@cmmd-center/forge 0.9.2 → 0.9.4

package/dist/runtimeControlAuthority-Dm9z5ziU.mjs

@@ -0,0 +1,505 @@
+#!/usr/bin/env node
+
+import { createPublicKey, timingSafeEqual, verify } from "node:crypto";
+import { readFileSync, unlinkSync } from "node:fs";
+//#region src/auth/readOnceFileToken.ts
+function createReadOnceFileTokenAccessor(config) {
+	let cachedFileToken = null;
+	let fileTokenResolved = false;
+	function readAndConsumeTokenFile(path) {
+		let contents;
+		try {
+			contents = readFileSync(path, "utf8");
+		} catch {
+			return null;
+		}
+		try {
+			unlinkSync(path);
+		} catch (error) {
+			console.debug(`${config.debugLabel}: failed to unlink token file`, error);
+		}
+		const trimmed = contents.trim();
+		return trimmed.length > 0 ? trimmed : null;
+	}
+	return {
+		read(env = process.env) {
+			const fromEnv = env[config.envVar]?.trim();
+			if (fromEnv) return fromEnv;
+			if (!fileTokenResolved) {
+				const path = env[config.fileEnvVar]?.trim();
+				cachedFileToken = path ? readAndConsumeTokenFile(path) : null;
+				fileTokenResolved = true;
+			}
+			return cachedFileToken;
+		},
+		set(token) {
+			cachedFileToken = token;
+			fileTokenResolved = true;
+		},
+		reset() {
+			cachedFileToken = null;
+			fileTokenResolved = false;
+		}
+	};
+}
+//#endregion
+//#region src/auth/runtimeGrantToken.ts
+const accessor = createReadOnceFileTokenAccessor({
+	envVar: "FORGE_CMMD_RUNTIME_GRANT_TOKEN",
+	fileEnvVar: "FORGE_CMMD_RUNTIME_GRANT_TOKEN_FILE",
+	debugLabel: "runtimeGrantToken"
+});
+/**
+* Resolves the CMMD runtime grant token, preferring the (legacy) environment
+* variable and falling back to a one-time file read. The file, once read, is
+* unlinked and its contents cached in memory for the remainder of the
+* process — the secret is never read from disk twice.
+*/
+function runtimeGrantToken(env = process.env) {
+	return accessor.read(env);
+}
+/**
+* Replaces the in-memory grant token cache with a freshly-issued one (see
+* runtimeAuth/runtimeGrantRefresh.ts). This is the ONLY way a long-lived
+* process picks up a rotated grant: the source file was already unlinked
+* after its one read, and FORGE_CMMD_RUNTIME_GRANT_TOKEN (when present)
+* always takes priority over this cache, matching `runtimeGrantToken()`'s own
+* precedence. Does not touch disk — the refreshed secret lives only in this
+* process's memory, same as the original.
+*/
+function setRuntimeGrantToken(token) {
+	accessor.set(token);
+}
+//#endregion
+//#region src/runtimeAuth/cmmdRuntimeTicket.ts
+const CMMD_CLAUDE_READINESS_TICKET_AUDIENCE = "forge-claude-readiness";
+const CMMD_CLAUDE_READINESS_TICKET_SCOPE = "claude-readiness-probe";
+function decodeBase64UrlJson(value) {
+	try {
+		return JSON.parse(Buffer.from(value, "base64url").toString("utf8"));
+	} catch {
+		return null;
+	}
+}
+function normalizePem(value) {
+	return value.includes("\\n") ? value.replace(/\\n/g, "\n") : value;
+}
+function stringClaim(payload, key) {
+	const value = payload[key];
+	if (typeof value === "string" && value.trim().length > 0) return value;
+	if (typeof value === "number" && Number.isFinite(value)) return String(value);
+	return null;
+}
+function constantTimeEqualString(left, right) {
+	const leftBuffer = Buffer.from(left, "utf8");
+	const rightBuffer = Buffer.from(right, "utf8");
+	if (leftBuffer.length !== rightBuffer.length) return false;
+	return timingSafeEqual(leftBuffer, rightBuffer);
+}
+function matchesExpected(actual, expected) {
+	return expected === void 0 || expected.trim().length === 0 || constantTimeEqualString(actual, expected);
+}
+function validTicketHeader(value) {
+	return typeof value === "object" && value !== null && value.alg === "EdDSA";
+}
+function validTicketSignature(input) {
+	try {
+		return verify(null, Buffer.from(input.signingInput), createPublicKey(normalizePem(input.publicKeyPem)), Buffer.from(input.signatureRaw, "base64url"));
+	} catch {
+		return false;
+	}
+}
+function nonNegativeIntegerClaim(value) {
+	return Number.isSafeInteger(value) && value >= 0 ? value : null;
+}
+function stringArrayClaim(value) {
+	return Array.isArray(value) && value.every((entry) => typeof entry === "string") ? value : null;
+}
+function verifiedRuntimeTicketPayload(token, publicKeyPem, audience = "forge-runtime") {
+	const parts = token.split(".");
+	if (parts.length !== 3) return null;
+	const [headerRaw, payloadRaw, signatureRaw] = parts;
+	if (!validTicketHeader(decodeBase64UrlJson(headerRaw))) return null;
+	const payload = decodeBase64UrlJson(payloadRaw);
+	if (typeof payload !== "object" || payload === null) return null;
+	const payloadRecord = payload;
+	if (payloadRecord["iss"] !== "cmmd" || payloadRecord["aud"] !== audience) return null;
+	return validTicketSignature({
+		signingInput: `${headerRaw}.${payloadRaw}`,
+		signatureRaw,
+		publicKeyPem
+	}) ? payloadRecord : null;
+}
+function verifyCmmdClaudeReadinessTicket(token, expectations) {
+	const payload = verifiedRuntimeTicketPayload(token, expectations.publicKeyPem, CMMD_CLAUDE_READINESS_TICKET_AUDIENCE);
+	if (!payload) return null;
+	const claims = runtimeTicketClaims(payload, false);
+	if (!claims || !runtimeTicketExpectationsMatch(claims, expectations)) return null;
+	const jti = stringClaim(payload, "jti");
+	const issuedAtSeconds = nonNegativeIntegerClaim(payload["iat"]);
+	const notBeforeSeconds = nonNegativeIntegerClaim(payload["nbf"]);
+	const nowSeconds = Math.floor(Date.now() / 1e3);
+	if (issuedAtSeconds === null || notBeforeSeconds === null || notBeforeSeconds > nowSeconds || issuedAtSeconds > nowSeconds + 5 || claims.expiresAtSeconds - issuedAtSeconds > 90) return null;
+	return jti && claims.scope.length === 1 && claims.scope[0] === CMMD_CLAUDE_READINESS_TICKET_SCOPE ? {
+		...claims,
+		jti
+	} : null;
+}
+function runtimeTicketExpiration(payload, allowExpired) {
+	const expiresAtSeconds = payload["exp"];
+	if (typeof expiresAtSeconds !== "number" || !Number.isFinite(expiresAtSeconds)) return null;
+	if (!allowExpired && Math.floor(Date.now() / 1e3) >= expiresAtSeconds) return null;
+	return expiresAtSeconds;
+}
+function requiredRuntimeIdentity(payload) {
+	const userId = stringClaim(payload, "user_id");
+	const orgId = stringClaim(payload, "org_id");
+	const projectId = stringClaim(payload, "project_id");
+	const runtimeId = stringClaim(payload, "runtime_id");
+	if (!userId || !orgId || !projectId || !runtimeId) return null;
+	return {
+		userId,
+		orgId,
+		projectId,
+		runtimeId
+	};
+}
+function runtimeTicketClaims(payload, allowExpired) {
+	const expiresAtSeconds = runtimeTicketExpiration(payload, allowExpired);
+	if (expiresAtSeconds === null) return null;
+	const identity = requiredRuntimeIdentity(payload);
+	if (!identity) return null;
+	const scope = stringArrayClaim(payload["scope"]);
+	if (!scope) return null;
+	return {
+		...identity,
+		machineId: stringClaim(payload, "machine_id"),
+		credentialEpoch: nonNegativeIntegerClaim(payload["credential_epoch"]),
+		scope,
+		expiresAtSeconds
+	};
+}
+function exactMachineExpectationMatches(claims, expectations) {
+	if (expectations.machineId !== void 0 && expectations.machineId.trim().length > 0) {
+		if (!claims.machineId) return false;
+		if (!constantTimeEqualString(claims.machineId, expectations.machineId)) return false;
+	}
+	return expectations.credentialEpoch === void 0 || claims.credentialEpoch === expectations.credentialEpoch;
+}
+function runtimeTicketExpectationsMatch(claims, expectations) {
+	return matchesExpected(claims.runtimeId, expectations.runtimeId) && matchesExpected(claims.orgId, expectations.orgId) && matchesExpected(claims.userId, expectations.userId) && matchesExpected(claims.projectId, expectations.projectId) && exactMachineExpectationMatches(claims, expectations);
+}
+function verifyCmmdRuntimeTicketWithExpirationPolicy(token, expectations, allowExpired) {
+	const payload = verifiedRuntimeTicketPayload(token, expectations.publicKeyPem);
+	if (!payload) return null;
+	const claims = runtimeTicketClaims(payload, allowExpired);
+	return claims && runtimeTicketExpectationsMatch(claims, expectations) ? claims : null;
+}
+function verifyCmmdRuntimeTicket(token, expectations) {
+	return verifyCmmdRuntimeTicketWithExpirationPolicy(token, expectations, false);
+}
+/**
+* Verify a provisioning grant used only as refresh proof, retaining its signed
+* identity and scope after `exp`. Expiration is intentionally the one relaxed
+* check: signature, issuer, audience, claim shape, and caller expectations are
+* identical to normal runtime-ticket verification. Callers must compare the
+* returned ownership and authority to the freshly issued grant before storing
+* it; this must never be used to authorize an ordinary runtime operation.
+*/
+function verifyCmmdRuntimeTicketRefreshProof(token, expectations) {
+	return verifyCmmdRuntimeTicketWithExpirationPolicy(token, expectations, true);
+}
+function authRuntimeTicketClaims(payload) {
+	const expiresAtSeconds = runtimeTicketExpiration(payload, false);
+	if (expiresAtSeconds === null) return null;
+	const userId = stringClaim(payload, "user_id");
+	const orgId = stringClaim(payload, "org_id");
+	const runtimeId = stringClaim(payload, "runtime_id");
+	const scope = stringArrayClaim(payload["scope"]);
+	return userId && orgId && runtimeId && scope ? {
+		orgId,
+		userId,
+		runtimeId,
+		scope,
+		expiresAtSeconds
+	} : null;
+}
+function authRuntimeTicketExpectationsMatch(claims, expectations) {
+	return matchesExpected(claims.runtimeId, expectations.runtimeId) && matchesExpected(claims.orgId, expectations.orgId) && matchesExpected(claims.userId, expectations.userId);
+}
+/**
+* Card 1359 — verify the projectless personal-provider auth VM's transport
+* ticket. It is the sibling of {@link verifyCmmdRuntimeTicket} for the distinct
+* "forge-auth-runtime" audience: projectless, with no machine id or credential
+* epoch (the auth VM serves no project and holds no broker scope), so it only
+* asserts org/user/runtime identity + scope. The audience check keeps the two
+* ticket families from cross-authenticating in either direction.
+*/
+function verifyCmmdAuthRuntimeTicket(token, expectations) {
+	const payload = verifiedRuntimeTicketPayload(token, expectations.publicKeyPem, "forge-auth-runtime");
+	if (!payload) return null;
+	const claims = authRuntimeTicketClaims(payload);
+	return claims && authRuntimeTicketExpectationsMatch(claims, expectations) ? claims : null;
+}
+//#endregion
+//#region src/runtimeAuth/runtimeControlAuthority.ts
+const CONTROL_AUTHORITY_REFRESH_SKEW_SECONDS = 60;
+const CONTROL_AUTHORITY_TIMEOUT_MS = 1e4;
+const CONTROL_AUTHORITY_SCOPES = new Set(["heartbeat", "replication"]);
+var RuntimeControlAuthorityError = class extends Error {
+	status;
+	code;
+	constructor(input) {
+		super(input.message);
+		this.name = "RuntimeControlAuthorityError";
+		this.status = input.status ?? null;
+		this.code = input.code;
+	}
+};
+let authority = null;
+let bootstrapInFlight = null;
+function normalizedControlPlaneUrl(value) {
+	return value.trim().replace(/\/+$/u, "");
+}
+function asObject(value) {
+	return value !== null && typeof value === "object" ? value : null;
+}
+function readNullableString(value) {
+	if (value === null) return null;
+	return typeof value === "string" ? value : void 0;
+}
+function hasValidOptionalHeartbeatFields(payload) {
+	const countsAreValid = [payload.activeTurnCount, payload.activeSessionCount].every((value) => value === void 0 || Number.isSafeInteger(value) && value >= 0);
+	const stringsAreValid = [
+		payload.drainStartedAt,
+		payload.drainReason,
+		payload.drainTargetImageRef,
+		payload.drainTargetImageVersion
+	].every((value) => value === void 0 || value === null || typeof value === "string");
+	return countsAreValid && stringsAreValid && (payload.draining === void 0 || typeof payload.draining === "boolean") && (payload.drainForceRequired === void 0 || typeof payload.drainForceRequired === "boolean");
+}
+function requiredControlFields(payload) {
+	const runtimeId = payload.runtimeId;
+	const controlTicket = payload.controlTicket;
+	const expiresAt = payload.expiresAt;
+	if (typeof runtimeId !== "string" || runtimeId.trim().length === 0 || typeof controlTicket !== "string" || controlTicket.trim().length === 0 || typeof expiresAt !== "string" || !Number.isFinite(Date.parse(expiresAt))) return null;
+	return {
+		runtimeId,
+		controlTicket,
+		expiresAt
+	};
+}
+function optionalHeartbeatFields(payload) {
+	const activeTurnCount = payload.activeTurnCount;
+	const activeSessionCount = payload.activeSessionCount;
+	const drainStartedAt = readNullableString(payload.drainStartedAt);
+	const drainReason = readNullableString(payload.drainReason);
+	const drainTargetImageRef = readNullableString(payload.drainTargetImageRef);
+	const drainTargetImageVersion = readNullableString(payload.drainTargetImageVersion);
+	return {
+		...typeof activeTurnCount === "number" ? { activeTurnCount } : {},
+		...typeof activeSessionCount === "number" ? { activeSessionCount } : {},
+		...typeof payload.draining === "boolean" ? { draining: payload.draining } : {},
+		...drainStartedAt !== void 0 ? { drainStartedAt } : {},
+		...drainReason !== void 0 ? { drainReason } : {},
+		...drainTargetImageRef !== void 0 ? { drainTargetImageRef } : {},
+		...drainTargetImageVersion !== void 0 ? { drainTargetImageVersion } : {},
+		...typeof payload.drainForceRequired === "boolean" ? { drainForceRequired: payload.drainForceRequired } : {}
+	};
+}
+function parseRuntimeControlAuthorityEnvelope(value) {
+	const payload = asObject(asObject(value)?.data);
+	if (!payload) return null;
+	const required = requiredControlFields(payload);
+	if (!required || !hasValidOptionalHeartbeatFields(payload)) return null;
+	return {
+		...required,
+		...optionalHeartbeatFields(payload)
+	};
+}
+function sameIdentity(stored, identity) {
+	return stored.controlPlaneUrl === normalizedControlPlaneUrl(identity.controlPlaneUrl) && stored.orgId === identity.orgId && stored.userId === identity.userId && stored.projectId === identity.projectId && stored.runtimeId === identity.runtimeId && stored.machineId === identity.machineId && stored.credentialEpoch === identity.credentialEpoch;
+}
+function isExactControlTicket(claims, identity) {
+	const scopes = new Set(claims.scope);
+	return claims.userId === identity.userId && claims.machineId === identity.machineId && claims.credentialEpoch === identity.credentialEpoch && scopes.size === CONTROL_AUTHORITY_SCOPES.size && [...CONTROL_AUTHORITY_SCOPES].every((scope) => scopes.has(scope));
+}
+function storeRuntimeControlAuthority(input) {
+	if (input.envelope.runtimeId !== input.identity.runtimeId) return false;
+	const claims = verifyCmmdRuntimeTicket(input.envelope.controlTicket, {
+		publicKeyPem: input.identity.publicKeyPem,
+		orgId: input.identity.orgId,
+		projectId: input.identity.projectId,
+		runtimeId: input.identity.runtimeId,
+		machineId: input.identity.machineId,
+		credentialEpoch: input.identity.credentialEpoch
+	});
+	if (!claims || !isExactControlTicket(claims, input.identity)) return false;
+	const responseExpirySeconds = Math.floor(Date.parse(input.envelope.expiresAt) / 1e3);
+	if (Math.abs(responseExpirySeconds - claims.expiresAtSeconds) > 1) return false;
+	if (authority && sameIdentity(authority, input.identity)) {
+		if (authority.expiresAtSeconds >= claims.expiresAtSeconds) return true;
+	}
+	authority = {
+		...input.identity,
+		controlPlaneUrl: normalizedControlPlaneUrl(input.identity.controlPlaneUrl),
+		token: input.envelope.controlTicket,
+		expiresAtSeconds: claims.expiresAtSeconds
+	};
+	return true;
+}
+async function readControlAuthorityResponse(response) {
+	if (!response.ok) throw new RuntimeControlAuthorityError({
+		status: response.status,
+		code: "CMMD_RUNTIME_CONTROL_AUTHORITY_REJECTED",
+		message: `CMMD runtime control authority request failed (${response.status}).`
+	});
+	try {
+		return await response.json();
+	} catch {
+		throw new RuntimeControlAuthorityError({
+			status: response.status,
+			code: "CMMD_RUNTIME_CONTROL_AUTHORITY_INVALID_RESPONSE",
+			message: "CMMD runtime control authority returned invalid JSON."
+		});
+	}
+}
+async function requestWithTimeout(url, init, fetchImpl) {
+	const abortController = new AbortController();
+	const timeout = setTimeout(() => abortController.abort(), CONTROL_AUTHORITY_TIMEOUT_MS);
+	try {
+		return await readControlAuthorityResponse(await fetchImpl(url, {
+			...init,
+			signal: abortController.signal
+		}));
+	} finally {
+		clearTimeout(timeout);
+	}
+}
+async function requestRuntimeControlHeartbeat(input) {
+	return requestWithTimeout(new URL(`/api/forge/context/runtime-authority/runtimes/${encodeURIComponent(input.grant.runtimeId)}/heartbeat`, `${input.grant.controlPlaneUrl}/`), {
+		method: "POST",
+		headers: {
+			authorization: `Bearer ${input.grant.grantToken}`,
+			"content-type": "application/json"
+		},
+		body: JSON.stringify({
+			activeTurnCount: input.activeTurnCount,
+			activeSessionCount: input.activeSessionCount,
+			...input.forgeGitCommit !== void 0 ? { forgeGitCommit: input.forgeGitCommit } : {}
+		})
+	}, input.fetchImpl);
+}
+function clearRejectedAuthority(error, grantToken) {
+	if (!(error instanceof RuntimeControlAuthorityError)) return;
+	if (error.status !== 401 && error.status !== 410) return;
+	if (authority?.token === grantToken) authority = null;
+}
+function readRuntimeControlAuthority(input) {
+	const current = authority;
+	if (!current) return null;
+	const nowSeconds = input.nowSeconds ?? Math.floor(Date.now() / 1e3);
+	if (current.expiresAtSeconds <= nowSeconds) {
+		authority = null;
+		return null;
+	}
+	if (current.runtimeId !== input.runtimeId || current.machineId !== input.machineId || current.credentialEpoch !== input.credentialEpoch) return null;
+	return {
+		controlPlaneUrl: current.controlPlaneUrl,
+		runtimeId: current.runtimeId,
+		machineId: current.machineId,
+		credentialEpoch: current.credentialEpoch,
+		grantToken: current.token,
+		expiresAtSeconds: current.expiresAtSeconds
+	};
+}
+/**
+* Seed the in-memory control authority from the sealed Service bootstrap grant.
+* The grant must be exact-machine and carry exactly heartbeat + replication;
+* it cannot authorize owner transport or any credential broker operation.
+*/
+function bootstrapRuntimeControlAuthorityFromNarrowGrant(input) {
+	const claims = verifyCmmdRuntimeTicket(input.grantToken, {
+		publicKeyPem: input.identity.publicKeyPem,
+		orgId: input.identity.orgId,
+		projectId: input.identity.projectId,
+		runtimeId: input.identity.runtimeId,
+		machineId: input.identity.machineId,
+		credentialEpoch: input.identity.credentialEpoch
+	});
+	if (!claims || !isExactControlTicket(claims, input.identity)) return false;
+	return storeRuntimeControlAuthority({
+		identity: input.identity,
+		envelope: {
+			runtimeId: input.identity.runtimeId,
+			controlTicket: input.grantToken,
+			expiresAt: (/* @__PURE__ */ new Date(claims.expiresAtSeconds * 1e3)).toISOString()
+		}
+	});
+}
+async function bootstrapRuntimeControlAuthority(input) {
+	const current = authority;
+	const nowSeconds = input.nowSeconds ?? Math.floor(Date.now() / 1e3);
+	if (current && sameIdentity(current, input.identity) && current.expiresAtSeconds > nowSeconds + CONTROL_AUTHORITY_REFRESH_SKEW_SECONDS) return true;
+	if (bootstrapInFlight) return bootstrapInFlight;
+	bootstrapInFlight = (async () => {
+		const envelope = parseRuntimeControlAuthorityEnvelope(await requestWithTimeout(new URL(`/api/forge/context/runtime-authority/runtimes/${encodeURIComponent(input.identity.runtimeId)}/control-ticket/bootstrap`, `${normalizedControlPlaneUrl(input.identity.controlPlaneUrl)}/`), {
+			method: "POST",
+			headers: {
+				authorization: `Bearer ${input.connectToken}`,
+				"x-forge-runtime-provisioning-grant": input.provisioningGrant
+			}
+		}, input.fetchImpl ?? fetch));
+		if (!envelope || !storeRuntimeControlAuthority({
+			identity: input.identity,
+			envelope
+		})) throw new RuntimeControlAuthorityError({
+			code: "CMMD_RUNTIME_CONTROL_AUTHORITY_INVALID_RESPONSE",
+			message: "CMMD runtime control authority response did not match this runtime."
+		});
+		return true;
+	})().finally(() => {
+		bootstrapInFlight = null;
+	});
+	return bootstrapInFlight;
+}
+async function sendRuntimeControlHeartbeat(input) {
+	const current = authority;
+	const grant = readRuntimeControlAuthority(input);
+	if (!current || !grant) return null;
+	let body;
+	try {
+		body = await requestRuntimeControlHeartbeat({
+			grant,
+			activeTurnCount: input.activeTurnCount,
+			activeSessionCount: input.activeSessionCount,
+			forgeGitCommit: input.forgeGitCommit,
+			fetchImpl: input.fetchImpl ?? fetch
+		});
+	} catch (error) {
+		clearRejectedAuthority(error, grant.grantToken);
+		throw error;
+	}
+	const envelope = parseRuntimeControlAuthorityEnvelope(body);
+	if (!envelope || !storeRuntimeControlAuthority({
+		identity: current,
+		envelope
+	})) throw new RuntimeControlAuthorityError({
+		code: "CMMD_RUNTIME_CONTROL_AUTHORITY_INVALID_RESPONSE",
+		message: "CMMD runtime heartbeat returned authority for a different runtime."
+	});
+	return {
+		activeTurnCount: envelope.activeTurnCount ?? input.activeTurnCount,
+		activeSessionCount: envelope.activeSessionCount ?? input.activeSessionCount,
+		draining: envelope.draining ?? false,
+		drainStartedAt: envelope.drainStartedAt ?? null,
+		drainReason: envelope.drainReason ?? null,
+		drainTargetImageRef: envelope.drainTargetImageRef ?? null,
+		drainTargetImageVersion: envelope.drainTargetImageVersion ?? null,
+		drainForceRequired: envelope.drainForceRequired ?? false
+	};
+}
+//#endregion
+export { verifyCmmdAuthRuntimeTicket as a, verifyCmmdRuntimeTicketRefreshProof as c, createReadOnceFileTokenAccessor as d, sendRuntimeControlHeartbeat as i, runtimeGrantToken as l, bootstrapRuntimeControlAuthorityFromNarrowGrant as n, verifyCmmdClaudeReadinessTicket as o, readRuntimeControlAuthority as r, verifyCmmdRuntimeTicket as s, bootstrapRuntimeControlAuthority as t, setRuntimeGrantToken as u };
+
+//# sourceMappingURL=runtimeControlAuthority-Dm9z5ziU.mjs.map