@cmmd-center/forge 0.13.14 → 0.13.15

package/dist/bin.cjs

@@ -27208,6 +27208,44 @@ function encodeCmmdRuntimeWorktreeLaunchActivityPayload(kind, payload) {
 function isCmmdRuntimeWorktreeLaunchActivityKind(kind) {
 	return WORKTREE_LAUNCH_ACTIVITY_KINDS.has(kind);
 }
+/**
+* A plan update rides the `tool_call` event kind because the forge-context
+* contract has no plan event kind, the same trade the launch rows make. The
+* steps are carried verbatim under a versioned marker so a cloud client can
+* rebuild the composer plan banner from the durable replica. (#3319)
+*/
+const CMMD_RUNTIME_PLAN_ACTIVITY_KIND = "turn.plan.updated";
+function encodeCmmdRuntimePlanActivityPayload(kind, payload) {
+	return {
+		...isRecord$23(payload) ? payload : { sourcePayload: payload },
+		forgePlanActivity: {
+			schemaVersion: 1,
+			source: "native",
+			kind
+		}
+	};
+}
+function decodeCmmdRuntimePlanActivity(payload) {
+	if (!isRecord$23(payload)) return null;
+	const metadata = payload["forgePlanActivity"];
+	if (!isRecord$23(metadata)) return null;
+	if (metadata["schemaVersion"] !== 1 || metadata["source"] !== "native" || metadata["kind"] !== "turn.plan.updated") return null;
+	const rawPlan = payload["plan"];
+	return {
+		kind: CMMD_RUNTIME_PLAN_ACTIVITY_KIND,
+		plan: Array.isArray(rawPlan) ? rawPlan.flatMap((entry) => {
+			if (!isRecord$23(entry)) return [];
+			const step = entry["step"];
+			const status = entry["status"];
+			if (typeof step !== "string" || step.trim().length === 0) return [];
+			if (status !== "pending" && status !== "inProgress" && status !== "completed") return [];
+			return [{
+				step,
+				status
+			}];
+		}) : []
+	};
+}
 //#endregion
 //#region ../../packages/contracts/src/cmmdProjectPatch.ts
 const CMMD_PROJECT_PATCH_FIELDS = {
@@ -66380,7 +66418,7 @@ function normalizeNumberish(value) {
 }
 //#endregion
 //#region package.json
-var version$1 = "0.13.14";
+var version$1 = "0.13.15";
 //#endregion
 //#region src/sentry.ts
 const SERVER_APP_NAME = "forge-server";
@@ -67260,6 +67298,121 @@ function verifyCmmdForgeCloudOwnerAssertion(token, publicKeyPem, expectedKeyId,
 	};
 }
 //#endregion
+//#region src/observability/Attributes.ts
+function isPlainObject$1(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function markSeen(value, seen) {
+	if (seen.has(value)) return true;
+	seen.add(value);
+	return false;
+}
+function normalizeJsonValue(value, seen = /* @__PURE__ */ new WeakSet()) {
+	if (value === null || value === void 0 || typeof value === "string" || typeof value === "number" || typeof value === "boolean") return value ?? null;
+	if (typeof value === "bigint") return value.toString();
+	if (value instanceof Date) return Number.isNaN(value.getTime()) ? "Invalid Date" : value.toISOString();
+	if (value instanceof Error) return {
+		name: value.name,
+		message: value.message,
+		...value.stack ? { stack: value.stack } : {}
+	};
+	if (Array.isArray(value)) {
+		if (markSeen(value, seen)) return "[Circular]";
+		return value.map((entry) => normalizeJsonValue(entry, seen));
+	}
+	if (value instanceof Map) {
+		if (markSeen(value, seen)) return "[Circular]";
+		return Object.fromEntries(Array.from(value.entries(), ([key, entryValue]) => [String(key), normalizeJsonValue(entryValue, seen)]));
+	}
+	if (value instanceof Set) {
+		if (markSeen(value, seen)) return "[Circular]";
+		return Array.from(value.values(), (entry) => normalizeJsonValue(entry, seen));
+	}
+	if (!isPlainObject$1(value)) return String(value);
+	if (markSeen(value, seen)) return "[Circular]";
+	return Object.fromEntries(Object.entries(value).map(([key, entryValue]) => [key, normalizeJsonValue(entryValue, seen)]));
+}
+function compactTraceAttributes(attributes) {
+	return Object.fromEntries(Object.entries(attributes).filter(([, value]) => value !== void 0).map(([key, value]) => [key, normalizeJsonValue(value)]));
+}
+function compactMetricAttributes(attributes) {
+	return Object.fromEntries(Object.entries(attributes).flatMap(([key, value]) => {
+		if (value === void 0 || value === null) return [];
+		if (typeof value === "string") return [[key, value]];
+		if (typeof value === "number" || typeof value === "boolean" || typeof value === "bigint") return [[key, String(value)]];
+		return [];
+	}));
+}
+function outcomeFromExit(exit) {
+	if (require_Schema$1.isSuccess(exit)) return "success";
+	return require_Schema$1.hasInterruptsOnly(exit.cause) ? "interrupt" : "failure";
+}
+function normalizeModelMetricLabel(model) {
+	const normalized = model?.trim().toLowerCase();
+	if (!normalized) return;
+	if (normalized.includes("gpt")) return "gpt";
+	if (normalized.includes("claude")) return "claude";
+	if (normalized.includes("gemini")) return "gemini";
+	return "other";
+}
+//#endregion
+//#region src/observability/Metrics.ts
+const rpcRequestsTotal = require_Schema$1.counter("t3_rpc_requests_total", { description: "Total RPC requests handled by the websocket RPC server." });
+const rpcRequestDuration = require_Schema$1.timer("t3_rpc_request_duration", { description: "RPC request handling duration." });
+const orchestrationCommandsTotal = require_Schema$1.counter("t3_orchestration_commands_total", { description: "Total orchestration commands dispatched." });
+const orchestrationCommandDuration = require_Schema$1.timer("t3_orchestration_command_duration", { description: "Orchestration command dispatch duration." });
+const orchestrationCommandAckDuration = require_Schema$1.timer("t3_orchestration_command_ack_duration", { description: "Time from orchestration command dispatch to the first committed domain event emitted for that command." });
+const orchestrationEventsProcessedTotal = require_Schema$1.counter("t3_orchestration_events_processed_total", { description: "Total orchestration intent events processed by runtime reactors." });
+const providerSessionsTotal = require_Schema$1.counter("t3_provider_sessions_total", { description: "Total provider session lifecycle operations." });
+const providerTurnsTotal = require_Schema$1.counter("t3_provider_turns_total", { description: "Total provider turn lifecycle operations." });
+const providerTurnDuration = require_Schema$1.timer("t3_provider_turn_duration", { description: "Provider turn request duration." });
+const providerRuntimeEventsTotal = require_Schema$1.counter("t3_provider_runtime_events_total", { description: "Total canonical provider runtime events processed." });
+const gitCommandsTotal = require_Schema$1.counter("t3_git_commands_total", { description: "Total git commands executed by the server runtime." });
+const gitCommandDuration = require_Schema$1.timer("t3_git_command_duration", { description: "Git command execution duration." });
+const terminalSessionsTotal = require_Schema$1.counter("t3_terminal_sessions_total", { description: "Total terminal sessions started." });
+const browserSessionsReapedTotal = require_Schema$1.counter("browser_sessions_reaped_total", { description: "Browser sessions and Chromium processes reclaimed by the orphan reaper, by reason (orphan | ttl | stale_profile)." });
+const terminalRestartsTotal = require_Schema$1.counter("t3_terminal_restarts_total", { description: "Total terminal restart requests handled." });
+const runtimeReplicationOutboxDepth = require_Schema$1.gauge("t3_runtime_replication_outbox_depth", { description: "Current runtime replication outbox items by durable state." });
+const runtimeReplicationOutboxOldestEventAge = require_Schema$1.gauge("t3_runtime_replication_outbox_oldest_event_age_seconds", { description: "Age in seconds of the oldest undelivered runtime replication payload." });
+const runtimeReplicationPublicationAttemptsTotal = require_Schema$1.counter("t3_runtime_replication_publication_attempts_total", { description: "Total canonical runtime replication publication attempts." });
+const runtimeReplicationPublicationRetriesTotal = require_Schema$1.counter("t3_runtime_replication_publication_retries_total", { description: "Total runtime replication retries scheduled after recoverable failures." });
+const runtimeReplicationPublicationLatency = require_Schema$1.timer("t3_runtime_replication_publication_latency", { description: "Time from durable enqueue to canonical CMMD acknowledgement." });
+const cmmdCredentialRefreshTotal = require_Schema$1.counter("t3_cmmd_credential_refresh_total", { description: "CMMD JWT refresh attempts for a Forge session, by rung (self-refresh | grant-redemption) and outcome (attempted | succeeded)." });
+const cmmdRotationFenceAppliedTotal = require_Schema$1.counter("t3_cmmd_rotation_fence_applied_total", { description: "Sessions Forge refused to rotate CMMD credentials for, because the rotation fence applied." });
+const cmmdCredentialRowDeletedTotal = require_Schema$1.counter("t3_cmmd_credential_row_deleted_total", { description: "command_access_tokens rows actually deleted by clearUnrecoverableCmmdAuthForSession, by reason." });
+const metricAttributes = (attributes) => Object.entries(compactMetricAttributes(attributes));
+const increment = (metric, attributes, amount = 1) => require_Schema$1.update(require_Schema$1.withAttributes(metric, metricAttributes(attributes)), amount);
+const withMetricsImpl = (effect, options) => require_Schema$1.gen(function* () {
+	const startedAt = Date.now();
+	const exit$2 = yield* require_Schema$1.exit(effect);
+	const duration = require_Schema$1.millis(Math.max(0, Date.now() - startedAt));
+	const baseAttributes = typeof options.attributes === "function" ? options.attributes() : options.attributes ?? {};
+	if (options.timer) yield* require_Schema$1.update(require_Schema$1.withAttributes(options.timer, metricAttributes(baseAttributes)), duration);
+	if (options.counter) {
+		const outcome = outcomeFromExit(exit$2);
+		yield* require_Schema$1.update(require_Schema$1.withAttributes(options.counter, metricAttributes({
+			...baseAttributes,
+			outcome,
+			...options.outcomeAttributes ? options.outcomeAttributes(outcome) : {}
+		})), 1);
+	}
+	if (require_Schema$1.isSuccess(exit$2)) return exit$2.value;
+	return yield* require_Schema$1.failCause(exit$2.cause);
+});
+const withMetrics = require_Schema$1.dual(2, withMetricsImpl);
+const providerMetricAttributes = (provider, extra) => compactMetricAttributes({
+	provider,
+	...extra
+});
+const providerTurnMetricAttributes = (input) => {
+	const modelFamily = normalizeModelMetricLabel(input.model);
+	return compactMetricAttributes({
+		provider: input.provider,
+		...modelFamily ? { modelFamily } : {},
+		...input.extra
+	});
+};
+//#endregion
 //#region src/persistence/Errors.ts
 var PersistenceSqlError = class extends require_Schema$1.TaggedErrorClass()("PersistenceSqlError", {
 	operation: require_Schema$1.String,
@@ -67950,8 +68103,14 @@ const scheduleExpiredForgeCloudOwnerCredentialMaintenance = require_Schema$1.sle
 *
 * Clearing every active owner row unconditionally (the pre-CMMD-1871 behaviour)
 * turned a single expired tab into a sign-out on every browser and device.
+*
+* Destroys a refresh token good for months, so every call is logged with a
+* `reason` naming the caller's own decision (never the credential itself) and
+* the actual row count deleted, at info level so it shows up without raising
+* the server's log level. `reason` is optional only so a caller that has not
+* been updated yet still compiles; every current caller passes one.
 */
-const clearUnrecoverableCmmdAuthForSession = (sessionId) => require_Schema$1.gen(function* () {
+const clearUnrecoverableCmmdAuthForSession = (sessionId, reason) => require_Schema$1.gen(function* () {
 	const sql = yield* require_SqlError.SqlClient;
 	const rows = yield* sql`
       DELETE FROM command_access_tokens
@@ -67976,6 +68135,14 @@ const clearUnrecoverableCmmdAuthForSession = (sessionId) => require_Schema$1.gen
     `.pipe(require_Schema$1.mapError(toPersistenceSqlError("CommandAccessTokenStore.clearUnrecoverableCmmdAuth:query")));
 	forgetCommandAccessTokenCachesForSession(sessionId);
 	for (const row of rows) forgetCommandAccessTokenCachesForSession(row.sessionId);
+	if (rows.length > 0) {
+		yield* require_Schema$1.logInfo("CMMD credential row deleted.", {
+			sessionId,
+			reason: reason ?? "unspecified",
+			rowsDeleted: rows.length
+		});
+		yield* require_Schema$1.update(require_Schema$1.withAttributes(cmmdCredentialRowDeletedTotal, metricAttributes({ reason: reason ?? "unspecified" })), rows.length);
+	}
 });
 /**
 * Retire refresh credentials copied into historical desktop bearer sessions.
@@ -68031,6 +68198,23 @@ const isDesktopBearerAuthSession = (sessionId) => require_Schema$1.gen(function*
     `.pipe(require_Schema$1.mapError(toPersistenceSqlError("CommandAccessTokenStore.isDesktopBearerSession:query")));
 	return rows[0]?.method === "bearer-session-token" && rows[0].clientDeviceType === "desktop";
 });
+/**
+* The device type a session's bearer bootstrap declared, for log lines only.
+*
+* Mirrors `isDesktopBearerAuthSession`'s read but returns the raw column
+* instead of collapsing it into a rotation verdict — a log line wants to say
+* what made the request, not whether Forge may rotate for it. Never fails:
+* an unreadable or missing row logs as `"unknown"` rather than losing the
+* decision-point log line it is attached to.
+*/
+const readClientDeviceTypeForSession = (sessionId) => require_Schema$1.gen(function* () {
+	return (yield* (yield* require_SqlError.SqlClient)`
+      SELECT client_device_type AS "clientDeviceType"
+      FROM auth_sessions
+      WHERE session_id = ${sessionId}
+      LIMIT 1
+    `.pipe(require_Schema$1.mapError(toPersistenceSqlError("CommandAccessTokenStore.readClientDeviceType:query"))))[0]?.clientDeviceType ?? "unknown";
+}).pipe(require_Schema$1.orElseSucceed(() => "unknown"));
 //#endregion
 //#region src/auth/http/oauthCookies.ts
 const OAUTH_STATE_COOKIE = "forge_oauth_state";
@@ -68233,9 +68417,21 @@ const authLogoutRouteLayer = add$1("POST", "/api/auth/logout", require_Schema$1.
 		onSuccess: (session) => session.sessionId
 	}));
 	if (sessionId) {
+		const deviceType = yield* readClientDeviceTypeForSession(sessionId);
+		yield* require_Schema$1.logInfo("Auth logout.", {
+			sessionId,
+			deviceType,
+			outcome: "session-cleared",
+			reason: cloudShell ? "forge-cloud-shell-session" : "local-session"
+		});
 		if (!cloudShell) yield* sessions.revoke(sessionId).pipe(require_Schema$1.ignore({ log: false }));
 		yield* clearCommandAccessTokenForSession(sessionId).pipe(require_Schema$1.ignore({ log: false }));
-	}
+	} else yield* require_Schema$1.logInfo("Auth logout.", {
+		sessionId: null,
+		deviceType: "unknown",
+		outcome: "no-op",
+		reason: "no authenticated session presented"
+	});
 	const secure = shouldUseSecureCookie(forgePublicUrlForRequest(request));
 	let response = yield* require_HttpServer.jsonUnsafe({ loggedOut: true }, { status: 200 }).pipe(require_HttpServer.setCookie(sessions.cookieName, "", {
 		expires: /* @__PURE__ */ new Date(0),
@@ -68834,16 +69030,32 @@ const authCommandBearerBootstrapRouteLayer = add$1("POST", "/api/auth/bootstrap/
 	if (limited) return limited;
 	const serverAuth = yield* ServerAuth;
 	const sessions = yield* SessionCredentialService;
-	if (serverAuth.isForgeCloudShell?.() === true) return yield* new AuthError({
-		message: "Forge Cloud accepts owner assertions from CMMD only.",
-		status: 403
-	});
+	if (serverAuth.isForgeCloudShell?.() === true) {
+		yield* require_Schema$1.logWarning("CMMD bearer bootstrap failed.", {
+			deviceType: "unknown",
+			outcome: "failed",
+			reason: "forge-cloud-shell-rejects-non-cmmd-bootstrap"
+		});
+		return yield* new AuthError({
+			message: "Forge Cloud accepts owner assertions from CMMD only.",
+			status: 403
+		});
+	}
 	const payload = yield* require_HttpServer.schemaBodyJson(CommandBootstrapInput).pipe(require_Schema$1.mapError((cause) => new AuthError({
 		message: "Invalid CMMD OAuth bearer bootstrap payload.",
 		status: 400,
 		cause
+	})), require_Schema$1.tapError(() => require_Schema$1.logWarning("CMMD bearer bootstrap failed.", {
+		deviceType: "unknown",
+		outcome: "failed",
+		reason: "invalid-payload"
+	})));
+	const deviceType = payload.clientDeviceType ?? "desktop";
+	const validated = yield* validateCommandBootstrapPayload(payload).pipe(require_Schema$1.tapError(() => require_Schema$1.logWarning("CMMD bearer bootstrap failed.", {
+		deviceType,
+		outcome: "failed",
+		reason: "invalid-command-bootstrap-payload"
 	})));
-	const validated = yield* validateCommandBootstrapPayload(payload);
 	const sessionSubject = resolveCommandOAuthSubject(validated.subjectUserId);
 	const issued = yield* sessions.issue({
 		method: "bearer-session-token",
@@ -68856,20 +69068,34 @@ const authCommandBearerBootstrapRouteLayer = add$1("POST", "/api/auth/bootstrap/
 	}).pipe(require_Schema$1.mapError((cause) => new AuthError({
 		message: "Failed to issue authenticated bearer session.",
 		cause
+	})), require_Schema$1.tapError(() => require_Schema$1.logWarning("CMMD bearer bootstrap failed.", {
+		deviceType,
+		outcome: "failed",
+		reason: "session-issuance-failed"
 	})));
 	const cmmdIdentity = yield* persistCommandBootstrapSessionArtifacts({
 		sessionId: issued.sessionId,
 		payload,
 		cmmdIdentity: validated.cmmdIdentity
 	});
-	if ((payload.clientDeviceType ?? "desktop") === "desktop" && !payload.refreshToken?.trim()) yield* clearDesktopBearerRefreshTokensForSubject({
+	if (deviceType === "desktop" && !payload.refreshToken?.trim()) yield* clearDesktopBearerRefreshTokensForSubject({
 		subject: sessionSubject,
 		clientUserAgent: request.headers["user-agent"]
 	}).pipe(require_Schema$1.mapError((cause) => new AuthError({
 		message: "Failed to retire legacy desktop refresh credentials.",
 		status: 500,
 		cause
+	})), require_Schema$1.tapError(() => require_Schema$1.logWarning("CMMD bearer bootstrap failed.", {
+		sessionId: issued.sessionId,
+		deviceType,
+		outcome: "failed",
+		reason: "legacy-desktop-refresh-retirement-failed"
 	})));
+	yield* require_Schema$1.logInfo("CMMD bearer bootstrap succeeded.", {
+		sessionId: issued.sessionId,
+		deviceType,
+		outcome: "succeeded"
+	});
 	return require_HttpServer.jsonUnsafe({
 		authenticated: true,
 		role: issued.role,
@@ -70177,64 +70403,6 @@ function parseAttachmentIdFromRelativePath(relativePath) {
 	return id.length > 0 && !id.includes(".") ? id : null;
 }
 //#endregion
-//#region src/observability/Attributes.ts
-function isPlainObject$1(value) {
-	return typeof value === "object" && value !== null && !Array.isArray(value);
-}
-function markSeen(value, seen) {
-	if (seen.has(value)) return true;
-	seen.add(value);
-	return false;
-}
-function normalizeJsonValue(value, seen = /* @__PURE__ */ new WeakSet()) {
-	if (value === null || value === void 0 || typeof value === "string" || typeof value === "number" || typeof value === "boolean") return value ?? null;
-	if (typeof value === "bigint") return value.toString();
-	if (value instanceof Date) return Number.isNaN(value.getTime()) ? "Invalid Date" : value.toISOString();
-	if (value instanceof Error) return {
-		name: value.name,
-		message: value.message,
-		...value.stack ? { stack: value.stack } : {}
-	};
-	if (Array.isArray(value)) {
-		if (markSeen(value, seen)) return "[Circular]";
-		return value.map((entry) => normalizeJsonValue(entry, seen));
-	}
-	if (value instanceof Map) {
-		if (markSeen(value, seen)) return "[Circular]";
-		return Object.fromEntries(Array.from(value.entries(), ([key, entryValue]) => [String(key), normalizeJsonValue(entryValue, seen)]));
-	}
-	if (value instanceof Set) {
-		if (markSeen(value, seen)) return "[Circular]";
-		return Array.from(value.values(), (entry) => normalizeJsonValue(entry, seen));
-	}
-	if (!isPlainObject$1(value)) return String(value);
-	if (markSeen(value, seen)) return "[Circular]";
-	return Object.fromEntries(Object.entries(value).map(([key, entryValue]) => [key, normalizeJsonValue(entryValue, seen)]));
-}
-function compactTraceAttributes(attributes) {
-	return Object.fromEntries(Object.entries(attributes).filter(([, value]) => value !== void 0).map(([key, value]) => [key, normalizeJsonValue(value)]));
-}
-function compactMetricAttributes(attributes) {
-	return Object.fromEntries(Object.entries(attributes).flatMap(([key, value]) => {
-		if (value === void 0 || value === null) return [];
-		if (typeof value === "string") return [[key, value]];
-		if (typeof value === "number" || typeof value === "boolean" || typeof value === "bigint") return [[key, String(value)]];
-		return [];
-	}));
-}
-function outcomeFromExit(exit) {
-	if (require_Schema$1.isSuccess(exit)) return "success";
-	return require_Schema$1.hasInterruptsOnly(exit.cause) ? "interrupt" : "failure";
-}
-function normalizeModelMetricLabel(model) {
-	const normalized = model?.trim().toLowerCase();
-	if (!normalized) return;
-	if (normalized.includes("gpt")) return "gpt";
-	if (normalized.includes("claude")) return "claude";
-	if (normalized.includes("gemini")) return "gemini";
-	return "other";
-}
-//#endregion
 //#region src/observability/TraceRecord.ts
 function formatTraceExit(exit) {
 	if (require_Schema$1.isSuccess(exit)) return { _tag: "Success" };
@@ -71297,6 +71465,22 @@ async function readOAuthErrorCode(response) {
 //#endregion
 //#region src/command/cmmdRotationFence.ts
 /**
+* Log and count a fence application, without changing the verdict it reports.
+*
+* The two facts named in the log line are exactly the ones the predicate
+* above the caller already computed — whether this session ever deposited a
+* refresh token of its own, and (only when that was false) whether the
+* session row reads as a desktop bearer session. Neither fact nor the log
+* line changes what the caller returns.
+*/
+function logRotationFenceApplied(input) {
+	return require_Schema$1.logInfo("CMMD rotation fence applied: session may not rotate its own credential.", {
+		sessionId: input.sessionId,
+		hasStoredRefreshToken: input.hasStoredRefreshToken,
+		isDesktopBearerSession: input.isDesktopBearerSession
+	}).pipe(require_Schema$1.andThen(() => require_Schema$1.update(require_Schema$1.withAttributes(cmmdRotationFenceAppliedTotal, metricAttributes({})), 1)));
+}
+/**
 * True when Forge must not rotate this session's CMMD credentials.
 *
 * Fails closed: if the session row cannot be read, assume the fence applies.
@@ -71304,8 +71488,22 @@ async function readOAuthErrorCode(response) {
 * reconnect.
 */
 function isRotationFencedSession(sessionId) {
-	if (readCommandRefreshTokenForSession(sessionId)) return require_Schema$1.succeed(false);
-	return isDesktopBearerAuthSession(sessionId).pipe(require_Schema$1.orElseSucceed(() => true));
+	const hasStoredRefreshToken = readCommandRefreshTokenForSession(sessionId) !== null;
+	if (hasStoredRefreshToken) return require_Schema$1.succeed(false);
+	return isDesktopBearerAuthSession(sessionId).pipe(require_Schema$1.match({
+		onFailure: () => ({
+			fenced: true,
+			isDesktopBearerSession: null
+		}),
+		onSuccess: (isDesktopBearerSession) => ({
+			fenced: isDesktopBearerSession,
+			isDesktopBearerSession
+		})
+	}), require_Schema$1.tap(({ fenced, isDesktopBearerSession }) => fenced ? logRotationFenceApplied({
+		sessionId,
+		hasStoredRefreshToken,
+		isDesktopBearerSession
+	}) : require_Schema$1.void_), require_Schema$1.map(({ fenced }) => fenced));
 }
 //#endregion
 //#region src/cmmdConnection/cmmdCredentialRejection.ts
@@ -71342,7 +71540,7 @@ function forgetCmmdCredentialRejection(sessionId) {
 */
 const clearCmmdAuthAfterCmmdRejection = (sessionId) => require_Schema$1.gen(function* () {
 	if (!hasCmmdCredentialRejection(sessionId)) return;
-	yield* clearUnrecoverableCmmdAuthForSession(sessionId);
+	yield* clearUnrecoverableCmmdAuthForSession(sessionId, "cmmd-rejected-credential");
 	forgetCmmdCredentialRejection(sessionId);
 });
 //#endregion
@@ -71353,6 +71551,23 @@ function usableCmmdUserJwt(token) {
 function storeResolvedJwt(sessionId, accessToken, refreshToken) {
 	return setCommandJwtForSession(sessionId, accessToken, refreshToken ? { refreshToken } : {}).pipe(require_Schema$1.ignore({ log: true }));
 }
+function logCmmdJwtRung(context, rung, outcome, reason) {
+	return (outcome === "failed" ? require_Schema$1.logWarning : require_Schema$1.logInfo)("CMMD JWT resolver rung.", {
+		sessionId: context.sessionId,
+		subject: context.subject,
+		deviceType: context.deviceType,
+		caller: context.caller,
+		rung,
+		outcome,
+		reason
+	});
+}
+function recordCmmdCredentialRefreshMetric(rung, outcome) {
+	return require_Schema$1.update(require_Schema$1.withAttributes(cmmdCredentialRefreshTotal, metricAttributes({
+		rung,
+		outcome
+	})), 1);
+}
 const inFlightRefreshes = /* @__PURE__ */ new Map();
 function refreshOnceForSession(sessionId, refreshToken) {
 	return require_Schema$1.promise(() => {
@@ -71374,15 +71589,21 @@ function refreshOnceForSession(sessionId, refreshToken) {
 * sibling session's token silently invalidates that sibling's stored copy and
 * signs it out.
 */
-function trySelfRefresh(sessionId, logPrefix) {
+function trySelfRefresh(sessionId, context) {
 	const currentRefreshToken = readCommandRefreshTokenForSession(sessionId);
-	if (!currentRefreshToken) return require_Schema$1.succeed(null);
+	if (!currentRefreshToken) return logCmmdJwtRung(context, "self-refresh", "skipped", "no refresh token stored for this session").pipe(require_Schema$1.as(null));
 	return require_Schema$1.gen(function* () {
+		yield* logCmmdJwtRung(context, "self-refresh", "attempted", "rotating this session's own stored refresh token");
+		yield* recordCmmdCredentialRefreshMetric("self-refresh", "attempted");
 		const refreshed = yield* refreshOnceForSession(sessionId, currentRefreshToken);
 		const accessToken = usableCmmdUserJwt(refreshed?.accessToken);
-		if (!accessToken) return null;
+		if (!accessToken) {
+			yield* logCmmdJwtRung(context, "self-refresh", "failed", "CMMD refresh did not return a usable user access JWT");
+			return null;
+		}
 		yield* storeResolvedJwt(sessionId, accessToken, refreshed?.refreshToken);
-		console.log(`[${logPrefix}] CMMD JWT refreshed for session ${sessionId}`);
+		yield* recordCmmdCredentialRefreshMetric("self-refresh", "succeeded");
+		yield* logCmmdJwtRung(context, "self-refresh", "succeeded", "CMMD rotated the stored refresh token");
 		return accessToken;
 	});
 }
@@ -71399,16 +71620,22 @@ function trySelfRefresh(sessionId, logPrefix) {
 * CMMD owns its lifetime, and a transient network failure must not throw away
 * the one credential that can still recover the session.
 */
-function tryGrantRedemption(sessionId, logPrefix) {
+function tryGrantRedemption(sessionId, context) {
 	const grantToken = readCommandSessionGrantForSession(sessionId);
-	if (!grantToken) return require_Schema$1.succeed(null);
+	if (!grantToken) return logCmmdJwtRung(context, "grant-redemption", "skipped", "no session grant stored for this session").pipe(require_Schema$1.as(null));
 	return require_Schema$1.gen(function* () {
+		yield* logCmmdJwtRung(context, "grant-redemption", "attempted", "redeeming this session's durable CMMD session grant");
+		yield* recordCmmdCredentialRefreshMetric("grant-redemption", "attempted");
 		const redeemed = yield* require_Schema$1.promise(() => redeemCmmdSessionGrant(grantToken)).pipe(require_Schema$1.orElseSucceed(() => null));
 		const accessToken = usableCmmdUserJwt(redeemed?.accessToken);
-		if (!accessToken) return null;
+		if (!accessToken) {
+			yield* logCmmdJwtRung(context, "grant-redemption", "failed", "session grant redemption did not return a usable user access JWT");
+			return null;
+		}
 		if (redeemed?.mcpToken) yield* setCommandAccessTokenForSession(sessionId, redeemed.mcpToken).pipe(require_Schema$1.ignore({ log: true }));
 		yield* storeResolvedJwt(sessionId, accessToken, redeemed?.refreshToken);
-		console.log(`[${logPrefix}] CMMD credentials recovered via session grant for ${sessionId}`);
+		yield* recordCmmdCredentialRefreshMetric("grant-redemption", "succeeded");
+		yield* logCmmdJwtRung(context, "grant-redemption", "succeeded", "session grant redeemed");
 		return accessToken;
 	});
 }
@@ -71419,23 +71646,28 @@ function tryGrantRedemption(sessionId, logPrefix) {
 * fallback for when that rotation is already gone. Neither touches another
 * session's credentials, so this ladder is safe to run from any path.
 */
-function tryOwnCredentialRecovery(sessionId, logPrefix) {
+function tryOwnCredentialRecovery(sessionId, context) {
 	return require_Schema$1.gen(function* () {
-		const refreshed = yield* trySelfRefresh(sessionId, logPrefix);
+		const refreshed = yield* trySelfRefresh(sessionId, context);
 		if (refreshed) return refreshed;
-		return yield* tryGrantRedemption(sessionId, logPrefix);
+		return yield* tryGrantRedemption(sessionId, context);
 	});
 }
-function tryPromoteBootstrap(sessionId, subject, forceRefresh) {
-	if (subject !== "owner-bootstrap" && subject !== "desktop-bootstrap") return require_Schema$1.succeed(null);
+function tryPromoteBootstrap(sessionId, subject, forceRefresh, context) {
+	if (subject !== "owner-bootstrap" && subject !== "desktop-bootstrap") return logCmmdJwtRung(context, "promote-bootstrap", "skipped", "subject is not a bootstrap subject").pipe(require_Schema$1.as(null));
 	return require_Schema$1.gen(function* () {
+		yield* logCmmdJwtRung(context, "promote-bootstrap", "attempted", "promoting the most recent owner CMMD auth to this bootstrap session");
 		yield* promoteMostRecentOwnerCommandAuthToSession(sessionId).pipe(require_Schema$1.catch_((error) => require_Schema$1.logWarning("Failed to promote owner CMMD auth for REST JWT resolution.", {
 			cause: error,
 			sessionId,
 			subject
 		})));
 		const promotedJwt = usableCmmdUserJwt(readCommandJwtForSession(sessionId));
-		if (!forceRefresh && promotedJwt && !isJwtExpiredForSession(sessionId)) return promotedJwt;
+		if (!forceRefresh && promotedJwt && !isJwtExpiredForSession(sessionId)) {
+			yield* logCmmdJwtRung(context, "promote-bootstrap", "succeeded", "promoted owner JWT is usable");
+			return promotedJwt;
+		}
+		yield* logCmmdJwtRung(context, "promote-bootstrap", "failed", forceRefresh ? "forced refresh: a promoted JWT is never reused as-is" : "no promoted JWT available, or it is already expired");
 		return null;
 	});
 }
@@ -71448,17 +71680,50 @@ function tryPromoteBootstrap(sessionId, subject, forceRefresh) {
 * must stay private to the session it was issued to (see `trySelfRefresh`).
 * Copying it is what let one expired tab sign the user out everywhere.
 */
-function trySubjectFallback(sessionId, subject, logPrefix) {
+function trySubjectFallback(sessionId, subject, context) {
 	return require_Schema$1.gen(function* () {
-		const fallback = yield* readMostRecentJwtForSubject(subject).pipe(require_Schema$1.orElseSucceed(() => null));
-		const fallbackJwt = usableCmmdUserJwt(fallback?.jwt);
-		if (!fallbackJwt) return null;
+		yield* logCmmdJwtRung(context, "subject-fallback", "attempted", "looking for a sibling session's still-valid JWT for this subject");
+		const fallbackJwt = usableCmmdUserJwt((yield* readMostRecentJwtForSubject(subject).pipe(require_Schema$1.orElseSucceed(() => null)))?.jwt);
+		if (!fallbackJwt) {
+			yield* logCmmdJwtRung(context, "subject-fallback", "failed", "no sibling session holds a still-valid JWT for this subject");
+			return null;
+		}
 		yield* storeResolvedJwt(sessionId, fallbackJwt, null);
-		console.log(`[${logPrefix}] JWT subject-fallback promoted for session ${sessionId} (owner: ${fallback?.sessionId})`);
+		yield* logCmmdJwtRung(context, "subject-fallback", "succeeded", "borrowed a sibling session's still-valid JWT");
 		return fallbackJwt;
 	});
 }
 /**
+* The rungs below the rotation fence: forced own-credential recovery,
+* bootstrap promotion, subject fallback, then own-credential recovery again
+* as the last resort. Split out of `resolveCmmdJwtForSession` so each half of
+* the ladder stays independently readable (and independently testable) —
+* the fence check above is the one decision the split does not touch.
+*/
+function runRecoveryLadder(sessionId, normalizedSubject, forceRefresh, context) {
+	return require_Schema$1.gen(function* () {
+		if (forceRefresh) {
+			const forced = yield* tryOwnCredentialRecovery(sessionId, context);
+			if (forced) return forced;
+		}
+		if (normalizedSubject) {
+			const promoted = yield* tryPromoteBootstrap(sessionId, normalizedSubject, forceRefresh, context);
+			if (promoted) return promoted;
+		}
+		if (!normalizedSubject) {
+			yield* logCmmdJwtRung(context, "cache", "failed", "no subject to resolve and forced recovery already exhausted");
+			return null;
+		}
+		if (!forceRefresh) {
+			const fallback = yield* trySubjectFallback(sessionId, normalizedSubject, context);
+			if (fallback) return fallback;
+		}
+		const recovered = yield* tryOwnCredentialRecovery(sessionId, context);
+		if (!recovered) yield* logCmmdJwtRung(context, "cache", "failed", "recovery ladder exhausted: no rung produced a usable JWT");
+		return recovered;
+	});
+}
+/**
 * Resolve the CMMD REST JWT for a Forge session.
 *
 * Forge session auth is long-lived compared with the short-lived CMMD JWT.
@@ -71472,26 +71737,30 @@ function resolveCmmdJwtForSession({ sessionId, subject, logPrefix = "cmmd-auth",
 	const cached = usableCmmdUserJwt(readCommandJwtForSession(sessionId));
 	if (cached && !isJwtExpiredForSession(sessionId)) {
 		if (!forceRefresh) return require_Schema$1.succeed(cached);
-		if (staleAccessToken && cached !== staleAccessToken) return require_Schema$1.succeed(cached);
+		if (staleAccessToken && cached !== staleAccessToken) return require_Schema$1.succeed(cached).pipe(require_Schema$1.tap(() => require_Schema$1.gen(function* () {
+			const deviceType = yield* readClientDeviceTypeForSession(sessionId);
+			yield* logCmmdJwtRung({
+				sessionId,
+				subject: subject?.trim() || null,
+				deviceType,
+				caller: logPrefix
+			}, "cache", "skipped", "forced refresh skipped: cache already holds a token another caller rotated");
+		})));
 	}
 	const normalizedSubject = subject?.trim() || null;
 	if (!normalizedSubject && !forceRefresh) return require_Schema$1.succeed(null);
 	return require_Schema$1.gen(function* () {
-		if (yield* isRotationFencedSession(sessionId)) return null;
-		if (forceRefresh) {
-			const forced = yield* tryOwnCredentialRecovery(sessionId, logPrefix);
-			if (forced) return forced;
-		}
-		if (normalizedSubject) {
-			const promoted = yield* tryPromoteBootstrap(sessionId, normalizedSubject, forceRefresh);
-			if (promoted) return promoted;
-		}
-		if (!normalizedSubject) return null;
-		if (!forceRefresh) {
-			const fallback = yield* trySubjectFallback(sessionId, normalizedSubject, logPrefix);
-			if (fallback) return fallback;
+		const context = {
+			sessionId,
+			subject: normalizedSubject,
+			deviceType: yield* readClientDeviceTypeForSession(sessionId),
+			caller: logPrefix
+		};
+		if (yield* isRotationFencedSession(sessionId)) {
+			yield* logCmmdJwtRung(context, "rotation-fence", "failed", "session is fenced from rotating CMMD credentials");
+			return null;
 		}
-		return yield* tryOwnCredentialRecovery(sessionId, logPrefix);
+		return yield* runRecoveryLadder(sessionId, normalizedSubject, forceRefresh, context);
 	});
 }
 //#endregion
@@ -72228,9 +72497,14 @@ function buildProxyErrorResponse(error) {
 * warning rather than failing the request if the clear itself errors — a
 * session that already has no usable credential must still get its 401,
 * not a 500 from a failed best-effort cleanup.
+*
+* Reached only after CMMD itself rejected the request with both the original
+* and (if retried) the refreshed JWT, so — unlike `respondCmmdConnectionRequired`
+* below — this always deletes the row. `clearUnrecoverableCmmdAuthForSession`
+* logs the row count and the reason itself; this only names the reason.
 */
 function clearCmmdAuthAfterFailure(sessionId) {
-	return clearUnrecoverableCmmdAuthForSession(sessionId).pipe(require_Schema$1.catch_((error) => require_Schema$1.logWarning("Failed to clear unrecoverable CMMD auth after CMMD auth failure.", {
+	return clearUnrecoverableCmmdAuthForSession(sessionId, "cmmd-proxy-auth-error").pipe(require_Schema$1.catch_((error) => require_Schema$1.logWarning("Failed to clear unrecoverable CMMD auth after CMMD auth failure.", {
 		cause: error,
 		sessionId
 	})));
@@ -72251,7 +72525,7 @@ function clearCmmdAuthAfterFailure(sessionId) {
 * refused the credential, which `clearCmmdAuthAfterCmmdRejection` checks.
 */
 function respondCmmdConnectionRequired(sessionId) {
-	return clearCmmdAuthAfterCmmdRejection(sessionId).pipe(require_Schema$1.catch_((error) => require_Schema$1.logWarning("Failed to clear CMMD auth that CMMD itself rejected.", {
+	return require_Schema$1.logInfo("CMMD proxy request answered CMMD_AUTH_REQUIRED.", { sessionId }).pipe(require_Schema$1.andThen(() => clearCmmdAuthAfterCmmdRejection(sessionId)), require_Schema$1.catch_((error) => require_Schema$1.logWarning("Failed to clear CMMD auth that CMMD itself rejected.", {
 		cause: error,
 		sessionId
 	})), require_Schema$1.as(buildProxyErrorResponse(new CmmdProxyAuthenticationRequiredError("CMMD connection required. Reconnect CMMD to continue."))));
@@ -95034,60 +95308,6 @@ const dispatchBootstrapTurnStart = (input, command) => require_Schema$1.gen(func
 */
 var OrchestrationEngineService = class extends require_Schema$1.Service()("forge/orchestration/Services/OrchestrationEngine/OrchestrationEngineService") {};
 //#endregion
-//#region src/observability/Metrics.ts
-const rpcRequestsTotal = require_Schema$1.counter("t3_rpc_requests_total", { description: "Total RPC requests handled by the websocket RPC server." });
-const rpcRequestDuration = require_Schema$1.timer("t3_rpc_request_duration", { description: "RPC request handling duration." });
-const orchestrationCommandsTotal = require_Schema$1.counter("t3_orchestration_commands_total", { description: "Total orchestration commands dispatched." });
-const orchestrationCommandDuration = require_Schema$1.timer("t3_orchestration_command_duration", { description: "Orchestration command dispatch duration." });
-const orchestrationCommandAckDuration = require_Schema$1.timer("t3_orchestration_command_ack_duration", { description: "Time from orchestration command dispatch to the first committed domain event emitted for that command." });
-const orchestrationEventsProcessedTotal = require_Schema$1.counter("t3_orchestration_events_processed_total", { description: "Total orchestration intent events processed by runtime reactors." });
-const providerSessionsTotal = require_Schema$1.counter("t3_provider_sessions_total", { description: "Total provider session lifecycle operations." });
-const providerTurnsTotal = require_Schema$1.counter("t3_provider_turns_total", { description: "Total provider turn lifecycle operations." });
-const providerTurnDuration = require_Schema$1.timer("t3_provider_turn_duration", { description: "Provider turn request duration." });
-const providerRuntimeEventsTotal = require_Schema$1.counter("t3_provider_runtime_events_total", { description: "Total canonical provider runtime events processed." });
-const gitCommandsTotal = require_Schema$1.counter("t3_git_commands_total", { description: "Total git commands executed by the server runtime." });
-const gitCommandDuration = require_Schema$1.timer("t3_git_command_duration", { description: "Git command execution duration." });
-const terminalSessionsTotal = require_Schema$1.counter("t3_terminal_sessions_total", { description: "Total terminal sessions started." });
-const browserSessionsReapedTotal = require_Schema$1.counter("browser_sessions_reaped_total", { description: "Browser sessions and Chromium processes reclaimed by the orphan reaper, by reason (orphan | ttl | stale_profile)." });
-const terminalRestartsTotal = require_Schema$1.counter("t3_terminal_restarts_total", { description: "Total terminal restart requests handled." });
-const runtimeReplicationOutboxDepth = require_Schema$1.gauge("t3_runtime_replication_outbox_depth", { description: "Current runtime replication outbox items by durable state." });
-const runtimeReplicationOutboxOldestEventAge = require_Schema$1.gauge("t3_runtime_replication_outbox_oldest_event_age_seconds", { description: "Age in seconds of the oldest undelivered runtime replication payload." });
-const runtimeReplicationPublicationAttemptsTotal = require_Schema$1.counter("t3_runtime_replication_publication_attempts_total", { description: "Total canonical runtime replication publication attempts." });
-const runtimeReplicationPublicationRetriesTotal = require_Schema$1.counter("t3_runtime_replication_publication_retries_total", { description: "Total runtime replication retries scheduled after recoverable failures." });
-const runtimeReplicationPublicationLatency = require_Schema$1.timer("t3_runtime_replication_publication_latency", { description: "Time from durable enqueue to canonical CMMD acknowledgement." });
-const metricAttributes = (attributes) => Object.entries(compactMetricAttributes(attributes));
-const increment = (metric, attributes, amount = 1) => require_Schema$1.update(require_Schema$1.withAttributes(metric, metricAttributes(attributes)), amount);
-const withMetricsImpl = (effect, options) => require_Schema$1.gen(function* () {
-	const startedAt = Date.now();
-	const exit$2 = yield* require_Schema$1.exit(effect);
-	const duration = require_Schema$1.millis(Math.max(0, Date.now() - startedAt));
-	const baseAttributes = typeof options.attributes === "function" ? options.attributes() : options.attributes ?? {};
-	if (options.timer) yield* require_Schema$1.update(require_Schema$1.withAttributes(options.timer, metricAttributes(baseAttributes)), duration);
-	if (options.counter) {
-		const outcome = outcomeFromExit(exit$2);
-		yield* require_Schema$1.update(require_Schema$1.withAttributes(options.counter, metricAttributes({
-			...baseAttributes,
-			outcome,
-			...options.outcomeAttributes ? options.outcomeAttributes(outcome) : {}
-		})), 1);
-	}
-	if (require_Schema$1.isSuccess(exit$2)) return exit$2.value;
-	return yield* require_Schema$1.failCause(exit$2.cause);
-});
-const withMetrics = require_Schema$1.dual(2, withMetricsImpl);
-const providerMetricAttributes = (provider, extra) => compactMetricAttributes({
-	provider,
-	...extra
-});
-const providerTurnMetricAttributes = (input) => {
-	const modelFamily = normalizeModelMetricLabel(input.model);
-	return compactMetricAttributes({
-		provider: input.provider,
-		...modelFamily ? { modelFamily } : {},
-		...input.extra
-	});
-};
-//#endregion
 //#region src/observability/RpcInstrumentation.ts
 const annotateRpcSpan = (method, traceAttributes) => require_Schema$1.annotateCurrentSpan({
 	"rpc.method": method,
@@ -98299,6 +98519,28 @@ function serializeWorktreeLaunchActivity(activity) {
 function decodeWorktreeLaunchActivityKind(kind) {
 	return isCmmdRuntimeWorktreeLaunchActivityKind(kind) ? kind : null;
 }
+function planStepsOf(activity) {
+	const decoded = decodeCmmdRuntimePlanActivity(encodeCmmdRuntimePlanActivityPayload(activity.kind, activity.payload));
+	return decoded !== null && decoded.plan.length > 0 ? decoded.plan : null;
+}
+function serializePlanActivity(activity) {
+	if (activity.kind !== "turn.plan.updated") return null;
+	const plan = planStepsOf(activity);
+	if (plan === null) return null;
+	const completed = plan.filter((step) => step.status === "completed").length;
+	return {
+		sourceSequence: null,
+		event: {
+			eventId: `activity:${activity.id}`,
+			occurredAt: canonicalRuntimeEventTimestamp(activity.createdAt),
+			...eventTurn(activity.turnId),
+			kind: "tool_call",
+			summary: `Plan: ${completed} of ${plan.length} steps done`,
+			status: "completed",
+			payload: encodeCmmdRuntimePlanActivityPayload(activity.kind, activity.payload)
+		}
+	};
+}
 function isReplicatedFailureActivity(activity) {
 	return activity.kind === "runtime.error" || activity.kind.startsWith("provider.") && activity.kind.endsWith(".failed");
 }
@@ -98683,6 +98925,10 @@ function serializeRuntimeThreadEvents(thread) {
 		const event = serializeWorktreeLaunchActivity(activity);
 		return event === null ? [] : [event];
 	});
+	const planActivities = thread.activities.flatMap((activity) => {
+		const event = serializePlanActivity(activity);
+		return event === null ? [] : [event];
+	});
 	const recordedTurns = serializeRecordedTurns(thread);
 	const textGenerations = serializeTextGenerations(thread);
 	return [
@@ -98690,6 +98936,7 @@ function serializeRuntimeThreadEvents(thread) {
 		...replicaActivities,
 		...toolActivities,
 		...worktreeLaunchActivities,
+		...planActivities,
 		...failureActivities,
 		...recordedTurns,
 		...textGenerations
@@ -292807,7 +293054,7 @@ const make$8 = require_Schema$1.gen(function* () {
 				summary: "Provider turn start failed",
 				detail: `User message '${event.payload.messageId}' was not found for turn start request.`,
 				turnId: null,
-				createdAt: event.payload.createdAt
+				createdAt: (/* @__PURE__ */ new Date()).toISOString()
 			});
 			return;
 		}
@@ -292860,7 +293107,7 @@ const make$8 = require_Schema$1.gen(function* () {
 			summary: "Provider turn start failed",
 			detail: publicProviderFailureDetail(require_Schema$1.pretty(cause)),
 			turnId: null,
-			createdAt: event.payload.createdAt
+			createdAt: (/* @__PURE__ */ new Date()).toISOString()
 		})));
 	});
 	const processTurnInterruptRequested = require_Schema$1.fn("processTurnInterruptRequested")(function* (event) {
@@ -298543,7 +298790,7 @@ function resolveBuildCommitFromEnv(env) {
 * environment descriptor down instead of reporting an honest "unknown".
 */
 function readBakedBuildCommit() {
-	return "dea91e954d3d2f23154802ae304412fabe90dbbd";
+	return "78b0e072680ed734c4eb8337a6d38c87e7e34393";
 }
 async function resolveServerBuildCommit(input) {
 	if (isFullCommitSha(input.baked)) return input.baked;
@@ -309967,6 +310214,33 @@ registerProxyRoute({
 	cmmdPath: "/api/projects/campaigns/:id",
 	orgIdSource: "none"
 });
+/**
+* Apple App Store guideline 5.1.1(v): an app that supports account creation
+* or sign-in must let the user start account deletion from inside the app.
+* CMMD owns the account, so this proxies to its existing deactivation route.
+*
+* `cmmdPath` is `/api/settings/delete-account`, not a `/api/forge/context/*`
+* route: CMMD never built a forge-context-scoped deletion endpoint. It is
+* still reachable through the same owner JWT this gateway already resolves
+* per session: CMMD's `optionalJwtAuth` runs ahead of every `/api/*` route
+* (not only forge-context ones), so the same Bearer that reaches
+* `/api/cmmd/bootstrap` also authenticates here.
+*
+* CMMD's route soft-deletes: it flips the user to `active: false` and
+* `lifecycleState: 'deactivated'`, revokes CMMD's own refresh tokens, and
+* destroys its session. It does not purge data on this call. The Forge
+* client is responsible for the rest: revoking the Forge session
+* (`/api/auth/logout`) and clearing local state, the same as a manual
+* sign-out.
+*/
+registerProxyRoute({
+	forgePath: "/api/cmmd/settings/delete-account",
+	method: "DELETE",
+	cmmdPath: "/api/settings/delete-account",
+	orgIdSource: "none",
+	responseShape: "unwrapData",
+	requestBody: "none"
+});
 registerProxyRoute({
 	forgePath: "/api/cmmd/bootstrap",
 	method: "GET",