@cmmd-center/forge 0.9.5 → 0.9.6

package/dist/bin.mjs

@@ -1,18 +1,18 @@
 #!/usr/bin/env node
 
 import { a as __toCommonJS, i as __require, n as __esmMin, o as __toESM, r as __exportAll, t as __commonJSMin } from "./chunk-C5ckVeoz.mjs";
-import { $ as encodeSync, $a as interrupt$3, $c as none$4, $i as isDoneCause, $r as scope$1, $s as allocate, Aa as closeUnsafe, Ac as Service$1, An as catchCause, Ao as CurrentLoggers$1, Ar as never$1, As as ParentSpan, At as withDecodingDefault, B as brand, Ba as _await, Bi as update$3, Bn as currentSpan, Br as provideContext, Bs as fromInputUnsafe, Bt as isEmpty$2, C as Record, Ca as succeedContext, Ci as uninterruptibleMask$1, Cn as annotateLogs, Cs as uninterruptibleMask, Ct as suspend$2, D as TaggedStruct, Da as addFinalizer$1, Dn as asVoid, Do as squash, Dr as matchCauseEffect, Dt as toJsonSchemaDocument, E as TaggedErrorClass, Ea as Scope$1, Ec as isSuccess$1, Ei as void_$1, En as asSome, Eo as prettyErrors, Er as match$1, Et as toCodecStringTree, F as UndefinedOr, Fa as CurrentLogAnnotations, Fi as zipWith, Fl as isNotUndefined, Fn as catchTag, Fo as as$2, Fr as option, Ft as assign, G as decodeSync, Gc as fromUndefinedOr, Gi as forever$2, Gl as constUndefined, Gn as exit, Gr as result, Gs as millis, Ha as fail$3, Hc as flatMap$2, Hi as addDelay, Hl as compose, Hn as die$1, Hr as race, Ht as toArray, I as Union, Ia as CurrentLogSpans, Ic as getUnsafe$1, Ii as counter, Il as isNullish, In as catchTags, Ir as orDie, It as append$1, J as decodeUnknownExit, Jc as getOrUndefined, Ji as recurs, Jl as dual, Jo as fiberInterrupt, Jr as runForkWith, Js as seconds, K as decodeTo, Kc as getOrElse, Kl as constVoid, Kn as fail, Kr as retry, Ks as min, L as Unknown, La as MinimumLogLevel, Lc as make$33, Li as gauge, Ll as isObject$1, Ln as catch_, Lr as orElseSucceed, Ls as days, Lt as drop$1, M as URLFromString, Ma as make$35, Mc as empty$1, Mi as withSpan, Ml as hasProperty, Mn as catchFilter, Mr as onExit, Ms as externalSpan, Na as makeUnsafe$4, Nc as get$3, Ni as withTracerEnabled, Nl as isNotNull, Nn as catchIf, No as addFinalizer, Ns as make$40, O as TemplateLiteral, Oa as addFinalizerExit, Oc as succeed$1, Oi as whileLoop, On as cached$3, Os as MinimumTraceLevel, Ot as toType, P as Undefined, Pa as provide$2, Pi as yieldNow, Pl as isNotNullish, Pn as catchReason, Po as andThen$1, Pr as onInterrupt, Q as encodeEffect, Qa as failCause$2, Qc as match, Ql as pipeArguments, Qn as flatMap, Qs as zero, Qt as stringifyJson, R as UnknownFromJsonString$1, Rc as makeUnsafe$3, Ri as snapshotUnsafe, Rl as isTagged, Rn as context, Rr as promise, Rs as format$1, Rt as empty$2, S as Option, Sa as succeed$2, Sc as fail$1, Si as uninterruptible, Sn as annotateCurrentSpan, Sr as map$3, Ss as tracerLogger$1, St as optionalKey, T as Struct, Ta as unwrap, Tc as isFailure$1, Ti as useSpan, Tl as equals, Tn as as$3, To as pretty, Ts as void_$2, Tt as toCodecJson, U as decodeEffect, Ua as failCause$3, Uc as flatten$1, Ui as both, Ur as raceFirst, V as declare, Vc as firstSomeOf, Vi as withAttributes, Vl as cast, Vr as provideService, Vt as size$2, W as decodeExit, Wc as fromNullishOr, Wi as exponential, Wl as constTrue, Wn as ensuring, Wr as repeat, Ws as max, Wt as Transformation, X as decodeUnknownSync, Xa as die$2, Xc as isSome, Xi as catchDone, Xl as identity, Xn as filterMapOrFail, Xs as toMillis, Xt as parseJson$1, Y as decodeUnknownOption, Ya as succeed$3, Yc as isNone, Yi as spaced, Yn as filter$1, Yr as runPromise, Ys as times, Yt as onSome, Z as encode$4, Za as fail$2, Zc as map$5, Zl as pipe$1, Zn as filterOrFail, Zr as runPromiseWith, Zs as toSeconds, _ as NonEmptyArray, _a as launch$1, _i as tryPromise, _n as acquireRelease, _o as hasInterrupts, _r as logError, a as DateTimeUtc, aa as currentTimeMillis, ac as isArrayNonEmpty, ai as succeed, ar as forkChild, at as isFinite$1, b as NullOr, ba as provide$1, bi as txRetry, bl as toJson, bn as all, bo as interruptors, br as logWarning$1, bs as suspend, bt as mutable, c as Defect, ca as TaggedError, ci as suspend$1, cl as YieldableProto, cn as formatIso, cr as forkScoped, ct as isInt, d as Exit, da as buildWithMemoMap, di as tapCause, dn as makeUnsafe$5, do as done, dr as ignoreCause, dt as isMaxProperties, ec as empty$3, ei as scoped, el as some, en as InvalidValue$1, eo as isFailure, er as flatten$2, et as encodeUnknownEffect, fa as effect, fc as reverse, fi as tapError, fn as now, fo as fail$4, fr as interrupt$1, ft as isMinLength, g as Never, gi as timeoutOrElse, gl as withFiber, gn as Transaction$1, go as hasDies, gr as logDebug, gs as sleep$3, gt as isSchemaError, h as Literals, ha as empty$4, hi as timeoutOption, hl as isEffect$1, hn as toUtc, hr as log$4, hs as scopeAddFinalizerExit, ht as isSchema, i as Class, ia as Clock, ic as fromIterable, ii as sleep$4, in as value, io as void_$3, ir as forever$1, is as forkDetach, it as isBetween, ja as forkUnsafe, jc as add$2, ji as withParentSpan, jl as compose$1, jn as catchDefect, jr as onError$1, js as Tracer, k as Trim, ka as close, kc as Reference$1, ki as withFiber$1, kn as callback, ko as ConsoleRef, kr as matchEffect, ks as NativeSpan, kt as withConstructorDefault, l as Duration, la as CurrentMemoMap, li as sync$1, ln as isGreaterThanOrEqualTo$1, lr as gen, lt as isLessThanOrEqualTo, m as Literal, ma as effectDiscard, mi as timeout, mn as toEpochMillis, mr as isEffect, ms as scope, mt as isPattern, n as ArraySchema, na as clamp, nc as filter, ni as service, nl as make$39, nn as makeFormatterDefault, no as match$2, nr as fnUntraced, ns as fnUntraced$1, nt as fromJsonString, o as DateTimeUtcFromString, oa as Class$1, oc as isReadonlyArrayNonEmpty, oi as succeedNone, on as encodeBase64Url$2, oo as NoSuchElementError, or as forkDetach$1, ot as isGreaterThan, p as Int$1, pa as effectContext, pc as sort, pi as tapErrorTag, pn as toDate, pr as interruptible, ps as reportCauseUnsafe, pt as isNonEmpty, q as decodeUnknownEffect, qa as make$37, qc as getOrNull, qi as passthrough$1, ql as constant, qn as failCause$1, qr as runFork, qs as minutes, qt as transformOrFail, r as Boolean$1, ra as parse$6, rc as flatMapNullishOr, ri as serviceOption, rn as make$38, rr as forEach, rs as forever, rt as is$1, si as succeedSome, sl as PipeInspectableProto, sn as add$3, so as StackTrace, sr as forkIn, ss as loggerMake, st as isGreaterThanOrEqualTo, t as Any, ta as Random$1, tc as ensure, tl as Number$2, to as isSuccess, tr as fn$1, ts as flatMap$1, tt as encodeUnknownExit, u as ErrorClass, ua as build, uc as map$4, ui as tap, un as make$36, ur as ignore, ut as isMaxLength, v as NonEmptyString, va as merge$3, vi as try_, vn as acquireUseRelease, vo as hasInterruptsOnly, vr as logFatal, vt as make$34, w as String$1, wa as sync$2, wn as annotateSpans, wo as map$6, wr as mapError, wt as tag, x as Number$1, xa as provideMerge, xi as undefined_, xl as format, xn as andThen, xr as makeSpanScoped, xs as sync, xt as optional$4, y as Null, ya as mergeAll, yi as tx$1, yl as NodeInspectSymbol, yn as addFinalizer$2, yo as interrupt$2, yr as logInfo, yt as makeFilter, z as Void, za as TracerTimingEnabled, zc as merge$2, zi as timer, zn as contextWith, zo as consolePretty$1, zr as provide, zs as fromInput, zt as head } from "./Schema-CTXk8IgN.mjs";
-import { $ as toAsyncIterable, A as isStream, At as offerUnsafe, C as fromChannel, Ct as end, D as fromQueue, Dt as make$42, E as fromPubSub, F as merge$4, Ft as unbounded$2, G as runFold, Gt as interrupt$4, H as run$2, Ht as makeUnsafe$7, It as publish, K as runForEach, Lt as shutdown$2, M as map$7, Mt as sliding, N as mapEffect$1, Nt as take$1, Ot as offer$1, Pt as takeAll, Q as tick, R as onExit$1, Rt as subscribe$1, S as fromAsyncIterable, St as bounded, T as fromIterable$1, Tt as failCause$4, U as runCollect, Ut as await_, V as provideContext$1, W as runDrain, Wt as getCurrent, Y as succeed$4, Z as takeWhile, _ as ensuring$1, _t as fromTransform, at as make$44, b as filter$2, bt as make$41, d as concat$2, dt as drain, f as debounce$1, ft as forEach$1, g as encodeText, h as empty$5, ht as mapInput, i as FileSystem, it as get$4, j as make$43, jt as shutdown$1, k as fromSubscription, kt as offerAll, l as callback$1, p as decodeText$1, q as runForEachArray, qt as runIn, rt as unwrap$1, t as Path$2, u as catchCause$1, w as fromEffect, x as flatMap$3, xt as makeUnsafe$6, y as failCause$5, zt as unbounded$1 } from "./Path-Bwl3ltR5.mjs";
-import { _ as ChildProcessSpawner, a as Stdio, g as make$45, o as make$46, r as isQuitError } from "./NodeTerminal-_XekCzf-.mjs";
-import { n as layer$7 } from "./NodeServices-Bqqy4DuH.mjs";
-import { $ as raw, Dt as merge$5, Et as fromRecordUnsafe, F as HttpServerError, Ft as makeUnsafe$8, G as retryTransient, H as layer$8, It as modify$3, J as symbol$1, Lt as set$2, Mt as getAndSet, Nt as getUnsafe$2, Pt as make$47, Q as jsonUnsafe, R as RouteNotFound, Rt as update$4, St as jsonUnsafe$1, Tt as fromInput$1, U as HttpClient, W as filterStatusOk$1, X as file, Y as empty$6, Z as isHttpServerResponse, _ as schemaHeaders, _t as get$6, a as withLogAddress, at as stream, bt as HttpClientErrorSchema, ct as filterStatusOk, d as logger$1, et as redirect, f as withLoggerDisabled, g as schemaBodyJson, gt as bodyJson, ht as bearerToken, i as serve$1, it as setHeader, jt as get$5, k as SocketErrorReason, lt as matchStatus, m as ParsedSearchParams, mt as acceptJson, nt as setCookie, ot as text$1, p as HttpServerRequest, pt as schemaBodyJson$1, rt as setCookies, st as uint8Array, t as HttpServer, tt as schemaJson, u as cors, v as toURL, vt as post, wt as empty$7, xt as isHttpClientError, yt as setBody, zt as updateAndGet } from "./HttpServer-ByyNdEXm.mjs";
-import { _ as withDefault$3, a as all$1, c as logLevel, d as option$1, f as port, g as url$2, i as TrueValues, l as map$8, m as string$7, n as FalseValues, o as boolean$5, p as schema$2, r as Record$1, s as int$3, t as Boolean$2, u as number$2 } from "./Config-DrOyN3WS.mjs";
-import { a as make$48, i as keys, n as getOption, o as makeWith$1, r as invalidate, s as set$3, t as get$7 } from "./Cache-Cm78WiyU.mjs";
-import { S as layer$9, _ as defaultEscape, a as DeadlockError, b as makeCompiler$1, c as SqlError, d as UnknownError, g as custom, h as make$49, i as ConstraintError, l as SqlSyntaxError, m as SqlClient, n as AuthorizationError, o as LockTimeoutError, r as ConnectionError, s as SerializationError, t as AuthenticationError, u as StatementTimeoutError, v as defaultTransforms, y as fragment } from "./SqlError-1c-3v7GY.mjs";
+import { $ as encodeEffect, $a as fail$2, $c as map$5, $l as pipe$1, $n as filterOrFail, $r as runPromiseWith, $s as toSeconds, $t as stringifyJson, Aa as addFinalizerExit, Ac as succeed$1, Ai as whileLoop, An as cached$3, As as MinimumTraceLevel, At as withConstructorDefault, Bc as makeUnsafe$3, Bi as snapshotUnsafe, Bl as isTagged, Bn as context, Br as promise, Bs as format$1, Bt as head, C as Record, Ca as provideMerge, Ci as undefined_, Cl as format, Cn as andThen, Cr as makeSpanScoped, Cs as sync, Ct as optionalKey, D as TaggedStruct, Da as unwrap, Dc as isFailure$1, Di as useSpan, Dl as equals, Dn as as$3, Do as pretty, Ds as void_$2, Dt as toCodecStringTree, E as TaggedErrorClass, Ea as sync$2, En as annotateSpans, Eo as map$6, Er as mapError, Et as toCodecJson, F as UndefinedOr, Fa as makeUnsafe$4, Fc as get$3, Fi as withTracerEnabled, Fl as isNotNull, Fn as catchIf, Fo as addFinalizer, Fs as make$40, G as decodeExit, Ga as failCause$3, Gc as flatten$1, Gi as both, Gr as raceFirst, Gt as Transformation, H as declare, Ha as _await, Hi as update$3, Hn as currentSpan, Hr as provideContext, Hs as fromInputUnsafe, Ht as size$2, I as Union, Ia as provide$2, Ii as yieldNow, Il as isNotNullish, In as catchReason, Io as andThen$1, Ir as onInterrupt, It as assign, J as decodeUnknownEffect, Jc as getOrElse, Jl as constVoid, Jn as fail, Jr as retry, Js as min, Jt as transformOrFail, K as decodeSync, Kc as fromNullishOr, Ki as exponential, Kl as constTrue, Kn as ensuring, Kr as repeat, Ks as max, L as Unknown, La as CurrentLogAnnotations, Li as zipWith, Ll as isNotUndefined, Ln as catchTag, Lo as as$2, Lr as option, Lt as append$1, M as URLFromString, Ma as closeUnsafe, Mc as Service$1, Mn as catchCause, Mo as CurrentLoggers$1, Mr as never$1, Ms as ParentSpan, Na as forkUnsafe, Nc as add$2, Ni as withParentSpan, Nl as compose$1, Nn as catchDefect, Nr as onError$1, Ns as Tracer, O as TemplateLiteral, Oa as Scope$1, Oc as isSuccess$1, Oi as void_$1, On as asSome, Oo as prettyErrors, Or as match$1, Ot as toJsonSchemaDocument, P as Undefined, Pa as make$35, Pc as empty$1, Pi as withSpan, Pl as hasProperty, Pn as catchFilter, Pr as onExit, Ps as externalSpan, Q as encode$4, Qa as die$2, Qc as isSome, Qi as catchDone, Ql as identity, Qn as filterMapOrFail, Qs as toMillis, R as UnknownFromJsonString$1, Ra as CurrentLogSpans, Rc as getUnsafe$1, Ri as counter, Rl as isNullish, Rn as catchTags, Rr as orDie, Rt as drop$1, S as Option, Sa as provide$1, Si as txRetry, Sl as toJson, Sn as all, So as interruptors, Sr as logWarning$1, Ss as suspend, St as optional$4, T as Struct, Ta as succeedContext, Ti as uninterruptibleMask$1, Tn as annotateLogs, Ts as uninterruptibleMask, Tt as tag, Uc as firstSomeOf, Ui as withAttributes, Ul as cast, Ur as provideService, Ut as toArray, V as brand, Va as TracerTimingEnabled, Vc as merge$2, Vi as timer, Vn as contextWith, Vo as consolePretty$1, Vr as provide, Vs as fromInput, Vt as isEmpty$2, W as decodeEffect, Wa as fail$3, Wc as flatMap$2, Wi as addDelay, Wl as compose, Wn as die$1, Wr as race, X as decodeUnknownOption, Xc as getOrUndefined, Xi as recurs, Xl as dual, Xo as fiberInterrupt, Xr as runForkWith, Xs as seconds, Xt as onSome, Y as decodeUnknownExit, Ya as make$37, Yc as getOrNull, Yi as passthrough$1, Yl as constant, Yn as failCause$1, Yr as runFork, Ys as minutes, Z as decodeUnknownSync, Za as succeed$3, Zc as isNone, Zi as spaced, Zn as filter$1, Zr as runPromise, Zs as times, Zt as parseJson$1, _ as NonEmptyArray, _a as empty$4, _i as timeoutOption, _l as isEffect$1, _n as toUtc, _r as log$4, _s as scopeAddFinalizerExit, _t as isSchemaError, a as DateTimeUtc, aa as parse$6, ac as flatMapNullishOr, ai as serviceOption, an as value, ar as forEach, as as forever, at as isBetween, b as NullOr, ba as merge$3, bi as try_, bn as acquireUseRelease, bo as hasInterruptsOnly, br as logFatal, bt as makeFilter, c as Defect, ca as Class$1, cc as isReadonlyArrayNonEmpty, ci as succeedNone, cn as add$3, co as NoSuchElementError, cr as forkDetach$1, ct as isGreaterThanOrEqualTo, d as Exit, da as CurrentMemoMap, di as sync$1, dn as isGreaterThanOrEqualTo$1, dr as gen, dt as isMaxLength, ec as zero, el as match, eo as failCause$2, er as flatMap, et as encodeSync, eu as pipeArguments, fa as build, fc as map$4, fi as tap, fn as make$36, fr as ignore, ft as isMaxProperties, g as Never, ga as effectDiscard, gi as timeout, gn as toEpochMillis, gr as isEffect, gs as scope, gt as isSchema, h as Literals, ha as effectContext, hc as sort, hi as tapErrorTag, hn as toDate, hr as interruptible, hs as reportCauseUnsafe, ht as isPattern, i as Class, ia as clamp, ic as filter, ii as service, il as make$39, in as make$38, io as match$2, ir as fnUntraced, is as fnUntraced$1, it as is$1, ja as close, jc as Reference$1, ji as withFiber$1, jn as callback, jo as ConsoleRef, jr as matchEffect, js as NativeSpan, jt as withDecodingDefault, k as Trim, ka as addFinalizer$1, kn as asVoid, ko as squash, kr as matchCauseEffect, kt as toType, l as Duration, li as succeedSome, ll as PipeInspectableProto, ln as distance, lo as StackTrace, lr as forkIn, ls as loggerMake, lt as isInt, m as Literal, ma as effect, mc as reverse, mi as tapError, mn as now, mo as fail$4, mr as interrupt$1, mt as isNonEmpty, n as ArraySchema, nc as empty$3, ni as scoped, nl as some, no as isFailure, nr as flatten$2, nt as encodeUnknownExit, o as DateTimeUtcFromString, oa as Clock, oc as fromIterable, oi as sleep$4, oo as void_$3, or as forever$1, os as forkDetach, ot as isFinite$1, p as Int$1, pa as buildWithMemoMap, pi as tapCause, pn as makeUnsafe$5, po as done, pr as ignoreCause, pt as isMinLength, q as decodeTo, qc as fromUndefinedOr, qi as forever$2, ql as constUndefined, qn as exit, qr as result, qs as millis, r as Boolean$1, ra as Random$1, rc as ensure, rl as Number$2, rn as makeFormatterDefault, ro as isSuccess, rr as fn$1, rs as flatMap$1, rt as fromJsonString, sa as currentTimeMillis, sc as isArrayNonEmpty, si as succeed, sn as encodeBase64Url$2, sr as forkChild, st as isGreaterThan, t as Any, ta as isDoneCause, tc as allocate, ti as scope$1, tl as none$4, tn as InvalidValue$1, to as interrupt$3, tt as encodeUnknownEffect, u as ErrorClass, ua as TaggedError, ui as suspend$1, ul as YieldableProto, un as formatIso, ur as forkScoped, ut as isLessThanOrEqualTo, v as NonEmptyString, vi as timeoutOrElse, vl as withFiber, vn as Transaction$1, vo as hasDies, vr as logDebug, vs as sleep$3, w as String$1, wa as succeed$2, wc as fail$1, wi as uninterruptible, wn as annotateCurrentSpan, wr as map$3, ws as tracerLogger$1, wt as suspend$2, x as Number$1, xa as mergeAll, xi as tx$1, xl as NodeInspectSymbol, xn as addFinalizer$2, xo as interrupt$2, xr as logInfo, xt as mutable, y as Null, ya as launch$1, yi as tryPromise, yn as acquireRelease, yo as hasInterrupts, yr as logError, yt as make$34, z as Void, za as MinimumLogLevel, zc as make$33, zi as gauge, zl as isObject$1, zn as catch_, zr as orElseSucceed, zs as days, zt as empty$2 } from "./Schema-CKuz8TX8.mjs";
+import { $ as toAsyncIterable, A as isStream, At as offerUnsafe, C as fromChannel, Ct as end, D as fromQueue, Dt as make$42, E as fromPubSub, F as merge$4, Ft as unbounded$2, G as runFold, Gt as interrupt$4, H as run$2, Ht as makeUnsafe$7, It as publish, K as runForEach, Lt as shutdown$2, M as map$7, Mt as sliding, N as mapEffect$1, Nt as take$1, Ot as offer$1, Pt as takeAll, Q as tick, R as onExit$1, Rt as subscribe$1, S as fromAsyncIterable, St as bounded, T as fromIterable$1, Tt as failCause$4, U as runCollect, Ut as await_, V as provideContext$1, W as runDrain, Wt as getCurrent, Y as succeed$4, Z as takeWhile, _ as ensuring$1, _t as fromTransform, at as make$44, b as filter$2, bt as make$41, d as concat$2, dt as drain, f as debounce$1, ft as forEach$1, g as encodeText, h as empty$5, ht as mapInput, i as FileSystem, it as get$4, j as make$43, jt as shutdown$1, k as fromSubscription, kt as offerAll, l as callback$1, p as decodeText$1, q as runForEachArray, qt as runIn, rt as unwrap$1, t as Path$2, u as catchCause$1, w as fromEffect, x as flatMap$3, xt as makeUnsafe$6, y as failCause$5, zt as unbounded$1 } from "./Path-DJTwK58E.mjs";
+import { _ as ChildProcessSpawner, a as Stdio, g as make$45, o as make$46, r as isQuitError } from "./NodeTerminal-Ke6chk0A.mjs";
+import { n as layer$7 } from "./NodeServices-Da5rUDDE.mjs";
+import { $ as jsonUnsafe, A as SocketErrorReason, Bt as updateAndGet, Ct as jsonUnsafe$1, Dt as fromRecordUnsafe, Et as fromInput$1, Ft as make$47, G as filterStatusOk$1, I as HttpServerError, It as makeUnsafe$8, K as retryTransient, Lt as modify$3, Mt as get$5, Nt as getAndSet, Ot as merge$5, Pt as getUnsafe$2, Q as isHttpServerResponse, Rt as set$2, St as isHttpClientError, Tt as empty$7, U as layer$8, W as HttpClient, X as empty$6, Y as symbol$1, Z as file, _ as schemaBodyUrlParams, _t as bodyJson, a as withLogAddress, at as setHeader, bt as setBody, ct as uint8Array, d as logger$1, et as raw, f as withLoggerDisabled, g as schemaBodyJson, gt as bearerToken, ht as acceptJson, i as serve$1, it as setCookies, lt as filterStatusOk, m as ParsedSearchParams, mt as schemaBodyJson$1, nt as schemaJson, ot as stream, p as HttpServerRequest, rt as setCookie, st as text$1, t as HttpServer, tt as redirect, u as cors, ut as matchStatus, v as schemaHeaders, vt as get$6, xt as HttpClientErrorSchema, y as toURL, yt as post, z as RouteNotFound, zt as update$4 } from "./HttpServer-DV-x5DVo.mjs";
+import { _ as withDefault$3, a as all$1, c as logLevel, d as option$1, f as port, g as url$2, i as TrueValues, l as map$8, m as string$7, n as FalseValues, o as boolean$5, p as schema$2, r as Record$1, s as int$3, t as Boolean$2, u as number$2 } from "./Config-To1VEqlB.mjs";
+import { a as make$48, i as keys, n as getOption, o as makeWith$1, r as invalidate, s as set$3, t as get$7 } from "./Cache-CHvh_vWI.mjs";
+import { S as layer$9, _ as defaultEscape, a as DeadlockError, b as makeCompiler$1, c as SqlError, d as UnknownError, g as custom, h as make$49, i as ConstraintError, l as SqlSyntaxError, m as SqlClient, n as AuthorizationError, o as LockTimeoutError, r as ConnectionError, s as SerializationError, t as AuthenticationError, u as StatementTimeoutError, v as defaultTransforms, y as fragment } from "./SqlError-DhK0hV8S.mjs";
 import { a as diag, c as SpanKind$1, d as TraceFlags, f as ROOT_CONTEXT, i as propagation, l as isSpanContextValid, m as DiagLogLevel, n as init_esm$1, o as context$1, p as createContextKey, r as trace, s as SpanStatusCode, t as esm_exports$1 } from "./esm-Ce1GqbVk.mjs";
 import { t as Mime_default } from "./Mime-BITO-E1U.mjs";
 import { a as verifyCmmdAuthRuntimeTicket, c as verifyCmmdRuntimeTicketRefreshProof, d as createReadOnceFileTokenAccessor, i as sendRuntimeControlHeartbeat, l as runtimeGrantToken, n as bootstrapRuntimeControlAuthorityFromNarrowGrant, o as verifyCmmdClaudeReadinessTicket, r as readRuntimeControlAuthority, s as verifyCmmdRuntimeTicket, t as bootstrapRuntimeControlAuthority, u as setRuntimeGrantToken } from "./runtimeControlAuthority-L85w5RTn.mjs";
-import { n as PtySpawnError, t as PtyAdapter } from "./PTY-CBkE5akF.mjs";
+import { n as PtySpawnError, t as PtyAdapter } from "./PTY-X-4Tv31s.mjs";
 import { createRequire } from "node:module";
 import * as HE from "node:child_process";
 import { execFile, execFileSync, spawn, spawnSync } from "node:child_process";
@@ -22,7 +22,7 @@ import { createCipheriv, createDecipheriv, createHash, createHmac, createPublicK
 import * as FS$1 from "node:fs";
 import fs, { accessSync, chmodSync, constants, createReadStream, existsSync, mkdirSync, mkdtempSync, promises, readFile, readFileSync, readdir, readdirSync, realpathSync, rmSync, statSync, writeFileSync } from "node:fs";
 import * as NodeOS from "node:os";
-import os, { homedir, networkInterfaces, tmpdir } from "node:os";
+import $U, { homedir, networkInterfaces, tmpdir } from "node:os";
 import * as Path$1 from "node:path";
 import path, { basename, delimiter, dirname, extname, isAbsolute, join, posix, relative, resolve, sep } from "node:path";
 import { pathToFileURL } from "node:url";
@@ -17588,6 +17588,7 @@ const ExecutionEnvironmentCapabilities = Struct({
 	pullRequests: optionalKey(Boolean$1),
 	threadPullRequestLinking: optionalKey(Boolean$1),
 	cloudMode: Boolean$1.pipe(withDecodingDefault(succeed(false))),
+	threadSettlement: optionalKey(Boolean$1),
 	posthogPublicKey: NullOr(String$1).pipe(withDecodingDefault(succeed(null))),
 	posthogHost: NullOr(String$1).pipe(withDecodingDefault(succeed(null))),
 	runtime: optionalKey(ExecutionEnvironmentRuntimeCapabilities),
@@ -52182,7 +52183,7 @@ function _supportsColor(haveStream, { streamIsTTY, sniffFlags = true } = {}) {
 	const min = forceColor || 0;
 	if (env.TERM === "dumb") return min;
 	if (process$1.platform === "win32") {
-		const osRelease = os.release().split(".");
+		const osRelease = $U.release().split(".");
 		if (Number(osRelease[0]) >= 10 && Number(osRelease[2]) >= 10586) return Number(osRelease[2]) >= 14931 ? 3 : 2;
 		return 1;
 	}
@@ -54625,7 +54626,7 @@ var require_ProcessDetector = /* @__PURE__ */ __commonJSMin(((exports) => {
 	exports.processDetector = void 0;
 	const api_1 = (init_esm$1(), __toCommonJS(esm_exports$1));
 	const semconv_1 = require_semconv$1();
-	const os$4 = __require("os");
+	const os$3 = __require("os");
 	/**
 	* ProcessDetector will be used to detect the resources related current process running
 	* and being instrumented from the NodeJS Process module.
@@ -54647,7 +54648,7 @@ var require_ProcessDetector = /* @__PURE__ */ __commonJSMin(((exports) => {
 			};
 			if (process.argv.length > 1) attributes[semconv_1.ATTR_PROCESS_COMMAND] = process.argv[1];
 			try {
-				const userInfo = os$4.userInfo();
+				const userInfo = os$3.userInfo();
 				attributes[semconv_1.ATTR_PROCESS_OWNER] = userInfo.username;
 			} catch (e) {
 				api_1.diag.debug(`error obtaining process owner: ${e}`);
@@ -67972,6 +67973,30 @@ const respondToAuthError = (error) => gen(function* () {
 	}));
 	return response;
 });
+const OAUTH_ACCESS_TOKEN_TYPE = "urn:ietf:params:oauth:token-type:access_token";
+/**
+* The one exchange this endpoint performs, or the reason it will not.
+*
+* Returns a message rather than a boolean so the route can say which field was
+* wrong: an operator debugging a pairing failure otherwise cannot tell an
+* unsupported grant from an unsupported token type.
+*/
+function rejectUnsupportedTokenExchange(input) {
+	if (input.grant_type !== "urn:ietf:params:oauth:grant-type:token-exchange") return "Unsupported grant_type.";
+	if (input.subject_token_type !== "urn:t3:params:oauth:token-type:environment-bootstrap") return "Unsupported subject_token_type.";
+	if (input.requested_token_type !== "urn:ietf:params:oauth:token-type:access_token") return "Unsupported requested_token_type.";
+	return null;
+}
+/**
+* `expires_in` is a duration in seconds; a session carries an absolute instant.
+*
+* Clamped at zero so a session that expired between issuance and this call is
+* reported as already expired rather than as a negative lifetime, which a client
+* could read as a very large unsigned value.
+*/
+function accessTokenExpiresInSeconds(remainingMillis) {
+	return Math.max(0, Math.floor(remainingMillis / 1e3));
+}
 //#endregion
 //#region ../../packages/shared/src/cmmdIdentity.ts
 const MAX_CMMD_AVATAR_URL_LENGTH = 256 * 1024;
@@ -69171,6 +69196,16 @@ const CommandOAuthDeviceInput = Struct({
 	return_url: optionalKey(String$1),
 	scope: optionalKey(String$1)
 });
+const OAuthTokenExchangeInput = Struct({
+	grant_type: String$1,
+	subject_token: String$1,
+	subject_token_type: String$1,
+	requested_token_type: String$1,
+	scope: optional$4(String$1),
+	client_label: optional$4(String$1),
+	client_device_type: optional$4(String$1),
+	client_os: optional$4(String$1)
+});
 const CommandOAuthTokenInput = Struct({
 	grant_type: String$1,
 	device_code: String$1,
@@ -70012,6 +70047,50 @@ const authBearerBootstrapRouteLayer = add$1("POST", "/api/auth/bootstrap/bearer"
 	})));
 	return jsonUnsafe(yield* serverAuth.exchangeBootstrapCredentialForBearerSession(payload.credential, deriveAuthClientMetadata({ request })), { status: 200 });
 }).pipe(catchTag("AuthError", (error) => respondToAuthError(error))));
+/**
+* FORGE COMPAT. `POST /oauth/token` — the RFC 8693 token exchange the vendored
+* t3code client uses to turn a pairing credential into a bearer token.
+*
+* Forge's own clients call `/api/auth/bootstrap/bearer` with JSON. The mobile app
+* cannot: the endpoint is baked into the vendored contract
+* (packages/t3-contracts/src/environmentHttp.ts) as a form-urlencoded OAuth
+* exchange, and without it every attempt to add an environment fails with a 404 —
+* which leaves the whole app unusable, since no screen works before an
+* environment exists.
+*
+* This is a shape adapter, not a second way to authenticate. It performs no
+* validation of its own and mints nothing: it forwards the subject token to the
+* same `exchangeBootstrapCredentialForBearerSession` the JSON route uses, so the
+* credential rules, expiry and session issuance stay in one place. The only work
+* here is vocabulary — form encoding in, OAuth field names out.
+*
+* Same pattern as the vcs.* handlers in ws.ts: the Forge server speaks upstream's
+* dialect over Forge's own services, rather than the vendored client being patched
+* to speak Forge's.
+*/
+const authOAuthTokenExchangeRouteLayer = add$1("POST", "/oauth/token", gen(function* () {
+	const request = yield* HttpServerRequest;
+	const serverAuth = yield* ServerAuth;
+	const payload = yield* schemaBodyUrlParams(OAuthTokenExchangeInput).pipe(mapError((cause) => new AuthError({
+		message: "Invalid token exchange payload.",
+		status: 400,
+		cause
+	})));
+	const refusal = rejectUnsupportedTokenExchange(payload);
+	if (refusal !== null) return yield* new AuthError({
+		message: refusal,
+		status: 400
+	});
+	const session = yield* serverAuth.exchangeBootstrapCredentialForBearerSession(payload.subject_token, deriveAuthClientMetadata({ request }));
+	const expiresInSeconds = accessTokenExpiresInSeconds(toMillis(distance(yield* now, session.expiresAt)));
+	return jsonUnsafe({
+		access_token: session.sessionToken,
+		issued_token_type: OAUTH_ACCESS_TOKEN_TYPE,
+		token_type: "Bearer",
+		expires_in: expiresInSeconds,
+		scope: payload.scope ?? session.role
+	}, { status: 200 });
+}).pipe(catchTag("AuthError", (error) => respondToAuthError(error))));
 const authWebSocketTokenRouteLayer = add$1("POST", "/api/auth/ws-token", gen(function* () {
 	const request = yield* HttpServerRequest;
 	const serverAuth = yield* ServerAuth;
@@ -76071,7 +76150,7 @@ var require_node_gyp_build = /* @__PURE__ */ __commonJSMin(((exports, module) =>
 	var fs$6 = __require("fs");
 	var path$5 = __require("path");
 	var url$1 = __require("url");
-	var os$3 = __require("os");
+	var os$2 = __require("os");
 	var runtimeRequire = typeof __webpack_require__ === "function" ? __non_webpack_require__ : __require;
 	var vars = process.config && process.config.variables || {};
 	var prebuildsOnly = !!process.env.PREBUILDS_ONLY;
@@ -76079,8 +76158,8 @@ var require_node_gyp_build = /* @__PURE__ */ __commonJSMin(((exports, module) =>
 	var abi = versions.modules;
 	if (versions.deno || process.isBun) abi = "unsupported";
 	var runtime = isElectron() ? "electron" : isNwjs() ? "node-webkit" : "node";
-	var arch = process.env.npm_config_arch || os$3.arch();
-	var platform = process.env.npm_config_platform || os$3.platform();
+	var arch = process.env.npm_config_arch || os$2.arch();
+	var platform = process.env.npm_config_platform || os$2.platform();
 	var libc = process.env.LIBC || (isMusl(platform) ? "musl" : "glibc");
 	var armv = process.env.ARM_VERSION || (arch === "arm64" ? "8" : vars.arm_version) || "";
 	var uv = (versions.uv || "").split(".")[0];
@@ -93715,7 +93794,7 @@ const launchDetached = (launch) => gen(function* () {
 });
 const OpenLive = effect(Open, gen(function* () {
 	const open = yield* tryPromise({
-		try: () => import("./open-FIgTDosf.mjs"),
+		try: () => import("./open-D8mGyWmt.mjs"),
 		catch: (cause) => new OpenError$1({
 			message: "failed to load browser opener",
 			cause
@@ -113371,8 +113450,8 @@ effectDiscard(runMigrations());
 //#endregion
 //#region src/persistence/Layers/Sqlite.ts
 const defaultSqliteClientLoaders = {
-	bun: () => import("./SqliteClient-aoOb51gB.mjs"),
-	node: () => import("./NodeSqliteClient-OdI1TawL.mjs")
+	bun: () => import("./SqliteClient-CA7vjiUj.mjs"),
+	node: () => import("./NodeSqliteClient-CcLD4Zvr.mjs")
 };
 const makeRuntimeSqliteLayer = fn$1("makeRuntimeSqliteLayer")(function* (config) {
 	const loader = defaultSqliteClientLoaders[process.versions.bun !== void 0 ? "bun" : "node"];
@@ -146712,22 +146791,58 @@ function runtimeAuthoritySessionId(input) {
 	if (input.authSessionId) return input.authSessionId;
 	return input.threadId ? readThreadSessionId(input.threadId) : null;
 }
+/**
+* Pure mapping from the three preconditions to an outcome.
+*
+* Split out so the reason can be tested without an Effect runtime, env vars or
+* module mocking — the decision is the thing worth pinning, not the plumbing
+* around it.
+*/
+function resolveBrokerTicketOutcome(input) {
+	if (input.identityMode === "legacy") return {
+		kind: "ticket",
+		token: input.legacyGrantToken
+	};
+	if (input.identityMode === "invalid") return {
+		kind: "unavailable",
+		reason: "runtime identity is incomplete or invalid"
+	};
+	if (!input.sessionId) return {
+		kind: "unavailable",
+		reason: "no owner session is bound to this request"
+	};
+	return input.brokerAuthority ? {
+		kind: "ticket",
+		token: input.brokerAuthority
+	} : {
+		kind: "unavailable",
+		reason: "no live broker authority for this session"
+	};
+}
 function runtimeProviderBrokerToken(input) {
 	const identity = classifyRuntimeBrokerIdentity({
 		machineId: configuredRuntimeMachineId() ?? void 0,
 		credentialEpoch: configuredRuntimeCredentialEpoch(),
 		brokerAuthorityMode: process.env.FORGE_CMMD_RUNTIME_BROKER_AUTHORITY_MODE
 	});
-	if (identity.mode === "legacy") return runtimeGrantToken();
-	if (identity.mode === "invalid") return null;
+	if (identity.mode !== "exact") return resolveBrokerTicketOutcome({
+		identityMode: identity.mode,
+		legacyGrantToken: identity.mode === "legacy" ? runtimeGrantToken() : null,
+		sessionId: null,
+		brokerAuthority: null
+	});
 	const sessionId = runtimeAuthoritySessionId(input);
-	if (!sessionId) return null;
-	return readRuntimeBrokerAuthority({
+	return resolveBrokerTicketOutcome({
+		identityMode: "exact",
+		legacyGrantToken: null,
 		sessionId,
-		runtimeId: process.env.FORGE_CMMD_RUNTIME_ID,
-		machineId: identity.machineId,
-		credentialEpoch: identity.credentialEpoch,
-		requiredScope: "provider"
+		brokerAuthority: sessionId ? readRuntimeBrokerAuthority({
+			sessionId,
+			runtimeId: process.env.FORGE_CMMD_RUNTIME_ID,
+			machineId: identity.machineId,
+			credentialEpoch: identity.credentialEpoch,
+			requiredScope: "provider"
+		}) : null
 	});
 }
 async function fetchRuntimeProviderGrant(input) {
@@ -146772,8 +146887,9 @@ const issueProviderEgressCredential = (input) => tryPromise({
 async function issueCmmdRuntimeProviderEgressCredential(input) {
 	const controlPlaneUrl = process.env.FORGE_COMMAND_APP_URL.replace(/\/+$/, "");
 	const runtimeId = encodeURIComponent(process.env.FORGE_CMMD_RUNTIME_ID);
-	const runtimeGrantToken = runtimeProviderBrokerToken(input);
-	if (!runtimeGrantToken) throw new Error("Provider token issuance requires a live exact-machine broker authority for this runtime epoch.");
+	const brokerTicket = runtimeProviderBrokerToken(input);
+	if (brokerTicket.kind === "unavailable") throw new Error(`Provider token issuance requires a live exact-machine broker authority for this runtime epoch (${brokerTicket.reason}).`);
+	const runtimeGrantToken = brokerTicket.token;
 	const response = await fetchRuntimeProviderGrant({
 		url: `${controlPlaneUrl}/api/forge/runtimes/${runtimeId}/provider/token`,
 		token: runtimeGrantToken,
@@ -186060,7 +186176,7 @@ var Vce = {
 function Ve() {
 	return Vce;
 }
-var Us = os.homedir(), lk = os.tmpdir(), { env: Vc } = process$1, Yce = (e) => {
+var Us = $U.homedir(), lk = $U.tmpdir(), { env: Vc } = process$1, Yce = (e) => {
 	let t = path.join(Us, "Library");
 	return {
 		data: path.join(t, "Application Support", e),
@@ -196260,12 +196376,12 @@ function qZ(e, t) {
 	}
 	return n;
 }
-var os$2 = "https://code.claude.com/docs/en", kKe = [
+var os$1 = "https://code.claude.com/docs/en", kKe = [
 	{
 		matches: (e) => e.path === "permissions.defaultMode" && e.code === "invalid_value",
 		tip: {
 			suggestion: "Valid modes: \"acceptEdits\" (ask before file changes), \"plan\" (analysis only), \"bypassPermissions\" (auto-accept all), or \"default\" (standard behavior)",
-			docLink: `${os$2}/iam#permission-modes`
+			docLink: `${os$1}/iam#permission-modes`
 		}
 	},
 	{
@@ -196280,7 +196396,7 @@ var os$2 = "https://code.claude.com/docs/en", kKe = [
 		matches: (e) => e.path.startsWith("env.") && e.code === "invalid_type",
 		tip: {
 			suggestion: "Environment variables must be strings. Wrap numbers and booleans in quotes. Example: \"DEBUG\": \"true\", \"PORT\": \"3000\"",
-			docLink: `${os$2}/settings#environment-variables`
+			docLink: `${os$1}/settings#environment-variables`
 		}
 	},
 	{
@@ -196291,14 +196407,14 @@ var os$2 = "https://code.claude.com/docs/en", kKe = [
 		matches: (e) => e.path.startsWith("hooks.") && e.code === "invalid_key",
 		tip: {
 			suggestion: "Not a recognized hook event. Common events: PreToolUse, PostToolUse, UserPromptSubmit, SessionStart, SessionEnd, Stop. Check spelling and capitalization.",
-			docLink: `${os$2}/hooks`
+			docLink: `${os$1}/hooks`
 		}
 	},
 	{
 		matches: (e) => /\.hooks\.\d+\.command$/.test(e.path) && e.code === "invalid_type" && e.received === "undefined",
 		tip: {
 			suggestion: "Command hooks require `command`. For exec form (no shell), set `command` to the executable and `args` to its arguments: {\"type\": \"command\", \"command\": \"echo\", \"args\": [\"hi\"]}. For shell form, set `command` to the full shell string: {\"type\": \"command\", \"command\": \"echo hi\"}.",
-			docLink: `${os$2}/hooks#exec-form-and-shell-form`
+			docLink: `${os$1}/hooks#exec-form-and-shell-form`
 		}
 	},
 	{
@@ -196313,7 +196429,7 @@ var os$2 = "https://code.claude.com/docs/en", kKe = [
 		matches: (e) => e.code === "unrecognized_keys",
 		tip: {
 			suggestion: "Check for typos or refer to the documentation for valid fields",
-			docLink: `${os$2}/settings`
+			docLink: `${os$1}/settings`
 		}
 	},
 	{
@@ -196328,13 +196444,13 @@ var os$2 = "https://code.claude.com/docs/en", kKe = [
 		matches: (e) => e.path === "permissions.additionalDirectories" && e.code === "invalid_type",
 		tip: {
 			suggestion: "Must be an array of directory paths. Example: [\"~/projects\", \"/tmp/workspace\"]. You can also use --add-dir flag or /add-dir command",
-			docLink: `${os$2}/iam#working-directories`
+			docLink: `${os$1}/iam#working-directories`
 		}
 	}
 ], AKe = {
-	permissions: `${os$2}/iam#configuring-permissions`,
-	env: `${os$2}/settings#environment-variables`,
-	hooks: `${os$2}/hooks`
+	permissions: `${os$1}/iam#configuring-permissions`,
+	env: `${os$1}/settings#environment-variables`,
+	hooks: `${os$1}/hooks`
 };
 function GZ(e) {
 	let t = kKe.find((r) => r.matches(e));
@@ -205021,6 +205137,48 @@ function applyPluginSkillPermissionsToDynamicTools(tools, settings) {
 	});
 }
 //#endregion
+//#region src/github/forgeGitHubToolHandler.ts
+/**
+* Shared wiring for Forge's brokered GitHub tools.
+*
+* Both provider surfaces run the same handler: Codex exposes the tools
+* natively, Claude reaches them over in-process MCP (`GitHubMcpServer.ts`).
+* The auth binding, the write confirmation gate and the audit trail live here
+* so a new surface cannot accidentally omit one — the handler's own defaults
+* are deliberately inert (no audit, never confirmed), which is safe for tests
+* but wrong for a real turn.
+*/
+function createForgeGitHubToolHandlerOptions(deps) {
+	const { runWithRuntimeContext } = deps;
+	return {
+		broker: new GitHubBroker({
+			resolveJwt: (auth) => runWithRuntimeContext(resolveCmmdJwtForSession({
+				sessionId: auth.sessionId,
+				logPrefix: deps.logPrefix,
+				...auth.subject !== void 0 ? { subject: auth.subject } : {},
+				...auth.forceRefresh !== void 0 ? { forceRefresh: auth.forceRefresh } : {}
+			})),
+			githubWriteIdentity: deps.githubWriteIdentity
+		}),
+		resolveAuth: async (threadId) => {
+			const binding = await runWithRuntimeContext(readThreadAuthSession(threadId));
+			return binding ? {
+				sessionId: binding.sessionId,
+				...binding.subject ? { subject: binding.subject } : {}
+			} : null;
+		},
+		recordAudit: (auditEvent) => runWithRuntimeContext(recordGitHubToolAuditEvent(auditEvent).pipe(asVoid)),
+		createConfirmation: (confirmation) => runWithRuntimeContext(createGitHubToolConfirmation(confirmation)),
+		isConfirmed: (confirmation) => runWithRuntimeContext(consumeApprovedOrLatestGitHubToolConfirmation({
+			confirmationId: confirmation.confirmationId,
+			threadId: confirmation.threadId,
+			toolName: confirmation.toolName,
+			request: confirmation.request
+		})),
+		bypassWriteConfirmation: deps.bypassWriteConfirmation
+	};
+}
+//#endregion
 //#region src/provider/shellSafety.ts
 const SHELL_SAFE_COMMAND_PATH_PATTERN = /^[A-Za-z0-9_.\-/\\:]+$/;
 function isShellSafeCommandPath(command) {
@@ -206309,33 +206467,12 @@ const makeCodexAdapter = fn$1("makeCodexAdapter")(function* (options) {
 		}));
 		const browserToolEnvironmentId = yield* resolveBrowserToolEnvironmentId$1();
 		const computerManager = resolveComputerManager(serverConfig);
-		const githubDynamicToolHandler = createCodexGitHubDynamicToolHandler({
-			broker: new GitHubBroker({
-				resolveJwt: (auth) => runWithRuntimeContext(resolveCmmdJwtForSession({
-					sessionId: auth.sessionId,
-					logPrefix: "codex-github",
-					...auth.subject !== void 0 ? { subject: auth.subject } : {},
-					...auth.forceRefresh !== void 0 ? { forceRefresh: auth.forceRefresh } : {}
-				})),
-				githubWriteIdentity: settings.githubWriteIdentity
-			}),
-			resolveAuth: async (threadId) => {
-				const binding = await runWithRuntimeContext(readThreadAuthSession(threadId));
-				return binding ? {
-					sessionId: binding.sessionId,
-					...binding.subject ? { subject: binding.subject } : {}
-				} : null;
-			},
-			recordAudit: (auditEvent) => runWithRuntimeContext(recordGitHubToolAuditEvent(auditEvent).pipe(asVoid)),
-			createConfirmation: (confirmation) => runWithRuntimeContext(createGitHubToolConfirmation(confirmation)),
-			isConfirmed: (confirmation) => runWithRuntimeContext(consumeApprovedOrLatestGitHubToolConfirmation({
-				confirmationId: confirmation.confirmationId,
-				threadId: confirmation.threadId,
-				toolName: confirmation.toolName,
-				request: confirmation.request
-			})),
+		const githubDynamicToolHandler = createCodexGitHubDynamicToolHandler(createForgeGitHubToolHandlerOptions({
+			runWithRuntimeContext,
+			githubWriteIdentity: settings.githubWriteIdentity,
+			logPrefix: "codex-github",
 			bypassWriteConfirmation: input.runtimeMode === "full-access"
-		});
+		}));
 		const cmmdConnectorDynamicToolHandler = createCodexCmmdConnectorDynamicToolHandler({ resolveAuth: async (threadId) => {
 			const binding = await runWithRuntimeContext(readThreadAuthSession(threadId));
 			if (!binding) return null;
@@ -207879,6 +208016,62 @@ function createDevServerMcpServer(deps, threadId) {
 	});
 }
 //#endregion
+//#region src/github/GitHubMcpServer.ts
+/**
+* Brokered Forge GitHub tools, exposed to the Claude surface (in-process MCP).
+*
+* The Codex app-server consumes these tools as native dynamic tools; Claude
+* reaches them through MCP instead. Both surfaces dispatch the SAME handler
+* (`createCodexGitHubDynamicToolHandler`), so auth resolution, the write
+* confirmation gate and the audit trail are shared rather than reimplemented
+* per provider — this module only adapts descriptor + result shapes.
+*
+* Without it a Claude agent has no brokered push path at all and falls back to
+* raw `git`, which the runtime deliberately blocks via `GIT_ASKPASS=/bin/false`.
+*
+* Result envelopes are relayed verbatim as tool content: the web approval card
+* is built by scanning tool results for `userActionRequired`, so summarising or
+* reshaping the payload here would silently strip the user's ability to approve
+* a write.
+*/
+const GITHUB_MCP_SERVER_NAME = "forge-github";
+/** Joins the brokered result's content items back into a single text payload. */
+function readResultText(contentItems) {
+	return contentItems.map((item) => item.text).filter((text) => typeof text === "string").join("\n");
+}
+/**
+* Factored out of `createGitHubMcpServer` (mirroring the Sidekick tools server)
+* so dispatch and envelope handling are testable without the SDK's `tool()` /
+* `createSdkMcpServer` machinery.
+*/
+function buildGitHubToolHandlers(runBrokeredTool, threadId) {
+	return createCodexGitHubDynamicTools().map((descriptor) => ({
+		name: descriptor.name,
+		description: descriptor.description,
+		inputSchema: jsonSchemaToZodShape(descriptor.inputSchema),
+		handler: async (args) => {
+			const result = await runBrokeredTool({
+				threadId,
+				tool: descriptor.name,
+				arguments: args
+			});
+			return {
+				content: [{
+					type: "text",
+					text: readResultText(result.contentItems)
+				}],
+				...result.success ? {} : { isError: true }
+			};
+		}
+	}));
+}
+function createGitHubMcpServer(runBrokeredTool, threadId) {
+	return z1e({
+		name: GITHUB_MCP_SERVER_NAME,
+		tools: buildGitHubToolHandlers(runBrokeredTool, threadId).map((entry) => U1e(entry.name, entry.description, entry.inputSchema, entry.handler))
+	});
+}
+//#endregion
 //#region src/provider/providerAuthFailureCopy.ts
 /**
 * Rewrite provider auth failures into an action the user can actually take.
@@ -208183,6 +208376,7 @@ function buildClaudeMcpServers(input) {
 		"forge-browser": createBrowserMcpServer(input.browserManager, input.threadId, browserToolScope(input.browserToolEnvironmentId)),
 		"forge-dev-server": createDevServerMcpServer(input.devServerToolDeps, input.threadId),
 		"cmmd-context": createCmmdContextMcpServer(input.threadId, input.resolveCmmdPat),
+		[GITHUB_MCP_SERVER_NAME]: createGitHubMcpServer(input.runBrokeredGitHubTool, input.threadId),
 		...input.computerManager ? { [COMPUTER_MCP_SERVER_NAME]: createComputerMcpServer(input.computerManager, input.threadId) } : {},
 		...input.cmmdSidekickTools ? { "cmmd-sidekick-tools": createCmmdSidekickToolsMcpServer(input.cmmdSidekickTools.session, input.cmmdSidekickTools.tools) } : {}
 	};
@@ -210192,6 +210386,12 @@ const makeClaudeAdapter = fn$1("makeClaudeAdapter")(function* (options) {
 		const permissionMode = permissionModeForRuntimeMode(input.runtimeMode);
 		const settings = claudeQuerySettings(modelConfig.thinking, modelConfig.fastMode);
 		const systemPrompt = buildClaudeSystemPrompt(modelConfig.endpointProfile, serverSettings.coauthorIncludeForge);
+		const runBrokeredGitHubTool = createCodexGitHubDynamicToolHandler(createForgeGitHubToolHandlerOptions({
+			runWithRuntimeContext: runWithSqlRuntimeContext,
+			githubWriteIdentity: serverSettings.githubWriteIdentity,
+			logPrefix: "claude-github",
+			bypassWriteConfirmation: input.runtimeMode === "full-access"
+		}));
 		const queryRuntime = yield* createClaudeQueryRuntime(prompt, buildClaudeQueryOptions({
 			cwd: input.cwd,
 			effectiveApiModelId: modelConfig.effectiveApiModelId,
@@ -210211,7 +210411,8 @@ const makeClaudeAdapter = fn$1("makeClaudeAdapter")(function* (options) {
 			computerManager,
 			resolveCmmdPat,
 			devServerToolDeps,
-			cmmdSidekickTools
+			cmmdSidekickTools,
+			runBrokeredGitHubTool
 		}), threadId);
 		const session = buildClaudeProviderSession({
 			threadId,
@@ -260394,7 +260595,7 @@ var import_multicast_dns = /* @__PURE__ */ __toESM((/* @__PURE__ */ __commonJSMi
 	var dgram = __require("dgram");
 	var thunky = require_thunky();
 	var events = __require("events");
-	var os$1 = __require("os");
+	var os = __require("os");
 	var noop = function() {};
 	module.exports = function(opts) {
 		if (!opts) opts = {};
@@ -260525,14 +260726,14 @@ var import_multicast_dns = /* @__PURE__ */ __toESM((/* @__PURE__ */ __commonJSMi
 		return that;
 	};
 	function defaultInterface() {
-		var networks = os$1.networkInterfaces();
+		var networks = os.networkInterfaces();
 		var names = Object.keys(networks);
 		for (var i = 0; i < names.length; i++) {
 			var net = networks[names[i]];
 			for (var j = 0; j < net.length; j++) {
 				var iface = net[j];
 				if (isIPv4(iface.family) && !iface.internal) {
-					if (os$1.platform() === "darwin" && names[i] === "en0") return iface.address;
+					if (os.platform() === "darwin" && names[i] === "en0") return iface.address;
 					return "0.0.0.0";
 				}
 			}
@@ -260540,7 +260741,7 @@ var import_multicast_dns = /* @__PURE__ */ __toESM((/* @__PURE__ */ __commonJSMi
 		return "127.0.0.1";
 	}
 	function allInterfaces() {
-		var networks = os$1.networkInterfaces();
+		var networks = os.networkInterfaces();
 		var names = Object.keys(networks);
 		var res = [];
 		for (var i = 0; i < names.length; i++) {
@@ -283125,7 +283326,9 @@ const ProviderCommandReactorLive = effect(ProviderCommandReactor, gen(function*
 			projects: readModel.projects
 		});
 		if (!cwd) return "Forge could not resolve the project folder for this thread.";
-		if (serverConfig.forgeCmmdRuntimeMode === true && !isPathInsideAnyRoot(cwd, [serverConfig.cloudProjectsRoot, serverConfig.worktreesDir])) return "Forge blocked this agent turn because the project folder is outside the managed runtime workspace.";
+		const isCloudExecutionRuntime = serverConfig.forgeCmmdRuntimeMode === true;
+		const managedRoots = [serverConfig.cloudProjectsRoot, serverConfig.worktreesDir];
+		if (isCloudExecutionRuntime && !isPathInsideAnyRoot(cwd, managedRoots)) return `Forge blocked this agent turn because the project folder is outside the managed runtime workspace. Folder: ${cwd}. Managed roots: ${managedRoots.join(", ")}.`;
 		if (thread.anchorKind === "task" && project?.repositoryIdentity == null && !isGitWorkspace(cwd)) return "Forge created this task thread, but the project folder is not a Git repository yet. Import or link the repository before starting an agent turn.";
 		return null;
 	});
@@ -288483,6 +288686,7 @@ function executionEnvironmentCapabilities(serverConfig) {
 		repositoryIdentity: true,
 		pullRequests: isExecutionPlane,
 		threadPullRequestLinking: isExecutionPlane,
+		threadSettlement: isExecutionPlane,
 		cloudMode: serverConfig.forgeCmmdRuntimeMode === true || isCloudShell,
 		runtime: {
 			topology: runtimeTopology(serverConfig),
@@ -310312,16 +310516,16 @@ const gitUrlCloneRouteLayer = add$1("POST", "/api/cloud/git/clone-url", gen(func
 //#endregion
 //#region src/server.ts
 const PtyAdapterLive = unwrap(gen(function* () {
-	if (typeof Bun !== "undefined") return (yield* promise(() => import("./BunPTY-D-Klry5N.mjs"))).layer;
-	else return (yield* promise(() => import("./NodePTY-BMUFdM93.mjs"))).layer;
+	if (typeof Bun !== "undefined") return (yield* promise(() => import("./BunPTY-B7ThejfA.mjs"))).layer;
+	else return (yield* promise(() => import("./NodePTY-RnitYPTs.mjs"))).layer;
 }));
 const HttpServerLive = unwrap(gen(function* () {
 	const config = yield* ServerConfig;
-	if (typeof Bun !== "undefined") return (yield* promise(() => import("./BunHttpServer-BgNCpQzV.mjs"))).layer({
+	if (typeof Bun !== "undefined") return (yield* promise(() => import("./BunHttpServer-C_855q3m.mjs"))).layer({
 		port: config.port,
 		...config.host ? { hostname: config.host } : {}
 	});
-	const [NodeHttpServer, NodeHttp] = yield* all([promise(() => import("./NodeHttpServer-C_wePPV0.mjs")), promise(() => import("node:http"))]);
+	const [NodeHttpServer, NodeHttp] = yield* all([promise(() => import("./NodeHttpServer-DgD75IAg.mjs")), promise(() => import("node:http"))]);
 	return NodeHttpServer.layer(NodeHttp.createServer, {
 		host: config.host,
 		port: config.port
@@ -310329,10 +310533,10 @@ const HttpServerLive = unwrap(gen(function* () {
 }));
 const PlatformServicesLive = unwrap(gen(function* () {
 	if (typeof Bun !== "undefined") {
-		const { layer } = yield* promise(() => import("./BunServices-ChM4mYH9.mjs"));
+		const { layer } = yield* promise(() => import("./BunServices-BFygTrvx.mjs"));
 		return layer;
 	} else {
-		const { layer } = yield* promise(() => import("./NodeServices-Bqqy4DuH.mjs").then((n) => n.t));
+		const { layer } = yield* promise(() => import("./NodeServices-Da5rUDDE.mjs").then((n) => n.t));
 		return layer;
 	}
 }));
@@ -310398,7 +310602,7 @@ const MiscRuntimeLayerLive = mergeAll(AnalyticsServiceLayerLive, OpenLive, Serve
 const RuntimeDependenciesWithoutPullRequestsLive = ReactorLayerLive.pipe(provideMerge(CheckpointingLayerLive), provideMerge(GitLayerLive), provideMerge(OrchestrationLayerLive), provideMerge(ProviderLayerLive), provideMerge(TerminalLayerLive), provideMerge(AgentBrowserManagerLive), provideMerge(mergeAll(ThreadDevRuntimeLive, DevTunnelLive.pipe(provide$1(ThreadDevRuntimeLive)))), provideMerge(PersistenceLayerLive), provideMerge(KeybindingsLive), provideMerge(ProviderRegistryLive), provideMerge(mergeAll(ServerSettingsLive, UsageServiceLive.pipe(provide$1(ServerSettingsLive)))), provideMerge(WorkspaceLayerLive), provideMerge(WorkspaceReadinessStateLive), provideMerge(ProjectFaviconResolverLive), provideMerge(RepositoryIdentityResolverLive), provideMerge(ServerEnvironmentLive), provideMerge(AuthLayerLive), provideMerge(ServerSecretStoreLayerLive), provideMerge(mergeAll(CloudRedisCoordinationLive, CloudStateSyncLive.pipe(provide$1(PersistenceLayerLive)))), provideMerge(MiscRuntimeLayerLive));
 const RuntimeDependenciesLive = pullRequestServiceFactoryLayer.pipe(provideMerge(RuntimeDependenciesWithoutPullRequestsLive), provideMerge(cmmdProjectIdentityResolverLive.pipe(provide$1(RuntimeDependenciesWithoutPullRequestsLive))), provideMerge(pullRequestProviderRuntimeLive));
 const RuntimeServicesLive = ServerRuntimeStartupLive.pipe(provideMerge(RuntimeDependenciesLive));
-const makeRoutesLayer = mergeAll(authBearerBootstrapRouteLayer, authBootstrapRouteLayer, authCommandBearerBootstrapRouteLayer, authCommandBootstrapRouteLayer, authCmmdOAuthDeviceRouteLayer, authCmmdOAuthTokenRouteLayer, authCmmdPasswordTokenRouteLayer, authClientsRevokeOthersRouteLayer, authClientsRevokeRouteLayer, authClientsRouteLayer, authLogoutRouteLayer, authPairingLinksRevokeRouteLayer, authPairingLinksRouteLayer, authPairingCredentialRouteLayer, authSessionRouteLayer, authWebSocketTokenRouteLayer, authWebLoginRouteLayer, authWebCallbackRouteLayer, desktopLocalWebBridgePublishRouteLayer, desktopLocalWebBridgeBootstrapRouteLayer, desktopRelayControlPlaneRouteLayer, apiDocsHtmlRouteLayer, apiDocsOpenApiRouteLayer, pulseSignalStateListRouteLayer, pulseSignalStateUpsertRouteLayer, cmmdProfileRouteLayer, cmmdCreateBrainDocRouteLayer, cmmdUpdateTaskRouteLayer, cmmdUpsertTaskPullRequestRouteLayer, ...cmmdPullRequestRouteLayers, cmmdAddTaskCommentRouteLayer, cmmdWorkIntakeRouteLayer, cmmdWsTokenRouteLayer, cmmdSearchTasksRouteLayer, cmmdGetTaskCommentsRouteLayer, cmmdGetProjectCommentsRouteLayer, cmmdAddProjectCommentRouteLayer, cmmdUpdateProjectRouteLayer, cmmdGetOrgMembersRouteLayer, cmmdSimHostsRouteLayer, cmmdSimLeaseReadRouteLayer, cmmdSimLeaseClaimRouteLayer, cmmdSimLeaseReleaseRouteLayer, cmmdSimLeaseRenewRouteLayer, cmmdUploadTaskAttachmentRouteLayer, cmmdGetTaskAttachmentsRouteLayer, cmmdUpdateTaskCommentRouteLayer, cmmdDeleteTaskCommentRouteLayer, cmmdGetProjectRepositoryRouteLayer, cmmdListProjectRepositoriesRouteLayer, cmmdArchiveTaskRouteLayer, cmmdUnarchiveTaskRouteLayer, cmmdListTasksRouteLayer, cmmdCreateTaskRouteLayer, cmmdListCampaignsRouteLayer, cmmdGetCampaignRouteLayer, cmmdCreateCampaignRouteLayer, cmmdUpdateCampaignRouteLayer, cmmdDeleteCampaignRouteLayer, cmmdListSavedViewsRouteLayer, cmmdCreateSavedViewRouteLayer, cmmdImportSavedViewRouteLayer, cmmdUpdateSavedViewRouteLayer, cmmdDeleteSavedViewRouteLayer, cmmdListProjectsRouteLayer, cmmdGetProjectRouteLayer, cmmdCreateProjectRouteLayer, cmmdDeleteProjectRouteLayer, cmmdMoveProjectRouteLayer, cmmdGetProjectMembersRouteLayer, cmmdListWorkspaceMembersRouteLayer, cmmdAddProjectMemberRouteLayer, cmmdGetProjectMilestonesRouteLayer, cmmdCreateProjectMilestoneRouteLayer, cmmdUpdateProjectMilestoneRouteLayer, cmmdDeleteProjectMilestoneRouteLayer, cmmdGetProjectUpdatesRouteLayer, cmmdCreateProjectUpdateRouteLayer, cmmdUpdateProjectUpdateRouteLayer, cmmdDeleteProjectUpdateRouteLayer, cmmdImproveProjectContentRouteLayer, cmmdCreateProjectTaskDraftRouteLayer, cmmdGetProjectTaskDraftRouteLayer, cmmdUpdateProjectTaskDraftRouteLayer, cmmdPreviewProjectTaskDraftRouteLayer, cmmdCommitProjectTaskDraftRouteLayer, cmmdDiscardProjectTaskDraftRouteLayer, cmmdGetProjectLeadPlanRouteLayer, cmmdActivateProjectLeadAuthorityRouteLayer, cmmdGetProjectLeadReadinessRouteLayer, cmmdGetProjectLeadCapabilitiesRouteLayer, cmmdGetProjectLeadSummaryRouteLayer, cmmdGetProjectLeadDetailRouteLayer, cmmdGetProjectLeadBriefingRouteLayer, cmmdListProjectLeadEventsRouteLayer, cmmdExplainProjectLeadRouteLayer, cmmdPauseProjectLeadRouteLayer, cmmdResumeProjectLeadRouteLayer, cmmdReserveProjectLeadTaskRouteLayer, cmmdReleaseProjectLeadReservationRouteLayer, cmmdReconcileProjectLeadRouteLayer, cmmdResolveProjectLeadAttentionRouteLayer, cmmdClaimProjectLeadControllerRouteLayer, cmmdRenewProjectLeadControllerClaimRouteLayer, cmmdYieldProjectLeadControllerClaimRouteLayer, cmmdAcknowledgeProjectLeadControllerEventRouteLayer, cmmdRecordProjectLeadControllerDecisionRouteLayer, cmmdListForgeAutomationPresetsRouteLayer, cmmdListUserForgeAutomationRulesRouteLayer, cmmdCreateUserForgeAutomationRuleRouteLayer, cmmdUpdateUserForgeAutomationRuleRouteLayer, cmmdListUserForgeAutomationRunsRouteLayer, cmmdStartUserForgeAutomationRunRouteLayer, cmmdListForgeAutomationRulesRouteLayer, cmmdCreateForgeAutomationRuleRouteLayer, cmmdUpdateForgeAutomationRuleRouteLayer, cmmdListForgeAutomationRunsRouteLayer, cmmdStartForgeAutomationRunRouteLayer, cmmdGetForgeAutomationRunRouteLayer, cmmdRetryForgeAutomationRunRouteLayer, cmmdCancelForgeAutomationRunRouteLayer, cmmdApproveForgeAutomationEscalationRouteLayer, cmmdRejectForgeAutomationEscalationRouteLayer, cmmdListProjectAgentMembersRouteLayer, cmmdCreateProjectAgentMemberRouteLayer, cmmdGetProjectAgentMemberRouteLayer, cmmdRenameProjectAgentMemberRouteLayer, cmmdRetireProjectAgentMemberRouteLayer, cmmdUpdateProjectAgentMemberAvatarRouteLayer, cmmdListProjectAgentMemberInstancesRouteLayer, cmmdPreviewProjectAgentMemberConsolidationRouteLayer, cmmdApplyProjectAgentMemberConsolidationRouteLayer, cmmdPutProjectTaskAssignmentRouteLayer, cmmdListProjectBoardRouteLayer, cmmdGetProjectTaskWorkflowRouteLayer, cmmdUpdateProjectTaskWorkflowRouteLayer, cmmdCreateProjectBoardTaskRouteLayer, cmmdUpdateProjectBoardTaskRouteLayer, cmmdUpdateProjectBoardTaskStatusRouteLayer, cmmdListTaskExecutionOptionsRouteLayer, cmmdCreateTaskWorkSessionRouteLayer, cmmdListProjectWorkSessionsRouteLayer, cmmdGetWorkSessionRouteLayer, cmmdUpdateWorkSessionRouteLayer, cmmdAttachWorkSessionThreadRouteLayer, cmmdListTaskConversationsRouteLayer, cmmdLinkTaskConversationRouteLayer, cmmdGetTaskHistoryRouteLayer, cmmdGetTaskConversationRouteLayer, cmmdSpawnForgeThreadFromBoardTaskRouteLayer, cmmdListCenterBoardRouteLayer, cmmdCreateCenterBoardTaskRouteLayer, cmmdCreateFeedbackRouteLayer, cmmdUpdateCenterBoardTaskRouteLayer, cmmdMoveCenterBoardTaskRouteLayer, cmmdMoveProjectBoardTaskRouteLayer, cmmdArchiveProjectBoardTaskRouteLayer, cmmdUnarchiveProjectBoardTaskRouteLayer, cmmdArchiveCenterBoardTaskRouteLayer, cmmdUnarchiveCenterBoardTaskRouteLayer, cmmdBootstrapRouteLayer, cmmdGetAccountPreferencesRouteLayer, cmmdUpdateAccountPreferencesRouteLayer, cmmdGetOrgProviderPolicyRouteLayer, cmmdListChatsRouteLayer, cmmdGetChatRouteLayer, cmmdListDevicesRouteLayer, runtimeReplicationStatusRouteLayer, cmmdRegisterDeviceRouteLayer, cmmdHeartbeatRuntimeRouteLayer, cmmdGrantRuntimeAccessRouteLayer, cmmdRevokeRuntimeAccessRouteLayer, cmmdCreateRelayControlRouteLayer, cmmdCreateRelayActionGrantRouteLayer, cmmdReplaceRuntimeInventoryRouteLayer, cmmdListRuntimeInventoryRouteLayer, cmmdGetRuntimeDiagnosticsRouteLayer, cmmdProvisionAuthRuntimeRouteLayer, cmmdGetAuthRuntimeRouteLayer, cmmdDestroyAuthRuntimeRouteLayer, cmmdConnectAuthRuntimeRouteLayer, cmmdGetProviderAccountsRouteLayer, cmmdDeleteProviderAccountRouteLayer, cmmdSetProviderAccountDefaultRouteLayer, cmmdGetProviderUsageRouteLayer, cmmdRefreshProviderUsageRouteLayer, cmmdGetUserCodexCredentialRouteLayer, cmmdDeleteUserCodexCredentialRouteLayer, cmmdGetUserClaudeCredentialRouteLayer, cmmdDeleteUserClaudeCredentialRouteLayer, cmmdGetClaudeRuntimeReadinessRouteLayer, cmmdAppendRuntimeThreadEventsRouteLayer, cmmdGetRuntimeThreadReplicaRouteLayer, cmmdRenameDeviceRouteLayer, cmmdRevokeDeviceRouteLayer, cmmdInstallConnectorRouteLayer, cmmdListConnectorsRouteLayer, cmmdForgeCloudProjectsListRouteLayer, cmmdForgeCloudProjectsEventsRouteLayer, cmmdForgeCloudProjectRegisterRouteLayer, cmmdForgeCloudProjectUnregisterRouteLayer, cmmdForgeCloudProjectLifecyclePreflightRouteLayer, cmmdForgeCloudProjectRemovalRouteLayer, cmmdForgeCloudProjectRemovalReceiptRouteLayer, cmmdForgeRuntimesEnsureRouteLayer, cmmdForgeRuntimesConnectRouteLayer, ownerRuntimeCodexReadinessRouteLayer, cmmdForgeRuntimesStatusRouteLayer, cmmdForgeRuntimesStartRouteLayer, cmmdForgeRuntimesStopRouteLayer, cmmdForgeRuntimesRecycleRouteLayer, cmmdForgeRuntimesUpdateCommitRouteLayer, cmmdForgeRuntimesDestroyRouteLayer, cmmdGetTaskRouteLayer, commandUpdateTaskRouteLayer, mobileProviderCatalogRouteLayer, cmmdUsageSummaryRouteLayer, cmmdBillingRouteLayer, cmmdBillingSeriesRouteLayer, attachmentsRouteLayer, orchestrationDispatchRouteLayer, orchestrationCmmdWorkRunEventRouteLayer, orchestrationAutomationStartThreadRouteLayer, orchestrationAutomationRebindRouteLayer, orchestrationAutomationTerminalReconcileRouteLayer, mobileGitRunStackedActionRouteLayer, pullRequestDiffRouteLayer, orchestrationSnapshotRouteLayer, localAutomationListRouteLayer, localAutomationCreateRouteLayer, localAutomationUpdateRouteLayer, localAutomationDeleteRouteLayer, localAutomationRunRouteLayer, otlpTracesProxyRouteLayer, devTunnelProxyRouteLayer, devTunnelLocalPortProxyRouteLayer, projectFaviconRouteLayer, serverEnvironmentRouteLayer, browserWebRtcReadinessRouteLayer, staticAndDevRouteLayer, githubStatusRouteLayer, githubAuthorizeUrlRouteLayer, githubDisconnectRouteLayer, githubReposRouteLayer, githubCloneRouteLayer, githubCloneJobStartRouteLayer, githubCloneJobStatusRouteLayer, githubRefreshCredentialsRouteLayer, githubToolConfirmationApproveRouteLayer, projectLinkGetRouteLayer, projectLinkListRouteLayer, projectLinkSetRouteLayer, projectLinkDeleteRouteLayer, cmmdWorkspacesRouteLayer, cmmdCampaignsRouteLayer, cmmdProjectLinksRouteLayer, cmmdEnsureGitHubProjectContextRouteLayer, cmmdProjectRepositoryEnsureRouteLayer, cmmdProjectsGetRouteLayer, cmmdProjectsCreateRouteLayer, workspaceReadinessRouteLayer, runtimeLivenessRouteLayer, claudeNativeGenerationProofRouteLayer, codexRuntimeProviderReadinessRouteLayer, runtimeDiagnosticsRouteLayer, cloudFoldersRouteLayer, cloudProjectCreateRouteLayer, gitUrlCloneRouteLayer, websocketRpcRouteLayer).pipe(provide$1(browserApiCorsLayer));
+const makeRoutesLayer = mergeAll(authBearerBootstrapRouteLayer, authBootstrapRouteLayer, authCommandBearerBootstrapRouteLayer, authCommandBootstrapRouteLayer, authOAuthTokenExchangeRouteLayer, authCmmdOAuthDeviceRouteLayer, authCmmdOAuthTokenRouteLayer, authCmmdPasswordTokenRouteLayer, authClientsRevokeOthersRouteLayer, authClientsRevokeRouteLayer, authClientsRouteLayer, authLogoutRouteLayer, authPairingLinksRevokeRouteLayer, authPairingLinksRouteLayer, authPairingCredentialRouteLayer, authSessionRouteLayer, authWebSocketTokenRouteLayer, authWebLoginRouteLayer, authWebCallbackRouteLayer, desktopLocalWebBridgePublishRouteLayer, desktopLocalWebBridgeBootstrapRouteLayer, desktopRelayControlPlaneRouteLayer, apiDocsHtmlRouteLayer, apiDocsOpenApiRouteLayer, pulseSignalStateListRouteLayer, pulseSignalStateUpsertRouteLayer, cmmdProfileRouteLayer, cmmdCreateBrainDocRouteLayer, cmmdUpdateTaskRouteLayer, cmmdUpsertTaskPullRequestRouteLayer, ...cmmdPullRequestRouteLayers, cmmdAddTaskCommentRouteLayer, cmmdWorkIntakeRouteLayer, cmmdWsTokenRouteLayer, cmmdSearchTasksRouteLayer, cmmdGetTaskCommentsRouteLayer, cmmdGetProjectCommentsRouteLayer, cmmdAddProjectCommentRouteLayer, cmmdUpdateProjectRouteLayer, cmmdGetOrgMembersRouteLayer, cmmdSimHostsRouteLayer, cmmdSimLeaseReadRouteLayer, cmmdSimLeaseClaimRouteLayer, cmmdSimLeaseReleaseRouteLayer, cmmdSimLeaseRenewRouteLayer, cmmdUploadTaskAttachmentRouteLayer, cmmdGetTaskAttachmentsRouteLayer, cmmdUpdateTaskCommentRouteLayer, cmmdDeleteTaskCommentRouteLayer, cmmdGetProjectRepositoryRouteLayer, cmmdListProjectRepositoriesRouteLayer, cmmdArchiveTaskRouteLayer, cmmdUnarchiveTaskRouteLayer, cmmdListTasksRouteLayer, cmmdCreateTaskRouteLayer, cmmdListCampaignsRouteLayer, cmmdGetCampaignRouteLayer, cmmdCreateCampaignRouteLayer, cmmdUpdateCampaignRouteLayer, cmmdDeleteCampaignRouteLayer, cmmdListSavedViewsRouteLayer, cmmdCreateSavedViewRouteLayer, cmmdImportSavedViewRouteLayer, cmmdUpdateSavedViewRouteLayer, cmmdDeleteSavedViewRouteLayer, cmmdListProjectsRouteLayer, cmmdGetProjectRouteLayer, cmmdCreateProjectRouteLayer, cmmdDeleteProjectRouteLayer, cmmdMoveProjectRouteLayer, cmmdGetProjectMembersRouteLayer, cmmdListWorkspaceMembersRouteLayer, cmmdAddProjectMemberRouteLayer, cmmdGetProjectMilestonesRouteLayer, cmmdCreateProjectMilestoneRouteLayer, cmmdUpdateProjectMilestoneRouteLayer, cmmdDeleteProjectMilestoneRouteLayer, cmmdGetProjectUpdatesRouteLayer, cmmdCreateProjectUpdateRouteLayer, cmmdUpdateProjectUpdateRouteLayer, cmmdDeleteProjectUpdateRouteLayer, cmmdImproveProjectContentRouteLayer, cmmdCreateProjectTaskDraftRouteLayer, cmmdGetProjectTaskDraftRouteLayer, cmmdUpdateProjectTaskDraftRouteLayer, cmmdPreviewProjectTaskDraftRouteLayer, cmmdCommitProjectTaskDraftRouteLayer, cmmdDiscardProjectTaskDraftRouteLayer, cmmdGetProjectLeadPlanRouteLayer, cmmdActivateProjectLeadAuthorityRouteLayer, cmmdGetProjectLeadReadinessRouteLayer, cmmdGetProjectLeadCapabilitiesRouteLayer, cmmdGetProjectLeadSummaryRouteLayer, cmmdGetProjectLeadDetailRouteLayer, cmmdGetProjectLeadBriefingRouteLayer, cmmdListProjectLeadEventsRouteLayer, cmmdExplainProjectLeadRouteLayer, cmmdPauseProjectLeadRouteLayer, cmmdResumeProjectLeadRouteLayer, cmmdReserveProjectLeadTaskRouteLayer, cmmdReleaseProjectLeadReservationRouteLayer, cmmdReconcileProjectLeadRouteLayer, cmmdResolveProjectLeadAttentionRouteLayer, cmmdClaimProjectLeadControllerRouteLayer, cmmdRenewProjectLeadControllerClaimRouteLayer, cmmdYieldProjectLeadControllerClaimRouteLayer, cmmdAcknowledgeProjectLeadControllerEventRouteLayer, cmmdRecordProjectLeadControllerDecisionRouteLayer, cmmdListForgeAutomationPresetsRouteLayer, cmmdListUserForgeAutomationRulesRouteLayer, cmmdCreateUserForgeAutomationRuleRouteLayer, cmmdUpdateUserForgeAutomationRuleRouteLayer, cmmdListUserForgeAutomationRunsRouteLayer, cmmdStartUserForgeAutomationRunRouteLayer, cmmdListForgeAutomationRulesRouteLayer, cmmdCreateForgeAutomationRuleRouteLayer, cmmdUpdateForgeAutomationRuleRouteLayer, cmmdListForgeAutomationRunsRouteLayer, cmmdStartForgeAutomationRunRouteLayer, cmmdGetForgeAutomationRunRouteLayer, cmmdRetryForgeAutomationRunRouteLayer, cmmdCancelForgeAutomationRunRouteLayer, cmmdApproveForgeAutomationEscalationRouteLayer, cmmdRejectForgeAutomationEscalationRouteLayer, cmmdListProjectAgentMembersRouteLayer, cmmdCreateProjectAgentMemberRouteLayer, cmmdGetProjectAgentMemberRouteLayer, cmmdRenameProjectAgentMemberRouteLayer, cmmdRetireProjectAgentMemberRouteLayer, cmmdUpdateProjectAgentMemberAvatarRouteLayer, cmmdListProjectAgentMemberInstancesRouteLayer, cmmdPreviewProjectAgentMemberConsolidationRouteLayer, cmmdApplyProjectAgentMemberConsolidationRouteLayer, cmmdPutProjectTaskAssignmentRouteLayer, cmmdListProjectBoardRouteLayer, cmmdGetProjectTaskWorkflowRouteLayer, cmmdUpdateProjectTaskWorkflowRouteLayer, cmmdCreateProjectBoardTaskRouteLayer, cmmdUpdateProjectBoardTaskRouteLayer, cmmdUpdateProjectBoardTaskStatusRouteLayer, cmmdListTaskExecutionOptionsRouteLayer, cmmdCreateTaskWorkSessionRouteLayer, cmmdListProjectWorkSessionsRouteLayer, cmmdGetWorkSessionRouteLayer, cmmdUpdateWorkSessionRouteLayer, cmmdAttachWorkSessionThreadRouteLayer, cmmdListTaskConversationsRouteLayer, cmmdLinkTaskConversationRouteLayer, cmmdGetTaskHistoryRouteLayer, cmmdGetTaskConversationRouteLayer, cmmdSpawnForgeThreadFromBoardTaskRouteLayer, cmmdListCenterBoardRouteLayer, cmmdCreateCenterBoardTaskRouteLayer, cmmdCreateFeedbackRouteLayer, cmmdUpdateCenterBoardTaskRouteLayer, cmmdMoveCenterBoardTaskRouteLayer, cmmdMoveProjectBoardTaskRouteLayer, cmmdArchiveProjectBoardTaskRouteLayer, cmmdUnarchiveProjectBoardTaskRouteLayer, cmmdArchiveCenterBoardTaskRouteLayer, cmmdUnarchiveCenterBoardTaskRouteLayer, cmmdBootstrapRouteLayer, cmmdGetAccountPreferencesRouteLayer, cmmdUpdateAccountPreferencesRouteLayer, cmmdGetOrgProviderPolicyRouteLayer, cmmdListChatsRouteLayer, cmmdGetChatRouteLayer, cmmdListDevicesRouteLayer, runtimeReplicationStatusRouteLayer, cmmdRegisterDeviceRouteLayer, cmmdHeartbeatRuntimeRouteLayer, cmmdGrantRuntimeAccessRouteLayer, cmmdRevokeRuntimeAccessRouteLayer, cmmdCreateRelayControlRouteLayer, cmmdCreateRelayActionGrantRouteLayer, cmmdReplaceRuntimeInventoryRouteLayer, cmmdListRuntimeInventoryRouteLayer, cmmdGetRuntimeDiagnosticsRouteLayer, cmmdProvisionAuthRuntimeRouteLayer, cmmdGetAuthRuntimeRouteLayer, cmmdDestroyAuthRuntimeRouteLayer, cmmdConnectAuthRuntimeRouteLayer, cmmdGetProviderAccountsRouteLayer, cmmdDeleteProviderAccountRouteLayer, cmmdSetProviderAccountDefaultRouteLayer, cmmdGetProviderUsageRouteLayer, cmmdRefreshProviderUsageRouteLayer, cmmdGetUserCodexCredentialRouteLayer, cmmdDeleteUserCodexCredentialRouteLayer, cmmdGetUserClaudeCredentialRouteLayer, cmmdDeleteUserClaudeCredentialRouteLayer, cmmdGetClaudeRuntimeReadinessRouteLayer, cmmdAppendRuntimeThreadEventsRouteLayer, cmmdGetRuntimeThreadReplicaRouteLayer, cmmdRenameDeviceRouteLayer, cmmdRevokeDeviceRouteLayer, cmmdInstallConnectorRouteLayer, cmmdListConnectorsRouteLayer, cmmdForgeCloudProjectsListRouteLayer, cmmdForgeCloudProjectsEventsRouteLayer, cmmdForgeCloudProjectRegisterRouteLayer, cmmdForgeCloudProjectUnregisterRouteLayer, cmmdForgeCloudProjectLifecyclePreflightRouteLayer, cmmdForgeCloudProjectRemovalRouteLayer, cmmdForgeCloudProjectRemovalReceiptRouteLayer, cmmdForgeRuntimesEnsureRouteLayer, cmmdForgeRuntimesConnectRouteLayer, ownerRuntimeCodexReadinessRouteLayer, cmmdForgeRuntimesStatusRouteLayer, cmmdForgeRuntimesStartRouteLayer, cmmdForgeRuntimesStopRouteLayer, cmmdForgeRuntimesRecycleRouteLayer, cmmdForgeRuntimesUpdateCommitRouteLayer, cmmdForgeRuntimesDestroyRouteLayer, cmmdGetTaskRouteLayer, commandUpdateTaskRouteLayer, mobileProviderCatalogRouteLayer, cmmdUsageSummaryRouteLayer, cmmdBillingRouteLayer, cmmdBillingSeriesRouteLayer, attachmentsRouteLayer, orchestrationDispatchRouteLayer, orchestrationCmmdWorkRunEventRouteLayer, orchestrationAutomationStartThreadRouteLayer, orchestrationAutomationRebindRouteLayer, orchestrationAutomationTerminalReconcileRouteLayer, mobileGitRunStackedActionRouteLayer, pullRequestDiffRouteLayer, orchestrationSnapshotRouteLayer, localAutomationListRouteLayer, localAutomationCreateRouteLayer, localAutomationUpdateRouteLayer, localAutomationDeleteRouteLayer, localAutomationRunRouteLayer, otlpTracesProxyRouteLayer, devTunnelProxyRouteLayer, devTunnelLocalPortProxyRouteLayer, projectFaviconRouteLayer, serverEnvironmentRouteLayer, browserWebRtcReadinessRouteLayer, staticAndDevRouteLayer, githubStatusRouteLayer, githubAuthorizeUrlRouteLayer, githubDisconnectRouteLayer, githubReposRouteLayer, githubCloneRouteLayer, githubCloneJobStartRouteLayer, githubCloneJobStatusRouteLayer, githubRefreshCredentialsRouteLayer, githubToolConfirmationApproveRouteLayer, projectLinkGetRouteLayer, projectLinkListRouteLayer, projectLinkSetRouteLayer, projectLinkDeleteRouteLayer, cmmdWorkspacesRouteLayer, cmmdCampaignsRouteLayer, cmmdProjectLinksRouteLayer, cmmdEnsureGitHubProjectContextRouteLayer, cmmdProjectRepositoryEnsureRouteLayer, cmmdProjectsGetRouteLayer, cmmdProjectsCreateRouteLayer, workspaceReadinessRouteLayer, runtimeLivenessRouteLayer, claudeNativeGenerationProofRouteLayer, codexRuntimeProviderReadinessRouteLayer, runtimeDiagnosticsRouteLayer, cloudFoldersRouteLayer, cloudProjectCreateRouteLayer, gitUrlCloneRouteLayer, websocketRpcRouteLayer).pipe(provide$1(browserApiCorsLayer));
 const runServer = launch$1(unwrap(gen(function* () {
 	const config = yield* ServerConfig;
 	fixPath();
@@ -311328,7 +311532,7 @@ const connectLoginCommand = make$32("login", {
 			})).json();
 		},
 		openBrowser: async (url) => {
-			const open = (await import("./open-FIgTDosf.mjs")).default;
+			const open = (await import("./open-D8mGyWmt.mjs")).default;
 			await open(url);
 			return true;
 		},