@cmmd-center/forge 0.10.13 → 0.10.16

package/dist/bin.mjs

@@ -1,18 +1,18 @@
 #!/usr/bin/env node
 
 import { a as __toCommonJS, i as __require, n as __esmMin, o as __toESM, r as __exportAll, t as __commonJSMin } from "./chunk-C5ckVeoz.mjs";
-import { $ as encodeEffect, $c as getOrNull, $i as catchDone, $l as constant, $n as filterMapOrFail, $o as fiberInterrupt, $s as seconds, $t as stringifyJson, Aa as addFinalizer$1, An as cached$3, Ao as pretty, Ar as matchCauseEffect, As as void_$2, At as withConstructorDefault, Ba as MinimumLogLevel, Bi as gauge, Bl as isNotNullish, Bn as catch_, Bo as as$2, Br as orElseSucceed, Bt as head, C as Record, Ca as provide$1, Ci as txRetry, Cn as andThen, Co as hasInterruptsOnly, Cr as logWarning$1, Ct as optionalKey, D as TaggedStruct, Da as sync$2, Dl as format, Dn as as$3, Dr as mapError, Ds as tracerLogger$1, Dt as toCodecStringTree, E as TaggedErrorClass, Ea as succeedContext, Ei as uninterruptibleMask$1, El as toJson, En as annotateSpans, Es as sync, Et as toCodecJson, F as UndefinedOr, Fa as make$37, Fc as Reference$1, Fi as withSpan, Fn as catchFilter, Fo as CurrentLoggers$1, Fr as onExit, Fs as ParentSpan, G as decodeExit, Gc as merge$2, Gi as addDelay, Gn as die$1, Gr as race, Gs as fromInputUnsafe, Gt as Transformation, H as declare, Ha as TracerTimingEnabled, Hc as getUnsafe$1, Hi as timer, Hl as isNullish, Hn as contextWith, Hr as provide, Hs as days, Ht as size$2, I as Union, Ia as makeUnsafe$4, Ic as Service$1, Ii as withTracerEnabled, In as catchIf, Is as Tracer, It as assign, J as decodeUnknownEffect, Jc as flatMap$2, Ji as forever$2, Jl as compose, Jn as exit, Jr as result, Jt as transformOrFail, K as decodeSync, Ka as fail$3, Ki as both, Kr as raceFirst, L as Unknown, La as provide$2, Lc as add$2, Li as yieldNow, Ll as compose$1, Ln as catchReason, Lr as onInterrupt, Ls as externalSpan, Lt as append$1, M as URLFromString, Ma as close, Mc as isSuccess$1, Mi as withFiber$1, Mn as callback, Mo as squash, Mr as matchEffect, Na as closeUnsafe, Nn as catchCause, Nr as never$1, Ns as MinimumTraceLevel, O as TemplateLiteral, Oa as unwrap, Oc as fail$1, Oi as useSpan, On as asSome, Os as uninterruptibleMask, Ot as toJsonSchemaDocument, P as Undefined, Pa as forkUnsafe, Pc as succeed$1, Pi as withParentSpan, Pn as catchDefect, Po as ConsoleRef, Pr as onError$1, Ps as NativeSpan, Q as encode$4, Qa as make$39, Qc as getOrElse, Qi as spaced, Ql as constVoid, Qn as filter$1, Qr as runPromise, Qs as minutes, R as UnknownFromJsonString$1, Ra as CurrentLogAnnotations, Rc as empty$1, Ri as zipWith, Rl as hasProperty, Rn as catchTag, Ro as addFinalizer, Rr as option, Rs as make$42, Rt as drop$1, S as Option, Sa as mergeAll, Si as tx$1, Sl as withFiber, Sn as all, So as hasInterrupts, Sr as logInfo, St as optional$4, T as Struct, Ta as succeed$2, Ti as uninterruptible, Tl as NodeInspectSymbol, Tn as annotateLogs, To as interruptors, Tr as map$3, Ts as suspend, Tt as tag, Ua as _await, Uc as make$35, Ui as update$3, Ul as isObject$1, Un as currentSpan, Ur as provideContext, Us as format$1, Ut as toArray, V as brand, Vi as snapshotUnsafe, Vl as isNotUndefined, Vn as context, Vr as promise, Vt as isEmpty$2, W as decodeEffect, Wa as done, Wc as makeUnsafe$3, Wi as withAttributes, Wl as isTagged, Wo as consolePretty$1, Wr as provideService, Ws as fromInput, X as decodeUnknownOption, Xa as isDeferred, Xc as fromNullishOr, Xi as passthrough$1, Xl as constTrue, Xn as failCause$1, Xr as runFork, Xs as millis, Xt as onSome, Y as decodeUnknownExit, Yc as flatten$1, Yn as fail, Yr as retry, Ys as max, Z as decodeUnknownSync, Zc as fromUndefinedOr, Zi as recurs, Zl as constUndefined, Zr as runForkWith, Zs as min, Zt as parseJson$1, _ as NonEmptyArray, _a as effectDiscard, _i as timeout$1, _n as toUtc, _o as fail$4, _r as isEffect, _t as isSchemaError, a as DateTimeUtc, aa as clamp, ac as empty$3, ai as service, al as none$4, an as value, ao as isFailure, ar as fnUntraced, at as isBetween, b as NullOr, ba as launch$1, bi as tryPromise, bn as acquireUseRelease, br as logError, bs as scopeAddFinalizerExit, bt as makeFilter, c as Defect, ca as currentTimeMillis, cc as flatMapNullishOr, ci as succeed, cl as make$41, cn as add$3, cr as forkChild, cs as forever, ct as isGreaterThanOrEqualTo, d as Exit, da as TaggedError, dc as isArrayNonEmpty, di as suspend$1, dn as isGreaterThanOrEqualTo$1, do as NoSuchElementError, dr as forkScoped, dt as isMaxLength, ec as times, ei as runPromiseWith, el as getOrUndefined, eo as succeed$3, er as filterOrFail, et as encodeSync, eu as dual, fa as CurrentMemoMap, fc as isReadonlyArrayNonEmpty, fi as sync$1, fn as make$38, fo as StackTrace, fr as gen, fs as loggerMake, ft as isMaxProperties, g as Never, ga as effectContext, gc as map$4, gi as tapErrorTag, gn as toEpochMillis, go as done$1, gr as interruptible, gt as isSchema, h as Literals, ha as effect, hi as tapError, hn as toDate, hr as interrupt$1, ht as isPattern, i as Class, ia as Random$1, ic as allocate, il as match, in as make$40, io as interrupt$3, ir as fn$1, it as is$1, iu as pipeArguments, ja as addFinalizerExit, jc as isFailure$1, ji as whileLoop, jl as equals, jn as cachedWithTTL, jo as prettyErrors, jt as withDecodingDefault, k as Trim, ka as Scope$1, ki as void_$1, kn as asVoid, ko as map$6, kr as match$1, kt as toType, l as Duration, la as Class$1, lc as fromIterable, li as succeedNone, ln as distance, lo as void_$3, lr as forkDetach$1, ls as forkDetach, lt as isInt, m as Literal, ma as buildWithMemoMap, mi as tapCause, ml as YieldableProto, mn as now, mr as ignoreCause, mt as isNonEmpty, n as ArraySchema, na as isDoneCause, nc as toSeconds, ni as scope$1, nl as isSome, no as fail$2, nt as encodeUnknownExit, nu as identity, o as DateTimeUtcFromString, oa as parse$6, oc as ensure, oi as serviceOption, ol as some, oo as isSuccess, or as forEach, os as flatMap$1, ot as isFinite$1, p as Int$1, pa as build, pi as tap, pl as PipeInspectableProto, pn as makeUnsafe$5, pr as ignore, pt as isMinLength, q as decodeTo, qa as failCause$3, qc as firstSomeOf, qi as exponential, ql as cast, qn as ensuring, qr as repeat, r as Boolean$1, rc as zero, ri as scoped, rl as map$5, rn as makeFormatterDefault, ro as failCause$2, rr as flatten$2, rt as fromJsonString, ru as pipe$1, sa as Clock, sc as filter, si as sleep$4, sl as Number$2, sn as encodeBase64Url$2, so as match$2, sr as forever$1, ss as fnUntraced$1, st as isGreaterThan, t as Any, tc as toMillis, tl as isNone, tn as InvalidValue$1, to as die$2, tr as flatMap, tt as encodeUnknownEffect, u as ErrorClass, ui as succeedSome, un as formatIso, ur as forkIn, ut as isLessThanOrEqualTo, v as NonEmptyString, va as empty$4, vc as reverse, vi as timeoutOption, vn as Transaction$1, vr as log$4, vs as reportCauseUnsafe, w as String$1, wa as provideMerge, wi as undefined_, wn as annotateCurrentSpan, wo as interrupt$2, wr as makeSpanScoped, wt as suspend$2, x as Number$1, xa as merge$3, xi as try_, xl as isEffect$1, xn as addFinalizer$2, xo as hasDies, xr as logFatal, xs as sleep$3, xt as mutable, y as Null, yc as sort, yi as timeoutOrElse, yn as acquireRelease, yr as logDebug, ys as scope, yt as make$36, z as Void, za as CurrentLogSpans, zc as get$3, zi as counter, zl as isNotNull, zn as catchTags, zo as andThen$1, zr as orDie, zt as empty$2 } from "./Schema-BK7-mN_J.mjs";
-import { $ as toAsyncIterable, A as make$45, At as offerAll, Bt as subscribe$1, C as fromEffect, Ct as bounded, E as fromQueue, Et as failCause$4, F as merge$4, Ft as take$1, G as runFold, Gt as await_, H as run$2, It as takeAll, K as runForEach, Kt as getCurrent, Lt as unbounded$2, M as mapAccum, N as mapEffect$1, Nt as shutdown$1, O as fromSubscription, Ot as make$44, Pt as sliding, Q as tick, R as onExit$1, Rt as publish, S as fromChannel, St as makeUnsafe$6, T as fromPubSub, U as runCollect, V as provideContext$1, Vt as unbounded$1, W as runDrain, Wt as makeUnsafe$7, Y as succeed$4, Yt as runIn, Z as takeWhile, _t as fromSubscriptionArray, at as make$46, b as flatMap$3, c as callback$1, d as debounce$1, dt as drain, f as decodeText$1, ft as forEach$1, g as ensuring$1, h as encodeText, ht as mapInput, it as get$4, j as map$7, jt as offerUnsafe, k as isStream, kt as offer$1, l as catchCause$1, m as empty$5, q as runForEachArray, qt as interrupt$4, r as FileSystem, rt as unwrap$1, t as Path$2, u as concat$2, v as failCause$5, vt as fromTransform, w as fromIterable$1, wt as end, x as fromAsyncIterable, xt as make$43, y as filter$2, zt as shutdown$2 } from "./Path-B0vKGzx2.mjs";
-import { _ as ChildProcessSpawner, a as Stdio, g as make$47, o as make$48, r as isQuitError } from "./NodeTerminal-DBDxXuu0.mjs";
-import { n as layer$7 } from "./NodeServices-DeNLW36O.mjs";
-import { $ as file, A as SocketErrorReason, At as merge$5, Bt as set$2, Ct as HttpClientErrorSchema, Dt as empty$7, Ft as getAndSet, G as TracerPropagationEnabled, Ht as updateAndGet, I as HttpServerError, It as getUnsafe$2, J as transformResponse, K as filterStatusOk$1, Lt as make$49, Ot as fromInput$1, Pt as get$5, Q as empty$6, Rt as makeUnsafe$8, St as setBody, Tt as jsonUnsafe$1, U as layer$8, Vt as update$4, W as HttpClient, Z as symbol$1, _ as schemaBodyUrlParams, _t as acceptJson, a as withLogAddress, at as setCookie, bt as get$6, ct as stream, d as logger$1, dt as filterStatusOk, et as isHttpServerResponse, f as withLoggerDisabled, ft as matchStatus, g as schemaBodyJson, gt as schemaBodyJson$1, i as serve$1, it as schemaJson, kt as fromRecordUnsafe, lt as text$2, m as ParsedSearchParams, nt as raw, ot as setCookies, p as HttpServerRequest, q as retryTransient, rt as redirect, st as setHeader, t as HttpServer, tt as jsonUnsafe, u as cors, ut as uint8Array, v as schemaHeaders, vt as bearerToken, wt as isHttpClientError, xt as post, y as toURL, yt as bodyJson, z as RouteNotFound, zt as modify$3 } from "./HttpServer-HhjqDZlB.mjs";
-import { _ as withDefault$3, a as all$1, c as logLevel, d as option$1, f as port, g as url$2, i as TrueValues, l as map$8, m as string$7, n as FalseValues, o as boolean$5, p as schema$2, r as Record$1, s as int$2, t as Boolean$2, u as number$2 } from "./Config-D0zF6ChD.mjs";
-import { a as make$50, i as keys, n as getOption, o as makeWith$1, r as invalidate, s as set$3, t as get$7 } from "./Cache-da-A9JAa.mjs";
-import { S as layer$9, _ as defaultEscape, a as DeadlockError, b as makeCompiler$1, c as SqlError, d as UnknownError, g as custom, h as make$51, i as ConstraintError, l as SqlSyntaxError, m as SqlClient, n as AuthorizationError, o as LockTimeoutError, r as ConnectionError, s as SerializationError, t as AuthenticationError, u as StatementTimeoutError, v as defaultTransforms, y as fragment } from "./SqlError-LFObCDir.mjs";
+import { $ as encodeEffect, $a as make$39, $c as fromUndefinedOr, $i as spaced, $l as constUndefined, $n as filterMapOrFail, $r as runPromise, $s as min, $t as stringifyJson, Aa as Scope$1, Ac as fail$1, Ai as void_$1, An as cached$3, Ar as match$1, As as uninterruptibleMask, At as withConstructorDefault, Ba as CurrentLogSpans, Bc as empty$1, Bi as counter, Bl as hasProperty, Bn as catch_, Bo as addFinalizer, Br as orDie, Bs as make$42, Bt as head, C as Record, Ca as mergeAll, Ci as tx$1, Cl as isEffect$1, Cn as andThen, Co as hasDies, Cr as logInfo, Cs as sleep$3, Ct as optionalKey, D as TaggedStruct, Da as succeedContext, Di as uninterruptibleMask$1, Dl as NodeInspectSymbol, Dn as as$3, Do as interruptors, Ds as suspend, Dt as toCodecStringTree, E as TaggedErrorClass, Ea as succeed$2, Ei as uninterruptible, En as annotateSpans, Eo as interrupt$2, Er as map$3, Et as toCodecJson, F as UndefinedOr, Fa as forkUnsafe, Fi as withParentSpan, Fn as catchFilter, Fr as onError$1, Fs as MinimumTraceLevel, G as decodeExit, Ga as done, Gc as make$35, Gi as withAttributes, Gl as isObject$1, Gn as die$1, Gr as provideService, Gs as format$1, Gt as Transformation, H as declare, Hi as snapshotUnsafe, Hl as isNotNullish, Hn as contextWith, Ho as as$2, Hr as promise, Ht as size$2, I as Union, Ia as make$37, Ic as succeed$1, Ii as withSpan, In as catchIf, Io as ConsoleRef, Ir as onExit, Is as NativeSpan, It as assign, J as decodeUnknownEffect, Ja as failCause$3, Ji as exponential, Jn as exit, Jr as repeat, Jt as transformOrFail, K as decodeSync, Kc as makeUnsafe$3, Ki as addDelay, Kl as isTagged, Ko as consolePretty$1, Kr as race, Ks as fromInput, L as Unknown, La as makeUnsafe$4, Lc as Reference$1, Li as withTracerEnabled, Ln as catchReason, Lo as CurrentLoggers$1, Ls as ParentSpan, Lt as append$1, M as URLFromString, Ma as addFinalizerExit, Mi as whileLoop, Mn as callback, Mo as pretty, Ms as void_$2, Na as close, Nc as isFailure$1, Ni as withFiber$1, Nl as equals, Nn as catchCause, No as prettyErrors, Nr as matchEffect, O as TemplateLiteral, Oa as sync$2, Ol as toJson, On as asSome, Or as mapError, Os as sync, Ot as toJsonSchemaDocument, P as Undefined, Pa as closeUnsafe, Pc as isSuccess$1, Pn as catchDefect, Po as squash, Pr as never$1, Q as encode$4, Qc as fromNullishOr, Qi as recurs, Ql as constTrue, Qn as filter$1, Qr as runForkWith, Qs as millis, R as UnknownFromJsonString$1, Ra as provide$2, Rc as Service$1, Ri as yieldNow, Rn as catchTag, Rr as onInterrupt, Rs as Tracer, Rt as drop$1, S as Option, Sa as merge$3, Si as try_, Sn as all, Sr as logFatal, Ss as scopeAddFinalizerExit, St as optional$4, T as Struct, Ta as provideMerge, Ti as undefined_, Tn as annotateLogs, To as hasInterruptsOnly, Tr as makeSpanScoped, Tt as tag, Ua as TracerTimingEnabled, Ui as timer, Ul as isNotUndefined, Un as currentSpan, Ur as provide, Ut as toArray, V as brand, Va as MinimumLogLevel, Vc as get$3, Vi as gauge, Vl as isNotNull, Vn as context, Vo as andThen$1, Vr as orElseSucceed, Vt as isEmpty$2, W as decodeEffect, Wa as _await, Wc as getUnsafe$1, Wi as update$3, Wl as isNullish, Wr as provideContext, Ws as days, X as decodeUnknownOption, Xc as flatMap$2, Xl as compose, Xn as failCause$1, Xr as retry, Xt as onSome, Y as decodeUnknownExit, Yc as firstSomeOf, Yi as forever$2, Yl as cast, Yn as fail, Yr as result, Z as decodeUnknownSync, Za as isDeferred, Zc as flatten$1, Zi as passthrough$1, Zr as runFork, Zs as max, Zt as parseJson$1, _ as NonEmptyArray, _a as effectContext, _i as tapErrorTag, _n as toUtc, _t as isSchemaError, a as DateTimeUtc, aa as Random$1, ac as zero, al as map$5, an as value, ao as interrupt$3, ar as fnUntraced, at as isBetween, au as pipe$1, b as NullOr, bc as reverse, bi as timeoutOrElse, bn as acquireUseRelease, br as logDebug, bs as reportCauseUnsafe, bt as makeFilter, c as Defect, ca as Clock, cc as ensure, ci as sleep$4, cl as some, cn as add$3, co as match$2, cr as forkChild, cs as flatMap$1, ct as isGreaterThanOrEqualTo, d as Exit, dc as fromIterable, di as succeedSome, dn as isGreaterThanOrEqualTo$1, dr as forkScoped, ds as forkDetach, dt as isMaxLength, ea as catchDone, ec as minutes, el as getOrElse, er as filterOrFail, et as encodeSync, eu as constVoid, fa as TaggedError, fi as suspend$1, fn as make$38, fr as gen, ft as isMaxProperties, g as Never, ga as effect, gi as tapError, gl as YieldableProto, gn as toEpochMillis, gr as interruptible, gt as isSchema, h as Literals, ha as buildWithMemoMap, hi as tapCause, hl as PipeInspectableProto, hn as toDate, hr as interrupt$1, ht as isPattern, i as Class, ic as toSeconds, ii as scoped, il as isSome, in as make$40, io as failCause$2, ir as fn$1, it as is$1, iu as identity, ja as addFinalizer$1, jn as cachedWithTTL, jo as map$6, jr as matchCauseEffect, jt as withDecodingDefault, k as Trim, ka as unwrap, ki as useSpan, kl as format, kn as asVoid, ks as tracerLogger$1, kt as toType, l as Duration, la as currentTimeMillis, lc as filter, li as succeed, ll as Number$2, ln as distance, lr as forkDetach$1, ls as fnUntraced$1, lt as isInt, m as Literal, ma as build, mc as isReadonlyArrayNonEmpty, mi as tap, mn as now, mo as StackTrace, mr as ignoreCause, ms as loggerMake, mt as isNonEmpty, n as ArraySchema, nc as times, nl as getOrUndefined, no as die$2, nt as encodeUnknownExit, nu as dual, o as DateTimeUtcFromString, oa as clamp, oc as allocate, oi as service, ol as match, oo as isFailure, or as forEach, ot as isFinite$1, ou as pipeArguments, p as Int$1, pa as CurrentMemoMap, pc as isArrayNonEmpty, pi as sync$1, pn as makeUnsafe$5, po as NoSuchElementError, pr as ignore, pt as isMinLength, q as decodeTo, qa as fail$3, qc as merge$2, qi as both, qn as ensuring, qr as raceFirst, qs as fromInputUnsafe, r as Boolean$1, ra as isDoneCause, rc as toMillis, ri as scope$1, rl as isNone, rn as makeFormatterDefault, ro as fail$2, rr as flatten$2, rt as fromJsonString, sa as parse$6, sc as empty$3, si as serviceOption, sl as none$4, sn as encodeBase64Url$2, so as isSuccess, sr as forever$1, st as isGreaterThan, t as Any, tc as seconds, ti as runPromiseWith, tl as getOrNull, tn as InvalidValue$1, to as succeed$3, tr as flatMap, ts as fiberInterrupt, tt as encodeUnknownEffect, tu as constant, u as ErrorClass, ua as Class$1, uc as flatMapNullishOr, ui as succeedNone, ul as make$41, un as formatIso, uo as void_$3, ur as forkIn, us as forever, ut as isLessThanOrEqualTo, v as NonEmptyString, va as effectDiscard, vc as map$4, vi as timeout$1, vn as Transaction$1, vo as done$1, vr as isEffect, w as String$1, wa as provide$1, wi as txRetry, wl as withFiber, wn as annotateCurrentSpan, wo as hasInterrupts, wr as logWarning$1, wt as suspend$2, x as Number$1, xa as launch$1, xc as sort, xi as tryPromise, xn as addFinalizer$2, xr as logError, xs as scope, xt as mutable, y as Null, ya as empty$4, yi as timeoutOption, yn as acquireRelease, yo as fail$4, yr as log$4, yt as make$36, z as Void, za as CurrentLogAnnotations, zc as add$2, zi as zipWith, zl as compose$1, zn as catchTags, zr as option, zs as externalSpan, zt as empty$2 } from "./Schema-CJyk7ah1.mjs";
+import { $ as toAsyncIterable, A as make$45, At as make$44, Bt as publish, C as fromEffect, Ct as make$43, E as fromQueue, Et as end, F as merge$4, Ft as shutdown$1, G as runFold, H as run$2, Ht as subscribe$1, It as sliding, Jt as getCurrent, K as runForEach, Kt as makeUnsafe$7, Lt as take$1, M as mapAccum, Mt as offerAll, N as mapEffect$1, Nt as offerUnsafe, O as fromSubscription, Ot as failCause$4, Q as tick, R as onExit$1, Rt as takeAll, S as fromChannel, T as fromPubSub, Tt as bounded, U as runCollect, Ut as unbounded$1, V as provideContext$1, Vt as shutdown$2, W as runDrain, Y as succeed$4, Yt as interrupt$4, Z as takeWhile, Zt as runIn, _t as mapInput, at as make$46, b as flatMap$3, bt as fromTransform, c as callback$1, d as debounce$1, f as decodeText$1, g as ensuring$1, h as encodeText, it as get$4, j as map$7, jt as offer$1, k as isStream, l as catchCause$1, m as empty$5, mt as forEach$1, ot as get$5, pt as drain, q as runForEachArray, qt as await_, r as FileSystem, rt as unwrap$1, st as make$47, t as Path$2, u as concat$2, v as failCause$5, w as fromIterable$1, wt as makeUnsafe$6, x as fromAsyncIterable, y as filter$2, yt as fromSubscriptionArray, zt as unbounded$2 } from "./Path-C6Zb2WHp.mjs";
+import { _ as ChildProcessSpawner, a as Stdio, g as make$48, o as make$49, r as isQuitError } from "./NodeTerminal-BEGtoMSS.mjs";
+import { n as layer$7 } from "./NodeServices-CBNXOYLG.mjs";
+import { $ as file, A as SocketErrorReason, At as merge$5, Bt as set$2, Ct as HttpClientErrorSchema, Dt as empty$7, Ft as getAndSet, G as TracerPropagationEnabled, Ht as updateAndGet, I as HttpServerError, It as getUnsafe$2, J as transformResponse, K as filterStatusOk$1, Lt as make$50, Ot as fromInput$1, Pt as get$6, Q as empty$6, Rt as makeUnsafe$8, St as setBody, Tt as jsonUnsafe$1, U as layer$8, Vt as update$4, W as HttpClient, Z as symbol$1, _ as schemaBodyUrlParams, _t as acceptJson, a as withLogAddress, at as setCookie, bt as get$7, ct as stream, d as logger$1, dt as filterStatusOk, et as isHttpServerResponse, f as withLoggerDisabled, ft as matchStatus, g as schemaBodyJson, gt as schemaBodyJson$1, i as serve$1, it as schemaJson, kt as fromRecordUnsafe, lt as text$2, m as ParsedSearchParams, nt as raw, ot as setCookies, p as HttpServerRequest, q as retryTransient, rt as redirect, st as setHeader, t as HttpServer, tt as jsonUnsafe, u as cors, ut as uint8Array, v as schemaHeaders, vt as bearerToken, wt as isHttpClientError, xt as post, y as toURL, yt as bodyJson, z as RouteNotFound, zt as modify$3 } from "./HttpServer-DNGCTTdk.mjs";
+import { _ as withDefault$3, a as all$1, c as logLevel, d as option$1, f as port, g as url$2, i as TrueValues, l as map$8, m as string$7, n as FalseValues, o as boolean$5, p as schema$2, r as Record$1, s as int$2, t as Boolean$2, u as number$2 } from "./Config-AqUR_lhX.mjs";
+import { a as make$51, i as keys, n as getOption, o as makeWith$1, r as invalidate, s as set$3, t as get$8 } from "./Cache-p0X77SKw.mjs";
+import { S as layer$9, _ as defaultEscape, a as DeadlockError, b as makeCompiler$1, c as SqlError, d as UnknownError, g as custom, h as make$52, i as ConstraintError, l as SqlSyntaxError, m as SqlClient, n as AuthorizationError, o as LockTimeoutError, r as ConnectionError, s as SerializationError, t as AuthenticationError, u as StatementTimeoutError, v as defaultTransforms, y as fragment } from "./SqlError-cyJT2IRY.mjs";
 import { r as wrapper_default, t as Mime_default } from "./Mime-Dq9IoNiV.mjs";
 import { a as diag, c as SpanKind$1, d as TraceFlags, f as ROOT_CONTEXT, i as propagation, l as isSpanContextValid, m as DiagLogLevel, n as init_esm$1, o as context$1, p as createContextKey, r as trace, s as SpanStatusCode, t as esm_exports$1 } from "./esm-wLIF-u3N.mjs";
 import { a as verifyCmmdAuthRuntimeTicket, c as verifyCmmdRuntimeTicket, d as setRuntimeGrantToken, f as createReadOnceFileTokenAccessor, i as sendRuntimeControlHeartbeat, l as verifyCmmdRuntimeTicketRefreshProof, n as bootstrapRuntimeControlAuthorityFromNarrowGrant, o as verifyCmmdClaudeReadinessTicket, r as readRuntimeControlAuthority, s as verifyCmmdClaudeUsageTicket, t as bootstrapRuntimeControlAuthority, u as runtimeGrantToken } from "./runtimeControlAuthority-COHmz_WT.mjs";
-import { n as PtySpawnError, t as PtyAdapter } from "./PTY-DdjcAGrF.mjs";
+import { n as PtySpawnError, t as PtyAdapter } from "./PTY-rIPf52QR.mjs";
 import { createRequire } from "node:module";
 import * as HE from "node:child_process";
 import { execFile, execFileSync, spawn, spawnSync } from "node:child_process";
@@ -65495,7 +65495,7 @@ function normalizeNumberish(value) {
 }
 //#endregion
 //#region package.json
-var version$1 = "0.10.13";
+var version$1 = "0.10.16";
 //#endregion
 //#region src/sentry.ts
 const SERVER_APP_NAME = "forge-server";
@@ -65968,7 +65968,7 @@ function readCmmdAvatarUrl(raw) {
 function readTrimmedString$2(value) {
 	return typeof value === "string" ? value.trim() || null : null;
 }
-function asRecord$13(value) {
+function asRecord$14(value) {
 	return value && typeof value === "object" ? value : null;
 }
 function readDirectPlanLabelFromRecord(obj) {
@@ -65980,26 +65980,26 @@ function readNestedPlanLabelFromRecord(obj) {
 function readCmmdPlanLabel(obj) {
 	const direct = readDirectPlanLabelFromRecord(obj);
 	if (direct) return direct;
-	const plan = asRecord$13(obj["plan"]);
+	const plan = asRecord$14(obj["plan"]);
 	if (plan) {
 		const label = readNestedPlanLabelFromRecord(plan);
 		if (label) return label;
 	}
-	const subscription = asRecord$13(obj["subscription"]);
+	const subscription = asRecord$14(obj["subscription"]);
 	if (subscription) {
 		const label = readNestedPlanLabelFromRecord(subscription);
 		if (label) return label;
-		const subscriptionPlan = asRecord$13(subscription["plan"]);
+		const subscriptionPlan = asRecord$14(subscription["plan"]);
 		if (subscriptionPlan) {
 			const nestedLabel = readNestedPlanLabelFromRecord(subscriptionPlan);
 			if (nestedLabel) return nestedLabel;
 		}
 	}
-	const billing = asRecord$13(obj["billing"]);
+	const billing = asRecord$14(obj["billing"]);
 	if (billing) {
 		const label = readNestedPlanLabelFromRecord(billing);
 		if (label) return label;
-		const billingPlan = asRecord$13(billing["plan"]);
+		const billingPlan = asRecord$14(billing["plan"]);
 		if (billingPlan) return readNestedPlanLabelFromRecord(billingPlan);
 	}
 	return null;
@@ -69794,22 +69794,22 @@ const EMPTY_PARSED_ERROR = {
 	message: null,
 	raw: null
 };
-function asRecord$12(value) {
+function asRecord$13(value) {
 	return value !== null && typeof value === "object" && !Array.isArray(value) ? value : null;
 }
 function readTrimmedString$1(value) {
 	return (typeof value === "string" ? value.trim() : "") || null;
 }
 function readErrorEnvelope(record) {
-	return asRecord$12(record["error"]);
+	return asRecord$13(record["error"]);
 }
 function readUpstreamErrorCode(body) {
-	const record = asRecord$12(body);
+	const record = asRecord$13(body);
 	if (record === null) return null;
 	return readTrimmedString$1(record["code"]) ?? readTrimmedString$1(readErrorEnvelope(record)?.["code"]);
 }
 function readErrorMessage$2(raw) {
-	const record = asRecord$12(raw);
+	const record = asRecord$13(raw);
 	if (record === null) return null;
 	const error = record["error"];
 	const nestedMessage = readErrorEnvelope(record)?.["message"];
@@ -71891,7 +71891,7 @@ function readStringJS(length) {
 	if (units.length > 0) result += fromCharCode.apply(String, units);
 	return result;
 }
-function readString$4(source, start, length) {
+function readString$5(source, start, length) {
 	let existingSrc = src;
 	src = source;
 	position$1 = start;
@@ -73756,7 +73756,7 @@ function readStruct(src, position, srcEnd, unpackr) {
 						}
 						if (end == null) end = source.bytesEnd - refStart;
 						if (source.srcString) return source.srcString.slice(ref, end);
-						return readString$4(src, ref + refStart, end - ref);
+						return readString$5(src, ref + refStart, end - ref);
 					};
 					break;
 				case UTF8:
@@ -77105,7 +77105,7 @@ succeed$2(TraceDiagnostics, TraceDiagnostics.of({ read: (options) => succeed(mak
 * through the server is what lets it ask at all.
 */
 const RUNTIMES_PATH = "/api/forge/context/runtimes";
-function asRecord$11(value) {
+function asRecord$12(value) {
 	return value !== null && typeof value === "object" && !Array.isArray(value) ? value : null;
 }
 /** A trimmed string, or null. Empty and whitespace are the same as absent. */
@@ -77120,7 +77120,7 @@ function text$1(value) {
 * something that cannot work.
 */
 function toSummary(value) {
-	const row = asRecord$11(value);
+	const row = asRecord$12(value);
 	if (!row) return null;
 	const runtimeId = text$1(row["runtimeId"]);
 	const organizationId = row["organizationId"];
@@ -77144,7 +77144,7 @@ function listCloudRuntimes(input) {
 	return gen(function* () {
 		const jwt = input.jwt;
 		if (jwt === null || jwt.trim().length === 0) return yield* fail(new CloudRuntimeListError({ failure: "not_signed_in" }));
-		const runtimes = asRecord$11(asRecord$11(yield* tryPromise({
+		const runtimes = asRecord$12(asRecord$12(yield* tryPromise({
 			try: () => input.request({
 				method: "GET",
 				jwt,
@@ -77433,10 +77433,10 @@ function updateSuccessfulEntry(input) {
 	return next;
 }
 const makeSourceControlRateLimit = gen(function* () {
-	const entries = yield* make$49(/* @__PURE__ */ new Map());
+	const entries = yield* make$50(/* @__PURE__ */ new Map());
 	const check = fn$1("SourceControlRateLimit.check")(function* (input, options) {
 		const now = yield* currentTimeMillis;
-		const entry = (yield* get$5(entries)).get(normalizedKey(input));
+		const entry = (yield* get$6(entries)).get(normalizedKey(input));
 		if (entry !== void 0 && entry.retryAt > now && options?.allowPaused !== true) return yield* new SourceControlRateLimitPausedError$1({
 			provider: input.provider,
 			host: input.host.trim().toLowerCase(),
@@ -82423,7 +82423,7 @@ const makePullRequestService = gen(function* () {
 	const staleList = staleWhileRevalidate(LIST_STALE_WINDOW, LIST_CACHE_CAPACITY);
 	const list = (input) => {
 		const key = listCacheKey(input, listingsEpoch);
-		return staleList(key, get$7(listCache, key));
+		return staleList(key, get$8(listCache, key));
 	};
 	const detailCache = yield* makeWith$1((key) => {
 		const [, projectId, repository, number] = JSON.parse(key);
@@ -82444,7 +82444,7 @@ const makePullRequestService = gen(function* () {
 			input.repository,
 			input.number
 		]);
-		return staleDetail(key, get$7(detailCache, key));
+		return staleDetail(key, get$8(detailCache, key));
 	};
 	const activityCache = yield* makeWith$1((key) => {
 		const [, projectId, repository, number] = JSON.parse(key);
@@ -82465,7 +82465,7 @@ const makePullRequestService = gen(function* () {
 			input.repository,
 			input.number
 		]);
-		return staleActivity(key, get$7(activityCache, key));
+		return staleActivity(key, get$8(activityCache, key));
 	};
 	const diffCache = yield* makeWith$1((key) => {
 		const [, projectId, repository, number, cursor, commit] = JSON.parse(key);
@@ -82493,7 +82493,7 @@ const makePullRequestService = gen(function* () {
 			input.cursor ?? null,
 			input.commit ?? null
 		]);
-		return staleDiff(key, get$7(diffCache, key));
+		return staleDiff(key, get$8(diffCache, key));
 	};
 	const listStatsCache = yield* makeWith$1((key) => {
 		const [, refs] = JSON.parse(key);
@@ -82514,7 +82514,7 @@ const makePullRequestService = gen(function* () {
 			ref.repository,
 			ref.number
 		]).toSorted((left, right) => `${left[0]} ${left[1]} ${left[2]}`.localeCompare(`${right[0]} ${right[1]} ${right[2]}`))]);
-		return staleListStats(key, get$7(listStatsCache, key));
+		return staleListStats(key, get$8(listStatsCache, key));
 	};
 	const invalidate = (input) => sync$1(() => {
 		if (input.reference === void 0) {
@@ -82632,12 +82632,12 @@ function resolveGithubWriteIdentity(getSettings) {
 }
 var ServerSettingsService = class ServerSettingsService extends Service$1()("forge/serverSettings/ServerSettingsService") {
 	static layerTest = (overrides = {}) => effect(ServerSettingsService, gen(function* () {
-		const currentSettingsRef = yield* make$49(deepMerge$1(DEFAULT_SERVER_SETTINGS, overrides));
+		const currentSettingsRef = yield* make$50(deepMerge$1(DEFAULT_SERVER_SETTINGS, overrides));
 		return {
 			start: void_$1,
 			ready: void_$1,
-			getSettings: get$5(currentSettingsRef),
-			updateSettings: (patch) => get$5(currentSettingsRef).pipe(map$3((currentSettings) => deepMerge$1(currentSettings, patch)), tap((nextSettings) => set$2(currentSettingsRef, nextSettings))),
+			getSettings: get$6(currentSettingsRef),
+			updateSettings: (patch) => get$6(currentSettingsRef).pipe(map$3((currentSettings) => deepMerge$1(currentSettings, patch)), tap((nextSettings) => set$2(currentSettingsRef, nextSettings))),
 			streamChanges: empty$5
 		};
 	}));
@@ -82693,7 +82693,7 @@ const ServerSettingsLive = effect(ServerSettingsService, gen(function* () {
 	const writeSemaphore = yield* make$43(1);
 	const cacheKey = "settings";
 	const changesPubSub = yield* unbounded$1();
-	const startedRef = yield* make$49(false);
+	const startedRef = yield* make$50(false);
 	const startedDeferred = yield* make$39();
 	const watcherScope = yield* make$37("sequential");
 	yield* addFinalizer$2(() => close(watcherScope, void_$3));
@@ -82721,11 +82721,11 @@ const ServerSettingsLive = effect(ServerSettingsService, gen(function* () {
 		}
 		return decoded.value;
 	});
-	const settingsCache = yield* make$50({
+	const settingsCache = yield* make$51({
 		capacity: 1,
 		lookup: () => loadSettingsFromDisk
 	});
-	const getSettingsFromCache = get$7(settingsCache, cacheKey);
+	const getSettingsFromCache = get$8(settingsCache, cacheKey);
 	const writeSettingsAtomically = (settings) => {
 		const tempPath = `${settingsPath}.${process.pid}.${Date.now()}.tmp`;
 		const sparseSettings = stripDefaultServerSettings(settings, DEFAULT_SERVER_SETTINGS) ?? {};
@@ -91522,7 +91522,7 @@ const KeybindingsLive = effect(Keybindings, gen(function* () {
 	const upsertSemaphore = yield* make$43(1);
 	const resolvedConfigCacheKey = "resolved";
 	const changesPubSub = yield* unbounded$1();
-	const startedRef = yield* make$49(false);
+	const startedRef = yield* make$50(false);
 	const startedDeferred = yield* make$39();
 	const watcherScope = yield* make$37("sequential");
 	yield* addFinalizer$2(() => close(watcherScope, void_$3));
@@ -91622,11 +91622,11 @@ const KeybindingsLive = effect(Keybindings, gen(function* () {
 		keybindings: mergeWithDefaultKeybindings(compileResolvedKeybindingsConfig(keybindings)),
 		issues
 	})));
-	const resolvedConfigCache = yield* make$50({
+	const resolvedConfigCache = yield* make$51({
 		capacity: 1,
 		lookup: () => loadConfigStateFromDisk
 	});
-	const loadConfigStateFromCacheOrDisk = get$7(resolvedConfigCache, resolvedConfigCacheKey);
+	const loadConfigStateFromCacheOrDisk = get$8(resolvedConfigCache, resolvedConfigCacheKey);
 	const revalidateAndEmit = upsertSemaphore.withPermits(1)(gen(function* () {
 		yield* invalidate(resolvedConfigCache, resolvedConfigCacheKey);
 		yield* emitChange(yield* loadConfigStateFromCacheOrDisk);
@@ -91706,7 +91706,7 @@ const KeybindingsLive = effect(Keybindings, gen(function* () {
 	});
 	return {
 		start: gen(function* () {
-			if (yield* get$5(startedRef)) return yield* _await(startedDeferred);
+			if (yield* get$6(startedRef)) return yield* _await(startedDeferred);
 			yield* set$2(startedRef, true);
 			const startupExit = yield* exit(gen(function* () {
 				yield* startWatcher;
@@ -92550,7 +92550,7 @@ var ProviderRegistry = class extends Service$1()("forge/provider/Services/Provid
 var ServerLifecycleEvents = class extends Service$1()("forge/serverLifecycleEvents") {};
 const ServerLifecycleEventsLive = effect(ServerLifecycleEvents, gen(function* () {
 	const pubsub = yield* unbounded$1();
-	const state = yield* make$49({
+	const state = yield* make$50({
 		sequence: 0,
 		events: []
 	});
@@ -92566,7 +92566,7 @@ const ServerLifecycleEventsLive = effect(ServerLifecycleEvents, gen(function* ()
 				events: nextEvent.type === "welcome" ? [nextEvent, ...current.events.filter((entry) => entry.type !== "welcome")] : [nextEvent, ...current.events.filter((entry) => entry.type !== "ready")]
 			}];
 		}).pipe(tap((event) => publish(pubsub, event))),
-		snapshot: get$5(state),
+		snapshot: get$6(state),
 		get stream() {
 			return fromPubSub(pubsub);
 		}
@@ -97847,10 +97847,10 @@ const runUsageScanWarmup = (options) => gen(function* () {
 	const now = options.now ?? currentTimeMillis;
 	const startDelayMs = options.startDelayMs ?? 2e4;
 	const intervalMs = options.intervalMs ?? 36e5;
-	const scanning = yield* make$49(false);
+	const scanning = yield* make$50(false);
 	yield* sleep(startDelayMs);
 	return yield* forever$1(gen(function* () {
-		if (yield* get$5(scanning)) yield* logInfo("usage scan warm-up skipped; the previous scan is still running");
+		if (yield* get$6(scanning)) yield* logInfo("usage scan warm-up skipped; the previous scan is still running");
 		else {
 			yield* set$2(scanning, true);
 			yield* forkChild(scanOnce(options, now).pipe(ensuring(set$2(scanning, false))));
@@ -97866,7 +97866,7 @@ const settleQueuedCommand = (deferred, exit) => isSuccess(exit) ? succeed$3(defe
 const makeCommandGate = gen(function* () {
 	const commandReady = yield* make$39();
 	const commandQueue = yield* unbounded$2();
-	const commandReadinessState = yield* make$49("pending");
+	const commandReadinessState = yield* make$50("pending");
 	yield* forkScoped(forever$1(take$1(commandQueue).pipe(flatMap((command) => command.run))));
 	return {
 		awaitCommandReady: _await(commandReady),
@@ -97879,7 +97879,7 @@ const makeCommandGate = gen(function* () {
 			yield* fail$3(commandReady, error).pipe(orDie);
 		}),
 		enqueueCommand: (effect) => gen(function* () {
-			const readinessState = yield* get$5(commandReadinessState);
+			const readinessState = yield* get$6(commandReadinessState);
 			if (readinessState === "ready") return yield* effect;
 			if (readinessState !== "pending") return yield* readinessState;
 			const result = yield* make$39();
@@ -99238,19 +99238,19 @@ function previewUrlForPort(port) {
 	return `http://127.0.0.1:${port}/`;
 }
 const ThreadDevRuntimeLive = effect(ThreadDevRuntime, gen(function* () {
-	const byThreadId = yield* make$49(/* @__PURE__ */ new Map());
-	const usedPorts = yield* make$49(/* @__PURE__ */ new Set());
+	const byThreadId = yield* make$50(/* @__PURE__ */ new Map());
+	const usedPorts = yield* make$50(/* @__PURE__ */ new Set());
 	const allocateNextPort = gen(function* () {
-		const used = yield* get$5(usedPorts);
+		const used = yield* get$6(usedPorts);
 		for (let port = DEFAULT_PORT_MIN; port <= DEFAULT_PORT_MAX; port += 1) if (!used.has(port)) return port;
 		return yield* new ThreadDevRuntimeError({ detail: `No dev ports available in range ${DEFAULT_PORT_MIN}-${DEFAULT_PORT_MAX}.` });
 	});
 	return {
 		get: (input) => gen(function* () {
-			return (yield* get$5(byThreadId)).get(input.threadId) ?? null;
+			return (yield* get$6(byThreadId)).get(input.threadId) ?? null;
 		}),
 		allocatePort: (input) => gen(function* () {
-			const existing = (yield* get$5(byThreadId)).get(input.threadId);
+			const existing = (yield* get$6(byThreadId)).get(input.threadId);
 			if (existing && existing.status !== "released") return existing;
 			const port = yield* allocateNextPort;
 			const record = {
@@ -99273,7 +99273,7 @@ const ThreadDevRuntimeLive = effect(ThreadDevRuntime, gen(function* () {
 			return record;
 		}),
 		release: (input) => gen(function* () {
-			const existing = (yield* get$5(byThreadId)).get(input.threadId);
+			const existing = (yield* get$6(byThreadId)).get(input.threadId);
 			if (!existing) return;
 			yield* update$4(byThreadId, (current) => {
 				const next = new Map(current);
@@ -99291,7 +99291,7 @@ const ThreadDevRuntimeLive = effect(ThreadDevRuntime, gen(function* () {
 			});
 		}),
 		setRunning: (threadId, patch) => gen(function* () {
-			const existing = (yield* get$5(byThreadId)).get(threadId);
+			const existing = (yield* get$6(byThreadId)).get(threadId);
 			if (!existing && patch.allocatedPort === void 0) return yield* new ThreadDevRuntimeError({ detail: `No dev runtime record for thread ${threadId}.` });
 			const allocatedPort = patch.allocatedPort ?? existing?.allocatedPort;
 			if (allocatedPort === void 0) return yield* new ThreadDevRuntimeError({ detail: `No dev runtime port is available for thread ${threadId}.` });
@@ -100501,7 +100501,7 @@ const EMPTY_PLAN_VALUES = new Set([
 	"none",
 	"null"
 ]);
-function asRecord$10(value) {
+function asRecord$11(value) {
 	if (!value || typeof value !== "object" || Array.isArray(value)) return void 0;
 	return value;
 }
@@ -100518,7 +100518,7 @@ function decodeJwtClaims(token) {
 	try {
 		const decoded = Buffer.from(payload, "base64url");
 		if (decoded.byteLength > MAX_CLAIMS_BYTES) return void 0;
-		return asRecord$10(JSON.parse(decoded.toString("utf8")));
+		return asRecord$11(JSON.parse(decoded.toString("utf8")));
 	} catch {
 		return;
 	}
@@ -100540,7 +100540,7 @@ function findPlanType(claims) {
 	const direct = fromRecord(claims);
 	if (direct) return direct;
 	for (const value of Object.values(claims)) {
-		const nested = asRecord$10(value);
+		const nested = asRecord$11(value);
 		if (!nested) continue;
 		const found = fromRecord(nested);
 		if (found) return found;
@@ -100557,7 +100557,7 @@ function readCodexAuthIdentity(authJson) {
 	} catch {
 		return {};
 	}
-	const claims = decodeJwtClaims(asRecord$10(asRecord$10(parsed)?.tokens)?.id_token);
+	const claims = decodeJwtClaims(asRecord$11(asRecord$11(parsed)?.tokens)?.id_token);
 	if (!claims) return {};
 	const email = findEmail(claims);
 	const planType = findPlanType(claims);
@@ -105075,7 +105075,7 @@ const makeWsRpcLayer = (currentSessionId, currentUserId) => WsRpcGroup.toLayer(g
 		}), { "rpc.aggregate": "server" }),
 		[WS_METHODS.subscribeAuthAccess]: (_input) => observeRpcStreamEffect(WS_METHODS.subscribeAuthAccess, gen(function* () {
 			const initialSnapshot = yield* loadAuthAccessSnapshot();
-			const revisionRef = yield* make$49(1);
+			const revisionRef = yield* make$50(1);
 			const liveEvents = merge$4(bootstrapCredentials.streamChanges, sessions.streamChanges).pipe(mapEffect$1((change) => updateAndGet(revisionRef, (revision) => revision + 1).pipe(map$3((revision) => toAuthAccessStreamEvent(change, revision, currentSessionId)))));
 			return concat$2(make$45({
 				version: 1,
@@ -112410,7 +112410,7 @@ const makeWith = /* @__PURE__ */ fnUntraced(function* (options) {
 	const compiler = makeCompiler(options.transformQueryNames, options.transformJson);
 	const transformRows = options.transformResultNames ? defaultTransforms(options.transformResultNames, options.transformJson).array : void 0;
 	const config = options.config;
-	return Object.assign(yield* make$51({
+	return Object.assign(yield* make$52({
 		acquirer: options.acquirer,
 		transactionAcquirer: options.transactionAcquirer,
 		compiler,
@@ -116161,8 +116161,8 @@ effectDiscard(runMigrations());
 //#endregion
 //#region src/persistence/Layers/Sqlite.ts
 const defaultSqliteClientLoaders = {
-	bun: () => import("./SqliteClient-DdItRZUr.mjs"),
-	node: () => import("./NodeSqliteClient-BqUcml1B.mjs")
+	bun: () => import("./SqliteClient-CIsITMoQ.mjs"),
+	node: () => import("./NodeSqliteClient-DGInbxQ3.mjs")
 };
 const makeRuntimeSqliteLayer = fn$1("makeRuntimeSqliteLayer")(function* (config) {
 	const loader = defaultSqliteClientLoaders[process.versions.bun !== void 0 ? "bun" : "node"];
@@ -147374,7 +147374,7 @@ const AnalyticsServiceLayerLive = effect(AnalyticsService, gen(function* () {
 	const httpClient = yield* HttpClient;
 	const serverConfig = yield* ServerConfig;
 	const identifier = yield* getTelemetryIdentifier;
-	const bufferRef = yield* make$49([]);
+	const bufferRef = yield* make$50([]);
 	const clientType = serverConfig.mode === "desktop" ? "desktop-app" : "cli-web-client";
 	const enqueueBufferedEvent = (event, properties) => flatMap(now, (now) => modify$3(bufferRef, (current) => {
 		const appended = [...current, {
@@ -149004,11 +149004,11 @@ function readObject(value) {
 function readArray(value) {
 	return Array.isArray(value) ? value : void 0;
 }
-function readString$3(value) {
+function readString$4(value) {
 	return typeof value === "string" ? value : void 0;
 }
 function nonEmptyTrimmed$1(value) {
-	const candidate = readString$3(value)?.trim();
+	const candidate = readString$4(value)?.trim();
 	return candidate ? candidate : void 0;
 }
 function readBoolean$2(value) {
@@ -149790,6 +149790,23 @@ function issueCmmdLocalUserProviderEgressCredential(input) {
 	});
 }
 //#endregion
+//#region src/provider/codexAccountTransition.ts
+function explicitProviderAccountTransition(fromAccountId, toAccountId) {
+	if (!fromAccountId || !toAccountId || fromAccountId === toAccountId) return void 0;
+	return {
+		fromAccountId,
+		toAccountId
+	};
+}
+function permitsCodexAccountTransition(input) {
+	const { transition, requestedAccountId, prior, current } = input;
+	if (!transition || transition.fromAccountId === transition.toAccountId || transition.toAccountId !== requestedAccountId || prior.identity.kind !== "provider_account" || current.identity.kind !== "provider_account" || prior.identity.provider !== "codex" || current.identity.provider !== "codex") return false;
+	return providerDeliveryBindingsEqual({
+		...prior,
+		identity: current.identity
+	}, current);
+}
+//#endregion
 //#region src/providerAuth/codexLocalAccountIdentity.ts
 const ACCOUNT_IDENTITY_PATH = "/api/forge/context/providers/codex/account-identity";
 const PROVIDER_ACCOUNT_IDENTITY$1 = /^pai_v1_[A-Za-z0-9_-]{43}$/;
@@ -150287,7 +150304,12 @@ var CodexAppServerManager = class extends EventEmitter$1 {
 				const rawPriorDeliveryBinding = input.resumeCursor.providerDeliveryBinding;
 				const priorDeliveryBinding = readProviderDeliveryBinding(rawPriorDeliveryBinding);
 				if (rawPriorDeliveryBinding !== void 0 && rawPriorDeliveryBinding !== null && !priorDeliveryBinding) throw new Error("Existing Codex history cannot resume because its persisted delivered provider account binding is unreadable.");
-				if (priorDeliveryBinding && !providerDeliveryBindingsEqual(priorDeliveryBinding, currentDeliveryBinding)) throw new Error("Existing Codex history cannot resume because the delivered provider account changed.");
+				if (priorDeliveryBinding && !providerDeliveryBindingsEqual(priorDeliveryBinding, currentDeliveryBinding) && !permitsCodexAccountTransition({
+					transition: input.accountTransition,
+					requestedAccountId: input.providerAccountId,
+					prior: priorDeliveryBinding,
+					current: currentDeliveryBinding
+				})) throw new Error("Existing Codex history cannot resume because the delivered provider account changed.");
 			}
 			const initialResumeCursor = initialCodexResumeCursor({
 				resumeCursor: input.resumeCursor,
@@ -206501,7 +206523,7 @@ function createCodexBrowserDynamicTools() {
 function readArgs$3(value) {
 	return value && typeof value === "object" ? value : {};
 }
-function readString$2(args, key) {
+function readString$3(args, key) {
 	const value = args[key];
 	return typeof value === "string" && value.trim().length > 0 ? value : void 0;
 }
@@ -206530,27 +206552,27 @@ function createCodexBrowserDynamicToolHandler(browserManager, options = {}) {
 		const toolScope = options.environmentId === void 0 ? {} : { environmentId: options.environmentId };
 		const handlers = makeBrowserHandlers(browserManager, ThreadId.make(input.threadId), toolScope);
 		const args = readArgs$3(input.arguments);
-		const tabId = readString$2(args, "tabId");
+		const tabId = readString$3(args, "tabId");
 		switch (input.tool) {
 			case "forge_browser_list_sessions": return toCodexDynamicToolResult$2(await handlers.listSessions());
 			case "forge_browser_name_session": {
-				const name = readString$2(args, "name");
+				const name = readString$3(args, "name");
 				if (!name) throw new Error("forge_browser_name_session requires a name.");
 				return toCodexDynamicToolResult$2(await handlers.nameSession(name));
 			}
 			case "forge_browser_set_visibility": {
-				const visibility = readString$2(args, "visibility");
+				const visibility = readString$3(args, "visibility");
 				if (visibility !== "hidden" && visibility !== "visible") throw new Error("forge_browser_set_visibility requires visibility hidden or visible.");
 				return toCodexDynamicToolResult$2(await handlers.setVisibility(visibility));
 			}
 			case "forge_browser_close_session":
 			case "forge_browser_reset_session": return toCodexDynamicToolResult$2(await handlers.closeSession());
 			case "forge_browser_navigate": {
-				const url = readString$2(args, "url");
+				const url = readString$3(args, "url");
 				if (!url) throw new Error("forge_browser_navigate requires a URL.");
 				return toCodexDynamicToolResult$2(await handlers.navigate(url, tabId));
 			}
-			case "forge_browser_new_tab": return toCodexDynamicToolResult$2(await handlers.newTab(readString$2(args, "url")));
+			case "forge_browser_new_tab": return toCodexDynamicToolResult$2(await handlers.newTab(readString$3(args, "url")));
 			case "forge_browser_close_tab":
 				if (!tabId) throw new Error("forge_browser_close_tab requires a tabId.");
 				return toCodexDynamicToolResult$2(await handlers.closeTab(tabId));
@@ -206561,33 +206583,33 @@ function createCodexBrowserDynamicToolHandler(browserManager, options = {}) {
 			case "forge_browser_go_forward": return toCodexDynamicToolResult$2(await handlers.goForward(tabId));
 			case "forge_browser_reload": return toCodexDynamicToolResult$2(await handlers.reload(tabId));
 			case "forge_browser_click": {
-				const selector = readString$2(args, "selector");
+				const selector = readString$3(args, "selector");
 				if (!selector) throw new Error("forge_browser_click requires a selector.");
 				return toCodexDynamicToolResult$2(await handlers.click(selector, tabId));
 			}
 			case "forge_browser_click_point": {
 				const x = readNumber$2(args, "x");
 				const y = readNumber$2(args, "y");
-				const button = readString$2(args, "button");
+				const button = readString$3(args, "button");
 				const clickCount = readNumber$2(args, "clickCount");
 				if (x === void 0 || y === void 0) throw new Error("forge_browser_click_point requires x and y.");
 				if (button !== void 0 && button !== "left" && button !== "middle" && button !== "right") throw new Error("forge_browser_click_point requires button left, middle, or right.");
 				return toCodexDynamicToolResult$2(await handlers.clickPoint(x, y, button, clickCount, tabId));
 			}
 			case "forge_browser_type": {
-				const selector = readString$2(args, "selector");
+				const selector = readString$3(args, "selector");
 				if (!selector) throw new Error("forge_browser_type requires a selector.");
-				const text = readString$2(args, "text");
+				const text = readString$3(args, "text");
 				if (text === void 0) throw new Error("forge_browser_type requires text.");
 				return toCodexDynamicToolResult$2(await handlers.type(selector, text, readBoolean$1(args, "append"), tabId));
 			}
 			case "forge_browser_type_text": {
-				const text = readString$2(args, "text");
+				const text = readString$3(args, "text");
 				if (text === void 0) throw new Error("forge_browser_type_text requires text.");
 				return toCodexDynamicToolResult$2(await handlers.typeText(text, readBoolean$1(args, "pressEnter"), tabId));
 			}
 			case "forge_browser_press_key": {
-				const key = readString$2(args, "key");
+				const key = readString$3(args, "key");
 				if (!key) throw new Error("forge_browser_press_key requires a key.");
 				return toCodexDynamicToolResult$2(await handlers.pressKey(key, tabId));
 			}
@@ -206901,7 +206923,7 @@ function createCodexComputerDynamicToolHandler(computerManager) {
 function readArgs$1(value) {
 	return value && typeof value === "object" && !Array.isArray(value) ? value : {};
 }
-function readString$1(args, key) {
+function readString$2(args, key) {
 	const value = args[key];
 	return typeof value === "string" ? value : void 0;
 }
@@ -206921,7 +206943,7 @@ function readStringArray(args, key) {
 	return value.filter((entry) => typeof entry === "string");
 }
 function readRequiredString(args, key, toolName) {
-	const value = readString$1(args, key)?.trim();
+	const value = readString$2(args, key)?.trim();
 	if (!value) throw new Error(`${toolName} requires ${key}.`);
 	return value;
 }
@@ -206956,7 +206978,7 @@ async function runGitHubLifecycleTool(toolName, context) {
 		action,
 		args: lifecycleArgs,
 		mode
-	}), mode === "write" ? readString$1(args, "confirmationId") : void 0);
+	}), mode === "write" ? readString$2(args, "confirmationId") : void 0);
 }
 //#endregion
 //#region src/github/GitHubCodexPullRequestTools.ts
@@ -206966,8 +206988,8 @@ async function runGitHubPullRequestTool(toolName, context) {
 		case "forge_github_create_pull_request": {
 			const cwd = readRequiredString(args, "cwd", toolName);
 			const title = readRequiredString(args, "title", toolName);
-			const body = readString$1(args, "body");
-			const headBranch = readString$1(args, "headBranch")?.trim();
+			const body = readString$2(args, "body");
+			const headBranch = readString$2(args, "headBranch")?.trim();
 			if (body === void 0) throw new Error("forge_github_create_pull_request requires body.");
 			const request = {
 				cwd,
@@ -206976,7 +206998,7 @@ async function runGitHubPullRequestTool(toolName, context) {
 				baseBranch: readRequiredString(args, "baseBranch", toolName),
 				...headBranch ? { headBranch } : {}
 			};
-			return runTool(request, () => broker.createPullRequest(auth, request), readString$1(args, "confirmationId"));
+			return runTool(request, () => broker.createPullRequest(auth, request), readString$2(args, "confirmationId"));
 		}
 		case "forge_github_get_pull_request": {
 			const cwd = readRequiredString(args, "cwd", toolName);
@@ -206998,29 +207020,29 @@ function runStatus$1({ auth, broker, runTool }) {
 	return runTool({}, () => broker.status(auth));
 }
 function runListRepositories({ args, auth, broker, runTool }) {
-	const search = readString$1(args, "search");
+	const search = readString$2(args, "search");
 	return runTool({ search: search ?? null }, () => broker.listRepositories(auth, { search }));
 }
 function runCloneRepository({ args, auth, broker, runTool }) {
 	const toolName = "forge_github_clone_repository";
 	const repoFullName = readRequiredString(args, "repoFullName", toolName);
 	const destination = readRequiredString(args, "destination", toolName);
-	const branch = readString$1(args, "branch");
+	const branch = readString$2(args, "branch");
 	const request = {
 		repoFullName,
 		destination,
 		...branch ? { branch } : {}
 	};
-	return runTool(request, () => broker.cloneRepository(auth, request), readString$1(args, "confirmationId"));
+	return runTool(request, () => broker.cloneRepository(auth, request), readString$2(args, "confirmationId"));
 }
 function runCreateRepository({ args, auth, broker, runTool }) {
 	const toolName = "forge_github_create_repository";
 	const owner = readRequiredString(args, "owner", toolName);
 	const name = readRequiredString(args, "name", toolName);
-	const visibility = readString$1(args, "visibility");
+	const visibility = readString$2(args, "visibility");
 	if (visibility !== void 0 && visibility !== "private" && visibility !== "public") throw new Error("forge_github_create_repository visibility must be private or public.");
 	const repositoryVisibility = visibility;
-	const description = readString$1(args, "description");
+	const description = readString$2(args, "description");
 	const request = {
 		owner,
 		name,
@@ -207028,32 +207050,32 @@ function runCreateRepository({ args, auth, broker, runTool }) {
 		...repositoryVisibility ? { visibility: repositoryVisibility } : {},
 		...description !== void 0 ? { description } : {}
 	};
-	return runTool(request, () => broker.createRepository(auth, request), readString$1(args, "confirmationId"));
+	return runTool(request, () => broker.createRepository(auth, request), readString$2(args, "confirmationId"));
 }
 function runLinkProjectRepository({ args, auth, broker, runTool }) {
 	const toolName = "forge_github_link_project_repository";
 	const cwd = readRequiredString(args, "cwd", toolName);
 	const repoFullName = readRequiredString(args, "repoFullName", toolName);
-	const branch = readString$1(args, "branch");
+	const branch = readString$2(args, "branch");
 	const request = {
 		cwd,
 		repoFullName,
 		...branch ? { branch } : {}
 	};
-	return runTool(request, () => broker.linkProjectRepository(auth, request), readString$1(args, "confirmationId"));
+	return runTool(request, () => broker.linkProjectRepository(auth, request), readString$2(args, "confirmationId"));
 }
 function runPushBranch({ args, auth, broker, runTool }) {
 	const cwd = readRequiredString(args, "cwd", "forge_github_push_branch");
-	const branch = readString$1(args, "branch");
+	const branch = readString$2(args, "branch");
 	const request = {
 		cwd,
 		...branch ? { branch } : {}
 	};
-	return runTool(request, () => broker.pushProjectBranch(auth, request), readString$1(args, "confirmationId"));
+	return runTool(request, () => broker.pushProjectBranch(auth, request), readString$2(args, "confirmationId"));
 }
 function runRefreshCredentials({ args, auth, broker, runTool }) {
 	const request = { cwd: readRequiredString(args, "cwd", "forge_github_refresh_credentials") };
-	return runTool(request, () => broker.refreshProjectCredentials(auth, request), readString$1(args, "confirmationId"));
+	return runTool(request, () => broker.refreshProjectCredentials(auth, request), readString$2(args, "confirmationId"));
 }
 const repositoryToolHandlers = {
 	forge_github_status: runStatus$1,
@@ -207091,7 +207113,7 @@ async function runGitHubWorkflowTool(toolName, context) {
 }
 function listWorkflowRuns({ args, auth, broker, runTool }) {
 	const cwd = readRequiredString(args, "cwd", "forge_github_list_workflow_runs");
-	const branch = readString$1(args, "branch")?.trim();
+	const branch = readString$2(args, "branch")?.trim();
 	const limit = readNumber$1(args, "limit");
 	const request = {
 		cwd,
@@ -207110,7 +207132,7 @@ function watchWorkflowRun({ args, auth, broker, runTool }) {
 }
 function getWorkflowRunLogs({ args, auth, broker, runTool }) {
 	const { cwd, runId } = readWorkflowRunRequest(args, "forge_github_get_workflow_run_logs");
-	const jobId = readString$1(args, "jobId")?.trim();
+	const jobId = readString$2(args, "jobId")?.trim();
 	const request = {
 		cwd,
 		runId,
@@ -207120,16 +207142,16 @@ function getWorkflowRunLogs({ args, auth, broker, runTool }) {
 }
 function downloadWorkflowArtifacts({ args, auth, broker, runTool }) {
 	const cwd = readRequiredString(args, "cwd", "forge_github_download_workflow_artifacts");
-	const runId = readString$1(args, "runId")?.trim();
-	const artifactName = readString$1(args, "artifactName")?.trim();
-	const destinationDir = readString$1(args, "destinationDir")?.trim();
+	const runId = readString$2(args, "runId")?.trim();
+	const artifactName = readString$2(args, "artifactName")?.trim();
+	const destinationDir = readString$2(args, "destinationDir")?.trim();
 	const request = {
 		cwd,
 		...runId ? { runId } : {},
 		...artifactName ? { artifactName } : {},
 		...destinationDir ? { destinationDir } : {}
 	};
-	return runTool(request, () => broker.downloadWorkflowArtifacts(auth, request), readString$1(args, "confirmationId"));
+	return runTool(request, () => broker.downloadWorkflowArtifacts(auth, request), readString$2(args, "confirmationId"));
 }
 function listWorkflows({ args, auth, broker, runTool }) {
 	const cwd = readRequiredString(args, "cwd", "forge_github_list_workflows");
@@ -207148,7 +207170,7 @@ function getWorkflow({ args, auth, broker, runTool }) {
 }
 function runWorkflow({ args, auth, broker, runTool }) {
 	const { cwd, workflow } = readWorkflowRequest(args, "forge_github_run_workflow");
-	const ref = readString$1(args, "ref")?.trim();
+	const ref = readString$2(args, "ref")?.trim();
 	const fields = readStringRecord(args, "fields");
 	const request = {
 		cwd,
@@ -207156,7 +207178,7 @@ function runWorkflow({ args, auth, broker, runTool }) {
 		...ref ? { ref } : {},
 		...fields && Object.keys(fields).length > 0 ? { fields } : {}
 	};
-	return runTool(request, () => broker.runWorkflow(auth, request), readString$1(args, "confirmationId"));
+	return runTool(request, () => broker.runWorkflow(auth, request), readString$2(args, "confirmationId"));
 }
 function enableWorkflow(context) {
 	return runWorkflowToggle("forge_github_enable_workflow", context, "enableWorkflow");
@@ -207179,12 +207201,12 @@ function readWorkflowRequest(args, toolName) {
 async function runWorkflowRunMutation(toolName, context, brokerMethod) {
 	const { args, auth, broker, runTool } = context;
 	const request = readWorkflowRunRequest(args, toolName);
-	return runTool(request, () => broker[brokerMethod](auth, request), readString$1(args, "confirmationId"));
+	return runTool(request, () => broker[brokerMethod](auth, request), readString$2(args, "confirmationId"));
 }
 function runWorkflowToggle(toolName, context, brokerMethod) {
 	const { args, auth, broker, runTool } = context;
 	const request = readWorkflowRequest(args, toolName);
-	return runTool(request, () => broker[brokerMethod](auth, request), readString$1(args, "confirmationId"));
+	return runTool(request, () => broker[brokerMethod](auth, request), readString$2(args, "confirmationId"));
 }
 //#endregion
 //#region src/github/GitHubCodexWorkspaceGitTools.ts
@@ -207201,7 +207223,7 @@ async function runWorkspaceGitTool(toolName, context) {
 		case "forge_git_commit": return runCommit("forge_git_commit", context);
 		case "forge_git_reset_hard": return runResetHard("forge_git_reset_hard", context);
 		case "forge_git": {
-			const operation = readString$1(args, "operation")?.trim();
+			const operation = readString$2(args, "operation")?.trim();
 			switch (operation) {
 				case "status": return runStatus(toolName, context, "status");
 				case "log": return runLog(toolName, context);
@@ -207230,7 +207252,7 @@ function runLog(toolName, { args, broker, runTool }) {
 }
 function runStash(toolName, { args, broker, runTool }, operation) {
 	const cwd = readRequiredString(args, "cwd", toolName);
-	const message = readString$1(args, "message")?.trim();
+	const message = readString$2(args, "message")?.trim();
 	return runTool({
 		cwd,
 		...operation ? { operation } : {},
@@ -207238,12 +207260,12 @@ function runStash(toolName, { args, broker, runTool }, operation) {
 	}, () => broker.stashWorkspace({
 		cwd,
 		...message ? { message } : {}
-	}), readString$1(args, "confirmationId"));
+	}), readString$2(args, "confirmationId"));
 }
 function runCommit(toolName, { args, broker, runTool }, operation) {
 	const cwd = readRequiredString(args, "cwd", toolName);
 	const message = readRequiredString(args, "message", operation ? `${toolName} operation=commit` : toolName);
-	const branch = readString$1(args, "branch")?.trim();
+	const branch = readString$2(args, "branch")?.trim();
 	return runTool({
 		cwd,
 		...operation ? { operation } : {},
@@ -207253,11 +207275,11 @@ function runCommit(toolName, { args, broker, runTool }, operation) {
 		cwd,
 		message,
 		...branch ? { branch } : {}
-	}), readString$1(args, "confirmationId"));
+	}), readString$2(args, "confirmationId"));
 }
 function runResetHard(toolName, { args, broker, runTool }, operation) {
 	const cwd = readRequiredString(args, "cwd", toolName);
-	const ref = readString$1(args, "ref")?.trim();
+	const ref = readString$2(args, "ref")?.trim();
 	return runTool({
 		cwd,
 		...operation ? { operation } : {},
@@ -207265,7 +207287,7 @@ function runResetHard(toolName, { args, broker, runTool }, operation) {
 	}, () => broker.resetWorkspaceHard({
 		cwd,
 		...ref ? { ref } : {}
-	}), readString$1(args, "confirmationId"));
+	}), readString$2(args, "confirmationId"));
 }
 //#endregion
 //#region src/github/GitHubCodexToolRunner.ts
@@ -207899,7 +207921,7 @@ function createCodexGitHubDynamicToolHandler(options = {}) {
 			error: "Forge could not resolve the authenticated user session for this thread. Send a new turn from the Forge UI and retry."
 		}, false);
 		const args = readArgs$1(input.arguments);
-		const dispatchOperation = input.tool === "forge_git" ? readString$1(args, "operation")?.trim() : void 0;
+		const dispatchOperation = input.tool === "forge_git" ? readString$2(args, "operation")?.trim() : void 0;
 		const operation = dispatchOperation ?? operationForTool(input.tool);
 		const requiresConfirmation = !bypassWriteConfirmation && (isGitHubWriteTool(input.tool) || dispatchOperation !== void 0 && FORGE_GIT_WRITE_OPERATIONS.has(dispatchOperation));
 		const runTool = async (request, execute, confirmationId) => {
@@ -208421,7 +208443,7 @@ function createCodexDevServerDynamicTools() {
 function readArgs(value) {
 	return value && typeof value === "object" ? value : {};
 }
-function readString(args, key) {
+function readString$1(args, key) {
 	const value = args[key];
 	return typeof value === "string" && value.trim().length > 0 ? value : void 0;
 }
@@ -208434,8 +208456,8 @@ function readBoolean(args, key) {
 	return typeof value === "boolean" ? value : void 0;
 }
 function runDevServerStart(handlers, args) {
-	const command = readString(args, "command");
-	const cwd = readString(args, "cwd");
+	const command = readString$1(args, "command");
+	const cwd = readString$1(args, "cwd");
 	const port = readNumber(args, "port");
 	const readyTimeoutMs = readNumber(args, "readyTimeoutMs");
 	const openPreview = readBoolean(args, "openPreview");
@@ -208591,7 +208613,7 @@ function readConnectorParams(tool, args) {
 	switch (tool.tool) {
 		case "forge_gmail_search": return {
 			...params,
-			query: readString$1(args, "query") ?? ""
+			query: readString$2(args, "query") ?? ""
 		};
 		case "forge_gmail_list_recent": return {
 			...params,
@@ -208603,7 +208625,7 @@ function readConnectorParams(tool, args) {
 	}
 }
 function appendString(target, args, key) {
-	const value = readString$1(args, key);
+	const value = readString$2(args, key);
 	if (value !== void 0) target[key] = value;
 }
 function appendNumber(target, args, key) {
@@ -209141,7 +209163,7 @@ const MODEL_LIST_PROBE_TIMEOUT_MS = 5e3;
 const probeCliModels = (input) => gen(function* () {
 	const useShell = process.platform === "win32";
 	if (useShell && !isShellSafeCommandPath(input.binaryPath)) return;
-	const command = make$47(input.binaryPath, [...input.args], {
+	const command = make$48(input.binaryPath, [...input.args], {
 		shell: useShell,
 		env: scrubForgeProviderChildEnvSecrets(process.env)
 	});
@@ -209192,7 +209214,7 @@ const collectStreamAsString = (stream) => stream.pipe(decodeText$1(), runFold(()
 //#region src/orchestration/WorkerPlanCodexTools.ts
 const FORGE_PROPOSE_WORKER_TASKS_TOOL = "forge_propose_worker_tasks";
 const MAX_WORKER_PLAN_ITEMS = 5;
-function asRecord$9(value) {
+function asRecord$10(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value) ? value : void 0;
 }
 function readTrimmedString(value) {
@@ -209208,7 +209230,7 @@ function isValidWorkerSummary(value) {
 	return value !== void 0 && value.length > 0 && value.length <= 4e3;
 }
 function decodeWorkerPlanItem(value) {
-	const item = asRecord$9(value);
+	const item = asRecord$10(value);
 	const slug = readTrimmedString(item?.slug);
 	const title = readTrimmedString(item?.title);
 	const summary = readTrimmedString(item?.summary);
@@ -209272,7 +209294,7 @@ function createWorkerPlanDynamicTools() {
 function createWorkerPlanDynamicToolHandler() {
 	return async (input) => {
 		if (input.tool !== "forge_propose_worker_tasks") throw new Error(`Unsupported worker-plan tool: ${input.tool}`);
-		if (!decodeWorkerPlanItems(asRecord$9(input.arguments)?.items)) throw new Error("Worker plans require one to five unique, fully described items.");
+		if (!decodeWorkerPlanItems(asRecord$10(input.arguments)?.items)) throw new Error("Worker plans require one to five unique, fully described items.");
 		return {
 			success: true,
 			contentItems: [{
@@ -210434,6 +210456,7 @@ const makeCodexAdapter = fn$1("makeCodexAdapter")(function* (options) {
 			...browserToolEnvironmentId !== void 0 ? { environmentId: browserToolEnvironmentId } : {}
 		};
 		const managerInput = {
+			...input.accountTransition ? { accountTransition: input.accountTransition } : {},
 			threadId: input.threadId,
 			provider: "codex",
 			...input.cwd !== void 0 ? { cwd: input.cwd } : {},
@@ -210767,14 +210790,14 @@ const makeManagedServerProvider = fn$1("makeManagedServerProvider")(function* (i
 	const refreshSemaphore = yield* make$43(1);
 	const changesPubSub = yield* acquireRelease(unbounded$1(), shutdown$2);
 	const initialSettings = yield* input.getSettings;
-	const snapshotRef = yield* make$49(input.initialSnapshot(initialSettings));
-	const settingsRef = yield* make$49(initialSettings);
+	const snapshotRef = yield* make$50(input.initialSnapshot(initialSettings));
+	const settingsRef = yield* make$50(initialSettings);
 	const applySnapshotBase = fn$1("applySnapshot")(function* (nextSettings, options) {
 		const forceRefresh = options?.forceRefresh === true;
-		const previousSettings = yield* get$5(settingsRef);
+		const previousSettings = yield* get$6(settingsRef);
 		if (!forceRefresh && !input.haveSettingsChanged(previousSettings, nextSettings)) {
 			yield* set$2(settingsRef, nextSettings);
-			return yield* get$5(snapshotRef);
+			return yield* get$6(snapshotRef);
 		}
 		const nextSnapshot = yield* input.checkProvider;
 		yield* set$2(settingsRef, nextSettings);
@@ -210787,9 +210810,9 @@ const makeManagedServerProvider = fn$1("makeManagedServerProvider")(function* (i
 		return yield* applySnapshot(yield* input.getSettings, { forceRefresh: true });
 	});
 	yield* runForEach(input.streamSettings, (nextSettings) => asVoid(applySnapshot(nextSettings))).pipe(forkScoped);
-	const refreshFailureCount = yield* make$49(0);
+	const refreshFailureCount = yield* make$50(0);
 	yield* forever$1(gen(function* () {
-		const failureCount = yield* get$5(refreshFailureCount);
+		const failureCount = yield* get$6(refreshFailureCount);
 		const baseMs = 6e4;
 		yield* sleep$4(millis(Math.min(baseMs * Math.pow(2, failureCount), 3e5)));
 		if (isFailure(yield* refreshSnapshot().pipe(tapError((e) => sync$1(() => captureServerError(e))), exit))) {
@@ -211087,25 +211110,25 @@ const AUTH_METHOD_CONTAINER_KEYS = [
 /** Lift an unknown value into `Option<string>` if it is a non-empty string. */
 const asNonEmptyString = (v) => typeof v === "string" && v.length > 0 ? some(v) : none$4();
 /** Lift an unknown value into `Option<Record>` if it is a plain object. */
-const asRecord$8 = (v) => typeof v === "object" && v !== null && !globalThis.Array.isArray(v) ? some(v) : none$4();
+const asRecord$9 = (v) => typeof v === "object" && v !== null && !globalThis.Array.isArray(v) ? some(v) : none$4();
 /**
 * Walk an unknown parsed JSON value looking for a subscription/plan
 * identifier, returning the first match as an `Option`.
 */
 function findSubscriptionType(value) {
 	if (globalThis.Array.isArray(value)) return firstSomeOf(value.map(findSubscriptionType));
-	return asRecord$8(value).pipe(flatMap$2((record) => {
+	return asRecord$9(value).pipe(flatMap$2((record) => {
 		const direct = firstSomeOf(SUBSCRIPTION_TYPE_KEYS.map((key) => asNonEmptyString(record[key])));
 		if (isSome(direct)) return direct;
-		return firstSomeOf(SUBSCRIPTION_CONTAINER_KEYS.map((key) => asRecord$8(record[key]).pipe(flatMap$2(findSubscriptionType))));
+		return firstSomeOf(SUBSCRIPTION_CONTAINER_KEYS.map((key) => asRecord$9(record[key]).pipe(flatMap$2(findSubscriptionType))));
 	}));
 }
 function findAuthMethod(value) {
 	if (globalThis.Array.isArray(value)) return firstSomeOf(value.map(findAuthMethod));
-	return asRecord$8(value).pipe(flatMap$2((record) => {
+	return asRecord$9(value).pipe(flatMap$2((record) => {
 		const direct = firstSomeOf(AUTH_METHOD_KEYS.map((key) => asNonEmptyString(record[key])));
 		if (isSome(direct)) return direct;
-		return firstSomeOf(AUTH_METHOD_CONTAINER_KEYS.map((key) => asRecord$8(record[key]).pipe(flatMap$2(findAuthMethod))));
+		return firstSomeOf(AUTH_METHOD_CONTAINER_KEYS.map((key) => asRecord$9(record[key]).pipe(flatMap$2(findAuthMethod))));
 	}));
 }
 /**
@@ -211332,7 +211355,7 @@ const runClaudeCommand = fn$1("runClaudeCommand")(function* (args) {
 	}));
 	const claudeSettings = yield* service(ServerSettingsService).pipe(flatMap((service) => service.getSettings), map$3((settings) => settings.providers.claudeAgent));
 	const effectiveConfigPath = claudeSettings.configPath || config.forgeClaudeConfigPath || process.env.CLAUDE_CONFIG_DIR || void 0;
-	const command = make$47(claudeSettings.binaryPath, [...args], {
+	const command = make$48(claudeSettings.binaryPath, [...args], {
 		shell: process.platform === "win32",
 		env: scrubForgeProviderChildEnvSecrets({
 			...process.env,
@@ -211516,7 +211539,7 @@ const makePendingClaudeProvider = (claudeSettings) => {
 const ClaudeProviderLive = effect(ClaudeProvider, gen(function* () {
 	const serverSettings = yield* ServerSettingsService;
 	const spawner = yield* ChildProcessSpawner;
-	const subscriptionProbeCache = yield* make$50({
+	const subscriptionProbeCache = yield* make$51({
 		capacity: 4,
 		timeToLive: minutes(5),
 		lookup: (key) => {
@@ -211527,7 +211550,7 @@ const ClaudeProviderLive = effect(ClaudeProvider, gen(function* () {
 			});
 		}
 	});
-	const getDiscovery = (input) => get$7(subscriptionProbeCache, JSON.stringify([input.binaryPath, input.configPath]));
+	const getDiscovery = (input) => get$8(subscriptionProbeCache, JSON.stringify([input.binaryPath, input.configPath]));
 	const checkProvider = checkClaudeProviderStatus((input) => getDiscovery(input).pipe(map$3((probe) => probe?.subscriptionType)), (input) => getDiscovery(input).pipe(map$3((probe) => probe?.slashCommands)), (input) => getDiscovery(input).pipe(map$3((probe) => probe?.models))).pipe(provideService(ServerSettingsService, serverSettings), provideService(ChildProcessSpawner, spawner));
 	return yield* makeManagedServerProvider({
 		getSettings: serverSettings.getSettings.pipe(map$3((settings) => settings.providers.claudeAgent), orDie),
@@ -212351,7 +212374,7 @@ function userInputQuestionsFromToolInput(toolInput) {
 	return (Array.isArray(toolInput.questions) ? toolInput.questions : []).map((question, idx) => userInputQuestionFromUnknown(question, idx));
 }
 function userInputQuestionFromUnknown(question, idx) {
-	const value = asRecord$7(question) ?? {};
+	const value = asRecord$8(question) ?? {};
 	return {
 		id: typeof value.header === "string" ? value.header : `q-${idx}`,
 		header: typeof value.header === "string" ? value.header : `Question ${idx + 1}`,
@@ -212361,13 +212384,13 @@ function userInputQuestionFromUnknown(question, idx) {
 	};
 }
 function userInputOptionFromUnknown(option) {
-	const value = asRecord$7(option) ?? {};
+	const value = asRecord$8(option) ?? {};
 	return {
 		label: typeof value.label === "string" ? value.label : "",
 		description: typeof value.description === "string" ? value.description : ""
 	};
 }
-function asRecord$7(value) {
+function asRecord$8(value) {
 	return value !== null && typeof value === "object" && !Array.isArray(value) ? value : void 0;
 }
 function permissionResultFromDecision(decision, toolInput, suggestions) {
@@ -213271,7 +213294,7 @@ const makeClaudeAdapter = fn$1("makeClaudeAdapter")(function* (options) {
 	const updateResumeCursor = fn$1("updateResumeCursor")(function* (context) {
 		const threadId = context.session.threadId;
 		if (!threadId) return;
-		const providerDeliveryBinding = readProviderDeliveryBinding(asRecord$7(context.session.resumeCursor)?.providerDeliveryBinding);
+		const providerDeliveryBinding = readProviderDeliveryBinding(asRecord$8(context.session.resumeCursor)?.providerDeliveryBinding);
 		const resumeCursor = {
 			threadId,
 			...context.resumeSessionId ? { resume: context.resumeSessionId } : {},
@@ -214424,7 +214447,7 @@ const makeClaudeAdapter = fn$1("makeClaudeAdapter")(function* (options) {
 	});
 	const makeCanUseTool = (contextRef, runtimeMode, pendingApprovals, pendingUserInputs, runFork, runPromise) => {
 		const canUseToolEffect = fn$1("canUseTool")(function* (toolName, toolInput, callbackOptions) {
-			const context = yield* get$5(contextRef);
+			const context = yield* get$6(contextRef);
 			if (!context) return {
 				behavior: "deny",
 				message: "Claude session context is unavailable."
@@ -214566,7 +214589,7 @@ const makeClaudeAdapter = fn$1("makeClaudeAdapter")(function* (options) {
 		const pendingApprovals = /* @__PURE__ */ new Map();
 		const pendingUserInputs = /* @__PURE__ */ new Map();
 		const inFlightTools = /* @__PURE__ */ new Map();
-		const contextRef = yield* make$49(void 0);
+		const contextRef = yield* make$50(void 0);
 		const canUseTool = makeCanUseTool(contextRef, input.runtimeMode, pendingApprovals, pendingUserInputs, runFork, runPromise);
 		const serverSettings = yield* serverSettingsService.getSettings.pipe(mapError((error) => new ProviderAdapterProcessError({
 			provider: PROVIDER$11,
@@ -218346,7 +218369,7 @@ function makeAcpContentDeltaEvent(input) {
 }
 //#endregion
 //#region ../../packages/shared/src/toolActivity.ts
-function asRecord$6(value) {
+function asRecord$7(value) {
 	return value !== null && typeof value === "object" && !Array.isArray(value) ? value : void 0;
 }
 function asTrimmedString(value) {
@@ -218372,10 +218395,10 @@ function extractCommandFromTitle$1(title) {
 	return /`([^`]+)`/u.exec(title)?.[1]?.trim() || void 0;
 }
 function extractToolCommand(data, title) {
-	const item = asRecord$6(data?.item);
-	const itemInput = asRecord$6(item?.input);
-	const itemResult = asRecord$6(item?.result);
-	const rawInput = asRecord$6(data?.rawInput);
+	const item = asRecord$7(data?.item);
+	const itemInput = asRecord$7(item?.input);
+	const itemResult = asRecord$7(item?.result);
+	const rawInput = asRecord$7(data?.rawInput);
 	const direct = [
 		normalizeCommandValue$1(item?.command),
 		normalizeCommandValue$1(itemInput?.command),
@@ -218403,7 +218426,7 @@ function collectPaths(value, paths, seen, depth) {
 		}
 		return;
 	}
-	const record = asRecord$6(value);
+	const record = asRecord$7(value);
 	if (!record) return;
 	for (const key of [
 		"path",
@@ -218462,7 +218485,7 @@ function deriveToolActivityPresentation(input) {
 	const title = asTrimmedString(input.title);
 	const detail = stripTrailingExitCode(asTrimmedString(input.detail));
 	const fallbackSummary = asTrimmedString(input.fallbackSummary) ?? "Tool";
-	const data = asRecord$6(input.data);
+	const data = asRecord$7(input.data);
 	const command = extractToolCommand(data, title);
 	const primaryPath = extractPrimaryPath(data);
 	const action = classifyToolAction({
@@ -218486,7 +218509,7 @@ function deriveToolActivityPresentation(input) {
 		...primaryPath ? { detail: primaryPath } : {}
 	};
 	if (action === "search") {
-		const query = asTrimmedString(asRecord$6(data?.rawInput)?.query) ?? asTrimmedString(asRecord$6(data?.rawInput)?.pattern) ?? asTrimmedString(asRecord$6(data?.rawInput)?.searchTerm);
+		const query = asTrimmedString(asRecord$7(data?.rawInput)?.query) ?? asTrimmedString(asRecord$7(data?.rawInput)?.pattern) ?? asTrimmedString(asRecord$7(data?.rawInput)?.searchTerm);
 		return {
 			summary: "Searched files",
 			...query ? { detail: query } : {}
@@ -218841,9 +218864,9 @@ const makeAcpPatchedProtocol = fn$1("makeAcpPatchedProtocol")(function* (options
 	const notificationQueue = yield* sliding(1024);
 	const disconnects = yield* unbounded$2();
 	const outgoing = yield* unbounded$2();
-	const nextRequestId = yield* make$49(1n);
-	const terminationHandled = yield* make$49(false);
-	const extPending = yield* make$49(/* @__PURE__ */ new Map());
+	const nextRequestId = yield* make$50(1n);
+	const terminationHandled = yield* make$50(false);
+	const extPending = yield* make$50(/* @__PURE__ */ new Map());
 	const logProtocol = (event) => {
 		if (event.direction === "incoming" && !options.logIncoming) return void_$1;
 		if (event.direction === "outgoing" && !options.logOutgoing) return void_$1;
@@ -218959,7 +218982,7 @@ const makeAcpPatchedProtocol = fn$1("makeAcpPatchedProtocol")(function* (options
 		if (!options.serverRequestMethods.has(message.tag)) return handleExtRequest(message).pipe(catch_(() => respondWithError(message.id, AcpRequestError.internalError())), asVoid);
 		return offer$1(serverQueue, message).pipe(asVoid);
 	};
-	const handleExitEncoded = (message) => get$5(extPending).pipe(flatMap((pending) => {
+	const handleExitEncoded = (message) => get$6(extPending).pipe(flatMap((pending) => {
 		if (!pending.has(message.requestId)) return offer$1(clientQueue, message).pipe(asVoid);
 		if (message.exit._tag === "Success") return completeExtPendingSuccess(message.requestId, message.exit.value);
 		const failure = message.exit.cause.find((entry) => entry._tag === "Fail");
@@ -218970,7 +218993,7 @@ const makeAcpPatchedProtocol = fn$1("makeAcpPatchedProtocol")(function* (options
 		switch (message._tag) {
 			case "Request": return handleRequestEncoded(message);
 			case "Exit": return handleExitEncoded(message);
-			case "Chunk": return get$5(extPending).pipe(flatMap((pending) => pending.has(message.requestId) ? completeExtPendingFailure(message.requestId, AcpRequestError.internalError("Streaming extension responses are not supported")) : offer$1(clientQueue, message).pipe(asVoid)));
+			case "Chunk": return get$6(extPending).pipe(flatMap((pending) => pending.has(message.requestId) ? completeExtPendingFailure(message.requestId, AcpRequestError.internalError("Streaming extension responses are not supported")) : offer$1(clientQueue, message).pipe(asVoid)));
 			case "Defect":
 			case "ClientProtocolError":
 			case "Pong": return offer$1(clientQueue, message).pipe(asVoid);
@@ -219212,7 +219235,7 @@ ArraySchema(Unknown);
 //#endregion
 //#region ../../packages/effect-acp/src/_internal/stdio.ts
 const encoder$1 = new TextEncoder();
-const makeChildStdio = (handle) => make$48({
+const makeChildStdio = (handle) => make$49({
 	args: succeed([]),
 	stdin: handle.stdout,
 	stdout: () => mapInput(handle.stdin, (chunk) => typeof chunk === "string" ? encoder$1.encode(chunk) : chunk),
@@ -219223,7 +219246,7 @@ fn$1("makeInMemoryStdio")(function* () {
 	const output = yield* unbounded$2();
 	const decoder = new TextDecoder();
 	return {
-		stdio: make$48({
+		stdio: make$49({
 			args: succeed([]),
 			stdin: fromQueue(input),
 			stdout: () => forEach$1((chunk) => offer$1(output, typeof chunk === "string" ? chunk : decoder.decode(chunk, { stream: true }))),
@@ -219414,11 +219437,11 @@ const makeAcpSessionRuntime = (options) => gen(function* () {
 	const spawner = yield* ChildProcessSpawner;
 	const runtimeScope = yield* Scope$1;
 	const eventQueue = yield* unbounded$2();
-	const modeStateRef = yield* make$49(void 0);
-	const toolCallsRef = yield* make$49(/* @__PURE__ */ new Map());
-	const assistantSegmentRef = yield* make$49({ nextSegmentIndex: 0 });
-	const configOptionsRef = yield* make$49(sessionConfigOptionsFromSetup(void 0));
-	const startStateRef = yield* make$49({ _tag: "NotStarted" });
+	const modeStateRef = yield* make$50(void 0);
+	const toolCallsRef = yield* make$50(/* @__PURE__ */ new Map());
+	const assistantSegmentRef = yield* make$50({ nextSegmentIndex: 0 });
+	const configOptionsRef = yield* make$50(sessionConfigOptionsFromSetup(void 0));
+	const startStateRef = yield* make$50({ _tag: "NotStarted" });
 	const logRequest = (event) => options.requestLogger ? options.requestLogger(event) : void_$1;
 	const runLoggedRequest = (method, payload, effect) => logRequest({
 		method,
@@ -219440,7 +219463,7 @@ const makeAcpSessionRuntime = (options) => gen(function* () {
 		command: options.spawn.command,
 		cause: /* @__PURE__ */ new Error(`Refusing to spawn ACP child process: command path contains shell metacharacters that cmd.exe would interpret as additional commands. Adjust the provider \`binaryPath\` setting to an unquoted absolute path.`)
 	});
-	const acpContext = yield* build(layerChildProcess(yield* spawner.spawn(make$47(options.spawn.command, [...options.spawn.args], {
+	const acpContext = yield* build(layerChildProcess(yield* spawner.spawn(make$48(options.spawn.command, [...options.spawn.args], {
 		...options.spawn.cwd ? { cwd: options.spawn.cwd } : {},
 		env: scrubForgeProviderChildEnvSecrets({
 			...process.env,
@@ -219475,7 +219498,7 @@ const makeAcpSessionRuntime = (options) => gen(function* () {
 		...options.clientCapabilities?._meta ? { _meta: options.clientCapabilities._meta } : {}
 	};
 	const getStartedState = gen(function* () {
-		const state = yield* get$5(startStateRef);
+		const state = yield* get$6(startStateRef);
 		if (state._tag === "Started") return state.result;
 		return yield* new AcpTransportError({
 			detail: "ACP session runtime has not been started",
@@ -219483,7 +219506,7 @@ const makeAcpSessionRuntime = (options) => gen(function* () {
 		});
 	});
 	const validateConfigOptionValue = (configId, value) => gen(function* () {
-		const configOption = findSessionConfigOption(yield* get$5(configOptionsRef), configId);
+		const configOption = findSessionConfigOption(yield* get$6(configOptionsRef), configId);
 		if (!configOption) return;
 		if (configOption.type === "boolean") {
 			if (typeof value === "boolean") return;
@@ -219523,7 +219546,7 @@ const makeAcpSessionRuntime = (options) => gen(function* () {
 		...current,
 		currentModeId: modeId
 	} : current);
-	const setConfigOption = (configId, value) => validateConfigOptionValue(configId, value).pipe(flatMap(() => getStartedState), flatMap((started) => get$5(configOptionsRef).pipe(flatMap((configOptions) => {
+	const setConfigOption = (configId, value) => validateConfigOptionValue(configId, value).pipe(flatMap(() => getStartedState), flatMap((started) => get$6(configOptionsRef).pipe(flatMap((configOptions) => {
 		const existing = findSessionConfigOption(configOptions, configId);
 		if (existing && configOptionCurrentValueMatches(existing, value)) return succeed({ configOptions });
 		const requestPayload = typeof value === "boolean" ? {
@@ -219604,8 +219627,8 @@ const makeAcpSessionRuntime = (options) => gen(function* () {
 		handleExtNotification: acp.handleExtNotification,
 		start: () => start,
 		getEvents: () => fromQueue(eventQueue),
-		getModeState: get$5(modeStateRef),
-		getConfigOptions: get$5(configOptionsRef),
+		getModeState: get$6(modeStateRef),
+		getConfigOptions: get$6(configOptionsRef),
 		prompt: (payload) => getStartedState.pipe(flatMap((started) => {
 			const requestPayload = {
 				sessionId: started.sessionId,
@@ -219620,7 +219643,7 @@ const makeAcpSessionRuntime = (options) => gen(function* () {
 			})));
 		})),
 		cancel: getStartedState.pipe(flatMap((started) => acp.agent.cancel({ sessionId: started.sessionId }))),
-		setMode: (modeId) => get$5(modeStateRef).pipe(flatMap((modeState) => {
+		setMode: (modeId) => get$6(modeStateRef).pipe(flatMap((modeState) => {
 			if (modeState?.currentModeId === modeId) return succeed({});
 			return getStartedState.pipe(flatMap((started) => {
 				if (sessionResponseHasModeState(started.sessionSetupResult)) {
@@ -219712,7 +219735,7 @@ const handleSessionUpdate = ({ queue, modeStateRef, toolCallsRef, assistantSegme
 		}
 		if (event._tag === "ContentDelta") {
 			if (event.text.trim().length === 0) {
-				if (!(yield* get$5(assistantSegmentRef)).activeItemId) continue;
+				if (!(yield* get$6(assistantSegmentRef)).activeItemId) continue;
 			}
 			const itemId = yield* ensureActiveAssistantSegment({
 				queue,
@@ -219764,7 +219787,7 @@ const closeActiveAssistantSegment = ({ queue, assistantSegmentRef }) => modify$3
 	}, { nextSegmentIndex: current.nextSegmentIndex }];
 }).pipe(flatMap((event) => event ? offer$1(queue, event) : void_$1));
 const makeStartCoordinator = (startStateRef, startOnce) => gen(function* () {
-	const currentState = yield* get$5(startStateRef);
+	const currentState = yield* get$6(startStateRef);
 	if (currentState._tag === "Started") return currentState.result;
 	if (currentState._tag === "Starting") return yield* _await(currentState.deferred);
 	const deferred = yield* make$39();
@@ -219889,7 +219912,7 @@ const readCursorApiKey = (_settings) => process.env.CURSOR_API_KEY || null;
 const runCursorCommand = fn$1("runCursorCommand")(function* (binaryPath, args) {
 	const useShell = process.platform === "win32";
 	if (useShell && !isShellSafeCommandPath(binaryPath)) return yield* fail(/* @__PURE__ */ new Error(`Refusing to spawn cursor-agent: \`binaryPath\` contains shell metacharacters that cmd.exe would interpret as additional commands.`));
-	return yield* spawnAndCollect(binaryPath, make$47(binaryPath, [...args], {
+	return yield* spawnAndCollect(binaryPath, make$48(binaryPath, [...args], {
 		shell: useShell,
 		env: scrubForgeProviderChildEnvSecrets(process.env)
 	}));
@@ -227708,7 +227731,7 @@ const makeOpenCodeRuntime = gen(function* () {
 	const netService = yield* NetService;
 	const runOpenCodeCommand = (input) => gen(function* () {
 		yield* rejectUnsafeWindowsBinaryPath("runOpenCodeCommand", input.binaryPath);
-		const child = yield* spawner.spawn(make$47(input.binaryPath, [...input.args], {
+		const child = yield* spawner.spawn(make$48(input.binaryPath, [...input.args], {
 			shell: process.platform === "win32",
 			env: input.environment ?? process.env
 		}));
@@ -227743,7 +227766,7 @@ const makeOpenCodeRuntime = gen(function* () {
 			`--hostname=${hostname}`,
 			`--port=${port}`
 		];
-		const child = yield* spawner.spawn(make$47(input.binaryPath, args, {
+		const child = yield* spawner.spawn(make$48(input.binaryPath, args, {
 			detached: process.platform !== "win32",
 			shell: process.platform === "win32",
 			env: {
@@ -227764,8 +227787,8 @@ const makeOpenCodeRuntime = gen(function* () {
 			} catch {}
 		});
 		yield* addFinalizer$1(runtimeScope, killOpenCodeProcessGroup("SIGTERM").pipe(andThen(sleep$4("1 second")), andThen(killOpenCodeProcessGroup("SIGKILL")), ignore));
-		const stdoutRef = yield* make$49("");
-		const stderrRef = yield* make$49("");
+		const stdoutRef = yield* make$50("");
+		const stderrRef = yield* make$50("");
 		const readyDeferred = yield* make$39();
 		const setReadyFromStdoutChunk = (chunk) => updateAndGet(stdoutRef, (stdout) => `${stdout}${chunk}`).pipe(flatMap((nextStdout) => {
 			const parsed = parseServerUrlFromOutput(nextStdout);
@@ -227774,8 +227797,8 @@ const makeOpenCodeRuntime = gen(function* () {
 		const stdoutFiber = yield* child.stdout.pipe(decodeText$1(), runForEach(setReadyFromStdoutChunk), ignore, forkIn(runtimeScope));
 		const stderrFiber = yield* child.stderr.pipe(decodeText$1(), runForEach((chunk) => update$4(stderrRef, (stderr) => `${stderr}${chunk}`)), ignore, forkIn(runtimeScope));
 		const exitFiber = yield* child.exitCode.pipe(flatMap((code) => gen(function* () {
-			const stdout = yield* get$5(stdoutRef);
-			const stderr = yield* get$5(stderrRef);
+			const stdout = yield* get$6(stdoutRef);
+			const stderr = yield* get$6(stderrRef);
 			const exitCode = Number(code);
 			yield* fail$3(readyDeferred, new OpenCodeRuntimeError({
 				operation: "startOpenCodeServerProcess",
@@ -228436,12 +228459,12 @@ function makeOpenCodeAdapter(openCodeSettings, options) {
 				}
 			}))).pipe(exit, flatMap((exit) => gen(function* () {
 				/* v8 ignore next -- session-scope interruption timing is a defensive cleanup path. */
-				if (eventsAbortController.signal.aborted || (yield* get$5(context.stopped))) return;
+				if (eventsAbortController.signal.aborted || (yield* get$6(context.stopped))) return;
 				if (isFailure(exit)) yield* emitUnexpectedExit(context, openCodeRuntimeErrorDetail(squash(exit.cause)));
 			})), forkIn(context.sessionScope));
 			if (!context.server.external && context.server.exitCode !== null) yield* context.server.exitCode.pipe(flatMap((code) => gen(function* () {
 				/* v8 ignore next -- server-exit watcher can lose the race to an already-stopped context. */
-				if (yield* get$5(context.stopped)) return;
+				if (yield* get$6(context.stopped)) return;
 				yield* emitUnexpectedExit(context, `OpenCode server exited unexpectedly (${code}).`);
 			})), forkIn(context.sessionScope));
 		});
@@ -228524,7 +228547,7 @@ function makeOpenCodeAdapter(openCodeSettings, options) {
 				activeTurnId: void 0,
 				activeAgent: void 0,
 				activeVariant: void 0,
-				stopped: yield* make$49(false),
+				stopped: yield* make$50(false),
 				sessionScope: started.sessionScope
 			};
 			sessions.set(input.threadId, context);
@@ -228883,6 +228906,8 @@ const makeProviderService = fn$1("makeProviderService")(function* (options) {
 	const canonicalEventLogger = options?.canonicalEventLogger ?? (options?.canonicalEventLogPath !== void 0 ? yield* makeEventNdjsonLogger(options.canonicalEventLogPath, { stream: "canonical" }) : void 0);
 	const registry = yield* ProviderAdapterRegistry;
 	const directory = yield* ProviderSessionDirectory;
+	const sessionLocks = yield* make$47({ lookup: (_threadId) => make$43(1) });
+	const withSessionLock = (threadId, effect) => get$5(sessionLocks, threadId).pipe(flatMap((lock) => lock.withPermit(effect)), scoped);
 	const runtimeEventPubSub = yield* unbounded$1();
 	const assertProviderExecutable = options?.assertProviderExecutable ?? (() => succeed(null));
 	const assertCurrentProviderDelivery = fn$1("assertCurrentProviderDelivery")(function* (input) {
@@ -229055,18 +229080,19 @@ const makeProviderService = fn$1("makeProviderService")(function* (options) {
 				"provider.runtime_mode": input.runtimeMode
 			});
 			const persistedBinding = getOrUndefined(yield* directory.getBinding(threadId));
-			yield* assertProviderAccountBoundary({
+			const adapter = yield* registry.getByProvider(effectiveProvider);
+			const priorAccountId = readPersistedProviderAccountId(persistedBinding?.runtimePayload);
+			const requestedAccountId = readProviderAccountIdFromModelSelection(input.modelSelection);
+			if (effectiveProvider !== "codex" || persistedBinding?.provider !== effectiveProvider || (yield* adapter.hasSession(threadId))) yield* assertProviderAccountBoundary({
 				operation: "ProviderService.startSession",
 				threadId,
-				persistedAccountId: readPersistedProviderAccountId(persistedBinding?.runtimePayload),
-				requestedAccountId: readProviderAccountIdFromModelSelection(input.modelSelection)
+				persistedAccountId: priorAccountId,
+				requestedAccountId
 			});
-			const effectiveResumeCursor = input.resumeCursor ?? (persistedBinding?.provider === effectiveProvider ? persistedBinding.resumeCursor : void 0);
-			const adapter = yield* registry.getByProvider(effectiveProvider);
 			const boundResumeCursor = yield* bindProviderDeliveryToResumeCursor({
 				operation: "ProviderService.startSession",
 				provider: effectiveProvider,
-				resumeCursor: effectiveResumeCursor,
+				resumeCursor: input.resumeCursor ?? (persistedBinding?.provider === effectiveProvider ? persistedBinding.resumeCursor : void 0),
 				currentBinding: yield* assertProviderExecutable({
 					threadId,
 					provider: effectiveProvider,
@@ -229075,6 +229101,7 @@ const makeProviderService = fn$1("makeProviderService")(function* (options) {
 			});
 			const session = yield* adapter.startSession({
 				...input,
+				accountTransition: explicitProviderAccountTransition(priorAccountId, requestedAccountId),
 				...boundResumeCursor !== void 0 ? { resumeCursor: boundResumeCursor } : {}
 			});
 			if (session.provider !== adapter.provider) return yield* toValidationError("ProviderService.startSession", `Adapter/provider mismatch: requested '${adapter.provider}', received '${session.provider}'.`);
@@ -229375,15 +229402,15 @@ const makeProviderService = fn$1("makeProviderService")(function* (options) {
 	});
 	yield* addFinalizer$2(() => catch_(runStopAll(), (cause) => logWarning$1("failed to stop provider service", { cause })));
 	return {
-		startSession,
-		sendTurn,
-		interruptTurn,
-		respondToRequest,
-		respondToUserInput,
-		stopSession,
+		startSession: (threadId, input) => withSessionLock(threadId, startSession(threadId, input)),
+		sendTurn: (input) => withSessionLock(input?.threadId, sendTurn(input)),
+		interruptTurn: (input) => withSessionLock(input?.threadId, interruptTurn(input)),
+		respondToRequest: (input) => withSessionLock(input?.threadId, respondToRequest(input)),
+		respondToUserInput: (input) => withSessionLock(input?.threadId, respondToUserInput(input)),
+		stopSession: (input) => withSessionLock(input?.threadId, stopSession(input)),
 		listSessions,
 		getCapabilities,
-		rollbackConversation,
+		rollbackConversation: (input) => withSessionLock(input?.threadId, rollbackConversation(input)),
 		get streamEvents() {
 			return fromPubSub(runtimeEventPubSub);
 		}
@@ -230582,7 +230609,7 @@ const createTrace2Monitor = fn$1("createTrace2Monitor")(function* (input, progre
 		suffix: ".json"
 	});
 	const hookStartByChildKey = /* @__PURE__ */ new Map();
-	const traceTailState = yield* make$49({
+	const traceTailState = yield* make$50({
 		processedChars: 0,
 		remainder: ""
 	});
@@ -230757,7 +230784,7 @@ const GitCoreLive = effect(GitCore, fn$1("makeGitCore")(function* (options) {
 			const truncateOutputAtMaxBytes = input.truncateOutputAtMaxBytes ?? false;
 			return yield* fn$1("runGitCommand")(function* () {
 				const trace2Monitor = yield* createTrace2Monitor(commandInput, input.progress).pipe(provideService(Path$2, path$10), provideService(FileSystem, fileSystem), mapError(toGitCommandError(commandInput, "failed to create trace2 monitor.")));
-				const child = yield* commandSpawner.spawn(make$47("git", commandInput.args, {
+				const child = yield* commandSpawner.spawn(make$48("git", commandInput.args, {
 					cwd: commandInput.cwd,
 					env: withRepositoryOwnershipTrust({
 						...process.env,
@@ -230918,7 +230945,7 @@ const GitCoreLive = effect(GitCore, fn$1("makeGitCore")(function* (options) {
 	const refreshStatusUpstreamIfStale = fn$1("refreshStatusUpstreamIfStale")(function* (cwd) {
 		const upstream = yield* resolveCurrentUpstream(cwd);
 		if (!upstream) return;
-		yield* get$7(statusRemoteRefreshCache, new StatusRemoteRefreshCacheKey({
+		yield* get$8(statusRemoteRefreshCache, new StatusRemoteRefreshCacheKey({
 			gitCommonDir: yield* resolveGitCommonDir(cwd),
 			remoteName: upstream.remoteName
 		}));
@@ -232122,10 +232149,10 @@ const GitStatusBroadcasterLive = effect(GitStatusBroadcaster, gen(function* () {
 	const gitManager = yield* GitManager;
 	const changesPubSub = yield* acquireRelease(unbounded$1(), (pubsub) => shutdown$2(pubsub));
 	const broadcasterScope = yield* acquireRelease(make$37(), (scope) => close(scope, void_$3));
-	const cacheRef = yield* make$49(/* @__PURE__ */ new Map());
+	const cacheRef = yield* make$50(/* @__PURE__ */ new Map());
 	const pollersRef = yield* make$32(/* @__PURE__ */ new Map());
 	const getCachedStatus = fn$1("getCachedStatus")(function* (cwd) {
-		return yield* get$5(cacheRef).pipe(map$3((cache) => cache.get(cwd) ?? null));
+		return yield* get$6(cacheRef).pipe(map$3((cache) => cache.get(cwd) ?? null));
 	});
 	const updateCachedLocalStatus = fn$1("updateCachedLocalStatus")(function* (cwd, local, options) {
 		const nextLocal = {
@@ -232748,7 +232775,7 @@ const runCodexCommand = fn$1("runCodexCommand")(function* (args) {
 	}));
 	const codexSettings = yield* (yield* ServerSettingsService).getSettings.pipe(map$3((settings) => settings.providers.codex));
 	const effectiveHomePath = codexSettings.homePath || config.forgeCodexHomePath || process.env.CODEX_HOME || void 0;
-	const command = make$47(codexSettings.binaryPath, [...args], {
+	const command = make$48(codexSettings.binaryPath, [...args], {
 		shell: process.platform === "win32",
 		env: scrubForgeProviderChildEnvSecrets({
 			...process.env,
@@ -232976,7 +233003,7 @@ const CodexProviderLive = effect(CodexProvider, gen(function* () {
 	const fileSystem = yield* FileSystem;
 	const path = yield* Path$2;
 	const spawner = yield* ChildProcessSpawner;
-	const accountProbeCache = yield* make$50({
+	const accountProbeCache = yield* make$51({
 		capacity: 4,
 		timeToLive: minutes(5),
 		lookup: (key) => {
@@ -232988,7 +233015,7 @@ const CodexProviderLive = effect(CodexProvider, gen(function* () {
 			});
 		}
 	});
-	const getDiscovery = (input) => get$7(accountProbeCache, JSON.stringify([
+	const getDiscovery = (input) => get$8(accountProbeCache, JSON.stringify([
 		input.binaryPath,
 		input.homePath,
 		input.cwd
@@ -233130,7 +233157,7 @@ const CodexTextGenerationLive = effect(TextGeneration, gen(function* () {
 				...threadId ? { threadId } : {},
 				authSessionId
 			});
-			const command = make$47(codexSettings?.binaryPath || "codex", [
+			const command = make$48(codexSettings?.binaryPath || "codex", [
 				"exec",
 				"--ephemeral",
 				"--skip-git-repo-check",
@@ -233368,7 +233395,7 @@ const ClaudeTextGenerationLive = effect(TextGeneration, gen(function* () {
 		};
 		const claudeSettings = yield* map$3(serverSettingsService.getSettings, (settings) => settings.providers.claudeAgent).pipe(catch_(() => undefined_));
 		const rawStdout = yield* fn$1("runClaudeJson.runClaudeCommand")(function* () {
-			const command = make$47(claudeSettings?.binaryPath || "claude", [
+			const command = make$48(claudeSettings?.binaryPath || "claude", [
 				"-p",
 				"--output-format",
 				"json",
@@ -282886,7 +282913,7 @@ const GitManagerLive = effect(GitManager, fn$1("makeGitManager")(function* () {
 	});
 	const resolveDefaultBranch = fn$1("resolveDefaultBranch")(function* (cwd, localDefaultBranch) {
 		if (localDefaultBranch && localDefaultBranch.length > 0) return localDefaultBranch;
-		const fromGh = yield* get$7(defaultBranchFallbackCache, normalizeStatusCacheKey(cwd));
+		const fromGh = yield* get$8(defaultBranchFallbackCache, normalizeStatusCacheKey(cwd));
 		if (fromGh && fromGh.length > 0) return fromGh;
 		return DEFAULT_BASE_BRANCH_FALLBACK;
 	});
@@ -283266,10 +283293,10 @@ const GitManagerLive = effect(GitManager, fn$1("makeGitManager")(function* () {
 		};
 	});
 	const localStatus = fn$1("localStatus")(function* (input) {
-		return yield* get$7(localStatusResultCache, normalizeStatusCacheKey(input.cwd));
+		return yield* get$8(localStatusResultCache, normalizeStatusCacheKey(input.cwd));
 	});
 	const remoteStatus = fn$1("remoteStatus")(function* (input) {
-		return yield* get$7(remoteStatusResultCache, normalizeStatusCacheKey(input.cwd));
+		return yield* get$8(remoteStatusResultCache, normalizeStatusCacheKey(input.cwd));
 	});
 	const status = fn$1("status")(function* (input) {
 		const [local, remote] = yield* all([localStatus(input), remoteStatus(input)]);
@@ -283420,7 +283447,7 @@ const GitManagerLive = effect(GitManager, fn$1("makeGitManager")(function* () {
 		preparePullRequestThread,
 		runStackedAction: fn$1("runStackedAction")(function* (input, options) {
 			const progress = createProgressEmitter(input, options);
-			const currentPhase = yield* make$49(none$4());
+			const currentPhase = yield* make$50(none$4());
 			return yield* fn$1("runStackedAction.runAction")(function* () {
 				const initialStatus = yield* gitCore.statusDetails(input.cwd);
 				const wantsCommit = isCommitAction(input.action);
@@ -283509,7 +283536,7 @@ const GitManagerLive = effect(GitManager, fn$1("makeGitManager")(function* () {
 					result
 				});
 				return result;
-			})().pipe(ensuring(invalidateStatus(input.cwd)), tapError((error) => flatMap(get$5(currentPhase), (phase) => progress.emit({
+			})().pipe(ensuring(invalidateStatus(input.cwd)), tapError((error) => flatMap(get$6(currentPhase), (phase) => progress.emit({
 				kind: "action_failed",
 				phase: getOrNull(phase),
 				message: error.message
@@ -285284,7 +285311,7 @@ function makeApprovedWorkerPlanEventState() {
 function promptKey(masterThreadId, promptId) {
 	return `${masterThreadId}\n${promptId}`;
 }
-function asRecord$5(value) {
+function asRecord$6(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value) ? value : null;
 }
 function exactMaterializedTaskIds(value, expectedCount) {
@@ -285294,7 +285321,7 @@ function exactMaterializedTaskIds(value, expectedCount) {
 }
 function readyBatchFromActivity(state, event) {
 	if (event.payload.activity.kind !== "plan.task-creation.batch-succeeded") return null;
-	const payload = asRecord$5(event.payload.activity.payload);
+	const payload = asRecord$6(event.payload.activity.payload);
 	const promptId = payload?.["promptId"];
 	if (typeof promptId !== "string") return null;
 	const key = promptKey(event.payload.threadId, promptId);
@@ -286470,7 +286497,7 @@ function runtimeGrantNeedsRefresh(token, identity, nowSeconds = Math.floor(Date.
 	return claims.expiresAtSeconds - nowSeconds <= RUNTIME_GRANT_REFRESH_SKEW_SECONDS;
 }
 /** Narrow an unknown to a plain object, or null. */
-function asRecord$4(value) {
+function asRecord$5(value) {
 	return value !== null && typeof value === "object" ? value : null;
 }
 /** The raw (untrimmed) string when it is present and not blank, else null. */
@@ -286482,7 +286509,7 @@ function asTimestamp(value) {
 	return typeof value === "string" && Number.isFinite(Date.parse(value)) ? value : null;
 }
 function parseRuntimeGrantRefreshResponse(runtimeId, value) {
-	const data = asRecord$4(asRecord$4(value)?.data);
+	const data = asRecord$5(asRecord$5(value)?.data);
 	if (!data || data.runtimeId !== runtimeId) return null;
 	const grantToken = asNonBlankString(data.grantToken);
 	const expiresAt = asTimestamp(data.expiresAt);
@@ -286543,7 +286570,6 @@ async function refreshRuntimeProvisioningGrant(input) {
 async function maybeRefreshRuntimeProvisioningGrant(input) {
 	const current = runtimeGrantToken();
 	if (!current) return "skipped";
-	if (!runtimeGrantNeedsRefresh(current, input)) return "skipped";
 	const exactIdentity = exactRuntimeControlIdentity(input);
 	const currentClaims = currentGrantClaimsForRefresh({
 		currentGrant: current,
@@ -286552,6 +286578,11 @@ async function maybeRefreshRuntimeProvisioningGrant(input) {
 	});
 	if (!currentClaims) throw invalidRefreshResponse("Current runtime provisioning grant is unverifiable.");
 	const currentAuthorityClass = currentGrantAuthorityClass(currentClaims, exactIdentity);
+	const controlAuthorityMissing = currentAuthorityClass === "exact" && exactIdentity !== null && readRuntimeControlAuthority({
+		runtimeId: input.runtimeId,
+		...exactIdentity
+	}) === null;
+	if (!runtimeGrantNeedsRefresh(current, input) && !controlAuthorityMissing) return "skipped";
 	const refreshed = await refreshRuntimeProvisioningGrant({
 		runtimeId: input.runtimeId,
 		currentGrant: current,
@@ -286598,7 +286629,7 @@ function normalizeCount(count) {
 	return Number.isFinite(count) ? Math.max(0, Math.floor(count)) : 0;
 }
 const makeRuntimeDrainState = gen(function* () {
-	const stateRef = yield* make$49(initialState);
+	const stateRef = yield* make$50(initialState);
 	const update = (f) => updateAndGet(stateRef, f).pipe(map$3(snapshotFromState));
 	return {
 		beginTurn: (input) => update((state) => {
@@ -286649,8 +286680,8 @@ const makeRuntimeDrainState = gen(function* () {
 			drainTargetImageVersion: input.drainTargetImageVersion ?? state.drainTargetImageVersion,
 			drainForceRequired: input.drainForceRequired ?? state.drainForceRequired
 		})),
-		snapshot: get$5(stateRef).pipe(map$3(snapshotFromState)),
-		isDraining: get$5(stateRef).pipe(map$3((state) => state.draining))
+		snapshot: get$6(stateRef).pipe(map$3(snapshotFromState)),
+		isDraining: get$6(stateRef).pipe(map$3((state) => state.draining))
 	};
 });
 var RuntimeDrainState = class extends Service$1()("forge/runtimeDrain/RuntimeDrainState") {};
@@ -287203,17 +287234,17 @@ const ProviderRuntimeIngestionLive = effect(ProviderRuntimeIngestionService, fn$
 	const browserManager = yield* BrowserManager;
 	const runtimeDrainState = yield* RuntimeDrainState;
 	const runtimeDrainReporter = yield* RuntimeDrainReporter;
-	const turnMessageIdsByTurnKey = yield* make$50({
+	const turnMessageIdsByTurnKey = yield* make$51({
 		capacity: TURN_MESSAGE_IDS_BY_TURN_CACHE_CAPACITY,
 		timeToLive: TURN_MESSAGE_IDS_BY_TURN_TTL,
 		lookup: () => succeed(/* @__PURE__ */ new Set())
 	});
-	const bufferedAssistantTextByMessageId = yield* make$50({
+	const bufferedAssistantTextByMessageId = yield* make$51({
 		capacity: BUFFERED_MESSAGE_TEXT_BY_MESSAGE_ID_CACHE_CAPACITY,
 		timeToLive: BUFFERED_MESSAGE_TEXT_BY_MESSAGE_ID_TTL,
 		lookup: () => succeed("")
 	});
-	const bufferedProposedPlanById = yield* make$50({
+	const bufferedProposedPlanById = yield* make$51({
 		capacity: BUFFERED_PROPOSED_PLAN_BY_ID_CACHE_CAPACITY,
 		timeToLive: BUFFERED_PROPOSED_PLAN_BY_ID_TTL,
 		lookup: () => succeed({
@@ -288052,7 +288083,7 @@ const ProviderCommandReactorLive = effect(ProviderCommandReactor, gen(function*
 	const serverSettingsService = yield* ServerSettingsService;
 	const serverConfig = yield* ServerConfig;
 	const runtimeDrainState = yield* RuntimeDrainState;
-	const handledTurnStartKeys = yield* make$50({
+	const handledTurnStartKeys = yield* make$51({
 		capacity: HANDLED_TURN_START_KEY_MAX,
 		timeToLive: HANDLED_TURN_START_KEY_TTL,
 		lookup: () => succeed(true)
@@ -290844,7 +290875,7 @@ const readOpenCodeApiKey = (_settings) => process.env.OPENCODE_API_KEY || proces
 const runOpenCodeCommand = fn$1("runOpenCodeCommand")(function* (binaryPath, args) {
 	const useShell = process.platform === "win32";
 	if (useShell && !isShellSafeCommandPath(binaryPath)) return yield* fail(/* @__PURE__ */ new Error(`Refusing to spawn opencode: \`binaryPath\` contains shell metacharacters that cmd.exe would interpret as additional commands.`));
-	return yield* spawnAndCollect(binaryPath, make$47(binaryPath, [...args], {
+	return yield* spawnAndCollect(binaryPath, make$48(binaryPath, [...args], {
 		shell: useShell,
 		env: scrubForgeProviderChildEnvSecrets(process.env)
 	}));
@@ -291087,7 +291118,7 @@ const ProviderRegistryLive = effect(ProviderRegistry, gen(function* () {
 		provider
 	})]));
 	const fallbackByProvider = new Map(fallbackProviders.map((provider) => [provider.provider, provider]));
-	const providersRef = yield* make$49(yield* forEach(PROVIDER_CACHE_IDS, (provider) => {
+	const providersRef = yield* make$50(yield* forEach(PROVIDER_CACHE_IDS, (provider) => {
 		const filePath = cachePathByProvider.get(provider);
 		const fallbackProvider = fallbackByProvider.get(provider);
 		return readProviderStatusCache(filePath).pipe(provideService(FileSystem, fileSystem), map$3((cachedProvider) => {
@@ -291145,7 +291176,7 @@ const ProviderRegistryLive = effect(ProviderRegistry, gen(function* () {
 			], {
 				concurrency: "unbounded",
 				discard: true
-			}).pipe(andThen(get$5(providersRef)));
+			}).pipe(andThen(get$6(providersRef)));
 		}
 	});
 	yield* runForEach(codexProvider.streamChanges, (provider) => syncProvider(provider)).pipe(forkScoped);
@@ -291156,7 +291187,7 @@ const ProviderRegistryLive = effect(ProviderRegistry, gen(function* () {
 	yield* runForEach(cursorProvider.streamChanges, (provider) => syncProvider(provider)).pipe(forkScoped);
 	yield* runForEach(opencodeProvider.streamChanges, (provider) => syncProvider(provider)).pipe(forkScoped);
 	return {
-		getProviders: get$5(providersRef),
+		getProviders: get$6(providersRef),
 		refresh: (provider) => refresh(provider).pipe(tapError(logError), orElseSucceed(() => [])),
 		get streamChanges() {
 			return fromPubSub(changesPubSub);
@@ -291526,7 +291557,7 @@ const RepositoryIdentityResolverLive = effect(RepositoryIdentityResolver, fn$1("
 	});
 	return { resolve: fn$1("RepositoryIdentityResolver.resolve")(function* (cwd) {
 		const location = yield* promise(() => resolveRepositoryLocation(cwd));
-		const baseIdentity = yield* get$7(repositoryIdentityCache, location.cacheKey);
+		const baseIdentity = yield* get$8(repositoryIdentityCache, location.cacheKey);
 		if (baseIdentity === null) return null;
 		return location.subpath === null ? baseIdentity : {
 			...baseIdentity,
@@ -291835,7 +291866,7 @@ const WorkspaceEntriesLive = effect(WorkspaceEntries, gen(function* () {
 		if (normalizedCwd !== cwd) yield* invalidate(workspaceIndexCache, normalizedCwd);
 	});
 	const search = fn$1("WorkspaceEntries.search")(function* (input) {
-		return yield* get$7(workspaceIndexCache, yield* normalizeWorkspaceRoot(input.cwd)).pipe(map$3((index) => {
+		return yield* get$8(workspaceIndexCache, yield* normalizeWorkspaceRoot(input.cwd)).pipe(map$3((index) => {
 			const normalizedQuery = normalizeSearchQuery(input.query, { trimLeadingPattern: /^[@./]+/ });
 			const limit = Math.max(0, Math.floor(input.limit));
 			const rankedEntries = [];
@@ -291859,7 +291890,7 @@ const WorkspaceEntriesLive = effect(WorkspaceEntries, gen(function* () {
 	return {
 		invalidate: invalidate$1,
 		list: fn$1("WorkspaceEntries.list")(function* (input) {
-			const index = yield* get$7(workspaceIndexCache, yield* normalizeWorkspaceRoot(input.cwd));
+			const index = yield* get$8(workspaceIndexCache, yield* normalizeWorkspaceRoot(input.cwd));
 			return {
 				entries: index.entries.map((entry) => ({
 					path: entry.path,
@@ -293493,7 +293524,7 @@ function resolveBuildCommitFromEnv(env) {
 * environment descriptor down instead of reporting an honest "unknown".
 */
 function readBakedBuildCommit() {
-	return "75c8e9532c9e35e71d4da1d8d45474fa2855ff1d";
+	return "7f0d765bc59cb837f8aa8025b9b2f855df3fd36d";
 }
 async function resolveServerBuildCommit(input) {
 	if (isFullCommitSha(input.baked)) return input.baked;
@@ -293667,7 +293698,7 @@ const ServerEnvironmentLive = effect(ServerEnvironment, fn$1("makeServerEnvironm
 		return yield* decodeUnknownEffect(EnvironmentMetadata)(parsed).pipe(orElseSucceed(() => ({ displayName: null })));
 	});
 	const writeMetadata = (metadata) => fileSystem.writeFileString(serverConfig.environmentMetadataPath, `${JSON.stringify(metadata, null, 2)}\n`);
-	const displayNameOverrideRef = yield* make$49(normalizeDisplayName((yield* readMetadata).displayName ?? null));
+	const displayNameOverrideRef = yield* make$50(normalizeDisplayName((yield* readMetadata).displayName ?? null));
 	const posthog = yield* PosthogPublicConfig.asEffect();
 	const buildCommit = yield* promise(() => resolveServerBuildCommit({
 		baked: readBakedBuildCommit(),
@@ -293676,7 +293707,7 @@ const ServerEnvironmentLive = effect(ServerEnvironment, fn$1("makeServerEnvironm
 	}));
 	const deviceRuntimeId = resolveDescriptorDeviceRuntimeId(serverConfig);
 	const buildDescriptor = gen(function* () {
-		const displayNameOverride = yield* get$5(displayNameOverrideRef);
+		const displayNameOverride = yield* get$6(displayNameOverrideRef);
 		const os = platformOs();
 		return {
 			environmentId,
@@ -294912,7 +294943,7 @@ const generatePairingToken = () => {
 const BootstrapCredentialServiceLive = effect(BootstrapCredentialService, gen(function* () {
 	const config = yield* ServerConfig;
 	const pairingLinks = yield* AuthPairingLinkRepository;
-	const seededGrantsRef = yield* make$49(/* @__PURE__ */ new Map());
+	const seededGrantsRef = yield* make$50(/* @__PURE__ */ new Map());
 	const changesPubSub = yield* unbounded$1();
 	const invalidBootstrapCredentialError = (message) => new BootstrapCredentialError({
 		message,
@@ -295357,7 +295388,7 @@ const SessionCredentialServiceLive = effect(SessionCredentialService, gen(functi
 	if (serverConfig.forgeCloudShellMode === true && configuredSigningKey === null) return yield* die$1(/* @__PURE__ */ new Error("FORGE_SESSION_SIGNING_KEY must decode to at least 32 bytes in cloud-shell mode. Forge Cloud refuses to issue restart-unsafe or replica-local sessions."));
 	const signingSecret = configuredSigningKey ?? (yield* secretStore.getOrCreateRandom(SIGNING_SECRET_NAME, 32));
 	const statelessCookieSessions = configuredSigningKey !== null;
-	const connectedSessionsRef = yield* make$49(/* @__PURE__ */ new Map());
+	const connectedSessionsRef = yield* make$50(/* @__PURE__ */ new Map());
 	const changesPubSub = yield* unbounded$1();
 	const cookieName = resolveSessionCookieName({
 		mode: serverConfig.mode,
@@ -295379,7 +295410,7 @@ const SessionCredentialServiceLive = effect(SessionCredentialService, gen(functi
 	const loadActiveSession = (sessionId) => gen(function* () {
 		const row = yield* authSessions.getById({ sessionId });
 		if (isNone(row) || row.value.revokedAt !== null) return none$4();
-		const connectedSessions = yield* get$5(connectedSessionsRef);
+		const connectedSessions = yield* get$6(connectedSessionsRef);
 		return some(toAuthClientSession({
 			sessionId: row.value.sessionId,
 			subject: row.value.subject,
@@ -295544,7 +295575,7 @@ const SessionCredentialServiceLive = effect(SessionCredentialService, gen(functi
 	})));
 	const listActive = () => gen(function* () {
 		const now$1 = yield* now;
-		const connectedSessions = yield* get$5(connectedSessionsRef);
+		const connectedSessions = yield* get$6(connectedSessionsRef);
 		return (yield* authSessions.listActive({ now: now$1 })).map((row) => toAuthClientSession({
 			sessionId: row.sessionId,
 			subject: row.subject,
@@ -302524,7 +302555,7 @@ const LocalAutomationSchedulerLive = effectDiscard(gen(function* () {
 }));
 //#endregion
 //#region src/command/providerUsageEnvironment.ts
-function asRecord$3(value) {
+function asRecord$4(value) {
 	return value !== null && typeof value === "object" && !Array.isArray(value) ? value : null;
 }
 function positiveInteger(value) {
@@ -302544,7 +302575,7 @@ function readRuntimeId(row) {
 	return typeof runtimeId === "string" && runtimeId.trim() !== "" ? runtimeId : null;
 }
 function readCandidate(runtime, ownerUserId) {
-	const row = asRecord$3(runtime);
+	const row = asRecord$4(runtime);
 	if (row === null || !isOwnedRuntime(row, ownerUserId) || row["desiredState"] !== "running") return null;
 	const organizationId = positiveInteger(row["organizationId"]);
 	const environmentId = readEnvironmentId(row["environmentId"]);
@@ -302579,15 +302610,17 @@ function deduplicateCandidates(candidates) {
 * organization from browser input.
 */
 function selectProviderUsageEnvironment(rawCatalog, ownerUserId) {
-	const runtimes = asRecord$3(asRecord$3(rawCatalog)?.["data"])?.["runtimes"];
+	const runtimes = asRecord$4(asRecord$4(rawCatalog)?.["data"])?.["runtimes"];
 	if (!Array.isArray(runtimes)) return { kind: "unavailable" };
 	const candidates = deduplicateCandidates(runtimes.map((runtime) => readCandidate(runtime, ownerUserId)).filter((candidate) => candidate !== null));
 	const bestRank = Math.min(...candidates.map((candidate) => statusRank(candidate.status)));
 	const bestCandidates = candidates.filter((candidate) => statusRank(candidate.status) === bestRank);
 	if (bestCandidates.length !== 1) return { kind: "unavailable" };
+	const selected = bestCandidates[0];
 	return {
 		kind: "ready",
-		organizationId: bestCandidates[0].organizationId
+		organizationId: selected.organizationId,
+		runtimeId: selected.runtimeId
 	};
 }
 //#endregion
@@ -302608,13 +302641,22 @@ function selectProviderUsageEnvironment(rawCatalog, ownerUserId) {
 const FAILURE_TEXT = {
 	CLAUDE_USAGE_ENVIRONMENT_UNAVAILABLE: "Refresh needs your Environment running.",
 	CLAUDE_USAGE_CREDENTIAL_NOT_READY: "The Claude credential is not applied to your Environment yet.",
+	CLAUDE_USAGE_CREDENTIAL_APPLY_FAILED: "Your Environment rejected the delivered Claude credential.",
+	CLAUDE_USAGE_CREDENTIAL_REFRESHING: "The delivered Claude credential expired. CMMD is sending a replacement.",
 	CLAUDE_USAGE_REFRESH_IN_PROGRESS: "A refresh for this account is already running.",
 	CLAUDE_USAGE_PROBE_FAILED: "Your Environment could not read Claude usage.",
 	CLAUDE_USAGE_RECONNECT_REQUIRED: "Reconnect this Claude account to refresh usage.",
 	CLAUDE_USAGE_ACCOUNT_NOT_FOUND: "This Claude account is no longer connected.",
 	CLAUDE_USAGE_REFRESH_UNAVAILABLE: "Claude usage refresh is unavailable."
 };
-/** Verbatim from CMMD `personal-claude-usage.ts` and `provider-usage-service.ts`. */
+/**
+* Verbatim from CMMD `personal-claude-usage.ts` and `provider-usage-service.ts`.
+*
+* Three reasons land on `CLAUDE_USAGE_CREDENTIAL_NOT_READY` because the refresh
+* response cannot tell them apart. `claudeUsageCredentialReadiness.ts` splits
+* them afterwards by reading the runtime's readiness, which is the only place
+* that knows whether a delivery is on its way or has already failed.
+*/
 const CODE_BY_UPSTREAM_REASON = {
 	runtime_not_active: "CLAUDE_USAGE_ENVIRONMENT_UNAVAILABLE",
 	claude_native_delivery_disabled: "CLAUDE_USAGE_ENVIRONMENT_UNAVAILABLE",
@@ -302627,7 +302669,12 @@ const CODE_BY_UPSTREAM_REASON = {
 	usage_receipt_invalid: "CLAUDE_USAGE_PROBE_FAILED",
 	usage_output_invalid: "CLAUDE_USAGE_PROBE_FAILED"
 };
-function failure(code, status) {
+/**
+* The one place a failure body is built, so every sentence a browser reads is
+* written in `FAILURE_TEXT` above. `claudeUsageCredentialReadiness.ts` calls it
+* to reach the two codes no upstream reason maps to.
+*/
+function describeClaudeUsageRefreshFailureCode(code, status) {
 	return {
 		status,
 		body: {
@@ -302636,6 +302683,9 @@ function failure(code, status) {
 		}
 	};
 }
+function failure(code, status) {
+	return describeClaudeUsageRefreshFailureCode(code, status);
+}
 /**
 * CMMD sends the reason as `{ "error": "<reason>" }`. Anything else, including
 * a longer sentence that happens to start with an allowlisted word, is treated
@@ -302656,6 +302706,77 @@ function describeClaudeUsageRefreshFailure(error) {
 	return failure("CLAUDE_USAGE_REFRESH_UNAVAILABLE", error.status === 503 ? 503 : 502);
 }
 //#endregion
+//#region src/command/claudeUsageCredentialReadiness.ts
+/**
+* Which "credential not ready" a Claude usage refresh actually hit.
+*
+* CMMD answers a blocked refresh with one reason for three different worlds:
+* a delivery still travelling, a delivery CMMD cannot produce, and a delivery
+* the Environment already ran and rejected. `claudeUsageRefreshFailure.ts` has
+* to collapse all three into `CLAUDE_USAGE_CREDENTIAL_NOT_READY`, because the
+* refresh response carries nothing that separates them. The card then says
+* "not applied yet", which asks the user to wait even when waiting can never
+* work: on 2026-09-08 CMMD's reconciler failed native credential validation on
+* runtime 523cd771 forty-three times in seventy-two minutes, and the card said
+* "yet" through all of it.
+*
+* The runtime readiness read is the one source that separates the worlds, so
+* the handler makes that read only for the collapsed code and hands the answer
+* here. Every sentence is written in `claudeUsageRefreshFailure.ts`; nothing
+* from CMMD's `lastErrorCode` or `lastErrorMessage` is repeated to a browser.
+*/
+const CMMD_READINESS_PATH_PREFIX = "/api/forge/context/providers/claude/runtime-readiness/";
+/** Typed as the gateway's absolute-path shape so the call site needs no cast. */
+function claudeUsageReadinessPath(runtimeId) {
+	return `${CMMD_READINESS_PATH_PREFIX}${encodeURIComponent(runtimeId)}`;
+}
+/**
+* Whether a readiness read would tell the caller anything it does not know.
+*
+* Only the collapsed code is ambiguous. Every other failure already names its
+* own cause, so asking CMMD again would cost a round trip on the error path
+* and could only produce a less specific answer.
+*/
+function claudeUsageFailureWantsReadiness(failure) {
+	return failure.body.code === "CLAUDE_USAGE_CREDENTIAL_NOT_READY";
+}
+function asRecord$3(value) {
+	return value !== null && typeof value === "object" && !Array.isArray(value) ? value : null;
+}
+function readString(value) {
+	return typeof value === "string" && value !== "" ? value : null;
+}
+/**
+* Refines the collapsed credential failure using the runtime's readiness.
+*
+* The ranking is by what the user can act on, not by which field looks most
+* severe:
+*
+* 1. A reason of `credential_reconnect_required` or `credential_not_connected`
+*    means CMMD holds no usable grant. That is upstream of delivery, so it wins
+*    even when the delivery it caused also failed. No re-delivery helps; only a
+*    reconnect does.
+* 2. `deliveryStatus: "failed"` means CMMD had a credential, sent it, and the
+*    Environment rejected it. Waiting cannot fix that, which is exactly what
+*    the collapsed sentence tells the user to do.
+* 3. `credential_expired_refreshing` means a replacement is already in flight,
+*    so the honest instruction is to retry shortly.
+*
+* Anything else, including a readiness read that failed or answered a shape
+* this module does not recognise, keeps the collapsed failure. A refinement
+* that guessed would be worse than the vague sentence it replaced.
+*/
+function refineClaudeUsageRefreshFailure(failure, rawReadiness) {
+	if (!claudeUsageFailureWantsReadiness(failure)) return failure;
+	const readiness = asRecord$3(asRecord$3(rawReadiness)?.["data"]);
+	if (readiness === null) return failure;
+	const reasonCode = claudeReadinessReasonCode(readString(readiness["reason"]));
+	if (reasonCode === "CREDENTIAL_RECONNECT_REQUIRED") return describeClaudeUsageRefreshFailureCode("CLAUDE_USAGE_RECONNECT_REQUIRED", 409);
+	if (readiness["deliveryStatus"] === "failed") return describeClaudeUsageRefreshFailureCode("CLAUDE_USAGE_CREDENTIAL_APPLY_FAILED", 503);
+	if (reasonCode === "CREDENTIAL_EXPIRED_REFRESHING") return describeClaudeUsageRefreshFailureCode("CLAUDE_USAGE_CREDENTIAL_REFRESHING", 503);
+	return failure;
+}
+//#endregion
 //#region src/command/wsToken.ts
 /**
 * Build the WS token response given an optional PAT and the configured CMMD
@@ -304520,6 +304641,25 @@ function buildClaudeUsageRefreshErrorResponse(error) {
 	const failure = describeClaudeUsageRefreshFailure(error);
 	return jsonUnsafe(failure.body, { status: failure.status });
 }
+/**
+* Answers a refresh CMMD refused, asking the selected runtime what state its
+* Claude credential is in when the refusal alone cannot say. Only the collapsed
+* credential code costs the extra read, and a readiness read that itself fails
+* leaves the original answer untouched.
+*/
+function answerBlockedClaudeUsageRefresh(input) {
+	return gen(function* () {
+		const failure = describeClaudeUsageRefreshFailure(input.error);
+		if (!claudeUsageFailureWantsReadiness(failure)) return jsonUnsafe(failure.body, { status: failure.status });
+		const readinessOutcome = yield* runCmmdRestProxy(input.session, (jwt) => cmmdGateway.request({
+			method: "GET",
+			jwt,
+			path: claudeUsageReadinessPath(input.runtimeId)
+		}), { jwt: input.requestJwt });
+		const refined = refineClaudeUsageRefreshFailure(failure, readinessOutcome.ok ? readinessOutcome.value : null);
+		return jsonUnsafe(refined.body, { status: refined.status });
+	});
+}
 function makeRefreshProviderUsageHandler(dependencies = {}) {
 	return gen(function* () {
 		const request = yield* HttpServerRequest;
@@ -304556,7 +304696,12 @@ function makeRefreshProviderUsageHandler(dependencies = {}) {
 				body: { providerAccountId: input.providerAccountId },
 				orgId: String(target.organizationId)
 			}), { jwt: requestJwt });
-			if (!refreshOutcome.ok) return buildClaudeUsageRefreshErrorResponse(refreshOutcome.error);
+			if (!refreshOutcome.ok) return yield* answerBlockedClaudeUsageRefresh({
+				session,
+				requestJwt,
+				runtimeId: target.runtimeId,
+				error: refreshOutcome.error
+			});
 			const snapshotOutcome = yield* runCmmdRestProxy(session, (jwt) => cmmdGateway.request({
 				method: "GET",
 				jwt,
@@ -304655,6 +304800,22 @@ registerProxyRoute({
 	responseShape: "unwrapData",
 	successStatus: 200
 });
+registerProxyRoute({
+	forgePath: "/api/cmmd/forge-runtimes/:runtimeId/execution-intents",
+	method: "POST",
+	cmmdPath: "/api/forge/context/runtimes/:runtimeId/execution-intents",
+	orgIdSource: "none",
+	responseShape: "unwrapData",
+	successStatus: 200
+});
+registerProxyRoute({
+	forgePath: "/api/cmmd/forge-runtimes/:runtimeId/execution-intents/:intentId/dispatched",
+	method: "POST",
+	cmmdPath: "/api/forge/context/runtimes/:runtimeId/execution-intents/:intentId/dispatched",
+	orgIdSource: "none",
+	responseShape: "unwrapData",
+	successStatus: 200
+});
 registerProxyRoute({
 	forgePath: "/api/cmmd/devices/:deviceId/revoke",
 	method: "POST",
@@ -306805,7 +306966,7 @@ const RuntimeReplicationLive = effect(RuntimeReplication, gen(function* () {
 	const terminal = yield* serviceOption(TerminalManager);
 	const activeHourMeter = yield* ActiveHourMeter;
 	const runtimeId = resolveRuntimeReplicationRuntimeId(config);
-	const outboxWarningActive = yield* make$49(false);
+	const outboxWarningActive = yield* make$50(false);
 	const enqueueInventoryPayload = (payload) => runtimeId ? outbox.enqueue({
 		runtimeId,
 		streamKey: "inventory",
@@ -308060,7 +308221,7 @@ const isActiveHourMeteringEnabled = gen(function* () {
 }).pipe(catch_(() => succeed(false)));
 const ActiveHourMeterLive = effect(ActiveHourMeter, gen(function* () {
 	const outbox = yield* RuntimeReplicationOutbox;
-	const statesByRuntime = yield* make$49(/* @__PURE__ */ new Map());
+	const statesByRuntime = yield* make$50(/* @__PURE__ */ new Map());
 	const markAwake = (runtimeId) => gen(function* () {
 		if (!(yield* isActiveHourMeteringEnabled)) return;
 		yield* update$4(statesByRuntime, (states) => {
@@ -310447,11 +310608,11 @@ const PipelineRunCoordinatorLive = effect(PipelineRunCoordinator, gen(function*
 		if (!preparedHandoffMatchesRun(preparedHandoff, input.runId)) return yield* coordinatorError("registerHandoff", "PIPELINE_HANDOFF_PREPARATION_INVALID", "The pipeline handoff preparation is missing, belongs to another run, or was already consumed.");
 		preparedHandoffs.delete(input.preparedHandoff);
 		const ownedProviderAuthorityInstallations = /* @__PURE__ */ new Set();
-		const preparedAuthorityRef = yield* make$49({
+		const preparedAuthorityRef = yield* make$50({
 			authority: preparedHandoff.authority,
 			preparation: preparedHandoff.providerAuthorityPreparation
 		});
-		const acceptingHeartbeatRef = yield* make$49(true);
+		const acceptingHeartbeatRef = yield* make$50(true);
 		const heartbeatPublicationSemaphore = yield* make$43(1);
 		if ((yield* store.getByRunId(input.runId)) !== null) return yield* coordinatorError("registerHandoff", "PIPELINE_HANDOFF_ALREADY_BOUND", "The CMMD run already has a Forge task thread and must use the authority rebind contract.");
 		const snapshot = preparedHandoff.snapshot;
@@ -310486,7 +310647,7 @@ const PipelineRunCoordinatorLive = effect(PipelineRunCoordinator, gen(function*
 				contextHash: preparedHandoff.authority.contextHash,
 				contextSnapshot: snapshot.run.contextSnapshot
 			}).pipe(mapError((cause) => coordinatorError("registerHandoff", "PIPELINE_CONTEXT_ARTIFACT_FAILED", "The immutable CMMD run context could not be materialized for the provider.", cause)));
-			const latestPreparedAuthority = yield* heartbeatPublicationSemaphore.withPermits(1)(set$2(acceptingHeartbeatRef, false).pipe(andThen(get$5(preparedAuthorityRef))));
+			const latestPreparedAuthority = yield* heartbeatPublicationSemaphore.withPermits(1)(set$2(acceptingHeartbeatRef, false).pipe(andThen(get$6(preparedAuthorityRef))));
 			const persistedAuthority = yield* persistAuthoritySecret({
 				runId: input.runId,
 				organizationId: latestPreparedAuthority.authority.organizationId,
@@ -310560,7 +310721,7 @@ const PipelineRunCoordinatorLive = effect(PipelineRunCoordinator, gen(function*
 			executionSessionInstallations.set(input.runId, rollbackSession);
 		}), gen(function* () {
 			yield* sleep$4(seconds(30));
-			const currentAuthority = (yield* get$5(preparedAuthorityRef)).authority;
+			const currentAuthority = (yield* get$6(preparedAuthorityRef)).authority;
 			const heartbeat = yield* client.heartbeat({
 				runId: input.runId,
 				authority: currentAuthority,
@@ -310572,7 +310733,7 @@ const PipelineRunCoordinatorLive = effect(PipelineRunCoordinator, gen(function*
 				heartbeat
 			});
 			yield* heartbeatPublicationSemaphore.withPermits(1)(gen(function* () {
-				if (!(yield* get$5(acceptingHeartbeatRef))) return;
+				if (!(yield* get$6(acceptingHeartbeatRef))) return;
 				yield* set$2(preparedAuthorityRef, {
 					authority: heartbeat.refreshedAuthority,
 					preparation
@@ -315296,9 +315457,9 @@ const AgentProtocolReactorLive = effect(AgentProtocolReactor, gen(function* () {
 const PRUNE_GRACE_MS = 6e4;
 const makeUserSlot = gen(function* () {
 	return {
-		snapshotRef: yield* make$49(null),
+		snapshotRef: yield* make$50(null),
 		pubsub: yield* unbounded$1(),
-		subscriberCountRef: yield* make$49(0)
+		subscriberCountRef: yield* make$50(0)
 	};
 });
 const WorkspaceReadinessStateLive = effect(WorkspaceReadinessState, gen(function* () {
@@ -315338,14 +315499,14 @@ const WorkspaceReadinessStateLive = effect(WorkspaceReadinessState, gen(function
 	*/
 	const schedulePrune = (userId, slot) => gen(function* () {
 		yield* sleep$4(millis(PRUNE_GRACE_MS));
-		if ((yield* get$5(slot.subscriberCountRef)) > 0) return;
-		if ((yield* get$5(slot.snapshotRef))?.phase !== "app-ready") return;
+		if ((yield* get$6(slot.subscriberCountRef)) > 0) return;
+		if ((yield* get$6(slot.snapshotRef))?.phase !== "app-ready") return;
 		yield* shutdown$2(slot.pubsub);
 		yield* removeSlot(userId);
 	}).pipe(forkIn(pruneScope), asVoid);
 	const update = (userId, event) => gen(function* () {
 		const slot = yield* getOrCreateSlot(userId);
-		const previous = yield* get$5(slot.snapshotRef);
+		const previous = yield* get$6(slot.snapshotRef);
 		if (previous !== null && event.ts < previous.ts) return;
 		yield* set$2(slot.snapshotRef, event);
 		yield* publish(slot.pubsub, event);
@@ -315354,7 +315515,7 @@ const WorkspaceReadinessStateLive = effect(WorkspaceReadinessState, gen(function
 	const snapshot = (userId) => gen(function* () {
 		const slot = (yield* get$2(slotsRef)).get(userId);
 		if (!slot) return null;
-		return yield* get$5(slot.snapshotRef);
+		return yield* get$6(slot.snapshotRef);
 	});
 	/**
 	* Stream of phase events for `userId`. Emits the current snapshot first
@@ -315363,7 +315524,7 @@ const WorkspaceReadinessStateLive = effect(WorkspaceReadinessState, gen(function
 	*/
 	const subscribe = (userId) => unwrap$1(gen(function* () {
 		const slot = yield* getOrCreateSlot(userId);
-		const initial = yield* get$5(slot.snapshotRef);
+		const initial = yield* get$6(slot.snapshotRef);
 		const live = fromPubSub(slot.pubsub);
 		const stream = initial === null ? live : concat$2(succeed$4(initial), live);
 		yield* update$4(slot.subscriberCountRef, (n) => n + 1);
@@ -316339,13 +316500,13 @@ const gitUrlCloneRouteLayer = add$1("POST", "/api/cloud/git/clone-url", gen(func
 //#endregion
 //#region src/server.ts
 const PtyAdapterLive = unwrap(gen(function* () {
-	if (typeof Bun !== "undefined") return (yield* promise(() => import("./BunPTY-C_ONQ8rt.mjs"))).layer;
-	else return (yield* promise(() => import("./NodePTY-DU_KoZdd.mjs"))).layer;
+	if (typeof Bun !== "undefined") return (yield* promise(() => import("./BunPTY-oVISucl_.mjs"))).layer;
+	else return (yield* promise(() => import("./NodePTY-CVH2yNYl.mjs"))).layer;
 }));
 const HttpServerLive = unwrap(gen(function* () {
 	const config = yield* ServerConfig;
-	if (typeof Bun !== "undefined") return (yield* promise(() => import("./BunHttpServer-GM72b26K.mjs"))).layer(bunHttpServerOptions(config));
-	const [NodeHttpServer, NodeHttp] = yield* all([promise(() => import("./NodeHttpServer-DmEyd0J4.mjs")), promise(() => import("node:http"))]);
+	if (typeof Bun !== "undefined") return (yield* promise(() => import("./BunHttpServer-VI75aqJw.mjs"))).layer(bunHttpServerOptions(config));
+	const [NodeHttpServer, NodeHttp] = yield* all([promise(() => import("./NodeHttpServer-Dw7ivXfX.mjs")), promise(() => import("node:http"))]);
 	return NodeHttpServer.layer(NodeHttp.createServer, {
 		host: config.host,
 		port: config.port
@@ -316353,10 +316514,10 @@ const HttpServerLive = unwrap(gen(function* () {
 }));
 const PlatformServicesLive = unwrap(gen(function* () {
 	if (typeof Bun !== "undefined") {
-		const { layer } = yield* promise(() => import("./BunServices-B-6JkR0Q.mjs"));
+		const { layer } = yield* promise(() => import("./BunServices-D0JTDujL.mjs"));
 		return layer;
 	} else {
-		const { layer } = yield* promise(() => import("./NodeServices-DeNLW36O.mjs").then((n) => n.t));
+		const { layer } = yield* promise(() => import("./NodeServices-CBNXOYLG.mjs").then((n) => n.t));
 		return layer;
 	}
 }));
@@ -317041,12 +317202,12 @@ const findActiveProjectTarget = fn$1("findActiveProjectTarget")(function* (input
 		workspaceRoot: resolved.workspaceRoot
 	};
 });
-const fetchLiveOrchestrationSnapshot = (origin, bearerToken$1) => runLiveServerRequest(get$6(`${origin}/api/orchestration/snapshot`).pipe(acceptJson, bearerToken(bearerToken$1)), matchStatus({
+const fetchLiveOrchestrationSnapshot = (origin, bearerToken$1) => runLiveServerRequest(get$7(`${origin}/api/orchestration/snapshot`).pipe(acceptJson, bearerToken(bearerToken$1)), matchStatus({
 	"2xx": decodeOrchestrationReadModelResponse,
 	orElse: (response) => readErrorMessageFromResponse(response).pipe(flatMap((message) => fail(new Error(message))))
 }));
 const ProjectLeadExplanationEnvelope = Struct({ data: ProjectLeadExplanationSchema });
-const fetchLiveProjectLeadExplanation = (origin, bearerToken$3, projectId) => runLiveServerRequest(get$6(`${origin}/api/cmmd/projects/${projectId}/project-lead/explain`).pipe(acceptJson, bearerToken(bearerToken$3)), matchStatus({
+const fetchLiveProjectLeadExplanation = (origin, bearerToken$3, projectId) => runLiveServerRequest(get$7(`${origin}/api/cmmd/projects/${projectId}/project-lead/explain`).pipe(acceptJson, bearerToken(bearerToken$3)), matchStatus({
 	"2xx": (response) => schemaBodyJson$1(ProjectLeadExplanationEnvelope)(response).pipe(map$3((body) => body.data)),
 	orElse: (response) => readErrorMessageFromResponse(response).pipe(flatMap((message) => fail(new Error(message))))
 }));