@cmmd-center/forge 0.13.20 → 0.13.22

package/dist/bin.cjs

@@ -17245,7 +17245,8 @@ const ExecutionEnvironmentAuthCapabilities = require_Schema$1.Struct({
 	ownerBootstrapPromotion: require_Schema$1.Boolean,
 	bearerBootstrap: require_Schema$1.Boolean,
 	desktopBootstrap: require_Schema$1.Boolean,
-	providerCredentialBroker: require_Schema$1.Boolean
+	providerCredentialBroker: require_Schema$1.Boolean,
+	cloudOwnerAssertion: require_Schema$1.optionalKey(require_Schema$1.Boolean)
 });
 const ExecutionEnvironmentToolCapabilities = require_Schema$1.Struct({
 	agents: require_Schema$1.Boolean,
@@ -66231,7 +66232,7 @@ function normalizeNumberish(value) {
 }
 //#endregion
 //#region package.json
-var version$1 = "0.13.20";
+var version$1 = "0.13.22";
 //#endregion
 //#region src/sentry.ts
 const SERVER_APP_NAME = "forge-server";
@@ -68356,6 +68357,7 @@ function extractCookieValue(setCookieHeaders, name) {
 	}
 	return null;
 }
+/** @internal exported for the other owner lanes and their tests. */
 function readCmmdJsonResponse(response, fallbackMessage) {
 	return require_Schema$1.gen(function* () {
 		const payload = yield* require_Schema$1.tryPromise({
@@ -68617,11 +68619,14 @@ function cmmdUserCredential(payload) {
 /**
 * Read one CMMD token-exchange response into the credential set Forge stores.
 *
-* Both owner lanes redeem the same `cmmd-forge-web` authorization code — the
-* browser OAuth callback and Cloud's password login — so they see the same
-* bundle shape. Reading it in one place is what keeps them from drifting on
-* which field carries the PAT; callers still own their own error reporting,
-* which is the only part that legitimately differs between the two.
+* Every owner lane that redeems a CMMD grant — the browser OAuth callback,
+* Cloud's password login, the cookie-shaped session renew, and the bearer
+* device-session redeem in cloudOwnerDeviceSession.ts — sees the same bundle
+* shape. Reading it in one place is what keeps them from drifting on which
+* field carries the PAT; callers still own their own error reporting, which
+* is the only part that legitimately differs between them.
+*
+* @internal exported for the other owner lanes and their tests.
 */
 function resolveCmmdTokenBundleCredentials(tokenResult) {
 	return require_Schema$1.gen(function* () {
@@ -69590,22 +69595,52 @@ const deriveServerPaths = require_Schema$1.fn(function* (baseDir, _devUrl, _mode
 		secretsDir: join(stateDir, "secrets")
 	};
 });
-const ensureServerDirectories = require_Schema$1.fn(function* (derivedPaths) {
+/**
+* Create `dir`, healing the one case a recursive mkdir cannot: a symlink whose
+* target no longer exists.
+*
+* A recursive mkdir is a no-op when the path is already a directory, but it
+* fails when the path is a DANGLING symlink, because nothing on the way down
+* resolves. bun reports that as EEXIST and node as ENOENT; either way the call
+* raises instead of recreating what the link points at.
+*
+* That shape is normal on a CMMD cloud runtime. The regenerable cache
+* directories there are symlinks onto the sprite's machine-local /tmp, which is
+* a separate device that is NOT part of the checkpointed overlay, so a wipe
+* leaves the links behind and takes their targets. Only provisioning recreated
+* them, and provisioning does not re-run on a restart, so a wiped store meant
+* the server raised at boot, exited 1, and did so again on every supervisor
+* restart for as long as the runtime existed.
+*
+* Observed live on cloud runtime 33dff4ee: /forge/caches pointed at
+* /tmp/forge-store/caches, the target was gone, and the server failed to boot
+* 974 times between 2026-09-15 and 2026-09-16. Recreating the target directory
+* by hand was the whole repair, which is what this does automatically.
+*
+* Healing is deliberately narrow. A path that is not a symlink, or a symlink
+* whose target cannot be created, re-raises the original error rather than
+* inventing a directory somewhere the caller did not ask for.
+*/
+const ensureDirectory = require_Schema$1.fn(function* (dir) {
 	const fs = yield* require_Path.FileSystem;
+	const path = yield* require_Path.Path;
+	yield* fs.makeDirectory(dir, { recursive: true }).pipe(require_Schema$1.catch_((error) => fs.readLink(dir).pipe(require_Schema$1.flatMap((target) => fs.makeDirectory(path.resolve(path.dirname(dir), target), { recursive: true })), require_Schema$1.mapError(() => error))));
+});
+const ensureServerDirectories = require_Schema$1.fn(function* (derivedPaths) {
 	const path = yield* require_Path.Path;
 	yield* require_Schema$1.all([
-		fs.makeDirectory(derivedPaths.stateDir, { recursive: true }),
-		fs.makeDirectory(derivedPaths.logsDir, { recursive: true }),
-		fs.makeDirectory(derivedPaths.providerLogsDir, { recursive: true }),
-		fs.makeDirectory(derivedPaths.terminalLogsDir, { recursive: true }),
-		fs.makeDirectory(derivedPaths.attachmentsDir, { recursive: true }),
-		fs.makeDirectory(derivedPaths.worktreesDir, { recursive: true }),
-		fs.makeDirectory(path.dirname(derivedPaths.keybindingsConfigPath), { recursive: true }),
-		fs.makeDirectory(path.dirname(derivedPaths.settingsPath), { recursive: true }),
-		fs.makeDirectory(derivedPaths.providerStatusCacheDir, { recursive: true }),
-		fs.makeDirectory(path.dirname(derivedPaths.anonymousIdPath), { recursive: true }),
-		fs.makeDirectory(path.dirname(derivedPaths.environmentMetadataPath), { recursive: true }),
-		fs.makeDirectory(path.dirname(derivedPaths.serverRuntimeStatePath), { recursive: true })
+		ensureDirectory(derivedPaths.stateDir),
+		ensureDirectory(derivedPaths.logsDir),
+		ensureDirectory(derivedPaths.providerLogsDir),
+		ensureDirectory(derivedPaths.terminalLogsDir),
+		ensureDirectory(derivedPaths.attachmentsDir),
+		ensureDirectory(derivedPaths.worktreesDir),
+		ensureDirectory(path.dirname(derivedPaths.keybindingsConfigPath)),
+		ensureDirectory(path.dirname(derivedPaths.settingsPath)),
+		ensureDirectory(derivedPaths.providerStatusCacheDir),
+		ensureDirectory(path.dirname(derivedPaths.anonymousIdPath)),
+		ensureDirectory(path.dirname(derivedPaths.environmentMetadataPath)),
+		ensureDirectory(path.dirname(derivedPaths.serverRuntimeStatePath))
 	], { concurrency: "unbounded" });
 });
 /**
@@ -298212,7 +298247,7 @@ function resolveBuildCommitFromEnv(env) {
 * environment descriptor down instead of reporting an honest "unknown".
 */
 function readBakedBuildCommit() {
-	return "6acacb9afbe43fd2b2053436daaddaec3459a517";
+	return "c9bc6514eb0d5f3c0eff3b12d396a11f7a96abef";
 }
 async function resolveServerBuildCommit(input) {
 	if (isFullCommitSha(input.baked)) return input.baked;
@@ -298340,9 +298375,10 @@ function executionEnvironmentCapabilities(serverConfig) {
 		auth: {
 			cmmd: true,
 			ownerBootstrapPromotion: !isRuntime && !isCloudShell,
-			bearerBootstrap: true,
+			bearerBootstrap: !isCloudShell,
 			desktopBootstrap: serverConfig.mode === "desktop" || serverConfig.desktopBootstrapToken !== void 0,
-			providerCredentialBroker: false
+			providerCredentialBroker: false,
+			cloudOwnerAssertion: isCloudShell
 		},
 		tools: {
 			agents: isExecutionPlane,
@@ -298434,6 +298470,145 @@ const makeServerEnvironment = require_Schema$1.fn("makeServerEnvironment")(funct
 });
 const ServerEnvironmentLive = require_Schema$1.effect(ServerEnvironment, makeServerEnvironment());
 //#endregion
+//#region src/auth/http/cloudOwnerDeviceSession.ts
+/**
+* Native OAuth clients allowed to redeem a Forge Cloud session grant through
+* this bearer lane. Starts with only the mobile client from FOR-36841's
+* companion CMMD change; widen deliberately, not by accident.
+*/
+const CLOUD_NATIVE_OAUTH_CLIENT_IDS = new Set(["cmmd-forge-mobile"]);
+const CloudOwnerSessionRedeemInput = require_Schema$1.Struct({
+	sessionGrant: require_Schema$1.String,
+	clientId: require_Schema$1.String
+});
+function outsideCloudShell() {
+	return require_Schema$1.fail(new AuthError({
+		message: "Forge Cloud session redemption is unavailable.",
+		status: 403
+	}));
+}
+function redeemSessionGrantWithCmmd(input) {
+	return require_Schema$1.tryPromise({
+		try: () => fetch(resolveCommandAppEndpoint("/api/mcp-server/oauth/token"), {
+			method: "POST",
+			headers: { "content-type": "application/json" },
+			body: JSON.stringify({
+				grant_type: "forge_session_grant",
+				grant_token: input.sessionGrant,
+				client_id: input.clientId
+			})
+		}),
+		catch: (cause) => new AuthError({
+			message: "Failed to redeem the Forge Cloud session grant with CMMD.",
+			status: 500,
+			cause
+		})
+	}).pipe(require_Schema$1.flatMap((response) => readCmmdJsonResponse(response, "Failed to redeem the Forge Cloud session grant with CMMD.")));
+}
+const cloudOwnerSessionRedeemRouteLayer = add$1("POST", "/api/auth/cloud/session", require_Schema$1.gen(function* () {
+	const serverAuth = yield* ServerAuth;
+	if (serverAuth.isForgeCloudShell?.() !== true) return yield* outsideCloudShell();
+	const request = yield* require_HttpServer.HttpServerRequest;
+	const limited = rateLimitOrRespond({
+		routeClass: "auth-bootstrap",
+		clientKey: clientKeyFromRequest(request)
+	});
+	if (limited) return limited;
+	yield* serverAuth.authenticateHttpRequest(request);
+	const payload = yield* require_HttpServer.schemaBodyJson(CloudOwnerSessionRedeemInput).pipe(require_Schema$1.mapError((cause) => new AuthError({
+		message: "Invalid Forge Cloud session redeem payload.",
+		status: 400,
+		cause
+	})));
+	if (!CLOUD_NATIVE_OAUTH_CLIENT_IDS.has(payload.clientId)) return yield* new AuthError({
+		message: "Unknown Forge Cloud native client.",
+		status: 403
+	});
+	const tokenResult = yield* redeemSessionGrantWithCmmd(payload);
+	const { tokenObj, cmmdIdentity, userId, accessToken, mcpToken, refreshToken, forgeOwnerAssertion, sessionGrantExpiresAt, isJwt, patToStore, jwtToStore } = yield* resolveCmmdTokenBundleCredentials(tokenResult);
+	if (!cmmdIdentity || !userId || !patToStore) {
+		yield* require_Schema$1.logError("Forge Cloud session redeem: CMMD token response incomplete.", {
+			clientId: payload.clientId,
+			tokenResponse: describeCmmdTokenResponseForLog({
+				tokenObj,
+				tokenResult,
+				accessToken,
+				mcpToken,
+				refreshToken,
+				isJwt,
+				userId,
+				patToStore,
+				jwtToStore
+			})
+		});
+		return yield* new AuthError({
+			message: "CMMD did not return a complete redeemed Forge Cloud session.",
+			status: 500
+		});
+	}
+	const assertion = yield* validateCloudOwnerCallbackAssertion({
+		serverAuth,
+		assertionToken: forgeOwnerAssertion,
+		authenticatedUserId: userId
+	});
+	if (!assertion) return yield* require_Schema$1.die(/* @__PURE__ */ new Error("Expected a redeemed Forge Cloud owner assertion for a native client."));
+	yield* persistCloudOwnerArtifacts({
+		assertion,
+		accessToken: patToStore,
+		identity: cmmdIdentity,
+		jwtToken: jwtToStore,
+		refreshToken,
+		sessionGrant: payload.sessionGrant,
+		sessionGrantExpiresAt
+	});
+	yield* require_Schema$1.logInfo("Forge Cloud owner session redeemed.", {
+		sessionId: assertion.sessionId,
+		clientId: payload.clientId,
+		userId
+	});
+	return require_HttpServer.jsonUnsafe({
+		assertion: assertion.token,
+		assertionExpiresAt: require_Schema$1.toUtc(assertion.expiresAt),
+		sessionGrantExpiresAt,
+		user: {
+			id: assertion.userId,
+			email: cmmdIdentity.email
+		}
+	}, { status: 200 });
+}).pipe(require_Schema$1.catchTag("AuthError", (error) => respondToAuthError(error))));
+/**
+* Seam for CMMD-side session-grant revocation.
+*
+* As of FOR-36841, CMMD does not expose an endpoint to revoke a
+* `forge_session_grant` token server-side (confirm with the CMMD change
+* before wiring this in). When it does, call it here, best-effort: a failure
+* revoking at CMMD must never block the local row deletion below, which is
+* this endpoint's actual guarantee. Left as a documented no-op rather than a
+* guess at CMMD's eventual route shape.
+*/
+function revokeCmmdSessionGrantBestEffort(_sessionId) {
+	return require_Schema$1.void_;
+}
+const cloudOwnerSessionRevokeRouteLayer = add$1("POST", "/api/auth/cloud/session/revoke", require_Schema$1.gen(function* () {
+	const serverAuth = yield* ServerAuth;
+	if (serverAuth.isForgeCloudShell?.() !== true) return yield* outsideCloudShell();
+	const request = yield* require_HttpServer.HttpServerRequest;
+	const limited = rateLimitOrRespond({
+		routeClass: "auth-bootstrap",
+		clientKey: clientKeyFromRequest(request)
+	});
+	if (limited) return limited;
+	const session = yield* serverAuth.authenticateHttpRequest(request);
+	yield* clearCommandAccessTokenForSession(session.sessionId).pipe(require_Schema$1.mapError((cause) => new AuthError({
+		message: "Failed to revoke the Forge Cloud owner session.",
+		status: 500,
+		cause
+	})));
+	yield* revokeCmmdSessionGrantBestEffort(session.sessionId);
+	yield* require_Schema$1.logInfo("Forge Cloud owner session revoked.", { sessionId: session.sessionId });
+	return require_HttpServer.empty({ status: 204 });
+}).pipe(require_Schema$1.catchTag("AuthError", (error) => respondToAuthError(error))));
+//#endregion
 //#region src/docs/http.ts
 const SCALAR_API_REFERENCE_URL = "https://cdn.jsdelivr.net/npm/@scalar/api-reference@1.64.1";
 const SCALAR_API_REFERENCE_INTEGRITY = "sha384-SmFRDuBBmEoCbbBCTcn8/+cIQONyH0xgOKpsp6OttBlI8uG9uc6iAO8SonYQ3e1W";
@@ -300567,6 +300742,24 @@ function readWebSocketUpgradeToken(params) {
 }
 //#endregion
 //#region src/auth/Layers/ForgeCloudOwnerAuthentication.ts
+const BEARER_PREFIX = "Bearer ";
+/**
+* Reads a Forge Cloud owner assertion presented as `Authorization: Bearer
+* <assertion>`, alongside the cookie read below.
+*
+* Deliberately its own parser rather than a shared one: `ServerAuth.ts`
+* carries a bearer reader for the local bootstrap/pairing/desktop lanes, and
+* those must stay untouched by this change. This function is only ever
+* called from `authenticateForgeCloudOwnerRequest`, which itself only runs
+* when `serverConfig.forgeCloudShellMode === true` — so a non-cloud server's
+* bearer lanes never pass through here.
+*/
+function readForgeCloudOwnerBearerToken(request) {
+	const header = request.headers["authorization"];
+	if (typeof header !== "string" || !header.startsWith(BEARER_PREFIX)) return null;
+	const token = header.slice(7).trim();
+	return token.length > 0 ? token : null;
+}
 function assertionVerifierConfig(config) {
 	const publicKey = config.forgeCloudOwnerAssertionPublicKey;
 	const keyId = config.forgeCloudOwnerAssertionKeyId;
@@ -300594,7 +300787,7 @@ function authenticateForgeCloudOwnerRequest(request, config) {
 			message: "Forge Cloud owner assertion verification is misconfigured.",
 			status: 500
 		});
-		const token = request.cookies[FORGE_CLOUD_OWNER_ASSERTION_COOKIE];
+		const token = request.cookies["forge_cloud_owner_assertion"] ?? readForgeCloudOwnerBearerToken(request);
 		if (!token) return yield* new AuthError({
 			message: "Authentication required.",
 			status: 401
@@ -321763,7 +321956,7 @@ const MiscRuntimeLayerLive = require_Schema$1.mergeAll(AnalyticsServiceLayerLive
 const RuntimeDependenciesWithoutPullRequestsLive = ReactorLayerLive.pipe(require_Schema$1.provideMerge(CheckpointingLayerLive), require_Schema$1.provideMerge(GitLayerLive), require_Schema$1.provideMerge(OrchestrationLayerLive), require_Schema$1.provideMerge(ProviderLayerLive), require_Schema$1.provideMerge(TerminalLayerLive), require_Schema$1.provideMerge(AgentBrowserManagerLive), require_Schema$1.provideMerge(require_Schema$1.mergeAll(ThreadDevRuntimeLive, DevTunnelLive.pipe(require_Schema$1.provide$1(ThreadDevRuntimeLive)))), require_Schema$1.provideMerge(PersistenceLayerLive), require_Schema$1.provideMerge(KeybindingsLive), require_Schema$1.provideMerge(ProviderRegistryLive), require_Schema$1.provideMerge(require_Schema$1.mergeAll(ServerSettingsLive, UsageServiceLive.pipe(require_Schema$1.provide$1(ServerSettingsLive), require_Schema$1.provide$1(UsageSessionLookupLive), require_Schema$1.provide$1(UsageRecordedSourceLive.pipe(require_Schema$1.provide$1(OrchestrationLayerLive), require_Schema$1.provide$1(RuntimeReplicationOutboxLive), require_Schema$1.provide$1(ProviderSessionRuntimeRepositoryLive), require_Schema$1.provide$1(TextGenerationSessionRepositoryLive)))))), require_Schema$1.provideMerge(WorkspaceLayerLive), require_Schema$1.provideMerge(WorkspaceReadinessStateLive), require_Schema$1.provideMerge(ProjectFaviconResolverLive), require_Schema$1.provideMerge(RepositoryIdentityResolverLive), require_Schema$1.provideMerge(ServerEnvironmentLive), require_Schema$1.provideMerge(AuthLayerLive), require_Schema$1.provideMerge(ServerSecretStoreLayerLive), require_Schema$1.provideMerge(require_Schema$1.mergeAll(CloudRedisCoordinationLive, CloudStateSyncLive.pipe(require_Schema$1.provide$1(PersistenceLayerLive)))), require_Schema$1.provideMerge(MiscRuntimeLayerLive));
 const RuntimeDependenciesLive = pullRequestServiceFactoryLayer.pipe(require_Schema$1.provideMerge(RuntimeDependenciesWithoutPullRequestsLive), require_Schema$1.provideMerge(cmmdProjectIdentityResolverLive.pipe(require_Schema$1.provide$1(RuntimeDependenciesWithoutPullRequestsLive))), require_Schema$1.provideMerge(pullRequestProviderRuntimeLive));
 const RuntimeServicesLive = ServerRuntimeStartupLive.pipe(require_Schema$1.provideMerge(RuntimeDependenciesLive));
-const makeRoutesLayer = require_Schema$1.mergeAll(attachmentUploadRouteLayer, authBearerBootstrapRouteLayer, authBootstrapRouteLayer, authCommandBearerBootstrapRouteLayer, authCommandBootstrapRouteLayer, authOAuthTokenExchangeRouteLayer, authWebSocketTicketRouteLayer, authCmmdOAuthDeviceRouteLayer, authCmmdOAuthTokenRouteLayer, authCmmdPasswordTokenRouteLayer, authClientsRevokeOthersRouteLayer, authClientsRevokeRouteLayer, authClientsRouteLayer, authLogoutRouteLayer, authPairingLinksRevokeRouteLayer, authPairingLinksRouteLayer, authPairingCredentialRouteLayer, authSessionRenewRouteLayer, authSessionRouteLayer, authWebSocketTokenRouteLayer, authWebLoginRouteLayer, authWebCallbackRouteLayer, desktopLocalWebBridgePublishRouteLayer, desktopLocalWebBridgeBootstrapRouteLayer, desktopRelayControlPlaneRouteLayer, apiDocsHtmlRouteLayer, apiDocsOpenApiRouteLayer, pulseSignalStateListRouteLayer, pulseSignalStateUpsertRouteLayer, cmmdProfileRouteLayer, ...cmmdProxyRouteLayers, cmmdWorkIntakeRouteLayer, cmmdWsTokenRouteLayer, cmmdGetProjectCommentsRouteLayer, cmmdAddProjectCommentRouteLayer, cmmdUpdateProjectRouteLayer, cmmdUploadTaskAttachmentRouteLayer, cmmdUpdateTaskCommentRouteLayer, cmmdListWorkspaceMembersRouteLayer, cmmdAddProjectMemberRouteLayer, cmmdUpdateProjectAgentMemberAvatarRouteLayer, runtimeReplicationStatusRouteLayer, cmmdRefreshProviderUsageRouteLayer, cmmdForgeCloudProjectsListRouteLayer, cmmdForgeCloudProjectsEventsRouteLayer, cmmdForgeRuntimesEnsureRouteLayer, cmmdForgeRuntimesConnectRouteLayer, ownerRuntimeCodexReadinessRouteLayer, cmmdForgeRuntimesStatusRouteLayer, cmmdForgeRuntimesStartRouteLayer, cmmdForgeRuntimesStopRouteLayer, cmmdForgeRuntimesRecycleRouteLayer, cmmdForgeRuntimesUpdateCommitRouteLayer, cmmdForgeRuntimesDestroyRouteLayer, mobileProviderCatalogRouteLayer, attachmentsRouteLayer, orchestrationDispatchRouteLayer, orchestrationCmmdWorkRunEventRouteLayer, orchestrationAutomationStartThreadRouteLayer, orchestrationAutomationRebindRouteLayer, orchestrationAutomationTerminalReconcileRouteLayer, mobileGitRunStackedActionRouteLayer, pullRequestDiffRouteLayer, orchestrationSnapshotRouteLayer, orchestrationThreadSnapshotRouteLayer, localAutomationListRouteLayer, localAutomationCreateRouteLayer, localAutomationUpdateRouteLayer, localAutomationDeleteRouteLayer, localAutomationRunRouteLayer, otlpTracesProxyRouteLayer, devTunnelProxyRouteLayer, devTunnelLocalPortProxyRouteLayer, projectFaviconRouteLayer, serverEnvironmentRouteLayer, browserWebRtcReadinessRouteLayer, staticAndDevRouteLayer, githubStatusRouteLayer, githubAuthorizeUrlRouteLayer, githubDisconnectRouteLayer, githubReposRouteLayer, githubCloneRouteLayer, githubCloneJobStartRouteLayer, githubCloneJobStatusRouteLayer, githubRefreshCredentialsRouteLayer, githubToolConfirmationApproveRouteLayer, projectLinkGetRouteLayer, projectLinkListRouteLayer, projectLinkSetRouteLayer, projectLinkDeleteRouteLayer, cmmdWorkspacesRouteLayer, cmmdCampaignsRouteLayer, cmmdProjectLinksRouteLayer, cmmdEnsureGitHubProjectContextRouteLayer, cmmdProjectRepositoryEnsureRouteLayer, cmmdProjectsGetRouteLayer, cmmdProjectsCreateRouteLayer, workspaceReadinessRouteLayer, runtimeLivenessRouteLayer, runtimeFilesystemHealthRouteLayer, claudeNativeGenerationProofRouteLayer, claudeUsageRouteLayer, codexRuntimeProviderReadinessRouteLayer, runtimeDiagnosticsRouteLayer, cloudFoldersRouteLayer, cloudProjectCreateRouteLayer, gitUrlCloneRouteLayer, websocketRpcRouteLayer).pipe(require_Schema$1.provide$1(browserApiCorsLayer));
+const makeRoutesLayer = require_Schema$1.mergeAll(attachmentUploadRouteLayer, authBearerBootstrapRouteLayer, authBootstrapRouteLayer, authCommandBearerBootstrapRouteLayer, authCommandBootstrapRouteLayer, authOAuthTokenExchangeRouteLayer, authWebSocketTicketRouteLayer, authCmmdOAuthDeviceRouteLayer, authCmmdOAuthTokenRouteLayer, authCmmdPasswordTokenRouteLayer, authClientsRevokeOthersRouteLayer, authClientsRevokeRouteLayer, authClientsRouteLayer, authLogoutRouteLayer, authPairingLinksRevokeRouteLayer, authPairingLinksRouteLayer, authPairingCredentialRouteLayer, authSessionRenewRouteLayer, authSessionRouteLayer, authWebSocketTokenRouteLayer, authWebLoginRouteLayer, authWebCallbackRouteLayer, cloudOwnerSessionRedeemRouteLayer, cloudOwnerSessionRevokeRouteLayer, desktopLocalWebBridgePublishRouteLayer, desktopLocalWebBridgeBootstrapRouteLayer, desktopRelayControlPlaneRouteLayer, apiDocsHtmlRouteLayer, apiDocsOpenApiRouteLayer, pulseSignalStateListRouteLayer, pulseSignalStateUpsertRouteLayer, cmmdProfileRouteLayer, ...cmmdProxyRouteLayers, cmmdWorkIntakeRouteLayer, cmmdWsTokenRouteLayer, cmmdGetProjectCommentsRouteLayer, cmmdAddProjectCommentRouteLayer, cmmdUpdateProjectRouteLayer, cmmdUploadTaskAttachmentRouteLayer, cmmdUpdateTaskCommentRouteLayer, cmmdListWorkspaceMembersRouteLayer, cmmdAddProjectMemberRouteLayer, cmmdUpdateProjectAgentMemberAvatarRouteLayer, runtimeReplicationStatusRouteLayer, cmmdRefreshProviderUsageRouteLayer, cmmdForgeCloudProjectsListRouteLayer, cmmdForgeCloudProjectsEventsRouteLayer, cmmdForgeRuntimesEnsureRouteLayer, cmmdForgeRuntimesConnectRouteLayer, ownerRuntimeCodexReadinessRouteLayer, cmmdForgeRuntimesStatusRouteLayer, cmmdForgeRuntimesStartRouteLayer, cmmdForgeRuntimesStopRouteLayer, cmmdForgeRuntimesRecycleRouteLayer, cmmdForgeRuntimesUpdateCommitRouteLayer, cmmdForgeRuntimesDestroyRouteLayer, mobileProviderCatalogRouteLayer, attachmentsRouteLayer, orchestrationDispatchRouteLayer, orchestrationCmmdWorkRunEventRouteLayer, orchestrationAutomationStartThreadRouteLayer, orchestrationAutomationRebindRouteLayer, orchestrationAutomationTerminalReconcileRouteLayer, mobileGitRunStackedActionRouteLayer, pullRequestDiffRouteLayer, orchestrationSnapshotRouteLayer, orchestrationThreadSnapshotRouteLayer, localAutomationListRouteLayer, localAutomationCreateRouteLayer, localAutomationUpdateRouteLayer, localAutomationDeleteRouteLayer, localAutomationRunRouteLayer, otlpTracesProxyRouteLayer, devTunnelProxyRouteLayer, devTunnelLocalPortProxyRouteLayer, projectFaviconRouteLayer, serverEnvironmentRouteLayer, browserWebRtcReadinessRouteLayer, staticAndDevRouteLayer, githubStatusRouteLayer, githubAuthorizeUrlRouteLayer, githubDisconnectRouteLayer, githubReposRouteLayer, githubCloneRouteLayer, githubCloneJobStartRouteLayer, githubCloneJobStatusRouteLayer, githubRefreshCredentialsRouteLayer, githubToolConfirmationApproveRouteLayer, projectLinkGetRouteLayer, projectLinkListRouteLayer, projectLinkSetRouteLayer, projectLinkDeleteRouteLayer, cmmdWorkspacesRouteLayer, cmmdCampaignsRouteLayer, cmmdProjectLinksRouteLayer, cmmdEnsureGitHubProjectContextRouteLayer, cmmdProjectRepositoryEnsureRouteLayer, cmmdProjectsGetRouteLayer, cmmdProjectsCreateRouteLayer, workspaceReadinessRouteLayer, runtimeLivenessRouteLayer, runtimeFilesystemHealthRouteLayer, claudeNativeGenerationProofRouteLayer, claudeUsageRouteLayer, codexRuntimeProviderReadinessRouteLayer, runtimeDiagnosticsRouteLayer, cloudFoldersRouteLayer, cloudProjectCreateRouteLayer, gitUrlCloneRouteLayer, websocketRpcRouteLayer).pipe(require_Schema$1.provide$1(browserApiCorsLayer));
 const makeServerLayer = require_Schema$1.unwrap(require_Schema$1.gen(function* () {
 	const config = yield* ServerConfig;
 	fixPath({ preferProcessPath: config.forgeCmmdRuntimeMode === true });