@cmmd-center/forge 0.9.3 → 0.9.5

package/dist/runtimeControlAuthority-SNBF5Mjy.cjs

@@ -0,0 +1,601 @@
+#!/usr/bin/env node
+
+require("./chunk-BhaIgcZK.cjs");
+let node_crypto = require("node:crypto");
+let node_fs = require("node:fs");
+//#region src/auth/readOnceFileToken.ts
+function createReadOnceFileTokenAccessor(config) {
+	let cachedFileToken = null;
+	let fileTokenResolved = false;
+	function readAndConsumeTokenFile(path) {
+		let contents;
+		try {
+			contents = (0, node_fs.readFileSync)(path, "utf8");
+		} catch {
+			return null;
+		}
+		try {
+			(0, node_fs.unlinkSync)(path);
+		} catch (error) {
+			console.debug(`${config.debugLabel}: failed to unlink token file`, error);
+		}
+		const trimmed = contents.trim();
+		return trimmed.length > 0 ? trimmed : null;
+	}
+	return {
+		read(env = process.env) {
+			const fromEnv = env[config.envVar]?.trim();
+			if (fromEnv) return fromEnv;
+			if (!fileTokenResolved) {
+				const path = env[config.fileEnvVar]?.trim();
+				cachedFileToken = path ? readAndConsumeTokenFile(path) : null;
+				fileTokenResolved = true;
+			}
+			return cachedFileToken;
+		},
+		set(token) {
+			cachedFileToken = token;
+			fileTokenResolved = true;
+		},
+		reset() {
+			cachedFileToken = null;
+			fileTokenResolved = false;
+		}
+	};
+}
+//#endregion
+//#region src/auth/runtimeGrantToken.ts
+const accessor = createReadOnceFileTokenAccessor({
+	envVar: "FORGE_CMMD_RUNTIME_GRANT_TOKEN",
+	fileEnvVar: "FORGE_CMMD_RUNTIME_GRANT_TOKEN_FILE",
+	debugLabel: "runtimeGrantToken"
+});
+/**
+* Resolves the CMMD runtime grant token, preferring the (legacy) environment
+* variable and falling back to a one-time file read. The file, once read, is
+* unlinked and its contents cached in memory for the remainder of the
+* process — the secret is never read from disk twice.
+*/
+function runtimeGrantToken(env = process.env) {
+	return accessor.read(env);
+}
+/**
+* Replaces the in-memory grant token cache with a freshly-issued one (see
+* runtimeAuth/runtimeGrantRefresh.ts). This is the ONLY way a long-lived
+* process picks up a rotated grant: the source file was already unlinked
+* after its one read, and FORGE_CMMD_RUNTIME_GRANT_TOKEN (when present)
+* always takes priority over this cache, matching `runtimeGrantToken()`'s own
+* precedence. Does not touch disk — the refreshed secret lives only in this
+* process's memory, same as the original.
+*/
+function setRuntimeGrantToken(token) {
+	accessor.set(token);
+}
+//#endregion
+//#region src/runtimeAuth/cmmdRuntimeTicket.ts
+const CMMD_CLAUDE_READINESS_TICKET_AUDIENCE = "forge-claude-readiness";
+const CMMD_CLAUDE_READINESS_TICKET_SCOPE = "claude-readiness-probe";
+function decodeBase64UrlJson(value) {
+	try {
+		return JSON.parse(Buffer.from(value, "base64url").toString("utf8"));
+	} catch {
+		return null;
+	}
+}
+function normalizePem(value) {
+	return value.includes("\\n") ? value.replace(/\\n/g, "\n") : value;
+}
+function stringClaim(payload, key) {
+	const value = payload[key];
+	if (typeof value === "string" && value.trim().length > 0) return value;
+	if (typeof value === "number" && Number.isFinite(value)) return String(value);
+	return null;
+}
+function constantTimeEqualString(left, right) {
+	const leftBuffer = Buffer.from(left, "utf8");
+	const rightBuffer = Buffer.from(right, "utf8");
+	if (leftBuffer.length !== rightBuffer.length) return false;
+	return (0, node_crypto.timingSafeEqual)(leftBuffer, rightBuffer);
+}
+function matchesExpected(actual, expected) {
+	return expected === void 0 || expected.trim().length === 0 || constantTimeEqualString(actual, expected);
+}
+function validTicketHeader(value) {
+	return typeof value === "object" && value !== null && value.alg === "EdDSA";
+}
+function validTicketSignature(input) {
+	try {
+		return (0, node_crypto.verify)(null, Buffer.from(input.signingInput), (0, node_crypto.createPublicKey)(normalizePem(input.publicKeyPem)), Buffer.from(input.signatureRaw, "base64url"));
+	} catch {
+		return false;
+	}
+}
+function nonNegativeIntegerClaim(value) {
+	return Number.isSafeInteger(value) && value >= 0 ? value : null;
+}
+function stringArrayClaim(value) {
+	return Array.isArray(value) && value.every((entry) => typeof entry === "string") ? value : null;
+}
+function verifiedRuntimeTicketPayload(token, publicKeyPem, audience = "forge-runtime") {
+	const parts = token.split(".");
+	if (parts.length !== 3) return null;
+	const [headerRaw, payloadRaw, signatureRaw] = parts;
+	if (!validTicketHeader(decodeBase64UrlJson(headerRaw))) return null;
+	const payload = decodeBase64UrlJson(payloadRaw);
+	if (typeof payload !== "object" || payload === null) return null;
+	const payloadRecord = payload;
+	if (payloadRecord["iss"] !== "cmmd" || payloadRecord["aud"] !== audience) return null;
+	return validTicketSignature({
+		signingInput: `${headerRaw}.${payloadRaw}`,
+		signatureRaw,
+		publicKeyPem
+	}) ? payloadRecord : null;
+}
+function verifyCmmdClaudeReadinessTicket(token, expectations) {
+	const payload = verifiedRuntimeTicketPayload(token, expectations.publicKeyPem, CMMD_CLAUDE_READINESS_TICKET_AUDIENCE);
+	if (!payload) return null;
+	const claims = runtimeTicketClaims(payload, false);
+	if (!claims || !runtimeTicketExpectationsMatch(claims, expectations)) return null;
+	const jti = stringClaim(payload, "jti");
+	const issuedAtSeconds = nonNegativeIntegerClaim(payload["iat"]);
+	const notBeforeSeconds = nonNegativeIntegerClaim(payload["nbf"]);
+	const nowSeconds = Math.floor(Date.now() / 1e3);
+	if (issuedAtSeconds === null || notBeforeSeconds === null || notBeforeSeconds > nowSeconds || issuedAtSeconds > nowSeconds + 5 || claims.expiresAtSeconds - issuedAtSeconds > 90) return null;
+	return jti && claims.scope.length === 1 && claims.scope[0] === CMMD_CLAUDE_READINESS_TICKET_SCOPE ? {
+		...claims,
+		jti
+	} : null;
+}
+function runtimeTicketExpiration(payload, allowExpired) {
+	const expiresAtSeconds = payload["exp"];
+	if (typeof expiresAtSeconds !== "number" || !Number.isFinite(expiresAtSeconds)) return null;
+	if (!allowExpired && Math.floor(Date.now() / 1e3) >= expiresAtSeconds) return null;
+	return expiresAtSeconds;
+}
+function requiredRuntimeIdentity(payload) {
+	const userId = stringClaim(payload, "user_id");
+	const orgId = stringClaim(payload, "org_id");
+	const projectId = stringClaim(payload, "project_id");
+	const runtimeId = stringClaim(payload, "runtime_id");
+	if (!userId || !orgId || !projectId || !runtimeId) return null;
+	return {
+		userId,
+		orgId,
+		projectId,
+		runtimeId
+	};
+}
+function runtimeTicketClaims(payload, allowExpired) {
+	const expiresAtSeconds = runtimeTicketExpiration(payload, allowExpired);
+	if (expiresAtSeconds === null) return null;
+	const identity = requiredRuntimeIdentity(payload);
+	if (!identity) return null;
+	const scope = stringArrayClaim(payload["scope"]);
+	if (!scope) return null;
+	return {
+		...identity,
+		machineId: stringClaim(payload, "machine_id"),
+		credentialEpoch: nonNegativeIntegerClaim(payload["credential_epoch"]),
+		scope,
+		expiresAtSeconds
+	};
+}
+function exactMachineExpectationMatches(claims, expectations) {
+	if (expectations.machineId !== void 0 && expectations.machineId.trim().length > 0) {
+		if (!claims.machineId) return false;
+		if (!constantTimeEqualString(claims.machineId, expectations.machineId)) return false;
+	}
+	return expectations.credentialEpoch === void 0 || claims.credentialEpoch === expectations.credentialEpoch;
+}
+function runtimeTicketExpectationsMatch(claims, expectations) {
+	return matchesExpected(claims.runtimeId, expectations.runtimeId) && matchesExpected(claims.orgId, expectations.orgId) && matchesExpected(claims.userId, expectations.userId) && matchesExpected(claims.projectId, expectations.projectId) && exactMachineExpectationMatches(claims, expectations);
+}
+function verifyCmmdRuntimeTicketWithExpirationPolicy(token, expectations, allowExpired) {
+	const payload = verifiedRuntimeTicketPayload(token, expectations.publicKeyPem);
+	if (!payload) return null;
+	const claims = runtimeTicketClaims(payload, allowExpired);
+	return claims && runtimeTicketExpectationsMatch(claims, expectations) ? claims : null;
+}
+function verifyCmmdRuntimeTicket(token, expectations) {
+	return verifyCmmdRuntimeTicketWithExpirationPolicy(token, expectations, false);
+}
+/**
+* Verify a provisioning grant used only as refresh proof, retaining its signed
+* identity and scope after `exp`. Expiration is intentionally the one relaxed
+* check: signature, issuer, audience, claim shape, and caller expectations are
+* identical to normal runtime-ticket verification. Callers must compare the
+* returned ownership and authority to the freshly issued grant before storing
+* it; this must never be used to authorize an ordinary runtime operation.
+*/
+function verifyCmmdRuntimeTicketRefreshProof(token, expectations) {
+	return verifyCmmdRuntimeTicketWithExpirationPolicy(token, expectations, true);
+}
+function authRuntimeTicketClaims(payload) {
+	const expiresAtSeconds = runtimeTicketExpiration(payload, false);
+	if (expiresAtSeconds === null) return null;
+	const userId = stringClaim(payload, "user_id");
+	const orgId = stringClaim(payload, "org_id");
+	const runtimeId = stringClaim(payload, "runtime_id");
+	const scope = stringArrayClaim(payload["scope"]);
+	return userId && orgId && runtimeId && scope ? {
+		orgId,
+		userId,
+		runtimeId,
+		scope,
+		expiresAtSeconds
+	} : null;
+}
+function authRuntimeTicketExpectationsMatch(claims, expectations) {
+	return matchesExpected(claims.runtimeId, expectations.runtimeId) && matchesExpected(claims.orgId, expectations.orgId) && matchesExpected(claims.userId, expectations.userId);
+}
+/**
+* Card 1359 — verify the projectless personal-provider auth VM's transport
+* ticket. It is the sibling of {@link verifyCmmdRuntimeTicket} for the distinct
+* "forge-auth-runtime" audience: projectless, with no machine id or credential
+* epoch (the auth VM serves no project and holds no broker scope), so it only
+* asserts org/user/runtime identity + scope. The audience check keeps the two
+* ticket families from cross-authenticating in either direction.
+*/
+function verifyCmmdAuthRuntimeTicket(token, expectations) {
+	const payload = verifiedRuntimeTicketPayload(token, expectations.publicKeyPem, "forge-auth-runtime");
+	if (!payload) return null;
+	const claims = authRuntimeTicketClaims(payload);
+	return claims && authRuntimeTicketExpectationsMatch(claims, expectations) ? claims : null;
+}
+//#endregion
+//#region src/runtimeAuth/runtimeControlAuthority.ts
+const CONTROL_AUTHORITY_REFRESH_SKEW_SECONDS = 60;
+const CONTROL_AUTHORITY_TIMEOUT_MS = 1e4;
+const CONTROL_AUTHORITY_SCOPES = new Set(["heartbeat", "replication"]);
+var RuntimeControlAuthorityError = class extends Error {
+	status;
+	code;
+	/**
+	* Whether trying again could plausibly succeed.
+	*
+	* A restarting control plane and a wrong credential both fail here and need
+	* opposite responses: the first must be retried until the deploy finishes,
+	* the second must not be retried at all. Without this the caller cannot tell
+	* them apart and picks wrong in one direction or the other.
+	*/
+	retryable;
+	constructor(input) {
+		super(input.message);
+		this.name = "RuntimeControlAuthorityError";
+		this.status = input.status ?? null;
+		this.code = input.code;
+		this.retryable = input.retryable ?? false;
+	}
+};
+/** Longest body prefix quoted into an error message. */
+const CONTROL_AUTHORITY_BODY_PREVIEW = 180;
+/**
+* A short, credential-free description of a body that would not parse.
+*
+* The point is to identify the RESPONDER. A proxy error page says who it is in
+* its first line, and that one line is the whole difference between "CMMD is
+* redeploying" and a multi-hour dig through a guest.
+*
+* Redacted because this lands in logs and the responder is not always the one
+* we think it is: anything resembling a JWT or a long opaque token is stripped
+* rather than trusted to be harmless.
+*/
+function describeUnparsableBody(body) {
+	const collapsed = body.replace(/[A-Za-z0-9_-]{12,}\.[A-Za-z0-9_-]{12,}\.[A-Za-z0-9_-]{6,}/g, "<redacted-jwt>").replace(/[A-Za-z0-9_-]{40,}/g, "<redacted>").replace(/\s+/g, " ").trim();
+	return collapsed.length > CONTROL_AUTHORITY_BODY_PREVIEW ? `${collapsed.slice(0, CONTROL_AUTHORITY_BODY_PREVIEW)}…` : collapsed;
+}
+let authority = null;
+let bootstrapInFlight = null;
+function normalizedControlPlaneUrl(value) {
+	return value.trim().replace(/\/+$/u, "");
+}
+function asObject(value) {
+	return value !== null && typeof value === "object" ? value : null;
+}
+function readNullableString(value) {
+	if (value === null) return null;
+	return typeof value === "string" ? value : void 0;
+}
+function hasValidOptionalHeartbeatFields(payload) {
+	const countsAreValid = [payload.activeTurnCount, payload.activeSessionCount].every((value) => value === void 0 || Number.isSafeInteger(value) && value >= 0);
+	const stringsAreValid = [
+		payload.drainStartedAt,
+		payload.drainReason,
+		payload.drainTargetImageRef,
+		payload.drainTargetImageVersion
+	].every((value) => value === void 0 || value === null || typeof value === "string");
+	return countsAreValid && stringsAreValid && (payload.draining === void 0 || typeof payload.draining === "boolean") && (payload.drainForceRequired === void 0 || typeof payload.drainForceRequired === "boolean");
+}
+function requiredControlFields(payload) {
+	const runtimeId = payload.runtimeId;
+	const controlTicket = payload.controlTicket;
+	const expiresAt = payload.expiresAt;
+	if (typeof runtimeId !== "string" || runtimeId.trim().length === 0 || typeof controlTicket !== "string" || controlTicket.trim().length === 0 || typeof expiresAt !== "string" || !Number.isFinite(Date.parse(expiresAt))) return null;
+	return {
+		runtimeId,
+		controlTicket,
+		expiresAt
+	};
+}
+function optionalHeartbeatFields(payload) {
+	const activeTurnCount = payload.activeTurnCount;
+	const activeSessionCount = payload.activeSessionCount;
+	const drainStartedAt = readNullableString(payload.drainStartedAt);
+	const drainReason = readNullableString(payload.drainReason);
+	const drainTargetImageRef = readNullableString(payload.drainTargetImageRef);
+	const drainTargetImageVersion = readNullableString(payload.drainTargetImageVersion);
+	return {
+		...typeof activeTurnCount === "number" ? { activeTurnCount } : {},
+		...typeof activeSessionCount === "number" ? { activeSessionCount } : {},
+		...typeof payload.draining === "boolean" ? { draining: payload.draining } : {},
+		...drainStartedAt !== void 0 ? { drainStartedAt } : {},
+		...drainReason !== void 0 ? { drainReason } : {},
+		...drainTargetImageRef !== void 0 ? { drainTargetImageRef } : {},
+		...drainTargetImageVersion !== void 0 ? { drainTargetImageVersion } : {},
+		...typeof payload.drainForceRequired === "boolean" ? { drainForceRequired: payload.drainForceRequired } : {}
+	};
+}
+function parseRuntimeControlAuthorityEnvelope(value) {
+	const payload = asObject(asObject(value)?.data);
+	if (!payload) return null;
+	const required = requiredControlFields(payload);
+	if (!required || !hasValidOptionalHeartbeatFields(payload)) return null;
+	return {
+		...required,
+		...optionalHeartbeatFields(payload)
+	};
+}
+function sameIdentity(stored, identity) {
+	return stored.controlPlaneUrl === normalizedControlPlaneUrl(identity.controlPlaneUrl) && stored.orgId === identity.orgId && stored.userId === identity.userId && stored.projectId === identity.projectId && stored.runtimeId === identity.runtimeId && stored.machineId === identity.machineId && stored.credentialEpoch === identity.credentialEpoch;
+}
+function isExactControlTicket(claims, identity) {
+	const scopes = new Set(claims.scope);
+	return claims.userId === identity.userId && claims.machineId === identity.machineId && claims.credentialEpoch === identity.credentialEpoch && scopes.size === CONTROL_AUTHORITY_SCOPES.size && [...CONTROL_AUTHORITY_SCOPES].every((scope) => scopes.has(scope));
+}
+function storeRuntimeControlAuthority(input) {
+	if (input.envelope.runtimeId !== input.identity.runtimeId) return false;
+	const claims = verifyCmmdRuntimeTicket(input.envelope.controlTicket, {
+		publicKeyPem: input.identity.publicKeyPem,
+		orgId: input.identity.orgId,
+		projectId: input.identity.projectId,
+		runtimeId: input.identity.runtimeId,
+		machineId: input.identity.machineId,
+		credentialEpoch: input.identity.credentialEpoch
+	});
+	if (!claims || !isExactControlTicket(claims, input.identity)) return false;
+	const responseExpirySeconds = Math.floor(Date.parse(input.envelope.expiresAt) / 1e3);
+	if (Math.abs(responseExpirySeconds - claims.expiresAtSeconds) > 1) return false;
+	if (authority && sameIdentity(authority, input.identity)) {
+		if (authority.expiresAtSeconds >= claims.expiresAtSeconds) return true;
+	}
+	authority = {
+		...input.identity,
+		controlPlaneUrl: normalizedControlPlaneUrl(input.identity.controlPlaneUrl),
+		token: input.envelope.controlTicket,
+		expiresAtSeconds: claims.expiresAtSeconds
+	};
+	return true;
+}
+async function readControlAuthorityResponse(response) {
+	if (!response.ok) throw new RuntimeControlAuthorityError({
+		status: response.status,
+		code: "CMMD_RUNTIME_CONTROL_AUTHORITY_REJECTED",
+		retryable: response.status >= 500,
+		message: `CMMD runtime control authority request failed (${response.status}).`
+	});
+	const raw = await response.text().catch(() => "");
+	try {
+		return JSON.parse(raw);
+	} catch {
+		throw new RuntimeControlAuthorityError({
+			status: response.status,
+			code: "CMMD_RUNTIME_CONTROL_AUTHORITY_INVALID_RESPONSE",
+			retryable: true,
+			message: `CMMD runtime control authority returned ${response.status} with a non-JSON body (content-type: ${response.headers.get("content-type") ?? "none"}): ${describeUnparsableBody(raw) || "<empty>"}`
+		});
+	}
+}
+async function requestWithTimeout(url, init, fetchImpl) {
+	const abortController = new AbortController();
+	const timeout = setTimeout(() => abortController.abort(), CONTROL_AUTHORITY_TIMEOUT_MS);
+	try {
+		return await readControlAuthorityResponse(await fetchImpl(url, {
+			...init,
+			signal: abortController.signal
+		}));
+	} finally {
+		clearTimeout(timeout);
+	}
+}
+async function requestRuntimeControlHeartbeat(input) {
+	return requestWithTimeout(new URL(`/api/forge/context/runtime-authority/runtimes/${encodeURIComponent(input.grant.runtimeId)}/heartbeat`, `${input.grant.controlPlaneUrl}/`), {
+		method: "POST",
+		headers: {
+			authorization: `Bearer ${input.grant.grantToken}`,
+			"content-type": "application/json"
+		},
+		body: JSON.stringify({
+			activeTurnCount: input.activeTurnCount,
+			activeSessionCount: input.activeSessionCount,
+			...input.forgeGitCommit !== void 0 ? { forgeGitCommit: input.forgeGitCommit } : {}
+		})
+	}, input.fetchImpl);
+}
+function clearRejectedAuthority(error, grantToken) {
+	if (!(error instanceof RuntimeControlAuthorityError)) return;
+	if (error.status !== 401 && error.status !== 410) return;
+	if (authority?.token === grantToken) authority = null;
+}
+function readRuntimeControlAuthority(input) {
+	const current = authority;
+	if (!current) return null;
+	const nowSeconds = input.nowSeconds ?? Math.floor(Date.now() / 1e3);
+	if (current.expiresAtSeconds <= nowSeconds) {
+		authority = null;
+		return null;
+	}
+	if (current.runtimeId !== input.runtimeId || current.machineId !== input.machineId || current.credentialEpoch !== input.credentialEpoch) return null;
+	return {
+		controlPlaneUrl: current.controlPlaneUrl,
+		runtimeId: current.runtimeId,
+		machineId: current.machineId,
+		credentialEpoch: current.credentialEpoch,
+		grantToken: current.token,
+		expiresAtSeconds: current.expiresAtSeconds
+	};
+}
+/**
+* Seed the in-memory control authority from the sealed Service bootstrap grant.
+* The grant must be exact-machine and carry exactly heartbeat + replication;
+* it cannot authorize owner transport or any credential broker operation.
+*/
+function bootstrapRuntimeControlAuthorityFromNarrowGrant(input) {
+	const claims = verifyCmmdRuntimeTicket(input.grantToken, {
+		publicKeyPem: input.identity.publicKeyPem,
+		orgId: input.identity.orgId,
+		projectId: input.identity.projectId,
+		runtimeId: input.identity.runtimeId,
+		machineId: input.identity.machineId,
+		credentialEpoch: input.identity.credentialEpoch
+	});
+	if (!claims || !isExactControlTicket(claims, input.identity)) return false;
+	return storeRuntimeControlAuthority({
+		identity: input.identity,
+		envelope: {
+			runtimeId: input.identity.runtimeId,
+			controlTicket: input.grantToken,
+			expiresAt: (/* @__PURE__ */ new Date(claims.expiresAtSeconds * 1e3)).toISOString()
+		}
+	});
+}
+async function bootstrapRuntimeControlAuthority(input) {
+	const current = authority;
+	const nowSeconds = input.nowSeconds ?? Math.floor(Date.now() / 1e3);
+	if (current && sameIdentity(current, input.identity) && current.expiresAtSeconds > nowSeconds + CONTROL_AUTHORITY_REFRESH_SKEW_SECONDS) return true;
+	if (bootstrapInFlight) return bootstrapInFlight;
+	bootstrapInFlight = (async () => {
+		const envelope = parseRuntimeControlAuthorityEnvelope(await requestWithTimeout(new URL(`/api/forge/context/runtime-authority/runtimes/${encodeURIComponent(input.identity.runtimeId)}/control-ticket/bootstrap`, `${normalizedControlPlaneUrl(input.identity.controlPlaneUrl)}/`), {
+			method: "POST",
+			headers: {
+				authorization: `Bearer ${input.connectToken}`,
+				"x-forge-runtime-provisioning-grant": input.provisioningGrant
+			}
+		}, input.fetchImpl ?? fetch));
+		if (!envelope || !storeRuntimeControlAuthority({
+			identity: input.identity,
+			envelope
+		})) throw new RuntimeControlAuthorityError({
+			code: "CMMD_RUNTIME_CONTROL_AUTHORITY_INVALID_RESPONSE",
+			message: "CMMD runtime control authority response did not match this runtime."
+		});
+		return true;
+	})().finally(() => {
+		bootstrapInFlight = null;
+	});
+	return bootstrapInFlight;
+}
+async function sendRuntimeControlHeartbeat(input) {
+	const current = authority;
+	const grant = readRuntimeControlAuthority(input);
+	if (!current || !grant) return null;
+	let body;
+	try {
+		body = await requestRuntimeControlHeartbeat({
+			grant,
+			activeTurnCount: input.activeTurnCount,
+			activeSessionCount: input.activeSessionCount,
+			forgeGitCommit: input.forgeGitCommit,
+			fetchImpl: input.fetchImpl ?? fetch
+		});
+	} catch (error) {
+		clearRejectedAuthority(error, grant.grantToken);
+		throw error;
+	}
+	const envelope = parseRuntimeControlAuthorityEnvelope(body);
+	if (!envelope || !storeRuntimeControlAuthority({
+		identity: current,
+		envelope
+	})) throw new RuntimeControlAuthorityError({
+		code: "CMMD_RUNTIME_CONTROL_AUTHORITY_INVALID_RESPONSE",
+		message: "CMMD runtime heartbeat returned authority for a different runtime."
+	});
+	return {
+		activeTurnCount: envelope.activeTurnCount ?? input.activeTurnCount,
+		activeSessionCount: envelope.activeSessionCount ?? input.activeSessionCount,
+		draining: envelope.draining ?? false,
+		drainStartedAt: envelope.drainStartedAt ?? null,
+		drainReason: envelope.drainReason ?? null,
+		drainTargetImageRef: envelope.drainTargetImageRef ?? null,
+		drainTargetImageVersion: envelope.drainTargetImageVersion ?? null,
+		drainForceRequired: envelope.drainForceRequired ?? false
+	};
+}
+//#endregion
+Object.defineProperty(exports, "bootstrapRuntimeControlAuthority", {
+	enumerable: true,
+	get: function() {
+		return bootstrapRuntimeControlAuthority;
+	}
+});
+Object.defineProperty(exports, "bootstrapRuntimeControlAuthorityFromNarrowGrant", {
+	enumerable: true,
+	get: function() {
+		return bootstrapRuntimeControlAuthorityFromNarrowGrant;
+	}
+});
+Object.defineProperty(exports, "createReadOnceFileTokenAccessor", {
+	enumerable: true,
+	get: function() {
+		return createReadOnceFileTokenAccessor;
+	}
+});
+Object.defineProperty(exports, "readRuntimeControlAuthority", {
+	enumerable: true,
+	get: function() {
+		return readRuntimeControlAuthority;
+	}
+});
+Object.defineProperty(exports, "runtimeGrantToken", {
+	enumerable: true,
+	get: function() {
+		return runtimeGrantToken;
+	}
+});
+Object.defineProperty(exports, "sendRuntimeControlHeartbeat", {
+	enumerable: true,
+	get: function() {
+		return sendRuntimeControlHeartbeat;
+	}
+});
+Object.defineProperty(exports, "setRuntimeGrantToken", {
+	enumerable: true,
+	get: function() {
+		return setRuntimeGrantToken;
+	}
+});
+Object.defineProperty(exports, "verifyCmmdAuthRuntimeTicket", {
+	enumerable: true,
+	get: function() {
+		return verifyCmmdAuthRuntimeTicket;
+	}
+});
+Object.defineProperty(exports, "verifyCmmdClaudeReadinessTicket", {
+	enumerable: true,
+	get: function() {
+		return verifyCmmdClaudeReadinessTicket;
+	}
+});
+Object.defineProperty(exports, "verifyCmmdRuntimeTicket", {
+	enumerable: true,
+	get: function() {
+		return verifyCmmdRuntimeTicket;
+	}
+});
+Object.defineProperty(exports, "verifyCmmdRuntimeTicketRefreshProof", {
+	enumerable: true,
+	get: function() {
+		return verifyCmmdRuntimeTicketRefreshProof;
+	}
+});
+
+//# sourceMappingURL=runtimeControlAuthority-SNBF5Mjy.cjs.map

package/package.json

@@ -1,7 +1,5 @@
 {
   "name": "@cmmd-center/forge",
-  "version": "0.9.3",
-  "license": "MIT",
   "repository": {
     "type": "git",
     "url": "https://github.com/CMMD-Center/forge",
@@ -10,19 +8,15 @@
   "bin": {
     "cmmd-forge": "dist/bin.mjs"
   },
+  "type": "module",
+  "version": "0.9.5",
+  "engines": {
+    "node": "^22.16 || ^23.11 || >=24.10"
+  },
   "files": [
     "dist",
     "!dist/**/*.map"
   ],
-  "type": "module",
-  "scripts": {
-    "dev": "FORGE_PORT=${FORGE_PORT:-13773} FORGE_COMMAND_APP_URL=${FORGE_COMMAND_APP_URL:-https://cmmd.ai} bun --watch src/bin.ts",
-    "build": "node scripts/cli.ts build",
-    "start": "node dist/bin.mjs",
-    "prepare": "effect-language-service patch || exit 0",
-    "typecheck": "tsc --noEmit",
-    "test": "vitest run"
-  },
   "dependencies": {
     "@anthropic-ai/claude-agent-sdk": "^0.3.232",
     "@cmmd-center/agent-browser": "0.6.2",
@@ -42,24 +36,28 @@
     "werift": "0.24.4",
     "zod": "^4.0.0"
   },
-  "devDependencies": {
-    "@cmmd-forge/client-runtime": "0.0.0-alpha.1",
-    "@cmmd-forge/contracts": "0.9.0",
-    "@cmmd-forge/relay-host": "0.0.0-alpha.1",
-    "@cmmd-forge/shared": "0.0.0-alpha.1",
-    "@cmmd-forge/web": "0.9.0",
-    "@effect/language-service": "0.84.2",
-    "@effect/vitest": "4.0.0-beta.45",
-    "@types/bun": "^1.3.9",
-    "@types/node": "^24.10.13",
-    "@types/pg": "^8.21.0",
-    "@types/ws": "^8.5.13",
-    "effect-acp": "0.0.1",
-    "tsdown": "0.21.4",
-    "typescript": "^5.7.3",
-    "vitest": "^4.1.10"
-  },
-  "engines": {
-    "node": "^22.16 || ^23.11 || >=24.10"
+  "overrides": {
+    "@babel/core": "7.29.7",
+    "@opentelemetry/core": "2.10.0",
+    "ajv": "8.20.0",
+    "brace-expansion": "5.0.9",
+    "dompurify": "3.4.13",
+    "esbuild": "0.28.1",
+    "fast-uri": "4.1.2",
+    "js-yaml": "4.3.1",
+    "nanoid": "3.3.18",
+    "picomatch": "4.0.5",
+    "postcss": "8.5.25",
+    "protobufjs": "7.6.5",
+    "sharp": "0.35.3",
+    "shell-quote": "1.10.0",
+    "smol-toml": "1.7.1",
+    "svgo": "4.0.2",
+    "tar": "7.5.22",
+    "undici": "7.29.0",
+    "uuid": "11.1.1",
+    "vite": "^8.2.0",
+    "ws": "8.21.2",
+    "yaml": "2.9.0"
   }
 }