@cmmd-center/forge 0.13.132 → 0.13.133

package/dist/bin.cjs

@@ -66407,7 +66407,7 @@ function normalizeNumberish(value) {
 }
 //#endregion
 //#region package.json
-var version$1 = "0.13.132";
+var version$1 = "0.13.133";
 //#endregion
 //#region src/sentry.ts
 const SERVER_APP_NAME = "forge-server";
@@ -67366,9 +67366,7 @@ const runtimeReplicationOutboxOldestEventAge = require_Schema$1.gauge("t3_runtim
 const runtimeReplicationPublicationAttemptsTotal = require_Schema$1.counter("t3_runtime_replication_publication_attempts_total", { description: "Total canonical runtime replication publication attempts." });
 const runtimeReplicationPublicationRetriesTotal = require_Schema$1.counter("t3_runtime_replication_publication_retries_total", { description: "Total runtime replication retries scheduled after recoverable failures." });
 const runtimeReplicationPublicationLatency = require_Schema$1.timer("t3_runtime_replication_publication_latency", { description: "Time from durable enqueue to canonical CMMD acknowledgement." });
-const cmmdCredentialRefreshTotal = require_Schema$1.counter("t3_cmmd_credential_refresh_total", { description: "CMMD JWT refresh attempts for a Forge session, by rung (self-refresh | grant-redemption) and outcome (attempted | succeeded)." });
-const cmmdTokenMintTotal = require_Schema$1.counter("t3_cmmd_token_mint_total", { description: "CMMD short-lived forge-token mints through the mint lane (forge#3518), by outcome (attempted | succeeded). The legacy rotation ladder keeps reporting t3_cmmd_credential_refresh_total, so the two lanes stay separable in every dashboard." });
-const cmmdRotationFenceAppliedTotal = require_Schema$1.counter("t3_cmmd_rotation_fence_applied_total", { description: "Sessions Forge refused to rotate CMMD credentials for, because the rotation fence applied." });
+const cmmdTokenMintTotal = require_Schema$1.counter("t3_cmmd_token_mint_total", { description: "CMMD short-lived forge-token mints, by outcome (attempted | succeeded | failed). The mint is the only CMMD JWT refresh story since forge#3521 deleted the legacy rotation ladder." });
 const cmmdCredentialRowDeletedTotal = require_Schema$1.counter("t3_cmmd_credential_row_deleted_total", { description: "command_access_tokens rows actually deleted by clearUnrecoverableCmmdAuthForSession, by reason." });
 const metricAttributes = (attributes) => Object.entries(compactMetricAttributes(attributes));
 const increment = (metric, attributes, amount = 1) => require_Schema$1.update(require_Schema$1.withAttributes(metric, metricAttributes(attributes)), amount);
@@ -67449,12 +67447,10 @@ const isPersistenceError = (u) => require_Schema$1.is(PersistenceSqlError)(u) ||
 const cache = /* @__PURE__ */ new Map();
 const jwtCache = /* @__PURE__ */ new Map();
 const jwtExpiryCache = /* @__PURE__ */ new Map();
-const refreshTokenCache = /* @__PURE__ */ new Map();
 const identityCache = /* @__PURE__ */ new Map();
 const sessionGrantCache = /* @__PURE__ */ new Map();
 const ACCESS_TOKEN_SCOPE = "cmmd-access-token";
 const JWT_TOKEN_SCOPE = "cmmd-jwt-token";
-const REFRESH_TOKEN_SCOPE = "cmmd-refresh-token";
 const IDENTITY_SCOPE = "cmmd-user-identity";
 const SESSION_GRANT_SCOPE = "cmmd-session-grant";
 const CommandAccessTokenRow = require_Schema$1.Struct({
@@ -67462,27 +67458,15 @@ const CommandAccessTokenRow = require_Schema$1.Struct({
 	accessToken: require_Schema$1.String,
 	jwtToken: require_Schema$1.NullOr(require_Schema$1.String),
 	jwtExpiresAt: require_Schema$1.NullOr(require_Schema$1.String),
-	refreshToken: require_Schema$1.NullOr(require_Schema$1.String),
 	cmmdUserIdentity: require_Schema$1.NullOr(require_Schema$1.String),
 	sessionGrant: require_Schema$1.NullOr(require_Schema$1.String)
 });
 const SubjectCommandAccessTokenRow = require_Schema$1.Struct({ accessToken: require_Schema$1.String });
-const SubjectJwtRow = require_Schema$1.Struct({
-	accessToken: require_Schema$1.String,
-	jwtToken: require_Schema$1.NullOr(require_Schema$1.String),
-	jwtExpiresAt: require_Schema$1.NullOr(require_Schema$1.String),
-	refreshToken: require_Schema$1.NullOr(require_Schema$1.String),
-	sessionId: require_Schema$1.String
-});
-const SubjectRefreshTokenRow = require_Schema$1.Struct({
-	refreshToken: require_Schema$1.String,
-	sessionId: require_Schema$1.String
-});
 const OwnerCommandAuthBundleRow = require_Schema$1.Struct({
 	accessToken: require_Schema$1.String,
 	jwtToken: require_Schema$1.NullOr(require_Schema$1.String),
 	jwtExpiresAt: require_Schema$1.NullOr(require_Schema$1.String),
-	refreshToken: require_Schema$1.NullOr(require_Schema$1.String),
+	sessionGrant: require_Schema$1.NullOr(require_Schema$1.String),
 	sessionId: require_Schema$1.String,
 	cmmdUserIdentity: require_Schema$1.String
 });
@@ -67527,8 +67511,6 @@ function decryptNullable(scope, value) {
 }
 const decodeTokenRows = require_Schema$1.decodeUnknownEffect(require_Schema$1.ArraySchema(CommandAccessTokenRow));
 const decodeSubjectTokenRows = require_Schema$1.decodeUnknownEffect(require_Schema$1.ArraySchema(SubjectCommandAccessTokenRow));
-const decodeSubjectJwtRows = require_Schema$1.decodeUnknownEffect(require_Schema$1.ArraySchema(SubjectJwtRow));
-require_Schema$1.decodeUnknownEffect(require_Schema$1.ArraySchema(SubjectRefreshTokenRow));
 const decodeOwnerCommandAuthBundleRows = require_Schema$1.decodeUnknownEffect(require_Schema$1.ArraySchema(OwnerCommandAuthBundleRow));
 const decodeOwnerCommandAuthSessionRows = require_Schema$1.decodeUnknownEffect(require_Schema$1.ArraySchema(OwnerCommandAuthSessionRow));
 const decodeCloudOwnerSessionRows = require_Schema$1.decodeUnknownEffect(require_Schema$1.ArraySchema(CloudOwnerSessionRow));
@@ -67554,9 +67536,9 @@ function extractJwtExpiresAt(jwtToken) {
 * Comparing against `exp` exactly leaves a window where Forge sends a token it
 * believes is good and CMMD has already stopped accepting it: the clocks differ by a
 * little, the request spends time in flight, and the answer comes back 401 on a
-* session that had a perfectly good refresh token sitting next to it. Two
-* minutes is far inside the JWT's own lifetime, so this costs one early
-* rotation and removes the race.
+* session whose grant could have minted a good replacement. Two minutes is far
+* inside the JWT's own lifetime, so this costs one early mint and removes the
+* race.
 */
 const JWT_EXPIRY_SKEW_MS = 2 * 6e4;
 /**
@@ -67582,7 +67564,6 @@ const hydrateCommandAccessTokenStore = require_Schema$1.gen(function* () {
       access_token AS "accessToken",
       jwt_token AS "jwtToken",
       jwt_expires_at AS "jwtExpiresAt",
-      refresh_token AS "refreshToken",
       cmmd_user_identity AS "cmmdUserIdentity",
       session_grant AS "sessionGrant"
     FROM command_access_tokens
@@ -67590,7 +67571,6 @@ const hydrateCommandAccessTokenStore = require_Schema$1.gen(function* () {
 	cache.clear();
 	jwtCache.clear();
 	jwtExpiryCache.clear();
-	refreshTokenCache.clear();
 	identityCache.clear();
 	sessionGrantCache.clear();
 	yield* require_Schema$1.try_({
@@ -67601,8 +67581,6 @@ const hydrateCommandAccessTokenStore = require_Schema$1.gen(function* () {
 				const jwtToken = decryptNullable(JWT_TOKEN_SCOPE, row.jwtToken);
 				if (jwtToken) jwtCache.set(sessionId, jwtToken);
 				if (row.jwtExpiresAt) jwtExpiryCache.set(sessionId, row.jwtExpiresAt);
-				const refreshToken = decryptNullable(REFRESH_TOKEN_SCOPE, row.refreshToken);
-				if (refreshToken) refreshTokenCache.set(sessionId, refreshToken);
 				const identity = decodeCmmdUserIdentity(decryptNullable(IDENTITY_SCOPE, row.cmmdUserIdentity));
 				if (identity) identityCache.set(sessionId, identity);
 				const sessionGrant = decryptNullable(SESSION_GRANT_SCOPE, row.sessionGrant);
@@ -67709,19 +67687,11 @@ function readCommandJwtForSession(sessionId) {
 	return jwtCache.get(sessionId) ?? null;
 }
 /**
-* Read the CMMD OAuth refresh token for a session. Sync; hits the in-memory
-* cache only. Used to rotate a REST JWT after CMMD rejects a locally cached JWT
-* that still appears unexpired.
-*/
-function readCommandRefreshTokenForSession(sessionId) {
-	return refreshTokenCache.get(sessionId) ?? null;
-}
-/**
 * The durable CMMD session grant for a session, if one was issued.
 *
-* Unlike the refresh token this is NON-rotating: redeeming it does not
-* invalidate it, so it stays valid until CMMD expires or revokes it. That is
-* what makes it a safe recovery credential after a rotation is lost.
+* The grant is NON-rotating: minting from it does not invalidate it, so it
+* stays valid until CMMD expires or revokes it. That is what makes it a safe
+* long-lived credential: the short-lived JWT it mints can always be replaced.
 */
 function readCommandSessionGrantForSession(sessionId) {
 	return sessionGrantCache.get(sessionId) ?? null;
@@ -67771,77 +67741,26 @@ const setCmmdUserIdentityForSession = (sessionId, identity) => require_Schema$1.
 * `jwt_expires_at` so callers can detect when the token has expired.
 * Updates only the JWT columns; the PAT row must already exist
 * (call `setCommandAccessTokenForSession` first in the OAuth callback).
+*
+* The JWT is short-lived by contract (CMMD clamps the mint TTL to one hour);
+* replacing one is the resolver's mint, so no sibling credential rides along.
 */
-const setCommandJwtForSession = (sessionId, jwtToken, opts = {}) => require_Schema$1.gen(function* () {
+const setCommandJwtForSession = (sessionId, jwtToken) => require_Schema$1.gen(function* () {
 	const token = jwtToken.trim();
 	if (token.length === 0) return;
 	const expiresAt = extractJwtExpiresAt(token);
-	const refreshToken = opts.refreshToken?.trim();
 	const storedToken = encodeSensitiveValue(JWT_TOKEN_SCOPE, token);
-	const storedRefreshToken = refreshToken ? encodeSensitiveValue(REFRESH_TOKEN_SCOPE, refreshToken) : null;
-	const sql = yield* require_SqlError.SqlClient;
-	const now = (/* @__PURE__ */ new Date()).toISOString();
-	if (refreshToken) yield* sql`
-        UPDATE command_access_tokens
-        SET
-          jwt_token = ${storedToken},
-          jwt_expires_at = ${expiresAt},
-          refresh_token = ${storedRefreshToken},
-          updated_at = ${now}
-        WHERE session_id = ${sessionId}
-      `.pipe(require_Schema$1.mapError(toPersistenceSqlError("CommandAccessTokenStore.setJwt:query")));
-	else yield* sql`
-        UPDATE command_access_tokens
-        SET
-          jwt_token = ${storedToken},
-          jwt_expires_at = ${expiresAt},
-          updated_at = ${now}
-        WHERE session_id = ${sessionId}
-      `.pipe(require_Schema$1.mapError(toPersistenceSqlError("CommandAccessTokenStore.setJwt:query")));
+	yield* (yield* require_SqlError.SqlClient)`
+      UPDATE command_access_tokens
+      SET
+        jwt_token = ${storedToken},
+        jwt_expires_at = ${expiresAt},
+        updated_at = ${(/* @__PURE__ */ new Date()).toISOString()}
+      WHERE session_id = ${sessionId}
+    `.pipe(require_Schema$1.mapError(toPersistenceSqlError("CommandAccessTokenStore.setJwt:query")));
 	jwtCache.set(sessionId, token);
 	if (expiresAt) jwtExpiryCache.set(sessionId, expiresAt);
 	else jwtExpiryCache.delete(sessionId);
-	if (refreshToken) refreshTokenCache.set(sessionId, refreshToken);
-});
-/**
-* Look up the most recent non-expired JWT for an auth subject across active
-* owner sessions. Used as a continuity fallback when the current session ID
-* changed (e.g. after re-authentication) but the user's CMMD JWT should still
-* be usable.
-*
-* Also returns the sessionId that owns the JWT so callers can promote it to
-* the current session, avoiding repeated cross-session lookups.
-*/
-const readMostRecentJwtForSubject = (subject) => require_Schema$1.gen(function* () {
-	const row = (yield* decodeSubjectJwtRows(yield* (yield* require_SqlError.SqlClient)`
-      SELECT
-        cat.access_token AS "accessToken",
-        cat.jwt_token AS "jwtToken",
-        cat.jwt_expires_at AS "jwtExpiresAt",
-        cat.refresh_token AS "refreshToken",
-        cat.session_id AS "sessionId"
-      FROM command_access_tokens AS cat
-      JOIN auth_sessions AS s ON s.session_id = cat.session_id
-      WHERE s.subject = ${subject}
-        AND s.role = 'owner'
-        AND s.revoked_at IS NULL
-        AND cat.jwt_token IS NOT NULL
-        AND cat.jwt_expires_at IS NOT NULL
-        AND cat.jwt_expires_at > ${(/* @__PURE__ */ new Date()).toISOString()}
-      ORDER BY s.issued_at DESC
-      LIMIT 1
-    `.pipe(require_Schema$1.mapError(toPersistenceSqlError("CommandAccessTokenStore.readMostRecentJwtBySubject:query")))).pipe(require_Schema$1.mapError(toPersistenceDecodeError("CommandAccessTokenStore.readMostRecentJwtBySubject:decodeRows"))))[0];
-	if (!row?.jwtToken) return null;
-	const jwtToken = decodeSensitiveValue(JWT_TOKEN_SCOPE, row.jwtToken);
-	const refreshToken = decryptNullable(REFRESH_TOKEN_SCOPE, row.refreshToken);
-	const accessToken = decodeSensitiveValue(ACCESS_TOKEN_SCOPE, row.accessToken);
-	return {
-		jwt: jwtToken,
-		sessionId: row.sessionId,
-		expiresAt: row.jwtExpiresAt ?? null,
-		refreshToken,
-		accessToken
-	};
 });
 /**
 * Look up the latest CMMD PAT for an auth subject across active owner sessions.
@@ -67880,7 +67799,7 @@ const readMostRecentCommandAccessTokenForSubject = (subject) => require_Schema$1
 * `desktop-bootstrap` session that minted them, and nothing later rewrites that
 * subject. So the clause matched no row on any machine, promotion always
 * returned null, and a phone whose short-lived JWT had expired could not reach
-* the refresh token sitting on its own previous session. It surfaced as "This
+* the credentials sitting on its own previous session. It surfaced as "This
 * session is no longer accepted. Sign in again." about a day after signing in,
 * with nothing in the log, because the ladder never got as far as a call that
 * could fail out loud.
@@ -67941,6 +67860,9 @@ const readMostRecentOwnerCommandAuthSession = require_Schema$1.gen(function* ()
 * a CMMD user subject. The CMMD token is still account-owned, so the trusted
 * local owner may inherit the most recent active owner token with an identity.
 * Client pairings must not call this.
+*
+* The copy includes the session grant: the promoted session can then mint its
+* own short-lived JWT, which since forge#3521 is the only refresh story.
 */
 const promoteMostRecentOwnerCommandAuthToSession = (sessionId) => require_Schema$1.gen(function* () {
 	const sql = yield* require_SqlError.SqlClient;
@@ -67949,7 +67871,7 @@ const promoteMostRecentOwnerCommandAuthToSession = (sessionId) => require_Schema
         cat.access_token AS "accessToken",
         cat.jwt_token AS "jwtToken",
         cat.jwt_expires_at AS "jwtExpiresAt",
-        cat.refresh_token AS "refreshToken",
+        cat.session_grant AS "sessionGrant",
         cat.session_id AS "sessionId",
         cat.cmmd_user_identity AS "cmmdUserIdentity"
       FROM command_access_tokens AS cat
@@ -67961,7 +67883,7 @@ const promoteMostRecentOwnerCommandAuthToSession = (sessionId) => require_Schema
 	if (!row) return null;
 	const accessToken = decodeSensitiveValue(ACCESS_TOKEN_SCOPE, row.accessToken);
 	const jwtToken = decryptNullable(JWT_TOKEN_SCOPE, row.jwtToken);
-	const refreshToken = decryptNullable(REFRESH_TOKEN_SCOPE, row.refreshToken);
+	const sessionGrant = decryptNullable(SESSION_GRANT_SCOPE, row.sessionGrant);
 	const identity = decodeCmmdUserIdentity(decodeSensitiveValue(IDENTITY_SCOPE, row.cmmdUserIdentity));
 	if (!identity) return null;
 	const updateNow = (/* @__PURE__ */ new Date()).toISOString();
@@ -67971,7 +67893,7 @@ const promoteMostRecentOwnerCommandAuthToSession = (sessionId) => require_Schema
         access_token,
         jwt_token,
         jwt_expires_at,
-        refresh_token,
+        session_grant,
         cmmd_user_identity,
         created_at,
         updated_at
@@ -67981,7 +67903,7 @@ const promoteMostRecentOwnerCommandAuthToSession = (sessionId) => require_Schema
         ${row.accessToken},
         ${row.jwtToken},
         ${row.jwtExpiresAt},
-        ${row.refreshToken},
+        ${row.sessionGrant},
         ${row.cmmdUserIdentity},
         ${updateNow},
         ${updateNow}
@@ -67990,7 +67912,7 @@ const promoteMostRecentOwnerCommandAuthToSession = (sessionId) => require_Schema
         access_token = excluded.access_token,
         jwt_token = excluded.jwt_token,
         jwt_expires_at = excluded.jwt_expires_at,
-        refresh_token = excluded.refresh_token,
+        session_grant = excluded.session_grant,
         cmmd_user_identity = excluded.cmmd_user_identity,
         updated_at = excluded.updated_at
     `.pipe(require_Schema$1.mapError(toPersistenceSqlError("CommandAccessTokenStore.promoteLatestOwnerAuth:upsert")));
@@ -67999,14 +67921,14 @@ const promoteMostRecentOwnerCommandAuthToSession = (sessionId) => require_Schema
 	else jwtCache.delete(sessionId);
 	if (row.jwtExpiresAt) jwtExpiryCache.set(sessionId, row.jwtExpiresAt);
 	else jwtExpiryCache.delete(sessionId);
-	if (refreshToken) refreshTokenCache.set(sessionId, refreshToken);
-	else refreshTokenCache.delete(sessionId);
+	if (sessionGrant) sessionGrantCache.set(sessionId, sessionGrant);
+	else sessionGrantCache.delete(sessionId);
 	identityCache.set(sessionId, identity);
 	return {
 		accessToken,
 		jwtToken,
 		jwtExpiresAt: row.jwtExpiresAt ?? null,
-		refreshToken,
+		sessionGrant,
 		sourceSessionId: row.sessionId,
 		cmmdUserIdentity: identity
 	};
@@ -68051,11 +67973,11 @@ const clearCommandAccessTokenForSession = (sessionId) => require_Schema$1.gen(fu
     `.pipe(require_Schema$1.mapError(toPersistenceSqlError("CommandAccessTokenStore.clear:query")));
 	forgetCommandAccessTokenCachesForSession(sessionId);
 });
+/** Evict a session's credentials, JWT expiry, identity, and grant from memory without changing storage. */
 function forgetCommandAccessTokenCachesForSession(sessionId) {
 	cache.delete(sessionId);
 	jwtCache.delete(sessionId);
 	jwtExpiryCache.delete(sessionId);
-	refreshTokenCache.delete(sessionId);
 	identityCache.delete(sessionId);
 	sessionGrantCache.delete(sessionId);
 }
@@ -68087,14 +68009,14 @@ const scheduleExpiredForgeCloudOwnerCredentialMaintenance = require_Schema$1.sle
 *   is dead too, so the promotion sources are cleared with it — otherwise the
 *   next promotion resurrects the same dead bundle in a loop.
 * - **Every other session** owns its credentials outright: each OAuth exchange
-*   mints a distinct PAT and refresh token (CMMD `createAccountScopedToken` /
-*   `issueTokenPair`). One session's dead credential says nothing about a
+*   mints its own PAT, JWT and session grant. One session's dead credential
+*   says nothing about a
 *   sibling browser or device, so the clear stays local to that session.
 *
 * Clearing every active owner row unconditionally (the pre-CMMD-1871 behaviour)
 * turned a single expired tab into a sign-out on every browser and device.
 *
-* Destroys a refresh token good for months, so every call is logged with a
+* Destroys durable credentials (the PAT, the grant), so every call is logged with a
 * `reason` naming the caller's own decision (never the credential itself) and
 * the actual row count deleted, at info level so it shows up without raising
 * the server's log level. `reason` is optional only so a caller that has not
@@ -68135,65 +68057,10 @@ const clearUnrecoverableCmmdAuthForSession = (sessionId, reason) => require_Sche
 	}
 });
 /**
-* Retire refresh credentials copied into historical desktop bearer sessions.
-* Electron owns rotation for native desktop OAuth; Forge Local keeps only the
-* derived access authority needed by the current bearer session.
-*
-* Scoped to the bootstrapping client, not to the whole subject. The phone and
-* Electron sign in as the same `user:<id>`, so a subject-wide sweep let one
-* desktop launch null out a phone's refresh token and end its session a day
-* later. Two clauses keep that from happening:
-*
-* - `client_device_type = 'desktop'`, which now excludes phones outright,
-*   because the mobile app declares itself at bootstrap.
-* - the same recorded `client_user_agent` as the bootstrap doing the
-*   retirement, which is the only thing that separates a phone row written
-*   before that stamp existed from a real Electron row. Both are stamped
-*   `desktop`; neither carries any other mark. An empty or unmatched user agent
-*   retires nothing, which is the direction that keeps a live credential.
-*
-* Electron re-bootstraps under a stable user agent, so its own historical rows
-* still match and still get swept.
-*/
-const clearDesktopBearerRefreshTokensForSubject = (input) => require_Schema$1.gen(function* () {
-	const normalizedSubject = input.subject.trim();
-	const normalizedUserAgent = input.clientUserAgent?.trim() ?? "";
-	if (!normalizedSubject || !normalizedUserAgent) return;
-	const rows = yield* (yield* require_SqlError.SqlClient)`
-      UPDATE command_access_tokens
-      SET
-        refresh_token = NULL,
-        updated_at = ${(/* @__PURE__ */ new Date()).toISOString()}
-      WHERE session_id IN (
-        SELECT session_id
-        FROM auth_sessions
-        WHERE subject = ${normalizedSubject}
-          AND role = 'owner'
-          AND method = 'bearer-session-token'
-          AND client_device_type = 'desktop'
-          AND client_user_agent = ${normalizedUserAgent}
-      )
-      RETURNING session_id AS "sessionId"
-    `.pipe(require_Schema$1.mapError(toPersistenceSqlError("CommandAccessTokenStore.clearDesktopBearerRefresh:query")));
-	for (const row of rows) refreshTokenCache.delete(row.sessionId);
-});
-const isDesktopBearerAuthSession = (sessionId) => require_Schema$1.gen(function* () {
-	const rows = yield* (yield* require_SqlError.SqlClient)`
-      SELECT
-        method,
-        client_device_type AS "clientDeviceType"
-      FROM auth_sessions
-      WHERE session_id = ${sessionId}
-      LIMIT 1
-    `.pipe(require_Schema$1.mapError(toPersistenceSqlError("CommandAccessTokenStore.isDesktopBearerSession:query")));
-	return rows[0]?.method === "bearer-session-token" && rows[0].clientDeviceType === "desktop";
-});
-/**
 * The device type a session's bearer bootstrap declared, for log lines only.
 *
-* Mirrors `isDesktopBearerAuthSession`'s read but returns the raw column
-* instead of collapsing it into a rotation verdict — a log line wants to say
-* what made the request, not whether Forge may rotate for it. Never fails:
+* Returns the raw column: a log line wants to say what made the request.
+* Never fails:
 * an unreadable or missing row logs as `"unknown"` rather than losing the
 * decision-point log line it is attached to.
 */
@@ -68246,6 +68113,7 @@ function artifactError(message) {
 		cause
 	});
 }
+/** Store credentials under the asserted Cloud owner session and retain its durable mint grant. */
 function persistCloudOwnerArtifacts(input) {
 	return require_Schema$1.gen(function* () {
 		const sql = yield* require_SqlError.SqlClient;
@@ -68253,7 +68121,7 @@ function persistCloudOwnerArtifacts(input) {
 			yield* setCommandAccessTokenForSession(input.assertion.sessionId, input.accessToken).pipe(require_Schema$1.mapError(artifactError("Failed to persist CMMD access token.")));
 			yield* setCmmdUserIdentityForSession(input.assertion.sessionId, input.identity).pipe(require_Schema$1.mapError(artifactError("Failed to persist CMMD user identity.")));
 			if (input.sessionGrant) yield* setCommandSessionGrantForSession(input.assertion.sessionId, input.sessionGrant, { expiresAt: input.sessionGrantExpiresAt ?? null }).pipe(require_Schema$1.mapError(artifactError("Failed to persist CMMD session grant.")));
-			if (input.jwtToken) yield* setCommandJwtForSession(input.assertion.sessionId, input.jwtToken, input.refreshToken ? { refreshToken: input.refreshToken } : {}).pipe(require_Schema$1.mapError(artifactError("Failed to persist CMMD JWT.")));
+			if (input.jwtToken) yield* setCommandJwtForSession(input.assertion.sessionId, input.jwtToken).pipe(require_Schema$1.mapError(artifactError("Failed to persist CMMD JWT.")));
 		});
 		yield* sql.withTransaction(transaction).pipe(require_Schema$1.mapError((cause) => cause instanceof AuthError ? cause : new AuthError({
 			message: "Failed to persist Forge Cloud owner credentials.",
@@ -68391,7 +68259,6 @@ const authSessionRenewRouteLayer = add$1("POST", "/api/auth/session/renew", requ
 		accessToken: patToStore,
 		identity: cmmdIdentity,
 		jwtToken: credentials.jwtToStore,
-		refreshToken: credentials.refreshToken,
 		sessionGrant,
 		sessionGrantExpiresAt: void 0
 	});
@@ -68468,7 +68335,6 @@ const PairingCredentialRequestHeaders = require_Schema$1.Struct({
 const CommandBootstrapInput = require_Schema$1.Struct({
 	accessToken: require_Schema$1.String,
 	mcpToken: require_Schema$1.optionalKey(require_Schema$1.String),
-	refreshToken: require_Schema$1.optionalKey(require_Schema$1.String),
 	userId: require_Schema$1.optionalKey(require_Schema$1.Number),
 	displayName: require_Schema$1.optionalKey(require_Schema$1.String),
 	user: require_Schema$1.optionalKey(require_Schema$1.Unknown),
@@ -68702,6 +68568,7 @@ function validateCommandBootstrapPayload(payload) {
 		};
 	});
 }
+/** Store the bootstrap PAT, optional JWT, and identity; report persistence failures as auth errors. */
 function persistCommandBootstrapSessionArtifacts(input) {
 	return require_Schema$1.gen(function* () {
 		const token = input.payload.accessToken.trim();
@@ -68716,14 +68583,11 @@ function persistCommandBootstrapSessionArtifacts(input) {
 			status: 500,
 			cause
 		})));
-		if (isCmmdJwtToken(token)) {
-			const refreshToken = input.payload.refreshToken?.trim();
-			yield* setCommandJwtForSession(input.sessionId, token, refreshToken ? { refreshToken } : {}).pipe(require_Schema$1.mapError((cause) => new AuthError({
-				message: "Failed to persist CMMD JWT.",
-				status: 500,
-				cause
-			})));
-		}
+		if (isCmmdJwtToken(token)) yield* setCommandJwtForSession(input.sessionId, token).pipe(require_Schema$1.mapError((cause) => new AuthError({
+			message: "Failed to persist CMMD JWT.",
+			status: 500,
+			cause
+		})));
 		const cmmdIdentity = input.cmmdIdentity ?? normalizeCmmdUserIdentity(input.payload.user);
 		if (cmmdIdentity) yield* setCmmdUserIdentityForSession(input.sessionId, cmmdIdentity).pipe(require_Schema$1.mapError((cause) => new AuthError({
 			message: "Failed to persist CMMD user identity.",
@@ -68825,7 +68689,6 @@ function resolveCmmdTokenBundleCredentials(tokenResult) {
 			userId: cmmdIdentity?.id,
 			accessToken,
 			mcpToken,
-			refreshToken: readString("refresh_token"),
 			sessionGrant: readString("session_grant"),
 			sessionGrantExpiresAt: readString("session_grant_expires_at"),
 			forgeOwnerAssertion: readString("forge_owner_assertion"),
@@ -68847,7 +68710,6 @@ function describeCmmdTokenResponseForLog(input) {
 		accessTokenType: input.tokenObj ? typeof input.tokenObj["access_token"] : "n/a",
 		hasAccessToken: input.accessToken !== void 0,
 		hasMcpToken: input.mcpToken !== void 0,
-		hasRefreshToken: input.refreshToken !== void 0,
 		expiresInType: input.tokenObj ? typeof input.tokenObj["expires_in"] : "n/a",
 		isJwt: input.isJwt,
 		userKeys: userObj ? Object.keys(userObj) : [],
@@ -69075,19 +68937,6 @@ const authCommandBearerBootstrapRouteLayer = add$1("POST", "/api/auth/bootstrap/
 		payload,
 		cmmdIdentity: validated.cmmdIdentity
 	});
-	if (deviceType === "desktop" && !payload.refreshToken?.trim()) yield* clearDesktopBearerRefreshTokensForSubject({
-		subject: sessionSubject,
-		clientUserAgent: request.headers["user-agent"]
-	}).pipe(require_Schema$1.mapError((cause) => new AuthError({
-		message: "Failed to retire legacy desktop refresh credentials.",
-		status: 500,
-		cause
-	})), require_Schema$1.tapError(() => require_Schema$1.logWarning("CMMD bearer bootstrap failed.", {
-		sessionId: issued.sessionId,
-		deviceType,
-		outcome: "failed",
-		reason: "legacy-desktop-refresh-retirement-failed"
-	})));
 	yield* require_Schema$1.logInfo("CMMD bearer bootstrap succeeded.", {
 		sessionId: issued.sessionId,
 		deviceType,
@@ -69185,7 +69034,6 @@ function completeCloudOwnerPasswordLogin(input) {
 			accessToken: patToStore,
 			identity: cmmdIdentity,
 			jwtToken: credentials.jwtToStore,
-			refreshToken: credentials.refreshToken,
 			sessionGrant: credentials.sessionGrant,
 			sessionGrantExpiresAt: credentials.sessionGrantExpiresAt
 		});
@@ -69268,6 +69116,10 @@ const authWebLoginRouteLayer = add$1("GET", "/api/auth/login", require_Schema$1.
 		transientCookie
 	]]));
 }));
+/**
+* Persist the local OAuth PAT and identity, failing if either write fails.
+* Capture and ignore failures while storing the optional mint grant and JWT.
+*/
 function persistLocalOAuthArtifacts(input) {
 	return require_Schema$1.gen(function* () {
 		yield* setCommandAccessTokenForSession(input.sessionId, input.accessToken).pipe(require_Schema$1.mapError((cause) => new AuthError({
@@ -69284,7 +69136,7 @@ function persistLocalOAuthArtifacts(input) {
 			route: "oauth-callback",
 			step: "grant-store"
 		}))), require_Schema$1.ignore({ log: true }));
-		if (input.jwtToken) yield* setCommandJwtForSession(input.sessionId, input.jwtToken, input.refreshToken ? { refreshToken: input.refreshToken } : {}).pipe(require_Schema$1.tapError((error) => require_Schema$1.sync(() => captureServerError(error, {
+		if (input.jwtToken) yield* setCommandJwtForSession(input.sessionId, input.jwtToken).pipe(require_Schema$1.tapError((error) => require_Schema$1.sync(() => captureServerError(error, {
 			route: "oauth-callback",
 			step: "jwt-store"
 		}))), require_Schema$1.ignore({ log: true }));
@@ -69338,13 +69190,12 @@ const authWebCallbackRouteLayer = add$1("GET", "/api/auth/callback", require_Sch
 			cause
 		})
 	}), "Failed to exchange authorization code with CMMD.");
-	const { tokenObj, cmmdIdentity, userId, accessToken, mcpToken, refreshToken, sessionGrant, sessionGrantExpiresAt, forgeOwnerAssertion, isJwt, patToStore, jwtToStore } = yield* resolveCmmdTokenBundleCredentials(tokenResult);
+	const { tokenObj, cmmdIdentity, userId, accessToken, mcpToken, sessionGrant, sessionGrantExpiresAt, forgeOwnerAssertion, isJwt, patToStore, jwtToStore } = yield* resolveCmmdTokenBundleCredentials(tokenResult);
 	const tokenResponseLogDetails = describeCmmdTokenResponseForLog({
 		tokenObj,
 		tokenResult,
 		accessToken,
 		mcpToken,
-		refreshToken,
 		isJwt,
 		userId,
 		patToStore,
@@ -69397,7 +69248,6 @@ const authWebCallbackRouteLayer = add$1("GET", "/api/auth/callback", require_Sch
 		accessToken: patToStore,
 		identity: cmmdIdentity,
 		jwtToken: jwtToStore,
-		refreshToken,
 		sessionGrant,
 		sessionGrantExpiresAt
 	};
@@ -71415,51 +71265,83 @@ function isCmmdUserAccessJwt(token) {
 }
 //#endregion
 //#region src/command/cmmdJwt.ts
-function parseCmmdOAuthRefreshResponse(value) {
-	if (!value || typeof value !== "object") return null;
-	const record = value;
-	const accessToken = record["access_token"];
-	if (typeof accessToken !== "string" || accessToken.trim().length === 0) return null;
-	const refreshToken = record["refresh_token"];
-	return {
-		accessToken: accessToken.trim(),
-		refreshToken: typeof refreshToken === "string" && refreshToken.trim().length > 0 ? refreshToken.trim() : null
-	};
-}
 /**
-* Read the one field the mint lane consumes from CMMD's mint response.
-* Returns null unless `access_token` is present and non-empty.
-*/
+* Read a minted JWT with finite issuance and expiry times and a lifetime of
+* at most one hour. Reject expired tokens and tokens issued in the future.
+* This checks the mint contract only; CMMD verifies signatures on use.
+*/
+/** Machine-client tokens live at most one hour; anything longer is a CMMD
+* contract violation that must not silently extend forge sessions. */
+const MAX_MACHINE_TOKEN_LIFETIME_SECONDS = 3600;
+/**
+* The minted access token's lifetime in seconds, read from its JWT `exp` and
+* `iat` claims without verifying the signature (the signature is checked on
+* every use at the guard; here the claims only measure the lifetime). `iat`
+* falls back to the current time when absent. Null when the payload cannot be
+* read, which is itself a contract violation.
+*/
+function readJwtLifetimeSeconds(accessToken) {
+	const claims = decodeJwtPayload(accessToken);
+	const expiresAt = claims?.["exp"];
+	const issuedAtRaw = claims?.["iat"];
+	if (typeof expiresAt !== "number" || !Number.isFinite(expiresAt)) return null;
+	const issuedAt = typeof issuedAtRaw === "number" && Number.isFinite(issuedAtRaw) ? issuedAtRaw : Math.floor(Date.now() / 1e3);
+	const now = Date.now() / 1e3;
+	if (expiresAt <= now || issuedAt > now) return null;
+	return expiresAt - issuedAt;
+}
+/** True when the minted token's lifetime honors the one-hour contract. A
+* refusal is logged here because the reason is mint-contract specific and the
+* caller only wants the token-or-null answer. */
+function mintLifetimeWithinContract(accessToken) {
+	const lifetime = readJwtLifetimeSeconds(accessToken);
+	if (lifetime !== null && lifetime <= MAX_MACHINE_TOKEN_LIFETIME_SECONDS) return true;
+	console.warn(`[cmmd-auth] CMMD minted a forge token outside the one-hour contract (lifetime=${lifetime === null ? "unreadable" : `${lifetime}s`}); refusing to persist it`);
+	return false;
+}
 function parseCmmdTokenMintResponse(value) {
 	if (!value || typeof value !== "object") return null;
 	const accessToken = value["access_token"];
 	if (typeof accessToken !== "string" || accessToken.trim().length === 0) return null;
-	return { accessToken: accessToken.trim() };
+	const trimmed = accessToken.trim();
+	if (!mintLifetimeWithinContract(trimmed)) return null;
+	return { accessToken: trimmed };
 }
 /**
-* How long the mint may take before the lane gives up on it. Minting is one
+* How long the mint may take before the caller gives up on it. Minting is one
 * grant lookup and one signature on CMMD's side; anything slower is treated
-* like a failure and the resolver falls through to the legacy ladder.
+* like a failure and the resolution returns null.
 */
 const MINT_TIMEOUT_MS = 1e4;
 /**
+* The OAuth error codes that are evidence the grant itself is dead, and the
+* only mint refusals allowed to feed the credential-rejection ledger.
+*
+* This set is grant-specific on purpose. Per RFC 6749, `invalid_grant` names
+* the grant. `invalid_client` names the client (CMMD did not accept
+* `cmmd-forge-web`) and `invalid_request` names the request shape (a missing or
+* unsupported parameter, for example after a CMMD contract change); both would
+* fire for every session at once, so a single misconfiguration or
+* deploy-ordering mistake could delete every stored credential. Those codes
+* stay logged refusals that resolve null and leave the row in place. If CMMD's
+* contract ever makes one of them grant-specific, document that here before
+* widening this set.
+*/
+const REJECTED_OAUTH_ERROR_CODES = new Set(["invalid_grant"]);
+/**
 * Mint a short-lived forge-scoped access token from a durable session grant
-* (forge#3518 expand phase).
+* (forge#3518 expand; the only lane since the forge#3521 contract phase).
 *
-* The grant is non-rotating and redeemable on demand, so this is the mint
-* lane's entire refresh story: call it again when the short-lived token
-* expires. CMMD answers with `access_token` only (no refresh token, no MCP
-* PAT, nothing durable), so a session that lives entirely on this lane never
-* accumulates long-lived credential state on Forge's side.
+* The grant is non-rotating and redeemable on demand, so this is the entire
+* refresh story: call it again when the short-lived token expires. CMMD answers
+* with `access_token` only (no refresh token, no MCP PAT, nothing durable), so
+* a session living on this lane never accumulates long-lived credential state
+* beyond the grant it already holds.
 *
 * Returns null for every failure because the resolver wants a value, not a
-* thrown error; the failure modes are logged by status and OAuth error code
-* the same way `refreshCmmdJwt` logs them. A rejection here is never fed to
-* the credential-rejection ledger: the ledger exists to prove a session's
-* *rotation* credential is dead, and the grant dying says nothing about the
-* refresh token the legacy fallback still owns.
+* thrown error; the failure modes are logged by status and OAuth error code.
 */
-function mintCmmdShortLivedToken(grantToken) {
+function mintCmmdShortLivedToken(grantToken, observer) {
 	return fetch(new URL("/api/mcp-server/oauth/token", resolveCommandAppUrl()).toString(), {
 		method: "POST",
 		headers: { "Content-Type": "application/json" },
@@ -71472,6 +71354,7 @@ function mintCmmdShortLivedToken(grantToken) {
 	}).then(async (response) => {
 		if (!response.ok) {
 			const errorCode = await readOAuthErrorCode(response);
+			if (errorCode !== null && REJECTED_OAUTH_ERROR_CODES.has(errorCode)) observer?.onCredentialRejected?.();
 			console.warn(`[cmmd-auth] CMMD refused a forge token mint with ${response.status}${errorCode === null ? "" : ` (${errorCode})`}`);
 			return null;
 		}
@@ -71484,103 +71367,149 @@ function mintCmmdShortLivedToken(grantToken) {
 	});
 }
 /**
-* The redemption request body. `popPublicKeyPem` is the server's PoP identity
-* (forge#3534): presented when bound sessions are enabled so CMMD stamps the
-* returned JWT with this server's key (`cnf.jkt`), omitted otherwise.
+* The OAuth `error` code from a refusal, lowercased, or null when there is none.
+*
+* Best effort by design: a body that is not JSON, or is already consumed, must
+* not turn a logged failure into an unlogged one. Null also reads correctly as
+* "no evidence the grant is dead", which is the safe answer for a caller
+* deciding whether to keep the session's stored credential.
 */
-function buildSessionGrantRedemptionBody(grantToken, popPublicKeyPem) {
-	return {
-		grant_type: "forge_session_grant",
-		grant_token: grantToken,
-		client_id: "cmmd-forge-web",
-		...popPublicKeyPem ? { pop_public_key: popPublicKeyPem } : {}
-	};
+async function readOAuthErrorCode(response) {
+	try {
+		const code = (await response.json())["error"];
+		return typeof code === "string" && code.trim().length > 0 ? code.trim().toLowerCase() : null;
+	} catch {
+		return null;
+	}
 }
+//#endregion
+//#region src/cmmdConnection/cmmdCredentialRejection.ts
 /**
-* Redeem a durable CMMD session grant for a fresh credential set.
-*
-* The grant is CMMD's designed recovery path for exactly the case a rotating
-* refresh token cannot cover: the refresh token is single-use, so one lost or
-* raced rotation strands the session with no way back. The grant is
-* NON-rotating — the same token redeems repeatedly until CMMD expires or
-* revokes it — so redemption is safe to retry and cannot race itself.
+* How long a recorded rejection stays usable.
 *
-* Returns the new MCP PAT alongside the JWT/refresh pair, because CMMD mints a
-* fresh PAT on redemption and the old one is not carried over.
+* Long enough to span the resolver ladder and the response that follows it,
+* short enough that it cannot outlive the credential it describes.
 */
-function redeemCmmdSessionGrant(grantToken, popPublicKeyPem) {
-	return fetch(new URL("/api/mcp-server/oauth/token", resolveCommandAppUrl()).toString(), {
-		method: "POST",
-		headers: { "Content-Type": "application/json" },
-		body: JSON.stringify(buildSessionGrantRedemptionBody(grantToken, popPublicKeyPem))
-	}).then(async (response) => {
-		if (!response.ok) return null;
-		const payload = await response.json();
-		const parsed = parseCmmdOAuthRefreshResponse(payload);
-		if (!parsed) return null;
-		const mcpToken = payload["mcp_token"];
-		return {
-			...parsed,
-			mcpToken: typeof mcpToken === "string" && mcpToken.trim().length > 0 ? mcpToken.trim() : null
-		};
-	}).catch(() => null);
+const REJECTION_TTL_MS = 6e4;
+const rejectedAt = /* @__PURE__ */ new Map();
+/** Record that CMMD refused this session's credential outright. */
+function noteCmmdCredentialRejected(sessionId) {
+	rejectedAt.set(sessionId, Date.now());
+}
+/** Whether CMMD refused this session's credential recently enough to act on. */
+function hasCmmdCredentialRejection(sessionId) {
+	const observedAt = rejectedAt.get(sessionId);
+	if (observedAt === void 0) return false;
+	if (Date.now() - observedAt <= REJECTION_TTL_MS) return true;
+	rejectedAt.delete(sessionId);
+	return false;
+}
+/** Drop a recorded rejection, once it has been acted on or superseded. */
+function forgetCmmdCredentialRejection(sessionId) {
+	rejectedAt.delete(sessionId);
 }
-const REJECTED_OAUTH_ERROR_CODES = new Set([
-	"invalid_grant",
-	"invalid_client",
-	"invalid_request"
-]);
 /**
-* Rotate a CMMD refresh token into a fresh access JWT.
+* Clear a session's CMMD credentials, but only if CMMD rejected them.
 *
-* Returns null for every failure, because the caller's recovery ladder wants a
-* value rather than a thrown error. Null is nearly the whole diagnostic value
-* of this call though, so each way of reaching it says so first. Chasing a
-* phone that had silently stopped accepting its session cost an afternoon
-* partly because a failed rotation here was indistinguishable from one that
-* never ran. The token itself is never logged; the status and the OAuth error
-* code are what identify the failure, and `invalid_grant` in particular means
-* the token was already spent, which is a different fix from a 500.
+* This is the only door the 401 path may use. A resolver that returned null
+* without a recorded rejection is a transient failure and leaves the stored
+* credential exactly where it is, so the next request can mint from it again.
 */
-function refreshCmmdJwt(refreshToken, observer) {
-	return fetch(new URL("/api/mcp-server/oauth/token", resolveCommandAppUrl()).toString(), {
-		method: "POST",
-		headers: { "Content-Type": "application/json" },
-		body: JSON.stringify({
-			grant_type: "refresh_token",
-			refresh_token: refreshToken,
-			client_id: "cmmd-forge-web"
-		})
-	}).then(async (response) => {
-		if (!response.ok) {
-			const errorCode = await readOAuthErrorCode(response);
-			if (errorCode !== null && REJECTED_OAUTH_ERROR_CODES.has(errorCode)) observer?.onCredentialRejected?.();
-			console.warn(`[cmmd-auth] CMMD refused a JWT rotation with ${response.status}${errorCode === null ? "" : ` (${errorCode})`}`);
-			return null;
-		}
-		const parsed = parseCmmdOAuthRefreshResponse(await response.json());
-		if (!parsed) console.warn("[cmmd-auth] CMMD accepted a JWT rotation but returned no usable access token");
-		return parsed;
-	}).catch((cause) => {
-		console.warn(`[cmmd-auth] CMMD JWT rotation could not be completed: ${String(cause)}`);
-		return null;
+const clearCmmdAuthAfterCmmdRejection = (sessionId) => require_Schema$1.gen(function* () {
+	if (!hasCmmdCredentialRejection(sessionId)) return;
+	yield* clearUnrecoverableCmmdAuthForSession(sessionId, "cmmd-rejected-credential");
+	forgetCmmdCredentialRejection(sessionId);
+});
+//#endregion
+//#region src/command/cmmdJwtResolver.ts
+function usableCmmdUserJwt(token) {
+	return isCmmdUserAccessJwt(token) ? token : null;
+}
+/** Log a resolver decision with session context and a fixed reason, excluding credential values. */
+function logCmmdJwtRung(context, rung, outcome, reason) {
+	return (outcome === "failed" ? require_Schema$1.logWarning : require_Schema$1.logInfo)("CMMD JWT resolver rung.", {
+		sessionId: context.sessionId,
+		subject: context.subject,
+		deviceType: context.deviceType,
+		caller: context.caller,
+		rung,
+		outcome,
+		reason
 	});
 }
+/** In-flight mints, keyed by session. */
+const inFlightMints = /* @__PURE__ */ new Map();
 /**
-* The OAuth `error` code from a refusal, lowercased, or null when there is none.
+* Collapse concurrent mints for one session into a single upstream call. A
+* mint cannot race itself into `invalid_grant` (the grant is non-rotating),
+* so this is call-rate hygiene, not correctness: two tabs observing the same
+* expiry must not both hit CMMD when one mint would do.
+*/
+function mintOnceForSession(sessionId, grantToken) {
+	return require_Schema$1.promise(() => {
+		const existing = inFlightMints.get(sessionId);
+		if (existing) return existing;
+		const pending = mintCmmdShortLivedToken(grantToken, { onCredentialRejected: () => noteCmmdCredentialRejected(sessionId) }).catch(() => null).finally(() => {
+			inFlightMints.delete(sessionId);
+		});
+		inFlightMints.set(sessionId, pending);
+		return pending;
+	});
+}
+/**
+* Resolve the CMMD REST JWT for a Forge session.
 *
-* Best effort by design: a body that is not JSON, or is already consumed, must
-* not turn a logged failure into an unlogged one. Null also reads correctly as
-* "no evidence the credential is dead", which is the safe answer for a caller
-* deciding whether to keep a refresh token.
+* Forge session auth is long-lived compared with the short-lived CMMD JWT. When
+* the session JWT expires, mint a fresh short-lived token from the session's
+* durable, non-rotating grant: CMMD answers with one forge-scoped access token
+* (TTL at most one hour) and nothing else, and minting is the entire refresh
+* story (forge#3521 contract phase). There is no rotation to fence, no
+* single-use token to single-flight, and no sibling credential to borrow.
+*
+* Fail-closed: never returns a non-user / malformed Bearer. Callers must map
+* null to CMMD_AUTH_REQUIRED and must not call CMMD upstream with a bad token.
 */
-async function readOAuthErrorCode(response) {
-	try {
-		const code = (await response.json())["error"];
-		return typeof code === "string" && code.trim().length > 0 ? code.trim().toLowerCase() : null;
-	} catch {
-		return null;
+function resolveCmmdJwtForSession({ sessionId, subject, logPrefix = "cmmd-auth", forceRefresh = false, staleAccessToken = null }) {
+	const cached = usableCmmdUserJwt(readCommandJwtForSession(sessionId));
+	if (cached && !isJwtExpiredForSession(sessionId)) {
+		if (!forceRefresh) return require_Schema$1.succeed(cached);
+		if (staleAccessToken && cached !== staleAccessToken) return require_Schema$1.succeed(cached).pipe(require_Schema$1.tap(() => require_Schema$1.gen(function* () {
+			const deviceType = yield* readClientDeviceTypeForSession(sessionId);
+			yield* logCmmdJwtRung({
+				sessionId,
+				subject: subject?.trim() || null,
+				deviceType,
+				caller: logPrefix
+			}, "cache", "skipped", "forced refresh skipped: cache already holds a token another caller minted");
+		})));
 	}
+	const normalizedSubject = subject?.trim() || null;
+	if (!normalizedSubject && !forceRefresh && readCommandSessionGrantForSession(sessionId) === null) return require_Schema$1.succeed(null);
+	return require_Schema$1.gen(function* () {
+		const context = {
+			sessionId,
+			subject: normalizedSubject,
+			deviceType: yield* readClientDeviceTypeForSession(sessionId),
+			caller: logPrefix
+		};
+		const grantToken = readCommandSessionGrantForSession(sessionId);
+		if (!grantToken) {
+			yield* logCmmdJwtRung(context, "mint", "skipped", "no session grant stored for this session");
+			return null;
+		}
+		yield* logCmmdJwtRung(context, "mint", "attempted", "minting a short-lived forge-scoped token from this session's grant");
+		yield* require_Schema$1.update(require_Schema$1.withAttributes(cmmdTokenMintTotal, metricAttributes({ outcome: "attempted" })), 1);
+		const accessToken = usableCmmdUserJwt((yield* mintOnceForSession(sessionId, grantToken))?.accessToken);
+		if (!accessToken) {
+			yield* require_Schema$1.update(require_Schema$1.withAttributes(cmmdTokenMintTotal, metricAttributes({ outcome: "failed" })), 1);
+			yield* logCmmdJwtRung(context, "mint", "failed", "CMMD token mint did not return a usable user access JWT");
+			return null;
+		}
+		yield* setCommandJwtForSession(sessionId, accessToken).pipe(require_Schema$1.ignore({ log: true }));
+		yield* require_Schema$1.update(require_Schema$1.withAttributes(cmmdTokenMintTotal, metricAttributes({ outcome: "succeeded" })), 1);
+		yield* logCmmdJwtRung(context, "mint", "succeeded", "CMMD minted a short-lived forge-scoped token");
+		return accessToken;
+	});
 }
 //#endregion
 //#region ../../packages/shared/src/cmmdSessionPop.ts
@@ -71698,10 +71627,6 @@ function resolveCmmdSessionPopSigner() {
 	cachedSigner ??= createServerSigner();
 	return cachedSigner;
 }
-/** The `pop_public_key` value to present at issuance, or null while disabled. */
-function cmmdSessionPopPublicKey() {
-	return resolveCmmdSessionPopSigner()?.publicKeyPem ?? null;
-}
 /**
 * The three proof headers for one CMMD-origin request, or no headers while
 * disabled. Each call carries a fresh nonce; never reuse the result across
@@ -71717,407 +71642,6 @@ async function cmmdSessionPopRequestHeaders(input) {
 	});
 }
 //#endregion
-//#region src/command/cmmdTokenMintLane.ts
-/**
-* The CMMD token-mint lane (forge#3518, expand phase).
-*
-* A new FIRST rung beside the legacy credential ladder: instead of rotating
-* CMMD's single-use refresh tokens, the resolver mints a short-lived
-* forge-scoped access token from the session's durable, non-rotating session
-* grant (`grant_type: forge_token_mint` on CMMD's token endpoint). The mint
-* spends nothing that cannot be spent again, so it cannot race itself into
-* `invalid_grant` the way a rotation can.
-*
-* Behind a config flag that is OFF unless explicitly enabled: production
-* keeps the legacy ladder as the only lane until this is switched on
-* deliberately. When enabled, the lane is tried before the legacy ladder;
-* every legacy rung (rotation fence, self-refresh, grant redemption,
-* bootstrap promotion, subject fallback) still exists below it unchanged and
-* still guards itself with the rejection ledger.
-*/
-/** Env var that enables the mint lane. Unset and anything but an affirmative value is off. */
-const CMMD_TOKEN_MINT_LANE_ENV = "FORGE_CMMD_TOKEN_MINT_LANE";
-const AFFIRMATIVE_VALUES = new Set([
-	"1",
-	"on",
-	"true",
-	"yes"
-]);
-/**
-* Whether the mint lane may run. Default off everywhere: a missing env var is
-* the production posture, and an opt-in flag must not half-default to on in
-* any environment a misconfigured deploy might land in.
-*/
-function isCmmdTokenMintLaneEnabled(env = process.env) {
-	const raw = env[CMMD_TOKEN_MINT_LANE_ENV]?.trim().toLowerCase();
-	return raw !== void 0 && AFFIRMATIVE_VALUES.has(raw);
-}
-//#endregion
-//#region src/command/cmmdRotationFence.ts
-/**
-* Log and count a fence application, without changing the verdict it reports.
-*
-* The two facts named in the log line are exactly the ones the predicate
-* above the caller already computed — whether this session ever deposited a
-* refresh token of its own, and (only when that was false) whether the
-* session row reads as a desktop bearer session. Neither fact nor the log
-* line changes what the caller returns.
-*/
-function logRotationFenceApplied(input) {
-	return require_Schema$1.logInfo("CMMD rotation fence applied: session may not rotate its own credential.", {
-		sessionId: input.sessionId,
-		hasStoredRefreshToken: input.hasStoredRefreshToken,
-		isDesktopBearerSession: input.isDesktopBearerSession
-	}).pipe(require_Schema$1.andThen(() => require_Schema$1.update(require_Schema$1.withAttributes(cmmdRotationFenceAppliedTotal, metricAttributes({})), 1)));
-}
-/**
-* True when Forge must not rotate this session's CMMD credentials.
-*
-* Fails closed: if the session row cannot be read, assume the fence applies.
-* Spending a token Forge had no right to spend is worse than one extra
-* reconnect.
-*/
-function isRotationFencedSession(sessionId) {
-	const hasStoredRefreshToken = readCommandRefreshTokenForSession(sessionId) !== null;
-	if (hasStoredRefreshToken) return require_Schema$1.succeed(false);
-	return isDesktopBearerAuthSession(sessionId).pipe(require_Schema$1.match({
-		onFailure: () => ({
-			fenced: true,
-			isDesktopBearerSession: null
-		}),
-		onSuccess: (isDesktopBearerSession) => ({
-			fenced: isDesktopBearerSession,
-			isDesktopBearerSession
-		})
-	}), require_Schema$1.tap(({ fenced, isDesktopBearerSession }) => fenced ? logRotationFenceApplied({
-		sessionId,
-		hasStoredRefreshToken,
-		isDesktopBearerSession
-	}) : require_Schema$1.void_), require_Schema$1.map(({ fenced }) => fenced));
-}
-//#endregion
-//#region src/cmmdConnection/cmmdCredentialRejection.ts
-/**
-* How long a recorded rejection stays usable.
-*
-* Long enough to span the resolver ladder and the response that follows it,
-* short enough that it cannot outlive the credential it describes.
-*/
-const REJECTION_TTL_MS = 6e4;
-const rejectedAt = /* @__PURE__ */ new Map();
-/** Record that CMMD refused this session's credential outright. */
-function noteCmmdCredentialRejected(sessionId) {
-	rejectedAt.set(sessionId, Date.now());
-}
-/** Whether CMMD refused this session's credential recently enough to act on. */
-function hasCmmdCredentialRejection(sessionId) {
-	const observedAt = rejectedAt.get(sessionId);
-	if (observedAt === void 0) return false;
-	if (Date.now() - observedAt <= REJECTION_TTL_MS) return true;
-	rejectedAt.delete(sessionId);
-	return false;
-}
-/** Drop a recorded rejection, once it has been acted on or superseded. */
-function forgetCmmdCredentialRejection(sessionId) {
-	rejectedAt.delete(sessionId);
-}
-/**
-* Clear a session's CMMD credentials, but only if CMMD rejected them.
-*
-* This is the only door the 401 path may use. A resolver that returned null
-* because it was not allowed to try is a policy refusal and leaves the stored
-* credential exactly where it is, so the next request can rotate it.
-*/
-const clearCmmdAuthAfterCmmdRejection = (sessionId) => require_Schema$1.gen(function* () {
-	if (!hasCmmdCredentialRejection(sessionId)) return;
-	yield* clearUnrecoverableCmmdAuthForSession(sessionId, "cmmd-rejected-credential");
-	forgetCmmdCredentialRejection(sessionId);
-});
-//#endregion
-//#region src/command/cmmdJwtResolver.ts
-function usableCmmdUserJwt(token) {
-	return isCmmdUserAccessJwt(token) ? token : null;
-}
-function storeResolvedJwt(sessionId, accessToken, refreshToken) {
-	return setCommandJwtForSession(sessionId, accessToken, refreshToken ? { refreshToken } : {}).pipe(require_Schema$1.ignore({ log: true }));
-}
-function logCmmdJwtRung(context, rung, outcome, reason, lane = "legacy") {
-	return (outcome === "failed" ? require_Schema$1.logWarning : require_Schema$1.logInfo)("CMMD JWT resolver rung.", {
-		sessionId: context.sessionId,
-		subject: context.subject,
-		deviceType: context.deviceType,
-		caller: context.caller,
-		lane,
-		rung,
-		outcome,
-		reason
-	});
-}
-function recordCmmdCredentialRefreshMetric(rung, outcome) {
-	return require_Schema$1.update(require_Schema$1.withAttributes(cmmdCredentialRefreshTotal, metricAttributes({
-		rung,
-		outcome
-	})), 1);
-}
-const inFlightRefreshes = /* @__PURE__ */ new Map();
-/** In-flight mints, keyed by session, same shape as `inFlightRefreshes`. */
-const inFlightMints = /* @__PURE__ */ new Map();
-/**
-* Collapse concurrent mints for one session into a single upstream call. A
-* mint cannot race itself into `invalid_grant` (the grant is non-rotating),
-* so this is call-rate hygiene, not correctness: two tabs observing the same
-* expiry must not both hit CMMD when one mint would do.
-*/
-function mintOnceForSession(sessionId, grantToken) {
-	return require_Schema$1.promise(() => {
-		const existing = inFlightMints.get(sessionId);
-		if (existing) return existing;
-		const pending = mintCmmdShortLivedToken(grantToken).catch(() => null).finally(() => {
-			inFlightMints.delete(sessionId);
-		});
-		inFlightMints.set(sessionId, pending);
-		return pending;
-	});
-}
-function refreshOnceForSession(sessionId, refreshToken) {
-	return require_Schema$1.promise(() => {
-		const existing = inFlightRefreshes.get(sessionId);
-		if (existing) return existing;
-		const pending = refreshCmmdJwt(refreshToken, { onCredentialRejected: () => noteCmmdCredentialRejected(sessionId) }).catch(() => null).finally(() => {
-			inFlightRefreshes.delete(sessionId);
-		});
-		inFlightRefreshes.set(sessionId, pending);
-		return pending;
-	});
-}
-/**
-* Rotate this session's **own** CMMD refresh token.
-*
-* CMMD rotates refresh tokens single-use — the presented hash is revoked inside
-* the rotation transaction (CMMD `server/jwt-auth.ts`). A session must
-* therefore only ever present the refresh token it was issued: rotating a
-* sibling session's token silently invalidates that sibling's stored copy and
-* signs it out.
-*/
-function trySelfRefresh(sessionId, context) {
-	const currentRefreshToken = readCommandRefreshTokenForSession(sessionId);
-	if (!currentRefreshToken) return logCmmdJwtRung(context, "self-refresh", "skipped", "no refresh token stored for this session").pipe(require_Schema$1.as(null));
-	return require_Schema$1.gen(function* () {
-		yield* logCmmdJwtRung(context, "self-refresh", "attempted", "rotating this session's own stored refresh token");
-		yield* recordCmmdCredentialRefreshMetric("self-refresh", "attempted");
-		const refreshed = yield* refreshOnceForSession(sessionId, currentRefreshToken);
-		const accessToken = usableCmmdUserJwt(refreshed?.accessToken);
-		if (!accessToken) {
-			yield* logCmmdJwtRung(context, "self-refresh", "failed", "CMMD refresh did not return a usable user access JWT");
-			return null;
-		}
-		yield* storeResolvedJwt(sessionId, accessToken, refreshed?.refreshToken);
-		yield* recordCmmdCredentialRefreshMetric("self-refresh", "succeeded");
-		yield* logCmmdJwtRung(context, "self-refresh", "succeeded", "CMMD rotated the stored refresh token");
-		return accessToken;
-	});
-}
-/**
-* The mint lane's rung (forge#3518, expand phase): mint a short-lived
-* forge-scoped access token from this session's durable session grant.
-*
-* Tried FIRST, before the rotation fence and the whole legacy ladder, when
-* `FORGE_CMMD_TOKEN_MINT_LANE` is on. Minting spends nothing that cannot be
-* spent again (the grant is non-rotating), so unlike the legacy rungs it is
-* safe for a session the rotation fence fences off, and it never feeds the
-* credential-rejection ledger: this rung failing says nothing about whether
-* the legacy rungs below it can still succeed.
-*
-* Only the JWT is persisted (`setCommandJwtForSession`, no refresh token):
-* the short lifetime is the expiry story, and re-minting is the refresh
-* story. A session that lives entirely on this lane accumulates no new
-* long-lived credential state beyond the grant it already had.
-*/
-function tryMintShortLivedToken(sessionId, context) {
-	const grantToken = readCommandSessionGrantForSession(sessionId);
-	if (!grantToken) return logCmmdJwtRung(context, "mint", "skipped", "no session grant stored for this session", "mint").pipe(require_Schema$1.as(null));
-	return require_Schema$1.gen(function* () {
-		yield* logCmmdJwtRung(context, "mint", "attempted", "minting a short-lived forge-scoped token from this session's grant", "mint");
-		yield* require_Schema$1.update(require_Schema$1.withAttributes(cmmdTokenMintTotal, metricAttributes({ outcome: "attempted" })), 1);
-		const accessToken = usableCmmdUserJwt((yield* mintOnceForSession(sessionId, grantToken))?.accessToken);
-		if (!accessToken) {
-			yield* logCmmdJwtRung(context, "mint", "failed", "CMMD token mint did not return a usable user access JWT", "mint");
-			return null;
-		}
-		yield* setCommandJwtForSession(sessionId, accessToken, {}).pipe(require_Schema$1.ignore({ log: true }));
-		yield* require_Schema$1.update(require_Schema$1.withAttributes(cmmdTokenMintTotal, metricAttributes({ outcome: "succeeded" })), 1);
-		yield* logCmmdJwtRung(context, "mint", "succeeded", "CMMD minted a short-lived forge-scoped token", "mint");
-		return accessToken;
-	});
-}
-/**
-* Last-resort recovery: redeem this session's durable CMMD session grant.
-*
-* A refresh token is single-use, so a session that lost a rotation — raced, or
-* stranded by a redeploy mid-flight — has no way back and the user is bounced
-* to /login. CMMD mints a long-lived, non-rotating grant at login for exactly
-* this, and redemption returns a fresh JWT, refresh token AND MCP PAT.
-*
-* Only reached after the session's own refresh has already failed, so this
-* never competes with a live rotation. The grant is not cleared on failure:
-* CMMD owns its lifetime, and a transient network failure must not throw away
-* the one credential that can still recover the session.
-*/
-function tryGrantRedemption(sessionId, context) {
-	const grantToken = readCommandSessionGrantForSession(sessionId);
-	if (!grantToken) return logCmmdJwtRung(context, "grant-redemption", "skipped", "no session grant stored for this session").pipe(require_Schema$1.as(null));
-	return require_Schema$1.gen(function* () {
-		yield* logCmmdJwtRung(context, "grant-redemption", "attempted", "redeeming this session's durable CMMD session grant");
-		yield* recordCmmdCredentialRefreshMetric("grant-redemption", "attempted");
-		const redeemed = yield* require_Schema$1.promise(() => redeemCmmdSessionGrant(grantToken, cmmdSessionPopPublicKey())).pipe(require_Schema$1.orElseSucceed(() => null));
-		const accessToken = usableCmmdUserJwt(redeemed?.accessToken);
-		if (!accessToken) {
-			yield* logCmmdJwtRung(context, "grant-redemption", "failed", "session grant redemption did not return a usable user access JWT");
-			return null;
-		}
-		if (redeemed?.mcpToken) yield* setCommandAccessTokenForSession(sessionId, redeemed.mcpToken).pipe(require_Schema$1.ignore({ log: true }));
-		yield* storeResolvedJwt(sessionId, accessToken, redeemed?.refreshToken);
-		yield* recordCmmdCredentialRefreshMetric("grant-redemption", "succeeded");
-		yield* logCmmdJwtRung(context, "grant-redemption", "succeeded", "session grant redeemed");
-		return accessToken;
-	});
-}
-/**
-* Recover using only credentials this session owns, strongest first.
-*
-* Rotating its own refresh token is preferred; the durable grant is the
-* fallback for when that rotation is already gone. Neither touches another
-* session's credentials, so this ladder is safe to run from any path.
-*/
-function tryOwnCredentialRecovery(sessionId, context) {
-	return require_Schema$1.gen(function* () {
-		const refreshed = yield* trySelfRefresh(sessionId, context);
-		if (refreshed) return refreshed;
-		return yield* tryGrantRedemption(sessionId, context);
-	});
-}
-function tryPromoteBootstrap(sessionId, subject, forceRefresh, context) {
-	if (subject !== "owner-bootstrap" && subject !== "desktop-bootstrap") return logCmmdJwtRung(context, "promote-bootstrap", "skipped", "subject is not a bootstrap subject").pipe(require_Schema$1.as(null));
-	return require_Schema$1.gen(function* () {
-		yield* logCmmdJwtRung(context, "promote-bootstrap", "attempted", "promoting the most recent owner CMMD auth to this bootstrap session");
-		yield* promoteMostRecentOwnerCommandAuthToSession(sessionId).pipe(require_Schema$1.catch_((error) => require_Schema$1.logWarning("Failed to promote owner CMMD auth for REST JWT resolution.", {
-			cause: error,
-			sessionId,
-			subject
-		})));
-		const promotedJwt = usableCmmdUserJwt(readCommandJwtForSession(sessionId));
-		if (!forceRefresh && promotedJwt && !isJwtExpiredForSession(sessionId)) {
-			yield* logCmmdJwtRung(context, "promote-bootstrap", "succeeded", "promoted owner JWT is usable");
-			return promotedJwt;
-		}
-		yield* logCmmdJwtRung(context, "promote-bootstrap", "failed", forceRefresh ? "forced refresh: a promoted JWT is never reused as-is" : "no promoted JWT available, or it is already expired");
-		return null;
-	});
-}
-/**
-* Borrow a sibling session's still-valid CMMD access JWT.
-*
-* `readMostRecentJwtForSubject` only returns a JWT that has not expired, so
-* this is a cheap read-only recovery that avoids an upstream rotation. The
-* sibling's *refresh* token is deliberately NOT copied: it is single-use and
-* must stay private to the session it was issued to (see `trySelfRefresh`).
-* Copying it is what let one expired tab sign the user out everywhere.
-*/
-function trySubjectFallback(sessionId, subject, context) {
-	return require_Schema$1.gen(function* () {
-		yield* logCmmdJwtRung(context, "subject-fallback", "attempted", "looking for a sibling session's still-valid JWT for this subject");
-		const fallbackJwt = usableCmmdUserJwt((yield* readMostRecentJwtForSubject(subject).pipe(require_Schema$1.orElseSucceed(() => null)))?.jwt);
-		if (!fallbackJwt) {
-			yield* logCmmdJwtRung(context, "subject-fallback", "failed", "no sibling session holds a still-valid JWT for this subject");
-			return null;
-		}
-		yield* storeResolvedJwt(sessionId, fallbackJwt, null);
-		yield* logCmmdJwtRung(context, "subject-fallback", "succeeded", "borrowed a sibling session's still-valid JWT");
-		return fallbackJwt;
-	});
-}
-/**
-* The rungs below the rotation fence: forced own-credential recovery,
-* bootstrap promotion, subject fallback, then own-credential recovery again
-* as the last resort. Split out of `resolveCmmdJwtForSession` so each half of
-* the ladder stays independently readable (and independently testable) —
-* the fence check above is the one decision the split does not touch.
-*/
-function runRecoveryLadder(sessionId, normalizedSubject, forceRefresh, context) {
-	return require_Schema$1.gen(function* () {
-		if (forceRefresh) {
-			const forced = yield* tryOwnCredentialRecovery(sessionId, context);
-			if (forced) return forced;
-		}
-		if (normalizedSubject) {
-			const promoted = yield* tryPromoteBootstrap(sessionId, normalizedSubject, forceRefresh, context);
-			if (promoted) return promoted;
-		}
-		if (!normalizedSubject) {
-			yield* logCmmdJwtRung(context, "cache", "failed", "no subject to resolve and forced recovery already exhausted");
-			return null;
-		}
-		if (!forceRefresh) {
-			const fallback = yield* trySubjectFallback(sessionId, normalizedSubject, context);
-			if (fallback) return fallback;
-		}
-		const recovered = yield* tryOwnCredentialRecovery(sessionId, context);
-		if (!recovered) yield* logCmmdJwtRung(context, "cache", "failed", "recovery ladder exhausted: no rung produced a usable JWT");
-		return recovered;
-	});
-}
-/**
-* Resolve the CMMD REST JWT for a Forge session.
-*
-* Forge session auth is long-lived compared with the short-lived CMMD JWT.
-* When the session JWT expires, recover by minting a fresh short-lived token
-* from the session grant (the mint lane; default-off, forge#3518), or, on
-* the legacy lane, by promoting a valid subject-level JWT or rotating the
-* stored CMMD refresh token.
-*
-* Fail-closed: never returns a non-user / malformed Bearer. Callers must map
-* null to CMMD_AUTH_REQUIRED and must not call CMMD upstream with a bad token.
-*/
-function resolveCmmdJwtForSession({ sessionId, subject, logPrefix = "cmmd-auth", forceRefresh = false, staleAccessToken = null }) {
-	const cached = usableCmmdUserJwt(readCommandJwtForSession(sessionId));
-	if (cached && !isJwtExpiredForSession(sessionId)) {
-		if (!forceRefresh) return require_Schema$1.succeed(cached);
-		if (staleAccessToken && cached !== staleAccessToken) return require_Schema$1.succeed(cached).pipe(require_Schema$1.tap(() => require_Schema$1.gen(function* () {
-			const deviceType = yield* readClientDeviceTypeForSession(sessionId);
-			yield* logCmmdJwtRung({
-				sessionId,
-				subject: subject?.trim() || null,
-				deviceType,
-				caller: logPrefix
-			}, "cache", "skipped", "forced refresh skipped: cache already holds a token another caller rotated");
-		})));
-	}
-	const normalizedSubject = subject?.trim() || null;
-	const mintLaneEnabled = isCmmdTokenMintLaneEnabled();
-	if (!normalizedSubject && !forceRefresh && !mintLaneEnabled) return require_Schema$1.succeed(null);
-	return require_Schema$1.gen(function* () {
-		const context = {
-			sessionId,
-			subject: normalizedSubject,
-			deviceType: yield* readClientDeviceTypeForSession(sessionId),
-			caller: logPrefix
-		};
-		if (mintLaneEnabled) {
-			const minted = yield* tryMintShortLivedToken(sessionId, context);
-			if (minted) return minted;
-			if (!normalizedSubject && !forceRefresh) {
-				yield* logCmmdJwtRung(context, "mint", "failed", "no subject to resolve and the mint lane produced nothing", "mint");
-				return null;
-			}
-		}
-		if (yield* isRotationFencedSession(sessionId)) {
-			yield* logCmmdJwtRung(context, "rotation-fence", "failed", "session is fenced from rotating CMMD credentials");
-			return null;
-		}
-		return yield* runRecoveryLadder(sessionId, normalizedSubject, forceRefresh, context);
-	});
-}
-//#endregion
 //#region src/cmmdData/cmmdRestProxyDeadline.ts
 var CmmdProxyTimeoutError = class extends Error {
 	status;
@@ -116357,7 +115881,7 @@ const postgresSchemaStatements = [
 	"CREATE TABLE IF NOT EXISTS projection_thread_proposed_plans (\n      plan_id TEXT PRIMARY KEY,\n      thread_id TEXT NOT NULL,\n      turn_id TEXT,\n      plan_markdown TEXT NOT NULL,\n      created_at TEXT NOT NULL,\n      updated_at TEXT NOT NULL\n    , implemented_at TEXT, implementation_thread_id TEXT)",
 	"CREATE TABLE IF NOT EXISTS auth_pairing_links (\n      id TEXT PRIMARY KEY,\n      credential TEXT NOT NULL UNIQUE,\n      method TEXT NOT NULL,\n      role TEXT NOT NULL,\n      subject TEXT NOT NULL,\n      created_at TEXT NOT NULL,\n      expires_at TEXT NOT NULL,\n      consumed_at TEXT,\n      revoked_at TEXT\n    , label TEXT, credential_lookup TEXT)",
 	"CREATE TABLE IF NOT EXISTS auth_sessions (\n      session_id TEXT PRIMARY KEY,\n      subject TEXT NOT NULL,\n      role TEXT NOT NULL,\n      method TEXT NOT NULL,\n      issued_at TEXT NOT NULL,\n      expires_at TEXT NOT NULL,\n      revoked_at TEXT\n    , client_label TEXT, client_ip_address TEXT, client_user_agent TEXT, client_device_type TEXT NOT NULL DEFAULT 'unknown', client_os TEXT, client_browser TEXT, last_connected_at TEXT)",
-	"CREATE TABLE IF NOT EXISTS command_access_tokens (\n      session_id TEXT PRIMARY KEY,\n      access_token TEXT NOT NULL,\n      created_at TEXT NOT NULL,\n      updated_at TEXT NOT NULL\n    , jwt_token TEXT, jwt_expires_at TEXT, refresh_token TEXT, cmmd_user_identity TEXT, session_grant TEXT, session_grant_expires_at TEXT)",
+	"CREATE TABLE IF NOT EXISTS command_access_tokens (\n      session_id TEXT PRIMARY KEY,\n      access_token TEXT NOT NULL,\n      created_at TEXT NOT NULL,\n      updated_at TEXT NOT NULL\n    , jwt_token TEXT, jwt_expires_at TEXT, cmmd_user_identity TEXT, session_grant TEXT, session_grant_expires_at TEXT)",
 	"CREATE TABLE IF NOT EXISTS comms_accounts (\n      id                            TEXT PRIMARY KEY,\n      provider                      TEXT NOT NULL,\n      email                         TEXT NOT NULL,\n      display_name                  TEXT,\n      composio_entity_id            TEXT NOT NULL,\n      composio_connected_account_id TEXT NOT NULL,\n      is_active                     INTEGER NOT NULL DEFAULT 1,\n      created_at                    TEXT NOT NULL,\n      updated_at                    TEXT NOT NULL\n    )",
 	"CREATE TABLE IF NOT EXISTS comms_messages (\n      id                   TEXT PRIMARY KEY,\n      provider             TEXT NOT NULL,\n      provider_message_id  TEXT NOT NULL,\n      provider_thread_id   TEXT,\n      account_id           TEXT NOT NULL REFERENCES comms_accounts(id),\n      direction            TEXT NOT NULL DEFAULT 'inbound',\n      from_address         TEXT NOT NULL,\n      from_name            TEXT,\n      to_addresses         TEXT NOT NULL DEFAULT '[]',\n      cc_addresses         TEXT,\n      subject              TEXT,\n      body_text            TEXT,\n      body_html            TEXT,\n      labels               TEXT,\n      sent_at              TEXT NOT NULL,\n      received_at          TEXT,\n      is_read              INTEGER NOT NULL DEFAULT 0,\n      is_starred           INTEGER NOT NULL DEFAULT 0,\n      has_attachments      INTEGER NOT NULL DEFAULT 0,\n      raw_payload          TEXT,\n      synced_at            TEXT NOT NULL,\n      created_at           TEXT NOT NULL,\n      updated_at           TEXT NOT NULL\n    )",
 	"CREATE TABLE IF NOT EXISTS comms_sync_cursors (\n      id                TEXT PRIMARY KEY,\n      provider          TEXT NOT NULL,\n      account_id        TEXT NOT NULL REFERENCES comms_accounts(id),\n      cursor_type       TEXT NOT NULL,\n      cursor_value      TEXT NOT NULL,\n      last_sync_at      TEXT NOT NULL,\n      last_sync_status  TEXT NOT NULL DEFAULT 'success',\n      last_error        TEXT,\n      created_at        TEXT NOT NULL,\n      updated_at        TEXT NOT NULL\n    )",
@@ -116670,7 +116194,8 @@ const postgresUpgradeMigrations = new Map([
         WHERE model_selection_json IS NULL`
 	]],
 	[77, [`ALTER TABLE projection_threads ADD COLUMN IF NOT EXISTS work_session_id TEXT`]],
-	[78, [`ALTER TABLE projection_threads ADD COLUMN IF NOT EXISTS work_session_bound_at TEXT`]]
+	[78, [`ALTER TABLE projection_threads ADD COLUMN IF NOT EXISTS work_session_bound_at TEXT`]],
+	[79, [`ALTER TABLE command_access_tokens DROP COLUMN IF EXISTS refresh_token`]]
 ]);
 function requirePostgresUpgradeStatements(version) {
 	const statements = postgresUpgradeMigrations.get(version);
@@ -116696,15 +116221,15 @@ const runPostgresMigrations = require_Schema$1.fn("runPostgresMigrations")(funct
         ORDER BY version DESC
         LIMIT 1
       `)[0]?.version ?? 0;
-		if (currentVersion > 78) return yield* require_Schema$1.die(/* @__PURE__ */ new Error(`Forge Postgres schema ${currentVersion} is newer than server schema 78.`));
+		if (currentVersion > 79) return yield* require_Schema$1.die(/* @__PURE__ */ new Error(`Forge Postgres schema ${currentVersion} is newer than server schema 79.`));
 		if (currentVersion === 0) {
 			for (const statement of postgresSchemaStatements) yield* sql.unsafe(statement);
 			yield* sql`
           INSERT INTO forge_schema_migrations (version)
-          VALUES (${78})
+          VALUES (${79})
           ON CONFLICT (version) DO NOTHING
         `;
-		} else for (let version = currentVersion + 1; version <= 78; version += 1) {
+		} else for (let version = currentVersion + 1; version <= 79; version += 1) {
 			const statements = yield* require_Schema$1.sync(() => requirePostgresUpgradeStatements(version));
 			for (const statement of statements) yield* sql.unsafe(statement);
 			yield* sql`
@@ -119513,6 +119038,26 @@ var _078_ProjectionThreadWorkSessionBoundAt_default = require_Schema$1.gen(funct
     `;
 });
 //#endregion
+//#region src/persistence/Migrations/079_DropCommandRefreshToken.ts
+/**
+* Drop the single-use CMMD refresh token from the session credential row.
+*
+* The rotation it powered is gone. forge#3518 added the CMMD mint lane, and
+* forge#3521 deleted the legacy ladder that sat beside it: the rotation fence,
+* the refresh single-flight, self-refresh, grant redemption, the subject
+* fallback, and the desktop refresh sweep. The resolver now mints a short-lived
+* JWT from the row's durable, non-rotating session grant, so a credential whose
+* every use invalidates it has nothing left to do on this row.
+*
+* Nothing is copied out first. Every surviving read of the column was deleted
+* in the same change; the value is a dead secret, and the kind of secret best
+* kept nowhere. Historical installs that ran migration 034 need this to run
+* after it, not instead of it.
+*/
+var _079_DropCommandRefreshToken_default = require_Schema$1.gen(function* () {
+	yield* (yield* require_SqlError.SqlClient)`ALTER TABLE command_access_tokens DROP COLUMN refresh_token`;
+});
+//#endregion
 //#region src/persistence/Migrations.ts
 /**
 * MigrationsLive - Migration runner with inline loader
@@ -119923,6 +119468,11 @@ const migrationEntries = [
 		78,
 		"ProjectionThreadWorkSessionBoundAt",
 		_078_ProjectionThreadWorkSessionBoundAt_default
+	],
+	[
+		79,
+		"DropCommandRefreshToken",
+		_079_DropCommandRefreshToken_default
 	]
 ];
 const makeMigrationLoader = (throughId) => fromRecord(Object.fromEntries(migrationEntries.filter(([id]) => throughId === void 0 || id <= throughId).map(([id, name, migration]) => [`${id}_${name}`, migration])));
@@ -300783,7 +300333,7 @@ function resolveBuildCommitFromEnv(env) {
 * environment descriptor down instead of reporting an honest "unknown".
 */
 function readBakedBuildCommit() {
-	return "b5d9623e21d1d5b372b4133d72c12136356d744e";
+	return "15aa06fedcdcf9e165622cf018e31ce724b98ef7";
 }
 async function resolveServerBuildCommit(input) {
 	if (isFullCommitSha(input.baked)) return input.baked;
@@ -301031,14 +300581,13 @@ function identityFromRedeemed(redeemed) {
 		username: redeemed.displayName?.trim() || `user-${redeemed.userId}`
 	};
 }
+/** Read optional display name, owner assertion, session grant, and expiry from a redeemed handoff. */
 function optionalRedeemedFields(body) {
-	const refreshToken = readTrimmedString(body.refreshToken);
 	const displayName = typeof body.displayName === "string" ? body.displayName : void 0;
 	const forgeOwnerAssertion = readTrimmedString(body.forgeOwnerAssertion);
 	const sessionGrant = readTrimmedString(body.sessionGrant);
 	const sessionGrantExpiresAt = typeof body.sessionGrantExpiresAt === "string" ? body.sessionGrantExpiresAt : void 0;
 	return {
-		...refreshToken !== void 0 ? { refreshToken } : {},
 		...displayName !== void 0 ? { displayName } : {},
 		...forgeOwnerAssertion !== void 0 ? { forgeOwnerAssertion } : {},
 		...sessionGrant !== void 0 ? { sessionGrant } : {},
@@ -301106,6 +300655,7 @@ function redeemEmbedCodeWithCmmd(code) {
 		return require_Schema$1.succeed(redeemed);
 	}));
 }
+/** Store the redeemed PAT, JWT, and identity for a local embed session, failing on write errors. */
 function persistLocalEmbedSession(input) {
 	return require_Schema$1.gen(function* () {
 		yield* setCommandAccessTokenForSession(input.sessionId, input.redeemed.mcpToken).pipe(require_Schema$1.mapError((cause) => new AuthError({
@@ -301113,7 +300663,7 @@ function persistLocalEmbedSession(input) {
 			status: 500,
 			cause
 		})));
-		yield* setCommandJwtForSession(input.sessionId, input.redeemed.accessToken, input.redeemed.refreshToken ? { refreshToken: input.redeemed.refreshToken } : {}).pipe(require_Schema$1.mapError((cause) => new AuthError({
+		yield* setCommandJwtForSession(input.sessionId, input.redeemed.accessToken).pipe(require_Schema$1.mapError((cause) => new AuthError({
 			message: "Failed to persist CMMD JWT.",
 			status: 500,
 			cause
@@ -301168,7 +300718,6 @@ const authCmmdEmbedExchangeRouteLayer = add$1("POST", "/api/auth/cmmd-embed/exch
 			accessToken: redeemed.mcpToken,
 			identity,
 			jwtToken: redeemed.accessToken,
-			refreshToken: redeemed.refreshToken,
 			sessionGrant,
 			sessionGrantExpiresAt: redeemed.sessionGrantExpiresAt
 		});
@@ -301274,7 +300823,7 @@ const cloudOwnerSessionRedeemRouteLayer = add$1("POST", "/api/auth/cloud/session
 		status: 403
 	});
 	const tokenResult = yield* redeemSessionGrantWithCmmd(payload);
-	const { tokenObj, cmmdIdentity, userId, accessToken, mcpToken, refreshToken, forgeOwnerAssertion, sessionGrantExpiresAt, isJwt, patToStore, jwtToStore } = yield* resolveCmmdTokenBundleCredentials(tokenResult);
+	const { tokenObj, cmmdIdentity, userId, accessToken, mcpToken, forgeOwnerAssertion, sessionGrantExpiresAt, isJwt, patToStore, jwtToStore } = yield* resolveCmmdTokenBundleCredentials(tokenResult);
 	if (!cmmdIdentity || !userId || !patToStore) {
 		yield* require_Schema$1.logError("Forge Cloud session redeem: CMMD token response incomplete.", {
 			clientId: payload.clientId,
@@ -301283,7 +300832,6 @@ const cloudOwnerSessionRedeemRouteLayer = add$1("POST", "/api/auth/cloud/session
 				tokenResult,
 				accessToken,
 				mcpToken,
-				refreshToken,
 				isJwt,
 				userId,
 				patToStore,
@@ -301306,7 +300854,6 @@ const cloudOwnerSessionRedeemRouteLayer = add$1("POST", "/api/auth/cloud/session
 		accessToken: patToStore,
 		identity: cmmdIdentity,
 		jwtToken: jwtToStore,
-		refreshToken,
 		sessionGrant: payload.sessionGrant,
 		sessionGrantExpiresAt
 	});