@cmmd-center/forge 0.9.11 → 0.9.13

package/dist/bin.cjs

@@ -12,7 +12,7 @@ const require_Cache = require("./Cache-U1fkdGvV.cjs");
 const require_SqlError = require("./SqlError-CSsHBaKF.cjs");
 const require_Mime = require("./Mime-Bilnh8zE.cjs");
 const require_esm = require("./esm-BZhXwX5p.cjs");
-const require_runtimeControlAuthority = require("./runtimeControlAuthority-SNBF5Mjy.cjs");
+const require_runtimeControlAuthority = require("./runtimeControlAuthority-45DPznyK.cjs");
 const require_PTY = require("./PTY-CNa0j0w2.cjs");
 let node_child_process = require("node:child_process");
 node_child_process = require_chunk.__toESM(node_child_process);
@@ -65123,7 +65123,7 @@ function normalizeNumberish(value) {
 }
 //#endregion
 //#region package.json
-var version$1 = "0.9.11";
+var version$1 = "0.9.13";
 //#endregion
 //#region src/sentry.ts
 const SERVER_APP_NAME = "forge-server";
@@ -85575,7 +85575,7 @@ function isBrokerScope(scope) {
 	return brokerScopes.has(scope);
 }
 function hasSameExactIdentity(authority, claims) {
-	return authority.orgId === claims.orgId && authority.userId === claims.userId && authority.projectId === claims.projectId && authority.runtimeId === claims.runtimeId && authority.machineId === claims.machineId && authority.credentialEpoch === claims.credentialEpoch;
+	return authority.orgId === claims.orgId && authority.userId === claims.userId && authority.runtimeId === claims.runtimeId && authority.machineId === claims.machineId && authority.credentialEpoch === claims.credentialEpoch;
 }
 function firstSessionAuthority(sessionAuthorities) {
 	if (!sessionAuthorities) return void 0;
@@ -85609,7 +85609,6 @@ function recordRuntimeBrokerAuthority(input) {
 		token: input.token,
 		orgId: claims.orgId,
 		userId: claims.userId,
-		projectId: claims.projectId,
 		runtimeId: claims.runtimeId,
 		machineId: claims.machineId,
 		credentialEpoch: claims.credentialEpoch,
@@ -97154,6 +97153,7 @@ const runClaudeLogout = (runtime) => new Promise((resolve, reject) => {
 const execFileAsync$4 = (0, node_util.promisify)(node_child_process.execFile);
 const USAGE_ARGS = [
 	"--safe-mode",
+	"--no-session-persistence",
 	"-p",
 	"/usage",
 	"--output-format",
@@ -97221,7 +97221,7 @@ function zonedDateTimeToUtc(input) {
 	}
 }
 function parseResetAt(value, now) {
-	const match = /^(Jan|Feb|Mar|Apr|May|Jun|Jul|Aug|Sep|Oct|Nov|Dec) (\d{1,2}) at (\d{1,2})(?::(\d{2}))?(am|pm) \(([^)]+)\)$/.exec(value);
+	const match = /^(Jan|Feb|Mar|Apr|May|Jun|Jul|Aug|Sep|Oct|Nov|Dec) (\d{1,2})(?:,| at) (\d{1,2})(?::(\d{2}))?(am|pm) \(([^)]+)\)$/.exec(value);
 	if (!match) return null;
 	const month = MONTH_BY_NAME[match[1]];
 	if (month === void 0) return null;
@@ -224916,6 +224916,9 @@ function isMissingGitCwdError(error) {
 	const normalized = `${error.detail}\n${error.message}`.toLowerCase();
 	return normalized.includes("no such file or directory") || normalized.includes("notfound: filesystem.access") || normalized.includes("enoent") || normalized.includes("not a directory");
 }
+function isUnregisteredWorktreeError(error) {
+	return `${error.detail}\n${error.message}`.toLowerCase().includes("is not a working tree");
+}
 function toGitCommandError(input, detail) {
 	return (cause) => require_Schema$1.is(GitCommandError)(cause) ? cause : new GitCommandError({
 		operation: input.operation,
@@ -225315,6 +225318,20 @@ const makeGitCore = require_Schema$1.fn("makeGitCore")(function* (options) {
 		if (firstRemote) return firstRemote;
 		return yield* createGitCommandError("GitCore.resolvePrimaryRemoteName", cwd, ["remote"], "No git remote is configured for this repository.");
 	});
+	const resolveNormalizedPrimaryRemoteUrl = require_Schema$1.fn("resolveNormalizedPrimaryRemoteUrl")(function* (cwd) {
+		const remoteName = yield* resolvePrimaryRemoteName(cwd);
+		const remoteUrl = yield* runGitStdout("GitCore.resolvePrimaryRemoteUrl", cwd, [
+			"remote",
+			"get-url",
+			remoteName
+		]).pipe(require_Schema$1.map((stdout) => normalizeRemoteUrl(stdout)));
+		if (remoteUrl.length > 0) return remoteUrl;
+		return yield* createGitCommandError("GitCore.resolvePrimaryRemoteUrl", cwd, [
+			"remote",
+			"get-url",
+			remoteName
+		], `Remote '${remoteName}' has no URL.`);
+	});
 	const resolvePushRemoteName = require_Schema$1.fn("resolvePushRemoteName")(function* (cwd, branch) {
 		const branchPushRemote = yield* runGitStdout("GitCore.resolvePushRemoteName.branchPushRemote", cwd, [
 			"config",
@@ -225986,10 +226003,33 @@ const makeGitCore = require_Schema$1.fn("makeGitCore")(function* (options) {
 		const args = ["worktree", "remove"];
 		if (input.force) args.push("--force");
 		args.push(input.path);
-		yield* executeGit("GitCore.removeWorktree", input.cwd, args, {
+		const executeRemoval = (cwd, removalArgs) => executeGit("GitCore.removeWorktree", cwd, removalArgs, {
 			timeoutMs: 15e3,
 			fallbackErrorMessage: "git worktree remove failed"
-		}).pipe(require_Schema$1.mapError((error) => createGitCommandError("GitCore.removeWorktree", input.cwd, args, `${commandLabel(args)} failed (cwd: ${input.cwd}): ${error.message}`, error)));
+		}).pipe(require_Schema$1.mapError((error) => createGitCommandError("GitCore.removeWorktree", cwd, removalArgs, `${commandLabel(removalArgs)} failed (cwd: ${cwd}): ${error.message}`, error)), require_Schema$1.asVoid);
+		yield* executeRemoval(input.cwd, args).pipe(require_Schema$1.catch_((originalError) => {
+			if (!input.force || !isUnregisteredWorktreeError(originalError)) return require_Schema$1.fail(originalError);
+			return require_Schema$1.gen(function* () {
+				const targetExists = yield* require_Schema$1.option(fileSystem.exists(input.path));
+				if (require_Schema$1.isNone(targetExists)) return yield* originalError;
+				if (!targetExists.value) return;
+				const ownerContext = yield* require_Schema$1.option(require_Schema$1.all({
+					callerRemoteUrl: resolveNormalizedPrimaryRemoteUrl(input.cwd),
+					targetRemoteUrl: resolveNormalizedPrimaryRemoteUrl(input.path),
+					targetGitCommonDir: resolveGitCommonDir(input.path)
+				}));
+				if (require_Schema$1.isNone(ownerContext) || ownerContext.value.callerRemoteUrl !== ownerContext.value.targetRemoteUrl) return yield* originalError;
+				const ownerArgs = [
+					"--git-dir",
+					ownerContext.value.targetGitCommonDir,
+					"worktree",
+					"remove",
+					"--force",
+					input.path
+				];
+				yield* executeRemoval(input.cwd, ownerArgs);
+			});
+		}));
 	});
 	const pruneWorktrees = require_Schema$1.fn("pruneWorktrees")(function* (cwd) {
 		yield* executeGit("GitCore.pruneWorktrees", cwd, [
@@ -280383,7 +280423,7 @@ function currentGrantClaimsForRefresh(input) {
 	});
 }
 function sameRuntimeOwnership(currentClaims, refreshedClaims) {
-	return refreshedClaims.orgId === currentClaims.orgId && refreshedClaims.userId === currentClaims.userId && refreshedClaims.projectId === currentClaims.projectId;
+	return refreshedClaims.orgId === currentClaims.orgId && refreshedClaims.userId === currentClaims.userId;
 }
 function sameScopeSet(left, right) {
 	const leftScopes = new Set(left);
@@ -290138,11 +290178,10 @@ function readCmmdRuntimeAuthConfig(serverConfig) {
 		serverConfig.forgeCmmdRuntimePublicKey,
 		serverConfig.forgeCmmdRuntimeId,
 		serverConfig.forgeCmmdRuntimeOrgId,
-		serverConfig.forgeCmmdRuntimeUserId,
-		serverConfig.forgeCmmdRuntimeProjectId
+		serverConfig.forgeCmmdRuntimeUserId
 	].map((value) => value?.trim() ?? "");
 	if (required.some((value) => value.length === 0)) return null;
-	const [publicKeyPem, runtimeId, orgId, userId, projectId] = required;
+	const [publicKeyPem, runtimeId, orgId, userId] = required;
 	const machineId = serverConfig.forgeCmmdRuntimeMachineId?.trim();
 	const credentialEpoch = serverConfig.forgeCmmdRuntimeCredentialEpoch;
 	const brokerIdentity = classifyRuntimeBrokerIdentity({
@@ -290156,7 +290195,6 @@ function readCmmdRuntimeAuthConfig(serverConfig) {
 		runtimeId,
 		orgId,
 		userId,
-		projectId,
 		...brokerIdentity.mode === "exact" ? {
 			machineId: brokerIdentity.machineId,
 			credentialEpoch: brokerIdentity.credentialEpoch
@@ -298659,9 +298697,10 @@ const cmmdForgeCloudProjectRemovalReceiptRouteLayer = registerProxyRoute({
 });
 const FORGE_RUNTIMES_POLL_INTERVAL = require_Schema$1.seconds(5);
 const FORGE_RUNTIMES_KEEPALIVE_INTERVAL = require_Schema$1.seconds(25);
-function encodeForgeCloudProjectsFrame(projects, capacity = null) {
+function encodeForgeCloudProjectsFrame(projects, environments, capacity = null) {
 	return new TextEncoder().encode(`event: cloud-projects\ndata: ${JSON.stringify({
 		projects,
+		environments,
 		capacity
 	})}\n\n`);
 }
@@ -298705,7 +298744,10 @@ function makeFetchCloudProjectsFrameEffect(upstreamUrl, accessToken) {
 		}
 		const json = await res.json();
 		const unwrapped = json && typeof json === "object" && "data" in json && json["data"] ? json["data"] : json;
-		return encodeForgeCloudProjectsFrame(Array.isArray(unwrapped?.["projects"]) ? unwrapped["projects"] : [], unwrapped?.["capacity"] ?? null);
+		const projects = unwrapped?.["projects"];
+		const environments = unwrapped?.["environments"];
+		if (!Array.isArray(projects) || !Array.isArray(environments)) return null;
+		return encodeForgeCloudProjectsFrame(projects, environments, unwrapped?.["capacity"] ?? null);
 	})).pipe(require_Schema$1.catch_(() => require_Schema$1.succeed(null)));
 }
 const cmmdForgeCloudProjectsEventsRouteLayer = add$1("GET", "/api/cmmd/forge-cloud-projects/events", require_Schema$1.gen(function* () {
@@ -305298,21 +305340,27 @@ function invalidAuthority(message, cause) {
 		...cause === void 0 ? {} : { cause }
 	});
 }
+/**
+* There is no project in a runtime's identity. A runtime serves every project
+* of one user, so a project id neither identifies it nor narrows it. Everything
+* here stays required: without a key, org, user, runtime, machine and epoch
+* there is nothing to verify a provider ticket against, and refusing is the
+* only safe answer.
+*/
 function resolveExactRuntimeIdentity(config) {
 	const identity = {
 		publicKeyPem: config.forgeCmmdRuntimePublicKey?.trim(),
 		orgId: config.forgeCmmdRuntimeOrgId?.trim(),
 		userId: config.forgeCmmdRuntimeUserId?.trim(),
-		projectId: config.forgeCmmdRuntimeProjectId?.trim(),
 		runtimeId: config.forgeCmmdRuntimeId?.trim(),
 		machineId: config.forgeCmmdRuntimeMachineId?.trim(),
 		credentialEpoch: config.forgeCmmdRuntimeCredentialEpoch
 	};
-	if (!identity.publicKeyPem || !identity.orgId || !identity.userId || !identity.projectId || !identity.runtimeId || !identity.machineId || identity.credentialEpoch === void 0) throw invalidAuthority("The exact CMMD runtime identity is not configured.");
+	if (!identity.publicKeyPem || !identity.orgId || !identity.userId || !identity.runtimeId || !identity.machineId || identity.credentialEpoch === void 0) throw invalidAuthority("The exact CMMD runtime identity is not configured.");
 	return identity;
 }
 function assertAutomationAuthorityMatchesRuntime(authority, identity) {
-	if (String(authority.organizationId) !== identity.orgId || String(authority.projectId) !== identity.projectId || authority.runtimeId !== identity.runtimeId) throw invalidAuthority("The automation authority does not match this runtime.");
+	if (String(authority.organizationId) !== identity.orgId || authority.runtimeId !== identity.runtimeId) throw invalidAuthority("The automation authority does not match this runtime.");
 }
 function verifyProviderAuthority(heartbeat, identity) {
 	const descriptor = heartbeat.providerAuthority;
@@ -309516,7 +309564,6 @@ const completeClaudeReadinessExpectations = (config) => {
 		runtimeId: config.forgeCmmdRuntimeId?.trim() ?? "",
 		orgId: config.forgeCmmdRuntimeOrgId?.trim() ?? "",
 		userId: config.forgeCmmdRuntimeUserId?.trim() ?? "",
-		projectId: config.forgeCmmdRuntimeProjectId?.trim() ?? "",
 		machineId: config.forgeCmmdRuntimeMachineId?.trim() ?? "",
 		credentialEpoch: config.forgeCmmdRuntimeCredentialEpoch
 	};
@@ -309545,7 +309592,6 @@ const claudeNativeGenerationProofRouteLayer = add$1("GET", "/api/runtime/provide
 		runtimeId: required.runtimeId,
 		orgId: required.orgId,
 		userId: required.userId,
-		projectId: required.projectId,
 		machineId: required.machineId,
 		credentialEpoch: required.credentialEpoch
 	});

package/dist/bin.mjs

@@ -11,7 +11,7 @@ import { a as make$48, i as keys, n as getOption, o as makeWith$1, r as invalida
 import { S as layer$9, _ as defaultEscape, a as DeadlockError, b as makeCompiler$1, c as SqlError, d as UnknownError, g as custom, h as make$49, i as ConstraintError, l as SqlSyntaxError, m as SqlClient, n as AuthorizationError, o as LockTimeoutError, r as ConnectionError, s as SerializationError, t as AuthenticationError, u as StatementTimeoutError, v as defaultTransforms, y as fragment } from "./SqlError-B2g5pJux.mjs";
 import { r as wrapper_default, t as Mime_default } from "./Mime-Dq9IoNiV.mjs";
 import { a as diag, c as SpanKind$1, d as TraceFlags, f as ROOT_CONTEXT, i as propagation, l as isSpanContextValid, m as DiagLogLevel, n as init_esm$1, o as context$1, p as createContextKey, r as trace, s as SpanStatusCode, t as esm_exports$1 } from "./esm-wLIF-u3N.mjs";
-import { a as verifyCmmdAuthRuntimeTicket, c as verifyCmmdRuntimeTicketRefreshProof, d as createReadOnceFileTokenAccessor, i as sendRuntimeControlHeartbeat, l as runtimeGrantToken, n as bootstrapRuntimeControlAuthorityFromNarrowGrant, o as verifyCmmdClaudeReadinessTicket, r as readRuntimeControlAuthority, s as verifyCmmdRuntimeTicket, t as bootstrapRuntimeControlAuthority, u as setRuntimeGrantToken } from "./runtimeControlAuthority-L85w5RTn.mjs";
+import { a as verifyCmmdAuthRuntimeTicket, c as verifyCmmdRuntimeTicketRefreshProof, d as createReadOnceFileTokenAccessor, i as sendRuntimeControlHeartbeat, l as runtimeGrantToken, n as bootstrapRuntimeControlAuthorityFromNarrowGrant, o as verifyCmmdClaudeReadinessTicket, r as readRuntimeControlAuthority, s as verifyCmmdRuntimeTicket, t as bootstrapRuntimeControlAuthority, u as setRuntimeGrantToken } from "./runtimeControlAuthority-akIBTI-S.mjs";
 import { n as PtySpawnError, t as PtyAdapter } from "./PTY-Cx_YKiEO.mjs";
 import { createRequire } from "node:module";
 import * as HE from "node:child_process";
@@ -64870,7 +64870,7 @@ function normalizeNumberish(value) {
 }
 //#endregion
 //#region package.json
-var version$1 = "0.9.11";
+var version$1 = "0.9.13";
 //#endregion
 //#region src/sentry.ts
 const SERVER_APP_NAME = "forge-server";
@@ -85267,7 +85267,7 @@ function isBrokerScope(scope) {
 	return brokerScopes.has(scope);
 }
 function hasSameExactIdentity(authority, claims) {
-	return authority.orgId === claims.orgId && authority.userId === claims.userId && authority.projectId === claims.projectId && authority.runtimeId === claims.runtimeId && authority.machineId === claims.machineId && authority.credentialEpoch === claims.credentialEpoch;
+	return authority.orgId === claims.orgId && authority.userId === claims.userId && authority.runtimeId === claims.runtimeId && authority.machineId === claims.machineId && authority.credentialEpoch === claims.credentialEpoch;
 }
 function firstSessionAuthority(sessionAuthorities) {
 	if (!sessionAuthorities) return void 0;
@@ -85301,7 +85301,6 @@ function recordRuntimeBrokerAuthority(input) {
 		token: input.token,
 		orgId: claims.orgId,
 		userId: claims.userId,
-		projectId: claims.projectId,
 		runtimeId: claims.runtimeId,
 		machineId: claims.machineId,
 		credentialEpoch: claims.credentialEpoch,
@@ -96826,6 +96825,7 @@ const runClaudeLogout = (runtime) => new Promise((resolve, reject) => {
 const execFileAsync$4 = promisify$1(execFile);
 const USAGE_ARGS = [
 	"--safe-mode",
+	"--no-session-persistence",
 	"-p",
 	"/usage",
 	"--output-format",
@@ -96893,7 +96893,7 @@ function zonedDateTimeToUtc(input) {
 	}
 }
 function parseResetAt(value, now) {
-	const match = /^(Jan|Feb|Mar|Apr|May|Jun|Jul|Aug|Sep|Oct|Nov|Dec) (\d{1,2}) at (\d{1,2})(?::(\d{2}))?(am|pm) \(([^)]+)\)$/.exec(value);
+	const match = /^(Jan|Feb|Mar|Apr|May|Jun|Jul|Aug|Sep|Oct|Nov|Dec) (\d{1,2})(?:,| at) (\d{1,2})(?::(\d{2}))?(am|pm) \(([^)]+)\)$/.exec(value);
 	if (!match) return null;
 	const month = MONTH_BY_NAME[match[1]];
 	if (month === void 0) return null;
@@ -224525,6 +224525,9 @@ function isMissingGitCwdError(error) {
 	const normalized = `${error.detail}\n${error.message}`.toLowerCase();
 	return normalized.includes("no such file or directory") || normalized.includes("notfound: filesystem.access") || normalized.includes("enoent") || normalized.includes("not a directory");
 }
+function isUnregisteredWorktreeError(error) {
+	return `${error.detail}\n${error.message}`.toLowerCase().includes("is not a working tree");
+}
 function toGitCommandError(input, detail) {
 	return (cause) => is$1(GitCommandError)(cause) ? cause : new GitCommandError({
 		operation: input.operation,
@@ -224920,6 +224923,20 @@ const GitCoreLive = effect(GitCore, fn$1("makeGitCore")(function* (options) {
 		if (firstRemote) return firstRemote;
 		return yield* createGitCommandError("GitCore.resolvePrimaryRemoteName", cwd, ["remote"], "No git remote is configured for this repository.");
 	});
+	const resolveNormalizedPrimaryRemoteUrl = fn$1("resolveNormalizedPrimaryRemoteUrl")(function* (cwd) {
+		const remoteName = yield* resolvePrimaryRemoteName(cwd);
+		const remoteUrl = yield* runGitStdout("GitCore.resolvePrimaryRemoteUrl", cwd, [
+			"remote",
+			"get-url",
+			remoteName
+		]).pipe(map$3((stdout) => normalizeRemoteUrl(stdout)));
+		if (remoteUrl.length > 0) return remoteUrl;
+		return yield* createGitCommandError("GitCore.resolvePrimaryRemoteUrl", cwd, [
+			"remote",
+			"get-url",
+			remoteName
+		], `Remote '${remoteName}' has no URL.`);
+	});
 	const resolvePushRemoteName = fn$1("resolvePushRemoteName")(function* (cwd, branch) {
 		const branchPushRemote = yield* runGitStdout("GitCore.resolvePushRemoteName.branchPushRemote", cwd, [
 			"config",
@@ -225591,10 +225608,33 @@ const GitCoreLive = effect(GitCore, fn$1("makeGitCore")(function* (options) {
 		const args = ["worktree", "remove"];
 		if (input.force) args.push("--force");
 		args.push(input.path);
-		yield* executeGit("GitCore.removeWorktree", input.cwd, args, {
+		const executeRemoval = (cwd, removalArgs) => executeGit("GitCore.removeWorktree", cwd, removalArgs, {
 			timeoutMs: 15e3,
 			fallbackErrorMessage: "git worktree remove failed"
-		}).pipe(mapError((error) => createGitCommandError("GitCore.removeWorktree", input.cwd, args, `${commandLabel(args)} failed (cwd: ${input.cwd}): ${error.message}`, error)));
+		}).pipe(mapError((error) => createGitCommandError("GitCore.removeWorktree", cwd, removalArgs, `${commandLabel(removalArgs)} failed (cwd: ${cwd}): ${error.message}`, error)), asVoid);
+		yield* executeRemoval(input.cwd, args).pipe(catch_((originalError) => {
+			if (!input.force || !isUnregisteredWorktreeError(originalError)) return fail(originalError);
+			return gen(function* () {
+				const targetExists = yield* option(fileSystem.exists(input.path));
+				if (isNone(targetExists)) return yield* originalError;
+				if (!targetExists.value) return;
+				const ownerContext = yield* option(all({
+					callerRemoteUrl: resolveNormalizedPrimaryRemoteUrl(input.cwd),
+					targetRemoteUrl: resolveNormalizedPrimaryRemoteUrl(input.path),
+					targetGitCommonDir: resolveGitCommonDir(input.path)
+				}));
+				if (isNone(ownerContext) || ownerContext.value.callerRemoteUrl !== ownerContext.value.targetRemoteUrl) return yield* originalError;
+				const ownerArgs = [
+					"--git-dir",
+					ownerContext.value.targetGitCommonDir,
+					"worktree",
+					"remove",
+					"--force",
+					input.path
+				];
+				yield* executeRemoval(input.cwd, ownerArgs);
+			});
+		}));
 	});
 	const pruneWorktrees = fn$1("pruneWorktrees")(function* (cwd) {
 		yield* executeGit("GitCore.pruneWorktrees", cwd, [
@@ -279940,7 +279980,7 @@ function currentGrantClaimsForRefresh(input) {
 	});
 }
 function sameRuntimeOwnership(currentClaims, refreshedClaims) {
-	return refreshedClaims.orgId === currentClaims.orgId && refreshedClaims.userId === currentClaims.userId && refreshedClaims.projectId === currentClaims.projectId;
+	return refreshedClaims.orgId === currentClaims.orgId && refreshedClaims.userId === currentClaims.userId;
 }
 function sameScopeSet(left, right) {
 	const leftScopes = new Set(left);
@@ -289628,11 +289668,10 @@ function readCmmdRuntimeAuthConfig(serverConfig) {
 		serverConfig.forgeCmmdRuntimePublicKey,
 		serverConfig.forgeCmmdRuntimeId,
 		serverConfig.forgeCmmdRuntimeOrgId,
-		serverConfig.forgeCmmdRuntimeUserId,
-		serverConfig.forgeCmmdRuntimeProjectId
+		serverConfig.forgeCmmdRuntimeUserId
 	].map((value) => value?.trim() ?? "");
 	if (required.some((value) => value.length === 0)) return null;
-	const [publicKeyPem, runtimeId, orgId, userId, projectId] = required;
+	const [publicKeyPem, runtimeId, orgId, userId] = required;
 	const machineId = serverConfig.forgeCmmdRuntimeMachineId?.trim();
 	const credentialEpoch = serverConfig.forgeCmmdRuntimeCredentialEpoch;
 	const brokerIdentity = classifyRuntimeBrokerIdentity({
@@ -289646,7 +289685,6 @@ function readCmmdRuntimeAuthConfig(serverConfig) {
 		runtimeId,
 		orgId,
 		userId,
-		projectId,
 		...brokerIdentity.mode === "exact" ? {
 			machineId: brokerIdentity.machineId,
 			credentialEpoch: brokerIdentity.credentialEpoch
@@ -298089,9 +298127,10 @@ const cmmdForgeCloudProjectRemovalReceiptRouteLayer = registerProxyRoute({
 });
 const FORGE_RUNTIMES_POLL_INTERVAL = seconds(5);
 const FORGE_RUNTIMES_KEEPALIVE_INTERVAL = seconds(25);
-function encodeForgeCloudProjectsFrame(projects, capacity = null) {
+function encodeForgeCloudProjectsFrame(projects, environments, capacity = null) {
 	return new TextEncoder().encode(`event: cloud-projects\ndata: ${JSON.stringify({
 		projects,
+		environments,
 		capacity
 	})}\n\n`);
 }
@@ -298135,7 +298174,10 @@ function makeFetchCloudProjectsFrameEffect(upstreamUrl, accessToken) {
 		}
 		const json = await res.json();
 		const unwrapped = json && typeof json === "object" && "data" in json && json["data"] ? json["data"] : json;
-		return encodeForgeCloudProjectsFrame(Array.isArray(unwrapped?.["projects"]) ? unwrapped["projects"] : [], unwrapped?.["capacity"] ?? null);
+		const projects = unwrapped?.["projects"];
+		const environments = unwrapped?.["environments"];
+		if (!Array.isArray(projects) || !Array.isArray(environments)) return null;
+		return encodeForgeCloudProjectsFrame(projects, environments, unwrapped?.["capacity"] ?? null);
 	})).pipe(catch_(() => succeed(null)));
 }
 const cmmdForgeCloudProjectsEventsRouteLayer = add$1("GET", "/api/cmmd/forge-cloud-projects/events", gen(function* () {
@@ -304697,21 +304739,27 @@ function invalidAuthority(message, cause) {
 		...cause === void 0 ? {} : { cause }
 	});
 }
+/**
+* There is no project in a runtime's identity. A runtime serves every project
+* of one user, so a project id neither identifies it nor narrows it. Everything
+* here stays required: without a key, org, user, runtime, machine and epoch
+* there is nothing to verify a provider ticket against, and refusing is the
+* only safe answer.
+*/
 function resolveExactRuntimeIdentity(config) {
 	const identity = {
 		publicKeyPem: config.forgeCmmdRuntimePublicKey?.trim(),
 		orgId: config.forgeCmmdRuntimeOrgId?.trim(),
 		userId: config.forgeCmmdRuntimeUserId?.trim(),
-		projectId: config.forgeCmmdRuntimeProjectId?.trim(),
 		runtimeId: config.forgeCmmdRuntimeId?.trim(),
 		machineId: config.forgeCmmdRuntimeMachineId?.trim(),
 		credentialEpoch: config.forgeCmmdRuntimeCredentialEpoch
 	};
-	if (!identity.publicKeyPem || !identity.orgId || !identity.userId || !identity.projectId || !identity.runtimeId || !identity.machineId || identity.credentialEpoch === void 0) throw invalidAuthority("The exact CMMD runtime identity is not configured.");
+	if (!identity.publicKeyPem || !identity.orgId || !identity.userId || !identity.runtimeId || !identity.machineId || identity.credentialEpoch === void 0) throw invalidAuthority("The exact CMMD runtime identity is not configured.");
 	return identity;
 }
 function assertAutomationAuthorityMatchesRuntime(authority, identity) {
-	if (String(authority.organizationId) !== identity.orgId || String(authority.projectId) !== identity.projectId || authority.runtimeId !== identity.runtimeId) throw invalidAuthority("The automation authority does not match this runtime.");
+	if (String(authority.organizationId) !== identity.orgId || authority.runtimeId !== identity.runtimeId) throw invalidAuthority("The automation authority does not match this runtime.");
 }
 function verifyProviderAuthority(heartbeat, identity) {
 	const descriptor = heartbeat.providerAuthority;
@@ -308901,7 +308949,6 @@ const completeClaudeReadinessExpectations = (config) => {
 		runtimeId: config.forgeCmmdRuntimeId?.trim() ?? "",
 		orgId: config.forgeCmmdRuntimeOrgId?.trim() ?? "",
 		userId: config.forgeCmmdRuntimeUserId?.trim() ?? "",
-		projectId: config.forgeCmmdRuntimeProjectId?.trim() ?? "",
 		machineId: config.forgeCmmdRuntimeMachineId?.trim() ?? "",
 		credentialEpoch: config.forgeCmmdRuntimeCredentialEpoch
 	};
@@ -308930,7 +308977,6 @@ const claudeNativeGenerationProofRouteLayer = add$1("GET", "/api/runtime/provide
 		runtimeId: required.runtimeId,
 		orgId: required.orgId,
 		userId: required.userId,
-		projectId: required.projectId,
 		machineId: required.machineId,
 		credentialEpoch: required.credentialEpoch
 	});