{"record":{"id":"b54c89e2ba7ca3cf","repo":"paperclipai/paperclip","slug":"cloud-runtime-identity-provider-is-not-initialized","errorCode":null,"errorMessage":"Cloud runtime identity provider is not initialized","messagePattern":"Cloud runtime identity provider is not initialized","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"server/src/services/cloud-runtime-identity.ts","lineNumber":371,"sourceCode":"  const right = Buffer.from(JSON.stringify([\n    claims.sub,\n    claims.claimId,\n    claims.previousOrigin,\n    claims.canonicalOrigin,\n    claims.stackSlug,\n  ]));\n  return left.length === right.length && timingSafeEqual(left, right);\n}\n\n/** Verify and durably apply the one-time Cloud claim assertion. */\nexport async function applyCloudRuntimeIdentityAssertion(input: {\n  db: Db;\n  compactJws: string;\n  env?: NodeJS.ProcessEnv;\n  now?: Date;\n}): Promise<CloudRuntimeIdentitySnapshot> {\n  const env = input.env ?? process.env;\n  if (!initialized) throw new Error(\"Cloud runtime identity provider is not initialized\");\n  const claims = verifyCloudRuntimeIdentityAssertion({\n    compactJws: input.compactJws,\n    env,\n    now: input.now,\n    // After a natural restart the provider env may already be canonical, but\n    // an identical retry of the original claim is still safe and idempotent.\n    // The durable row preserves the pool origin that assertion had to match\n    // on first application.\n    expectedPreviousOrigin: currentIdentity?.previousOrigin ?? startupOrigin,\n  });\n  const previousOrigin = claims.previousOrigin;\n  const canonicalOrigin = claims.canonicalOrigin;\n\n  const row = await input.db.transaction(async (tx) => {\n    const existing = await readPersistedIdentity(tx);\n    if (existing) {\n      if (!assertionsEqual(existing, claims)) {\n        throw new Error(\"Cloud runtime identity is already claimed by another assertion\");","sourceCodeStart":353,"sourceCodeEnd":389,"githubUrl":"https://github.com/paperclipai/paperclip/blob/01ad8584922b5d85292b1723cae71fa0d9b07a19/server/src/services/cloud-runtime-identity.ts#L353-L389","documentation":"applyCloudRuntimeIdentityAssertion requires that initCloudRuntimeIdentity (initialization) ran first; the module-level `initialized` flag guards all apply operations. It throws when an assertion is applied before the provider was initialized with its signing/verification environment, because verification keys and configuration are not yet loaded.","triggerScenarios":"cloudRuntimeIdentityMiddleware or direct applyCloudRuntimeIdentityAssertion call on a server process where the identity provider's initialization step was skipped, failed, or has not run yet (e.g. early request during boot, init skipped in tests).","commonSituations":"Middleware mounted before async init completed; initialization error swallowed so the flag stayed false; test harness constructing routes without calling init; server restarted into a partial boot state.","solutions":["Ensure provider initialization is awaited before the middleware/apply path is reachable (await init in bootstrapping before server.listen)","Check boot logs for a failed initialization that left `initialized` false","In tests, call the init function before exercising assertion endpoints","Add a readiness gate so traffic only arrives after initialization completes"],"exampleFix":"// before\napp.use(cloudRuntimeIdentityMiddleware());\nawait initCloudRuntimeIdentity({ env: process.env });\n// after\nawait initCloudRuntimeIdentity({ env: process.env });\napp.use(cloudRuntimeIdentityMiddleware());","handlingStrategy":"validation","validationCode":"if (!isCloudRuntimeIdentityInitialized()) {\n  await initCloudRuntimeIdentity({ env: process.env });\n}\nawait applyCloudRuntimeIdentityAssertion({ db, compactJws: jws });","typeGuard":"function isCloudRuntimeIdentityInitialized(): boolean {\n  return Boolean(process.env.PAPERCLIP_CLOUD_STACK_ID) && cloudIdentityInitCompleted;\n}","tryCatchPattern":"try {\n  await applyCloudRuntimeIdentityAssertion({ db, compactJws: jws });\n} catch (e) {\n  if (e.message.includes('not initialized')) {\n    await initCloudRuntimeIdentity({ env: process.env });\n    return applyCloudRuntimeIdentityAssertion({ db, compactJws: jws }); // retry once after init\n  }\n  throw e;\n}","preventionTips":["Await initialization during bootstrap before opening the HTTP listener","Gate middleware registration on successful init","Fail fast (crash) if init throws instead of continuing in a partial state","In tests, always call init in a shared beforeAll"],"tags":["initialization","auth","lifecycle"],"backgroundTag":"module-init-failed","analyzedSha":"01ad8584922b5d85292b1723cae71fa0d9b07a19","analyzedAt":"2026-09-10T03:14:50.855Z","contentChangedAt":"2026-09-10T03:14:50.855Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}