@repo-os/repoos 0.5.45

package/dist/commands/ui-harness.d.ts

@@ -0,0 +1,53 @@
+export interface PreviewServer {
+    close: () => void;
+    url: string;
+}
+/** Structural subset of the Playwright WebKit API both callers use. */
+export interface SmokeConsoleMessage {
+    type(): string;
+    text(): string;
+}
+export interface SmokePage {
+    on(event: "console", handler: (msg: SmokeConsoleMessage) => void): void;
+    on(event: "pageerror", handler: (err: Error) => void): void;
+    goto(url: string, options: {
+        waitUntil: string;
+        timeout: number;
+    }): Promise<unknown>;
+    title(): Promise<string>;
+    evaluate<R>(fn: () => R): Promise<R>;
+    $(selector: string): Promise<unknown>;
+    waitForTimeout(ms: number): Promise<void>;
+}
+export interface SmokeBrowser {
+    newPage(): Promise<SmokePage>;
+    newPage(options: {
+        viewport: {
+            width: number;
+            height: number;
+        };
+    }): Promise<SmokePage>;
+    close(): Promise<void>;
+}
+export interface SmokePlaywright {
+    webkit: {
+        launch(options: {
+            headless: boolean;
+        }): Promise<SmokeBrowser>;
+    };
+}
+/**
+ * Start the built UI's server on an ephemeral port so the gate works even when
+ * a `repoos serve` instance is already running on the default port. `root` is
+ * optional — both callers pass a throwaway fixture root for determinism: the
+ * smoke test (check.ts) boots against a bare empty work/ + minimal repoos.toml
+ * so it never touches the live board's jobs or preview auto-launch (#0260),
+ * and the screenshot script serves a fixture copy.
+ */
+export declare function startPreviewServer(root?: string): Promise<PreviewServer>;
+/**
+ * Resolve `@playwright/test` and launch headless WebKit. Throws a descriptive
+ * error when the package isn't installed so callers can report it as a
+ * graceful skip rather than a gate failure.
+ */
+export declare function launchWebkit(): Promise<SmokeBrowser>;

package/dist/commands/ui-harness.js

@@ -0,0 +1,62 @@
+/**
+ * Shared headless-UI setup for the two places that start the built app's
+ * ephemeral HTTP server and a WebKit browser against it:
+ *   - `runUISmokeTest` in src/commands/check.ts (`repoos check`'s UI gate)
+ *   - `scripts/capture-screenshots.mjs` (`bun run screenshots`)
+ *
+ * Both previously hand-rolled the same "start server on an ephemeral port via
+ * createRequire + launch headless WebKit" boilerplate, each with its own copy
+ * of the `@playwright/test` / server wiring — so close-out ended up with two
+ * independent browser+server launch cycles to verify the same built UI.
+ *
+ * They run in separate OS processes that are never alive at the same time —
+ * `repoos check` is a subprocess of the close-out gate, while screenshots are
+ * an on-demand `bun run screenshots` run that, per #0140, is never part of a
+ * close-out — so each still performs its own launch at runtime. A literal
+ * single shared server + single browser *instance* across that boundary is
+ * therefore impossible without folding screenshots into `repoos check` (which
+ * would contradict #0140), so the shared logic itself is the intended AC3
+ * scope-down (task #0213): one launch implementation, zero drift between the
+ * two call sites.
+ */
+import { createRequire } from "node:module";
+/**
+ * Start the built UI's server on an ephemeral port so the gate works even when
+ * a `repoos serve` instance is already running on the default port. `root` is
+ * optional — both callers pass a throwaway fixture root for determinism: the
+ * smoke test (check.ts) boots against a bare empty work/ + minimal repoos.toml
+ * so it never touches the live board's jobs or preview auto-launch (#0260),
+ * and the screenshot script serves a fixture copy.
+ */
+export async function startPreviewServer(root) {
+    const { startServer } = await import("../server/server.js");
+    // disableAuth: the smoke gate tests generic rendering (title, board,
+    // buttons), not auth flows — a project with [auth] enabled must not make
+    // `repoos check` itself unable to reach the dashboard.
+    const opts = { host: "127.0.0.1", port: 0, disableAuth: true };
+    if (root !== undefined)
+        opts.root = root;
+    return startServer(opts);
+}
+/**
+ * Resolve `@playwright/test` and launch headless WebKit. Throws a descriptive
+ * error when the package isn't installed so callers can report it as a
+ * graceful skip rather than a gate failure.
+ */
+export async function launchWebkit() {
+    // @playwright/test is a CJS package. Bun's ESM `import()` of it resolves the
+    // named browser exports to `undefined` (root cause of #0200), so load it via
+    // createRequire, which handles the CJS interop under both Bun and Node.
+    // Types are structural (Smoke*) rather than `typeof import("@playwright/test")`
+    // so `tsc` compiles even when the package is absent — the build must not fail
+    // before the "not installed" skip can run.
+    const require = createRequire(import.meta.url);
+    let playwright;
+    try {
+        playwright = require("@playwright/test");
+    }
+    catch {
+        throw new Error("Cannot find module @playwright/test (not installed)");
+    }
+    return playwright.webkit.launch({ headless: true });
+}

package/dist/commands/ui-smoke.d.ts

@@ -0,0 +1,6 @@
+/**
+ * Run the smoke test with the same outcomes `repoos check` used to apply
+ * in-process: pass → 0, Playwright/WebKit unavailable → skip (0), anything
+ * else → 1. Returns the exit code so the caller decides how to exit.
+ */
+export declare function cmdUISmoke(): Promise<number>;

package/dist/commands/ui-smoke.js

@@ -0,0 +1,220 @@
+/**
+ * RepoOS's own headless UI smoke test (#0348).
+ *
+ * `repoos check`'s ui-smoke step is per-project and opt-in: it runs whatever a
+ * project declares (a `smoke` package.json script, or `[check] uiSmoke` in
+ * repoos.toml). RepoOS dogfoods that mechanism instead of keeping a
+ * RepoOS-only branch in check.ts: its own `smoke` script (scripts/ui-smoke.mjs)
+ * calls `cmdUISmoke()` below against the freshly built dist/.
+ *
+ * Server startup + webkit launch share the harness in ui-harness.ts with the
+ * screenshot script (#0213).
+ */
+import { mkdirSync, mkdtempSync, rmSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { c } from "../cli/colors.js";
+import { startPreviewServer, launchWebkit } from "./ui-harness.js";
+/**
+ * Build a throwaway, empty fixture repo to serve the built SPA against.
+ * The smoke test only cares that the built UI renders with zero console errors,
+ * so booting it against the live checkout's real board drags in job recovery
+ * and preview auto-launch reconciliation for every active/review task (0260).
+ * A bare `work/` + minimal `repoos.toml` avoids all of that: no tasks, no
+ * recovery, no auto-launch — constant cost regardless of board size.
+ */
+function makeSmokeFixture() {
+    const root = mkdtempSync(join(tmpdir(), "repoos-smoke-"));
+    mkdirSync(join(root, "work"), { recursive: true });
+    writeFileSync(join(root, "repoos.toml"), 'theme = "dark"\nuiTheme = "classic"\n\n');
+    return root;
+}
+/**
+ * Start the dev server, run Playwright WebKit smoke tests, then stop.
+ * Exports failures as thrown errors. Server startup + webkit launch share the
+ * harness in ui-harness.ts with the screenshot script (#0213).
+ */
+async function runUISmokeTest() {
+    const fixture = makeSmokeFixture();
+    let server;
+    try {
+        server = await startPreviewServer(fixture);
+    }
+    catch (err) {
+        rmSync(fixture, { recursive: true, force: true });
+        throw err;
+    }
+    let browser;
+    try {
+        browser = await launchWebkit();
+    }
+    catch (err) {
+        server.close();
+        rmSync(fixture, { recursive: true, force: true });
+        throw err;
+    }
+    try {
+        const page = await browser.newPage();
+        const consoleErrs = [];
+        const pageErrors = [];
+        page.on("console", (msg) => {
+            if (msg.type() === "error")
+                consoleErrs.push(msg.text());
+        });
+        page.on("pageerror", (err) => {
+            pageErrors.push(err.message);
+        });
+        await page.goto(server.url, { waitUntil: "load", timeout: 20_000 });
+        // Check page title is correct
+        const title = await page.title();
+        if (title !== "RepoOS")
+            throw new Error(`Unexpected title: "${title}"`);
+        // Verify we are testing the built Vite SPA, which references hashed
+        // assets in /assets/.
+        const hashedAsset = await page.evaluate(() => {
+            const scripts = Array.from(document.querySelectorAll("script[src]"));
+            return scripts.some((s) => (s.getAttribute("src") ?? "").startsWith("/assets/"));
+        });
+        if (!hashedAsset) {
+            throw new Error("Served page is not the built Vite app (no /assets/ bundle)");
+        }
+        // Check that the app MOUNTED — no unrendered mustache in the DOM
+        const bodyText = await page.evaluate(() => document.body.innerText);
+        if (bodyText.includes("{{") || bodyText.includes("}}")) {
+            throw new Error("Unrendered mustache found in DOM — Vue did not mount");
+        }
+        // Check that a known root element rendered with real content
+        const appEl = await page.$("#app");
+        if (!appEl)
+            throw new Error("#app element not found");
+        const hasBrand = await page.evaluate(() => document.body.innerText.includes("RepoOS"));
+        if (!hasBrand)
+            throw new Error('Expected "RepoOS" in rendered content');
+        // Navigate to work page and click +New Task
+        await page.evaluate(() => {
+            const navItems = document.querySelectorAll(".nav-item");
+            for (const item of Array.from(navItems)) {
+                if (item.textContent?.includes("Work"))
+                    item.click();
+            }
+        });
+        await page.waitForTimeout(500);
+        // Verify work page rendered
+        const workEl = await page.$(".board");
+        if (!workEl) {
+            consoleErrs.push("Work page board not rendered — check page navigation");
+        }
+        // Check that the +New Task button exists
+        const newBtn = await page.$(".new-btn");
+        if (!newBtn) {
+            consoleErrs.push("+New Task button not found in DOM");
+        }
+        // ── CSS regression guard: utility spacing must actually apply ─────
+        // Tailwind v4 emits all its CSS inside cascade layers. If an
+        // UNLAYERED reset such as `*{padding:0;margin:0}` is ever added to
+        // style.css, it silently beats every spacing utility (unlayered rules
+        // take precedence over @layer rules), collapsing padding on shadcn
+        // controls while console stays clean. Flag any non-explicit-zero
+        // spacing utility whose computed value is 0.
+        const assertUtilitySpacing = async (where) => {
+            const offenders = await page.evaluate(() => {
+                const AXIS = {
+                    p: ["paddingTop", "paddingRight", "paddingBottom", "paddingLeft"],
+                    px: ["paddingLeft", "paddingRight"],
+                    py: ["paddingTop", "paddingBottom"],
+                    pt: ["paddingTop"],
+                    pr: ["paddingRight"],
+                    pb: ["paddingBottom"],
+                    pl: ["paddingLeft"],
+                    m: ["marginTop", "marginRight", "marginBottom", "marginLeft"],
+                    mx: ["marginLeft", "marginRight"],
+                    my: ["marginTop", "marginBottom"],
+                    mt: ["marginTop"],
+                    mr: ["marginRight"],
+                    mb: ["marginBottom"],
+                    ml: ["marginLeft"],
+                };
+                const bad = [];
+                for (const el of Array.from(document.querySelectorAll("*"))) {
+                    if (!(el instanceof HTMLElement))
+                        continue;
+                    const s = getComputedStyle(el);
+                    for (const cls of el.classList) {
+                        if (cls.startsWith("-"))
+                            continue; // negative margins are intentional
+                        const m = /^([pm])([trblxy]?)-(?:\[)?([1-9])/.exec(cls);
+                        if (!m)
+                            continue;
+                        for (const prop of AXIS[m[1] + m[2]] ?? []) {
+                            if (parseFloat(s[prop]) <= 0) {
+                                bad.push(`${cls} → ${prop} = ${s[prop]} on <${el.tagName.toLowerCase()}>`);
+                                break;
+                            }
+                        }
+                    }
+                }
+                return [...new Set(bad)];
+            });
+            if (offenders.length > 0) {
+                throw new Error("Utility spacing collapsed on " + where + ": " + offenders.slice(0, 6).join("; "));
+            }
+        };
+        await assertUtilitySpacing("dashboard");
+        // Re-run the guard on the settings page (covers shadcn Button + Select)
+        await page.evaluate(() => {
+            const navItems = document.querySelectorAll(".nav-item");
+            for (const item of Array.from(navItems)) {
+                if (item.textContent?.includes("Settings"))
+                    item.click();
+            }
+        });
+        await page.waitForTimeout(500);
+        await assertUtilitySpacing("settings");
+        // Check for zero console errors
+        if (consoleErrs.length > 0) {
+            let msg = "Console errors (" + consoleErrs.length + "): " + consoleErrs.join("; ");
+            if (pageErrors.length > 0)
+                msg += " | Page errors: " + pageErrors.join("; ");
+            throw new Error(msg);
+        }
+        if (pageErrors.length > 0) {
+            throw new Error("Page errors (" + pageErrors.length + "): " + pageErrors.join("; "));
+        }
+    }
+    finally {
+        if (browser)
+            await browser.close();
+        server.close();
+        rmSync(fixture, { recursive: true, force: true });
+    }
+}
+/** A missing @playwright/test install or WebKit binary — a skip, not a failure. */
+function isPlaywrightUnavailable(msg) {
+    return (msg.includes("Cannot find module") ||
+        msg.includes("not installed") ||
+        msg.includes("Executable doesn't exist"));
+}
+/**
+ * Run the smoke test with the same outcomes `repoos check` used to apply
+ * in-process: pass → 0, Playwright/WebKit unavailable → skip (0), anything
+ * else → 1. Returns the exit code so the caller decides how to exit.
+ */
+export async function cmdUISmoke() {
+    try {
+        await runUISmokeTest();
+        console.log(c.green("  ✔ UI smoke test passed"));
+        return 0;
+    }
+    catch (e) {
+        const msg = e.message;
+        if (isPlaywrightUnavailable(msg)) {
+            console.log(c.dim("  · Playwright not available — UI smoke test skipped"));
+            console.log(c.dim("    Install: bun add -d @playwright/test && bunx playwright install webkit"));
+            return 0;
+        }
+        console.log(c.red("  ✗ UI smoke test failed: " + msg.split("\n")[0]));
+        if (msg.includes("\n"))
+            console.log(c.dim(msg));
+        return 1;
+    }
+}

package/dist/commands/upgrade.d.ts

@@ -0,0 +1,15 @@
+/**
+ * The release notes to print after an upgrade, or null when there's nothing
+ * to show — GitHub returns `body` as `null`/absent for a release cut with an
+ * empty notes field (#0361's UI leaves the field optional), and this must
+ * stay silent then, not print an empty line or "no notes available" filler.
+ */
+export declare function releaseNotesToPrint(body: string | null | undefined): string | null;
+export declare function cmdUpgrade(args: string[]): Promise<void>;
+/**
+ * The `repoos` launcher script: Bun when it's installed, Node otherwise
+ * (`REPOOS_RUNTIME=node` pins Node). The runtime is picked each time `repoos`
+ * runs, so installing Bun later takes effect with no reinstall. Must match the
+ * heredoc in install.sh exactly; launcher.test.ts compares the two.
+ */
+export declare function launcherScript(entry: string): string;

package/dist/commands/upgrade.js

@@ -0,0 +1,188 @@
+/**
+ * `repoos upgrade` — self-update for standalone (curl-installed) builds.
+ * Downloads the latest GitHub release's dist tarball and swaps it into place.
+ *
+ * Package-manager installs (npm/bun, living under node_modules/) are not
+ * touched here — those update through the package manager itself.
+ */
+import { execFileSync } from "node:child_process";
+import { chmodSync, existsSync, mkdirSync, readFileSync, renameSync, rmSync, writeFileSync, } from "node:fs";
+import { homedir } from "node:os";
+import { dirname, join } from "node:path";
+import { fileURLToPath } from "node:url";
+import { c } from "../cli/colors.js";
+const REPO = "repo-os/repoos";
+/** The directory containing cli/, core/, server/, ui/, .build-info.json — dist/ in a source checkout, or the whole install root for a standalone install. */
+function installRoot() {
+    return dirname(dirname(fileURLToPath(import.meta.url)));
+}
+function readVersion(root) {
+    try {
+        const info = JSON.parse(readFileSync(join(root, ".build-info.json"), "utf8"));
+        return info.version ?? null;
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * The release notes to print after an upgrade, or null when there's nothing
+ * to show — GitHub returns `body` as `null`/absent for a release cut with an
+ * empty notes field (#0361's UI leaves the field optional), and this must
+ * stay silent then, not print an empty line or "no notes available" filler.
+ */
+export function releaseNotesToPrint(body) {
+    const trimmed = body?.trim();
+    return trimmed ? trimmed : null;
+}
+/** `--channel beta|canary|rc` from argv, or null for the default stable channel. */
+function parseChannel(args) {
+    const flag = args.indexOf("--channel");
+    const value = flag !== -1 ? args[flag + 1] : undefined;
+    return value && !value.startsWith("--") ? value : null;
+}
+/**
+ * `GET /releases/latest` always excludes prereleases (GitHub's own rule, not
+ * configurable) — release.yml marks any tag with a "-" (v0.6.0-beta.1,
+ * -canary.N, -rc.N) as a prerelease, exactly so stable users never get handed
+ * one from this endpoint. A channel opt-in has to use the list endpoint
+ * instead and find its own match.
+ */
+async function fetchLatestRelease(channel) {
+    if (!channel) {
+        const res = await fetch(`https://api.github.com/repos/${REPO}/releases/latest`);
+        if (!res.ok)
+            throw new Error(`GitHub API returned ${res.status}`);
+        return (await res.json());
+    }
+    // Newest first by default; the first tag matching "-<channel>." wins.
+    const res = await fetch(`https://api.github.com/repos/${REPO}/releases?per_page=30`);
+    if (!res.ok)
+        throw new Error(`GitHub API returned ${res.status}`);
+    const releases = (await res.json());
+    const match = releases.find((r) => r.tag_name.includes(`-${channel}.`));
+    if (!match)
+        throw new Error(`No "${channel}" release found in the last 30 releases.`);
+    return match;
+}
+export async function cmdUpgrade(args) {
+    const root = installRoot();
+    const channel = parseChannel(args);
+    if (root.includes("node_modules")) {
+        console.log(c.yellow("  repoos was installed via a package manager."));
+        console.log(c.dim("  Update it the same way:"));
+        console.log(c.dim("    bun update -g @repo-os/repoos") +
+            c.dim("   or   ") +
+            c.dim("npm update -g @repo-os/repoos"));
+        return;
+    }
+    const current = readVersion(root);
+    if (!current) {
+        console.log(c.yellow("  repoos appears to be running from a source checkout, not a standalone install."));
+        console.log(c.dim("  Update it with: git pull && bun run build"));
+        return;
+    }
+    console.log(c.dim(`  Current version: v${current}`));
+    console.log(c.dim(channel ? `  Checking latest "${channel}" release…` : "  Checking latest release…"));
+    let release;
+    try {
+        release = await fetchLatestRelease(channel);
+    }
+    catch (e) {
+        console.error(c.red("  Failed to check for updates: " + e.message));
+        process.exitCode = 1;
+        return;
+    }
+    const latest = release.tag_name.replace(/^v/, "");
+    if (latest === current) {
+        console.log(c.green(`  Already up to date (v${current}).`));
+        return;
+    }
+    const asset = release.assets.find((a) => a.name === "repoos-dist.tar.gz");
+    if (!asset) {
+        console.error(c.red(`  No repoos-dist.tar.gz asset found on release v${latest}.`));
+        process.exitCode = 1;
+        return;
+    }
+    console.log(c.dim(`  Upgrading v${current} → v${latest}…`));
+    // Do all the work in siblings of the install root, never in the system temp
+    // dir: `/tmp` is often a small tmpfs (or has a per-user quota — Omarchy sets
+    // one), and a multi-MB download there fails with `curl: (23)`. Siblings of
+    // `root` are on the same filesystem as the install, so there's space and the
+    // final swap is a plain rename.
+    const work = `${root}.upgrade-download`;
+    const staged = `${root}.upgrade-staged`;
+    const displaced = `${root}.upgrade-old`;
+    for (const dir of [work, staged, displaced]) {
+        if (existsSync(dir))
+            rmSync(dir, { recursive: true, force: true });
+    }
+    mkdirSync(work, { recursive: true });
+    const tmpTar = join(work, "repoos-dist.tar.gz");
+    try {
+        execFileSync("curl", ["-fsSL", asset.browser_download_url, "-o", tmpTar], { stdio: "inherit" });
+        mkdirSync(staged, { recursive: true });
+        execFileSync("tar", ["-xzf", tmpTar, "-C", staged]);
+        execFileSync("chmod", ["+x", join(staged, "cli", "index.js")]);
+        renameSync(root, displaced);
+        try {
+            renameSync(staged, root);
+        }
+        catch (e) {
+            renameSync(displaced, root);
+            throw e;
+        }
+        rmSync(displaced, { recursive: true, force: true });
+    }
+    finally {
+        rmSync(work, { recursive: true, force: true });
+        if (existsSync(staged))
+            rmSync(staged, { recursive: true, force: true });
+    }
+    regenerateLauncher(root);
+    console.log(c.green(`  Upgraded to v${latest}.`));
+    const notes = releaseNotesToPrint(release.body);
+    if (notes) {
+        console.log("");
+        console.log(notes);
+    }
+}
+/**
+ * The `repoos` launcher script: Bun when it's installed, Node otherwise
+ * (`REPOOS_RUNTIME=node` pins Node). The runtime is picked each time `repoos`
+ * runs, so installing Bun later takes effect with no reinstall. Must match the
+ * heredoc in install.sh exactly; launcher.test.ts compares the two.
+ */
+export function launcherScript(entry) {
+    return [
+        "#!/usr/bin/env bash",
+        "# repoos launcher: Bun when it's installed, Node otherwise (REPOOS_RUNTIME=node pins Node).",
+        `entry="${entry}"`,
+        'if [ "${REPOOS_RUNTIME:-}" != "node" ]; then',
+        '  bun="${REPOOS_BUN_PATH:-$(command -v bun 2>/dev/null || true)}"',
+        '  if [ -n "$bun" ] && [ -x "$bun" ]; then exec "$bun" "$entry" "$@"; fi',
+        "fi",
+        'exec node --no-warnings "$entry" "$@"',
+        "",
+    ].join("\n");
+}
+/**
+ * Rewrite the `repoos` launcher script install.sh created, so an existing
+ * curl install picks up launcher-level fixes (e.g. the Bun-first runtime
+ * choice) without needing to re-run install.sh. Silent
+ * no-op if the launcher isn't where install.sh puts it — e.g. a custom setup
+ * that symlinks straight to cli/index.js instead.
+ */
+function regenerateLauncher(root) {
+    const binDir = process.env.REPOOS_BIN_DIR || join(homedir(), ".local", "bin");
+    const launcherPath = join(binDir, "repoos");
+    if (!existsSync(launcherPath))
+        return;
+    try {
+        writeFileSync(launcherPath, launcherScript(join(root, "cli", "index.js")));
+        chmodSync(launcherPath, 0o755);
+    }
+    catch {
+        // Best-effort — an upgrade that fails to touch the launcher isn't worth failing over.
+    }
+}

package/dist/core/auth-store.d.ts

@@ -0,0 +1,81 @@
+/**
+ * Auth persistence layer. Wraps the SQLite database with typed operations
+ * for users, sessions, OTP challenges, and audit log entries.
+ *
+ * All OTP codes and session tokens are stored hashed — plaintext never
+ * touches disk.
+ */
+import type { AuthRole } from "./auth.js";
+export interface AuthUser {
+    email: string;
+    role: AuthRole;
+    displayName: string | null;
+    authSource: string;
+    addedBy: string | null;
+    createdAt: string;
+    updatedAt: string;
+}
+export interface AuthSessionRow {
+    sessionId: string;
+    tokenHash: string;
+    email: string;
+    role: AuthRole;
+    createdAt: string;
+    expiresAt: string;
+    revokedAt: string | null;
+}
+export interface OtpChallengeRow {
+    id: number;
+    email: string;
+    codeHash: string;
+    createdAt: string;
+    expiresAt: string;
+    usedAt: string | null;
+    sourceIp: string | null;
+}
+export interface AuditLogEntry {
+    id: number;
+    action: string;
+    targetEmail: string | null;
+    actorEmail: string | null;
+    details: string | null;
+    createdAt: string;
+}
+export declare class AuthStore {
+    private db;
+    private available;
+    constructor(repoRoot: string);
+    isAvailable(): boolean;
+    getUser(email: string): AuthUser | null;
+    listUsers(): AuthUser[];
+    upsertUser(email: string, role: AuthRole, addedBy: string | null, displayName?: string): void;
+    deleteUser(email: string): boolean;
+    getAdminCount(): number;
+    createSession(email: string, role: AuthRole, maxAgeSeconds: number): string;
+    getSession(token: string): AuthSessionRow | null;
+    revokeSession(token: string): boolean;
+    revokeAllSessions(email: string): number;
+    /** Update the role column on all active sessions for a user. */
+    updateSessionRoles(email: string, newRole: AuthRole): number;
+    cleanupExpiredSessions(): number;
+    /** Store a hashed OTP challenge. Returns the challenge id. */
+    createOtpChallenge(email: string, codeHash: string, ttlSeconds: number, sourceIp: string | null): number;
+    /** Find a valid, unused OTP for this email. Returns null if none found or expired. */
+    findValidOtp(email: string, codeHash: string): OtpChallengeRow | null;
+    /** Mark an OTP as used. */
+    markOtpUsed(otpId: number): void;
+    /** Count OTP requests for this email in the given time window. */
+    countRecentOtpRequests(email: string, windowSeconds: number): number;
+    /** Count failed verify attempts for this email in the given time window. */
+    countFailedVerifyAttempts(email: string, windowSeconds: number): number;
+    cleanupExpiredOtps(): number;
+    logAudit(action: string, targetEmail: string | null, actorEmail: string | null, details?: string): void;
+    getAuditLog(limit?: number): AuditLogEntry[];
+    private toUser;
+    private toSession;
+    private toOtp;
+    private toAuditEntry;
+    close(): void;
+}
+export declare function getAuthStore(repoRoot: string): AuthStore | null;
+export declare function resetAuthStoreInstance(): void;