forgedock 1.0.21 → 1.1.1

package/examples/forgedock-demo/issues/02-feature-filter-notes.md

@@ -0,0 +1,37 @@
+---
+title: "feat(notes): add safe filtering for GET /notes"
+labels: ["feature", "security", "priority:P2"]
+---
+
+## Problem
+
+`GET /notes?where=...` forwards the raw `where` string straight into
+`db.query()`, which evaluates it as a JavaScript expression. That is an
+injection hole (a caller can pass `?where=true||secret` to leak secret notes).
+We want a **safe** way to filter notes instead.
+
+## Proposed Solution
+
+Replace the free-form `?where=` evaluation with explicit, allow-listed query
+params:
+
+- `?owner=alice` — exact match on `owner`
+- `?secret=false` — match on the `secret` boolean
+
+Build the filter from these typed params in code — never by evaluating a string.
+
+## Affected Files
+
+1. `src/routes/notes.js` — `listNotes()` should read `owner` / `secret` params.
+2. `src/db.js` — replace `query(whereClause)` with a structured filter helper
+   (e.g. `filter({ owner, secret })`) that does not evaluate strings.
+
+## Acceptance Criteria
+
+- [ ] `GET /notes?owner=alice` returns only alice's notes.
+- [ ] `GET /notes?secret=false` returns only non-secret notes.
+- [ ] The string-evaluating `db.query()` path is removed.
+- [ ] `npm run smoke` still passes.
+
+> This issue exercises the **investigation + architecture** phases — the fix
+> touches two files and removes an unsafe code path.

package/examples/forgedock-demo/issues/03-refactor-router-table.md

@@ -0,0 +1,33 @@
+---
+title: "refactor(server): extract the router into its own module"
+labels: ["refactor", "priority:P3"]
+---
+
+## Problem
+
+`src/server.js` mixes three concerns in one file: the route table, request
+body parsing, and the HTTP server wiring. As more routes are added this file
+will become hard to read and test.
+
+## Proposed Solution
+
+Extract the routing logic into a dedicated `src/router.js` module that exports
+a `route(req, res)` function (or a small `Router` object). `server.js` should
+shrink to: create the HTTP server, delegate to the router, and listen.
+
+This is a pure refactor — no behavior changes.
+
+## Affected Files
+
+1. `src/server.js` — remove the inline `TABLE` + matching logic.
+2. `src/router.js` (NEW) — owns the route table and dispatch.
+
+## Acceptance Criteria
+
+- [ ] Route table and dispatch live in `src/router.js`.
+- [ ] `server.js` only creates the server and listens.
+- [ ] All endpoints behave exactly as before.
+- [ ] `npm run smoke` still passes.
+
+> A clean refactor with zero behavior change — a good way to see how the review
+> agents confirm "no regression".

package/examples/forgedock-demo/issues/04-perf-index-lookup.md

@@ -0,0 +1,35 @@
+---
+title: "perf(db): make findById O(1) instead of a linear scan"
+labels: ["performance", "priority:P3"]
+---
+
+## Problem
+
+`db.findById(id)` and `db.remove(id)` both do a linear `Array.find` /
+`Array.filter` over every note on each call. With the seed data that is fine,
+but it is O(n) per lookup and will not scale as the note count grows.
+
+## Investigation Hint
+
+Before optimizing, confirm where the linear scans actually are and whether an
+index can stay consistent across `insert`, `remove`, and `reset`. The point of
+this issue is to show ForgeDock's **investigation phase** tracing the real hot
+path rather than guessing.
+
+## Proposed Solution
+
+Maintain an `id -> note` index (a `Map`) alongside the array so `findById` is
+O(1). Keep the index in sync in `insert`, `remove`, and `reset`.
+
+## Affected Files
+
+1. `src/db.js` — add and maintain a `Map` index; use it in `findById`.
+
+## Acceptance Criteria
+
+- [ ] `findById` uses an O(1) Map lookup.
+- [ ] The index stays consistent after `insert`, `remove`, and `reset`.
+- [ ] `npm run smoke` still passes.
+
+> This issue showcases the **investigation phase** — the agent verifies the
+> claim against the code before writing the optimization.

package/examples/forgedock-demo/issues/05-docs-api-reference.md

@@ -0,0 +1,39 @@
+---
+title: "docs(api): add an API reference for the Notes endpoints"
+labels: ["documentation", "priority:P3"]
+---
+
+## Problem
+
+The demo API has no endpoint documentation. A newcomer has to read `server.js`
+and `routes/notes.js` to learn what routes exist, which ones need a token, and
+what they return.
+
+## Proposed Solution
+
+Add `docs/API.md` documenting every endpoint:
+
+| Method | Path | Auth | Description |
+|--------|------|------|-------------|
+| GET | `/health` | no | Liveness check |
+| GET | `/notes` | no | List notes (supports filtering) |
+| GET | `/notes/:id` | no | Fetch one note |
+| POST | `/notes` | yes | Create a note |
+| DELETE | `/notes/:id` | yes | Delete a note |
+
+Include a `curl` example for each and note the `Authorization: Bearer demo-token`
+header for protected routes.
+
+## Affected Files
+
+1. `docs/API.md` (NEW) — endpoint reference.
+2. `README.md` — link to the new API reference.
+
+## Acceptance Criteria
+
+- [ ] `docs/API.md` documents all 5 endpoints with auth + examples.
+- [ ] README links to it.
+- [ ] No code changes required.
+
+> This issue proves the pipeline handles **non-code work** — docs-only changes
+> still go through investigate → build → review → merge.

package/examples/forgedock-demo/labels.json

@@ -0,0 +1,21 @@
+[
+  { "name": "priority:P0", "color": "B60205", "description": "Critical priority — production broken, data loss, security breach." },
+  { "name": "priority:P1", "color": "D93F0B", "description": "High priority — major feature broken, no workaround." },
+  { "name": "priority:P2", "color": "FBCA04", "description": "Medium priority — impaired functionality, workaround exists." },
+  { "name": "priority:P3", "color": "C2E0C6", "description": "Low priority — minor issue or polish." },
+  { "name": "workflow:investigating", "color": "1D76DB", "description": "Pipeline: investigation phase in progress." },
+  { "name": "workflow:ready-to-build", "color": "0075CA", "description": "Pipeline: investigation complete, ready for build." },
+  { "name": "workflow:building", "color": "0052CC", "description": "Pipeline: implementation in progress." },
+  { "name": "workflow:in-review", "color": "5319E7", "description": "Pipeline: PR created, under review." },
+  { "name": "workflow:merged", "color": "0E8A16", "description": "Pipeline: PR merged, issue closed." },
+  { "name": "workflow:decomposed", "color": "BFD4F2", "description": "Pipeline: decomposed into sub-issues." },
+  { "name": "workflow:invalid", "color": "CCCCCC", "description": "Pipeline: issue closed as invalid after investigation." },
+  { "name": "needs-human", "color": "E4E669", "description": "Pipeline stalled — requires human intervention." },
+  { "name": "review-finding", "color": "D93F0B", "description": "Defect or improvement found during automated PR review." },
+  { "name": "bug", "color": "D73A4A", "description": "Something isn't working." },
+  { "name": "feature", "color": "0075CA", "description": "New feature implementation." },
+  { "name": "refactor", "color": "FEF2C0", "description": "Code restructuring without behavior change." },
+  { "name": "performance", "color": "F9D0C4", "description": "Performance optimization or regression." },
+  { "name": "documentation", "color": "0075CA", "description": "Documentation addition or update." },
+  { "name": "security", "color": "B60205", "description": "Security vulnerability or hardening." }
+]

package/examples/forgedock-demo/package.json

@@ -0,0 +1,16 @@
+{
+  "name": "forgedock-demo",
+  "version": "1.0.0",
+  "description": "A tiny, dependency-free Notes API used as a risk-free playground for trying ForgeDock.",
+  "type": "commonjs",
+  "main": "src/server.js",
+  "scripts": {
+    "start": "node src/server.js",
+    "smoke": "node scripts/smoke.js"
+  },
+  "engines": {
+    "node": ">=18"
+  },
+  "license": "MIT",
+  "private": true
+}

package/examples/forgedock-demo/scripts/smoke.js

@@ -0,0 +1,61 @@
+// Tiny smoke test for the demo Notes API. No test framework, no deps.
+// Starts the server on a random port, hits a few endpoints, and asserts.
+// Run with: npm run smoke
+
+const http = require('http');
+const assert = require('assert');
+const { server } = require('../src/server');
+
+function request(port, method, path, { token, json } = {}) {
+  return new Promise((resolve, reject) => {
+    const headers = {};
+    if (token) headers['Authorization'] = `Bearer ${token}`;
+    let payload;
+    if (json) {
+      payload = JSON.stringify(json);
+      headers['Content-Type'] = 'application/json';
+      headers['Content-Length'] = Buffer.byteLength(payload);
+    }
+    const req = http.request({ host: '127.0.0.1', port, method, path, headers }, (res) => {
+      let raw = '';
+      res.on('data', (c) => (raw += c));
+      res.on('end', () => resolve({ status: res.statusCode, body: raw ? JSON.parse(raw) : {} }));
+    });
+    req.on('error', reject);
+    if (payload) req.write(payload);
+    req.end();
+  });
+}
+
+async function main() {
+  await new Promise((r) => server.listen(0, r));
+  const { port } = server.address();
+
+  const health = await request(port, 'GET', '/health');
+  assert.strictEqual(health.status, 200, 'health should be 200');
+  assert.strictEqual(health.body.status, 'ok', 'health status should be ok');
+
+  const list = await request(port, 'GET', '/notes');
+  assert.ok(Array.isArray(list.body.notes), 'GET /notes returns an array');
+  assert.ok(list.body.notes.length >= 3, 'seed notes present');
+
+  const created = await request(port, 'POST', '/notes', {
+    token: 'demo-token',
+    json: { title: 'smoke', owner: 'tester' },
+  });
+  assert.strictEqual(created.status, 201, 'POST with token returns 201');
+
+  const unauth = await request(port, 'POST', '/notes', { json: { title: 'nope' } });
+  assert.strictEqual(unauth.status, 401, 'POST without token returns 401');
+
+  // eslint-disable-next-line no-console
+  console.log('SMOKE OK — health, list, create(auth), create(unauth) all pass');
+  server.close();
+}
+
+main().catch((err) => {
+  // eslint-disable-next-line no-console
+  console.error('SMOKE FAILED:', err.message);
+  server.close();
+  process.exit(1);
+});

package/examples/forgedock-demo/src/auth.js

@@ -0,0 +1,28 @@
+// Minimal token-based auth for the demo Notes API.
+//
+// The "token" is just a static demo secret — there are no real users or
+// sessions. Routes that should be protected call `requireToken(req)`.
+//
+// >>> DEMO NOTE: In routes/notes.js, one mutating route deliberately does NOT
+// >>> call requireToken(). That missing-auth check is an INTENTIONAL flaw so
+// >>> ForgeDock's review agents have an authorization gap to flag.
+
+const DEMO_TOKEN = 'demo-token';
+
+// Returns true when the request carries the demo bearer token.
+function isAuthenticated(req) {
+  const header = req.headers['authorization'] || '';
+  const [scheme, value] = header.split(' ');
+  return scheme === 'Bearer' && value === DEMO_TOKEN;
+}
+
+// Throws a 401-style error when the request is not authenticated.
+function requireToken(req) {
+  if (!isAuthenticated(req)) {
+    const err = new Error('Unauthorized: missing or invalid bearer token');
+    err.statusCode = 401;
+    throw err;
+  }
+}
+
+module.exports = { isAuthenticated, requireToken, DEMO_TOKEN };

package/examples/forgedock-demo/src/db.js

@@ -0,0 +1,66 @@
+// In-memory data store for the demo Notes API.
+//
+// This is intentionally a plain array plus a deliberately naive query helper.
+// There is no real database — `query()` simulates a SQL-style WHERE clause by
+// building a predicate from a raw string. This mirrors the classic SQL-injection
+// pattern (untrusted input concatenated into a query) so that ForgeDock's
+// /review-pr security agent has a realistic finding to surface.
+//
+// >>> DEMO NOTE: The string-built filter below is an INTENTIONAL, isolated flaw.
+// >>> It exists only inside examples/forgedock-demo so the review agents have
+// >>> something to catch. Do not copy this pattern into real code.
+
+let notes = [
+  { id: 1, owner: 'alice', title: 'Buy milk', body: 'Whole milk, 2 liters', secret: false },
+  { id: 2, owner: 'alice', title: 'Launch plan', body: 'Ship the demo repo', secret: true },
+  { id: 3, owner: 'bob', title: 'Gym', body: 'Leg day', secret: false },
+];
+
+let nextId = 4;
+
+function all() {
+  return notes;
+}
+
+function findById(id) {
+  return notes.find((n) => n.id === Number(id));
+}
+
+// Simulated SQL query. `whereClause` is a raw expression like "owner == 'alice'".
+// INTENTIONAL FLAW: the clause is evaluated directly, so a caller can inject
+// arbitrary expressions (e.g. "true || secret"). A real fix would use a
+// parameterized filter instead of evaluating untrusted strings.
+function query(whereClause) {
+  // eslint-disable-next-line no-new-func
+  const predicate = new Function('row', `with (row) { return (${whereClause}); }`);
+  return notes.filter((row) => {
+    try {
+      return predicate(row);
+    } catch {
+      return false;
+    }
+  });
+}
+
+function insert(note) {
+  const record = { id: nextId++, secret: false, ...note };
+  notes.push(record);
+  return record;
+}
+
+function remove(id) {
+  const before = notes.length;
+  notes = notes.filter((n) => n.id !== Number(id));
+  return notes.length < before;
+}
+
+function reset() {
+  notes = [
+    { id: 1, owner: 'alice', title: 'Buy milk', body: 'Whole milk, 2 liters', secret: false },
+    { id: 2, owner: 'alice', title: 'Launch plan', body: 'Ship the demo repo', secret: true },
+    { id: 3, owner: 'bob', title: 'Gym', body: 'Leg day', secret: false },
+  ];
+  nextId = 4;
+}
+
+module.exports = { all, findById, query, insert, remove, reset };

package/examples/forgedock-demo/src/routes/notes.js

@@ -0,0 +1,64 @@
+// Route handlers for the demo Notes API.
+//
+// Each handler takes (req, res, params) and returns a plain object that the
+// server serializes to JSON. Handlers throw errors with a `statusCode` to
+// signal HTTP error responses.
+
+const db = require('../db');
+const { requireToken } = require('../auth');
+
+// GET /notes
+// Lists notes. Supports an optional ?where= filter that is passed straight
+// into db.query().
+//
+// >>> DEMO NOTE: forwarding the raw ?where= string into db.query() is the
+// >>> injection surface (see db.js). Issue #2 asks to make this safe.
+function listNotes(req, res, params) {
+  const where = params.query.where;
+  if (where) {
+    return { notes: db.query(where) };
+  }
+  return { notes: db.all() };
+}
+
+// GET /notes/:id
+function getNote(req, res, params) {
+  const note = db.findById(params.id);
+  if (!note) {
+    const err = new Error('Note not found');
+    err.statusCode = 404;
+    throw err;
+  }
+  return { note };
+}
+
+// POST /notes  (protected)
+function createNote(req, res, params) {
+  requireToken(req);
+  const { title, body, owner } = params.body || {};
+  if (!title) {
+    const err = new Error('title is required');
+    err.statusCode = 400;
+    throw err;
+  }
+  const note = db.insert({ title, body: body || '', owner: owner || 'anonymous' });
+  res.statusCode = 201;
+  return { note };
+}
+
+// DELETE /notes/:id
+//
+// >>> DEMO NOTE: this mutating route is MISSING a requireToken(req) call, so
+// >>> anyone can delete any note. That missing authorization check is the
+// >>> INTENTIONAL flaw that Issue #1 (bug fix) asks you to close.
+function deleteNote(req, res, params) {
+  const ok = db.remove(params.id);
+  if (!ok) {
+    const err = new Error('Note not found');
+    err.statusCode = 404;
+    throw err;
+  }
+  return { deleted: Number(params.id) };
+}
+
+module.exports = { listNotes, getNote, createNote, deleteNote };

package/examples/forgedock-demo/src/server.js

@@ -0,0 +1,79 @@
+// Entry point for the demo Notes API.
+//
+// Uses only Node's built-in `http` module — no Express, no npm install. Run it
+// with `node src/server.js` (or `npm start`). The router below is intentionally
+// small and hand-rolled so the whole codebase stays readable in a few minutes.
+
+const http = require('http');
+const { URL } = require('url');
+const routes = require('./routes/notes');
+
+const PORT = process.env.PORT || 3000;
+
+// Route table: [method, pathRegex, handler]. A `:id` segment is captured.
+const TABLE = [
+  ['GET', /^\/notes$/, routes.listNotes],
+  ['POST', /^\/notes$/, routes.createNote],
+  ['GET', /^\/notes\/(?<id>\d+)$/, routes.getNote],
+  ['DELETE', /^\/notes\/(?<id>\d+)$/, routes.deleteNote],
+];
+
+function readBody(req) {
+  return new Promise((resolve) => {
+    let raw = '';
+    req.on('data', (chunk) => {
+      raw += chunk;
+    });
+    req.on('end', () => {
+      if (!raw) return resolve({});
+      try {
+        resolve(JSON.parse(raw));
+      } catch {
+        resolve({});
+      }
+    });
+  });
+}
+
+const server = http.createServer(async (req, res) => {
+  res.setHeader('Content-Type', 'application/json');
+
+  // Health check.
+  if (req.method === 'GET' && req.url === '/health') {
+    res.statusCode = 200;
+    return res.end(JSON.stringify({ status: 'ok' }));
+  }
+
+  const url = new URL(req.url, `http://localhost:${PORT}`);
+  const query = Object.fromEntries(url.searchParams.entries());
+
+  const match = TABLE.find(
+    ([method, pattern]) => method === req.method && pattern.test(url.pathname)
+  );
+
+  if (!match) {
+    res.statusCode = 404;
+    return res.end(JSON.stringify({ error: 'Not found' }));
+  }
+
+  const [, pattern, handler] = match;
+  const groups = url.pathname.match(pattern).groups || {};
+  const body = req.method === 'POST' ? await readBody(req) : {};
+
+  try {
+    const result = handler(req, res, { ...groups, query, body });
+    return res.end(JSON.stringify(result));
+  } catch (err) {
+    res.statusCode = err.statusCode || 500;
+    return res.end(JSON.stringify({ error: err.message }));
+  }
+});
+
+if (require.main === module) {
+  server.listen(PORT, () => {
+    // eslint-disable-next-line no-console
+    console.log(`Notes API listening on http://localhost:${PORT}`);
+  });
+}
+
+module.exports = { server };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "forgedock",
-  "version": "1.0.21",
+  "version": "1.1.1",
   "description": "Autonomous dev pipeline for Claude Code. GitHub as institutional memory — every issue, PR, and annotation survives context resets and makes the next agent smarter.",
   "bin": {
     "forgedock": "bin/forgedock.mjs"
@@ -27,7 +27,7 @@
     "type": "git",
     "url": "git+https://github.com/RapierCraftStudios/ForgeDock.git"
   },
-  "homepage": "https://forgedock.dev",
+  "homepage": "https://github.com/RapierCraftStudios/ForgeDock#readme",
   "bugs": {
     "url": "https://github.com/RapierCraftStudios/ForgeDock/issues"
   },
@@ -36,17 +36,27 @@
     "!bin/tests/",
     "commands/",
     "docs/",
+    "examples/",
     "scripts/",
     "templates/",
     "LICENSE",
     "README.md"
   ],
   "scripts": {
-    "test": "node --test \"bin/tests/**/*.test.mjs\""
+    "test": "node --test \"bin/tests/**/*.test.mjs\"",
+    "docs:dev": "vitepress dev docs/site",
+    "docs:build": "vitepress build docs/site",
+    "docs:preview": "vitepress preview docs/site"
   },
   "engines": {
     "node": ">=18"
   },
+  "optionalDependencies": {
+    "@anthropic-ai/sdk": ">=0.30.0 <1"
+  },
+  "devDependencies": {
+    "vitepress": "^1.6.3"
+  },
   "peerDependencies": {
     "@anthropic-ai/claude-code": ">=2.0.0"
   },

package/scripts/verify-env-vars.sh

@@ -179,8 +179,24 @@ for var in $VAR_NAMES; do
     fi
 
     if [ -z "$FOUND_IN" ]; then
-        echo "BLOCKING: $var — not found in .env.example, docker-compose.yml, or env_validation.py"
-        BLOCKING=$((BLOCKING + 1))
+        # Determine whether any of the optional surfaces exist in this repo.
+        # If NONE of the known surfaces exist (not even .env.example), the repo
+        # uses a layout we can't validate — emit SKIP instead of a false BLOCKING.
+        # This is the verify-sops-chain.sh pattern: unknown layout → graceful skip,
+        # not a spurious failure. <!-- Added: forge#1349 -->
+        HAS_ANY_SURFACE=0
+        [ -f "$REPO_ROOT/.env.example" ] && HAS_ANY_SURFACE=1
+        [ -f "$REPO_ROOT/docker-compose.yml" ] && HAS_ANY_SURFACE=1
+        [ -f "$REPO_ROOT/docker-compose.prod.yml" ] && HAS_ANY_SURFACE=1
+        [ -f "$REPO_ROOT/services/api/app/core/env_validation.py" ] && HAS_ANY_SURFACE=1
+        [ -f "$REPO_ROOT/scripts/decrypt-secrets.sh" ] && HAS_ANY_SURFACE=1
+
+        if [ "$HAS_ANY_SURFACE" -eq 0 ]; then
+            echo "SKIP: $var — no known env-wiring surfaces found in repo (no .env.example, docker-compose, env_validation.py, or SOPS mapping). Configure verification.env_check_surfaces in forge.yaml or add .env.example to enable this check."
+        else
+            echo "BLOCKING: $var — not found in any detected env-wiring surface (.env.example, docker-compose.yml, env_validation.py, or decrypt-secrets.sh)"
+            BLOCKING=$((BLOCKING + 1))
+        fi
     else
         echo "OK: $var — found in:$FOUND_IN"
     fi

package/scripts/verify-host-headers.sh

@@ -67,9 +67,9 @@ while read -r f; do
         elif echo "$CONTENT" | grep -qE "\-\-header\s+[\"']Host:"; then
             echo "OK: $f:$LINENO — Host header explicitly set (--header)"
         else
-            echo "BLOCKING: $f:$LINENO — curl/wget to internal service without explicit Host header. TrustedHostMiddleware will reject raw IP as Host value."
+            echo "BLOCKING: $f:$LINENO — curl/wget to internal service without explicit Host header. Host-validation middleware will reject a raw IP as the Host value."
             echo "  Line: $CONTENT"
-            echo "  Fix: Add -H 'Host: localhost' (or appropriate allowed host from services/api/app/main.py allowed_hosts)"
+            echo "  Fix: Add -H 'Host: <allowed-hostname>' — check your service's allowed_hosts configuration for the correct value"
             BLOCKING=$((BLOCKING + 1))
         fi
     done < <(echo "$CURL_LINES")
@@ -96,11 +96,11 @@ if [ -n "$FRONTEND_FILES" ]; then
         fi
 
         if [ -n "$DIRECT_CALLS" ]; then
-            echo "BLOCKING: $f — direct /api/v1/ call bypasses Next.js proxy (auth will fail)"
+            echo "BLOCKING: $f — direct /api/v1/ call bypasses frontend proxy (auth middleware will be skipped)"
             while IFS= read -r match; do
                 echo "  $match"
             done < <(echo "$DIRECT_CALLS")
-            echo "  Fix: Use /api/* proxy routes instead of /api/v1/* direct FastAPI calls"
+            echo "  Fix: Use the frontend proxy route (e.g. /api/*) instead of calling the backend API directly"
             BLOCKING=$((BLOCKING + 1))
         else
             echo "OK: $f — no direct backend calls"

package/scripts/verify-route-registration.sh

@@ -5,7 +5,7 @@
 #   changed_files_file: path to a file listing changed files (one per line)
 #   repo_root: path to the repository root
 #
-# Layout path overrides (env vars — override defaults for non-AlterLab layouts):
+# Layout path overrides (env vars — override defaults for project-specific layouts):
 #   FORGE_PAGES_ROOT          Root of Next.js App Router pages dir (default: web/src/app)
 #   FORGE_API_ROUTERS_DIR     Dir containing FastAPI router .py files (default: services/api/app/routers)
 #   FORGE_API_MAIN            Path to API app entrypoint, relative to repo root (default: services/api/app/main.py)
@@ -35,7 +35,7 @@ else
     FILES=$(cat "$CHANGED_FILES")
 fi
 
-# Layout path configuration — read from env vars, fall back to AlterLab defaults
+# Layout path configuration — read from env vars, fall back to project defaults
 FORGE_PAGES_ROOT="${FORGE_PAGES_ROOT:-web/src/app}"
 FORGE_API_ROUTERS_DIR="${FORGE_API_ROUTERS_DIR:-services/api/app/routers}"
 FORGE_API_MAIN="${FORGE_API_MAIN:-services/api/app/main.py}"