@ipul-labs/forge 1.22.0 → 1.35.0

package/lib/server/forge/auth/resetPassword.d.ts

@@ -0,0 +1,14 @@
+import type { Db } from "../db/database.ts";
+import { type User } from "./users.ts";
+/**
+ * Recovery path for a locked-out local account, run by `forge reset-password`
+ * on the host. Whoever can open the database file already controls the
+ * install, so this needs no sign-in. Signs the account out everywhere, since a
+ * reset usually means the old password can't be trusted.
+ */
+export declare function resetPassword({ db, email, password }: {
+    db: Db;
+    email: string;
+    password: string;
+}): Promise<User>;
+//# sourceMappingURL=resetPassword.d.ts.map

package/lib/server/forge/auth/resetPassword.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"resetPassword.d.ts","sourceRoot":"","sources":["../../../../server/forge/auth/resetPassword.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,EAAE,EAAE,MAAM,mBAAmB,CAAC;AAI5C,OAAO,EAAe,KAAK,IAAI,EAAE,MAAM,YAAY,CAAC;AAEpD;;;;;GAKG;AACH,wBAAsB,aAAa,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE;IAAE,EAAE,EAAE,EAAE,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAkBvH"}

package/lib/server/forge/auth/resetPassword.js

@@ -0,0 +1,29 @@
+import { createAuditLog } from "./auditLog.js";
+import { createSessions } from "./sessions.js";
+import { createUsers } from "./users.js";
+/**
+ * Recovery path for a locked-out local account, run by `forge reset-password`
+ * on the host. Whoever can open the database file already controls the
+ * install, so this needs no sign-in. Signs the account out everywhere, since a
+ * reset usually means the old password can't be trusted.
+ */
+export async function resetPassword({ db, email, password }) {
+    const users = createUsers({ db });
+    const user = await users.findByEmail(email);
+    if (!user)
+        throw new Error(`No Forge account for ${email}.`);
+    if (user.authProvider !== "local") {
+        throw new Error(`${user.email} signs in with SSO, so its password is managed by your identity provider.`);
+    }
+    await users.update(user.id, { password });
+    await createSessions({ db }).revokeAllForUser(user.id);
+    await createAuditLog({ db }).record({
+        actorId: null,
+        actorLabel: "cli",
+        action: "user.password_reset",
+        outcome: "success",
+        target: user.email,
+    });
+    return user;
+}
+//# sourceMappingURL=resetPassword.js.map

package/lib/server/forge/auth/resetPassword.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"resetPassword.js","sourceRoot":"","sources":["../../../../server/forge/auth/resetPassword.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAC/C,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAC/C,OAAO,EAAE,WAAW,EAAa,MAAM,YAAY,CAAC;AAEpD;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,QAAQ,EAA+C;IACvG,MAAM,KAAK,GAAG,WAAW,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;IAClC,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;IAC5C,IAAI,CAAC,IAAI;QAAE,MAAM,IAAI,KAAK,CAAC,wBAAwB,KAAK,GAAG,CAAC,CAAC;IAC7D,IAAI,IAAI,CAAC,YAAY,KAAK,OAAO,EAAE,CAAC;QACnC,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,CAAC,KAAK,2EAA2E,CAAC,CAAC;IAC3G,CAAC;IAED,MAAM,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC;IAC1C,MAAM,cAAc,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,gBAAgB,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACvD,MAAM,cAAc,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC;QACnC,OAAO,EAAE,IAAI;QACb,UAAU,EAAE,KAAK;QACjB,MAAM,EAAE,qBAAqB;QAC7B,OAAO,EAAE,SAAS;QAClB,MAAM,EAAE,IAAI,CAAC,KAAK;KAClB,CAAC,CAAC;IACH,OAAO,IAAI,CAAC;AACb,CAAC"}

package/lib/server/forge/auth/roles.d.ts

@@ -0,0 +1,7 @@
+/** Ordered least → most privileged. Each role includes everything below it. */
+export declare const ROLES: readonly ["viewer", "operator", "approver", "admin"];
+export type Role = (typeof ROLES)[number];
+export declare const ROLE_DESCRIPTIONS: Record<Role, string>;
+export declare function isRole(value: unknown): value is Role;
+export declare function hasRole(actual: Role, required: Role): boolean;
+//# sourceMappingURL=roles.d.ts.map

package/lib/server/forge/auth/roles.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"roles.d.ts","sourceRoot":"","sources":["../../../../server/forge/auth/roles.ts"],"names":[],"mappings":"AAAA,+EAA+E;AAC/E,eAAO,MAAM,KAAK,sDAAuD,CAAC;AAC1E,MAAM,MAAM,IAAI,GAAG,CAAC,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC,CAAC;AAE1C,eAAO,MAAM,iBAAiB,EAAE,MAAM,CAAC,IAAI,EAAE,MAAM,CAKlD,CAAC;AAEF,wBAAgB,MAAM,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,IAAI,CAEpD;AAED,wBAAgB,OAAO,CAAC,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,GAAG,OAAO,CAE7D"}

package/lib/server/forge/auth/roles.js

@@ -0,0 +1,15 @@
+/** Ordered least → most privileged. Each role includes everything below it. */
+export const ROLES = ["viewer", "operator", "approver", "admin"];
+export const ROLE_DESCRIPTIONS = {
+    viewer: "Read issues, merge requests, pipelines and runs.",
+    operator: "Analyze issues, refine fixes, validate and open merge requests.",
+    approver: "Everything an operator can do, plus merge and close merge requests.",
+    admin: "Full access, including connections, repositories, members and the audit log.",
+};
+export function isRole(value) {
+    return typeof value === "string" && ROLES.includes(value);
+}
+export function hasRole(actual, required) {
+    return ROLES.indexOf(actual) >= ROLES.indexOf(required);
+}
+//# sourceMappingURL=roles.js.map

package/lib/server/forge/auth/roles.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"roles.js","sourceRoot":"","sources":["../../../../server/forge/auth/roles.ts"],"names":[],"mappings":"AAAA,+EAA+E;AAC/E,MAAM,CAAC,MAAM,KAAK,GAAG,CAAC,QAAQ,EAAE,UAAU,EAAE,UAAU,EAAE,OAAO,CAAU,CAAC;AAG1E,MAAM,CAAC,MAAM,iBAAiB,GAAyB;IACtD,MAAM,EAAE,kDAAkD;IAC1D,QAAQ,EAAE,iEAAiE;IAC3E,QAAQ,EAAE,qEAAqE;IAC/E,KAAK,EAAE,8EAA8E;CACrF,CAAC;AAEF,MAAM,UAAU,MAAM,CAAC,KAAc;IACpC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAK,KAA2B,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;AAClF,CAAC;AAED,MAAM,UAAU,OAAO,CAAC,MAAY,EAAE,QAAc;IACnD,OAAO,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;AACzD,CAAC"}

package/lib/server/forge/auth/sessions.d.ts

@@ -0,0 +1,27 @@
+import type { Db } from "../db/database.ts";
+export declare const SESSION_IDLE_MS: number;
+export declare const SESSION_ABSOLUTE_MS: number;
+/** Opaque session tokens; only their SHA-256 is stored. */
+export declare function createSessions({ db, clock, idleMs, absoluteMs, }: {
+    db: Db;
+    clock?: () => number;
+    idleMs?: number;
+    absoluteMs?: number;
+}): {
+    absoluteMs: number;
+    create({ userId, ip, userAgent }: {
+        userId: string;
+        ip: string;
+        userAgent: string;
+    }): Promise<{
+        token: string;
+    }>;
+    resolve(token: string): Promise<{
+        userId: string;
+        createdAt: number;
+    }>;
+    revoke(token: string): Promise<void>;
+    revokeAllForUser(userId: string): Promise<void>;
+};
+export type Sessions = ReturnType<typeof createSessions>;
+//# sourceMappingURL=sessions.d.ts.map

package/lib/server/forge/auth/sessions.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sessions.d.ts","sourceRoot":"","sources":["../../../../server/forge/auth/sessions.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,EAAE,EAAE,MAAM,mBAAmB,CAAC;AAI5C,eAAO,MAAM,eAAe,QAAmB,CAAC;AAChD,eAAO,MAAM,mBAAmB,QAAuB,CAAC;AAUxD,2DAA2D;AAC3D,wBAAgB,cAAc,CAAC,EAC9B,EAAE,EACF,KAAgB,EAChB,MAAwB,EACxB,UAAgC,GAChC,EAAE;IACF,EAAE,EAAE,EAAE,CAAC;IACP,KAAK,CAAC,EAAE,MAAM,MAAM,CAAC;IACrB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,UAAU,CAAC,EAAE,MAAM,CAAC;CACpB;;sCAIyC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,EAAE,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE;;;mBAUpE,MAAM;;;;kBAcP,MAAM;6BAIK,MAAM;EAItC;AAED,MAAM,MAAM,QAAQ,GAAG,UAAU,CAAC,OAAO,cAAc,CAAC,CAAC"}

package/lib/server/forge/auth/sessions.js

@@ -0,0 +1,37 @@
+import { newSecret, sha256 } from "./tokenHash.js";
+export const SESSION_IDLE_MS = 12 * 60 * 60_000;
+export const SESSION_ABSOLUTE_MS = 7 * 24 * 60 * 60_000;
+/** Opaque session tokens; only their SHA-256 is stored. */
+export function createSessions({ db, clock = Date.now, idleMs = SESSION_IDLE_MS, absoluteMs = SESSION_ABSOLUTE_MS, }) {
+    return {
+        absoluteMs,
+        async create({ userId, ip, userAgent }) {
+            const token = newSecret();
+            const now = clock();
+            await db.run("INSERT INTO sessions (id_hash, user_id, created_at, last_seen_at, expires_at, ip, user_agent) VALUES (?, ?, ?, ?, ?, ?, ?)", [sha256(token), userId, now, now, now + absoluteMs, ip, userAgent.slice(0, 300)]);
+            return { token };
+        },
+        async resolve(token) {
+            if (!token)
+                return null;
+            const hash = sha256(token);
+            const row = await db.get("SELECT * FROM sessions WHERE id_hash = ?", [hash]);
+            if (!row)
+                return null;
+            const now = clock();
+            if (now >= row.expires_at || now - row.last_seen_at > idleMs) {
+                await db.run("DELETE FROM sessions WHERE id_hash = ?", [hash]);
+                return null;
+            }
+            await db.run("UPDATE sessions SET last_seen_at = ? WHERE id_hash = ?", [now, hash]);
+            return { userId: row.user_id, createdAt: row.created_at };
+        },
+        async revoke(token) {
+            await db.run("DELETE FROM sessions WHERE id_hash = ?", [sha256(token)]);
+        },
+        async revokeAllForUser(userId) {
+            await db.run("DELETE FROM sessions WHERE user_id = ?", [userId]);
+        },
+    };
+}
+//# sourceMappingURL=sessions.js.map

package/lib/server/forge/auth/sessions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sessions.js","sourceRoot":"","sources":["../../../../server/forge/auth/sessions.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,gBAAgB,CAAC;AAEnD,MAAM,CAAC,MAAM,eAAe,GAAG,EAAE,GAAG,EAAE,GAAG,MAAM,CAAC;AAChD,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,MAAM,CAAC;AAUxD,2DAA2D;AAC3D,MAAM,UAAU,cAAc,CAAC,EAC9B,EAAE,EACF,KAAK,GAAG,IAAI,CAAC,GAAG,EAChB,MAAM,GAAG,eAAe,EACxB,UAAU,GAAG,mBAAmB,GAMhC;IACA,OAAO;QACN,UAAU;QAEV,KAAK,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,SAAS,EAAqD;YACxF,MAAM,KAAK,GAAG,SAAS,EAAE,CAAC;YAC1B,MAAM,GAAG,GAAG,KAAK,EAAE,CAAC;YACpB,MAAM,EAAE,CAAC,GAAG,CACX,4HAA4H,EAC5H,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,GAAG,UAAU,EAAE,EAAE,EAAE,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAChF,CAAC;YACF,OAAO,EAAE,KAAK,EAAE,CAAC;QAClB,CAAC;QAED,KAAK,CAAC,OAAO,CAAC,KAAa;YAC1B,IAAI,CAAC,KAAK;gBAAE,OAAO,IAAI,CAAC;YACxB,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;YAC3B,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,GAAG,CAAa,0CAA0C,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC;YACzF,IAAI,CAAC,GAAG;gBAAE,OAAO,IAAI,CAAC;YACtB,MAAM,GAAG,GAAG,KAAK,EAAE,CAAC;YACpB,IAAI,GAAG,IAAI,GAAG,CAAC,UAAU,IAAI,GAAG,GAAG,GAAG,CAAC,YAAY,GAAG,MAAM,EAAE,CAAC;gBAC9D,MAAM,EAAE,CAAC,GAAG,CAAC,wCAAwC,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC;gBAC/D,OAAO,IAAI,CAAC;YACb,CAAC;YACD,MAAM,EAAE,CAAC,GAAG,CAAC,wDAAwD,EAAE,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC;YACpF,OAAO,EAAE,MAAM,EAAE,GAAG,CAAC,OAAO,EAAE,SAAS,EAAE,GAAG,CAAC,UAAU,EAAE,CAAC;QAC3D,CAAC;QAED,KAAK,CAAC,MAAM,CAAC,KAAa;YACzB,MAAM,EAAE,CAAC,GAAG,CAAC,wCAAwC,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QACzE,CAAC;QAED,KAAK,CAAC,gBAAgB,CAAC,MAAc;YACpC,MAAM,EAAE,CAAC,GAAG,CAAC,wCAAwC,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC;QAClE,CAAC;KACD,CAAC;AACH,CAAC"}

package/lib/server/forge/auth/testHarness.d.ts

@@ -0,0 +1,104 @@
+import express, { type Router } from "express";
+import { type AuthOptions } from "./createAuth.ts";
+export declare const SERVICE_TOKEN = "service-token-for-tests-0123456789";
+/** Boots an express app with the auth stack and a few probe routes. */
+export declare function startAuthApp(opts?: Partial<AuthOptions> & {
+    extra?: (r: Router) => void;
+}): Promise<{
+    auth: {
+        users: {
+            count(): Promise<number>;
+            countActiveAdmins(): Promise<number>;
+            findById(id: string): Promise<import("./users.ts").User>;
+            findByEmail(email: string): Promise<import("./users.ts").User>;
+            list(): Promise<import("./users.ts").User[]>;
+            create({ email, name, role, password }: {
+                email: string;
+                name: string;
+                role: import("./roles.ts").Role;
+                password?: string;
+            }): Promise<import("./users.ts").User>;
+            update(id: string, patch: {
+                role?: import("./roles.ts").Role;
+                disabled?: boolean;
+                name?: string;
+                password?: string;
+            }): Promise<import("./users.ts").User>;
+            authenticate(email: string, password: string): Promise<import("./users.ts").AuthResult>;
+            upsertOidc({ subject, email, name, defaultRole }: {
+                subject: string;
+                email: string;
+                name: string;
+                defaultRole: import("./roles.ts").Role;
+            }): Promise<import("./users.ts").User>;
+        };
+        sessions: {
+            absoluteMs: number;
+            create({ userId, ip, userAgent }: {
+                userId: string;
+                ip: string;
+                userAgent: string;
+            }): Promise<{
+                token: string;
+            }>;
+            resolve(token: string): Promise<{
+                userId: string;
+                createdAt: number;
+            }>;
+            revoke(token: string): Promise<void>;
+            revokeAllForUser(userId: string): Promise<void>;
+        };
+        tokens: {
+            create({ userId, name }: {
+                userId: string;
+                name: string;
+            }): Promise<{
+                token: string;
+                record: import("./apiTokens.ts").ApiTokenRecord;
+            }>;
+            list(userId: string): Promise<import("./apiTokens.ts").ApiTokenRecord[]>;
+            resolve(token: string): Promise<{
+                userId: string;
+                tokenId: string;
+            }>;
+            revoke({ id, userId }: {
+                id: string;
+                userId: string;
+            }): Promise<boolean>;
+            revokeAllForUser(userId: string): Promise<void>;
+        };
+        audit: {
+            record(e: import("./auditLog.ts").AuditEventInput): Promise<void>;
+            list({ action, actorId, limit, before }: {
+                action?: string;
+                actorId?: string;
+                limit?: number;
+                before?: number;
+            }): Promise<{
+                events: import("./auditLog.ts").AuditEvent[];
+                nextCursor: number;
+            }>;
+        };
+        router: import("express-serve-static-core").Router;
+        adminRouter: import("express-serve-static-core").Router;
+        authenticate: (req: express.Request, res: express.Response, next: express.NextFunction) => Promise<void>;
+        requireUser: (req: express.Request, res: express.Response, next: express.NextFunction) => void;
+        requireRole: typeof import("./middleware.ts").requireRole;
+        csrf: (req: express.Request, res: express.Response, next: express.NextFunction) => void;
+        auditTrail: (req: express.Request, res: express.Response, next: express.NextFunction) => void;
+        announceSetup: () => Promise<void>;
+        setOidcRedirectUri: (uri: string) => void;
+    };
+    db: import("../db/database.ts").Db;
+    base: string;
+    close: () => Promise<unknown>;
+}>;
+/** Minimal cookie-jar client. */
+export declare function client(base: string): {
+    call: (path: string, init?: RequestInit & {
+        json?: unknown;
+        csrf?: boolean;
+    }) => Promise<Response>;
+    cookie: string;
+};
+//# sourceMappingURL=testHarness.d.ts.map

package/lib/server/forge/auth/testHarness.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"testHarness.d.ts","sourceRoot":"","sources":["../../../../server/forge/auth/testHarness.ts"],"names":[],"mappings":"AAEA,OAAO,OAAO,EAAE,EAAE,KAAK,MAAM,EAAE,MAAM,SAAS,CAAC;AAI/C,OAAO,EAAc,KAAK,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAE/D,eAAO,MAAM,aAAa,uCAAuC,CAAC;AAElE,uEAAuE;AACvE,wBAAsB,YAAY,CAAC,IAAI,GAAE,OAAO,CAAC,WAAW,CAAC,GAAG;IAAE,KAAK,CAAC,EAAE,CAAC,CAAC,EAAE,MAAM,KAAK,IAAI,CAAA;CAAO;;;;;;;;;;;;wBAuC1E,CAAC;;;oBAM+jB,CAAC;wBAAgB,CAAC;oBAAe,CAAC;wBAAkB,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;sBA1B7nB,CAAC;uBAAiB,CAAC;qBAAe,CAAC;sBAAgB,CAAC;;;;;;;;;;;;;;;;;;;GACrE;AAED,iCAAiC;AACjC,wBAAgB,MAAM,CAAC,IAAI,EAAE,MAAM;iBAER,MAAM,SAAQ,WAAW,GAAG;QAAE,IAAI,CAAC,EAAE,OAAO,CAAC;QAAC,IAAI,CAAC,EAAE,OAAO,CAAA;KAAE;YAkB1B,MAAM;EACpE"}

package/lib/server/forge/auth/testHarness.js

@@ -0,0 +1,53 @@
+import express from "express";
+import { openDatabase } from "../db/database.js";
+import { createAuth } from "./createAuth.js";
+export const SERVICE_TOKEN = "service-token-for-tests-0123456789";
+/** Boots an express app with the auth stack and a few probe routes. */
+export async function startAuthApp(opts = {}) {
+    const db = await openDatabase({ path: ":memory:" });
+    const auth = createAuth({ db, serviceToken: SERVICE_TOKEN, cookieSecure: false, ...opts });
+    const app = express();
+    app.use(express.json());
+    const api = express.Router();
+    api.use("/auth", auth.router);
+    api.use(auth.authenticate, auth.requireUser, auth.csrf, auth.auditTrail);
+    api.use("/admin", auth.adminRouter);
+    api.get("/probe", (req, res) => res.json({ principal: req.principal }));
+    api.post("/operate", auth.requireRole("operator"), (_req, res) => res.json({ ok: true }));
+    api.post("/mr/:mrIid/merge", auth.requireRole("approver"), (_req, res) => res.json({ merged: true }));
+    opts.extra?.(api);
+    app.use("/api/forge", api);
+    // Bind where the tests connect: on macOS a bare listen(0) takes the IPv6
+    // wildcard, and another process can hold the same port on 127.0.0.1.
+    const server = app.listen(0, "127.0.0.1");
+    await new Promise((r) => server.once("listening", r));
+    const base = `http://127.0.0.1:${server.address().port}/api/forge`;
+    return { auth, db, base, close: () => new Promise((r) => server.close(r)) };
+}
+/** Minimal cookie-jar client. */
+export function client(base) {
+    let cookie = "";
+    const call = async (path, init = {}) => {
+        const headers = { ...init.headers };
+        if (cookie)
+            headers.cookie = cookie;
+        if (init.json !== undefined)
+            headers["content-type"] = "application/json";
+        if (init.csrf !== false && init.method && init.method !== "GET")
+            headers["x-forge-request"] = "1";
+        const res = await fetch(base + path, {
+            ...init,
+            headers,
+            body: init.json !== undefined ? JSON.stringify(init.json) : init.body,
+            redirect: "manual",
+        });
+        const set = res.headers.getSetCookie();
+        for (const c of set) {
+            const pair = c.split(";")[0];
+            cookie = /=$/.test(pair) || /Max-Age=0/i.test(c) ? "" : pair;
+        }
+        return res;
+    };
+    return { call, get cookie() { return cookie; }, set cookie(v) { cookie = v; } };
+}
+//# sourceMappingURL=testHarness.js.map

package/lib/server/forge/auth/testHarness.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"testHarness.js","sourceRoot":"","sources":["../../../../server/forge/auth/testHarness.ts"],"names":[],"mappings":"AAEA,OAAO,OAAwB,MAAM,SAAS,CAAC;AAE/C,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAEjD,OAAO,EAAE,UAAU,EAAoB,MAAM,iBAAiB,CAAC;AAE/D,MAAM,CAAC,MAAM,aAAa,GAAG,oCAAoC,CAAC;AAElE,uEAAuE;AACvE,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,OAA+D,EAAE;IACnG,MAAM,EAAE,GAAG,MAAM,YAAY,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,CAAC;IACpD,MAAM,IAAI,GAAG,UAAU,CAAC,EAAE,EAAE,EAAE,YAAY,EAAE,aAAa,EAAE,YAAY,EAAE,KAAK,EAAE,GAAG,IAAI,EAAE,CAAC,CAAC;IAC3F,MAAM,GAAG,GAAG,OAAO,EAAE,CAAC;IACtB,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;IACxB,MAAM,GAAG,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAC7B,GAAG,CAAC,GAAG,CAAC,OAAO,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;IAC9B,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,YAAY,EAAE,IAAI,CAAC,WAAW,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;IACzE,GAAG,CAAC,GAAG,CAAC,QAAQ,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC;IACpC,GAAG,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,GAAG,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC;IACxE,GAAG,CAAC,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,WAAW,CAAC,UAAU,CAAC,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;IAC1F,GAAG,CAAC,IAAI,CAAC,kBAAkB,EAAE,IAAI,CAAC,WAAW,CAAC,UAAU,CAAC,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;IACtG,IAAI,CAAC,KAAK,EAAE,CAAC,GAAG,CAAC,CAAC;IAClB,GAAG,CAAC,GAAG,CAAC,YAAY,EAAE,GAAG,CAAC,CAAC;IAC3B,yEAAyE;IACzE,qEAAqE;IACrE,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC,EAAE,WAAW,CAAC,CAAC;IAC1C,MAAM,IAAI,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,CAAC;IACtD,MAAM,IAAI,GAAG,oBAAqB,MAAM,CAAC,OAAO,EAAkB,CAAC,IAAI,YAAY,CAAC;IACpF,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,IAAI,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;AAC7E,CAAC;AAED,iCAAiC;AACjC,MAAM,UAAU,MAAM,CAAC,IAAY;IAClC,IAAI,MAAM,GAAG,EAAE,CAAC;IAChB,MAAM,IAAI,GAAG,KAAK,EAAE,IAAY,EAAE,OAAyD,EAAE,EAAE,EAAE;QAChG,MAAM,OAAO,GAA2B,EAAE,GAAI,IAAI,CAAC,OAAkC,EAAE,CAAC;QACxF,IAAI,MAAM;YAAE,OAAO,CAAC,MAAM,GAAG,MAAM,CAAC;QACpC,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS;YAAE,OAAO,CAAC,cAAc,CAAC,GAAG,kBAAkB,CAAC;QAC1E,IAAI,IAAI,CAAC,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,MAAM,KAAK,KAAK;YAAE,OAAO,CAAC,iBAAiB,CAAC,GAAG,GAAG,CAAC;QAClG,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,IAAI,GAAG,IAAI,EAAE;YACpC,GAAG,IAAI;YACP,OAAO;YACP,IAAI,EAAE,IAAI,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI;YACrE,QAAQ,EAAE,QAAQ;SAClB,CAAC,CAAC;QACH,MAAM,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,YAAY,EAAE,CAAC;QACvC,KAAK,MAAM,CAAC,IAAI,GAAG,EAAE,CAAC;YACrB,MAAM,IAAI,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;YAC7B,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;QAC9D,CAAC;QACD,OAAO,GAAG,CAAC;IACZ,CAAC,CAAC;IACF,OAAO,EAAE,IAAI,EAAE,IAAI,MAAM,KAAK,OAAO,MAAM,CAAC,CAAC,CAAC,EAAE,IAAI,MAAM,CAAC,CAAS,IAAI,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;AACzF,CAAC"}

package/lib/server/forge/auth/tokenHash.d.ts

@@ -0,0 +1,3 @@
+export declare const newSecret: () => string;
+export declare const sha256: (value: string) => string;
+//# sourceMappingURL=tokenHash.d.ts.map

package/lib/server/forge/auth/tokenHash.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tokenHash.d.ts","sourceRoot":"","sources":["../../../../server/forge/auth/tokenHash.ts"],"names":[],"mappings":"AAEA,eAAO,MAAM,SAAS,cAA8C,CAAC;AACrE,eAAO,MAAM,MAAM,GAAI,OAAO,MAAM,WAAqD,CAAC"}

package/lib/server/forge/auth/tokenHash.js

@@ -0,0 +1,4 @@
+import { createHash, randomBytes } from "node:crypto";
+export const newSecret = () => randomBytes(32).toString("base64url");
+export const sha256 = (value) => createHash("sha256").update(value).digest("hex");
+//# sourceMappingURL=tokenHash.js.map

package/lib/server/forge/auth/tokenHash.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tokenHash.js","sourceRoot":"","sources":["../../../../server/forge/auth/tokenHash.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAEtD,MAAM,CAAC,MAAM,SAAS,GAAG,GAAG,EAAE,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AACrE,MAAM,CAAC,MAAM,MAAM,GAAG,CAAC,KAAa,EAAE,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC"}

package/lib/server/forge/auth/users.d.ts

@@ -0,0 +1,51 @@
+import type { Db } from "../db/database.ts";
+import type { Role } from "./roles.ts";
+export interface User {
+    id: string;
+    email: string;
+    name: string;
+    role: Role;
+    authProvider: "local" | "oidc";
+    disabled: boolean;
+    createdAt: number;
+    lastLoginAt: number | null;
+}
+export type AuthResult = {
+    ok: true;
+    user: User;
+} | {
+    ok: false;
+    reason: "invalid" | "locked" | "disabled";
+};
+export declare function createUsers({ db, clock }: {
+    db: Db;
+    clock?: () => number;
+}): {
+    count(): Promise<number>;
+    countActiveAdmins(): Promise<number>;
+    findById(id: string): Promise<User>;
+    findByEmail(email: string): Promise<User>;
+    list(): Promise<User[]>;
+    create({ email, name, role, password }: {
+        email: string;
+        name: string;
+        role: Role;
+        password?: string;
+    }): Promise<User>;
+    update(id: string, patch: {
+        role?: Role;
+        disabled?: boolean;
+        name?: string;
+        password?: string;
+    }): Promise<User>;
+    authenticate(email: string, password: string): Promise<AuthResult>;
+    /** Find by OIDC subject, else link by email, else provision. */
+    upsertOidc({ subject, email, name, defaultRole }: {
+        subject: string;
+        email: string;
+        name: string;
+        defaultRole: Role;
+    }): Promise<User>;
+};
+export type Users = ReturnType<typeof createUsers>;
+//# sourceMappingURL=users.d.ts.map

package/lib/server/forge/auth/users.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"users.d.ts","sourceRoot":"","sources":["../../../../server/forge/auth/users.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,EAAE,EAAE,MAAM,mBAAmB,CAAC;AAG5C,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,YAAY,CAAC;AAEvC,MAAM,WAAW,IAAI;IACpB,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,IAAI,CAAC;IACX,YAAY,EAAE,OAAO,GAAG,MAAM,CAAC;IAC/B,QAAQ,EAAE,OAAO,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;CAC3B;AAiBD,MAAM,MAAM,UAAU,GAAG;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,IAAI,EAAE,IAAI,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,SAAS,GAAG,QAAQ,GAAG,UAAU,CAAA;CAAE,CAAC;AAqB7G,wBAAgB,WAAW,CAAC,EAAE,EAAE,EAAE,KAAgB,EAAE,EAAE;IAAE,EAAE,EAAE,EAAE,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,MAAM,CAAA;CAAE;;;iBAajE,MAAM;uBAKA,MAAM;;4CASe;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,IAAI,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;KAAE;eAgB3F,MAAM,SAAS;QAAE,IAAI,CAAC,EAAE,IAAI,CAAC;QAAC,QAAQ,CAAC,EAAE,OAAO,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;KAAE;wBAe3E,MAAM,YAAY,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC;IAuBxE,gEAAgE;sDACR;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,IAAI,CAAA;KAAE;EAsB5H;AAED,MAAM,MAAM,KAAK,GAAG,UAAU,CAAC,OAAO,WAAW,CAAC,CAAC"}

package/lib/server/forge/auth/users.js

@@ -0,0 +1,118 @@
+import { randomUUID } from "node:crypto";
+import { hashPassword, validatePassword, verifyPassword } from "./passwords.js";
+const MAX_FAILED_LOGINS = 5;
+const LOCKOUT_MS = 15 * 60_000;
+// Compared against when the email is unknown so response time doesn't reveal
+// which addresses have accounts.
+const DUMMY_HASH = hashPassword("forge-dummy-password-for-timing");
+const toUser = (r) => ({
+    id: r.id,
+    email: r.email,
+    name: r.name,
+    role: r.role,
+    authProvider: r.auth_provider,
+    disabled: Boolean(r.disabled),
+    createdAt: r.created_at,
+    lastLoginAt: r.last_login_at,
+});
+const normalizeEmail = (email) => email.trim().toLowerCase();
+export function createUsers({ db, clock = Date.now }) {
+    const rowByEmail = (email) => db.get("SELECT * FROM users WHERE email = ?", [normalizeEmail(email)]);
+    const rowById = (id) => db.get("SELECT * FROM users WHERE id = ?", [id]);
+    const users = {
+        async count() {
+            return (await db.get("SELECT COUNT(*) AS n FROM users")).n;
+        },
+        async countActiveAdmins() {
+            return (await db.get("SELECT COUNT(*) AS n FROM users WHERE role = 'admin' AND disabled = 0")).n;
+        },
+        async findById(id) {
+            const r = await rowById(id);
+            return r ? toUser(r) : null;
+        },
+        async findByEmail(email) {
+            const r = await rowByEmail(email);
+            return r ? toUser(r) : null;
+        },
+        async list() {
+            return (await db.all("SELECT * FROM users ORDER BY created_at, email")).map(toUser);
+        },
+        async create({ email, name, role, password }) {
+            const normalized = normalizeEmail(email);
+            if (!/^[^@\s]+@[^@\s]+$/.test(normalized))
+                throw new Error("Enter a valid email address.");
+            if (password !== undefined) {
+                const problem = validatePassword(password);
+                if (problem)
+                    throw new Error(problem);
+            }
+            if (await rowByEmail(normalized))
+                throw new Error("A user with that email already exists.");
+            const id = randomUUID();
+            await db.run("INSERT INTO users (id, email, name, role, password_hash, auth_provider, created_at) VALUES (?, ?, ?, ?, ?, 'local', ?)", [id, normalized, name.trim() || normalized, role, password ? await hashPassword(password) : null, clock()]);
+            return toUser((await rowById(id)));
+        },
+        async update(id, patch) {
+            if (patch.password !== undefined) {
+                const problem = validatePassword(patch.password);
+                if (problem)
+                    throw new Error(problem);
+                await db.run("UPDATE users SET password_hash = ?, failed_logins = 0, locked_until = NULL WHERE id = ?", [
+                    await hashPassword(patch.password),
+                    id,
+                ]);
+            }
+            if (patch.role !== undefined)
+                await db.run("UPDATE users SET role = ? WHERE id = ?", [patch.role, id]);
+            if (patch.disabled !== undefined)
+                await db.run("UPDATE users SET disabled = ? WHERE id = ?", [patch.disabled ? 1 : 0, id]);
+            if (patch.name !== undefined)
+                await db.run("UPDATE users SET name = ? WHERE id = ?", [patch.name.trim(), id]);
+            return users.findById(id);
+        },
+        async authenticate(email, password) {
+            const row = await rowByEmail(email ?? "");
+            if (!row || !row.password_hash) {
+                await verifyPassword(password ?? "", await DUMMY_HASH);
+                return { ok: false, reason: "invalid" };
+            }
+            const now = clock();
+            if (row.locked_until && row.locked_until > now)
+                return { ok: false, reason: "locked" };
+            if (!(await verifyPassword(password ?? "", row.password_hash))) {
+                const failures = row.failed_logins + 1;
+                const lock = failures >= MAX_FAILED_LOGINS;
+                await db.run("UPDATE users SET failed_logins = ?, locked_until = ? WHERE id = ?", [
+                    lock ? 0 : failures,
+                    lock ? now + LOCKOUT_MS : null,
+                    row.id,
+                ]);
+                return { ok: false, reason: "invalid" };
+            }
+            if (row.disabled)
+                return { ok: false, reason: "disabled" };
+            await db.run("UPDATE users SET failed_logins = 0, locked_until = NULL, last_login_at = ? WHERE id = ?", [now, row.id]);
+            return { ok: true, user: toUser((await rowById(row.id))) };
+        },
+        /** Find by OIDC subject, else link by email, else provision. */
+        async upsertOidc({ subject, email, name, defaultRole }) {
+            const now = clock();
+            const bySubject = await db.get("SELECT * FROM users WHERE oidc_subject = ?", [subject]);
+            const existing = bySubject ?? (await rowByEmail(email));
+            if (existing) {
+                await db.run("UPDATE users SET oidc_subject = ?, name = ?, last_login_at = ? WHERE id = ?", [
+                    subject,
+                    name || existing.name,
+                    now,
+                    existing.id,
+                ]);
+                return toUser((await rowById(existing.id)));
+            }
+            const id = randomUUID();
+            await db.run("INSERT INTO users (id, email, name, role, auth_provider, oidc_subject, created_at, last_login_at) VALUES (?, ?, ?, ?, 'oidc', ?, ?, ?)", [id, normalizeEmail(email), name || email, defaultRole, subject, now, now]);
+            return toUser((await rowById(id)));
+        },
+    };
+    return users;
+}
+//# sourceMappingURL=users.js.map

package/lib/server/forge/auth/users.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"users.js","sourceRoot":"","sources":["../../../../server/forge/auth/users.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAIzC,OAAO,EAAE,YAAY,EAAE,gBAAgB,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AA+BhF,MAAM,iBAAiB,GAAG,CAAC,CAAC;AAC5B,MAAM,UAAU,GAAG,EAAE,GAAG,MAAM,CAAC;AAC/B,6EAA6E;AAC7E,iCAAiC;AACjC,MAAM,UAAU,GAAG,YAAY,CAAC,iCAAiC,CAAC,CAAC;AAEnE,MAAM,MAAM,GAAG,CAAC,CAAU,EAAQ,EAAE,CAAC,CAAC;IACrC,EAAE,EAAE,CAAC,CAAC,EAAE;IACR,KAAK,EAAE,CAAC,CAAC,KAAK;IACd,IAAI,EAAE,CAAC,CAAC,IAAI;IACZ,IAAI,EAAE,CAAC,CAAC,IAAI;IACZ,YAAY,EAAE,CAAC,CAAC,aAAa;IAC7B,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC;IAC7B,SAAS,EAAE,CAAC,CAAC,UAAU;IACvB,WAAW,EAAE,CAAC,CAAC,aAAa;CAC5B,CAAC,CAAC;AAEH,MAAM,cAAc,GAAG,CAAC,KAAa,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;AAErE,MAAM,UAAU,WAAW,CAAC,EAAE,EAAE,EAAE,KAAK,GAAG,IAAI,CAAC,GAAG,EAAoC;IACrF,MAAM,UAAU,GAAG,CAAC,KAAa,EAAE,EAAE,CAAC,EAAE,CAAC,GAAG,CAAU,qCAAqC,EAAE,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IACtH,MAAM,OAAO,GAAG,CAAC,EAAU,EAAE,EAAE,CAAC,EAAE,CAAC,GAAG,CAAU,kCAAkC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;IAE1F,MAAM,KAAK,GAAG;QACb,KAAK,CAAC,KAAK;YACV,OAAO,CAAC,MAAM,EAAE,CAAC,GAAG,CAAgB,iCAAiC,CAAC,CAAE,CAAC,CAAC,CAAC;QAC5E,CAAC;QAED,KAAK,CAAC,iBAAiB;YACtB,OAAO,CAAC,MAAM,EAAE,CAAC,GAAG,CAAgB,uEAAuE,CAAC,CAAE,CAAC,CAAC,CAAC;QAClH,CAAC;QAED,KAAK,CAAC,QAAQ,CAAC,EAAU;YACxB,MAAM,CAAC,GAAG,MAAM,OAAO,CAAC,EAAE,CAAC,CAAC;YAC5B,OAAO,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QAC7B,CAAC;QAED,KAAK,CAAC,WAAW,CAAC,KAAa;YAC9B,MAAM,CAAC,GAAG,MAAM,UAAU,CAAC,KAAK,CAAC,CAAC;YAClC,OAAO,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QAC7B,CAAC;QAED,KAAK,CAAC,IAAI;YACT,OAAO,CAAC,MAAM,EAAE,CAAC,GAAG,CAAU,gDAAgD,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAC9F,CAAC;QAED,KAAK,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAkE;YAC3G,MAAM,UAAU,GAAG,cAAc,CAAC,KAAK,CAAC,CAAC;YACzC,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,UAAU,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC;YAC3F,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;gBAC5B,MAAM,OAAO,GAAG,gBAAgB,CAAC,QAAQ,CAAC,CAAC;gBAC3C,IAAI,OAAO;oBAAE,MAAM,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC;YACvC,CAAC;YACD,IAAI,MAAM,UAAU,CAAC,UAAU,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;YAC5F,MAAM,EAAE,GAAG,UAAU,EAAE,CAAC;YACxB,MAAM,EAAE,CAAC,GAAG,CACX,wHAAwH,EACxH,CAAC,EAAE,EAAE,UAAU,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,UAAU,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAC,MAAM,YAAY,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,CAC1G,CAAC;YACF,OAAO,MAAM,CAAC,CAAC,MAAM,OAAO,CAAC,EAAE,CAAC,CAAE,CAAC,CAAC;QACrC,CAAC;QAED,KAAK,CAAC,MAAM,CAAC,EAAU,EAAE,KAA4E;YACpG,IAAI,KAAK,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;gBAClC,MAAM,OAAO,GAAG,gBAAgB,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;gBACjD,IAAI,OAAO;oBAAE,MAAM,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC;gBACtC,MAAM,EAAE,CAAC,GAAG,CAAC,yFAAyF,EAAE;oBACvG,MAAM,YAAY,CAAC,KAAK,CAAC,QAAQ,CAAC;oBAClC,EAAE;iBACF,CAAC,CAAC;YACJ,CAAC;YACD,IAAI,KAAK,CAAC,IAAI,KAAK,SAAS;gBAAE,MAAM,EAAE,CAAC,GAAG,CAAC,wCAAwC,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC;YACvG,IAAI,KAAK,CAAC,QAAQ,KAAK,SAAS;gBAAE,MAAM,EAAE,CAAC,GAAG,CAAC,4CAA4C,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;YAC3H,IAAI,KAAK,CAAC,IAAI,KAAK,SAAS;gBAAE,MAAM,EAAE,CAAC,GAAG,CAAC,wCAAwC,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC;YAC9G,OAAO,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;QAC3B,CAAC;QAED,KAAK,CAAC,YAAY,CAAC,KAAa,EAAE,QAAgB;YACjD,MAAM,GAAG,GAAG,MAAM,UAAU,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC;YAC1C,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,aAAa,EAAE,CAAC;gBAChC,MAAM,cAAc,CAAC,QAAQ,IAAI,EAAE,EAAE,MAAM,UAAU,CAAC,CAAC;gBACvD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;YACzC,CAAC;YACD,MAAM,GAAG,GAAG,KAAK,EAAE,CAAC;YACpB,IAAI,GAAG,CAAC,YAAY,IAAI,GAAG,CAAC,YAAY,GAAG,GAAG;gBAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;YACvF,IAAI,CAAC,CAAC,MAAM,cAAc,CAAC,QAAQ,IAAI,EAAE,EAAE,GAAG,CAAC,aAAa,CAAC,CAAC,EAAE,CAAC;gBAChE,MAAM,QAAQ,GAAG,GAAG,CAAC,aAAa,GAAG,CAAC,CAAC;gBACvC,MAAM,IAAI,GAAG,QAAQ,IAAI,iBAAiB,CAAC;gBAC3C,MAAM,EAAE,CAAC,GAAG,CAAC,mEAAmE,EAAE;oBACjF,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ;oBACnB,IAAI,CAAC,CAAC,CAAC,GAAG,GAAG,UAAU,CAAC,CAAC,CAAC,IAAI;oBAC9B,GAAG,CAAC,EAAE;iBACN,CAAC,CAAC;gBACH,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;YACzC,CAAC;YACD,IAAI,GAAG,CAAC,QAAQ;gBAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC;YAC3D,MAAM,EAAE,CAAC,GAAG,CAAC,yFAAyF,EAAE,CAAC,GAAG,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;YACvH,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC,MAAM,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAE,CAAC,EAAE,CAAC;QAC7D,CAAC;QAED,gEAAgE;QAChE,KAAK,CAAC,UAAU,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,WAAW,EAAuE;YAC1H,MAAM,GAAG,GAAG,KAAK,EAAE,CAAC;YACpB,MAAM,SAAS,GAAG,MAAM,EAAE,CAAC,GAAG,CAAU,4CAA4C,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC;YACjG,MAAM,QAAQ,GAAG,SAAS,IAAI,CAAC,MAAM,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC;YACxD,IAAI,QAAQ,EAAE,CAAC;gBACd,MAAM,EAAE,CAAC,GAAG,CAAC,6EAA6E,EAAE;oBAC3F,OAAO;oBACP,IAAI,IAAI,QAAQ,CAAC,IAAI;oBACrB,GAAG;oBACH,QAAQ,CAAC,EAAE;iBACX,CAAC,CAAC;gBACH,OAAO,MAAM,CAAC,CAAC,MAAM,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAE,CAAC,CAAC;YAC9C,CAAC;YACD,MAAM,EAAE,GAAG,UAAU,EAAE,CAAC;YACxB,MAAM,EAAE,CAAC,GAAG,CACX,wIAAwI,EACxI,CAAC,EAAE,EAAE,cAAc,CAAC,KAAK,CAAC,EAAE,IAAI,IAAI,KAAK,EAAE,WAAW,EAAE,OAAO,EAAE,GAAG,EAAE,GAAG,CAAC,CAC1E,CAAC;YACF,OAAO,MAAM,CAAC,CAAC,MAAM,OAAO,CAAC,EAAE,CAAC,CAAE,CAAC,CAAC;QACrC,CAAC;KACD,CAAC;IACF,OAAO,KAAK,CAAC;AACd,CAAC"}

package/lib/server/forge/core/ForgeAgent.d.ts

@@ -88,6 +88,23 @@ interface SignalOpts {
     /** Per-request agent-mode override ("structured" | "agentic"); see agentMode.ts. */
     agentMode?: string;
 }
+/** Inputs for one agentic run in a prepared checkout. */
+interface AgenticRunOpts {
+    signal?: AbortSignal;
+    ciContext?: string;
+    userPrompt?: string;
+    /** Reviewer follow-up: the run is a refine of the change already in the tree. */
+    feedback?: string;
+    /** Changes already in the tree before the agent starts (refine overlays them). */
+    baseline?: ForgeChange[];
+}
+/** What an agentic run produced, before it is emitted. */
+interface AgenticOutcome {
+    result: EnrichedAnalysisResult;
+    usage: ForgeEvent | null;
+    /** False when the agent left the tree exactly as it found it. */
+    edited: boolean;
+}
 /** The result of the analysis "kind" argument. */
 type AnalysisKind = "fresh" | "new" | "update" | "retry";
 /** Result from applying changes to a single repo. */
@@ -116,7 +133,7 @@ export declare class ForgeAgent {
     provider: ScmProvider;
     constructor(opts?: ForgeAgentOptions);
     _provider(repo: string): ScmProvider;
-    get _agentLabel(): "OpenClaw" | "Claude";
+    get _agentLabel(): string;
     get _isMultiRepo(): boolean;
     _fetchAllTrees(emit: (evt: ForgeEvent) => void): Promise<RepoTree[]>;
     _fetchFiles(entries: FileEntry[], emit: (evt: ForgeEvent) => void): Promise<FileContent[]>;
@@ -147,6 +164,30 @@ export declare class ForgeAgent {
      * pipeline so the route, UI, and apply flow are unchanged.
      */
     _analyzeAgentic(issueIid: number, emit: (evt: ForgeEvent) => void, model: string | undefined, ciContext: string | undefined, userPrompt: string | undefined, opts?: SignalOpts): Promise<EnrichedAnalysisResult>;
+    _runAgentic(dir: string, issue: NormalIssue, repo: string, emit: (evt: ForgeEvent) => void, model: string | undefined, ciContext: string | undefined, userPrompt: string | undefined, { signal }: SignalOpts): Promise<EnrichedAnalysisResult>;
+    /**
+     * Runs the agent in `dir` and reads back what it did: the captured changes,
+     * its summary and any evidence. Callers decide what to emit.
+     */
+    _executeAgentic(dir: string, issue: NormalIssue, repo: string, emit: (evt: ForgeEvent) => void, model: string | undefined, { signal, ciContext, userPrompt, feedback, baseline }: AgenticRunOpts): Promise<AgenticOutcome>;
+    /**
+     * Agentic refine: overlays the current proposal on the issue's worktree and
+     * runs the reviewer's follow-up as a full agent, so asks like "check it in
+     * Playwright" can run things instead of hitting the read-only refine's
+     * Read/Glob/Grep wall. A run that leaves the tree untouched and gathers no
+     * evidence comes back as an answer, so a question doesn't replace the
+     * proposal (and its validation) with an identical one.
+     */
+    _refineAgentic(issue: NormalIssue, previousChanges: ForgeChange[] | null, feedback: string, emit: (evt: ForgeEvent) => void, model: string | undefined, { signal }: SignalOpts): Promise<EnrichedAnalysisResult | {
+        kind: "answer";
+        answer: string;
+    }>;
+    /**
+     * Uploads whatever the agent left in the evidence folder and returns the
+     * markdown for the MR. A failed upload is logged, never fatal — the change
+     * itself is what matters.
+     */
+    _attachEvidence(dir: string, emit: (evt: ForgeEvent) => void): Promise<string | null>;
     /**
      * Runs the full analysis pipeline for an issue across all configured repos.
      *
@@ -281,6 +322,7 @@ export declare class ForgeAgent {
         isPrimary?: boolean;
         repo?: string;
         priorApplications?: ApplicationResult[];
+        evidence?: string;
     }): string;
 }
 export {};