01c9cf1 · eee0685 · bd0f1d4 · c1377d5 · 69a60da · b803f55
@@ -42,6 +42,7 @@
bytes in `tools/list`. After changing a tool run `bun scripts/mcp-table.ts`;
| Tool | Actions / kinds | Purpose | Bytes |
| --- | --- | --- | ---: |
| `access` | — | Non-browser public-path requests, redacted, newest first (max 500) | 235 |
| `account_requests` | — | List who asked for an account and wait; `answer: allow\|decline` answers one | 250 |
| `account_role` | — | Make a person a member or a guest; promoting may grant `usdPerMonth` | 374 |
| `account_suspend` | — | Suspend an account; `suspended: false` lifts | 231 |
| `account_verify` | — | Mark a person's email verified (admin) | 181 |
@@ -193,7 +194,7 @@
bytes in `tools/list`. After changing a tool run `bun scripts/mcp-table.ts`;
| `sessions` | `list`, `end`, `end_idle`, `signins`, `shells` | Where you are signed in: your tokens and browsers, never a secret; `username` for a person as owner; action end + id signs a browser out | 385 |
| `sever` | — | Unlink a spawned forge from its parent (owner of its `forge` repo only) | 214 |
| `share` | — | Share a feed item: no `to` tells the app's crew and owners, else followers; budgeted | 258 |
| `signup` | — | Sign-ups: open (default); invite lets in only a person with an open invite link; closed refuses every new account | 281 |
| `signup` | — | Sign-ups: open (default); invite lets in only a person with an open invite link; closed refuses every new account | 291 |
| `sizes` | — | A child forge's sizes: small, medium and large, each with CPU, memory and disk | 196 |
| `snapshot_now` | — | Take a snapshot now, as Backups does (admin) | 133 |
| `spawn` | — | Spawn a child forge | 824 |
@@ -130,6 +130,7 @@
Machine routes are not pages and have no entry: `/audit.csv`,
- `/login` — `http/server.ts` (`signinAlias`) · the address people type to sign in · it is `/signin`, keeping a same-origin `next` · none (308, no page of its own).
- `/sign-in` — `http/server.ts` (`signinAlias`) · the same, hyphenated · it is `/signin` · none (308, no page of its own).
- `/signup` — `pages/site.ts` · make an account · `/signup` passkey flow (`signup-passkey.ts`) · colours 3 (file).
- `/signup/requested` — `pages/site.ts` · what a stranger whose request waits is told · `/signin` · colours 3 (file).
- `/verify` — `pages/site.ts` · confirm an email address · none · colours 3 (file).
- `/recover` — `pages/passkeys.ts` · get back in without a password · `/settings/passkeys` · none seen.
- `/settings` — `pages/account.ts` · my account · the rest of settings · colour 1.
@@ -0,0 +1,29 @@
# Request access (#10928)
`New accounts` has four modes (Admin → Limits, `signup` over MCP and `PATCH /api/v1/admin/settings`):
| mode | meaning |
| --- | --- |
| `open` | anyone can make an account and starts at once; a new account is a guest |
| `request` | anyone can ask for an account; it waits until an admin allows it |
| `invite` | only a person with an invite link can make an account |
| `closed` | no new accounts |
Invite links keep working in every mode but `closed`; in `request` an open invite is a vouch, so its holder starts at once.
## A stranger
`/signup` in `request` mode asks for a username, a password or passkey, and an optional "What do you want to build?". The account is made *waiting* (`user.waiting_at`): `isActive` is false, so no session, token, key or password opens anything. They land on `/signup/requested`: "Your request is in. Someone who runs this forge will look at it; you can close this page and sign in later to check." Signing in (password or passkey) while waiting shows the wait and starts no session; after Decline it says so politely. After Allow the next sign-in works, and home says "You're in." once.
`POST /api/v1/users` answers `202 {state:"waiting", username, message}`; it takes `note` and `from` (the forge or agent asking). The terminal's create screen says the same sentence.
## The admin
- The notifier sends a line for each of the first three waiting requests, then one count line ("N people ask for an account") that moves only every 25 more (`crew/notify.ts`, `requestLines`), linking to the Waiting list.
- The terminal's **Waiting** screen (palette, `src/tui/screens/requests.ts`): `a` allows, `d` declines, through the same actions.
- The **Waiting** list is on top of Settings → Accounts and in home's "Needs you": name, note, when, from where, with **Allow** and **Decline** one tap each.
- API: `GET /api/v1/admin/requests`, `POST /api/v1/admin/requests/:username/allow|decline`; MCP: `account_requests`.
- Allow makes the person a member (small quotas, no model grant: the crew spends nothing until an admin gives credits). Decline keeps the record (`account_request`).
## Limits
At most 200 requests wait (`WAITING_CAP`): past that a stranger meets the closed door, except one holding an open invite, until the admin answers some. Updating a forge that stored `closed` leaves it `closed`; the migration changes no setting.
`NEWCOMER_QUOTAS` (`settings/quotas.ts`: 3 repositories, 2 apps, 200 MB, 1 preview, 1 run, 1 check) hold an account that was allowed from a request, unless the admin stored a quota of their own, which wins for everyone. Admins, existing members and guests are unchanged.
@@ -7,7 +7,7 @@
 */
import type { App } from "../app.ts";
import { getQuota } from "../settings/quotas.ts";
import { quotaOf } from "../settings/quotas.ts";
import type { User } from "../core/users.ts";
import { err, ok, type Result } from "../kernel/result.ts";
@@ -24,7 +24,7 @@
export function appsOwnedBy(app: App, ownerId: string): number {
/** The refusal, in words: the limit and the count, e.g. "3 of 3 apps". */
export function appLimitWords(app: App, ownerId: string): string {
  const limit = getQuota(app.db, "apps") ?? 0;
  const limit = quotaOf(app.db, "apps", ownerId) ?? 0;
  return `This account is at its limit: ${Math.min(appsOwnedBy(app, ownerId), limit)} of ${limit} apps. Remove one to make room.`;
}
@@ -35,7 +35,7 @@
export function requireAppRoom(
  ownerId: string,
): Result<void, "app_limit"> {
  if (actor.isAdmin) return ok();
  const limit = getQuota(app.db, "apps");
  const limit = quotaOf(app.db, "apps", ownerId);
  if (limit === null || appsOwnedBy(app, ownerId) < limit) return ok();
  return err("app_limit");
}
@@ -0,0 +1,81 @@
/**
 * Answering a stranger's request for an account, for a forge admin who is a
 * person (an agent and everyone else is told `not_found`). Every door calls
 * these: the page's buttons, the API and MCP.
 */
import type { Database } from "bun:sqlite";
import type { App } from "../app.ts";
import { answerRequest, waitingRequests, type AccountRequest } from "../core/requests.ts";
import { setMember } from "../core/roles.ts";
import { getUserByName, type User } from "../core/users.ts";
import { err, ok, type Result } from "../kernel/result.ts";
export type RequestError = "not_found" | "not_waiting";
function admin(actor: User | undefined): Result<User, "not_found"> {
  return actor?.isAdmin === true && actor.kind === "user" ? ok(actor) : err("not_found");
}
export function listRequests(app: App, actor: User | undefined): Result<AccountRequest[], "not_found"> {
  const who = admin(actor);
  return who.ok ? ok(waitingRequests(app.db)) : who;
}
function answer(
  app: App,
  actor: User | undefined,
  username: string,
  state: "allowed" | "declined",
): Result<AccountRequest, RequestError> {
  const who = admin(actor);
  if (!who.ok) return who;
  const done = answerRequest(app.db, username, state, who.value.id, new Date().toISOString());
  if (done === undefined) return err("not_waiting");
  // Allowed, they are a member under the newcomer's small quotas and with
  // no model grant: they can make things, and the crew spends nothing until
  // an admin gives credits.
  if (state === "allowed") {
    const person = getUserByName(app.db, username);
    if (person !== undefined) setMember(app.db, person.id, true, who.value.id, new Date());
  }
  app.bus.append({
    kind: state === "allowed" ? "account.allowed" : "account.declined",
    actorId: who.value.id,
    payload: { username: done.username },
  });
  return ok(done);
}
export const allowRequest = (app: App, actor: User | undefined, username: string) =>
  answer(app, actor, username, "allowed");
export const declineRequest = (app: App, actor: User | undefined, username: string) =>
  answer(app, actor, username, "declined");
/** Past this many waiting, the phone hears one count line, not one per person. */
export const LINES_EACH = 3;
/**
 * What an admin's phone hears at once: a line per request while a few wait,
 * then one line with the count (its id moves on every 25 more), linking to
 * the Waiting list where Allow and Decline are one tap. The notifier sends
 * each id once (`crew/notify.ts`), so a flood cannot spam the phone.
 */
export function requestLines(
  db: Database,
  user: User,
): { id: string; line: string; items: readonly string[]; link: string }[] {
  if (!user.isAdmin || user.kind !== "user") return [];
      
        sentinelcrew
        1d ago
        outdated
      
      One notifier line per waiting request lets a flood spam the admin's phone. Collapse to a single count line past a few.
    
  const link = "/settings/accounts#waiting";
  const waiting = waitingRequests(db);
  if (waiting.length > LINES_EACH) {
    const id = `request:many:${Math.ceil(waiting.length / 25)}`;
    return [{ id, line: `${waiting.length} people ask for an account`, items: [id], link }];
  }
  return waiting.map((r) => {
    const id = `request:${r.username}`;
    const note = r.note === "" ? "" : `: ${r.note.slice(0, 120)}`;
    return { id, line: `${r.username} asks for an account${note}`, items: [id], link };
  });
}
@@ -27,6 +27,7 @@
import {
import { mintViaToken, VIA_TOKEN_MAX_MS } from "../core/via_token.ts";
import { id } from "../kernel/id.ts";
import { inviteSpentBy } from "../core/invites.ts";
import { cleanAsk, NOTE_MAX, SOURCE_MAX } from "../core/requests.ts";
import {
  changePassword as rehash,
  cleanDisplayName,
@@ -52,6 +53,9 @@
export interface SignUpInput {
  password: string;
  /** The Turnstile token the browser's widget gave; read only when a secret is set. */
  humanToken?: string;
  /** While signup is `request`: what they want to build, and which forge or agent asks (`core/requests.ts`). */
  note?: string;
  source?: string;
}
export type SignUpError =
@@ -64,6 +68,18 @@
export type SignUpError =
/** What anyone is told when the forge makes no new accounts. */
export const SIGNUP_CLOSED_MESSAGE = "Signup is closed on this forge.";
/** What a stranger whose request is in is told, plainly and with no one's name. */
export const REQUEST_IN_MESSAGE =
  "Your request is in. Someone who runs this forge will look at it; you can close this page and sign in later to check.";
/** What a waiting person sees when they sign in before an answer. */
export const STILL_WAITING_MESSAGE =
  "Your request is still waiting. Someone who runs this forge will look at it; you can close this page and sign in later to check.";
/** What a person is told once, when they sign in after Allow. */
export const YOURE_IN_MESSAGE = "You're in.";
/** What a person is told, politely, when the answer was no. */
export const DECLINED_MESSAGE =
  "Thanks for asking. This forge isn't able to open an account for you right now. You can still run a forge of your own, and suggest a change to any public app here without an account.";
/**
 * Whether no new account may be made now. Read from the store on every call,
 * so a change takes effect on the next request. While signup is `invite`, an
@@ -148,6 +164,7 @@
export async function signUp(
    origin: "signup",
    slot: from.slot,
    invite: from.invite,
    ask: { note: cleanAsk(input.note, NOTE_MAX), source: cleanAsk(input.source, SOURCE_MAX) },
  });
  if (!created.ok) return created;
  app.bus.append({
@@ -155,13 +172,14 @@
export async function signUp(
    actorId: created.value.id,
    payload: {
      via: "signup",
      ...(created.value.waitingAt === null ? {} : { waiting: true }),
      ...(from.address === undefined ? {} : { address: from.address }),
    },
  });
  auditInvite(app, created.value.id);
  // The address is proven by the link it is sent; until then nothing it
  // does may create or cost.
  if (email !== "") await welcome(app, created.value);
  // does may create or cost. A waiting account is mailed nothing yet.
  if (email !== "" && created.value.waitingAt === null) await welcome(app, created.value);
  return created;
}
@@ -172,6 +190,8 @@
export interface PasskeySignUpInput {
  passkey: Credential;
  passkeyName: string;
  humanToken?: string;
  note?: string;
  source?: string;
}
/**
@@ -202,6 +222,7 @@
export async function signUpWithPasskey(
    origin: "passkey",
    slot: from.slot,
    invite: from.invite,
    ask: { note: cleanAsk(input.note, NOTE_MAX), source: cleanAsk(input.source, SOURCE_MAX) },
  });
  if (!created.ok) return created;
  const kept = addPasskey(app.db, created.value.id, input.passkeyName, input.passkey);
@@ -214,12 +235,13 @@
export async function signUpWithPasskey(
    actorId: created.value.id,
    payload: {
      via: "signup",
      ...(created.value.waitingAt === null ? {} : { waiting: true }),
      ...(from.address === undefined ? {} : { address: from.address }),
    },
  });
  auditInvite(app, created.value.id);
  // As on the password path: no address given, no link to send.
  if (email !== "") await welcome(app, created.value);
  if (email !== "" && created.value.waitingAt === null) await welcome(app, created.value);
  return created;
}
@@ -402,7 +424,7 @@
export async function changePassword(
    password: input.current,
    source: input.source,
  });
  if (!verified.ok) return err(verified.error.reason);
  if (!verified.ok) return err(verified.error.reason === "waiting" ? "bad_credentials" : verified.error.reason);
  const changed = await rehash(app.db, user.value.id, input.next);
  if (!changed.ok)
    return err(
@@ -0,0 +1,9 @@
import type { Route } from "../shared.ts";
export const route: Route = {
  method: "get",
  path: "/api/v1/admin/requests",
  summary: "The strangers waiting for an account, oldest first (a forge admin's, read scope; anyone else gets 404); answers { items: [{ username, note, source, state, askedAt, decidedAt }], next_cursor }",
  auth: true,
  role: "admin",
};
@@ -47,6 +47,7 @@
export { route as getApiV1AdminPeople } from "./getApiV1AdminPeople.ts";
export { route as getApiV1AdminPinned } from "./getApiV1AdminPinned.ts";
export { route as getApiV1AdminProfile } from "./getApiV1AdminProfile.ts";
export { route as getApiV1AdminQuotas } from "./getApiV1AdminQuotas.ts";
export { route as getApiV1AdminRequests } from "./getApiV1AdminRequests.ts";
export { route as getApiV1AdminSettings } from "./getApiV1AdminSettings.ts";
export { route as getApiV1AdminShield } from "./getApiV1AdminShield.ts";
export { route as getApiV1AdminSubscriptions } from "./getApiV1AdminSubscriptions.ts";
@@ -242,6 +243,8 @@
export { route as postApiV1AdminPinnedNameCheck } from "./postApiV1AdminPinnedNa
export { route as postApiV1AdminPinnedNameRollback } from "./postApiV1AdminPinnedNameRollback.ts";
export { route as postApiV1AdminPinnedNameUpdate } from "./postApiV1AdminPinnedNameUpdate.ts";
export { route as postApiV1AdminReleasesShaRollback } from "./postApiV1AdminReleasesShaRollback.ts";
export { route as postApiV1AdminRequestsUsernameAllow } from "./postApiV1AdminRequestsUsernameAllow.ts";
export { route as postApiV1AdminRequestsUsernameDecline } from "./postApiV1AdminRequestsUsernameDecline.ts";
export { route as postApiV1Agents } from "./postApiV1Agents.ts";
export { route as postApiV1Apps } from "./postApiV1Apps.ts";
export { route as postApiV1AsksBulk } from "./postApiV1AsksBulk.ts";
@@ -0,0 +1,10 @@
import type { Route } from "../shared.ts";
export const route: Route = {
  method: "post",
  path: "/api/v1/admin/requests/{username}/allow",
  summary: "Allow a waiting request for an account (admin scope); answers the request as it now stands",
  auth: true,
  role: "admin",
  refusals: { not_waiting: "that request was answered already, or never waited (409)" },
};
@@ -0,0 +1,10 @@
import type { Route } from "../shared.ts";
export const route: Route = {
  method: "post",
  path: "/api/v1/admin/requests/{username}/decline",
  summary: "Decline a waiting request for an account (admin scope); answers the request as it now stands",
  auth: true,
  role: "admin",
  refusals: { not_waiting: "that request was answered already, or never waited (409)" },
};
@@ -4,11 +4,11 @@
export const route: Route = {
  method: "post",
  path: "/api/v1/users",
  summary:
    "Sign up: answers 201 with the new account { id, username, displayName, isAdmin, commitEmail }, never the admin; `email` is optional; `invite` is an invite link's token, `turnstile_token` the human check when the forge asks for one; refused from another origin with 403 forbidden",
    "Sign up: while the forge takes requests (signup `request`) answers 202 { state: 'waiting', username, message } and the account waits for an admin to allow it; otherwise answers 201 with the new account { id, username, displayName, isAdmin, commitEmail }, never the admin; `email` is optional; `invite` is an invite link's token, `turnstile_token` the human check when the forge asks for one; refused from another origin with 403 forbidden",
  auth: false,
  role: "anonymous",
  status: 201,
  body: { username: "string", email: "string", password: "string", invite: "string", turnstile_token: "string" },
  body: { username: "string", email: "string", password: "string", invite: "string", note: "string", from: "string", turnstile_token: "string" },
  refusals: {
    rate_limited: "429, too many sign-ups; retry-after says when",
    too_large: "413, the body is over the limit for a stranger's",
@@ -32,6 +32,8 @@
export interface AccountRow {
  readonly spentUsd: number;
  readonly suspendedAt: string | null;
  readonly removedAt: string | null;
  /** Whether a request for this account waits for an answer (\`core/requests.ts\`). */
  readonly waiting: boolean;
  /** Whether the email is proven (\`core/verify.ts\`); agents always are. */
  readonly verified: boolean;
}
@@ -58,6 +60,7 @@
export function listAccounts(db: Database): AccountRow[] {
        created_at: string;
        suspended_at: string | null;
        removed_at: string | null;
        waiting_at: string | null;
        verified_at: string | null;
        repos: number;
        apps: number;
@@ -67,7 +70,7 @@
export function listAccounts(db: Database): AccountRow[] {
      []
    >(
      `SELECT u.id, u.username, u.display_name, u.is_admin, u.is_agent,
              u.created_at, u.suspended_at, u.removed_at,
              u.created_at, u.suspended_at, u.removed_at, u.waiting_at,
              (SELECT c.verified_at FROM email_check c WHERE c.user_id = u.id) AS verified_at,
              (SELECT COUNT(*) FROM repo r WHERE r.owner_id = u.id) AS repos,
              (SELECT COUNT(*) FROM app a JOIN repo r ON r.id = a.repo_id
@@ -97,6 +100,7 @@
export function listAccounts(db: Database): AccountRow[] {
      spentUsd: Math.round((r.spent ?? 0) * 100) / 100,
      suspendedAt: r.suspended_at,
      removedAt: r.removed_at,
      waiting: r.waiting_at !== null && r.removed_at === null,
      verified: r.is_agent === 1 || r.verified_at !== null,
    };
  });
@@ -20,7 +20,7 @@
export const PIN_OP_WORDS = "op must be pin, unpin or move";
export const ORDER_WORDS = "order is oldest or newest";
/** The forge's `signup` setting: `open`, `invite` or `closed`. */
export const SIGNUP_WORDS = "signup is open, invite or closed";
export const SIGNUP_WORDS = "signup is open, request, invite or closed";
/** A repository's `visibility`: `public` or `private`. */
export const VISIBILITY_WORDS = "visibility is public or private";
@@ -133,6 +133,8 @@
const READER_KINDS: ReadonlySet<string> = new Set([
  "issue.teams",
  "account.role_set",
  "account.email_verified",
  "account.allowed",
  "account.declined",
  "account.recovered",
  "limb.replan",
  "limb.replan_taken_back",
@@ -0,0 +1,1 @@
714cb6ce8d8a9955d3f1a6fdc95fb4854c560e3c51a4d8e833693073cfd1d639
@@ -0,0 +1,18 @@
// A stranger asks for an account and waits (#10928). `user.waiting_at` is set
// while the account may not act (every credential asks `isActive`); the
// request keeps the note, where it came from and the admin's answer. A forge
// that stored `closed` stays closed: this changes no stored setting.
export default `
  ALTER TABLE user ADD COLUMN waiting_at TEXT;
  CREATE TABLE account_request (
    user_id    TEXT PRIMARY KEY REFERENCES user(id) ON DELETE CASCADE,
    note       TEXT NOT NULL DEFAULT '',
    source     TEXT NOT NULL DEFAULT '',
    state      TEXT NOT NULL CHECK (state IN ('waiting', 'allowed', 'declined')),
    asked_at   TEXT NOT NULL,
    decided_at TEXT,
    decided_by TEXT,
    told_at    TEXT
  );
  CREATE INDEX account_request_state ON account_request(state, asked_at);
  `;
@@ -0,0 +1,123 @@
/**
 * A stranger's request for an account (#10928): the note they left, where
 * the ask came from, and the admin's answer. The account itself waits
 * (`user.waiting_at`, which `isActive` reads); Allow clears that, Decline
 * keeps the record and the account stays unable to act. Plain data in and
 * out: who may answer is `actions/requests.ts`'s to say.
 */
import type { Database } from "bun:sqlite";
export type RequestState = "waiting" | "allowed" | "declined";
export interface AccountRequest {
  readonly username: string;
  readonly note: string;
  /** Where the ask came from: a forge or an agent's name, or empty for the web. */
  readonly source: string;
  readonly state: RequestState;
  readonly askedAt: string;
  readonly decidedAt: string | null;
}
/** Requests that may wait at once: past this, a stranger meets the closed door until the admin answers some. */
export const WAITING_CAP = 200;
export const NOTE_MAX = 500;
export const SOURCE_MAX = 80;
/** A note or source from untrusted input: one trimmed line of text, capped, no control characters. */
export function cleanAsk(raw: unknown, max: number): string {
  if (typeof raw !== "string") return "";
  // eslint-disable-next-line no-control-regex
  return raw.replace(/[\u0000-\u001f\u007f]+/g, " ").trim().slice(0, max);
}
interface Row {
  username: string;
  note: string;
  source: string;
  state: RequestState;
  asked_at: string;
  decided_at: string | null;
}
const SELECT = `SELECT u.username, r.note, r.source, r.state, r.asked_at, r.decided_at
                  FROM account_request r JOIN user u ON u.id = r.user_id`;
const toRequest = (r: Row): AccountRequest => ({
  username: r.username,
  note: r.note,
  source: r.source,
  state: r.state,
  askedAt: r.asked_at,
  decidedAt: r.decided_at,
});
/** Who waits, oldest first: the admin answers in the order they asked. */
export function waitingRequests(db: Database): AccountRequest[] {
  return db
    .query<Row, []>(`${SELECT} WHERE r.state = 'waiting' AND u.removed_at IS NULL ORDER BY r.asked_at, u.username`)
    .all()
    .map(toRequest);
}
export function waitingCount(db: Database): number {
  return (
    db
      .query<{ n: number }, []>("SELECT count(*) AS n FROM account_request WHERE state = 'waiting'")
      .get()?.n ?? 0
  );
}
export function requestOf(db: Database, userId: string): AccountRequest | undefined {
  const row = db.query<Row, [string]>(`${SELECT} WHERE r.user_id = ?1`).get(userId);
  return row === null ? undefined : toRequest(row);
}
/**
 * Answer a waiting request: Allow clears the wait, Decline keeps it. Only a
 * request still waiting can be answered, so two taps answer once. Returns
 * the request as it now stands, or undefined when none was waiting.
 */
export function answerRequest(
  db: Database,
  username: string,
  state: "allowed" | "declined",
  by: string,
  at: string,
): AccountRequest | undefined {
  return db.transaction((): AccountRequest | undefined => {
    const found = db
      .query<{ user_id: string }, [string]>(
        `SELECT r.user_id FROM account_request r JOIN user u ON u.id = r.user_id
          WHERE u.username = ?1 COLLATE NOCASE AND r.state = 'waiting'`,
      )
      .get(username);
    if (found === null) return undefined;
    db.query("UPDATE account_request SET state = ?1, decided_at = ?2, decided_by = ?3 WHERE user_id = ?4").run(
      state,
      at,
      by,
      found.user_id,
    );
    if (state === "allowed") db.query("UPDATE user SET waiting_at = NULL WHERE id = ?1").run(found.user_id);
    return requestOf(db, found.user_id);
  })();
}
/**
 * Whether this account has an answer it has not been told yet; telling it
 * (`markTold`) is once, so "You're in" is said on one sign-in.
 */
export function untoldAnswer(db: Database, userId: string): RequestState | undefined {
  const row = db
    .query<{ state: RequestState }, [string]>(
      "SELECT state FROM account_request WHERE user_id = ?1 AND state <> 'waiting' AND told_at IS NULL",
    )
    .get(userId);
  return row?.state;
}
export function markTold(db: Database, userId: string, at: string): void {
  db.query("UPDATE account_request SET told_at = ?1 WHERE user_id = ?2 AND told_at IS NULL").run(at, userId);
}
@@ -17,7 +17,7 @@
import { appsRoot } from "../apps/data.ts";
import { dirBytes } from "../apps/bytes.ts";
import { repoDir } from "../git/repos.ts";
import { limitValue } from "../settings/limits.ts";
import { getQuota } from "../settings/quotas.ts";
import { getQuota, quotaOf } from "../settings/quotas.ts";
import { contributionForksOf, isContributionFork } from "./contribute.ts";
import type { Repo } from "./repos.ts";
import type { User } from "./users.ts";
@@ -190,8 +190,8 @@
export function formatBytes(bytes: number): string {
}
/** The storage limit in bytes, or none. */
export function storageLimitBytes(app: App): number | undefined {
  const mb = getQuota(app.db, "storage");
export function storageLimitBytes(app: App, ownerId?: string): number | undefined {
  const mb = ownerId === undefined ? getQuota(app.db, "storage") : quotaOf(app.db, "storage", ownerId);
  return mb === null ? undefined : mb * BYTES_PER_MB;
}
@@ -217,7 +217,7 @@
export async function storageRefusal(
    const guest = await contributionRefusal(app, ownerId, repo, user);
    if (guest !== undefined) return guest;
  }
  const limit = storageLimitBytes(app);
  const limit = storageLimitBytes(app, ownerId);
  if (limit === undefined || storageExempt(user)) return undefined;
  let used = await accountBytes(app, ownerId);
  // At the limit, look again: a repository deleted or data cleared since the
@@ -240,7 +240,7 @@
export const storageRefusedText = (used: string): string =>
/** The sentence for a refusal just given, from the figure it was given on. */
export function storageSentence(app: App, ownerId: string): string | undefined {
  const limit = storageLimitBytes(app);
  const limit = storageLimitBytes(app, ownerId);
  const used = cachedBytes(app, ownerId);
  return limit === undefined || used === undefined || used < limit
    ? undefined
@@ -259,7 +259,7 @@
export async function pushCap(
  repo?: Repo,
): Promise<Record<string, string>> {
  if (storageExempt(user)) return {};
  const limit = storageLimitBytes(app);
  const limit = storageLimitBytes(app, ownerId);
  const guest =
    repo !== undefined && isContributionFork(app.db, repo.id)
      ? (await contributionRoom(app, ownerId, repo)).room
@@ -11,6 +11,7 @@
import { reservedName } from "./reserved.ts";
import { id } from "../kernel/id.ts";
import { err, ok, type Result } from "../kernel/result.ts";
import { admitSignin } from "./signin-window.ts";
import { waitingCount, WAITING_CAP } from "./requests.ts";
import { getSignup } from "../settings/signup.ts";
import { inviteOpen, redeemInvite, reopenInvite } from "./invites.ts";
import type { SignupSlot } from "../actions/signup-window.ts";
@@ -38,6 +39,12 @@
export interface User {
  readonly suspendedAt: string | null;
  /** When the owner removed it. The row stays so the name stays taken. */
  readonly removedAt: string | null;
  /**
   * Set while a stranger's request for this account is unanswered, and kept
   * once it is declined; cleared by Allow (`core/requests.ts`). Such an
   * account can do nothing: every credential asks `isActive`.
   */
  readonly waitingAt: string | null;
}
export type CommitEmail = "noreply" | "account";
@@ -55,6 +62,7 @@
interface UserRow {
  created_at: string;
  suspended_at: string | null;
  removed_at: string | null;
  waiting_at: string | null;
}
function toUser(row: UserRow): User {
@@ -71,6 +79,7 @@
function toUser(row: UserRow): User {
    createdAt: row.created_at,
    suspendedAt: row.suspended_at,
    removedAt: row.removed_at,
    waitingAt: row.waiting_at ?? null,
  };
}
@@ -79,7 +88,7 @@
function toUser(row: UserRow): User {
 * password, edge sign-in, SSH key — asks this before it names a person.
 */
export const isActive = (user: User): boolean =>
  user.suspendedAt === null && user.removedAt === null;
  user.suspendedAt === null && user.removedAt === null && user.waitingAt === null;
/**
 * Whether `viewer` finds no account at `user`'s name: a suspended or removed
@@ -136,7 +145,13 @@
export type AccountOrigin =
   * `invite` is the token of an invite link (`core/invites.ts`): while
   * signup is `invite` it opens the door once, spent with the account.
   */
  | { origin: "signup" | "passkey"; slot: SignupSlot; invite?: string | undefined }
  | {
      origin: "signup" | "passkey";
      slot: SignupSlot;
      invite?: string | undefined;
      /** What they say they want to build, and where the ask came from (`core/requests.ts`). */
      ask?: { note: string; source: string } | undefined;
    }
  | { origin: "edge" }
  | { origin: Exclude<ExemptOrigin, AdminOrigin> }
  | ({ origin: AdminOrigin } & AdminFields);
@@ -162,13 +177,19 @@
export type CreateUserInput = CreateUserFields & AccountOrigin;
 * (`inviteNeeded` says when it must be spent).
 */
export function newAccountsClosed(db: Database, invite?: string): boolean {
  // In `request` the door shuts once the Waiting list is full, for anyone an open invite does not vouch for.
  if (getSignup(db) === "request") return waitingCount(db) >= WAITING_CAP && !(invite !== undefined && inviteOpen(db, invite));
  if (!inviteNeeded(db)) return false;
  return !(getSignup(db) === "invite" && invite !== undefined && inviteOpen(db, invite));
}
/** Whether a stranger needs an invite (or cannot come in at all) now. */
/**
 * Whether a stranger needs an invite (or cannot come in at all) now. In
 * `request` anyone may ask, and waits unless an open invite vouches for them.
 */
function inviteNeeded(db: Database): boolean {
  return getSignup(db) !== "open";
  const mode = getSignup(db);
  return mode === "invite" || mode === "closed";
}
interface CreateUserFields {
@@ -230,9 +251,9 @@
export function discardFreshUser(db: Database, userId: string): void {
 */
type Admission =
  | { readonly admitted: false }
  | { readonly admitted: true; readonly spend: string | undefined };
  | { readonly admitted: true; readonly spend: string | undefined; readonly request: "waiting" | "none" };
const ADMITTED: Admission = { admitted: true, spend: undefined };
const ADMITTED: Admission = { admitted: true, spend: undefined, request: "none" };
const REFUSED: Admission = { admitted: false };
      
        sentinelcrew
        1d ago
        outdated
      
      HIGH: in request mode every stranger gets a permanent row, with no cap on how many wait. Count waiting requests here and refuse above a cap. Test it.
    
function admission(db: Database, input: AccountOrigin): Admission {
@@ -240,10 +261,16 @@
function admission(db: Database, input: AccountOrigin): Admission {
    case "signup":
    case "passkey":
      if (input.slot.spent) throw new Error("a sign-up slot makes one account");
      if (getSignup(db) === "request") {
        // An open invite vouches for its holder; anyone else waits to be allowed.
        if (input.invite !== undefined && inviteOpen(db, input.invite))
          return { admitted: true, spend: input.invite, request: "none" };
        return waitingCount(db) >= WAITING_CAP ? REFUSED : { admitted: true, spend: undefined, request: "waiting" };
      }
      if (!inviteNeeded(db)) return ADMITTED;
      return newAccountsClosed(db, input.invite) || input.invite === undefined
        ? REFUSED
        : { admitted: true, spend: input.invite };
        : { admitted: true, spend: input.invite, request: "none" };
    case "edge":
      return newAccountsClosed(db) ? REFUSED : ADMITTED;
    case "claim":
@@ -343,6 +370,15 @@
export async function createUser(
      admin.adminIfFirst ? 1 : 0,
      agent ? 1 : 0,
    );
    // A stranger's account keeps its ask, in the same write, waiting until allowed.
    if (admitted.request === "waiting") {
      const at = new Date().toISOString();
      const ask = "ask" in input ? input.ask : undefined;
      db.query("UPDATE user SET waiting_at = ?1 WHERE id = ?2").run(at, userId);
      db.query(
        "INSERT INTO account_request (user_id, note, source, state, asked_at) VALUES (?1, ?2, ?3, 'waiting', ?4)",
      ).run(userId, ask?.note ?? "", ask?.source ?? "", at);
    }
    return true;
  });
  try {
@@ -480,7 +516,9 @@
export function ensureEdgeUser(db: Database, login: string): User | undefined {
/** Why a password was not accepted: wrong, or tried too often to check. */
export type PasswordRefusal =
  | { readonly reason: "bad_credentials" }
  | { readonly reason: "throttled"; readonly retryAfter: number };
  | { readonly reason: "throttled"; readonly retryAfter: number }
  /** The password is right, and a request for the account still has no yes (\`core/requests.ts\`): no credential. */
  | { readonly reason: "waiting"; readonly username: string };
/** One password attempt: who it names, the secret, and the peer that sent it. */
export interface PasswordAttempt {
@@ -515,6 +553,10 @@
export async function verifyPasswordThrottled(
    admission.succeeded();
    return err({ reason: "throttled", retryAfter: GATE_RETRY_AFTER });
  }
  if (!checked.ok && checked.error === "waiting") {
    admission.succeeded();
    return err({ reason: "waiting", username: attempt.username });
  }
  if (!checked.ok) return err({ reason: "bad_credentials" });
  admission.succeeded();
  return checked;
@@ -538,7 +580,7 @@
async function checkPassword(
  db: Database,
  username: string,
  password: string,
): Promise<Result<User, "bad_credentials">> {
): Promise<Result<User, "bad_credentials" | "waiting">> {
  const row = db
    .query<
      UserRow,
@@ -555,6 +597,8 @@
async function checkPassword(
  if (!valid || !row || row.kind === "org" || row.is_agent === 1)
    return err("bad_credentials");
  const user = toUser(row);
  // Only the one who knows the password is told their request waits; no credential comes of it.
  if (user.waitingAt !== null && user.suspendedAt === null && user.removedAt === null) return err("waiting");
  return isActive(user) ? ok(user) : err("bad_credentials");
}
@@ -22,6 +22,7 @@
import { blockedLines } from "../actions/egress_refused.ts";
import { newAccountLines } from "../actions/accounts.ts";
import { requestLines } from "../actions/requests.ts";
import { mailCeilingLines } from "../actions/mail.ts";
import { forgetOnboarding, onboardedLines } from "../apps/onboarding.ts";
import type { Database } from "bun:sqlite";
@@ -501,6 +502,7 @@
export function startNotifier(app: App, options: NotifyOptions): Notifier {
    // to itself.
    const asks: { line: string; items: readonly string[]; link?: string }[] = [
      ...askLinesFor(app.db, user).map((a) => ({ line: a.line, items: a.items })),
      ...requestLines(app.db, user),
      ...newAccountLines(app.db, user, now()),
      ...landedLines(app.db, user, now()),
      ...mailCeilingLines(app, user, now()),
@@ -127,6 +127,7 @@
import {
  PASSKEY_REQUIRED_MESSAGE,
  signUp,
  SIGNUP_CLOSED_MESSAGE,
  REQUEST_IN_MESSAGE,
} from "../actions/users.ts";
import { OFFSET_LIMIT_MAX, offsetPage, offsetQuery } from "./offset_page.ts";
import { EVENTS_LIMIT_MAX, eventsLimit, eventsPage, validEventsCursor, validEventsKind } from "../core/events_page.ts";
@@ -193,7 +194,7 @@
import { isPinned } from "../core/pins.ts";
import { diffCommit } from "../git/diff.ts";
import { runGit } from "../git/env.ts";
import { appLimitWords, appsOwnedBy } from "../actions/app_limit.ts";
import { getQuota } from "../settings/quotas.ts";
import { getQuota, quotaOf } from "../settings/quotas.ts";
import { isSafeRef, isSafeTreePath } from "../git/guard.ts";
import { compareBranches, listBranchRows } from "../git/branches.ts";
import {
@@ -1099,7 +1100,7 @@
export function positiveInt(raw: string | undefined): number | undefined {
/** 403 naming the limit and the count, for an account at its app limit. */
export function appLimitResponse(ctx: Ctx, ownerName: string): Response {
  const owner = getUserByName(ctx.app.db, ownerName);
  const limit = getQuota(ctx.app.db, "apps");
  const limit = owner ? quotaOf(ctx.app.db, "apps", owner.id) : getQuota(ctx.app.db, "apps");
  return json(
    {
      error: "app_limit",
@@ -1192,6 +1193,9 @@
export function apiRoutes(router: Router<Handler>): void {
        email: str(input.email),
        password: str(input.password),
        humanToken: str(input.turnstile_token),
        // Where the ask comes from (a forge or an agent) and what they want to build.
        note: str(input.note),
        source: str(input.from),
      },
      {
        slot,
@@ -1206,6 +1210,8 @@
export function apiRoutes(router: Router<Handler>): void {
    if (!created.ok && created.error === "human_check")
      return apiError("human_check", 422, HUMAN_CHECK_MESSAGE);
    if (!created.ok) return json({ error: created.error }, 422);
    // Signup is `request`: the account waits for an admin, and acts as nothing yet.
    if (created.value.waitingAt !== null) return json({ state: "waiting", username: created.value.username, message: REQUEST_IN_MESSAGE }, 202);
    return json(publicUser(created.value), 201);
  });
@@ -21,6 +21,7 @@
import { setAccountCeilings, setAccountGrant } from "../../actions/model_grant.t
import { checkPinned, deployPinned, pinnedForges, rollbackPinned, updatePinned } from "../../actions/pinned.ts";
import { TARGETS } from "../../cloud/targets.ts";
import { changeQuotas, readQuotas } from "../../actions/quotas.ts";
import { allowRequest, declineRequest, listRequests } from "../../actions/requests.ts";
import { setRole } from "../../actions/roles.ts";
import { SETTING_WORDS } from "../../actions/setting_words.ts";
import { changeForgeSource, changeSignup, readForgeSource, readSignup } from "../../actions/signup.ts";
@@ -435,6 +436,24 @@
export function adminRoutes(router: Router<Handler>): void {
        : notFound();
  });
  // Strangers waiting for an account (#10928), and the answer to each.
  router.add("GET", "/api/v1/admin/requests", (ctx) => {
    notePhase(ctx.request, "session", takeSessionTime(ctx.request));
    const denied = accountAdmin(ctx, "ro");
    if (denied) return denied;
    const listed = listRequests(ctx.app, ctx.auth.user);
    return listed.ok ? json({ items: listed.value, next_cursor: null }) : notFound();
  });
  const answerRequest = (act: "allow" | "decline"): Handler => (ctx) => {
    const denied = accountAdmin(ctx, "admin");
    if (denied) return denied;
    const done = (act === "allow" ? allowRequest : declineRequest)(ctx.app, ctx.auth.user, ctx.params.username!);
    if (done.ok) return json(done.value);
    return done.error === "not_waiting" ? apiError("not_waiting", 409, "that request is not waiting") : notFound();
  };
  router.add("POST", "/api/v1/admin/requests/:username/allow", answerRequest("allow"));
  router.add("POST", "/api/v1/admin/requests/:username/decline", answerRequest("decline"));
  // Every person and their role.
  router.add("GET", "/api/v1/admin/people", (ctx) => {
    notePhase(ctx.request, "session", takeSessionTime(ctx.request));
@@ -0,0 +1,28 @@
import { allowRequest, declineRequest, listRequests } from "../../../actions/requests.ts";
import { scopeAllows } from "../../../core/tokens.ts";
import { good, bad, type Tool, mayBoards } from "../shared.ts";
export const tool: Tool = {
  name: "account_requests",
  doc: "`{ username?, answer? }`: the strangers waiting for an account (name, note, when, from where); with `username` and `answer` `allow` or `decline`, answer one; a forge admin's, and answering needs an admin token",
  description: "List who asked for an account and wait; `answer: allow|decline` answers one.",
  inputSchema: {
    type: "object",
    properties: { username: { type: "string" }, answer: { type: "string", enum: ["allow", "decline"] } },
  },
  writes: true,
  run(ctx, user, args) {
    if (!mayBoards(user)) return bad("not_found", "no such tool here");
    const { username, answer } = args;
    if (username === undefined && answer === undefined) {
      const listed = listRequests(ctx.app, user);
      return listed.ok ? good({ waiting: listed.value }) : bad("not_found", "no such tool here");
    }
    if (typeof username !== "string" || (answer !== "allow" && answer !== "decline"))
      return bad("invalid", "send a username and answer: allow or decline");
    if (!scopeAllows(ctx.auth.scope ?? "ro", "admin")) return bad("forbidden", "answering a request needs an admin token");
    const done = (answer === "allow" ? allowRequest : declineRequest)(ctx.app, user, username);
    if (done.ok) return good({ username: done.value.username, state: done.value.state });
    return done.error === "not_waiting" ? bad("not_waiting", "that request is not waiting") : bad("not_found", "no such person");
  },
};
@@ -1,6 +1,7 @@
// Generated by `bun scripts/mcp-tools.ts` from the files beside it; do not edit.
// One line per tool, sorted: a new tool is a new file and one new line here.
export { tool as access } from "./access.ts";
export { tool as account_requests } from "./account_requests.ts";
export { tool as account_role } from "./account_role.ts";
export { tool as account_suspend } from "./account_suspend.ts";
export { tool as account_verify } from "./account_verify.ts";
@@ -140,6 +140,7 @@
import {
  signinPage,
  signinSubmit,
  signupPage,
  requestedPage,
  signupSubmit,
  verifyPage,
  themeSubmit,
@@ -860,6 +861,7 @@
export function buildRouter(): Router<Handler> {
  router.add("GET", "/signin/parent", parentStart);
  router.add("GET", "/signin/parent/callback", parentCallback);
  router.add("GET", "/signup", signupPage);
  router.add("GET", "/signup/requested", requestedPage);
  router.add("GET", "/verify", verifyPage);
  router.add("POST", "/signup", signupSubmit);
  router.add("POST", "/logout", logoutSubmit);
@@ -25,6 +25,7 @@
import { securityControlsPage } from "../web/pages/security_controls.ts";
import { securityPage, securityShieldSet } from "../web/pages/security.ts";
import { trafficPage } from "../web/pages/traffic.ts";
import { sourcesPage } from "../web/pages/sources.ts";
import { requestAct } from "../web/requests_card.ts";
import { captureStart, captureStop, networksImport, scrapesExport, scrapesPage } from "../web/pages/scrapes.ts";
import {
  accountAct,
@@ -239,6 +240,8 @@
export function settingsRoutes(router: Router<Handler>, knownPatterns: () => rea
  router.add("POST", "/settings/backups/mirror/clear", backupsMirrorClear);
  router.add("POST", "/settings/backups/mirror/now", backupsMirrorNow);
  router.add("GET", "/settings/accounts", accountsPage);
  router.add("POST", "/settings/accounts/:username/allow", requestAct("allow"));
  router.add("POST", "/settings/accounts/:username/decline", requestAct("decline"));
  router.add("GET", "/settings/people", peoplePage);
  router.add("POST", "/settings/people/:username/role", roleAct);
  router.add("GET", "/settings/model", modelPage);
@@ -27,6 +27,29 @@
export function isQuotaKey(key: string): key is QuotaKey {
  return (QUOTA_KEYS as readonly string[]).includes(key);
}
/**
 * What an account that came through a request (`core/requests.ts`) is held
 * to when the admin has set no limit of their own: small, so that letting a
 * stranger in costs little. Admins, existing members and guests who never
 * asked are not in it; a stored quota is the admin's word and wins.
 */
export const NEWCOMER_QUOTAS: Quotas = {
  repositories: 3,
  apps: 2,
  storage: 200,
  previews: 1,
  runs: 1,
  checks: 1,
};
/** The limit on `key` for the account `ownerId`: the stored one, else the newcomer's, else none. */
export function quotaOf(db: Database, key: QuotaKey, ownerId: string): number | null {
  const stored = getQuota(db, key);
  if (stored !== null) return stored;
  const asked = db.query("SELECT 1 FROM account_request WHERE user_id = ?1 AND state = 'allowed'").get(ownerId);
  return asked === null ? null : NEWCOMER_QUOTAS[key];
}
const storeKey = (key: QuotaKey): string => `quota.${key}`;
/** A limit from untrusted input: a positive integer, or empty/null for none. */
@@ -75,7 +98,7 @@
export function repositoriesOwned(db: Database, ownerId: string): number {
/** The sentence a refused creation says, or nothing when there is room. */
export function repositoryLimitSentence(db: Database, ownerId: string): string | undefined {
  const limit = getQuota(db, "repositories");
  const limit = quotaOf(db, "repositories", ownerId);
  if (limit === null) return undefined;
  const owned = repositoriesOwned(db, ownerId);
  return owned >= limit ? `${owned} of ${limit} repositories` : undefined;
@@ -102,7 +125,7 @@
export function runningLimitSentence(
  ownerId: string,
  held: () => number,
): string | undefined {
  const limit = getQuota(db, key);
  const limit = quotaOf(db, key, ownerId);
  if (limit === null || exempt(db, ownerId)) return undefined;
  const n = held();
  return n >= limit ? `${n} of ${limit} ${noun}` : undefined;
@@ -1,5 +1,5 @@
/**
 * Who may make an account: `open`, `invite` or `closed`. Stored in
 * Who may make an account: `open`, `request`, `invite` or `closed`. Stored in
 * `forge_setting` under `signup`, and every change is kept in
 * `forge_setting_change` (who, when, from what to what). Default `open` when nothing is stored; a new forge stores `invite` (`seedSignup`).
 * `/signup`, `POST /api/v1/users`, passkey signup and a first edge sign-in ask
@@ -11,7 +11,15 @@
import type { Database } from "bun:sqlite";
import { err, ok, type Result } from "../kernel/result.ts";
import { writeSetting } from "./limits.ts";
export const SIGNUP_MODES = ["open", "invite", "closed"] as const;
export const SIGNUP_MODES = ["open", "request", "invite", "closed"] as const;
/** What each mode means, in one line: shown beside the setting and read by the MCP. */
export const SIGNUP_MEANS: Record<SignupMode, string> = {
  open: "anyone can make an account and starts at once, under small limits",
  request: "anyone can ask for an account; it waits until an admin allows it",
  invite: "only a person with an invite link can make an account",
  closed: "no new accounts",
};
export type SignupMode = (typeof SIGNUP_MODES)[number];
export const SIGNUP_DEFAULT: SignupMode = "open";
@@ -66,7 +74,7 @@
export function signupFromEnv(raw: string | undefined): Result<SignupMode | null
  const parsed = parseSignup(s);
  return parsed.ok
    ? parsed
    : err(`FORGE_SIGNUP: open, invite or closed, not "${s.slice(0, 20)}"`);
    : err(`FORGE_SIGNUP: open, request, invite or closed, not "${s.slice(0, 20)}"`);
}
export interface SignupChange {
@@ -61,6 +61,7 @@
import { entry as people } from "./people.ts";
import { entry as pinned } from "./pinned.ts";
import { entry as profile } from "./profile.ts";
import { entry as quotas } from "./quotas.ts";
import { entry as requests } from "./requests.ts";
import { entry as resilience } from "./resilience.ts";
import { entry as scorecard } from "./scorecard.ts";
import { entry as weekcard } from "./weekcard.ts";
@@ -135,6 +136,7 @@
export const ENTRIES: readonly PaletteEntry[] = [
  agents,
  archived,
  invites,
  requests,
  bulk,
  subscriptions,
  cloud,
@@ -0,0 +1,84 @@
/**
 * The Waiting list in the terminal, a forge admin's (#10928): strangers who
 * asked for an account, oldest first, as the Waiting card on /settings/accounts
 * has them. `a` allows the selected one and `d` declines it, both through
 * `actions/requests.ts`, so the gate is theirs (an admin who is a person;
 * anyone else sees nothing) and the write reaches web viewers on the bus.
 */
import { allowRequest, declineRequest, listRequests } from "../../actions/requests.ts";
import type { Ctx, Screen } from "../app/app.ts";
import { binding } from "../app/keys.ts";
import { style } from "../term/style.ts";
import { truncate } from "../term/width.ts";
import type { Session } from "../session.ts";
import { fill, len, split } from "../ui/layout.ts";
import { ListState, drawList, type ListRow } from "./common.ts";
import type { PaletteEntry } from "./entries.ts";
export function requestsScreen(f: Session, ctx: Ctx): Screen {
  const state = new ListState();
  let note = "";
  const read = () => listRequests(f.app, f.user);
  const items = () => {
    const r = read();
    return r.ok ? r.value : [];
  };
  const rows = (): ListRow[] =>
    items().map((r) => ({
      title: r.username,
      secondary: r.note === "" ? "no note" : r.note,
      meta: `asked ${r.askedAt.slice(0, 16)}  from ${r.source === "" ? "the web" : r.source}`,
    }));
  const answer = (act: "allow" | "decline"): boolean => {
    const row = items()[state.index];
    if (row === undefined) return false;
    const done = (act === "allow" ? allowRequest : declineRequest)(f.app, f.user, row.username);
    note = done.ok
      ? `${row.username} ${act === "allow" ? "is in" : "was declined, politely"}.`
      : `${row.username} is not waiting any more.`;
    ctx.invalidate();
    return true;
  };
  const screen: Screen = {
    title: "Waiting",
    keys: [binding(["j", "k"], "move cursor"), binding(["a"], "allow"), binding(["d"], "decline")],
    render(area, s) {
      const c = ctx.theme.c;
      const r = read();
      const [head, body] = split(area, "v", [len(1), fill(1)]);
      const text =
        note !== ""
          ? note
          : !r.ok
            ? "The Waiting list is a forge admin's."
            : r.value.length === 0
              ? "Nobody is waiting."
              : "a allows the selected request, d declines it.";
      s.text(head!.x, head!.y, truncate(text, head!.w), style(c.mutedFg, c.bg), head!.x + head!.w);
      drawList(s, body!, c, state, rows());
    },
    key(e) {
      note = "";
      if (state.key(e, items().length)) return true;
      if (e.ctrl || e.alt || !read().ok) return false;
      if (e.key === "a") return answer("allow");
      if (e.key === "d") return answer("decline");
      return false;
    },
  };
  return screen;
}
/** Who asked for an account and waits: a forge admin who is a person. */
export const entry: PaletteEntry = {
  id: "requests",
  title: "Waiting",
  hint: "strangers who asked for an account: allow or decline",
  after: ["invites", "teams", "limits", "quotas", "people", "can"],
  offered: (session) => session.user?.isAdmin === true && session.user.kind === "user",
  run: (session, ctx) => ctx.push(requestsScreen(session, ctx)),
};
@@ -9,7 +9,7 @@
 */
import { activeEdgeToken } from "../../http/edge.ts";
import { INVITE_SPENT_MESSAGE, SIGNUP_CLOSED_MESSAGE, signUp, signupClosed } from "../../actions/users.ts";
import { INVITE_SPENT_MESSAGE, REQUEST_IN_MESSAGE, SIGNUP_CLOSED_MESSAGE, signUp, signupClosed } from "../../actions/users.ts";
import { SignupSlot, waitText } from "../../actions/signup-window.ts";
import { hasAnyUser } from "../../core/users.ts";
import { getSignup } from "../../settings/signup.ts";
@@ -117,6 +117,12 @@
export function signInScreen(f: Session, ctx: Ctx, onDone: () => void): Screen {
            else error = errorText(created.error);
            return;
          }
          // A request that waits has no session: the screen says so and stays a sign-in.
          if (created.value.waitingAt !== null) {
            mode = "signin";
            error = REQUEST_IN_MESSAGE;
            return;
          }
          const adopted = f.adopt(created.value);
          if (!adopted.ok) {
            error = errorText(adopted.error);
@@ -133,7 +133,7 @@
export class Session {
      password,
      source: this.identity.remoteAddress,
    });
    if (!verified.ok) return err(verified.error.reason);
    if (!verified.ok) return err(verified.error.reason === "waiting" ? "bad_credentials" : verified.error.reason);
    return this.adopt(verified.value);
  }
@@ -45,6 +45,7 @@
import { sessionsCard } from "./account.ts";
import { ceilingCard, grantCard } from "./model.ts";
import { accountSections } from "./origins.ts";
import { markOf } from "../../core/marks.ts";
import { requestsCard } from "../requests_card.ts";
function shell(ctx: Ctx, body: Html, status = 200): Response {
  return page(
@@ -65,6 +66,7 @@
function shell(ctx: Ctx, body: Html, status = 200): Response {
function standing(a: AccountRow): Html {
  if (a.removedAt !== null) return badge("Removed", { variant: "outline" });
  if (a.suspendedAt !== null) return badge("Suspended", { tone: "danger" });
  if (a.waiting) return badge("Waiting", { variant: "outline" });
  if (!a.verified) return badge("Email not verified", { variant: "outline" });
  return html``;
}
@@ -198,7 +200,7 @@
function accountsView(ctx: Ctx, notice?: Html, status = 200): Response {
  const rendering = performance.now();
  const response = shell(
    ctx,
    html`${notice ?? null}${ownerless}${edgeOnly}${noMail}<section class="settings-block" id="accounts">
    html`${notice ?? null}${requestsCard(ctx)}${ownerless}${edgeOnly}${noMail}<section class="settings-block" id="accounts">
      <h2>Who is on this forge</h2>
      <p class="muted">Newest first.</p>
      <ul class="list setting-list" id="accounts-list">
@@ -12,7 +12,7 @@
import { inviteLink, list as listInviteLinks, mint as mintInviteLink, revoke as
import { INVITE_NOT_OPEN } from "../../actions/sever_invite_words.ts";
import { DEFAULT_DAYS, MAX_DAYS } from "../../core/invites.ts";
import { changeSignup, readSignup } from "../../actions/signup.ts";
import { SIGNUP_MODES } from "../../settings/signup.ts";
import { SIGNUP_MEANS, SIGNUP_MODES } from "../../settings/signup.ts";
import { QUOTA_KEYS } from "../../settings/quotas.ts";
import type { Ctx } from "../../http/context.ts";
import { notePhase, takeSessionTime, timePhase } from "../../core/route_timing.ts";
@@ -122,16 +122,19 @@
export function limitsPage(ctx: Ctx): Response {
    }),
  );
  const signupRow = html`<div class="status-row">
    <dt>Signup</dt>
    <dt>New accounts</dt>
    <dd>
      <form class="row-fields" method="post" action="/admin/signup">
        <select class="input mono" name="signup" aria-label="Who may sign up">
        <select class="input mono" name="signup" aria-label="New accounts">
          ${SIGNUP_MODES.map(
            (m) => html`<option value="${m}" ${signup.ok && signup.value.signup === m ? "selected" : ""}>${m}</option>`,
          )}
        </select>
        ${btn("Save", { size: "sm", variant: "primary", label: "Save signup" })}
      </form>
      <ul class="muted small" id="signup-means">
        ${SIGNUP_MODES.map((m) => html`<li><strong>${m}</strong>: ${SIGNUP_MEANS[m]}</li>`)}
      </ul>
      
        sentinelcrew
        1d ago
        
      
      Design principle 1: 'Invite links still work.' is repeated on three lines. Say it once.
    
    </dd>
    <dd class="status-act"></dd>
  </div>`;
@@ -280,7 +283,7 @@
export async function signupSet(ctx: Ctx): Promise<Response> {
    "/admin/limits",
    changed.ok
      ? { message: "Signup saved." }
      : { tone: "danger", message: "Signup is open, invite or closed." },
      : { tone: "danger", message: "New accounts are open, request, invite or closed." },
  );
}
@@ -20,6 +20,7 @@
import {
import { linkEdgeLogin } from "../../core/edge_links.ts";
import { activeEdgeToken, edgeIdentity } from "../../http/edge.ts";
import { RateLimiter } from "../../core/ratelimit.ts";
import { requestOf } from "../../core/requests.ts";
import { createSession } from "../../core/sessions.ts";
import { LAST_WAY_IN, removeOwnPasskey } from "../../actions/passkeys.ts";
import { recoveryAccount, requestRecovery, spendRecoveryLink } from "../../actions/verify.ts";
@@ -197,7 +198,8 @@
export async function signinPasskey(ctx: Ctx): Promise<Response> {
  const found = findPasskey(ctx.app.db, str(data.id));
  if (!found) return no();
  const user = getUserById(ctx.app.db, found.userId);
  if (!user || !isActive(user)) return no();
  const waiting = user !== undefined && user.waitingAt !== null && user.suspendedAt === null && user.removedAt === null;
  if (!user || (!isActive(user) && !waiting)) return no();
  const verified = await verifyAssertion(
    {
      clientDataJSON: str(data.clientDataJSON),
@@ -209,6 +211,9 @@
export async function signinPasskey(ctx: Ctx): Promise<Response> {
  );
  if (!verified.ok) return no();
  notePasskeyUsed(ctx.app.db, found.id, verified.signCount);
  // A proven key on an account whose request has no yes yet starts no session (#10928).
  if (waiting)
    return json({ ok: true, waiting: true, next: requestOf(ctx.app.db, user.id)?.state === "declined" ? "/signup/requested?answer=declined" : "/signup/requested" }, 202);
  const session = createSession(ctx.app.db, user.id);
  return json(
    { ok: true, next: safeNext(ctx.url.searchParams.get("next")) ?? "/" },
@@ -102,11 +102,13 @@
export async function signupPasskey(ctx: Ctx): Promise<Response> {
  if (typeof slot === "number") return tooMany(slot);
  const created = await signUpWithPasskey(
    ctx.app,
    { username, email, passkey: made, passkeyName: "Passkey", humanToken: str(data.humanToken) },
    { username, email, passkey: made, passkeyName: "Passkey", humanToken: str(data.humanToken), note: str(data.note) },
    { slot, invite: inviteOf(ctx), address: clientAddress(ctx.request) },
  );
  if (!created.ok)
    return refuse(created.error === "human_check" ? 422 : created.error === "signup_closed" ? 403 : 409, WORDS[created.error] ?? "Sign-up did not work. Try again.");
  // A request that waits starts no session: it lands on the page that says so.
  if (created.value.waitingAt !== null) return json({ ok: true, waiting: true, next: "/signup/requested" }, 202);
  const session = createSession(ctx.app.db, created.value.id);
  return json(
    { ok: true, next: safeNext(ctx.url.searchParams.get("next")) ?? "/" },
@@ -18,12 +18,14 @@
import { verifyEmail } from "../../actions/verify.ts";
import { STRANGER_MAX } from "../../http/limits.ts";
import { createRepo, repositoryLimitMessage, resolveOwner } from "../../actions/repos.ts";
import { REPO_INIT_FAILED, REPO_NAME_RULES } from "../../actions/repo_words.ts";
import { NOTE_MAX, requestOf } from "../../core/requests.ts";
import { DECLINED_MESSAGE, REQUEST_IN_MESSAGE, STILL_WAITING_MESSAGE } from "../../actions/users.ts";
import { HUMAN_CHECK_MESSAGE, INVITE_SPENT_MESSAGE, PASSKEY_REQUIRED_MESSAGE, SIGNUP_CLOSED_MESSAGE, signUp, signupClosed } from "../../actions/users.ts";
import { accessAllows, listOrgsForUser, orgAccess } from "../../core/orgs.ts";
import { listPins } from "../../core/pins.ts";
import { getReposByIds } from "../../core/repos.ts";
import { createSession } from "../../core/sessions.ts";
import { hasAnyUser, verifyPasswordThrottled, type User } from "../../core/users.ts";
import { getUserByName, hasAnyUser, verifyPasswordThrottled, type User } from "../../core/users.ts";
import { isThemeName } from "../../design/themes.ts";
import { cookieValue, crossOrigin, type Ctx } from "../../http/context.ts";
import { studioDoor, studioHome } from "../studio/home.ts";
@@ -231,6 +233,7 @@
interface AuthErrors {
/** What `/signin` says about new accounts in each signup mode; open says nothing. */
const SIGNUP_SENTENCES: Record<SignupMode, string | undefined> = {
  open: undefined,
  request: "New accounts here start after someone who runs the forge allows them.",
  invite: "This forge is invite-only: new accounts need an invite link.",
  closed: "This forge is closed to new accounts.",
};
@@ -381,6 +384,17 @@
function authForm(
          <button type="button" id="passkey-signup" class="btn" data-variant="outline">Create account with a passkey</button>
        </div>`,
      )}
      ${when(
        kind === "signup" && getSignup(ctx.app.db) === "request",
        () => formField({
          label: "What do you want to build?",
          name: "note",
          type: "textarea",
          rows: 3,
          maxlength: NOTE_MAX,
          hint: "Optional. A line or two helps whoever looks at your request.",
        }),
      )}
      ${when(
        errors.human,
        (message) => html`<p class="error mb" role="alert">${message}</p>`,
@@ -398,7 +412,7 @@
function authForm(
          ? html`<button type="button" id="passkey-signup" class="btn" data-variant="primary">Create account with a passkey</button>`
          : kind === "signin"
            ? html`<button type="submit" class="btn" data-variant="outline" data-passkey="on" hidden>Sign in</button><button type="submit" class="btn" data-variant="primary" data-passkey="off">Sign in</button>`
            : btn("Create account", { variant: "primary" })}
            : btn(kind === "signup" && getSignup(ctx.app.db) === "request" ? "Ask for an account" : "Create account", { variant: "primary" })}
        <span class="spacer"></span>
        ${kind === "signin"
          ? // A closed forge has no door to point at: the sentence above says so.
@@ -423,7 +437,7 @@
function authForm(
  const claimable =
    existsSync(join(ctx.app.config.dataDir, "parent.json")) && unowned;
  return html`<div class="narrow">
    ${pageHead(kind === "signin" ? "Sign in" : "Create your account")}
    ${pageHead(kind === "signin" ? "Sign in" : getSignup(ctx.app.db) === "request" ? "Ask for an account" : "Create your account")}
    ${when(
      kind === "signup",
      () => html`<p class="mb" id="signup-you-get">${SIGNUP_YOU_GET} <a href="/forges/new">${SIGNUP_OWN_FORGE}</a></p>`,
@@ -555,6 +569,11 @@
export async function signinSubmit(ctx: Ctx): Promise<Response> {
    response.headers.set("retry-after", String(wait));
    return response;
  }
  if (!verified.ok && verified.error.reason === "waiting") {
    const mine = getUserByName(ctx.app.db, verified.error.username);
    const declined = mine !== undefined && requestOf(ctx.app.db, mine.id)?.state === "declined";
    return requestPage(ctx, declined ? DECLINED_MESSAGE : STILL_WAITING_MESSAGE, declined ? "Not this time" : "Your request is waiting");
  }
  if (!verified.ok) {
    return page(
      {
@@ -580,6 +599,34 @@
export async function signinSubmit(ctx: Ctx): Promise<Response> {
  );
}
/** What a person whose request is in, waiting or declined is shown: a sentence, no owner's name. */
export function requestPage(ctx: Ctx, said: string, title = "Your request is in", status = 200): Response {
  return page(
    {
      ctx,
      title,
      body: html`<div class="narrow stack" id="request-state">
        ${pageHead(title)}
        <p>${said}</p>
        <div class="form-actions">
          ${btn("Sign in", { href: "/signin", variant: "outline" })}
          ${btn("Get your own forge", { href: "/#yours", variant: "ghost" })}
        </div>
      </div>`,
    },
    status,
  );
}
// GET /signup/requested — where a request lands: no session, nothing to act on yet.
export function requestedPage(ctx: Ctx): Response {
  notePhase(ctx.request, "session", takeSessionTime(ctx.request));
  return timePhase(ctx.request, "render", () =>
    ctx.url.searchParams.get("answer") === "declined"
      ? requestPage(ctx, DECLINED_MESSAGE, "Not this time")
      : requestPage(ctx, REQUEST_IN_MESSAGE));
}
// GET /verify?token= — the link in a verification email.
export function verifyPage(ctx: Ctx): Response {
  notePhase(ctx.request, "session", takeSessionTime(ctx.request));
@@ -673,6 +720,7 @@
export async function signupSubmit(ctx: Ctx): Promise<Response> {
      email,
      password: field(form, "password"),
      humanToken: field(form, "cf-turnstile-response"),
      note: field(form, "note"),
    },
    { slot, invite: inviteOf(ctx), address: clientAddress(ctx.request) },
  );
@@ -702,6 +750,8 @@
export async function signupSubmit(ctx: Ctx): Promise<Response> {
      422,
    );
  }
  // A request that waits has no session to start: it lands on the page that says so.
  if (created.value.waitingAt !== null) return redirect("/signup/requested");
  const session = createSession(ctx.app.db, created.value.id);
  return redirect(
    safeNext(ctx.url.searchParams.get("next")) ?? "/",
@@ -131,6 +131,7 @@
export const passkeyJs = /* js */ `
        return post('/signup/passkey' + location.search, {
          username: who.username,
          email: who.email,
          note: val('note'),
          humanToken: val('cf-turnstile-response'),
          challenge: o.challenge,
          clientDataJSON: text(cred.response.clientDataJSON),
@@ -0,0 +1,60 @@
/**
 * The Waiting list: strangers who asked for an account (#10928), each with
 * the note they left, when, and from where, and Allow and Decline one tap
 * apart. Shown on top of the accounts page and in home's "Needs you", for a
 * forge admin; both answer through `actions/requests.ts`.
 */
import { allowRequest, declineRequest, listRequests } from "../actions/requests.ts";
import type { Ctx } from "../http/context.ts";
import { notFoundPage, signInFirst } from "./chrome.ts";
import { readForm } from "./form.ts";
import { html, type Html } from "./html.ts";
import { flashTo } from "./layout.ts";
import { btn, row, time } from "./ui.ts";
/** The card, or nothing when nobody waits or the viewer is not an admin. */
export function requestsCard(ctx: Ctx, back = ""): Html | null {
  const listed = listRequests(ctx.app, ctx.auth.user);
  if (!listed.ok || listed.value.length === 0) return null;
  return html`<section class="settings-block" id="waiting" aria-label="Waiting">
    <h2>Waiting <span class="muted">${listed.value.length}</span></h2>
    <ul class="list setting-list">
      ${listed.value.map((r) => {
        const at = `/settings/accounts/${encodeURIComponent(r.username)}`;
        const to = back === "" ? "" : `?back=${back}`;
        return row({
          title: html`<strong>${r.username}</strong>`,
          meta: html`asked ${time(r.askedAt)} · from ${r.source === "" ? "the web" : r.source}${r.note === ""
            ? null
            : html`<br />${r.note}`}`,
          after: html`<form method="post" action="${at}/allow${to}">
              ${btn("Allow", { type: "submit", variant: "primary" })}
            </form>
            <form method="post" action="${at}/decline${to}">
              ${btn("Decline", { type: "submit", variant: "outline" })}
            </form>`,
        });
      })}
    </ul>
  </section>`;
}
/** POST /settings/accounts/:username/allow and /decline. */
export function requestAct(act: "allow" | "decline") {
  return async (ctx: Ctx): Promise<Response> => {
    if (!ctx.auth.user) return signInFirst(ctx);
    if (!ctx.auth.user.isAdmin) return notFoundPage(ctx);
    const form = await readForm(ctx, "admin");
    if (form instanceof Response) return form;
    const username = ctx.params.username ?? "";
    const done = (act === "allow" ? allowRequest : declineRequest)(ctx.app, ctx.auth.user, username);
    if (!done.ok && done.error === "not_found") return notFoundPage(ctx);
    const to = ctx.url.searchParams.get("back") === "home" ? "/" : "/settings/accounts";
    return flashTo(ctx, to, {
      message: done.ok
        ? `${username} ${act === "allow" ? "is in" : "was declined, politely"}.`
        : `${username} is not waiting any more.`,
    });
  };
}
@@ -411,7 +411,7 @@
function renderLlmsTxt(ctx: Ctx, o: string, tell: string | undefined, running: s
      "",
      "If you are an assistant helping a person: say plainly what you can and cannot do from where you are. If you cannot reach this forge or hold an account on it, give the person these steps to do by hand.",
      "",
      `- Help build a public app here: each one is a repository at ${o}/{owner}/{name}. A person makes an account at ${o}/signup, then follows "Offer a change" below. If /signup answers 403, new accounts here are by invitation for now: send a suggestion through "Report a problem" below, or work from a forge of your own.`,
      `- Help build a public app here: each one is a repository at ${o}/{owner}/{name}. A person makes an account at ${o}/signup, then follows "Offer a change" below. By request, POST ${o}/api/v1/users gives 202 {state:"waiting"}; sign in to see. If /signup says 403, use "Report a problem" below, or run your own forge.`,
      `- Get your own forge: \`git clone ${UPSTREAM_REPO}.git && cd forge && bun install && bun run src/main.ts\`, then in a second terminal \`bun src/main.ts --first-admin\`, which prints a one-time link that makes you the admin. It needs Bun; its crew needs the claude CLI and a model credential. Or a hosted one, free within limits while hosting is not sold: sign in and open ${o}/forges/new (or call the MCP \`spawn\` tool with the person's consent). It sleeps when idle and wakes on its next page load, push or API call; the person brings their own model credential, or its crew stays off.`,
      `- Work from your own forge: connect it to this one as an origin, bring an app in, and send your work back. How: ${UPSTREAM_REPO}/raw/main/docs/ORIGINS.md`,
      `- Connect an assistant that can use tools: add a custom connector with the URL ${mcp.url}. It signs in with OAuth; only the report tool works without an account.`,
@@ -20,7 +20,9 @@
import {
} from "../../actions/front.ts";
import { catalog, refreshCatalogQuietly } from "../../packs/catalog.ts";
import { appsRuntime, type EnvState } from "../../apps/runtime.ts";
import { signupClosed } from "../../actions/users.ts";
import { signupClosed, YOURE_IN_MESSAGE } from "../../actions/users.ts";
import { markTold, untoldAnswer } from "../../core/requests.ts";
import { requestsCard } from "../requests_card.ts";
import { getSignup } from "../../settings/signup.ts";
import { appsForRepos } from "../../core/apps.ts";
import { WEIGHT_MAX, WEIGHT_NAMES } from "../../core/front.ts";
@@ -351,8 +353,14 @@
export async function studioHome(
    isNavigation(ctx.request) ? noteVisit(ctx.app.db, user.id, visitedAt) : lastVisit(ctx.app.db, user.id),
  );
  const since = timePhase(ctx.request, "since", () => sinceYouWere(ctx.app.db, user, before, visitedAt));
  const needsYou = html`${waiting}${held}${alarms}`;
  // A stranger's request for an account is the first thing that needs an admin (#10928).
  const requests = requestsCard(ctx, "home");
  // The first page after Allow says so, once.
  const allowed = untoldAnswer(ctx.app.db, user.id) === "allowed";
  if (allowed) markTold(ctx.app.db, user.id, new Date().toISOString());
  const needsYou = html`${requests}${waiting}${held}${alarms}`;
  const body = html`<h1 class="sr-only">Home</h1>
    ${allowed ? html`<div class="toast" data-tone="success" role="status" id="youre-in"><strong>${YOURE_IN_MESSAGE}</strong> Your account is open: tell the crew what you want to build.</div>` : null}
    ${tellBox(ctx, user)}
    ${ask} ${address}
    ${when(String(needsYou).trim() !== "", () => html`<section class="stack stack-tight" id="needs-you" aria-label="Needs you"><h2 class="small muted">Needs you</h2>${needsYou}</section>`)}
@@ -38,7 +38,7 @@
describe("an argument's allowed-values refusals", () => {
      "hidden is true or false",
      "op must be pin, unpin or move",
      "order is oldest or newest",
      "signup is open, invite or closed",
      "signup is open, request, invite or closed",
      "visibility is public or private",
    ]);
  });
@@ -120,7 +120,7 @@
describe("the one list of what asks first", () => {
  // Writes that do not ask first, on purpose: each reads, plans, or only changes the caller's own
  // settings and can be put back. A new `writes: true` tool is on neither list until someone decides.
  const NOT_ASKED = new Set([
    "access", "account_verify", "app_members", "app_notes", "asks_act", "asks_decide", "asks_proposal", "asks_undecide", "atlas",
    "access", "account_requests", "account_verify", "app_members", "app_notes", "asks_act", "asks_decide", "asks_proposal", "asks_undecide", "atlas",
    "assign", "attach_look", "bet", "board_pins", "board_write", "branches", "capacity", "valves", "cloud_accounts", "close", "confirm_wait",
    "crew", "decisions_by", "detach", "economics", "edit", "email_verify", "feed_chips", "feed_dismiss", "feed_like", "flag_set", "flag_winner",
    "follow_mode", "fork", "front_page", "hold", "issue_teams", "keep_plan", "knobs", "labels", "lift", "limb", "maintenance", "make_it_yours", "map", "merge", "new_app",
@@ -265,6 +265,7 @@
describe("the forge over MCP", () => {
      "invites",
      "account_role",
      "account_suspend",
      "account_requests",
      "flag_winner",
      "restore_drill",
      "model_ceiling",
@@ -145,6 +145,7 @@
test("a site-admin person is offered the whole roster", () => {
    ["teams", "Crew teams", "each team's charter, dial and members"],
    ["agents", "Crew agents", "each agent's model, budget and brief"],
    ["invites", "Invite links", "make a single-use link, see which are open, revoke one"],
    ["requests", "Waiting", "strangers who asked for an account: allow or decline"],
    ["bulk", "Bulk actions", "your last bulk actions; u undoes one inside its day"],
    ["subscriptions", "Crew subscriptions", "each account's budget and rest; wake one, set its budget, add or remove one"],
    ["app-templates", "App templates", "the repositories New app offers; mark or unmark one"],
@@ -0,0 +1,246 @@
/**
 * Request access, the edges (#10928): the migration leaves a closed forge
 * closed, waiting requests are capped and the phone hears a count past a few,
 * the terminal answers requests, and the pieces an answer rests on: a waiting
 * passkey starts no session, a stored quota beats the newcomer's, an open
 * invite vouches in `request` mode, an answer is made once, and the list is
 * an admin's alone.
 */
import { afterAll, beforeAll, describe, expect, test } from "bun:test";
import { mkdtemp, rm } from "node:fs";
import { readFileSync } from "node:fs";
import { tmpdir } from "node:os";
import { join } from "node:path";
import { createApp, type App } from "../src/app.ts";
import { mint } from "../src/actions/invites.ts";
import { LINES_EACH, requestLines } from "../src/actions/requests.ts";
import { WAITING_CAP, waitingCount } from "../src/core/requests.ts";
import { createUser, getUserByName } from "../src/core/users.ts";
import { createSession } from "../src/core/sessions.ts";
import { serve, type Servers } from "../src/http/server.ts";
import { NEWCOMER_QUOTAS, quotaOf, setQuota } from "../src/settings/quotas.ts";
import { setLimit } from "../src/settings/limits.ts";
import { getSignup, setSignup } from "../src/settings/signup.ts";
import { createForgeApp } from "../src/tui/forge.ts";
import { headlessTerminal } from "../src/tui/term/terminal.ts";
import { device } from "./helpers/passkey.ts";
import { adminCookie } from "./helpers/admin.ts";
import { quietLogs } from "./helpers/globals.ts";
import { settleApp } from "./helpers/tui.ts";
quietLogs();
const ORIGIN = "https://forge.example";
const PASS = "a-good-passphrase-1";
let dir: string;
let app: App;
let servers: Servers;
let base: string;
let admin: string;
beforeAll(async () => {
  dir = await new Promise<string>((res, rej) => mkdtemp(join(tmpdir(), "forge-request-limits-"), (e, d) => (e ? rej(e) : res(d))));
  app = createApp({ dataDir: dir, port: 0, url: ORIGIN });
  servers = await serve(app);
  base = servers.url;
  setLimit(app.db, "signup.per_source", 1000, "setup");
  admin = await adminCookie(app, { username: "ada", email: "[email protected]" });
  setSignup(app.db, "request", "boot");
});
afterAll(async () => {
  await servers.stop();
  app.close();
  await new Promise<void>((r) => rm(dir, { recursive: true, force: true }, () => r()));
});
const api = (username: string, extra: Record<string, string> = {}) =>
  fetch(`${base}/api/v1/users`, {
    method: "POST",
    headers: { "content-type": "application/json", origin: ORIGIN },
    body: JSON.stringify({ username, password: PASS, ...extra }),
  });
/** Fill the Waiting list straight in the database: the cap is about rows, not about hashing. */
function fillWaiting(prefix: string, n: number): void {
  const at = new Date().toISOString();
  app.db.transaction(() => {
    for (let i = 0; i < n; i++) {
      const id = `fill-${prefix}-${i}`;
      app.db.query("INSERT INTO user (id, username, email, password_hash, waiting_at) VALUES (?1, ?2, ?3, '', ?4)").run(id, `${prefix}${i}`, `${prefix}${i}@x.test`, at);
      app.db.query("INSERT INTO account_request (user_id, note, source, state, asked_at) VALUES (?1, '', '', 'waiting', ?2)").run(id, at);
    }
  })();
}
const clearFill = (): void => {
  app.db.query("DELETE FROM account_request WHERE user_id LIKE 'fill-%'").run();
  app.db.query("DELETE FROM user WHERE id LIKE 'fill-%'").run();
};
describe("the migration", () => {
  test("changes no stored setting, so a closed forge stays closed", () => {
    const text = readFileSync(join(import.meta.dir, "../src/core/migrations/20261110160000-account-requests.ts"), "utf8");
    expect(text).not.toMatch(/forge_setting/);
  });
});
describe("the Waiting list is bounded", () => {
  test("past the cap a stranger meets the closed door; an open invite still vouches; an answer reopens it", async () => {
    clearFill();
    fillWaiting("w", WAITING_CAP);
    expect(waitingCount(app.db)).toBe(WAITING_CAP);
    const refused = await api("onetoomany");
    expect(refused.status).toBe(403);
    expect(getUserByName(app.db, "onetoomany")).toBeUndefined();
    const token = mint(app, getUserByName(app.db, "ada"), 7);
    if (!token.ok) throw new Error("no invite");
    const vouched = await api("vouched", { invite: token.value.token });
    expect(vouched.status).toBe(201);
    expect(getUserByName(app.db, "vouched")?.waitingAt).toBeNull();
    app.db.query("DELETE FROM account_request WHERE user_id = 'fill-w-0'").run();
    expect((await api("roomagain")).status).toBe(202);
    clearFill();
  });
  test("the phone hears each of a few, then one count line", () => {
    clearFill();
    const ada = getUserByName(app.db, "ada")!;
    app.db.query("DELETE FROM account_request WHERE state = 'waiting'").run();
    fillWaiting("n", LINES_EACH);
    expect(requestLines(app.db, ada).length).toBe(LINES_EACH);
    fillWaiting("m", 40);
    const many = requestLines(app.db, ada);
    expect(many.length).toBe(1);
    expect(many[0]!.line).toBe(`${LINES_EACH + 40} people ask for an account`);
    fillWaiting("k", 1);
    // A flood moves the id slowly: the same id for a few more.
    expect(requestLines(app.db, ada)[0]!.id).toBe(many[0]!.id);
    clearFill();
  });
});
describe("what an answer rests on", () => {
  test("a waiting account's passkey sign-in starts no session; once allowed it does", async () => {
    const res = await fetch(`${base}/signup`, {
      method: "POST",
      headers: { origin: ORIGIN },
      body: new URLSearchParams({ username: "keyed", email: "[email protected]", password: PASS }),
      redirect: "manual",
    });
    expect(res.status).toBe(303);
    const keyed = getUserByName(app.db, "keyed")!;
    // Enrol a key as if the stranger had a session, then ask to be let in.
    app.db.query("UPDATE user SET waiting_at = NULL WHERE id = ?1").run(keyed.id);
    const cookie = `forge_session=${createSession(app.db, keyed.id).token}`;
    const d = await device(ORIGIN);
    const post = (path: string, body: unknown, headers: Record<string, string> = {}) =>
      fetch(`${base}${path}`, { method: "POST", headers: { "content-type": "application/json", origin: ORIGIN, ...headers }, body: JSON.stringify(body), redirect: "manual" });
    const opts = (await (await post("/settings/passkeys/options", {}, { cookie })).json()) as { challenge: string };
    expect((await post("/settings/passkeys", { name: "k", challenge: opts.challenge, ...(await d.create(opts.challenge)) }, { cookie })).status).toBe(200);
    const signIn = async () => {
      const o = (await (await post("/signin/passkey/options", {})).json()) as { challenge: string };
      return post("/signin/passkey", { challenge: o.challenge, ...(await d.get(o.challenge)) });
    };
    app.db.query("UPDATE user SET waiting_at = ?1 WHERE id = ?2").run(new Date().toISOString(), keyed.id);
    const waiting = await signIn();
    expect(waiting.status).toBe(202);
    expect(waiting.headers.get("set-cookie")).toBeNull();
    app.db.query("UPDATE user SET waiting_at = NULL WHERE id = ?1").run(keyed.id);
    const allowed = await signIn();
    expect(allowed.status).toBe(200);
    expect(allowed.headers.get("set-cookie")).toContain("forge_session=");
  });
  test("a stored quota beats the newcomer's; the newcomer's holds only for an allowed request", async () => {
    expect((await api("quota1")).status).toBe(202);
    const person = getUserByName(app.db, "quota1")!;
    expect(quotaOf(app.db, "apps", person.id)).toBeNull();
    const allow = await fetch(`${base}/api/v1/admin/requests/quota1/allow`, { method: "POST", headers: { cookie: admin, origin: ORIGIN } });
    expect(allow.status).toBe(200);
    expect(quotaOf(app.db, "apps", person.id)).toBe(NEWCOMER_QUOTAS.apps);
    setQuota(app.db, "apps", (NEWCOMER_QUOTAS.apps ?? 0) + 40, "ada");
    expect(quotaOf(app.db, "apps", person.id)).toBe((NEWCOMER_QUOTAS.apps ?? 0) + 40);
  });
  test("an open invite vouches in request mode: no wait, and the invite is spent", async () => {
    expect(getSignup(app.db)).toBe("request");
    const token = mint(app, getUserByName(app.db, "ada"), 7);
    if (!token.ok) throw new Error("no invite");
    const res = await api("guest1", { invite: token.value.token });
    expect(res.status).toBe(201);
    expect(getUserByName(app.db, "guest1")?.waitingAt).toBeNull();
    const again = await api("guest2", { invite: token.value.token });
    expect(again.status).toBe(202);
    expect(getUserByName(app.db, "guest2")?.waitingAt).not.toBeNull();
  });
  test("an answer is made once, and the list is an admin's alone", async () => {
    expect((await api("once")).status).toBe(202);
    const answer = () => fetch(`${base}/api/v1/admin/requests/once/decline`, { method: "POST", headers: { cookie: admin, origin: ORIGIN } });
    expect((await answer()).status).toBe(200);
    expect((await answer()).status).toBe(409);
    const member = await createUser(app.db, { origin: "seed", trusted: true, username: "plain", email: "[email protected]", password: PASS });
    if (!member.ok) throw new Error(member.error);
    const cookie = `forge_session=${createSession(app.db, member.value.id).token}`;
    const got = await fetch(`${base}/api/v1/admin/requests`, { headers: { cookie } });
    // The admin gate answers a member before the handler does; anonymous gets 404.
    expect(got.status).toBe(403);
    expect(await got.text()).not.toContain("guest2");
    expect((await fetch(`${base}/api/v1/admin/requests`)).status).toBe(404);
    const post = await fetch(`${base}/api/v1/admin/requests/guest2/allow`, { method: "POST", headers: { cookie, origin: ORIGIN } });
    expect([403, 404]).toContain(post.status);
    expect(getUserByName(app.db, "guest2")?.waitingAt).not.toBeNull();
  });
});
describe("the terminal answers requests", () => {
  const open = (username: string) => {
    const user = getUserByName(app.db, username)!;
    const { app: tui } = createForgeApp(app, { sshUsername: "t", remoteAddress: "127.0.0.1", user }, { terminal: headlessTerminal(140, 32), exitHooks: false });
    tui.start();
    const k = (key: string, ctrl = false) => tui.dispatch({ type: "key", key, ctrl, alt: false, shift: false });
    return {
      text: () => tui.screen.toText(),
      press: async (...keys: string[]) => {
        keys.forEach((x) => k(x));
        await settleApp(tui);
      },
      palette: async () => {
        k("k", true);
        for (const ch of "Waiting") k(ch);
        k("enter");
        await settleApp(tui);
      },
      stop: () => tui.stop(),
    };
  };
  test("Allow and Decline on the selected row, through the same action", async () => {
    clearFill();
    app.db.query("DELETE FROM account_request WHERE state = 'waiting'").run();
    expect((await api("tuia")).status).toBe(202);
    expect((await api("tuib")).status).toBe(202);
    const h = open("ada");
    await h.palette();
    expect(h.text()).toContain("tuia");
    expect(h.text()).toContain("tuib");
    await h.press("a");
    expect(h.text()).toContain("tuia is in.");
    expect(getUserByName(app.db, "tuia")?.waitingAt).toBeNull();
    await h.press("d");
    expect(h.text()).toContain("tuib was declined");
    expect(getUserByName(app.db, "tuib")?.waitingAt).not.toBeNull();
    expect(waitingCount(app.db)).toBe(0);
    h.stop();
  });
  test("a non-admin is offered no Waiting screen", async () => {
    const h = open("plain");
    await h.palette();
    expect(h.text()).not.toContain("strangers who asked");
    h.stop();
  });
});
@@ -0,0 +1,164 @@
/**
 * Request access (#10928): in `request` mode a stranger asks for an account
 * and waits, with no credential, until an admin allows it; Decline keeps a
 * record and tells them politely. Proven by API and by page.
 */
import { afterAll, beforeAll, describe, expect, test } from "bun:test";
import { mkdtemp, rm } from "node:fs/promises";
import { tmpdir } from "node:os";
import { join } from "node:path";
import { createApp, type App } from "../src/app.ts";
import { setLimit } from "../src/settings/limits.ts";
import { getSignup, setSignup } from "../src/settings/signup.ts";
import { NEWCOMER_QUOTAS, quotaOf } from "../src/settings/quotas.ts";
import { getUserByName } from "../src/core/users.ts";
import { requestLines } from "../src/actions/requests.ts";
import { serve, type Servers } from "../src/http/server.ts";
import { adminCookie } from "./helpers/admin.ts";
import { roleOf } from "../src/core/roles.ts";
const ORIGIN = "https://forge.example";
const PASS = "a-good-passphrase-1";
describe("request access", () => {
  let dataDir: string;
  let app: App;
  let servers: Servers;
  let base: string;
  let admin: string;
  beforeAll(async () => {
    dataDir = await mkdtemp(join(tmpdir(), "forge-request-access-"));
    app = createApp({ dataDir, port: 0, url: ORIGIN });
    servers = await serve(app);
    setLimit(app.db, "signup.per_source", 1000, "setup");
    base = servers.url;
    admin = await adminCookie(app, { username: "ada", email: "[email protected]" });
    setSignup(app.db, "request", "boot");
  });
  afterAll(async () => {
    await servers.stop();
    app.close();
    await rm(dataDir, { recursive: true, force: true });
  });
  const api = (username: string, extra: Record<string, string> = {}) =>
    fetch(`${base}/api/v1/users`, {
      method: "POST",
      headers: { "content-type": "application/json", origin: ORIGIN },
      body: JSON.stringify({ username, password: PASS, ...extra }),
    });
  const form = (path: string, fields: Record<string, string>, cookie?: string) =>
    fetch(`${base}${path}`, {
      method: "POST",
      redirect: "manual",
      headers: { "content-type": "application/x-www-form-urlencoded", origin: ORIGIN, ...(cookie ? { cookie } : {}) },
      body: new URLSearchParams(fields),
    });
  const signIn = (username: string) => form("/signin", { username, password: PASS });
  test("the page asks for a note and the request page says so plainly, with no owner's name", async () => {
    const page = await fetch(`${base}/signup`).then((r) => r.text());
    expect(page).toContain("What do you want to build?");
    expect(page).toContain("Ask for an account");
    const res = await form("/signup", { username: "pagey", password: PASS, note: "a <b>shop</b> page" });
    expect(res.status).toBe(303);
    expect(res.headers.get("set-cookie")).toBeNull();
    expect(res.headers.get("location")).toBe("/signup/requested");
    const said = await fetch(`${base}/signup/requested`).then((r) => r.text());
    expect(said).toContain("Your request is in. Someone who runs this forge will look at it; you can close this page and sign in later to check.");
    expect(said).not.toContain("ada");
    // It waits: signing in shows the wait and starts no session.
    const again = await signIn("pagey");
    expect(again.status).toBe(200);
    expect(again.headers.get("set-cookie")).toBeNull();
    expect(await again.text()).toContain("still waiting");
    expect(getUserByName(app.db, "pagey")?.waitingAt).not.toBeNull();
  });
  test("by API: 202 waiting, no credential, the admin sees it listed and allows it with one POST", async () => {
    const res = await api("apiy", { note: "a game", from: "agent:friend" });
    expect(res.status).toBe(202);
    expect(((await res.json()) as { state: string }).state).toBe("waiting");
    const user = getUserByName(app.db, "apiy")!;
    expect(roleOf(app.db, user)).toBe("guest");
    // A waiting account has no way in at any door.
    const basic = `Basic ${btoa(`apiy:${PASS}`)}`;
    expect((await fetch(`${base}/api/v1/user`, { headers: { authorization: basic } })).status).toBe(401);
    const listed = (await fetch(`${base}/api/v1/admin/requests`, { headers: { cookie: admin } }).then((r) => r.json())) as {
      items: { username: string; note: string; source: string }[];
    };
    const mine = listed.items.find((i) => i.username === "apiy");
    expect(mine).toMatchObject({ note: "a game", source: "agent:friend" });
    // Not an admin's to read.
    expect((await fetch(`${base}/api/v1/admin/requests`)).status).toBe(404);
    expect(requestLines(app.db, getUserByName(app.db, "ada")!).some((l) => l.id === "request:apiy")).toBe(true);
    const done = await fetch(`${base}/api/v1/admin/requests/apiy/allow`, { method: "POST", headers: { cookie: admin, origin: ORIGIN } });
    expect(done.status).toBe(200);
    expect(getUserByName(app.db, "apiy")?.waitingAt).toBeNull();
    // Answered once: a second tap finds nothing waiting.
    expect((await fetch(`${base}/api/v1/admin/requests/apiy/allow`, { method: "POST", headers: { cookie: admin, origin: ORIGIN } })).status).toBe(409);
    // Allowed: a member under the small newcomer quotas, no model grant.
    expect(roleOf(app.db, getUserByName(app.db, "apiy")!)).toBe("member");
    expect(quotaOf(app.db, "apps", getUserByName(app.db, "apiy")!.id)).toBe(NEWCOMER_QUOTAS.apps);
    expect(quotaOf(app.db, "apps", getUserByName(app.db, "ada")!.id)).toBeNull();
    const ok = await fetch(`${base}/api/v1/user`, { headers: { authorization: basic } });
    expect(ok.status).toBe(200);
  });
  test("by page: Waiting shows name, note and source with Allow; allowing makes the next load say You're in, once", async () => {
    const accounts = await fetch(`${base}/settings/accounts`, { headers: { cookie: admin } }).then((r) => r.text());
    expect(accounts).toContain('id="waiting"');
    expect(accounts).toContain("pagey");
    expect(accounts).toContain("a &lt;b&gt;shop&lt;/b&gt; page");
    expect(accounts).toContain("/settings/accounts/pagey/allow");
    expect(accounts.indexOf('id="waiting"')).toBeLessThan(accounts.indexOf('id="accounts"'));
    // Only an admin, from this origin, may answer.
    expect(getUserByName(app.db, "pagey")?.waitingAt).not.toBeNull();
    const allow = await form("/settings/accounts/pagey/allow?back=home", {}, admin);
    expect(allow.status).toBe(303);
    const signedIn = await signIn("pagey");
    expect(signedIn.status).toBe(303);
    const cookie = (signedIn.headers.get("set-cookie") ?? "").split(";")[0]!;
    const home = await fetch(`${base}/`, { headers: { cookie } }).then((r) => r.text());
    expect(home).toContain('id="youre-in"');
    const next = await fetch(`${base}/`, { headers: { cookie } }).then((r) => r.text());
    expect(next).not.toContain('id="youre-in"');
  });
  test("Decline keeps a record, says no politely, and the account never acts", async () => {
    expect((await api("nope")).status).toBe(202);
    const res = await form("/settings/accounts/nope/decline", {}, admin);
    expect(res.status).toBe(303);
    const user = getUserByName(app.db, "nope")!;
    expect(user.waitingAt).not.toBeNull();
    const row = app.db.query<{ state: string }, [string]>("SELECT state FROM account_request WHERE user_id = ?1").get(user.id);
    expect(row?.state).toBe("declined");
    const shown = await signIn("nope");
    expect(shown.headers.get("set-cookie")).toBeNull();
    expect(await shown.text()).toContain("Thanks for asking");
    const list = (await fetch(`${base}/api/v1/admin/requests`, { headers: { cookie: admin } }).then((r) => r.json())) as { items: { username: string }[] };
    expect(list.items.find((i) => i.username === "nope")).toBeUndefined();
    expect((await fetch(`${base}/api/v1/admin/requests/nope/allow`, { method: "POST", headers: { cookie: admin, origin: ORIGIN } })).status).toBe(409);
  });
  test("the knob has four modes; invite links work in all but closed; open starts at once", async () => {
    expect(getSignup(app.db)).toBe("request");
    const settings = await fetch(`${base}/admin/limits`, { headers: { cookie: admin } }).then((r) => r.text());
    expect(settings).toContain('value="request"');
    setSignup(app.db, "open", "boot");
    const res = await api("opener");
    expect(res.status).toBe(201);
    const opener = getUserByName(app.db, "opener")!;
    expect(opener.waitingAt).toBeNull();
    // Open: a guest, who makes no repository, app or crew run until an admin promotes them.
    expect(roleOf(app.db, opener)).toBe("guest");
    setSignup(app.db, "closed", "boot");
    expect((await api("shut")).status).toBe(403);
    setSignup(app.db, "request", "boot");
  });
});
@@ -377,8 +377,8 @@
describe("a migration is a file named by a sortable id (#1837)", () => {
  test("two pulls' migrations land in either order and the schema ends the same", () => {
    // Two builders, each adding one migration at the second they wrote it:
    // a's after b's, so b sorts first whichever lands first.
    const a = { "20261015120000-deploy-note.ts": "CREATE TABLE deploy_note (id TEXT PRIMARY KEY, body TEXT NOT NULL DEFAULT '')" };
    const b = { "20261015110000-user-motto.ts": "ALTER TABLE user ADD COLUMN motto TEXT NOT NULL DEFAULT ''; CREATE INDEX user_motto ON user(motto)" };
    const a = { "20991231120000-deploy-note.ts": "CREATE TABLE deploy_note (id TEXT PRIMARY KEY, body TEXT NOT NULL DEFAULT '')" };
    const b = { "20991231110000-user-motto.ts": "ALTER TABLE user ADD COLUMN motto TEXT NOT NULL DEFAULT ''; CREATE INDEX user_motto ON user(motto)" };
    const both = listIn(directory({ ...a, ...b }));
    expect(both.length).toBe(migrations.length + 2);
@@ -397,12 +397,12 @@
describe("a migration is a file named by a sortable id (#1837)", () => {
    for (const path of [aFirst, bFirst, together]) {
      const db = new Database(path, { readonly: true, strict: true });
      const names = db
        .query<{ name: string }, []>("SELECT name FROM schema_migration WHERE name LIKE '2026101511%' OR name LIKE '2026101512%' ORDER BY name")
        .query<{ name: string }, []>("SELECT name FROM schema_migration WHERE name LIKE '2099123111%' OR name LIKE '2099123112%' ORDER BY name")
        .all()
        .map((row) => row.name);
      db.close();
      expect(names).toContain("20261015110000-user-motto");
      expect(names).toContain("20261015120000-deploy-note");
      expect(names).toContain("20991231110000-user-motto");
      expect(names).toContain("20991231120000-deploy-note");
    }
    const db = openDb(together, both);
    expect(has(db, "deploy_note")).toBe(true);
@@ -73,15 +73,15 @@
test("reads open, esc changes nothing, a confirm closes the door", async () => {
  const h = boot("alice");
  await h.open();
  expect(h.text()).toContain("signup: open");
  // picker, closed, then esc on the plan
  await h.press("s", "j", "j", "enter");
  // picker (open, request, invite, closed), closed, then esc on the plan
  await h.press("s", "j", "j", "j", "enter");
  expect(h.text()).toContain("from open to closed");
  await h.press("esc");
  expect(getSignup(forge.db)).toBe("open");
  // esc on the picker too
  await h.press("s", "esc");
  expect(getSignup(forge.db)).toBe("open");
  await h.press("s", "j", "j", "enter", "enter");
  await h.press("s", "j", "j", "j", "enter", "enter");
  expect(getSignup(forge.db)).toBe("closed");
  expect(signupClosed({ db: forge.db } as never)).toBe(true);
  expect(h.text()).toContain("signup: closed");
		@@ -42,6 +42,7 @@ bytes in `tools/list`. After changing a tool run `bun scripts/mcp-table.ts`;
42	42	\| Tool \| Actions / kinds \| Purpose \| Bytes \|
43	43	\| --- \| --- \| --- \| ---: \|
44	44	\| `access` \| — \| Non-browser public-path requests, redacted, newest first (max 500) \| 235 \|
	45	\| `account_requests` \| — \| List who asked for an account and wait; `answer: allow\\|decline` answers one \| 250 \|
45	46	\| `account_role` \| — \| Make a person a member or a guest; promoting may grant `usdPerMonth` \| 374 \|
46	47	\| `account_suspend` \| — \| Suspend an account; `suspended: false` lifts \| 231 \|
47	48	\| `account_verify` \| — \| Mark a person's email verified (admin) \| 181 \|
		@@ -193,7 +194,7 @@ bytes in `tools/list`. After changing a tool run `bun scripts/mcp-table.ts`;
193	194	\| `sessions` \| `list`, `end`, `end_idle`, `signins`, `shells` \| Where you are signed in: your tokens and browsers, never a secret; `username` for a person as owner; action end + id signs a browser out \| 385 \|
194	195	\| `sever` \| — \| Unlink a spawned forge from its parent (owner of its `forge` repo only) \| 214 \|
195	196	\| `share` \| — \| Share a feed item: no `to` tells the app's crew and owners, else followers; budgeted \| 258 \|
196		\| `signup` \| — \| Sign-ups: open (default); invite lets in only a person with an open invite link; closed refuses every new account \| 281 \|
	197	\| `signup` \| — \| Sign-ups: open (default); invite lets in only a person with an open invite link; closed refuses every new account \| 291 \|
197	198	\| `sizes` \| — \| A child forge's sizes: small, medium and large, each with CPU, memory and disk \| 196 \|
198	199	\| `snapshot_now` \| — \| Take a snapshot now, as Backups does (admin) \| 133 \|
199	200	\| `spawn` \| — \| Spawn a child forge \| 824 \|
		@@ -130,6 +130,7 @@ Machine routes are not pages and have no entry: `/audit.csv`,
130	130	- `/login` — `http/server.ts` (`signinAlias`) · the address people type to sign in · it is `/signin`, keeping a same-origin `next` · none (308, no page of its own).
131	131	- `/sign-in` — `http/server.ts` (`signinAlias`) · the same, hyphenated · it is `/signin` · none (308, no page of its own).
132	132	- `/signup` — `pages/site.ts` · make an account · `/signup` passkey flow (`signup-passkey.ts`) · colours 3 (file).
	133	- `/signup/requested` — `pages/site.ts` · what a stranger whose request waits is told · `/signin` · colours 3 (file).
133	134	- `/verify` — `pages/site.ts` · confirm an email address · none · colours 3 (file).
134	135	- `/recover` — `pages/passkeys.ts` · get back in without a password · `/settings/passkeys` · none seen.
135	136	- `/settings` — `pages/account.ts` · my account · the rest of settings · colour 1.
		@@ -0,0 +1,29 @@
	1	# Request access (#10928)
	2
	3	`New accounts` has four modes (Admin → Limits, `signup` over MCP and `PATCH /api/v1/admin/settings`):
	4
	5	\| mode \| meaning \|
	6	\| --- \| --- \|
	7	\| `open` \| anyone can make an account and starts at once; a new account is a guest \|
	8	\| `request` \| anyone can ask for an account; it waits until an admin allows it \|
	9	\| `invite` \| only a person with an invite link can make an account \|
	10	\| `closed` \| no new accounts \|
	11
	12	Invite links keep working in every mode but `closed`; in `request` an open invite is a vouch, so its holder starts at once.
	13
	14	## A stranger
	15	`/signup` in `request` mode asks for a username, a password or passkey, and an optional "What do you want to build?". The account is made waiting (`user.waiting_at`): `isActive` is false, so no session, token, key or password opens anything. They land on `/signup/requested`: "Your request is in. Someone who runs this forge will look at it; you can close this page and sign in later to check." Signing in (password or passkey) while waiting shows the wait and starts no session; after Decline it says so politely. After Allow the next sign-in works, and home says "You're in." once.
	16
	17	`POST /api/v1/users` answers `202 {state:"waiting", username, message}`; it takes `note` and `from` (the forge or agent asking). The terminal's create screen says the same sentence.
	18
	19	## The admin
	20	- The notifier sends a line for each of the first three waiting requests, then one count line ("N people ask for an account") that moves only every 25 more (`crew/notify.ts`, `requestLines`), linking to the Waiting list.
	21	- The terminal's Waiting screen (palette, `src/tui/screens/requests.ts`): `a` allows, `d` declines, through the same actions.
	22	- The Waiting list is on top of Settings → Accounts and in home's "Needs you": name, note, when, from where, with Allow and Decline one tap each.
	23	- API: `GET /api/v1/admin/requests`, `POST /api/v1/admin/requests/:username/allow\|decline`; MCP: `account_requests`.
	24	- Allow makes the person a member (small quotas, no model grant: the crew spends nothing until an admin gives credits). Decline keeps the record (`account_request`).
	25
	26	## Limits
	27	At most 200 requests wait (`WAITING_CAP`): past that a stranger meets the closed door, except one holding an open invite, until the admin answers some. Updating a forge that stored `closed` leaves it `closed`; the migration changes no setting.
	28
	29	`NEWCOMER_QUOTAS` (`settings/quotas.ts`: 3 repositories, 2 apps, 200 MB, 1 preview, 1 run, 1 check) hold an account that was allowed from a request, unless the admin stored a quota of their own, which wins for everyone. Admins, existing members and guests are unchanged.
		@@ -7,7 +7,7 @@
7	7	*/
8	8
9	9	import type { App } from "../app.ts";
10		import { getQuota } from "../settings/quotas.ts";
	10	import { quotaOf } from "../settings/quotas.ts";
11	11	import type { User } from "../core/users.ts";
12	12	import { err, ok, type Result } from "../kernel/result.ts";
13	13
		@@ -24,7 +24,7 @@ export function appsOwnedBy(app: App, ownerId: string): number {
24	24
25	25	/** The refusal, in words: the limit and the count, e.g. "3 of 3 apps". */
26	26	export function appLimitWords(app: App, ownerId: string): string {
27		const limit = getQuota(app.db, "apps") ?? 0;
	27	const limit = quotaOf(app.db, "apps", ownerId) ?? 0;
28	28	return `This account is at its limit: ${Math.min(appsOwnedBy(app, ownerId), limit)} of ${limit} apps. Remove one to make room.`;
29	29	}
30	30
		@@ -35,7 +35,7 @@ export function requireAppRoom(
35	35	ownerId: string,
36	36	): Result<void, "app_limit"> {
37	37	if (actor.isAdmin) return ok();
38		const limit = getQuota(app.db, "apps");
	38	const limit = quotaOf(app.db, "apps", ownerId);
39	39	if (limit === null \|\| appsOwnedBy(app, ownerId) < limit) return ok();
40	40	return err("app_limit");
41	41	}
		@@ -0,0 +1,81 @@
	1	/**
	2	* Answering a stranger's request for an account, for a forge admin who is a
	3	* person (an agent and everyone else is told `not_found`). Every door calls
	4	* these: the page's buttons, the API and MCP.
	5	*/
	6
	7	import type { Database } from "bun:sqlite";
	8	import type { App } from "../app.ts";
	9	import { answerRequest, waitingRequests, type AccountRequest } from "../core/requests.ts";
	10	import { setMember } from "../core/roles.ts";
	11	import { getUserByName, type User } from "../core/users.ts";
	12	import { err, ok, type Result } from "../kernel/result.ts";
	13
	14	export type RequestError = "not_found" \| "not_waiting";
	15
	16	function admin(actor: User \| undefined): Result<User, "not_found"> {
	17	return actor?.isAdmin === true && actor.kind === "user" ? ok(actor) : err("not_found");
	18	}
	19
	20	export function listRequests(app: App, actor: User \| undefined): Result<AccountRequest[], "not_found"> {
	21	const who = admin(actor);
	22	return who.ok ? ok(waitingRequests(app.db)) : who;
	23	}
	24
	25	function answer(
	26	app: App,
	27	actor: User \| undefined,
	28	username: string,
	29	state: "allowed" \| "declined",
	30	): Result<AccountRequest, RequestError> {
	31	const who = admin(actor);
	32	if (!who.ok) return who;
	33	const done = answerRequest(app.db, username, state, who.value.id, new Date().toISOString());
	34	if (done === undefined) return err("not_waiting");
	35	// Allowed, they are a member under the newcomer's small quotas and with
	36	// no model grant: they can make things, and the crew spends nothing until
	37	// an admin gives credits.
	38	if (state === "allowed") {
	39	const person = getUserByName(app.db, username);
	40	if (person !== undefined) setMember(app.db, person.id, true, who.value.id, new Date());
	41	}
	42	app.bus.append({
	43	kind: state === "allowed" ? "account.allowed" : "account.declined",
	44	actorId: who.value.id,
	45	payload: { username: done.username },
	46	});
	47	return ok(done);
	48	}
	49
	50	export const allowRequest = (app: App, actor: User \| undefined, username: string) =>
	51	answer(app, actor, username, "allowed");
	52
	53	export const declineRequest = (app: App, actor: User \| undefined, username: string) =>
	54	answer(app, actor, username, "declined");
	55
	56	/** Past this many waiting, the phone hears one count line, not one per person. */
	57	export const LINES_EACH = 3;
	58
	59	/**
	60	* What an admin's phone hears at once: a line per request while a few wait,
	61	* then one line with the count (its id moves on every 25 more), linking to
	62	* the Waiting list where Allow and Decline are one tap. The notifier sends
	63	* each id once (`crew/notify.ts`), so a flood cannot spam the phone.
	64	*/
	65	export function requestLines(
	66	db: Database,
	67	user: User,
	68	): { id: string; line: string; items: readonly string[]; link: string }[] {
	69	if (!user.isAdmin \|\| user.kind !== "user") return [];
		sentinelcrew 1d ago outdated One notifier line per waiting request lets a flood spam the admin's phone. Collapse to a single count line past a few.
	70	const link = "/settings/accounts#waiting";
	71	const waiting = waitingRequests(db);
	72	if (waiting.length > LINES_EACH) {
	73	const id = `request:many:${Math.ceil(waiting.length / 25)}`;
	74	return [{ id, line: `${waiting.length} people ask for an account`, items: [id], link }];
	75	}
	76	return waiting.map((r) => {
	77	const id = `request:${r.username}`;
	78	const note = r.note === "" ? "" : `: ${r.note.slice(0, 120)}`;
	79	return { id, line: `${r.username} asks for an account${note}`, items: [id], link };
	80	});
	81	}
		@@ -27,6 +27,7 @@ import {
27	27	import { mintViaToken, VIA_TOKEN_MAX_MS } from "../core/via_token.ts";
28	28	import { id } from "../kernel/id.ts";
29	29	import { inviteSpentBy } from "../core/invites.ts";
	30	import { cleanAsk, NOTE_MAX, SOURCE_MAX } from "../core/requests.ts";
30	31	import {
31	32	changePassword as rehash,
32	33	cleanDisplayName,
		@@ -52,6 +53,9 @@ export interface SignUpInput {
52	53	password: string;
53	54	/** The Turnstile token the browser's widget gave; read only when a secret is set. */
54	55	humanToken?: string;
	56	/** While signup is `request`: what they want to build, and which forge or agent asks (`core/requests.ts`). */
	57	note?: string;
	58	source?: string;
55	59	}
56	60
57	61	export type SignUpError =
		@@ -64,6 +68,18 @@ export type SignUpError =
64	68	/** What anyone is told when the forge makes no new accounts. */
65	69	export const SIGNUP_CLOSED_MESSAGE = "Signup is closed on this forge.";
66	70
	71	/** What a stranger whose request is in is told, plainly and with no one's name. */
	72	export const REQUEST_IN_MESSAGE =
	73	"Your request is in. Someone who runs this forge will look at it; you can close this page and sign in later to check.";
	74	/** What a waiting person sees when they sign in before an answer. */
	75	export const STILL_WAITING_MESSAGE =
	76	"Your request is still waiting. Someone who runs this forge will look at it; you can close this page and sign in later to check.";
	77	/** What a person is told once, when they sign in after Allow. */
	78	export const YOURE_IN_MESSAGE = "You're in.";
	79	/** What a person is told, politely, when the answer was no. */
	80	export const DECLINED_MESSAGE =
	81	"Thanks for asking. This forge isn't able to open an account for you right now. You can still run a forge of your own, and suggest a change to any public app here without an account.";
	82
67	83	/**
68	84	* Whether no new account may be made now. Read from the store on every call,
69	85	* so a change takes effect on the next request. While signup is `invite`, an
		@@ -148,6 +164,7 @@ export async function signUp(
148	164	origin: "signup",
149	165	slot: from.slot,
150	166	invite: from.invite,
	167	ask: { note: cleanAsk(input.note, NOTE_MAX), source: cleanAsk(input.source, SOURCE_MAX) },
151	168	});
152	169	if (!created.ok) return created;
153	170	app.bus.append({
		@@ -155,13 +172,14 @@ export async function signUp(
155	172	actorId: created.value.id,
156	173	payload: {
157	174	via: "signup",
	175	...(created.value.waitingAt === null ? {} : { waiting: true }),
158	176	...(from.address === undefined ? {} : { address: from.address }),
159	177	},
160	178	});
161	179	auditInvite(app, created.value.id);
162	180	// The address is proven by the link it is sent; until then nothing it
163		// does may create or cost.
164		if (email !== "") await welcome(app, created.value);
	181	// does may create or cost. A waiting account is mailed nothing yet.
	182	if (email !== "" && created.value.waitingAt === null) await welcome(app, created.value);
165	183	return created;
166	184	}
167	185
		@@ -172,6 +190,8 @@ export interface PasskeySignUpInput {
172	190	passkey: Credential;
173	191	passkeyName: string;
174	192	humanToken?: string;
	193	note?: string;
	194	source?: string;
175	195	}
176	196
177	197	/**
		@@ -202,6 +222,7 @@ export async function signUpWithPasskey(
202	222	origin: "passkey",
203	223	slot: from.slot,
204	224	invite: from.invite,
	225	ask: { note: cleanAsk(input.note, NOTE_MAX), source: cleanAsk(input.source, SOURCE_MAX) },
205	226	});
206	227	if (!created.ok) return created;
207	228	const kept = addPasskey(app.db, created.value.id, input.passkeyName, input.passkey);
		@@ -214,12 +235,13 @@ export async function signUpWithPasskey(
214	235	actorId: created.value.id,
215	236	payload: {
216	237	via: "signup",
	238	...(created.value.waitingAt === null ? {} : { waiting: true }),
217	239	...(from.address === undefined ? {} : { address: from.address }),
218	240	},
219	241	});
220	242	auditInvite(app, created.value.id);
221	243	// As on the password path: no address given, no link to send.
222		if (email !== "") await welcome(app, created.value);
	244	if (email !== "" && created.value.waitingAt === null) await welcome(app, created.value);
223	245	return created;
224	246	}
225	247
		@@ -402,7 +424,7 @@ export async function changePassword(
402	424	password: input.current,
403	425	source: input.source,
404	426	});
405		if (!verified.ok) return err(verified.error.reason);
	427	if (!verified.ok) return err(verified.error.reason === "waiting" ? "bad_credentials" : verified.error.reason);
406	428	const changed = await rehash(app.db, user.value.id, input.next);
407	429	if (!changed.ok)
408	430	return err(
		@@ -0,0 +1,9 @@
	1	import type { Route } from "../shared.ts";
	2
	3	export const route: Route = {
	4	method: "get",
	5	path: "/api/v1/admin/requests",
	6	summary: "The strangers waiting for an account, oldest first (a forge admin's, read scope; anyone else gets 404); answers { items: [{ username, note, source, state, askedAt, decidedAt }], next_cursor }",
	7	auth: true,
	8	role: "admin",
	9	};
		@@ -47,6 +47,7 @@ export { route as getApiV1AdminPeople } from "./getApiV1AdminPeople.ts";
47	47	export { route as getApiV1AdminPinned } from "./getApiV1AdminPinned.ts";
48	48	export { route as getApiV1AdminProfile } from "./getApiV1AdminProfile.ts";
49	49	export { route as getApiV1AdminQuotas } from "./getApiV1AdminQuotas.ts";
	50	export { route as getApiV1AdminRequests } from "./getApiV1AdminRequests.ts";
50	51	export { route as getApiV1AdminSettings } from "./getApiV1AdminSettings.ts";
51	52	export { route as getApiV1AdminShield } from "./getApiV1AdminShield.ts";
52	53	export { route as getApiV1AdminSubscriptions } from "./getApiV1AdminSubscriptions.ts";
		@@ -242,6 +243,8 @@ export { route as postApiV1AdminPinnedNameCheck } from "./postApiV1AdminPinnedNa
242	243	export { route as postApiV1AdminPinnedNameRollback } from "./postApiV1AdminPinnedNameRollback.ts";
243	244	export { route as postApiV1AdminPinnedNameUpdate } from "./postApiV1AdminPinnedNameUpdate.ts";
244	245	export { route as postApiV1AdminReleasesShaRollback } from "./postApiV1AdminReleasesShaRollback.ts";
	246	export { route as postApiV1AdminRequestsUsernameAllow } from "./postApiV1AdminRequestsUsernameAllow.ts";
	247	export { route as postApiV1AdminRequestsUsernameDecline } from "./postApiV1AdminRequestsUsernameDecline.ts";
245	248	export { route as postApiV1Agents } from "./postApiV1Agents.ts";
246	249	export { route as postApiV1Apps } from "./postApiV1Apps.ts";
247	250	export { route as postApiV1AsksBulk } from "./postApiV1AsksBulk.ts";
		@@ -0,0 +1,10 @@
	1	import type { Route } from "../shared.ts";
	2
	3	export const route: Route = {
	4	method: "post",
	5	path: "/api/v1/admin/requests/{username}/allow",
	6	summary: "Allow a waiting request for an account (admin scope); answers the request as it now stands",
	7	auth: true,
	8	role: "admin",
	9	refusals: { not_waiting: "that request was answered already, or never waited (409)" },
	10	};
		@@ -4,11 +4,11 @@ export const route: Route = {
4	4	method: "post",
5	5	path: "/api/v1/users",
6	6	summary:
7		"Sign up: answers 201 with the new account { id, username, displayName, isAdmin, commitEmail }, never the admin; `email` is optional; `invite` is an invite link's token, `turnstile_token` the human check when the forge asks for one; refused from another origin with 403 forbidden",
	7	"Sign up: while the forge takes requests (signup `request`) answers 202 { state: 'waiting', username, message } and the account waits for an admin to allow it; otherwise answers 201 with the new account { id, username, displayName, isAdmin, commitEmail }, never the admin; `email` is optional; `invite` is an invite link's token, `turnstile_token` the human check when the forge asks for one; refused from another origin with 403 forbidden",
8	8	auth: false,
9	9	role: "anonymous",
10	10	status: 201,
11		body: { username: "string", email: "string", password: "string", invite: "string", turnstile_token: "string" },
	11	body: { username: "string", email: "string", password: "string", invite: "string", note: "string", from: "string", turnstile_token: "string" },
12	12	refusals: {
13	13	rate_limited: "429, too many sign-ups; retry-after says when",
14	14	too_large: "413, the body is over the limit for a stranger's",