@ipul-labs/forge 1.22.0 → 1.35.0

package/lib/server/forge/analyses/analysisStore.d.ts

@@ -0,0 +1,53 @@
+/**
+ * Saved analyses, per (repo, issue). The browser used to be the only place a
+ * finished analysis lived, so switching tickets mid-run, a second device or a
+ * cleared cache lost it. The analyze job now saves its result here before it
+ * reports `done`; browsers keep a localStorage copy as a cache.
+ *
+ * Entries are stored as JSON in the client's StoredAnalysis shape; the server
+ * only owns `id`, `ordinal`, `repo` and `analyzedAt`.
+ */
+import type { Db } from "../db/database.ts";
+export declare const MAX_ANALYSES_PER_ISSUE = 5;
+export interface SavedAnalysis {
+    id: string;
+    ordinal: number;
+    result: {
+        explanation: string;
+        [key: string]: unknown;
+    };
+    analyzedAt: string;
+    repo: string;
+    model: string;
+    mrIid?: number;
+    prompt?: string;
+    refineThread?: unknown[];
+    claudeSessionId?: string;
+    validation?: unknown;
+}
+export declare function createAnalysisStore({ db, clock }: {
+    db: Db;
+    clock?: () => number;
+}): {
+    list: (repo: string, issueIid: number) => Promise<SavedAnalysis[]>;
+    /** Saves a finished analyze job. Calling it again for the same job returns the saved entry. */
+    create: ({ repo, issueIid, id, result, model, mrIid, prompt }: {
+        repo: string;
+        issueIid: number;
+        id: string;
+        result: SavedAnalysis["result"];
+        model: string;
+        mrIid?: number;
+        prompt?: string;
+    }) => Promise<SavedAnalysis>;
+    /**
+     * Saves a browser's copy of an analysis: refine turns and validation on a
+     * known entry, or an entry only that browser had. A new entry whose
+     * ordinal is taken gets the next free one; the caller adopts the result.
+     */
+    put: (repo: string, issueIid: number, entry: SavedAnalysis) => Promise<SavedAnalysis>;
+    remove: (repo: string, issueIid: number, id: string) => Promise<void>;
+    clear: (repo: string, issueIid: number) => Promise<void>;
+};
+export type AnalysisStore = ReturnType<typeof createAnalysisStore>;
+//# sourceMappingURL=analysisStore.d.ts.map

package/lib/server/forge/analyses/analysisStore.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"analysisStore.d.ts","sourceRoot":"","sources":["../../../../server/forge/analyses/analysisStore.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,EAAE,EAAE,EAAE,MAAM,mBAAmB,CAAC;AAE5C,eAAO,MAAM,sBAAsB,IAAI,CAAC;AAExC,MAAM,WAAW,aAAa;IAC7B,EAAE,EAAE,MAAM,CAAC;IACX,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE;QAAE,WAAW,EAAE,MAAM,CAAC;QAAC,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAA;KAAE,CAAC;IACxD,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,YAAY,CAAC,EAAE,OAAO,EAAE,CAAC;IACzB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,UAAU,CAAC,EAAE,OAAO,CAAC;CACrB;AAMD,wBAAgB,mBAAmB,CAAC,EAAE,EAAE,EAAE,KAAgB,EAAE,EAAE;IAAE,EAAE,EAAE,EAAE,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,MAAM,CAAA;CAAE;iBACnE,MAAM,YAAY,MAAM,KAAG,OAAO,CAAC,aAAa,EAAE,CAAC;IAsC5E,+FAA+F;mEAChC;QAC9D,IAAI,EAAE,MAAM,CAAC;QACb,QAAQ,EAAE,MAAM,CAAC;QACjB,EAAE,EAAE,MAAM,CAAC;QACX,MAAM,EAAE,aAAa,CAAC,QAAQ,CAAC,CAAC;QAChC,KAAK,EAAE,MAAM,CAAC;QACd,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,MAAM,CAAC,EAAE,MAAM,CAAC;KAChB;IAmBD;;;;OAIG;gBACS,MAAM,YAAY,MAAM,SAAS,aAAa;mBAarC,MAAM,YAAY,MAAM,MAAM,MAAM;kBAIrC,MAAM,YAAY,MAAM;EAI7C;AAED,MAAM,MAAM,aAAa,GAAG,UAAU,CAAC,OAAO,mBAAmB,CAAC,CAAC"}

package/lib/server/forge/analyses/analysisStore.js

@@ -0,0 +1,77 @@
+/**
+ * Saved analyses, per (repo, issue). The browser used to be the only place a
+ * finished analysis lived, so switching tickets mid-run, a second device or a
+ * cleared cache lost it. The analyze job now saves its result here before it
+ * reports `done`; browsers keep a localStorage copy as a cache.
+ *
+ * Entries are stored as JSON in the client's StoredAnalysis shape; the server
+ * only owns `id`, `ordinal`, `repo` and `analyzedAt`.
+ */
+export const MAX_ANALYSES_PER_ISSUE = 5;
+export function createAnalysisStore({ db, clock = Date.now }) {
+    const list = async (repo, issueIid) => {
+        const rows = await db.all("SELECT data FROM analyses WHERE repo = ? AND issue_iid = ? ORDER BY ordinal DESC", [repo, issueIid]);
+        return rows.map((r) => JSON.parse(r.data));
+    };
+    const nextOrdinal = async (repo, issueIid) => {
+        const row = await db.get("SELECT MAX(ordinal) AS max FROM analyses WHERE repo = ? AND issue_iid = ?", [repo, issueIid]);
+        return (row?.max ?? 0) + 1;
+    };
+    const write = async (repo, issueIid, entry) => {
+        await db.run(`INSERT INTO analyses (repo, issue_iid, id, ordinal, data, updated_at) VALUES (?, ?, ?, ?, ?, ?)
+			 ON CONFLICT (repo, issue_iid, id) DO UPDATE SET data = excluded.data, updated_at = excluded.updated_at`, [repo, issueIid, entry.id, entry.ordinal, JSON.stringify(entry), clock()]);
+        // Keep the newest MAX_ANALYSES_PER_ISSUE, same as the browser cache did.
+        await db.run(`DELETE FROM analyses WHERE repo = ? AND issue_iid = ? AND ordinal NOT IN
+			 (SELECT ordinal FROM analyses WHERE repo = ? AND issue_iid = ? ORDER BY ordinal DESC LIMIT ?)`, [repo, issueIid, repo, issueIid, MAX_ANALYSES_PER_ISSUE]);
+    };
+    const find = async (repo, issueIid, id) => {
+        const row = await db.get("SELECT data FROM analyses WHERE repo = ? AND issue_iid = ? AND id = ?", [repo, issueIid, id]);
+        return row ? JSON.parse(row.data) : null;
+    };
+    return {
+        list,
+        /** Saves a finished analyze job. Calling it again for the same job returns the saved entry. */
+        create: ({ repo, issueIid, id, result, model, mrIid, prompt }) => db.transaction(async () => {
+            const existing = await find(repo, issueIid, id);
+            if (existing)
+                return existing;
+            const trimmed = prompt?.trim();
+            const entry = {
+                id,
+                ordinal: await nextOrdinal(repo, issueIid),
+                result,
+                analyzedAt: new Date(clock()).toISOString(),
+                repo,
+                model,
+                ...(mrIid !== undefined && { mrIid }),
+                ...(trimmed && { prompt: trimmed }),
+            };
+            await write(repo, issueIid, entry);
+            return entry;
+        }),
+        /**
+         * Saves a browser's copy of an analysis: refine turns and validation on a
+         * known entry, or an entry only that browser had. A new entry whose
+         * ordinal is taken gets the next free one; the caller adopts the result.
+         */
+        put: (repo, issueIid, entry) => db.transaction(async () => {
+            const existing = await find(repo, issueIid, entry.id);
+            let ordinal = existing?.ordinal ?? entry.ordinal;
+            if (!existing) {
+                const taken = await db.get("SELECT 1 FROM analyses WHERE repo = ? AND issue_iid = ? AND ordinal = ?", [repo, issueIid, ordinal]);
+                if (taken || !Number.isInteger(ordinal) || ordinal < 1)
+                    ordinal = await nextOrdinal(repo, issueIid);
+            }
+            const saved = { ...entry, ordinal, repo };
+            await write(repo, issueIid, saved);
+            return saved;
+        }),
+        remove: async (repo, issueIid, id) => {
+            await db.run("DELETE FROM analyses WHERE repo = ? AND issue_iid = ? AND id = ?", [repo, issueIid, id]);
+        },
+        clear: async (repo, issueIid) => {
+            await db.run("DELETE FROM analyses WHERE repo = ? AND issue_iid = ?", [repo, issueIid]);
+        },
+    };
+}
+//# sourceMappingURL=analysisStore.js.map

package/lib/server/forge/analyses/analysisStore.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"analysisStore.js","sourceRoot":"","sources":["../../../../server/forge/analyses/analysisStore.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAIH,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAC;AAoBxC,MAAM,UAAU,mBAAmB,CAAC,EAAE,EAAE,EAAE,KAAK,GAAG,IAAI,CAAC,GAAG,EAAoC;IAC7F,MAAM,IAAI,GAAG,KAAK,EAAE,IAAY,EAAE,QAAgB,EAA4B,EAAE;QAC/E,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,GAAG,CACxB,kFAAkF,EAClF,CAAC,IAAI,EAAE,QAAQ,CAAC,CAChB,CAAC;QACF,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAkB,CAAC,CAAC;IAC7D,CAAC,CAAC;IAEF,MAAM,WAAW,GAAG,KAAK,EAAE,IAAY,EAAE,QAAgB,EAAE,EAAE;QAC5D,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,GAAG,CACvB,2EAA2E,EAC3E,CAAC,IAAI,EAAE,QAAQ,CAAC,CAChB,CAAC;QACF,OAAO,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;IAC5B,CAAC,CAAC;IAEF,MAAM,KAAK,GAAG,KAAK,EAAE,IAAY,EAAE,QAAgB,EAAE,KAAoB,EAAE,EAAE;QAC5E,MAAM,EAAE,CAAC,GAAG,CACX;2GACwG,EACxG,CAAC,IAAI,EAAE,QAAQ,EAAE,KAAK,CAAC,EAAE,EAAE,KAAK,CAAC,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,CAAC,CACzE,CAAC;QACF,yEAAyE;QACzE,MAAM,EAAE,CAAC,GAAG,CACX;kGAC+F,EAC/F,CAAC,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE,sBAAsB,CAAC,CACxD,CAAC;IACH,CAAC,CAAC;IAEF,MAAM,IAAI,GAAG,KAAK,EAAE,IAAY,EAAE,QAAgB,EAAE,EAAU,EAAE,EAAE;QACjE,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,GAAG,CAAM,uEAAuE,EAAE,CAAC,IAAI,EAAE,QAAQ,EAAE,EAAE,CAAC,CAAC,CAAC;QAC7H,OAAO,GAAG,CAAC,CAAC,CAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAmB,CAAC,CAAC,CAAC,IAAI,CAAC;IAC7D,CAAC,CAAC;IAEF,OAAO;QACN,IAAI;QAEJ,+FAA+F;QAC/F,MAAM,EAAE,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAQ1D,EAAE,EAAE,CACJ,EAAE,CAAC,WAAW,CAAC,KAAK,IAAI,EAAE;YACzB,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,QAAQ,EAAE,EAAE,CAAC,CAAC;YAChD,IAAI,QAAQ;gBAAE,OAAO,QAAQ,CAAC;YAC9B,MAAM,OAAO,GAAG,MAAM,EAAE,IAAI,EAAE,CAAC;YAC/B,MAAM,KAAK,GAAkB;gBAC5B,EAAE;gBACF,OAAO,EAAE,MAAM,WAAW,CAAC,IAAI,EAAE,QAAQ,CAAC;gBAC1C,MAAM;gBACN,UAAU,EAAE,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,WAAW,EAAE;gBAC3C,IAAI;gBACJ,KAAK;gBACL,GAAG,CAAC,KAAK,KAAK,SAAS,IAAI,EAAE,KAAK,EAAE,CAAC;gBACrC,GAAG,CAAC,OAAO,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;aACnC,CAAC;YACF,MAAM,KAAK,CAAC,IAAI,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC;YACnC,OAAO,KAAK,CAAC;QACd,CAAC,CAAC;QAEH;;;;WAIG;QACH,GAAG,EAAE,CAAC,IAAY,EAAE,QAAgB,EAAE,KAAoB,EAAE,EAAE,CAC7D,EAAE,CAAC,WAAW,CAAC,KAAK,IAAI,EAAE;YACzB,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,QAAQ,EAAE,KAAK,CAAC,EAAE,CAAC,CAAC;YACtD,IAAI,OAAO,GAAG,QAAQ,EAAE,OAAO,IAAI,KAAK,CAAC,OAAO,CAAC;YACjD,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACf,MAAM,KAAK,GAAG,MAAM,EAAE,CAAC,GAAG,CAAC,yEAAyE,EAAE,CAAC,IAAI,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC;gBACjI,IAAI,KAAK,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC,IAAI,OAAO,GAAG,CAAC;oBAAE,OAAO,GAAG,MAAM,WAAW,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;YACrG,CAAC;YACD,MAAM,KAAK,GAAkB,EAAE,GAAG,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;YACzD,MAAM,KAAK,CAAC,IAAI,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC;YACnC,OAAO,KAAK,CAAC;QACd,CAAC,CAAC;QAEH,MAAM,EAAE,KAAK,EAAE,IAAY,EAAE,QAAgB,EAAE,EAAU,EAAE,EAAE;YAC5D,MAAM,EAAE,CAAC,GAAG,CAAC,kEAAkE,EAAE,CAAC,IAAI,EAAE,QAAQ,EAAE,EAAE,CAAC,CAAC,CAAC;QACxG,CAAC;QAED,KAAK,EAAE,KAAK,EAAE,IAAY,EAAE,QAAgB,EAAE,EAAE;YAC/C,MAAM,EAAE,CAAC,GAAG,CAAC,uDAAuD,EAAE,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAC;QACzF,CAAC;KACD,CAAC;AACH,CAAC"}

package/lib/server/forge/auth/apiTokens.d.ts

@@ -0,0 +1,34 @@
+import type { Db } from "../db/database.ts";
+export declare const API_TOKEN_PREFIX = "forge_pat_";
+export interface ApiTokenRecord {
+    id: string;
+    name: string;
+    prefix: string;
+    createdAt: number;
+    lastUsedAt: number | null;
+}
+/** Personal access tokens for the CLI and automation. Shown once, stored hashed. */
+export declare function createApiTokens({ db, clock }: {
+    db: Db;
+    clock?: () => number;
+}): {
+    create({ userId, name }: {
+        userId: string;
+        name: string;
+    }): Promise<{
+        token: string;
+        record: ApiTokenRecord;
+    }>;
+    list(userId: string): Promise<ApiTokenRecord[]>;
+    resolve(token: string): Promise<{
+        userId: string;
+        tokenId: string;
+    }>;
+    revoke({ id, userId }: {
+        id: string;
+        userId: string;
+    }): Promise<boolean>;
+    revokeAllForUser(userId: string): Promise<void>;
+};
+export type ApiTokens = ReturnType<typeof createApiTokens>;
+//# sourceMappingURL=apiTokens.d.ts.map

package/lib/server/forge/auth/apiTokens.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"apiTokens.d.ts","sourceRoot":"","sources":["../../../../server/forge/auth/apiTokens.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,EAAE,EAAE,MAAM,mBAAmB,CAAC;AAI5C,eAAO,MAAM,gBAAgB,eAAe,CAAC;AAE7C,MAAM,WAAW,cAAc;IAC9B,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;CAC1B;AAoBD,oFAAoF;AACpF,wBAAgB,eAAe,CAAC,EAAE,EAAE,EAAE,KAAgB,EAAE,EAAE;IAAE,EAAE,EAAE,EAAE,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,MAAM,CAAA;CAAE;6BAEzD;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE;;;;iBAW5C,MAAM;mBAMJ,MAAM;;;;2BAOE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE;6BAS5B,MAAM;EAItC;AAED,MAAM,MAAM,SAAS,GAAG,UAAU,CAAC,OAAO,eAAe,CAAC,CAAC"}

package/lib/server/forge/auth/apiTokens.js

@@ -0,0 +1,44 @@
+import { randomUUID } from "node:crypto";
+import { newSecret, sha256 } from "./tokenHash.js";
+export const API_TOKEN_PREFIX = "forge_pat_";
+const toRecord = (r) => ({
+    id: r.id,
+    name: r.name,
+    prefix: r.prefix,
+    createdAt: r.created_at,
+    lastUsedAt: r.last_used_at,
+});
+/** Personal access tokens for the CLI and automation. Shown once, stored hashed. */
+export function createApiTokens({ db, clock = Date.now }) {
+    return {
+        async create({ userId, name }) {
+            const token = `${API_TOKEN_PREFIX}${newSecret()}`;
+            const id = randomUUID();
+            await db.run("INSERT INTO api_tokens (id, user_id, name, token_hash, prefix, created_at) VALUES (?, ?, ?, ?, ?, ?)", [id, userId, name.trim().slice(0, 80) || "API token", sha256(token), token.slice(0, API_TOKEN_PREFIX.length + 8), clock()]);
+            const row = (await db.get("SELECT * FROM api_tokens WHERE id = ?", [id]));
+            return { token, record: toRecord(row) };
+        },
+        async list(userId) {
+            return (await db.all("SELECT * FROM api_tokens WHERE user_id = ? AND revoked_at IS NULL ORDER BY created_at DESC", [userId])).map(toRecord);
+        },
+        async resolve(token) {
+            const row = await db.get("SELECT * FROM api_tokens WHERE token_hash = ? AND revoked_at IS NULL", [sha256(token)]);
+            if (!row)
+                return null;
+            await db.run("UPDATE api_tokens SET last_used_at = ? WHERE id = ?", [clock(), row.id]);
+            return { userId: row.user_id, tokenId: row.id };
+        },
+        async revoke({ id, userId }) {
+            const r = await db.run("UPDATE api_tokens SET revoked_at = ? WHERE id = ? AND user_id = ? AND revoked_at IS NULL", [
+                clock(),
+                id,
+                userId,
+            ]);
+            return r.changes > 0;
+        },
+        async revokeAllForUser(userId) {
+            await db.run("UPDATE api_tokens SET revoked_at = ? WHERE user_id = ? AND revoked_at IS NULL", [clock(), userId]);
+        },
+    };
+}
+//# sourceMappingURL=apiTokens.js.map

package/lib/server/forge/auth/apiTokens.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"apiTokens.js","sourceRoot":"","sources":["../../../../server/forge/auth/apiTokens.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAIzC,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,gBAAgB,CAAC;AAEnD,MAAM,CAAC,MAAM,gBAAgB,GAAG,YAAY,CAAC;AAoB7C,MAAM,QAAQ,GAAG,CAAC,CAAM,EAAkB,EAAE,CAAC,CAAC;IAC7C,EAAE,EAAE,CAAC,CAAC,EAAE;IACR,IAAI,EAAE,CAAC,CAAC,IAAI;IACZ,MAAM,EAAE,CAAC,CAAC,MAAM;IAChB,SAAS,EAAE,CAAC,CAAC,UAAU;IACvB,UAAU,EAAE,CAAC,CAAC,YAAY;CAC1B,CAAC,CAAC;AAEH,oFAAoF;AACpF,MAAM,UAAU,eAAe,CAAC,EAAE,EAAE,EAAE,KAAK,GAAG,IAAI,CAAC,GAAG,EAAoC;IACzF,OAAO;QACN,KAAK,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,IAAI,EAAoC;YAC9D,MAAM,KAAK,GAAG,GAAG,gBAAgB,GAAG,SAAS,EAAE,EAAE,CAAC;YAClD,MAAM,EAAE,GAAG,UAAU,EAAE,CAAC;YACxB,MAAM,EAAE,CAAC,GAAG,CACX,sGAAsG,EACtG,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,WAAW,EAAE,MAAM,CAAC,KAAK,CAAC,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,gBAAgB,CAAC,MAAM,GAAG,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAC1H,CAAC;YACF,MAAM,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC,GAAG,CAAM,uCAAuC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAE,CAAC;YAChF,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QACzC,CAAC;QAED,KAAK,CAAC,IAAI,CAAC,MAAc;YACxB,OAAO,CACN,MAAM,EAAE,CAAC,GAAG,CAAM,4FAA4F,EAAE,CAAC,MAAM,CAAC,CAAC,CACzH,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACjB,CAAC;QAED,KAAK,CAAC,OAAO,CAAC,KAAa;YAC1B,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,GAAG,CAAM,sEAAsE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;YACvH,IAAI,CAAC,GAAG;gBAAE,OAAO,IAAI,CAAC;YACtB,MAAM,EAAE,CAAC,GAAG,CAAC,qDAAqD,EAAE,CAAC,KAAK,EAAE,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;YACvF,OAAO,EAAE,MAAM,EAAE,GAAG,CAAC,OAAO,EAAE,OAAO,EAAE,GAAG,CAAC,EAAE,EAAE,CAAC;QACjD,CAAC;QAED,KAAK,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,MAAM,EAAkC;YAC1D,MAAM,CAAC,GAAG,MAAM,EAAE,CAAC,GAAG,CAAC,0FAA0F,EAAE;gBAClH,KAAK,EAAE;gBACP,EAAE;gBACF,MAAM;aACN,CAAC,CAAC;YACH,OAAO,CAAC,CAAC,OAAO,GAAG,CAAC,CAAC;QACtB,CAAC;QAED,KAAK,CAAC,gBAAgB,CAAC,MAAc;YACpC,MAAM,EAAE,CAAC,GAAG,CAAC,+EAA+E,EAAE,CAAC,KAAK,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC;QAClH,CAAC;KACD,CAAC;AACH,CAAC"}

package/lib/server/forge/auth/auditLog.d.ts

@@ -0,0 +1,36 @@
+import type { Db } from "../db/database.ts";
+export type AuditOutcome = "success" | "failure" | "denied";
+export interface AuditEventInput {
+    actorId: string | null;
+    actorLabel: string;
+    action: string;
+    outcome: AuditOutcome;
+    target?: string | null;
+    repo?: string | null;
+    ip?: string | null;
+    userAgent?: string | null;
+    details?: Record<string, unknown> | null;
+}
+export interface AuditEvent extends Required<Omit<AuditEventInput, "details">> {
+    id: number;
+    at: number;
+    details: Record<string, unknown> | null;
+}
+/** Append-only. There is deliberately no update or delete. */
+export declare function createAuditLog({ db, clock }: {
+    db: Db;
+    clock?: () => number;
+}): {
+    record(e: AuditEventInput): Promise<void>;
+    list({ action, actorId, limit, before }: {
+        action?: string;
+        actorId?: string;
+        limit?: number;
+        before?: number;
+    }): Promise<{
+        events: AuditEvent[];
+        nextCursor: number;
+    }>;
+};
+export type AuditLog = ReturnType<typeof createAuditLog>;
+//# sourceMappingURL=auditLog.d.ts.map

package/lib/server/forge/auth/auditLog.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auditLog.d.ts","sourceRoot":"","sources":["../../../../server/forge/auth/auditLog.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,EAAE,EAAE,MAAM,mBAAmB,CAAC;AAE5C,MAAM,MAAM,YAAY,GAAG,SAAS,GAAG,SAAS,GAAG,QAAQ,CAAC;AAE5D,MAAM,WAAW,eAAe;IAC/B,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,YAAY,CAAC;IACtB,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,EAAE,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;CACzC;AAED,MAAM,WAAW,UAAW,SAAQ,QAAQ,CAAC,IAAI,CAAC,eAAe,EAAE,SAAS,CAAC,CAAC;IAC7E,EAAE,EAAE,MAAM,CAAC;IACX,EAAE,EAAE,MAAM,CAAC;IACX,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;CACxC;AAkBD,8DAA8D;AAC9D,wBAAgB,cAAc,CAAC,EAAE,EAAE,EAAE,KAAgB,EAAE,EAAE;IAAE,EAAE,EAAE,EAAE,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,MAAM,CAAA;CAAE;cAEvE,eAAe;6CAkBqB;QAAE,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE;;;;EAyC3H;AAED,MAAM,MAAM,QAAQ,GAAG,UAAU,CAAC,OAAO,cAAc,CAAC,CAAC"}

package/lib/server/forge/auth/auditLog.js

@@ -0,0 +1,56 @@
+const MAX_PAGE = 200;
+/** Append-only. There is deliberately no update or delete. */
+export function createAuditLog({ db, clock = Date.now }) {
+    return {
+        async record(e) {
+            await db.run("INSERT INTO audit_events (at, actor_id, actor_label, action, target, repo, outcome, ip, user_agent, details) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)", [
+                clock(),
+                e.actorId,
+                e.actorLabel,
+                e.action,
+                e.target ?? null,
+                e.repo ?? null,
+                e.outcome,
+                e.ip ?? null,
+                e.userAgent?.slice(0, 300) ?? null,
+                e.details ? JSON.stringify(e.details) : null,
+            ]);
+        },
+        async list({ action, actorId, limit = 50, before }) {
+            const where = [];
+            const params = [];
+            if (action) {
+                where.push("action = ?");
+                params.push(action);
+            }
+            if (actorId) {
+                where.push("actor_id = ?");
+                params.push(actorId);
+            }
+            if (before) {
+                where.push("id < ?");
+                params.push(before);
+            }
+            const size = Math.min(Math.max(1, limit), MAX_PAGE);
+            const rows = await db.all(`SELECT * FROM audit_events ${where.length ? `WHERE ${where.join(" AND ")}` : ""} ORDER BY id DESC LIMIT ?`, [...params, size + 1]);
+            const page = rows.slice(0, size);
+            return {
+                events: page.map((r) => ({
+                    id: r.id,
+                    at: r.at,
+                    actorId: r.actor_id,
+                    actorLabel: r.actor_label,
+                    action: r.action,
+                    target: r.target,
+                    repo: r.repo,
+                    outcome: r.outcome,
+                    ip: r.ip,
+                    userAgent: r.user_agent,
+                    details: r.details ? JSON.parse(r.details) : null,
+                })),
+                nextCursor: rows.length > size ? page[page.length - 1].id : null,
+            };
+        },
+    };
+}
+//# sourceMappingURL=auditLog.js.map

package/lib/server/forge/auth/auditLog.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auditLog.js","sourceRoot":"","sources":["../../../../server/forge/auth/auditLog.ts"],"names":[],"mappings":"AAoCA,MAAM,QAAQ,GAAG,GAAG,CAAC;AAErB,8DAA8D;AAC9D,MAAM,UAAU,cAAc,CAAC,EAAE,EAAE,EAAE,KAAK,GAAG,IAAI,CAAC,GAAG,EAAoC;IACxF,OAAO;QACN,KAAK,CAAC,MAAM,CAAC,CAAkB;YAC9B,MAAM,EAAE,CAAC,GAAG,CACX,oJAAoJ,EACpJ;gBACC,KAAK,EAAE;gBACP,CAAC,CAAC,OAAO;gBACT,CAAC,CAAC,UAAU;gBACZ,CAAC,CAAC,MAAM;gBACR,CAAC,CAAC,MAAM,IAAI,IAAI;gBAChB,CAAC,CAAC,IAAI,IAAI,IAAI;gBACd,CAAC,CAAC,OAAO;gBACT,CAAC,CAAC,EAAE,IAAI,IAAI;gBACZ,CAAC,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,IAAI,IAAI;gBAClC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI;aAC5C,CACD,CAAC;QACH,CAAC;QAED,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,GAAG,EAAE,EAAE,MAAM,EAA0E;YACzH,MAAM,KAAK,GAAa,EAAE,CAAC;YAC3B,MAAM,MAAM,GAAwB,EAAE,CAAC;YACvC,IAAI,MAAM,EAAE,CAAC;gBACZ,KAAK,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;gBACzB,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YACrB,CAAC;YACD,IAAI,OAAO,EAAE,CAAC;gBACb,KAAK,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;gBAC3B,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YACtB,CAAC;YACD,IAAI,MAAM,EAAE,CAAC;gBACZ,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;gBACrB,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YACrB,CAAC;YACD,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,CAAC,EAAE,QAAQ,CAAC,CAAC;YACpD,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,GAAG,CACxB,8BAA8B,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,2BAA2B,EAC3G,CAAC,GAAG,MAAM,EAAE,IAAI,GAAG,CAAC,CAAC,CACrB,CAAC;YACF,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;YACjC,OAAO;gBACN,MAAM,EAAE,IAAI,CAAC,GAAG,CACf,CAAC,CAAC,EAAc,EAAE,CAAC,CAAC;oBACnB,EAAE,EAAE,CAAC,CAAC,EAAE;oBACR,EAAE,EAAE,CAAC,CAAC,EAAE;oBACR,OAAO,EAAE,CAAC,CAAC,QAAQ;oBACnB,UAAU,EAAE,CAAC,CAAC,WAAW;oBACzB,MAAM,EAAE,CAAC,CAAC,MAAM;oBAChB,MAAM,EAAE,CAAC,CAAC,MAAM;oBAChB,IAAI,EAAE,CAAC,CAAC,IAAI;oBACZ,OAAO,EAAE,CAAC,CAAC,OAAO;oBAClB,EAAE,EAAE,CAAC,CAAC,EAAE;oBACR,SAAS,EAAE,CAAC,CAAC,UAAU;oBACvB,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI;iBACjD,CAAC,CACF;gBACD,UAAU,EAAE,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI;aAChE,CAAC;QACH,CAAC;KACD,CAAC;AACH,CAAC"}

package/lib/server/forge/auth/authConfig.d.ts

@@ -0,0 +1,13 @@
+import type { OidcOptions } from "./oidc.ts";
+type Env = Record<string, string | undefined>;
+export interface AuthConfig {
+    serviceToken?: string;
+    cookieSecure: boolean;
+    oidc?: OidcOptions;
+}
+/** Reads auth settings from the environment; throws on half-configured SSO. */
+export declare function authConfigFromEnv(env: Env, { isProd }: {
+    isProd: boolean;
+}): AuthConfig;
+export {};
+//# sourceMappingURL=authConfig.d.ts.map

package/lib/server/forge/auth/authConfig.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"authConfig.d.ts","sourceRoot":"","sources":["../../../../server/forge/auth/authConfig.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,WAAW,CAAC;AAG7C,KAAK,GAAG,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC;AAE9C,MAAM,WAAW,UAAU;IAC1B,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,YAAY,EAAE,OAAO,CAAC;IACtB,IAAI,CAAC,EAAE,WAAW,CAAC;CACnB;AAED,+EAA+E;AAC/E,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,MAAM,EAAE,EAAE;IAAE,MAAM,EAAE,OAAO,CAAA;CAAE,GAAG,UAAU,CAiCvF"}

package/lib/server/forge/auth/authConfig.js

@@ -0,0 +1,37 @@
+import { isRole } from "./roles.js";
+/** Reads auth settings from the environment; throws on half-configured SSO. */
+export function authConfigFromEnv(env, { isProd }) {
+    const serviceToken = env.FORGE_DISABLE_SERVICE_TOKEN === "1" ? undefined : env.FORGE_TOKEN || undefined;
+    const cookieSecure = env.FORGE_COOKIE_SECURE ? env.FORGE_COOKIE_SECURE === "1" : isProd;
+    if (!env.FORGE_OIDC_ISSUER)
+        return { serviceToken, cookieSecure };
+    for (const key of ["FORGE_OIDC_CLIENT_ID", "FORGE_OIDC_CLIENT_SECRET"]) {
+        if (!env[key])
+            throw new Error(`${key} is required when FORGE_OIDC_ISSUER is set.`);
+    }
+    const redirectUri = env.FORGE_OIDC_REDIRECT_URI ??
+        (env.FORGE_PUBLIC_URL ? `${env.FORGE_PUBLIC_URL.replace(/\/$/, "")}/api/forge/auth/oidc/callback` : undefined);
+    if (!redirectUri)
+        throw new Error("Set FORGE_PUBLIC_URL (or FORGE_OIDC_REDIRECT_URI) to enable single sign-on.");
+    const defaultRole = env.FORGE_OIDC_DEFAULT_ROLE ?? "viewer";
+    if (!isRole(defaultRole))
+        throw new Error(`FORGE_OIDC_DEFAULT_ROLE must be viewer, operator, approver or admin.`);
+    return {
+        serviceToken,
+        cookieSecure,
+        oidc: {
+            issuer: env.FORGE_OIDC_ISSUER,
+            clientId: env.FORGE_OIDC_CLIENT_ID,
+            clientSecret: env.FORGE_OIDC_CLIENT_SECRET,
+            redirectUri,
+            allowedDomains: (env.FORGE_OIDC_ALLOWED_DOMAINS ?? "")
+                .split(",")
+                .map((d) => d.trim().toLowerCase())
+                .filter(Boolean),
+            defaultRole,
+            name: env.FORGE_OIDC_NAME || "SSO",
+            scopes: env.FORGE_OIDC_SCOPES,
+        },
+    };
+}
+//# sourceMappingURL=authConfig.js.map

package/lib/server/forge/auth/authConfig.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"authConfig.js","sourceRoot":"","sources":["../../../../server/forge/auth/authConfig.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,MAAM,EAAE,MAAM,YAAY,CAAC;AAUpC,+EAA+E;AAC/E,MAAM,UAAU,iBAAiB,CAAC,GAAQ,EAAE,EAAE,MAAM,EAAuB;IAC1E,MAAM,YAAY,GAAG,GAAG,CAAC,2BAA2B,KAAK,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,WAAW,IAAI,SAAS,CAAC;IACxG,MAAM,YAAY,GAAG,GAAG,CAAC,mBAAmB,CAAC,CAAC,CAAC,GAAG,CAAC,mBAAmB,KAAK,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC;IAExF,IAAI,CAAC,GAAG,CAAC,iBAAiB;QAAE,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,CAAC;IAElE,KAAK,MAAM,GAAG,IAAI,CAAC,sBAAsB,EAAE,0BAA0B,CAAC,EAAE,CAAC;QACxE,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,GAAG,GAAG,6CAA6C,CAAC,CAAC;IACrF,CAAC;IACD,MAAM,WAAW,GAChB,GAAG,CAAC,uBAAuB;QAC3B,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,gBAAgB,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,+BAA+B,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IAChH,IAAI,CAAC,WAAW;QAAE,MAAM,IAAI,KAAK,CAAC,6EAA6E,CAAC,CAAC;IACjH,MAAM,WAAW,GAAG,GAAG,CAAC,uBAAuB,IAAI,QAAQ,CAAC;IAC5D,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,sEAAsE,CAAC,CAAC;IAElH,OAAO;QACN,YAAY;QACZ,YAAY;QACZ,IAAI,EAAE;YACL,MAAM,EAAE,GAAG,CAAC,iBAAiB;YAC7B,QAAQ,EAAE,GAAG,CAAC,oBAAqB;YACnC,YAAY,EAAE,GAAG,CAAC,wBAAyB;YAC3C,WAAW;YACX,cAAc,EAAE,CAAC,GAAG,CAAC,0BAA0B,IAAI,EAAE,CAAC;iBACpD,KAAK,CAAC,GAAG,CAAC;iBACV,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;iBAClC,MAAM,CAAC,OAAO,CAAC;YACjB,WAAW;YACX,IAAI,EAAE,GAAG,CAAC,eAAe,IAAI,KAAK;YAClC,MAAM,EAAE,GAAG,CAAC,iBAAiB;SAC7B;KACD,CAAC;AACH,CAAC"}

package/lib/server/forge/auth/createAuth.d.ts

@@ -0,0 +1,130 @@
+import { type NextFunction, type Request, type Response } from "express";
+import type { Db } from "../db/database.ts";
+import { type OidcOptions } from "./oidc.ts";
+import { requireRole } from "./middleware.ts";
+import { type Role } from "./roles.ts";
+import { type User } from "./users.ts";
+export interface Principal {
+    id: string;
+    email: string;
+    name: string;
+    role: Role;
+    kind: "user" | "token" | "service";
+}
+declare global {
+    namespace Express {
+        interface Request {
+            principal?: Principal;
+            authVia?: "cookie" | "bearer";
+        }
+    }
+}
+export interface AuthOptions {
+    db: Db;
+    /** FORGE_TOKEN: admin service credential for the CLI and the first-run setup secret. */
+    serviceToken?: string;
+    /** Called once at startup with the code remote visitors need to create the first admin. */
+    onSetupCode?: (code: string) => void;
+    cookieSecure: boolean;
+    oidc?: OidcOptions;
+    clock?: () => number;
+    sessionIdleMs?: number;
+    sessionAbsoluteMs?: number;
+}
+export declare const CSRF_HEADER = "x-forge-request";
+/**
+ * True only for a browser on the server machine talking to Forge directly:
+ * loopback socket, no proxy headers (a reverse proxy on the same host would
+ * otherwise make every visitor look local), and a localhost Host header (so a
+ * DNS-rebinding page can't pose as local).
+ */
+export declare function isLocalRequest(req: Request): boolean;
+/** Only same-origin relative paths; anything else (incl. `//host`) → "/". */
+export declare function safeReturnTo(value: unknown): string;
+export declare function createAuth(opts: AuthOptions): {
+    users: {
+        count(): Promise<number>;
+        countActiveAdmins(): Promise<number>;
+        findById(id: string): Promise<User>;
+        findByEmail(email: string): Promise<User>;
+        list(): Promise<User[]>;
+        create({ email, name, role, password }: {
+            email: string;
+            name: string;
+            role: Role;
+            password?: string;
+        }): Promise<User>;
+        update(id: string, patch: {
+            role?: Role;
+            disabled?: boolean;
+            name?: string;
+            password?: string;
+        }): Promise<User>;
+        authenticate(email: string, password: string): Promise<import("./users.ts").AuthResult>;
+        upsertOidc({ subject, email, name, defaultRole }: {
+            subject: string;
+            email: string;
+            name: string;
+            defaultRole: Role;
+        }): Promise<User>;
+    };
+    sessions: {
+        absoluteMs: number;
+        create({ userId, ip, userAgent }: {
+            userId: string;
+            ip: string;
+            userAgent: string;
+        }): Promise<{
+            token: string;
+        }>;
+        resolve(token: string): Promise<{
+            userId: string;
+            createdAt: number;
+        }>;
+        revoke(token: string): Promise<void>;
+        revokeAllForUser(userId: string): Promise<void>;
+    };
+    tokens: {
+        create({ userId, name }: {
+            userId: string;
+            name: string;
+        }): Promise<{
+            token: string;
+            record: import("./apiTokens.ts").ApiTokenRecord;
+        }>;
+        list(userId: string): Promise<import("./apiTokens.ts").ApiTokenRecord[]>;
+        resolve(token: string): Promise<{
+            userId: string;
+            tokenId: string;
+        }>;
+        revoke({ id, userId }: {
+            id: string;
+            userId: string;
+        }): Promise<boolean>;
+        revokeAllForUser(userId: string): Promise<void>;
+    };
+    audit: {
+        record(e: import("./auditLog.ts").AuditEventInput): Promise<void>;
+        list({ action, actorId, limit, before }: {
+            action?: string;
+            actorId?: string;
+            limit?: number;
+            before?: number;
+        }): Promise<{
+            events: import("./auditLog.ts").AuditEvent[];
+            nextCursor: number;
+        }>;
+    };
+    router: import("express-serve-static-core").Router;
+    adminRouter: import("express-serve-static-core").Router;
+    authenticate: (req: Request, res: Response, next: NextFunction) => Promise<void>;
+    requireUser: (req: Request, res: Response, next: NextFunction) => void;
+    requireRole: typeof requireRole;
+    csrf: (req: Request, res: Response, next: NextFunction) => void;
+    auditTrail: (req: Request, res: Response, next: NextFunction) => void;
+    /** Logs the setup code while no admin exists (only when it was generated). */
+    announceSetup: () => Promise<void>;
+    setOidcRedirectUri: (uri: string) => void;
+};
+export type Auth = ReturnType<typeof createAuth>;
+//# sourceMappingURL=createAuth.d.ts.map

package/lib/server/forge/auth/createAuth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"createAuth.d.ts","sourceRoot":"","sources":["../../../../server/forge/auth/createAuth.ts"],"names":[],"mappings":"AAEA,OAAgB,EAAE,KAAK,YAAY,EAAE,KAAK,OAAO,EAAE,KAAK,QAAQ,EAAE,MAAM,SAAS,CAAC;AAElF,OAAO,KAAK,EAAE,EAAE,EAAE,MAAM,mBAAmB,CAAC;AAI5C,OAAO,EAAoB,KAAK,WAAW,EAAe,MAAM,WAAW,CAAC;AAC5E,OAAO,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAC9C,OAAO,EAAU,KAAK,IAAI,EAAE,MAAM,YAAY,CAAC;AAE/C,OAAO,EAAe,KAAK,IAAI,EAAE,MAAM,YAAY,CAAC;AAEpD,MAAM,WAAW,SAAS;IACzB,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,IAAI,CAAC;IACX,IAAI,EAAE,MAAM,GAAG,OAAO,GAAG,SAAS,CAAC;CACnC;AAED,OAAO,CAAC,MAAM,CAAC;IAEd,UAAU,OAAO,CAAC;QACjB,UAAU,OAAO;YAChB,SAAS,CAAC,EAAE,SAAS,CAAC;YACtB,OAAO,CAAC,EAAE,QAAQ,GAAG,QAAQ,CAAC;SAC9B;KACD;CACD;AAED,MAAM,WAAW,WAAW;IAC3B,EAAE,EAAE,EAAE,CAAC;IACP,wFAAwF;IACxF,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,2FAA2F;IAC3F,WAAW,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IACrC,YAAY,EAAE,OAAO,CAAC;IACtB,IAAI,CAAC,EAAE,WAAW,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,MAAM,CAAC;IACrB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,iBAAiB,CAAC,EAAE,MAAM,CAAC;CAC3B;AAGD,eAAO,MAAM,WAAW,oBAAoB,CAAC;AAa7C;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAAE,OAAO,GAAG,OAAO,CAKpD;AAiBD,6EAA6E;AAC7E,wBAAgB,YAAY,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAInD;AAaD,wBAAgB,UAAU,CAAC,IAAI,EAAE,WAAW;;;;;;;;;;;oBArCpC,CAAC;;;gBAoBW,CAAC;oBAAgB,CAAC;gBAAe,CAAC;oBACrC,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBAxCS,CAAC;mBAC1B,CAAC;iBAAe,CAAC;kBACV,CAAA;;;;;;;;wBAqHyB,OAAO,OAAO,QAAQ,QAAQ,YAAY;uBAcjD,OAAO,OAAO,QAAQ,QAAQ,YAAY;;gBASjD,OAAO,OAAO,QAAQ,QAAQ,YAAY;sBASpC,OAAO,OAAO,QAAQ,QAAQ,YAAY;IAwOlE,8EAA8E;;8BAMpD,MAAM;EAIjC;AAED,MAAM,MAAM,IAAI,GAAG,UAAU,CAAC,OAAO,UAAU,CAAC,CAAC"}