@cmmd-center/forge 0.9.12 → 0.9.14

package/dist/{runtimeControlAuthority-45DPznyK.cjs → runtimeControlAuthority-BdIovv-r.cjs}

@@ -75,6 +75,8 @@ function setRuntimeGrantToken(token) {
 //#region src/runtimeAuth/cmmdRuntimeTicket.ts
 const CMMD_CLAUDE_READINESS_TICKET_AUDIENCE = "forge-claude-readiness";
 const CMMD_CLAUDE_READINESS_TICKET_SCOPE = "claude-readiness-probe";
+const CMMD_CLAUDE_USAGE_TICKET_AUDIENCE = "forge-claude-usage";
+const CMMD_CLAUDE_USAGE_TICKET_SCOPE = "claude-usage";
 function decodeBase64UrlJson(value) {
 	try {
 		return JSON.parse(Buffer.from(value, "base64url").toString("utf8"));
@@ -146,6 +148,25 @@ function verifyCmmdClaudeReadinessTicket(token, expectations) {
 		jti
 	} : null;
 }
+function verifyCmmdClaudeUsageTicket(token, expectations) {
+	const payload = verifiedRuntimeTicketPayload(token, expectations.publicKeyPem, CMMD_CLAUDE_USAGE_TICKET_AUDIENCE);
+	if (!payload) return null;
+	const claims = runtimeTicketClaims(payload, false);
+	if (!claims || !runtimeTicketExpectationsMatch(claims, expectations)) return null;
+	const jti = stringClaim(payload, "jti");
+	const providerAccountId = stringClaim(payload, "provider_account_id");
+	const generationId = stringClaim(payload, "credential_generation_id");
+	const issuedAtSeconds = nonNegativeIntegerClaim(payload["iat"]);
+	const notBeforeSeconds = nonNegativeIntegerClaim(payload["nbf"]);
+	const nowSeconds = Math.floor(Date.now() / 1e3);
+	if (!jti || !providerAccountId || !generationId || issuedAtSeconds === null || notBeforeSeconds === null || notBeforeSeconds > nowSeconds || issuedAtSeconds > nowSeconds + 5 || claims.expiresAtSeconds - issuedAtSeconds > 90 || claims.scope.length !== 1 || claims.scope[0] !== CMMD_CLAUDE_USAGE_TICKET_SCOPE) return null;
+	return {
+		...claims,
+		jti,
+		providerAccountId,
+		generationId
+	};
+}
 function runtimeTicketExpiration(payload, allowExpired) {
 	const expiresAtSeconds = payload["exp"];
 	if (typeof expiresAtSeconds !== "number" || !Number.isFinite(expiresAtSeconds)) return null;
@@ -584,6 +605,12 @@ Object.defineProperty(exports, "verifyCmmdClaudeReadinessTicket", {
 		return verifyCmmdClaudeReadinessTicket;
 	}
 });
+Object.defineProperty(exports, "verifyCmmdClaudeUsageTicket", {
+	enumerable: true,
+	get: function() {
+		return verifyCmmdClaudeUsageTicket;
+	}
+});
 Object.defineProperty(exports, "verifyCmmdRuntimeTicket", {
 	enumerable: true,
 	get: function() {
@@ -597,4 +624,4 @@ Object.defineProperty(exports, "verifyCmmdRuntimeTicketRefreshProof", {
 	}
 });
 
-//# sourceMappingURL=runtimeControlAuthority-45DPznyK.cjs.map
+//# sourceMappingURL=runtimeControlAuthority-BdIovv-r.cjs.map

package/dist/{runtimeControlAuthority-akIBTI-S.mjs → runtimeControlAuthority-COHmz_WT.mjs}

@@ -74,6 +74,8 @@ function setRuntimeGrantToken(token) {
 //#region src/runtimeAuth/cmmdRuntimeTicket.ts
 const CMMD_CLAUDE_READINESS_TICKET_AUDIENCE = "forge-claude-readiness";
 const CMMD_CLAUDE_READINESS_TICKET_SCOPE = "claude-readiness-probe";
+const CMMD_CLAUDE_USAGE_TICKET_AUDIENCE = "forge-claude-usage";
+const CMMD_CLAUDE_USAGE_TICKET_SCOPE = "claude-usage";
 function decodeBase64UrlJson(value) {
 	try {
 		return JSON.parse(Buffer.from(value, "base64url").toString("utf8"));
@@ -145,6 +147,25 @@ function verifyCmmdClaudeReadinessTicket(token, expectations) {
 		jti
 	} : null;
 }
+function verifyCmmdClaudeUsageTicket(token, expectations) {
+	const payload = verifiedRuntimeTicketPayload(token, expectations.publicKeyPem, CMMD_CLAUDE_USAGE_TICKET_AUDIENCE);
+	if (!payload) return null;
+	const claims = runtimeTicketClaims(payload, false);
+	if (!claims || !runtimeTicketExpectationsMatch(claims, expectations)) return null;
+	const jti = stringClaim(payload, "jti");
+	const providerAccountId = stringClaim(payload, "provider_account_id");
+	const generationId = stringClaim(payload, "credential_generation_id");
+	const issuedAtSeconds = nonNegativeIntegerClaim(payload["iat"]);
+	const notBeforeSeconds = nonNegativeIntegerClaim(payload["nbf"]);
+	const nowSeconds = Math.floor(Date.now() / 1e3);
+	if (!jti || !providerAccountId || !generationId || issuedAtSeconds === null || notBeforeSeconds === null || notBeforeSeconds > nowSeconds || issuedAtSeconds > nowSeconds + 5 || claims.expiresAtSeconds - issuedAtSeconds > 90 || claims.scope.length !== 1 || claims.scope[0] !== CMMD_CLAUDE_USAGE_TICKET_SCOPE) return null;
+	return {
+		...claims,
+		jti,
+		providerAccountId,
+		generationId
+	};
+}
 function runtimeTicketExpiration(payload, allowExpired) {
 	const expiresAtSeconds = payload["exp"];
 	if (typeof expiresAtSeconds !== "number" || !Number.isFinite(expiresAtSeconds)) return null;
@@ -529,6 +550,6 @@ async function sendRuntimeControlHeartbeat(input) {
 	};
 }
 //#endregion
-export { verifyCmmdAuthRuntimeTicket as a, verifyCmmdRuntimeTicketRefreshProof as c, createReadOnceFileTokenAccessor as d, sendRuntimeControlHeartbeat as i, runtimeGrantToken as l, bootstrapRuntimeControlAuthorityFromNarrowGrant as n, verifyCmmdClaudeReadinessTicket as o, readRuntimeControlAuthority as r, verifyCmmdRuntimeTicket as s, bootstrapRuntimeControlAuthority as t, setRuntimeGrantToken as u };
+export { verifyCmmdAuthRuntimeTicket as a, verifyCmmdRuntimeTicket as c, setRuntimeGrantToken as d, createReadOnceFileTokenAccessor as f, sendRuntimeControlHeartbeat as i, verifyCmmdRuntimeTicketRefreshProof as l, bootstrapRuntimeControlAuthorityFromNarrowGrant as n, verifyCmmdClaudeReadinessTicket as o, readRuntimeControlAuthority as r, verifyCmmdClaudeUsageTicket as s, bootstrapRuntimeControlAuthority as t, runtimeGrantToken as u };
 
-//# sourceMappingURL=runtimeControlAuthority-akIBTI-S.mjs.map
+//# sourceMappingURL=runtimeControlAuthority-COHmz_WT.mjs.map

package/package.json

@@ -9,7 +9,7 @@
     "cmmd-forge": "dist/bin.mjs"
   },
   "type": "module",
-  "version": "0.9.12",
+  "version": "0.9.14",
   "engines": {
     "node": "^22.16 || ^23.11 || >=24.10"
   },
@@ -41,9 +41,10 @@
     "@opentelemetry/core": "2.10.0",
     "ajv": "8.20.0",
     "brace-expansion": "5.0.9",
+    "browserslist": "4.28.7",
     "dompurify": "3.4.13",
     "esbuild": "0.28.1",
-    "fast-uri": "4.1.2",
+    "fast-uri": "4.1.3",
     "js-yaml": "4.3.1",
     "nanoid": "3.3.18",
     "picomatch": "4.0.5",