@cmmd-center/forge 0.13.124 → 0.13.125

package/dist/bin.mjs

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 
 import { a as __toCommonJS, i as __require, n as __esmMin, o as __toESM, r as __exportAll, t as __commonJSMin } from "./chunk-C5ckVeoz.mjs";
-import { $ as encodeEffect, $a as make$38, $i as spaced, $n as filterMapOrFail, $r as runPromise, $s as max, $t as stringifyJson, Aa as Scope$1, Ai as void_$1, An as cached$3, Ar as match$1, As as uninterruptibleMask, At as withConstructorDefault, Ba as CurrentLogSpans, Bi as counter, Bn as catch_, Bo as addFinalizer, Br as orDie, Bs as make$41, Bt as head, C as Record, Ca as mergeAll, Cc as map$4, Ci as tx$1, Cn as andThen, Co as hasDies, Cr as logInfo, Cs as sleep$3, Ct as optionalKey, D as TaggedStruct, Da as succeedContext, Di as uninterruptibleMask$1, Dn as as$3, Do as interruptors, Ds as suspend, Dt as toCodecStringTree, E as TaggedErrorClass, Ea as succeed$2, Ec as sort, Ei as uninterruptible, En as annotateSpans, Eo as interrupt$2, Er as map$3, Et as toCodecJson, F as UndefinedOr, Fa as forkUnsafe, Fc as fail$1, Fi as withParentSpan, Fn as catchFilter, Fr as onError$1, Fs as MinimumTraceLevel, G as decodeExit, Ga as done, Gc as empty$1, Gi as withAttributes, Gl as hasProperty, Gn as die$1, Gr as provideService, Gs as format$1, Gt as Transformation, H as declare, Hc as Reference$1, Hi as snapshotUnsafe, Hn as contextWith, Ho as as$2, Hr as promise, Ht as size$2, I as Union, Ia as make$36, Ii as withSpan, In as catchIf, Io as ConsoleRef, Ir as onExit, Is as NativeSpan, It as assign, J as decodeUnknownEffect, Ja as failCause$3, Ji as exponential, Jl as isNotUndefined, Jn as exit, Jr as repeat, Js as hours, Jt as transformOrFail, K as decodeSync, Kc as get$3, Ki as addDelay, Kl as isNotNull, Ko as consolePretty$1, Kr as race, Ks as fromInput, L as Unknown, La as makeUnsafe$4, Li as withTracerEnabled, Ln as catchReason, Lo as CurrentLoggers$1, Ls as ParentSpan, Lt as append$1, M as URLFromString, Ma as addFinalizerExit, Mi as whileLoop, Ml as NodeInspectSymbol, Mn as callback, Mo as pretty, Ms as void_$2, Na as close, Ni as withFiber$1, Nl as toJson, Nn as catchCause, No as prettyErrors, Nr as matchEffect, O as TemplateLiteral, Oa as sync$2, Ol as isEffect$1, On as asSome, Or as mapError, Os as sync, Ot as toJsonSchemaDocument, P as Undefined, Pa as closeUnsafe, Pl as format, Pn as catchDefect, Po as squash, Pr as never$1, Q as encode$4, Qc as merge$2, Qi as recurs, Qn as filter$1, Qr as runForkWith, R as UnknownFromJsonString$1, Ra as provide$2, Rc as isFailure$1, Ri as yieldNow, Rl as equals, Rn as catchTag, Rr as onInterrupt, Rs as Tracer, Rt as drop$1, S as Option, Sa as merge$3, Si as try_, Sn as all, Sr as logFatal, Ss as scopeAddFinalizerExit, St as optional$4, T as Struct, Ta as provideMerge, Tc as reverse, Ti as undefined_, Tn as annotateLogs, To as hasInterruptsOnly, Tr as makeSpanScoped, Tt as tag, Ua as TracerTimingEnabled, Uc as Service$1, Ui as timer, Un as currentSpan, Ur as provide, Ut as toArray, V as brand, Va as MinimumLogLevel, Vc as succeed$1, Vi as gauge, Vn as context, Vo as andThen$1, Vr as orElseSucceed, Vt as isEmpty$2, W as decodeEffect, Wa as _await, Wc as add$2, Wi as update$3, Wl as compose$1, Wr as provideContext, Ws as days, X as decodeUnknownOption, Xc as make$34, Xl as isObject$1, Xn as failCause$1, Xr as retry, Xt as onSome, Y as decodeUnknownExit, Yc as getUnsafe$1, Yi as forever$2, Yl as isNullish, Yn as fail, Yr as result, Z as decodeUnknownSync, Za as isDeferred, Zc as makeUnsafe$3, Zi as passthrough$1, Zl as isTagged, Zr as runFork, Zs as isGreaterThan$1, Zt as parseJson$1, _ as NonEmptyArray, _a as effectContext, _i as tapErrorTag, _n as toUtc, _t as isSchemaError, a as DateTimeUtc, aa as Random$1, ac as sum$1, al as getOrElse, an as value, ao as interrupt$3, ar as fnUntraced, at as isBetween, au as constVoid, b as NullOr, bi as timeoutOrElse, bl as PipeInspectableProto, bn as acquireUseRelease, br as logDebug, bs as reportCauseUnsafe, bt as makeFilter, c as Defect, ca as Clock, cc as toSeconds, ci as sleep$4, cl as isNone, cn as add$3, co as match$2, cr as forkChild, cs as flatMap$1, ct as isGreaterThanOrEqualTo, d as Exit, dc as empty$3, di as succeedSome, dl as match, dn as isGreaterThanOrEqualTo$1, dr as forkScoped, ds as forkDetach, dt as isMaxLength, du as pipeArguments, ea as catchDone, ec as millis, el as firstSomeOf, er as filterOrFail, et as encodeSync, eu as cast, fa as TaggedError, fc as ensure, fi as suspend$1, fl as none$4, fn as make$37, fr as gen, ft as isMaxProperties, g as Never, ga as effect, gi as tapError, gn as toEpochMillis, gr as interruptible, gt as isSchema, h as Literals, ha as buildWithMemoMap, hc as fromIterable, hi as tapCause, hl as make$40, hn as toDate, hr as interrupt$1, ht as isPattern, i as Class, ic as subtract, ii as scoped, il as fromUndefinedOr, in as make$39, io as failCause$2, ir as fn$1, it as is$1, iu as constUndefined, ja as addFinalizer$1, jn as cachedWithTTL, jo as map$6, jr as matchCauseEffect, jt as withDecodingDefault, k as Trim, ka as unwrap, ki as useSpan, kl as withFiber, kn as asVoid, ks as tracerLogger$1, kt as toType, l as Duration, la as currentTimeMillis, lc as zero, li as succeed, ll as isSome, ln as distance, lr as forkDetach$1, ls as fnUntraced$1, lt as isInt, lu as identity, m as Literal, ma as build, mc as flatMapNullishOr, mi as tap, ml as Number$2, mn as now, mo as StackTrace, mr as ignoreCause, ms as loggerMake, mt as isNonEmpty, n as ArraySchema, nc as minutes, nl as flatten$1, no as die$2, nt as encodeUnknownExit, o as DateTimeUtcFromString, oa as clamp, oc as times, oi as service, ol as getOrNull, oo as isFailure, or as forEach, ot as isFinite$1, ou as constant, p as Int$1, pa as CurrentMemoMap, pc as filter, pi as sync$1, pl as some, pn as makeUnsafe$5, po as NoSuchElementError, pr as ignore, pt as isMinLength, q as decodeTo, qa as fail$3, qi as both, ql as isNotNullish, qn as ensuring, qr as raceFirst, qs as fromInputUnsafe, r as Boolean$1, ra as isDoneCause, rc as seconds, ri as scope$1, rl as fromNullishOr, rn as makeFormatterDefault, ro as fail$2, rr as flatten$2, rt as fromJsonString, ru as constTrue, sa as parse$6, sc as toMillis, si as serviceOption, sl as getOrUndefined, sn as encodeBase64Url$2, so as isSuccess, sr as forever$1, st as isGreaterThan, su as dual, t as Any, tc as min, ti as runPromiseWith, tl as flatMap$2, tn as InvalidValue$1, to as succeed$3, tr as flatMap, ts as fiberInterrupt, tt as encodeUnknownEffect, tu as compose, u as ErrorClass, ua as Class$1, uc as allocate, ui as succeedNone, ul as map$5, un as formatIso, uo as void_$3, ur as forkIn, us as forever, ut as isLessThanOrEqualTo, uu as pipe$1, v as NonEmptyString, va as effectDiscard, vc as isArrayNonEmpty, vi as timeout$1, vn as Transaction$1, vo as done$1, vr as isEffect, w as String$1, wa as provide$1, wi as txRetry, wn as annotateCurrentSpan, wo as hasInterrupts, wr as logWarning$1, wt as suspend$2, x as Number$1, xa as launch$1, xi as tryPromise, xl as YieldableProto, xn as addFinalizer$2, xr as logError, xs as scope, xt as mutable, y as Null, ya as empty$4, yc as isReadonlyArrayNonEmpty, yi as timeoutOption, yn as acquireRelease, yo as fail$4, yr as log$4, yt as make$35, z as Void, za as CurrentLogAnnotations, zc as isSuccess$1, zi as zipWith, zn as catchTags, zr as option, zs as externalSpan, zt as empty$2 } from "./Schema-Ay3DUM83.mjs";
+import { $ as encodeEffect, $a as make$38, $i as spaced, $n as filterMapOrFail, $r as runPromise, $s as max, $t as stringifyJson, Aa as Scope$1, Ai as void_$1, An as cached$3, Ar as match$1, As as uninterruptibleMask, At as withConstructorDefault, Ba as CurrentLogSpans, Bi as counter, Bn as catch_, Bo as addFinalizer, Br as orDie, Bs as make$41, Bt as head, C as Record, Ca as mergeAll, Cc as map$4, Ci as tx$1, Cn as andThen, Co as hasDies, Cr as logInfo, Cs as sleep$3, Ct as optionalKey, D as TaggedStruct, Da as succeedContext, Di as uninterruptibleMask$1, Dn as as$3, Do as interruptors, Ds as suspend, Dt as toCodecStringTree, E as TaggedErrorClass, Ea as succeed$2, Ec as sort, Ei as uninterruptible, En as annotateSpans, Eo as interrupt$2, Er as map$3, Et as toCodecJson, F as UndefinedOr, Fa as forkUnsafe, Fc as fail$1, Fi as withParentSpan, Fn as catchFilter, Fr as onError$1, Fs as MinimumTraceLevel, G as decodeExit, Ga as done, Gc as empty$1, Gi as withAttributes, Gl as hasProperty, Gn as die$1, Gr as provideService, Gs as format$1, Gt as Transformation, H as declare, Hc as Reference$1, Hi as snapshotUnsafe, Hn as contextWith, Ho as as$2, Hr as promise, Ht as size$2, I as Union, Ia as make$36, Ii as withSpan, In as catchIf, Io as ConsoleRef, Ir as onExit, Is as NativeSpan, It as assign, J as decodeUnknownEffect, Ja as failCause$3, Ji as exponential, Jl as isNotUndefined, Jn as exit, Jr as repeat, Js as hours, Jt as transformOrFail, K as decodeSync, Kc as get$3, Ki as addDelay, Kl as isNotNull, Ko as consolePretty$1, Kr as race, Ks as fromInput, L as Unknown, La as makeUnsafe$4, Li as withTracerEnabled, Ln as catchReason, Lo as CurrentLoggers$1, Ls as ParentSpan, Lt as append$1, M as URLFromString, Ma as addFinalizerExit, Mi as whileLoop, Ml as NodeInspectSymbol, Mn as callback, Mo as pretty, Ms as void_$2, Na as close, Ni as withFiber$1, Nl as toJson, Nn as catchCause, No as prettyErrors, Nr as matchEffect, O as TemplateLiteral, Oa as sync$2, Ol as isEffect$1, On as asSome, Or as mapError, Os as sync, Ot as toJsonSchemaDocument, P as Undefined, Pa as closeUnsafe, Pl as format, Pn as catchDefect, Po as squash, Pr as never$1, Q as encode$4, Qc as merge$2, Qi as recurs, Qn as filter$1, Qr as runForkWith, R as UnknownFromJsonString$1, Ra as provide$2, Rc as isFailure$1, Ri as yieldNow, Rl as equals, Rn as catchTag, Rr as onInterrupt, Rs as Tracer, Rt as drop$1, S as Option, Sa as merge$3, Si as try_, Sn as all, Sr as logFatal, Ss as scopeAddFinalizerExit, St as optional$4, T as Struct, Ta as provideMerge, Tc as reverse, Ti as undefined_, Tn as annotateLogs, To as hasInterruptsOnly, Tr as makeSpanScoped, Tt as tag, Ua as TracerTimingEnabled, Uc as Service$1, Ui as timer, Un as currentSpan, Ur as provide, Ut as toArray, V as brand, Va as MinimumLogLevel, Vc as succeed$1, Vi as gauge, Vn as context, Vo as andThen$1, Vr as orElseSucceed, Vt as isEmpty$2, W as decodeEffect, Wa as _await, Wc as add$2, Wi as update$3, Wl as compose$1, Wr as provideContext, Ws as days, X as decodeUnknownOption, Xc as make$34, Xl as isObject$1, Xn as failCause$1, Xr as retry, Xt as onSome, Y as decodeUnknownExit, Yc as getUnsafe$1, Yi as forever$2, Yl as isNullish, Yn as fail, Yr as result, Z as decodeUnknownSync, Za as isDeferred, Zc as makeUnsafe$3, Zi as passthrough$1, Zl as isTagged, Zr as runFork, Zs as isGreaterThan$1, Zt as parseJson$1, _ as NonEmptyArray, _a as effectContext, _i as tapErrorTag, _n as toUtc, _t as isSchemaError, a as DateTimeUtc, aa as Random$1, ac as sum$1, al as getOrElse, an as value, ao as interrupt$3, ar as fnUntraced, at as isBetween, au as constVoid, b as NullOr, bi as timeoutOrElse, bl as PipeInspectableProto, bn as acquireUseRelease, br as logDebug, bs as reportCauseUnsafe, bt as makeFilter, c as Defect, ca as Clock, cc as toSeconds, ci as sleep$4, cl as isNone, cn as add$3, co as match$2, cr as forkChild, cs as flatMap$1, ct as isGreaterThanOrEqualTo, d as Exit, dc as empty$3, di as succeedSome, dl as match, dn as isGreaterThanOrEqualTo$1, dr as forkScoped, ds as forkDetach, dt as isMaxLength, du as pipeArguments, ea as catchDone, ec as millis, el as firstSomeOf, er as filterOrFail, et as encodeSync, eu as cast, fa as TaggedError, fc as ensure, fi as suspend$1, fl as none$4, fn as make$37, fr as gen, ft as isMaxProperties, g as Never, ga as effect, gi as tapError, gn as toEpochMillis, gr as interruptible, gt as isSchema, h as Literals, ha as buildWithMemoMap, hc as fromIterable, hi as tapCause, hl as make$40, hn as toDate, hr as interrupt$1, ht as isPattern, i as Class, ic as subtract, ii as scoped, il as fromUndefinedOr, in as make$39, io as failCause$2, ir as fn$1, it as is$1, iu as constUndefined, ja as addFinalizer$1, jn as cachedWithTTL, jo as map$6, jr as matchCauseEffect, jt as withDecodingDefault, k as Trim, ka as unwrap, ki as useSpan, kl as withFiber, kn as asVoid, ks as tracerLogger$1, kt as toType, l as Duration, la as currentTimeMillis, lc as zero, li as succeed, ll as isSome, ln as distance, lr as forkDetach$1, ls as fnUntraced$1, lt as isInt, lu as identity, m as Literal, ma as build, mc as flatMapNullishOr, mi as tap, ml as Number$2, mn as now, mo as StackTrace, mr as ignoreCause, ms as loggerMake, mt as isNonEmpty, n as ArraySchema, nc as minutes, nl as flatten$1, no as die$2, nt as encodeUnknownExit, o as DateTimeUtcFromString, oa as clamp, oc as times, oi as service, ol as getOrNull, oo as isFailure, or as forEach, ot as isFinite$1, ou as constant, p as Int$1, pa as CurrentMemoMap, pc as filter, pi as sync$1, pl as some, pn as makeUnsafe$5, po as NoSuchElementError, pr as ignore, pt as isMinLength, q as decodeTo, qa as fail$3, qi as both, ql as isNotNullish, qn as ensuring, qr as raceFirst, qs as fromInputUnsafe, r as Boolean$1, ra as isDoneCause, rc as seconds, ri as scope$1, rl as fromNullishOr, rn as makeFormatterDefault, ro as fail$2, rr as flatten$2, rt as fromJsonString, ru as constTrue, sa as parse$6, sc as toMillis, si as serviceOption, sl as getOrUndefined, sn as encodeBase64Url$3, so as isSuccess, sr as forever$1, st as isGreaterThan, su as dual, t as Any, tc as min, ti as runPromiseWith, tl as flatMap$2, tn as InvalidValue$1, to as succeed$3, tr as flatMap, ts as fiberInterrupt, tt as encodeUnknownEffect, tu as compose, u as ErrorClass, ua as Class$1, uc as allocate, ui as succeedNone, ul as map$5, un as formatIso, uo as void_$3, ur as forkIn, us as forever, ut as isLessThanOrEqualTo, uu as pipe$1, v as NonEmptyString, va as effectDiscard, vc as isArrayNonEmpty, vi as timeout$1, vn as Transaction$1, vo as done$1, vr as isEffect, w as String$1, wa as provide$1, wi as txRetry, wn as annotateCurrentSpan, wo as hasInterrupts, wr as logWarning$1, wt as suspend$2, x as Number$1, xa as launch$1, xi as tryPromise, xl as YieldableProto, xn as addFinalizer$2, xr as logError, xs as scope, xt as mutable, y as Null, ya as empty$4, yc as isReadonlyArrayNonEmpty, yi as timeoutOption, yn as acquireRelease, yo as fail$4, yr as log$4, yt as make$35, z as Void, za as CurrentLogAnnotations, zc as isSuccess$1, zi as zipWith, zn as catchTags, zr as option, zs as externalSpan, zt as empty$2 } from "./Schema-Ay3DUM83.mjs";
 import { $t as interrupt$4, A as fromSubscription, At as end, B as onExit$1, Bt as sliding, C as fromChannel, Ct as fromSubscriptionArray, D as fromPull, Dt as make$43, E as fromPubSub, F as mapEffect$1, Ft as offer$1, G as runCollect, Gt as shutdown$2, Ht as takeAll, I as mapError$1, It as offerAll, J as runForEach, K as runDrain, Kt as subscribe$1, L as merge$4, Lt as offerUnsafe, M as make$42, Mt as failCause$4, N as map$7, O as fromQueue, Ot as makeUnsafe$6, P as mapAccum, Pt as make$44, Q as succeed$4, Qt as getCurrent, S as fromAsyncIterable, T as fromIterable$1, U as provideContext$1, Ut as unbounded$2, Vt as take$1, W as run$2, Wt as publish, X as runHead, Xt as makeUnsafe$7, Y as runForEachArray, Zt as await_, _t as drain, b as flatMap$3, c as callback$1, ct as get$4, d as debounce$1, dt as make$46, et as takeWhile, f as decodeText$1, g as ensuring$1, h as encodeText, j as isStream, kt as bounded, l as catchCause$1, lt as make$45, m as empty$5, nt as toAsyncIterable, q as runFold, qt as unbounded$1, r as FileSystem, rt as toPull, st as unwrap$1, t as Path$2, tn as runIn, tt as tick, u as concat$2, ut as get$5, v as failCause$5, vt as forEach$1, w as fromEffect, wt as fromTransform, x as fromArray, xt as mapInput, y as filter$2, zt as shutdown$1 } from "./Path-BIaGSU2M.mjs";
 import { _ as ChildProcessSpawner, a as Stdio, g as make$47, o as make$48, r as isQuitError } from "./NodeTerminal-CeaWke6-.mjs";
 import { n as layer$7 } from "./NodeServices-Bt1GwPBR.mjs";
@@ -19,11 +19,11 @@ import * as HE from "node:child_process";
 import { execFile, execFileSync, spawn, spawnSync } from "node:child_process";
 import { Readable } from "node:stream";
 import * as Crypto from "node:crypto";
-import { createCipheriv, createDecipheriv, createHash, createHmac, createPublicKey, randomBytes, randomUUID, timingSafeEqual, verify } from "node:crypto";
+import { createCipheriv, createDecipheriv, createHash, createHmac, createPublicKey, generateKeyPairSync, randomBytes, randomUUID, sign, timingSafeEqual, verify } from "node:crypto";
 import * as FS$1 from "node:fs";
 import fs, { accessSync, chmodSync, constants, createReadStream, existsSync, mkdirSync, mkdtempSync, promises, readFile, readFileSync, readdir, readdirSync, realpathSync, rmSync, statSync, unlinkSync, writeFileSync } from "node:fs";
 import * as NodeOS from "node:os";
-import $U, { homedir, networkInterfaces, tmpdir } from "node:os";
+import os, { homedir, networkInterfaces, tmpdir } from "node:os";
 import * as Path$1 from "node:path";
 import path, { basename, delimiter, dirname, extname, isAbsolute, join, posix, relative, resolve, sep } from "node:path";
 import { pathToFileURL } from "node:url";
@@ -30476,7 +30476,7 @@ function frameClassByte(frameClass) {
 	if (frameClass === "application") return Uint8Array.of(1);
 	return Uint8Array.of(2);
 }
-function encodeBase64Url$1(value) {
+function encodeBase64Url$2(value) {
 	let output = "";
 	for (let index = 0; index < value.byteLength; index += 3) {
 		const first = value[index] ?? 0;
@@ -30506,7 +30506,7 @@ function decodeBase64Url$1(value) {
 			outputIndex += 1;
 		}
 	}
-	if (encodeBase64Url$1(output) !== value) throw new RelayPayloadChannelFailure("channel_authentication_failed", "Encrypted relay frame has a non-canonical base64url encoding.");
+	if (encodeBase64Url$2(output) !== value) throw new RelayPayloadChannelFailure("channel_authentication_failed", "Encrypted relay frame has a non-canonical base64url encoding.");
 	return output;
 }
 function isLowOrderX25519PublicKey(value) {
@@ -30545,7 +30545,7 @@ async function createRelayPayloadBinding(input, digestProvider = defaultDigestPr
 	};
 }
 function relayPayloadTicketDigestBase64Url(binding) {
-	return encodeBase64Url$1(binding.ticketDigest);
+	return encodeBase64Url$2(binding.ticketDigest);
 }
 function relayPayloadInfo(binding) {
 	return concat([
@@ -30582,7 +30582,7 @@ async function generateRelayEndpointKeyPair(randomSource = defaultRandomSource)
 }
 async function serializeRelayEndpointPublicKey(publicKey) {
 	try {
-		return encodeBase64Url$1(bytes(await suite.kem.serializePublicKey(publicKey)));
+		return encodeBase64Url$2(bytes(await suite.kem.serializePublicKey(publicKey)));
 	} catch (error) {
 		throw new RelayPayloadChannelFailure("endpoint_key_invalid", error instanceof Error ? error.message : "Endpoint public-key serialization failed.");
 	}
@@ -30637,7 +30637,7 @@ var HpkeRelayPayloadSender = class {
 	constructor(binding, context) {
 		this.binding = binding;
 		this.context = context;
-		this.encapsulatedKey = encodeBase64Url$1(bytes(context.enc));
+		this.encapsulatedKey = encodeBase64Url$2(bytes(context.enc));
 	}
 	seal(input) {
 		return this.queue.run(async () => {
@@ -30667,7 +30667,7 @@ var HpkeRelayPayloadSender = class {
 				direction: this.binding.direction,
 				frameClass: input.frameClass,
 				sequence,
-				ciphertext: encodeBase64Url$1(ciphertext)
+				ciphertext: encodeBase64Url$2(ciphertext)
 			};
 		});
 	}
@@ -50658,7 +50658,7 @@ function _supportsColor(haveStream, { streamIsTTY, sniffFlags = true } = {}) {
 	const min = forceColor || 0;
 	if (env.TERM === "dumb") return min;
 	if (process$1.platform === "win32") {
-		const osRelease = $U.release().split(".");
+		const osRelease = os.release().split(".");
 		if (Number(osRelease[0]) >= 10 && Number(osRelease[2]) >= 10586) return Number(osRelease[2]) >= 14931 ? 3 : 2;
 		return 1;
 	}
@@ -53101,7 +53101,7 @@ var require_ProcessDetector = /* @__PURE__ */ __commonJSMin(((exports) => {
 	exports.processDetector = void 0;
 	const api_1 = (init_esm$1(), __toCommonJS(esm_exports$1));
 	const semconv_1 = require_semconv$1();
-	const os$3 = __require("os");
+	const os$4 = __require("os");
 	/**
 	* ProcessDetector will be used to detect the resources related current process running
 	* and being instrumented from the NodeJS Process module.
@@ -53123,7 +53123,7 @@ var require_ProcessDetector = /* @__PURE__ */ __commonJSMin(((exports) => {
 			};
 			if (process.argv.length > 1) attributes[semconv_1.ATTR_PROCESS_COMMAND] = process.argv[1];
 			try {
-				const userInfo = os$3.userInfo();
+				const userInfo = os$4.userInfo();
 				attributes[semconv_1.ATTR_PROCESS_OWNER] = userInfo.username;
 			} catch (e) {
 				api_1.diag.debug(`error obtaining process owner: ${e}`);
@@ -66046,7 +66046,7 @@ function normalizeNumberish(value) {
 }
 //#endregion
 //#region package.json
-var version$1 = "0.13.124";
+var version$1 = "0.13.125";
 //#endregion
 //#region src/sentry.ts
 const SERVER_APP_NAME = "forge-server";
@@ -71098,6 +71098,19 @@ function mintCmmdShortLivedToken(grantToken) {
 	});
 }
 /**
+* The redemption request body. `popPublicKeyPem` is the server's PoP identity
+* (forge#3534): presented when bound sessions are enabled so CMMD stamps the
+* returned JWT with this server's key (`cnf.jkt`), omitted otherwise.
+*/
+function buildSessionGrantRedemptionBody(grantToken, popPublicKeyPem) {
+	return {
+		grant_type: "forge_session_grant",
+		grant_token: grantToken,
+		client_id: "cmmd-forge-web",
+		...popPublicKeyPem ? { pop_public_key: popPublicKeyPem } : {}
+	};
+}
+/**
 * Redeem a durable CMMD session grant for a fresh credential set.
 *
 * The grant is CMMD's designed recovery path for exactly the case a rotating
@@ -71109,15 +71122,11 @@ function mintCmmdShortLivedToken(grantToken) {
 * Returns the new MCP PAT alongside the JWT/refresh pair, because CMMD mints a
 * fresh PAT on redemption and the old one is not carried over.
 */
-function redeemCmmdSessionGrant(grantToken) {
+function redeemCmmdSessionGrant(grantToken, popPublicKeyPem) {
 	return fetch(new URL("/api/mcp-server/oauth/token", resolveCommandAppUrl()).toString(), {
 		method: "POST",
 		headers: { "Content-Type": "application/json" },
-		body: JSON.stringify({
-			grant_type: "forge_session_grant",
-			grant_token: grantToken,
-			client_id: "cmmd-forge-web"
-		})
+		body: JSON.stringify(buildSessionGrantRedemptionBody(grantToken, popPublicKeyPem))
 	}).then(async (response) => {
 		if (!response.ok) return null;
 		const payload = await response.json();
@@ -71188,6 +71197,140 @@ async function readOAuthErrorCode(response) {
 	}
 }
 //#endregion
+//#region ../../packages/shared/src/cmmdSessionPop.ts
+/**
+* CMMD session proof-of-possession client protocol (forge#3517).
+*
+* A CMMD session issued to a Forge client can be bound to the client's Ed25519
+* device key: the public key travels with the login (`pop_public_key`), CMMD
+* stamps its thumbprint into the token (`cnf.jkt`), and every authenticated
+* request must then carry a detached Ed25519 signature over a canonical
+* request binding (method + path + timestamp + nonce). A stolen bearer token
+* alone is unusable.
+*
+* This module is the client half of the scheme CMMD verifies in
+* `server/services/auth/session-pop-binding.ts`. The protocol deliberately
+* reuses CMMD's existing crypto shapes rather than inventing a new scheme: the
+* thumbprint is the same sha256-over-SPKI-DER base64url digest as the forge
+* device registry and the desktop relay identity, and the signature covers
+* `<purpose>.<base64url payload>`, the forge relay challenge shape, with
+* Ed25519. It is not a DPoP port: proofs are plain headers, not JWTs.
+*/
+const HEADER_KEY = "x-cmmd-pop-key";
+const HEADER_INPUT = "x-cmmd-pop-input";
+const HEADER_SIGNATURE = "x-cmmd-pop-signature";
+const CMMD_SESSION_POP_PURPOSE = "cmmd-session-pop-v1";
+function encodeBase64Url$1(bytes) {
+	let binary = "";
+	for (const byte of bytes) binary += String.fromCharCode(byte);
+	return btoa(binary).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/u, "");
+}
+function buildCmmdSessionPopSigningInput(payload) {
+	return `${CMMD_SESSION_POP_PURPOSE}.${encodeBase64Url$1(new TextEncoder().encode(JSON.stringify(payload)))}`;
+}
+function randomNonce() {
+	const bytes = new Uint8Array(16);
+	crypto.getRandomValues(bytes);
+	return encodeBase64Url$1(bytes);
+}
+/**
+* Build the three proof headers for one request. Each call produces a fresh
+* nonce; callers must not reuse the returned headers across attempts
+* (retries included), because CMMD rejects replayed nonces.
+*/
+async function buildCmmdSessionPopProofHeaders(input) {
+	const payload = {
+		version: 1,
+		htm: input.method.toUpperCase(),
+		htu: input.path,
+		ts: input.nowSeconds ?? Math.floor(Date.now() / 1e3),
+		nonce: input.nonce ?? randomNonce()
+	};
+	const signingInput = buildCmmdSessionPopSigningInput(payload);
+	const signature = await input.signer.sign(signingInput);
+	const spkiDer = decodePemSpkiDer(input.signer.publicKeyPem);
+	return {
+		[HEADER_KEY]: encodeBase64Url$1(spkiDer),
+		[HEADER_INPUT]: encodeBase64Url$1(new TextEncoder().encode(JSON.stringify(payload))),
+		[HEADER_SIGNATURE]: encodeBase64Url$1(signature)
+	};
+}
+function decodePemSpkiDer(pem) {
+	const base64 = pem.replace("-----BEGIN PUBLIC KEY-----", "").replace("-----END PUBLIC KEY-----", "").replace(/\s+/gu, "").replace(/-/g, "+").replace(/_/g, "/");
+	const padded = base64 + "=".repeat((4 - base64.length % 4) % 4);
+	const binary = atob(padded);
+	const bytes = new Uint8Array(binary.length);
+	for (let index = 0; index < binary.length; index += 1) bytes[index] = binary.charCodeAt(index);
+	return bytes;
+}
+//#endregion
+//#region src/cmmd/cmmdSessionPopServer.ts
+/**
+* The Forge server's own CMMD session proof-of-possession identity (forge#3534,
+* D3): the server holds an Ed25519 key, presents its SPKI PEM as
+* `pop_public_key` when it redeems a CMMD session grant, and signs every
+* CMMD-origin REST call it makes with detached proofs, so a stolen bearer JWT
+* alone is unusable. CMMD verifies the scheme in
+* `server/services/auth/session-pop-binding.ts`.
+*
+* Rollout order (docs/forge-cmmd-auth-lanes.md): CMMD deploys first; Forge
+* flips `FORGE_CMMD_SESSION_POP_ENABLED` afterwards; CMMD's
+* `JWT_REQUIRE_BOUND_SESSIONS=true` is the contract phase. While the flag is
+* off this module produces no keys and no headers, and CMMD treats tokens as
+* plain bearers.
+*
+* The identity lives in memory for the process lifetime. After a restart the
+* server mints a new identity; CMMD then refuses proofs from the old one, and
+* the JWT resolver's recovery ladder re-mints the affected credentials. The
+* persistence duty (a stable identity across restarts) lands with the flag
+* rollout, not with this plumbing.
+*/
+const ENABLED_FLAG = "FORGE_CMMD_SESSION_POP_ENABLED";
+/** Enables session proofs only when the rollout flag is exactly "true". */
+function isCmmdSessionPopEnabled() {
+	return process.env[ENABLED_FLAG] === "true";
+}
+let cachedSigner = null;
+/** Creates an in-memory Ed25519 identity with a public SPKI PEM and a detached signer. */
+function createServerSigner() {
+	const { publicKey, privateKey } = generateKeyPairSync("ed25519");
+	const exported = publicKey.export({
+		type: "spki",
+		format: "pem"
+	});
+	return {
+		publicKeyPem: typeof exported === "string" ? exported : exported.toString("utf8"),
+		sign: async (signingInput) => new Uint8Array(sign(null, Buffer.from(signingInput, "utf8"), privateKey))
+	};
+}
+/**
+* The server's PoP identity, created on first use under the flag and stable
+* for the process lifetime. Null while the flag is off.
+*/
+function resolveCmmdSessionPopSigner() {
+	if (!isCmmdSessionPopEnabled()) return null;
+	cachedSigner ??= createServerSigner();
+	return cachedSigner;
+}
+/** The `pop_public_key` value to present at issuance, or null while disabled. */
+function cmmdSessionPopPublicKey() {
+	return resolveCmmdSessionPopSigner()?.publicKeyPem ?? null;
+}
+/**
+* The three proof headers for one CMMD-origin request, or no headers while
+* disabled. Each call carries a fresh nonce; never reuse the result across
+* attempts, because CMMD rejects replayed nonces.
+*/
+async function cmmdSessionPopRequestHeaders(input) {
+	const signer = resolveCmmdSessionPopSigner();
+	if (!signer) return {};
+	return buildCmmdSessionPopProofHeaders({
+		signer,
+		method: input.method,
+		path: input.path
+	});
+}
+//#endregion
 //#region src/command/cmmdTokenMintLane.ts
 /**
 * The CMMD token-mint lane (forge#3518, expand phase).
@@ -71440,7 +71583,7 @@ function tryGrantRedemption(sessionId, context) {
 	return gen(function* () {
 		yield* logCmmdJwtRung(context, "grant-redemption", "attempted", "redeeming this session's durable CMMD session grant");
 		yield* recordCmmdCredentialRefreshMetric("grant-redemption", "attempted");
-		const redeemed = yield* promise(() => redeemCmmdSessionGrant(grantToken)).pipe(orElseSucceed(() => null));
+		const redeemed = yield* promise(() => redeemCmmdSessionGrant(grantToken, cmmdSessionPopPublicKey())).pipe(orElseSucceed(() => null));
 		const accessToken = usableCmmdUserJwt(redeemed?.accessToken);
 		if (!accessToken) {
 			yield* logCmmdJwtRung(context, "grant-redemption", "failed", "session grant redemption did not return a usable user access JWT");
@@ -71729,11 +71872,25 @@ async function requireCmmdProxySuccess(response, signal) {
 * Uses the stored JWT (set after OAuth auth-code flow with post-update CMMD)
 * to make authenticated REST calls on behalf of the user. A missing delegated
 * JWT is an authentication-required state, not a CMMD availability failure.
+*
+* Every request this module sends can carry the server's session
+* proof-of-possession headers (forge#3534): while
+* `FORGE_CMMD_SESSION_POP_ENABLED` is true, `authHeaders` attaches detached
+* Ed25519 proofs over each request's method and path, which CMMD requires for
+* tokens bound with `cnf.jkt` and ignores otherwise. Each call gets a fresh
+* nonce, so retries re-sign rather than replay.
 */
-function authHeaders(jwt, orgId) {
+/** Builds owner JWT and optional organization headers with fresh, flag-gated session proofs. */
+async function authHeaders(jwt, orgId, method, path) {
 	const headers = { Authorization: `Bearer ${jwt}` };
 	if (orgId) headers["X-Organization-ID"] = orgId;
-	return headers;
+	return {
+		...headers,
+		...await cmmdSessionPopRequestHeaders({
+			method,
+			path
+		})
+	};
 }
 async function fetchResponse(url, init, options) {
 	try {
@@ -71745,18 +71902,20 @@ async function fetchResponse(url, init, options) {
 		rethrowCmmdProxyTimeout(error, options?.signal);
 	}
 }
+/** Fetches a CMMD JSON resource with optional query parameters and caller cancellation. */
 async function proxyGet(jwt, path, searchParams, orgId, options) {
 	const cmmdBase = resolveCommandAppUrl();
 	const url = new URL(path, cmmdBase);
 	if (searchParams) for (const [k, v] of Object.entries(searchParams)) url.searchParams.set(k, v);
-	return handleCmmdProxyResponse(await fetchResponse(url.toString(), { headers: authHeaders(jwt, orgId) }, options), options?.signal);
+	return handleCmmdProxyResponse(await fetchResponse(url.toString(), { headers: await authHeaders(jwt, orgId, "GET", path) }, options), options?.signal);
 }
+/** Posts JSON to CMMD on the owner JWT lane and decodes the response or upstream error. */
 async function proxyPost(jwt, path, body, orgId, options) {
 	const cmmdBase = resolveCommandAppUrl();
 	return handleCmmdProxyResponse(await fetchResponse(new URL(path, cmmdBase).toString(), {
 		method: "POST",
 		headers: {
-			...authHeaders(jwt, orgId),
+			...await authHeaders(jwt, orgId, "POST", path),
 			"Content-Type": "application/json"
 		},
 		body: JSON.stringify(body)
@@ -71770,44 +71929,49 @@ async function responseWithMetadata(response, signal) {
 		retryAfter: response.headers.get("retry-after")
 	};
 }
+/** Fetches a CMMD resource while preserving status, Location, and Retry-After metadata. */
 async function proxyGetWithMetadata(jwt, path, orgId, options) {
-	return responseWithMetadata(await fetchResponse(new URL(path, resolveCommandAppUrl()).toString(), { headers: authHeaders(jwt, orgId) }, options), options?.signal);
+	return responseWithMetadata(await fetchResponse(new URL(path, resolveCommandAppUrl()).toString(), { headers: await authHeaders(jwt, orgId, "GET", path) }, options), options?.signal);
 }
+/** Posts JSON to CMMD while preserving status, Location, and Retry-After metadata. */
 async function proxyPostWithMetadata(jwt, path, body, orgId, options) {
 	const cmmdBase = resolveCommandAppUrl();
 	return responseWithMetadata(await fetchResponse(new URL(path, cmmdBase).toString(), {
 		method: "POST",
 		headers: {
-			...authHeaders(jwt, orgId),
+			...await authHeaders(jwt, orgId, "POST", path),
 			"Content-Type": "application/json"
 		},
 		body: JSON.stringify(body)
 	}, options), options?.signal);
 }
+/** Applies a JSON patch request to CMMD using the owner JWT and optional organization. */
 async function proxyPatch(jwt, path, body, orgId) {
 	const cmmdBase = resolveCommandAppUrl();
 	const url = new URL(path, cmmdBase);
 	return handleCmmdProxyResponse(await fetch(url.toString(), {
 		method: "PATCH",
 		headers: {
-			...authHeaders(jwt, orgId),
+			...await authHeaders(jwt, orgId, "PATCH", path),
 			"Content-Type": "application/json"
 		},
 		body: JSON.stringify(body)
 	}));
 }
+/** Sends a JSON replacement request to CMMD and decodes its response or upstream error. */
 async function proxyPut(jwt, path, body, orgId) {
 	const cmmdBase = resolveCommandAppUrl();
 	const url = new URL(path, cmmdBase);
 	return handleCmmdProxyResponse(await fetch(url.toString(), {
 		method: "PUT",
 		headers: {
-			...authHeaders(jwt, orgId),
+			...await authHeaders(jwt, orgId, "PUT", path),
 			"Content-Type": "application/json"
 		},
 		body: JSON.stringify(body)
 	}));
 }
+/** Deletes a CMMD resource with optional query parameters and JSON body; 204 returns undefined. */
 async function proxyDelete(jwt, path, searchParams, orgId, body) {
 	const cmmdBase = resolveCommandAppUrl();
 	const url = new URL(path, cmmdBase);
@@ -71815,7 +71979,7 @@ async function proxyDelete(jwt, path, searchParams, orgId, body) {
 	const response = await fetch(url.toString(), {
 		method: "DELETE",
 		headers: {
-			...authHeaders(jwt, orgId),
+			...await authHeaders(jwt, orgId, "DELETE", path),
 			...body === void 0 ? {} : { "Content-Type": "application/json" }
 		},
 		...body === void 0 ? {} : { body: JSON.stringify(body) }
@@ -71823,13 +71987,14 @@ async function proxyDelete(jwt, path, searchParams, orgId, body) {
 	if (!response.ok && response.status !== 204) await requireCmmdProxySuccess(response);
 	return response.status === 204 ? void 0 : handleCmmdProxyResponse(response);
 }
+/** Forwards multipart bytes to CMMD, preserving the caller's content type and boundary. */
 async function proxyMultipart(jwt, path, body, contentType, orgId) {
 	const cmmdBase = resolveCommandAppUrl();
 	const url = new URL(path, cmmdBase);
 	return handleCmmdProxyResponse(await fetch(url.toString(), {
 		method: "POST",
 		headers: {
-			...authHeaders(jwt, orgId),
+			...await authHeaders(jwt, orgId, "POST", path),
 			"Content-Type": contentType
 		},
 		body
@@ -76116,7 +76281,7 @@ var require_node_gyp_build = /* @__PURE__ */ __commonJSMin(((exports, module) =>
 	var fs$6 = __require("fs");
 	var path$5 = __require("path");
 	var url$1 = __require("url");
-	var os$2 = __require("os");
+	var os$3 = __require("os");
 	var runtimeRequire = typeof __webpack_require__ === "function" ? __non_webpack_require__ : __require;
 	var vars = process.config && process.config.variables || {};
 	var prebuildsOnly = !!process.env.PREBUILDS_ONLY;
@@ -76124,8 +76289,8 @@ var require_node_gyp_build = /* @__PURE__ */ __commonJSMin(((exports, module) =>
 	var abi = versions.modules;
 	if (versions.deno || process.isBun) abi = "unsupported";
 	var runtime = isElectron() ? "electron" : isNwjs() ? "node-webkit" : "node";
-	var arch = process.env.npm_config_arch || os$2.arch();
-	var platform = process.env.npm_config_platform || os$2.platform();
+	var arch = process.env.npm_config_arch || os$3.arch();
+	var platform = process.env.npm_config_platform || os$3.platform();
 	var libc = process.env.LIBC || (isMusl(platform) ? "musl" : "glibc");
 	var armv = process.env.ARM_VERSION || (arch === "arm64" ? "8" : vars.arm_version) || "";
 	var uv = (versions.uv || "").split(".")[0];
@@ -93969,7 +94134,7 @@ const launchDetached = (launch) => gen(function* () {
 });
 const OpenLive = effect(Open, gen(function* () {
 	const open = yield* tryPromise({
-		try: () => import("./open-2-reBrpv.mjs"),
+		try: () => import("./open-yHTUkd2Y.mjs"),
 		catch: (cause) => new OpenError$1({
 			message: "failed to load browser opener",
 			cause
@@ -192255,7 +192420,7 @@ var Vce = {
 function Ve() {
 	return Vce;
 }
-var Us = $U.homedir(), lk = $U.tmpdir(), { env: Vc } = process$1, Yce = (e) => {
+var Us = os.homedir(), lk = os.tmpdir(), { env: Vc } = process$1, Yce = (e) => {
 	let t = path.join(Us, "Library");
 	return {
 		data: path.join(t, "Application Support", e),
@@ -202455,12 +202620,12 @@ function qZ(e, t) {
 	}
 	return n;
 }
-var os$1 = "https://code.claude.com/docs/en", kKe = [
+var os$2 = "https://code.claude.com/docs/en", kKe = [
 	{
 		matches: (e) => e.path === "permissions.defaultMode" && e.code === "invalid_value",
 		tip: {
 			suggestion: "Valid modes: \"acceptEdits\" (ask before file changes), \"plan\" (analysis only), \"bypassPermissions\" (auto-accept all), or \"default\" (standard behavior)",
-			docLink: `${os$1}/iam#permission-modes`
+			docLink: `${os$2}/iam#permission-modes`
 		}
 	},
 	{
@@ -202475,7 +202640,7 @@ var os$1 = "https://code.claude.com/docs/en", kKe = [
 		matches: (e) => e.path.startsWith("env.") && e.code === "invalid_type",
 		tip: {
 			suggestion: "Environment variables must be strings. Wrap numbers and booleans in quotes. Example: \"DEBUG\": \"true\", \"PORT\": \"3000\"",
-			docLink: `${os$1}/settings#environment-variables`
+			docLink: `${os$2}/settings#environment-variables`
 		}
 	},
 	{
@@ -202486,14 +202651,14 @@ var os$1 = "https://code.claude.com/docs/en", kKe = [
 		matches: (e) => e.path.startsWith("hooks.") && e.code === "invalid_key",
 		tip: {
 			suggestion: "Not a recognized hook event. Common events: PreToolUse, PostToolUse, UserPromptSubmit, SessionStart, SessionEnd, Stop. Check spelling and capitalization.",
-			docLink: `${os$1}/hooks`
+			docLink: `${os$2}/hooks`
 		}
 	},
 	{
 		matches: (e) => /\.hooks\.\d+\.command$/.test(e.path) && e.code === "invalid_type" && e.received === "undefined",
 		tip: {
 			suggestion: "Command hooks require `command`. For exec form (no shell), set `command` to the executable and `args` to its arguments: {\"type\": \"command\", \"command\": \"echo\", \"args\": [\"hi\"]}. For shell form, set `command` to the full shell string: {\"type\": \"command\", \"command\": \"echo hi\"}.",
-			docLink: `${os$1}/hooks#exec-form-and-shell-form`
+			docLink: `${os$2}/hooks#exec-form-and-shell-form`
 		}
 	},
 	{
@@ -202508,7 +202673,7 @@ var os$1 = "https://code.claude.com/docs/en", kKe = [
 		matches: (e) => e.code === "unrecognized_keys",
 		tip: {
 			suggestion: "Check for typos or refer to the documentation for valid fields",
-			docLink: `${os$1}/settings`
+			docLink: `${os$2}/settings`
 		}
 	},
 	{
@@ -202523,13 +202688,13 @@ var os$1 = "https://code.claude.com/docs/en", kKe = [
 		matches: (e) => e.path === "permissions.additionalDirectories" && e.code === "invalid_type",
 		tip: {
 			suggestion: "Must be an array of directory paths. Example: [\"~/projects\", \"/tmp/workspace\"]. You can also use --add-dir flag or /add-dir command",
-			docLink: `${os$1}/iam#working-directories`
+			docLink: `${os$2}/iam#working-directories`
 		}
 	}
 ], AKe = {
-	permissions: `${os$1}/iam#configuring-permissions`,
-	env: `${os$1}/settings#environment-variables`,
-	hooks: `${os$1}/hooks`
+	permissions: `${os$2}/iam#configuring-permissions`,
+	env: `${os$2}/settings#environment-variables`,
+	hooks: `${os$2}/hooks`
 };
 function GZ(e) {
 	let t = kKe.find((r) => r.matches(e));
@@ -234623,7 +234788,7 @@ function inferCheckpointRefsPrefixFromStored(checkpointRefs) {
 	return checkpointRefs.some((checkpointRef) => String(checkpointRef).startsWith(`refs/t3/checkpoints/`)) ? LEGACY_CHECKPOINT_REFS_PREFIX : CHECKPOINT_REFS_PREFIX;
 }
 function checkpointRefForThreadTurnWithPrefix(threadId, turnCount, prefix) {
-	return CheckpointRef.make(`${prefix}/${encodeBase64Url$2(threadId)}/turn/${turnCount}`);
+	return CheckpointRef.make(`${prefix}/${encodeBase64Url$3(threadId)}/turn/${turnCount}`);
 }
 function resolveThreadWorkspaceCwd(input) {
 	const worktreeCwd = input.thread.worktreePath ?? void 0;
@@ -239110,10 +239275,10 @@ function legacySafeThreadId(threadId) {
 	return threadId.replace(/[^a-zA-Z0-9._-]/g, "_");
 }
 function toSafeThreadId(threadId) {
-	return `terminal_${encodeBase64Url$2(threadId)}`;
+	return `terminal_${encodeBase64Url$3(threadId)}`;
 }
 function toSafeTerminalId(terminalId) {
-	return encodeBase64Url$2(terminalId);
+	return encodeBase64Url$3(terminalId);
 }
 function toSessionKey(threadId, terminalId) {
 	return `${threadId}\u0000${terminalId}`;
@@ -271073,7 +271238,7 @@ var import_multicast_dns = /* @__PURE__ */ __toESM((/* @__PURE__ */ __commonJSMi
 	var dgram = __require("dgram");
 	var thunky = require_thunky();
 	var events = __require("events");
-	var os = __require("os");
+	var os$1 = __require("os");
 	var noop = function() {};
 	module.exports = function(opts) {
 		if (!opts) opts = {};
@@ -271204,14 +271369,14 @@ var import_multicast_dns = /* @__PURE__ */ __toESM((/* @__PURE__ */ __commonJSMi
 		return that;
 	};
 	function defaultInterface() {
-		var networks = os.networkInterfaces();
+		var networks = os$1.networkInterfaces();
 		var names = Object.keys(networks);
 		for (var i = 0; i < names.length; i++) {
 			var net = networks[names[i]];
 			for (var j = 0; j < net.length; j++) {
 				var iface = net[j];
 				if (isIPv4(iface.family) && !iface.internal) {
-					if (os.platform() === "darwin" && names[i] === "en0") return iface.address;
+					if (os$1.platform() === "darwin" && names[i] === "en0") return iface.address;
 					return "0.0.0.0";
 				}
 			}
@@ -271219,7 +271384,7 @@ var import_multicast_dns = /* @__PURE__ */ __toESM((/* @__PURE__ */ __commonJSMi
 		return "127.0.0.1";
 	}
 	function allInterfaces() {
-		var networks = os.networkInterfaces();
+		var networks = os$1.networkInterfaces();
 		var names = Object.keys(networks);
 		var res = [];
 		for (var i = 0; i < names.length; i++) {
@@ -299854,7 +300019,7 @@ function resolveBuildCommitFromEnv(env) {
 * environment descriptor down instead of reporting an honest "unknown".
 */
 function readBakedBuildCommit() {
-	return "52e8c25f0de536143b44ff1ac86510aa93d35772";
+	return "2b217d6b85f7c98cf77e2a23bce2ef8102d3a0a5";
 }
 async function resolveServerBuildCommit(input) {
 	if (isFullCommitSha(input.baked)) return input.baked;
@@ -312710,6 +312875,44 @@ const cmmdUpdateProjectAgentMemberAvatarRouteLayer = registerProxyRoute({
 	responseShape: "unwrapData"
 });
 //#endregion
+//#region src/command/cmmdPushProxyRoutes.ts
+/**
+* The signed-in phone's push registration, forwarded to CMMD's push
+* device-token API on the owner's stored CMMD JWT (forge#3534).
+*
+* CMMD owns push delivery: the `device_push_tokens` table, the Expo transport,
+* and the `mobile_push_v1` delivery flag are all CMMD-side, and its
+* registration API lives at `/api/push`, not under `/api/forge/context`. The
+* mobile push delivery spec (docs/specs/2026-09-09-mobile-push-delivery.md,
+* stage 2) recommends reusing that API over adding a forge-context doorway
+* first: the Forge server already holds the phone's CMMD credential, and the
+* registry prologue here provides the same session auth, CMMD-connection
+* gate, and `CMMD_AUTH_REQUIRED` mapping every `/api/cmmd` route gets. The
+* deny-listed legacy owner control paths are untouched. If review wants a
+* forge-context doorway first, these two routes are the only call sites to
+* repoint.
+*
+* `orgIdSource` is `none` (the organization comes from the JWT, like the
+* settings and device-registry routes): a phone registers against its default
+* organization and has no workspace context to pass.
+*/
+const cmmdRegisterMobilePushDeviceRouteLayer = registerProxyRoute({
+	forgePath: "/api/cmmd/mobile/push/registration",
+	method: "POST",
+	cmmdPath: "/api/push/device-tokens",
+	orgIdSource: "none",
+	responseShape: "unwrapData",
+	successStatus: 201
+});
+const cmmdDeleteMobilePushDeviceRouteLayer = registerProxyRoute({
+	forgePath: "/api/cmmd/mobile/push/registration",
+	method: "DELETE",
+	cmmdPath: "/api/push/device-tokens",
+	orgIdSource: "none",
+	responseShape: "unwrapData",
+	requestBody: "json"
+});
+//#endregion
 //#region src/command/runtimeProviderAuthorityUpgradeModel.ts
 const AUTHORITY_UPGRADE_OPERATION_KEYS = new Set([
 	"operationId",
@@ -324279,7 +324482,7 @@ const MiscRuntimeLayerLive = mergeAll(AnalyticsServiceLayerLive, OpenLive, Serve
 const RuntimeDependenciesWithoutPullRequestsLive = ReactorLayerLive.pipe(provideMerge(CheckpointingLayerLive), provideMerge(GitLayerLive), provideMerge(OrchestrationLayerLive), provideMerge(ProviderLayerLive), provideMerge(TerminalLayerLive), provideMerge(AgentBrowserManagerLive), provideMerge(mergeAll(ThreadDevRuntimeLive, DevTunnelLive.pipe(provide$1(ThreadDevRuntimeLive)))), provideMerge(PersistenceLayerLive), provideMerge(KeybindingsLive), provideMerge(ProviderRegistryLive), provideMerge(mergeAll(ServerSettingsLive, UsageServiceLive.pipe(provide$1(ServerSettingsLive), provide$1(UsageSessionLookupLive), provide$1(UsageRecordedSourceLive.pipe(provide$1(OrchestrationLayerLive), provide$1(RuntimeReplicationOutboxLive), provide$1(ProviderSessionRuntimeRepositoryLive), provide$1(TextGenerationSessionRepositoryLive)))))), provideMerge(WorkspaceLayerLive), provideMerge(WorkspaceReadinessStateLive), provideMerge(ProjectFaviconResolverLive), provideMerge(RepositoryIdentityResolverLive), provideMerge(ServerEnvironmentLive), provideMerge(AuthLayerLive), provideMerge(ServerSecretStoreLayerLive), provideMerge(mergeAll(CloudRedisCoordinationLive, CloudStateSyncLive.pipe(provide$1(PersistenceLayerLive)))), provideMerge(MiscRuntimeLayerLive));
 const RuntimeDependenciesLive = pullRequestServiceFactoryLayer.pipe(provideMerge(RuntimeDependenciesWithoutPullRequestsLive), provideMerge(cmmdProjectIdentityResolverLive.pipe(provide$1(RuntimeDependenciesWithoutPullRequestsLive))), provideMerge(pullRequestProviderRuntimeLive));
 const RuntimeServicesLive = ServerRuntimeStartupLive.pipe(provideMerge(RuntimeDependenciesLive));
-const makeRoutesLayer = mergeAll(attachmentUploadRouteLayer, authBearerBootstrapRouteLayer, authBootstrapRouteLayer, authCommandBearerBootstrapRouteLayer, authCommandBootstrapRouteLayer, authCmmdEmbedExchangeRouteLayer, authOAuthTokenExchangeRouteLayer, authWebSocketTicketRouteLayer, authCmmdOAuthDeviceRouteLayer, authCmmdOAuthTokenRouteLayer, authCmmdPasswordTokenRouteLayer, authClientsRevokeOthersRouteLayer, authClientsRevokeRouteLayer, authClientsRouteLayer, authLogoutRouteLayer, authPairingLinksRevokeRouteLayer, authPairingLinksRouteLayer, authPairingCredentialRouteLayer, authSessionRenewRouteLayer, authSessionRouteLayer, authWebSocketTokenRouteLayer, authWebLoginRouteLayer, authWebCallbackRouteLayer, cloudOwnerSessionRedeemRouteLayer, cloudOwnerSessionRevokeRouteLayer, desktopLocalWebBridgePublishRouteLayer, desktopLocalWebBridgeBootstrapRouteLayer, desktopRelayControlPlaneRouteLayer, apiDocsHtmlRouteLayer, apiDocsOpenApiRouteLayer, pulseSignalStateListRouteLayer, pulseSignalStateUpsertRouteLayer, cmmdProfileRouteLayer, ...cmmdProxyRouteLayers, cmmdWorkIntakeRouteLayer, cmmdWsTokenRouteLayer, cmmdGetProjectCommentsRouteLayer, cmmdAddProjectCommentRouteLayer, cmmdUpdateProjectRouteLayer, cmmdUploadTaskAttachmentRouteLayer, cmmdUpdateTaskCommentRouteLayer, cmmdListWorkspaceMembersRouteLayer, cmmdAddProjectMemberRouteLayer, cmmdUpdateProjectAgentMemberAvatarRouteLayer, runtimeReplicationStatusRouteLayer, cmmdRefreshProviderUsageRouteLayer, cmmdForgeCloudProjectsListRouteLayer, cmmdForgeCloudProjectsEventsRouteLayer, cmmdForgeEnvironmentsEventsRouteLayer, cmmdForgeRuntimesEnsureRouteLayer, cmmdForgeRuntimesConnectRouteLayer, ownerRuntimeCodexReadinessRouteLayer, cmmdForgeRuntimesStatusRouteLayer, cmmdForgeRuntimesStartRouteLayer, cmmdForgeRuntimesStopRouteLayer, cmmdForgeRuntimesRecycleRouteLayer, cmmdForgeRuntimesUpdateCommitRouteLayer, cmmdForgeRuntimesDestroyRouteLayer, mobileProviderCatalogRouteLayer, attachmentsRouteLayer, orchestrationDispatchRouteLayer, orchestrationCmmdWorkRunEventRouteLayer, orchestrationAutomationStartThreadRouteLayer, orchestrationAutomationRebindRouteLayer, orchestrationAutomationTerminalReconcileRouteLayer, mobileGitRunStackedActionRouteLayer, pullRequestDiffRouteLayer, orchestrationSnapshotRouteLayer, orchestrationThreadSnapshotRouteLayer, localAutomationListRouteLayer, localAutomationCreateRouteLayer, localAutomationUpdateRouteLayer, localAutomationDeleteRouteLayer, localAutomationRunRouteLayer, otlpTracesProxyRouteLayer, devTunnelProxyRouteLayer, devTunnelLocalPortProxyRouteLayer, projectFaviconRouteLayer, serverEnvironmentRouteLayer, browserWebRtcReadinessRouteLayer, staticAndDevRouteLayer, githubStatusRouteLayer, githubAuthorizeUrlRouteLayer, githubDisconnectRouteLayer, githubReposRouteLayer, githubCloneRouteLayer, githubCloneJobStartRouteLayer, githubCloneJobStatusRouteLayer, githubRefreshCredentialsRouteLayer, githubToolConfirmationApproveRouteLayer, projectLinkGetRouteLayer, projectLinkListRouteLayer, projectLinkSetRouteLayer, projectLinkDeleteRouteLayer, cmmdWorkspacesRouteLayer, cmmdCampaignsRouteLayer, cmmdProjectLinksRouteLayer, cmmdEnsureGitHubProjectContextRouteLayer, cmmdProjectRepositoryEnsureRouteLayer, cmmdProjectsGetRouteLayer, cmmdProjectsCreateRouteLayer, workspaceReadinessRouteLayer, runtimeLivenessRouteLayer, runtimeFilesystemHealthRouteLayer, claudeNativeGenerationProofRouteLayer, claudeUsageRouteLayer, codexRuntimeProviderReadinessRouteLayer, runtimeDiagnosticsRouteLayer, cloudFoldersRouteLayer, cloudProjectCreateRouteLayer, gitUrlCloneRouteLayer, websocketRpcRouteLayer).pipe(provide$1(browserApiCorsLayer));
+const makeRoutesLayer = mergeAll(attachmentUploadRouteLayer, authBearerBootstrapRouteLayer, authBootstrapRouteLayer, authCommandBearerBootstrapRouteLayer, authCommandBootstrapRouteLayer, authCmmdEmbedExchangeRouteLayer, authOAuthTokenExchangeRouteLayer, authWebSocketTicketRouteLayer, authCmmdOAuthDeviceRouteLayer, authCmmdOAuthTokenRouteLayer, authCmmdPasswordTokenRouteLayer, authClientsRevokeOthersRouteLayer, authClientsRevokeRouteLayer, authClientsRouteLayer, authLogoutRouteLayer, authPairingLinksRevokeRouteLayer, authPairingLinksRouteLayer, authPairingCredentialRouteLayer, authSessionRenewRouteLayer, authSessionRouteLayer, authWebSocketTokenRouteLayer, authWebLoginRouteLayer, authWebCallbackRouteLayer, cloudOwnerSessionRedeemRouteLayer, cloudOwnerSessionRevokeRouteLayer, desktopLocalWebBridgePublishRouteLayer, desktopLocalWebBridgeBootstrapRouteLayer, desktopRelayControlPlaneRouteLayer, apiDocsHtmlRouteLayer, apiDocsOpenApiRouteLayer, pulseSignalStateListRouteLayer, pulseSignalStateUpsertRouteLayer, cmmdProfileRouteLayer, ...cmmdProxyRouteLayers, cmmdWorkIntakeRouteLayer, cmmdWsTokenRouteLayer, cmmdGetProjectCommentsRouteLayer, cmmdAddProjectCommentRouteLayer, cmmdUpdateProjectRouteLayer, cmmdUploadTaskAttachmentRouteLayer, cmmdUpdateTaskCommentRouteLayer, cmmdListWorkspaceMembersRouteLayer, cmmdAddProjectMemberRouteLayer, cmmdUpdateProjectAgentMemberAvatarRouteLayer, runtimeReplicationStatusRouteLayer, cmmdRefreshProviderUsageRouteLayer, cmmdForgeCloudProjectsListRouteLayer, cmmdForgeCloudProjectsEventsRouteLayer, cmmdForgeEnvironmentsEventsRouteLayer, cmmdForgeRuntimesEnsureRouteLayer, cmmdForgeRuntimesConnectRouteLayer, ownerRuntimeCodexReadinessRouteLayer, cmmdRegisterMobilePushDeviceRouteLayer, cmmdDeleteMobilePushDeviceRouteLayer, cmmdForgeRuntimesStatusRouteLayer, cmmdForgeRuntimesStartRouteLayer, cmmdForgeRuntimesStopRouteLayer, cmmdForgeRuntimesRecycleRouteLayer, cmmdForgeRuntimesUpdateCommitRouteLayer, cmmdForgeRuntimesDestroyRouteLayer, mobileProviderCatalogRouteLayer, attachmentsRouteLayer, orchestrationDispatchRouteLayer, orchestrationCmmdWorkRunEventRouteLayer, orchestrationAutomationStartThreadRouteLayer, orchestrationAutomationRebindRouteLayer, orchestrationAutomationTerminalReconcileRouteLayer, mobileGitRunStackedActionRouteLayer, pullRequestDiffRouteLayer, orchestrationSnapshotRouteLayer, orchestrationThreadSnapshotRouteLayer, localAutomationListRouteLayer, localAutomationCreateRouteLayer, localAutomationUpdateRouteLayer, localAutomationDeleteRouteLayer, localAutomationRunRouteLayer, otlpTracesProxyRouteLayer, devTunnelProxyRouteLayer, devTunnelLocalPortProxyRouteLayer, projectFaviconRouteLayer, serverEnvironmentRouteLayer, browserWebRtcReadinessRouteLayer, staticAndDevRouteLayer, githubStatusRouteLayer, githubAuthorizeUrlRouteLayer, githubDisconnectRouteLayer, githubReposRouteLayer, githubCloneRouteLayer, githubCloneJobStartRouteLayer, githubCloneJobStatusRouteLayer, githubRefreshCredentialsRouteLayer, githubToolConfirmationApproveRouteLayer, projectLinkGetRouteLayer, projectLinkListRouteLayer, projectLinkSetRouteLayer, projectLinkDeleteRouteLayer, cmmdWorkspacesRouteLayer, cmmdCampaignsRouteLayer, cmmdProjectLinksRouteLayer, cmmdEnsureGitHubProjectContextRouteLayer, cmmdProjectRepositoryEnsureRouteLayer, cmmdProjectsGetRouteLayer, cmmdProjectsCreateRouteLayer, workspaceReadinessRouteLayer, runtimeLivenessRouteLayer, runtimeFilesystemHealthRouteLayer, claudeNativeGenerationProofRouteLayer, claudeUsageRouteLayer, codexRuntimeProviderReadinessRouteLayer, runtimeDiagnosticsRouteLayer, cloudFoldersRouteLayer, cloudProjectCreateRouteLayer, gitUrlCloneRouteLayer, websocketRpcRouteLayer).pipe(provide$1(browserApiCorsLayer));
 const runServer = launch$1(unwrap(gen(function* () {
 	const config = yield* ServerConfig;
 	fixPath({ preferProcessPath: config.forgeCmmdRuntimeMode === true });
@@ -325211,7 +325414,7 @@ const connectLoginCommand = make$33("login", {
 			})).json();
 		},
 		openBrowser: async (url) => {
-			const open = (await import("./open-2-reBrpv.mjs")).default;
+			const open = (await import("./open-yHTUkd2Y.mjs")).default;
 			await open(url);
 			return true;
 		},