update(require_Schema$1.withAttributes(cmmdTokenMintTotal, metricAttributes({ outcome: "attempted" })), 1);
+		const accessToken = usableCmmdUserJwt((yield* mintOnceForSession(sessionId, grantToken))?.accessToken);
+		if (!accessToken) {
+			yield* logCmmdJwtRung(context, "mint", "failed", "CMMD token mint did not return a usable user access JWT", "mint");
+			return null;
+		}
+		yield* setCommandJwtForSession(sessionId, accessToken, {}).pipe(require_Schema$1.ignore({ log: true }));
+		yield* require_Schema$1.update(require_Schema$1.withAttributes(cmmdTokenMintTotal, metricAttributes({ outcome: "succeeded" })), 1);
+		yield* logCmmdJwtRung(context, "mint", "succeeded", "CMMD minted a short-lived forge-scoped token", "mint");
+		return accessToken;
+	});
+}
+/**
 * Last-resort recovery: redeem this session's durable CMMD session grant.
 *
 * A refresh token is single-use, so a session that lost a rotation — raced, or
@@ -71619,8 +71766,10 @@ function runRecoveryLadder(sessionId, normalizedSubject, forceRefresh, context)
 * Resolve the CMMD REST JWT for a Forge session.
 *
 * Forge session auth is long-lived compared with the short-lived CMMD JWT.
-* When the session JWT expires, recover by promoting a valid subject-level JWT
-* or rotating the stored CMMD refresh token.
+* When the session JWT expires, recover by minting a fresh short-lived token
+* from the session grant (the mint lane; default-off, forge#3518), or, on
+* the legacy lane, by promoting a valid subject-level JWT or rotating the
+* stored CMMD refresh token.
 *
 * Fail-closed: never returns a non-user / malformed Bearer. Callers must map
 * null to CMMD_AUTH_REQUIRED and must not call CMMD upstream with a bad token.
@@ -71640,7 +71789,8 @@ function resolveCmmdJwtForSession({ sessionId, subject, logPrefix = "cmmd-auth",
 		})));
 	}
 	const normalizedSubject = subject?.trim() || null;
-	if (!normalizedSubject && !forceRefresh) return require_Schema$1.succeed(null);
+	const mintLaneEnabled = isCmmdTokenMintLaneEnabled();
+	if (!normalizedSubject && !forceRefresh && !mintLaneEnabled) return require_Schema$1.succeed(null);
 	return require_Schema$1.gen(function* () {
 		const context = {
 			sessionId,
@@ -71648,6 +71798,14 @@ function resolveCmmdJwtForSession({ sessionId, subject, logPrefix = "cmmd-auth",
 			deviceType: yield* readClientDeviceTypeForSession(sessionId),
 			caller: logPrefix
 		};
+		if (mintLaneEnabled) {
+			const minted = yield* tryMintShortLivedToken(sessionId, context);
+			if (minted) return minted;
+			if (!normalizedSubject && !forceRefresh) {
+				yield* logCmmdJwtRung(context, "mint", "failed", "no subject to resolve and the mint lane produced nothing", "mint");
+				return null;
+			}
+		}
 		if (yield* isRotationFencedSession(sessionId)) {
 			yield* logCmmdJwtRung(context, "rotation-fence", "failed", "session is fenced from rotating CMMD credentials");
 			return null;
@@ -87868,6 +88026,38 @@ function readRuntimeBrokerAuthority(input) {
 	if (authority.credentialEpoch !== input.credentialEpoch) return null;
 	return authority.token;
 }
+/**
+* Why a scoped lookup would miss, without mutating the map.
+*
+* "no live broker authority for this session" used to be one flat reason
+* whether nothing had ever been recorded, an entry had just expired, or an
+* entry existed for the wrong runtime, machine, or epoch. This lets a caller
+* name the distinction to an operator reading a production refusal.
+*
+* Read-only by design: call this BEFORE readRuntimeBrokerAuthority for the
+* same input. That read evicts an expired entry as it scans, so calling this
+* afterward would find the entry already gone and report "absent" for what
+* was really "expired".
+*/
+function describeRuntimeBrokerAuthorityMiss(input) {
+	const nowSeconds = input.nowSeconds ?? Math.floor(Date.now() / 1e3);
+	const scopedAuthorities = authorities.get(input.sessionId)?.get(input.requiredScope);
+	if (!scopedAuthorities || scopedAuthorities.size === 0) return "absent";
+	let selected = null;
+	let sawExpired = false;
+	for (const authority of scopedAuthorities.values()) {
+		if (authority.expiresAtSeconds <= nowSeconds) {
+			sawExpired = true;
+			continue;
+		}
+		if (!selected || authority.expiresAtSeconds >= selected.expiresAtSeconds) selected = authority;
+	}
+	if (!selected) return sawExpired ? "expired" : "absent";
+	if (selected.runtimeId !== input.runtimeId) return "runtime mismatch";
+	if (selected.machineId !== input.machineId) return "machine mismatch";
+	if (selected.credentialEpoch !== input.credentialEpoch) return "epoch mismatch";
+	return "absent";
+}
 function readRuntimeBrokerAuthorityForRuntime(input) {
 	for (const sessionId of authorities.keys()) {
 		const token = readRuntimeBrokerAuthority({
@@ -152394,6 +152584,30 @@ function runtimeAuthoritySessionId(input) {
 	if (input.authSessionId) return input.authSessionId;
 	return input.threadId ? readThreadSessionId(input.threadId) : null;
 }
+const BROKER_AUTHORITY_MISS_PHRASE = {
+	absent: "nothing has ever been recorded for this session and scope",
+	expired: "the recorded authority already passed its expiry",
+	"runtime mismatch": "the recorded authority names a different runtime",
+	"machine mismatch": "the recorded authority names a different machine",
+	"epoch mismatch": "the recorded authority names a different credential epoch"
+};
+/**
+* The base "no live broker authority" reason, enriched with what the lookup
+* compared and why it missed when that detail is available.
+*
+* A production refusal used to say only "no live broker authority for this
+* session", true whether nothing had ever been recorded, an entry had just
+* expired, or an entry existed for the wrong runtime, machine, or epoch. An
+* operator reading the log had no way to tell those apart (CMMD-Center/forge#3547).
+* `missDetail` is optional so a caller that has not resolved it (or a test
+* pinning the plain-outcome mapping) still gets the original, unqualified
+* sentence.
+*/
+function describeNoLiveBrokerAuthorityReason(sessionId, missDetail) {
+	const base = "no live broker authority for this session";
+	if (!missDetail) return base;
+	return `${base} (looked up session ${sessionId}, scope ${missDetail.requiredScope}, runtime ${missDetail.runtimeId}, machine ${missDetail.machineId}, epoch ${missDetail.credentialEpoch}: ${BROKER_AUTHORITY_MISS_PHRASE[missDetail.missReason]})`;
+}
 /**
 * Pure mapping from the three preconditions to an outcome.
 *
@@ -152419,7 +152633,7 @@ function resolveBrokerTicketOutcome(input) {
 		token: input.brokerAuthority
 	} : {
 		kind: "unavailable",
-		reason: "no live broker authority for this session"
+		reason: describeNoLiveBrokerAuthorityReason(input.sessionId, input.missDetail ?? null)
 	};
 }
 /**
@@ -152451,17 +152665,43 @@ function runtimeProviderBrokerToken(input) {
 		brokerAuthority: null
 	});
 	const sessionId = runtimeAuthoritySessionId(input);
+	if (!sessionId) return resolveBrokerTicketOutcome({
+		identityMode: "exact",
+		legacyGrantToken: null,
+		sessionId: null,
+		brokerAuthority: null
+	});
+	const runtimeId = process.env.FORGE_CMMD_RUNTIME_ID;
+	const requiredScope = "provider";
+	const nowSeconds = Math.floor(Date.now() / 1e3);
+	const missReason = describeRuntimeBrokerAuthorityMiss({
+		sessionId,
+		runtimeId,
+		machineId: identity.machineId,
+		credentialEpoch: identity.credentialEpoch,
+		requiredScope,
+		nowSeconds
+	});
+	const brokerAuthority = readRuntimeBrokerAuthority({
+		sessionId,
+		runtimeId,
+		machineId: identity.machineId,
+		credentialEpoch: identity.credentialEpoch,
+		requiredScope,
+		nowSeconds
+	});
 	return resolveBrokerTicketOutcome({
 		identityMode: "exact",
 		legacyGrantToken: null,
 		sessionId,
-		brokerAuthority: sessionId ? readRuntimeBrokerAuthority({
-			sessionId,
-			runtimeId: process.env.FORGE_CMMD_RUNTIME_ID,
+		brokerAuthority,
+		missDetail: brokerAuthority ? null : {
+			requiredScope,
+			runtimeId,
 			machineId: identity.machineId,
 			credentialEpoch: identity.credentialEpoch,
-			requiredScope: "provider"
-		}) : null
+			missReason
+		}
 	});
 }
 async function fetchRuntimeProviderGrant(input) {
@@ -298409,7 +298649,7 @@ function resolveBuildCommitFromEnv(env) {
 * environment descriptor down instead of reporting an honest "unknown".
 */
 function readBakedBuildCommit() {
-	return "ac91dc3fd479252ab728872fa5df9aaf5959eca7";
+	return "8e9fcb0318612dd80655f7c9662dd9128b8f005c";
 }
 async function resolveServerBuildCommit(input) {
 	if (isFullCommitSha(input.baked)) return input.baked;