@cmmd-center/forge 0.9.11 → 0.9.12

package/dist/bin.cjs

@@ -12,7 +12,7 @@ const require_Cache = require("./Cache-U1fkdGvV.cjs");
 const require_SqlError = require("./SqlError-CSsHBaKF.cjs");
 const require_Mime = require("./Mime-Bilnh8zE.cjs");
 const require_esm = require("./esm-BZhXwX5p.cjs");
-const require_runtimeControlAuthority = require("./runtimeControlAuthority-SNBF5Mjy.cjs");
+const require_runtimeControlAuthority = require("./runtimeControlAuthority-45DPznyK.cjs");
 const require_PTY = require("./PTY-CNa0j0w2.cjs");
 let node_child_process = require("node:child_process");
 node_child_process = require_chunk.__toESM(node_child_process);
@@ -65123,7 +65123,7 @@ function normalizeNumberish(value) {
 }
 //#endregion
 //#region package.json
-var version$1 = "0.9.11";
+var version$1 = "0.9.12";
 //#endregion
 //#region src/sentry.ts
 const SERVER_APP_NAME = "forge-server";
@@ -85575,7 +85575,7 @@ function isBrokerScope(scope) {
 	return brokerScopes.has(scope);
 }
 function hasSameExactIdentity(authority, claims) {
-	return authority.orgId === claims.orgId && authority.userId === claims.userId && authority.projectId === claims.projectId && authority.runtimeId === claims.runtimeId && authority.machineId === claims.machineId && authority.credentialEpoch === claims.credentialEpoch;
+	return authority.orgId === claims.orgId && authority.userId === claims.userId && authority.runtimeId === claims.runtimeId && authority.machineId === claims.machineId && authority.credentialEpoch === claims.credentialEpoch;
 }
 function firstSessionAuthority(sessionAuthorities) {
 	if (!sessionAuthorities) return void 0;
@@ -85609,7 +85609,6 @@ function recordRuntimeBrokerAuthority(input) {
 		token: input.token,
 		orgId: claims.orgId,
 		userId: claims.userId,
-		projectId: claims.projectId,
 		runtimeId: claims.runtimeId,
 		machineId: claims.machineId,
 		credentialEpoch: claims.credentialEpoch,
@@ -280383,7 +280382,7 @@ function currentGrantClaimsForRefresh(input) {
 	});
 }
 function sameRuntimeOwnership(currentClaims, refreshedClaims) {
-	return refreshedClaims.orgId === currentClaims.orgId && refreshedClaims.userId === currentClaims.userId && refreshedClaims.projectId === currentClaims.projectId;
+	return refreshedClaims.orgId === currentClaims.orgId && refreshedClaims.userId === currentClaims.userId;
 }
 function sameScopeSet(left, right) {
 	const leftScopes = new Set(left);
@@ -290138,11 +290137,10 @@ function readCmmdRuntimeAuthConfig(serverConfig) {
 		serverConfig.forgeCmmdRuntimePublicKey,
 		serverConfig.forgeCmmdRuntimeId,
 		serverConfig.forgeCmmdRuntimeOrgId,
-		serverConfig.forgeCmmdRuntimeUserId,
-		serverConfig.forgeCmmdRuntimeProjectId
+		serverConfig.forgeCmmdRuntimeUserId
 	].map((value) => value?.trim() ?? "");
 	if (required.some((value) => value.length === 0)) return null;
-	const [publicKeyPem, runtimeId, orgId, userId, projectId] = required;
+	const [publicKeyPem, runtimeId, orgId, userId] = required;
 	const machineId = serverConfig.forgeCmmdRuntimeMachineId?.trim();
 	const credentialEpoch = serverConfig.forgeCmmdRuntimeCredentialEpoch;
 	const brokerIdentity = classifyRuntimeBrokerIdentity({
@@ -290156,7 +290154,6 @@ function readCmmdRuntimeAuthConfig(serverConfig) {
 		runtimeId,
 		orgId,
 		userId,
-		projectId,
 		...brokerIdentity.mode === "exact" ? {
 			machineId: brokerIdentity.machineId,
 			credentialEpoch: brokerIdentity.credentialEpoch
@@ -305298,21 +305295,27 @@ function invalidAuthority(message, cause) {
 		...cause === void 0 ? {} : { cause }
 	});
 }
+/**
+* There is no project in a runtime's identity. A runtime serves every project
+* of one user, so a project id neither identifies it nor narrows it. Everything
+* here stays required: without a key, org, user, runtime, machine and epoch
+* there is nothing to verify a provider ticket against, and refusing is the
+* only safe answer.
+*/
 function resolveExactRuntimeIdentity(config) {
 	const identity = {
 		publicKeyPem: config.forgeCmmdRuntimePublicKey?.trim(),
 		orgId: config.forgeCmmdRuntimeOrgId?.trim(),
 		userId: config.forgeCmmdRuntimeUserId?.trim(),
-		projectId: config.forgeCmmdRuntimeProjectId?.trim(),
 		runtimeId: config.forgeCmmdRuntimeId?.trim(),
 		machineId: config.forgeCmmdRuntimeMachineId?.trim(),
 		credentialEpoch: config.forgeCmmdRuntimeCredentialEpoch
 	};
-	if (!identity.publicKeyPem || !identity.orgId || !identity.userId || !identity.projectId || !identity.runtimeId || !identity.machineId || identity.credentialEpoch === void 0) throw invalidAuthority("The exact CMMD runtime identity is not configured.");
+	if (!identity.publicKeyPem || !identity.orgId || !identity.userId || !identity.runtimeId || !identity.machineId || identity.credentialEpoch === void 0) throw invalidAuthority("The exact CMMD runtime identity is not configured.");
 	return identity;
 }
 function assertAutomationAuthorityMatchesRuntime(authority, identity) {
-	if (String(authority.organizationId) !== identity.orgId || String(authority.projectId) !== identity.projectId || authority.runtimeId !== identity.runtimeId) throw invalidAuthority("The automation authority does not match this runtime.");
+	if (String(authority.organizationId) !== identity.orgId || authority.runtimeId !== identity.runtimeId) throw invalidAuthority("The automation authority does not match this runtime.");
 }
 function verifyProviderAuthority(heartbeat, identity) {
 	const descriptor = heartbeat.providerAuthority;
@@ -309516,7 +309519,6 @@ const completeClaudeReadinessExpectations = (config) => {
 		runtimeId: config.forgeCmmdRuntimeId?.trim() ?? "",
 		orgId: config.forgeCmmdRuntimeOrgId?.trim() ?? "",
 		userId: config.forgeCmmdRuntimeUserId?.trim() ?? "",
-		projectId: config.forgeCmmdRuntimeProjectId?.trim() ?? "",
 		machineId: config.forgeCmmdRuntimeMachineId?.trim() ?? "",
 		credentialEpoch: config.forgeCmmdRuntimeCredentialEpoch
 	};
@@ -309545,7 +309547,6 @@ const claudeNativeGenerationProofRouteLayer = add$1("GET", "/api/runtime/provide
 		runtimeId: required.runtimeId,
 		orgId: required.orgId,
 		userId: required.userId,
-		projectId: required.projectId,
 		machineId: required.machineId,
 		credentialEpoch: required.credentialEpoch
 	});

package/dist/bin.mjs

@@ -11,7 +11,7 @@ import { a as make$48, i as keys, n as getOption, o as makeWith$1, r as invalida
 import { S as layer$9, _ as defaultEscape, a as DeadlockError, b as makeCompiler$1, c as SqlError, d as UnknownError, g as custom, h as make$49, i as ConstraintError, l as SqlSyntaxError, m as SqlClient, n as AuthorizationError, o as LockTimeoutError, r as ConnectionError, s as SerializationError, t as AuthenticationError, u as StatementTimeoutError, v as defaultTransforms, y as fragment } from "./SqlError-B2g5pJux.mjs";
 import { r as wrapper_default, t as Mime_default } from "./Mime-Dq9IoNiV.mjs";
 import { a as diag, c as SpanKind$1, d as TraceFlags, f as ROOT_CONTEXT, i as propagation, l as isSpanContextValid, m as DiagLogLevel, n as init_esm$1, o as context$1, p as createContextKey, r as trace, s as SpanStatusCode, t as esm_exports$1 } from "./esm-wLIF-u3N.mjs";
-import { a as verifyCmmdAuthRuntimeTicket, c as verifyCmmdRuntimeTicketRefreshProof, d as createReadOnceFileTokenAccessor, i as sendRuntimeControlHeartbeat, l as runtimeGrantToken, n as bootstrapRuntimeControlAuthorityFromNarrowGrant, o as verifyCmmdClaudeReadinessTicket, r as readRuntimeControlAuthority, s as verifyCmmdRuntimeTicket, t as bootstrapRuntimeControlAuthority, u as setRuntimeGrantToken } from "./runtimeControlAuthority-L85w5RTn.mjs";
+import { a as verifyCmmdAuthRuntimeTicket, c as verifyCmmdRuntimeTicketRefreshProof, d as createReadOnceFileTokenAccessor, i as sendRuntimeControlHeartbeat, l as runtimeGrantToken, n as bootstrapRuntimeControlAuthorityFromNarrowGrant, o as verifyCmmdClaudeReadinessTicket, r as readRuntimeControlAuthority, s as verifyCmmdRuntimeTicket, t as bootstrapRuntimeControlAuthority, u as setRuntimeGrantToken } from "./runtimeControlAuthority-akIBTI-S.mjs";
 import { n as PtySpawnError, t as PtyAdapter } from "./PTY-Cx_YKiEO.mjs";
 import { createRequire } from "node:module";
 import * as HE from "node:child_process";
@@ -64870,7 +64870,7 @@ function normalizeNumberish(value) {
 }
 //#endregion
 //#region package.json
-var version$1 = "0.9.11";
+var version$1 = "0.9.12";
 //#endregion
 //#region src/sentry.ts
 const SERVER_APP_NAME = "forge-server";
@@ -85267,7 +85267,7 @@ function isBrokerScope(scope) {
 	return brokerScopes.has(scope);
 }
 function hasSameExactIdentity(authority, claims) {
-	return authority.orgId === claims.orgId && authority.userId === claims.userId && authority.projectId === claims.projectId && authority.runtimeId === claims.runtimeId && authority.machineId === claims.machineId && authority.credentialEpoch === claims.credentialEpoch;
+	return authority.orgId === claims.orgId && authority.userId === claims.userId && authority.runtimeId === claims.runtimeId && authority.machineId === claims.machineId && authority.credentialEpoch === claims.credentialEpoch;
 }
 function firstSessionAuthority(sessionAuthorities) {
 	if (!sessionAuthorities) return void 0;
@@ -85301,7 +85301,6 @@ function recordRuntimeBrokerAuthority(input) {
 		token: input.token,
 		orgId: claims.orgId,
 		userId: claims.userId,
-		projectId: claims.projectId,
 		runtimeId: claims.runtimeId,
 		machineId: claims.machineId,
 		credentialEpoch: claims.credentialEpoch,
@@ -279940,7 +279939,7 @@ function currentGrantClaimsForRefresh(input) {
 	});
 }
 function sameRuntimeOwnership(currentClaims, refreshedClaims) {
-	return refreshedClaims.orgId === currentClaims.orgId && refreshedClaims.userId === currentClaims.userId && refreshedClaims.projectId === currentClaims.projectId;
+	return refreshedClaims.orgId === currentClaims.orgId && refreshedClaims.userId === currentClaims.userId;
 }
 function sameScopeSet(left, right) {
 	const leftScopes = new Set(left);
@@ -289628,11 +289627,10 @@ function readCmmdRuntimeAuthConfig(serverConfig) {
 		serverConfig.forgeCmmdRuntimePublicKey,
 		serverConfig.forgeCmmdRuntimeId,
 		serverConfig.forgeCmmdRuntimeOrgId,
-		serverConfig.forgeCmmdRuntimeUserId,
-		serverConfig.forgeCmmdRuntimeProjectId
+		serverConfig.forgeCmmdRuntimeUserId
 	].map((value) => value?.trim() ?? "");
 	if (required.some((value) => value.length === 0)) return null;
-	const [publicKeyPem, runtimeId, orgId, userId, projectId] = required;
+	const [publicKeyPem, runtimeId, orgId, userId] = required;
 	const machineId = serverConfig.forgeCmmdRuntimeMachineId?.trim();
 	const credentialEpoch = serverConfig.forgeCmmdRuntimeCredentialEpoch;
 	const brokerIdentity = classifyRuntimeBrokerIdentity({
@@ -289646,7 +289644,6 @@ function readCmmdRuntimeAuthConfig(serverConfig) {
 		runtimeId,
 		orgId,
 		userId,
-		projectId,
 		...brokerIdentity.mode === "exact" ? {
 			machineId: brokerIdentity.machineId,
 			credentialEpoch: brokerIdentity.credentialEpoch
@@ -304697,21 +304694,27 @@ function invalidAuthority(message, cause) {
 		...cause === void 0 ? {} : { cause }
 	});
 }
+/**
+* There is no project in a runtime's identity. A runtime serves every project
+* of one user, so a project id neither identifies it nor narrows it. Everything
+* here stays required: without a key, org, user, runtime, machine and epoch
+* there is nothing to verify a provider ticket against, and refusing is the
+* only safe answer.
+*/
 function resolveExactRuntimeIdentity(config) {
 	const identity = {
 		publicKeyPem: config.forgeCmmdRuntimePublicKey?.trim(),
 		orgId: config.forgeCmmdRuntimeOrgId?.trim(),
 		userId: config.forgeCmmdRuntimeUserId?.trim(),
-		projectId: config.forgeCmmdRuntimeProjectId?.trim(),
 		runtimeId: config.forgeCmmdRuntimeId?.trim(),
 		machineId: config.forgeCmmdRuntimeMachineId?.trim(),
 		credentialEpoch: config.forgeCmmdRuntimeCredentialEpoch
 	};
-	if (!identity.publicKeyPem || !identity.orgId || !identity.userId || !identity.projectId || !identity.runtimeId || !identity.machineId || identity.credentialEpoch === void 0) throw invalidAuthority("The exact CMMD runtime identity is not configured.");
+	if (!identity.publicKeyPem || !identity.orgId || !identity.userId || !identity.runtimeId || !identity.machineId || identity.credentialEpoch === void 0) throw invalidAuthority("The exact CMMD runtime identity is not configured.");
 	return identity;
 }
 function assertAutomationAuthorityMatchesRuntime(authority, identity) {
-	if (String(authority.organizationId) !== identity.orgId || String(authority.projectId) !== identity.projectId || authority.runtimeId !== identity.runtimeId) throw invalidAuthority("The automation authority does not match this runtime.");
+	if (String(authority.organizationId) !== identity.orgId || authority.runtimeId !== identity.runtimeId) throw invalidAuthority("The automation authority does not match this runtime.");
 }
 function verifyProviderAuthority(heartbeat, identity) {
 	const descriptor = heartbeat.providerAuthority;
@@ -308901,7 +308904,6 @@ const completeClaudeReadinessExpectations = (config) => {
 		runtimeId: config.forgeCmmdRuntimeId?.trim() ?? "",
 		orgId: config.forgeCmmdRuntimeOrgId?.trim() ?? "",
 		userId: config.forgeCmmdRuntimeUserId?.trim() ?? "",
-		projectId: config.forgeCmmdRuntimeProjectId?.trim() ?? "",
 		machineId: config.forgeCmmdRuntimeMachineId?.trim() ?? "",
 		credentialEpoch: config.forgeCmmdRuntimeCredentialEpoch
 	};
@@ -308930,7 +308932,6 @@ const claudeNativeGenerationProofRouteLayer = add$1("GET", "/api/runtime/provide
 		runtimeId: required.runtimeId,
 		orgId: required.orgId,
 		userId: required.userId,
-		projectId: required.projectId,
 		machineId: required.machineId,
 		credentialEpoch: required.credentialEpoch
 	});

package/dist/runtimeBootstrap.cjs

@@ -2,7 +2,7 @@
 
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 require("./chunk-BhaIgcZK.cjs");
-const require_runtimeControlAuthority = require("./runtimeControlAuthority-SNBF5Mjy.cjs");
+const require_runtimeControlAuthority = require("./runtimeControlAuthority-45DPznyK.cjs");
 exports.bootstrapRuntimeControlAuthorityFromNarrowGrant = require_runtimeControlAuthority.bootstrapRuntimeControlAuthorityFromNarrowGrant;
 exports.setRuntimeGrantToken = require_runtimeControlAuthority.setRuntimeGrantToken;
 exports.verifyCmmdRuntimeTicket = require_runtimeControlAuthority.verifyCmmdRuntimeTicket;

package/dist/runtimeBootstrap.mjs

@@ -1,4 +1,4 @@
 #!/usr/bin/env node
 
-import { n as bootstrapRuntimeControlAuthorityFromNarrowGrant, s as verifyCmmdRuntimeTicket, u as setRuntimeGrantToken } from "./runtimeControlAuthority-L85w5RTn.mjs";
+import { n as bootstrapRuntimeControlAuthorityFromNarrowGrant, s as verifyCmmdRuntimeTicket, u as setRuntimeGrantToken } from "./runtimeControlAuthority-akIBTI-S.mjs";
 export { bootstrapRuntimeControlAuthorityFromNarrowGrant, setRuntimeGrantToken, verifyCmmdRuntimeTicket };

package/dist/{runtimeControlAuthority-SNBF5Mjy.cjs → runtimeControlAuthority-45DPznyK.cjs}

@@ -155,13 +155,12 @@ function runtimeTicketExpiration(payload, allowExpired) {
 function requiredRuntimeIdentity(payload) {
 	const userId = stringClaim(payload, "user_id");
 	const orgId = stringClaim(payload, "org_id");
-	const projectId = stringClaim(payload, "project_id");
 	const runtimeId = stringClaim(payload, "runtime_id");
-	if (!userId || !orgId || !projectId || !runtimeId) return null;
+	if (!userId || !orgId || !runtimeId) return null;
 	return {
 		userId,
 		orgId,
-		projectId,
+		projectId: stringClaim(payload, "project_id"),
 		runtimeId
 	};
 }
@@ -188,7 +187,7 @@ function exactMachineExpectationMatches(claims, expectations) {
 	return expectations.credentialEpoch === void 0 || claims.credentialEpoch === expectations.credentialEpoch;
 }
 function runtimeTicketExpectationsMatch(claims, expectations) {
-	return matchesExpected(claims.runtimeId, expectations.runtimeId) && matchesExpected(claims.orgId, expectations.orgId) && matchesExpected(claims.userId, expectations.userId) && matchesExpected(claims.projectId, expectations.projectId) && exactMachineExpectationMatches(claims, expectations);
+	return matchesExpected(claims.runtimeId, expectations.runtimeId) && matchesExpected(claims.orgId, expectations.orgId) && matchesExpected(claims.userId, expectations.userId) && exactMachineExpectationMatches(claims, expectations);
 }
 function verifyCmmdRuntimeTicketWithExpirationPolicy(token, expectations, allowExpired) {
 	const payload = verifiedRuntimeTicketPayload(token, expectations.publicKeyPem);
@@ -357,7 +356,7 @@ function storeRuntimeControlAuthority(input) {
 	const claims = verifyCmmdRuntimeTicket(input.envelope.controlTicket, {
 		publicKeyPem: input.identity.publicKeyPem,
 		orgId: input.identity.orgId,
-		projectId: input.identity.projectId,
+		userId: input.identity.userId,
 		runtimeId: input.identity.runtimeId,
 		machineId: input.identity.machineId,
 		credentialEpoch: input.identity.credentialEpoch
@@ -453,7 +452,7 @@ function bootstrapRuntimeControlAuthorityFromNarrowGrant(input) {
 	const claims = verifyCmmdRuntimeTicket(input.grantToken, {
 		publicKeyPem: input.identity.publicKeyPem,
 		orgId: input.identity.orgId,
-		projectId: input.identity.projectId,
+		userId: input.identity.userId,
 		runtimeId: input.identity.runtimeId,
 		machineId: input.identity.machineId,
 		credentialEpoch: input.identity.credentialEpoch
@@ -598,4 +597,4 @@ Object.defineProperty(exports, "verifyCmmdRuntimeTicketRefreshProof", {
 	}
 });
 
-//# sourceMappingURL=runtimeControlAuthority-SNBF5Mjy.cjs.map
+//# sourceMappingURL=runtimeControlAuthority-45DPznyK.cjs.map

package/dist/{runtimeControlAuthority-L85w5RTn.mjs → runtimeControlAuthority-akIBTI-S.mjs}

@@ -154,13 +154,12 @@ function runtimeTicketExpiration(payload, allowExpired) {
 function requiredRuntimeIdentity(payload) {
 	const userId = stringClaim(payload, "user_id");
 	const orgId = stringClaim(payload, "org_id");
-	const projectId = stringClaim(payload, "project_id");
 	const runtimeId = stringClaim(payload, "runtime_id");
-	if (!userId || !orgId || !projectId || !runtimeId) return null;
+	if (!userId || !orgId || !runtimeId) return null;
 	return {
 		userId,
 		orgId,
-		projectId,
+		projectId: stringClaim(payload, "project_id"),
 		runtimeId
 	};
 }
@@ -187,7 +186,7 @@ function exactMachineExpectationMatches(claims, expectations) {
 	return expectations.credentialEpoch === void 0 || claims.credentialEpoch === expectations.credentialEpoch;
 }
 function runtimeTicketExpectationsMatch(claims, expectations) {
-	return matchesExpected(claims.runtimeId, expectations.runtimeId) && matchesExpected(claims.orgId, expectations.orgId) && matchesExpected(claims.userId, expectations.userId) && matchesExpected(claims.projectId, expectations.projectId) && exactMachineExpectationMatches(claims, expectations);
+	return matchesExpected(claims.runtimeId, expectations.runtimeId) && matchesExpected(claims.orgId, expectations.orgId) && matchesExpected(claims.userId, expectations.userId) && exactMachineExpectationMatches(claims, expectations);
 }
 function verifyCmmdRuntimeTicketWithExpirationPolicy(token, expectations, allowExpired) {
 	const payload = verifiedRuntimeTicketPayload(token, expectations.publicKeyPem);
@@ -356,7 +355,7 @@ function storeRuntimeControlAuthority(input) {
 	const claims = verifyCmmdRuntimeTicket(input.envelope.controlTicket, {
 		publicKeyPem: input.identity.publicKeyPem,
 		orgId: input.identity.orgId,
-		projectId: input.identity.projectId,
+		userId: input.identity.userId,
 		runtimeId: input.identity.runtimeId,
 		machineId: input.identity.machineId,
 		credentialEpoch: input.identity.credentialEpoch
@@ -452,7 +451,7 @@ function bootstrapRuntimeControlAuthorityFromNarrowGrant(input) {
 	const claims = verifyCmmdRuntimeTicket(input.grantToken, {
 		publicKeyPem: input.identity.publicKeyPem,
 		orgId: input.identity.orgId,
-		projectId: input.identity.projectId,
+		userId: input.identity.userId,
 		runtimeId: input.identity.runtimeId,
 		machineId: input.identity.machineId,
 		credentialEpoch: input.identity.credentialEpoch
@@ -532,4 +531,4 @@ async function sendRuntimeControlHeartbeat(input) {
 //#endregion
 export { verifyCmmdAuthRuntimeTicket as a, verifyCmmdRuntimeTicketRefreshProof as c, createReadOnceFileTokenAccessor as d, sendRuntimeControlHeartbeat as i, runtimeGrantToken as l, bootstrapRuntimeControlAuthorityFromNarrowGrant as n, verifyCmmdClaudeReadinessTicket as o, readRuntimeControlAuthority as r, verifyCmmdRuntimeTicket as s, bootstrapRuntimeControlAuthority as t, setRuntimeGrantToken as u };
 
-//# sourceMappingURL=runtimeControlAuthority-L85w5RTn.mjs.map
+//# sourceMappingURL=runtimeControlAuthority-akIBTI-S.mjs.map

package/package.json

@@ -9,7 +9,7 @@
     "cmmd-forge": "dist/bin.mjs"
   },
   "type": "module",
-  "version": "0.9.11",
+  "version": "0.9.12",
   "engines": {
     "node": "^22.16 || ^23.11 || >=24.10"
   },