Add DocWeave authentication integration, dynamic workspace selection, search, Dockerfile, and HF Spaces config

.env.example

@@ -0,0 +1,45 @@
+# =============================================================================
+# DiffWeave Configuration (.env)
+# Semantic Version Control & PR Review Deck for DocWeave Knowledge
+# =============================================================================
+
+# -----------------------------------------------------------------------------
+# 1. Connection Mode (Remote MCP Server vs. Local DocWeave)
+# -----------------------------------------------------------------------------
+# For deployed / cloud instances (e.g. Hugging Face Spaces or custom domain):
+# DOCWEAVE_MCP_URL=https://your-docweave.hf.space
+# DOCWEAVE_API_KEY=your-docweave-personal-access-token
+
+# For local development with DocWeave on the same machine:
+DOCWEAVE_BACKEND_DIR=../DocWeave/backend
+DOCWEAVE_BACKEND_URL=http://localhost:8000
+
+# -----------------------------------------------------------------------------
+# 2. Database & Auth (Shared with DocWeave for Unified Identity)
+# -----------------------------------------------------------------------------
+# Shared Neon PostgreSQL database URL
+DATABASE_URL=postgresql://neondb_owner:npg_LP1rgDY6JsTV@ep-morning-shadow-azegcix7-pooler.c-3.ap-southeast-1.aws.neon.tech/neondb?sslmode=require
+
+# JWT Secret Key (Must match DocWeave SECRET_KEY to verify tokens)
+SECRET_KEY=b1c482a537917a24274fa65e7c7fbe5dcce1e97a1e16c662dd470872e8f76fdf
+ALGORITHM=HS256
+ACCESS_TOKEN_EXPIRE_MINUTES=480
+
+# -----------------------------------------------------------------------------
+# 3. Workspace Defaults
+# -----------------------------------------------------------------------------
+# Default target workspace ID (e.g., Cardiology workspace)
+DIFFWEAVE_WORKSPACE_ID=3e24fa72-b6c2-4427-9e44-b26a997fd205
+
+# -----------------------------------------------------------------------------
+# 4. DiffWeave Studio Server Bridge
+# -----------------------------------------------------------------------------
+PORT=7860
+HOST=127.0.0.1
+
+# -----------------------------------------------------------------------------
+# 5. Email & Notification Delivery (Optional - for DocWeave OTP / email verification)
+# -----------------------------------------------------------------------------
+# RESEND_API_KEY=re_your_api_key_here
+# SMTP_FROM=DocWeave <noreply@doc-weave.xyz>
+# FRONTEND_URL=http://localhost:7860

Dockerfile

@@ -22,15 +22,8 @@ RUN apt-get update && apt-get install -y --no-install-recommends \
     && rm -rf /var/lib/apt/lists/*
 
 # Install Python backend dependencies
-COPY pyproject.toml ./
-RUN pip install --no-cache-dir \
-    fastapi==0.115.0 \
-    uvicorn==0.30.6 \
-    pydantic==2.8.2 \
-    httpx==0.27.2 \
-    typer==0.12.5 \
-    rich==13.8.0 \
-    python-multipart==0.0.9
+COPY requirements.txt ./
+RUN pip install --no-cache-dir -r requirements.txt
 
 # Copy DiffWeave application package
 COPY diffweave ./diffweave

README.md

@@ -63,10 +63,25 @@ DiffWeave is built on top of the **DocWeave** document intelligence engine via t
 
 ## Quickstart
 
-### 1. Requirements
+### 1. Requirements & Environment Configuration
 - Python 3.10+
 - Node.js 18+ (for Studio UI development)
-- DocWeave engine backend (or run in embedded standalone mode)
+- DocWeave engine backend (or run in standalone / remote cloud mode)
+
+Copy `.env.example` to `.env` to configure your environment:
+```bash
+cp .env.example .env
+```
+
+| Variable | Description | Default / Example |
+| :--- | :--- | :--- |
+| `DATABASE_URL` | Neon PostgreSQL connection string (shared with DocWeave) | `postgresql://...` |
+| `SECRET_KEY` | JWT secret for token verification (shared with DocWeave) | `b1c482a...` |
+| `DOCWEAVE_MCP_URL` | Remote DocWeave MCP server URL (for deployed cloud mode) | `https://your-docweave.hf.space` |
+| `DOCWEAVE_API_KEY` | Personal Access Token (for CI/CD or automated pipelines) | `dw_pat_...` |
+| `DOCWEAVE_BACKEND_DIR` | Path to local DocWeave backend (for in-process dev) | `../DocWeave/backend` |
+| `DIFFWEAVE_WORKSPACE_ID`| Default workspace ID to bind | `3e24fa72-b6c2-4427-9e44-b26a997fd205` |
+| `PORT` | DiffWeave Studio port | `7860` |
 
 ### 2. CLI Setup
 Run diagnostic checks to verify connectivity to DocWeave:

diffweave/__init__.py

@@ -3,3 +3,9 @@ DiffWeave — A Git-Like Developer Platform for DocWeave.
 """
 
 __version__ = "0.1.0"
+
+try:
+    from dotenv import load_dotenv
+    load_dotenv()
+except ImportError:
+    pass

diffweave/bridge/app.py

@@ -1,4 +1,4 @@
-"""
+"""
 FastAPI Server Bridge for DiffWeave Studio.
 
 Provides secure, authenticated, workspace-scoped REST APIs that
@@ -68,231 +68,241 @@ class CreateRuleRequest(BaseModel):
 
 
 # ---------------------------------------------------------------------------
-# Authentication & API Key Management
+# Authentication -- Complete DocWeave Authentication Engine
 # ---------------------------------------------------------------------------
+import json as _json
+from fastapi import Request as _Request, Header
+from fastapi.responses import Response as _Response
+from diffweave.bridge import docweave_auth
+from diffweave.cli.credentials import save_credentials, clear_credentials
 
-class SignupRequest(BaseModel):
-    username: str
-    email: str
-    password: str
+_DOCWEAVE_URL = os.environ.get("DOCWEAVE_BACKEND_URL", "http://localhost:8000")
 
+@app.post("/api/auth/send-otp")
+async def send_otp_endpoint(request: _Request):
+    body = await request.json()
+    try:
+        res = docweave_auth.send_otp(
+            email=body.get("email", ""),
+            username=body.get("username", ""),
+            password=body.get("password", ""),
+        )
+        return res
+    except ValueError as e:
+        raise HTTPException(status_code=400, detail=str(e))
+    except Exception as e:
+        raise HTTPException(status_code=500, detail=f"Auth error: {str(e)}")
 
-@app.post("/api/auth/signup")
-async def signup_endpoint(req: SignupRequest):
-    user_email = req.email.strip().lower()
-    username = req.username.strip()
-    api_key = f"dw_live_{secrets.token_hex(16)}"
-    mcp_url = os.environ.get("DOCWEAVE_MCP_URL", "http://127.0.0.1:7860")
-    
+@app.post("/api/auth/verify-otp")
+async def verify_otp_endpoint(request: _Request):
+    body = await request.json()
     try:
-        save_credentials(
-            access_token=api_key,
-            email=user_email,
-            username=username,
-            mcp_url=mcp_url,
+        res = docweave_auth.verify_otp(
+            email=body.get("email", ""),
+            code=body.get("code", ""),
         )
-        cli_synced = True
-    except Exception:
-        cli_synced = False
-        
-    return {
-        "access_token": api_key,
-        "api_key": api_key,
-        "username": username,
-        "email": user_email,
-        "role": "Architect",
-        "provider": "docweave-identity",
-        "cli_command": f"dw login --api-key {api_key}",
-        "cli_synced": cli_synced,
-        "credentials_path": str(get_credentials_file()),
-    }
+        return res
+    except ValueError as e:
+        raise HTTPException(status_code=400, detail=str(e))
+    except Exception as e:
+        raise HTTPException(status_code=500, detail=f"Verification error: {str(e)}")
 
+@app.post("/api/auth/signup")
+async def signup_endpoint(request: _Request):
+    body = await request.json()
+    try:
+        res = docweave_auth.send_otp(
+            email=body.get("email", ""),
+            username=body.get("username", ""),
+            password=body.get("password", ""),
+        )
+        return res
+    except ValueError as e:
+        raise HTTPException(status_code=400, detail=str(e))
 
-class LoginRequest(BaseModel):
-    username: str
-    password: Optional[str] = None
-    email: Optional[str] = None
+@app.post("/api/auth/login")
+async def login_endpoint(request: _Request):
+    """
+    DocWeave login: accepts both OAuth2 form data (username, password)
+    and JSON bodies (email/username, password).
+    """
+    content_type = request.headers.get("content-type", "")
+    username = ""
+    password = ""
+    if "application/x-www-form-urlencoded" in content_type:
+        form = await request.form()
+        username = form.get("username", "")
+        password = form.get("password", "")
+    else:
+        try:
+            data = await request.json()
+            username = data.get("username") or data.get("email", "")
+            password = data.get("password", "")
+        except Exception:
+            pass
 
+    if not username or not password:
+        raise HTTPException(status_code=400, detail="Username/Email and password are required.")
 
-class GenerateKeyRequest(BaseModel):
-    name: Optional[str] = "CLI Personal Access Token"
-    expires_in_days: Optional[int] = 90
+    try:
+        result = docweave_auth.login(username, password)
+        return result
+    except ValueError as e:
+        raise HTTPException(status_code=401, detail=str(e))
+    except Exception as e:
+        raise HTTPException(status_code=500, detail=f"Login failed: {str(e)}")
 
+@app.post("/api/auth/demo-login")
+async def demo_login_endpoint():
+    try:
+        return docweave_auth.demo_login()
+    except Exception as e:
+        raise HTTPException(status_code=500, detail=f"Demo login failed: {str(e)}")
 
-class SyncCLIRequest(BaseModel):
-    access_token: str
-    email: Optional[str] = None
-    username: Optional[str] = None
-    mcp_url: Optional[str] = None
+@app.get("/api/auth/me")
+@app.get("/api/auth/whoami")
+async def auth_me_endpoint(authorization: str = Header(None)):
+    if not authorization or not authorization.startswith("Bearer "):
+        raise HTTPException(status_code=401, detail="Authentication token required.")
+    token = authorization.split(" ", 1)[1].strip()
+    user = docweave_auth.get_current_user_from_token(token)
+    if not user:
+        raise HTTPException(status_code=401, detail="Invalid or expired token.")
+    return user
+
+@app.post("/api/auth/forgot-password")
+async def forgot_password_endpoint(request: _Request):
+    body = await request.json()
+    return docweave_auth.forgot_password(body.get("email", ""))
+
+@app.post("/api/auth/reset-password")
+async def reset_password_endpoint(request: _Request):
+    body = await request.json()
+    try:
+        return docweave_auth.reset_password(body.get("token", ""), body.get("new_password", ""))
+    except ValueError as e:
+        raise HTTPException(status_code=400, detail=str(e))
 
+@app.post("/api/auth/logout")
+async def logout_endpoint():
+    return docweave_auth.logout()
 
-@app.post("/api/auth/demo-login")
-async def demo_login():
-    api_key = f"dw_live_demo_{secrets.token_hex(16)}"
-    username = "DocWeave Evaluator"
+@app.post("/api/auth/generate-key")
+async def generate_key_endpoint(request: _Request, authorization: str = Header(None)):
+    token = ""
     email = "evaluator@docweave.io"
-    mcp_url = os.environ.get("DOCWEAVE_MCP_URL", "http://127.0.0.1:7860")
-    
+    username = "DocWeave User"
+    if authorization and authorization.startswith("Bearer "):
+        token = authorization.split(" ", 1)[1].strip()
+        user = docweave_auth.get_current_user_from_token(token)
+        if user:
+            email = user.get("email", email)
+            username = user.get("username", username)
+    if not token:
+        token = f"dw_pat_{uuid.uuid4().hex}"
+
     try:
         save_credentials(
-            access_token=api_key,
+            access_token=token,
             email=email,
             username=username,
-            mcp_url=mcp_url,
+            api_key=token,
         )
-        cli_synced = True
     except Exception:
-        cli_synced = False
-        
-    return {
-        "access_token": api_key,
-        "api_key": api_key,
-        "username": username,
-        "email": email,
-        "role": "Evaluator / Architect",
-        "provider": "docweave-sso",
-        "cli_command": f"dw login --token {api_key}",
-        "cli_synced": cli_synced,
-        "credentials_path": str(get_credentials_file()),
-    }
+        pass
 
-
-@app.post("/api/auth/login")
-async def login_endpoint(req: LoginRequest):
-    user_email = req.email or req.username
-    username = req.username if "@" not in req.username else req.username.split("@")[0]
-    api_key = f"dw_live_{secrets.token_hex(16)}"
-    mcp_url = os.environ.get("DOCWEAVE_MCP_URL", "http://127.0.0.1:7860")
-    
-    try:
-        save_credentials(
-            access_token=api_key,
-            email=user_email,
-            username=username,
-            mcp_url=mcp_url,
-        )
-        cli_synced = True
-    except Exception:
-        cli_synced = False
-        
     return {
-        "access_token": api_key,
-        "api_key": api_key,
+        "status": "success",
+        "api_key": token,
+        "token_type": "personal_access_token",
         "username": username,
-        "email": user_email,
-        "role": "Developer",
-        "provider": "docweave-sso",
-        "cli_command": f"dw login --token {api_key}",
-        "cli_synced": cli_synced,
-        "credentials_path": str(get_credentials_file()),
-    }
-
-
-@app.post("/api/auth/generate-key")
-async def generate_key_endpoint(req: GenerateKeyRequest):
-    api_key = f"dw_live_{secrets.token_hex(16)}"
-    creds = load_credentials() or {}
-    synced = False
-    if creds:
-        try:
-            save_credentials(
-                access_token=api_key,
-                email=creds.get("email"),
-                username=creds.get("username"),
-                mcp_url=creds.get("mcp_url"),
-            )
-            synced = True
-        except Exception:
-            pass
-            
-    return {
-        "name": req.name,
-        "api_key": api_key,
-        "created_at": datetime.utcnow().isoformat() + "Z",
-        "expires_in_days": req.expires_in_days,
-        "cli_command": f"dw login --token {api_key}",
-        "cli_synced": synced,
-        "credentials_path": str(get_credentials_file()),
+        "email": email,
+        "created_at": datetime.utcnow().isoformat(),
+        "instructions": "Set DIFFWEAVE_API_KEY in terminal or run 'diffweave auth login'.",
     }
 
-
 @app.post("/api/auth/sync-cli")
-async def sync_cli_endpoint(req: SyncCLIRequest):
+async def sync_cli_endpoint(request: _Request):
+    body = await request.json()
+    token = body.get("access_token", "")
+    email = body.get("email", "evaluator@docweave.io")
+    username = body.get("username", "Evaluator")
     try:
         save_credentials(
-            access_token=req.access_token,
-            email=req.email,
-            username=req.username,
-            mcp_url=req.mcp_url or "http://127.0.0.1:7860",
+            access_token=token,
+            email=email,
+            username=username,
+            api_key=token,
         )
-        return {
-            "status": "ok",
-            "synced": True,
-            "path": str(get_credentials_file()),
-            "username": req.username,
-            "token_preview": req.access_token[:12] + "...",
-        }
     except Exception as e:
         raise HTTPException(status_code=500, detail=str(e))
-
-
-@app.get("/api/auth/whoami")
-async def get_whoami_endpoint():
-    creds = load_credentials()
-    if not creds:
-        return {"authenticated": False, "user": None}
-    return {
-        "authenticated": True,
-        "user": {
-            "username": creds.get("username", "Authenticated User"),
-            "email": creds.get("email", ""),
-            "access_token": creds.get("access_token", ""),
-            "mcp_url": creds.get("mcp_url", ""),
-        },
-        "credentials_path": str(get_credentials_file()),
-    }
-
-
-@app.post("/api/auth/logout")
-async def logout_endpoint():
-    clear_credentials()
-    return {"status": "ok", "message": "Logged out and cleared credentials."}
-
-
-# ---------------------------------------------------------------------------
-# Health & MCP Meta
-# ---------------------------------------------------------------------------
-
-@app.get("/api/health")
-async def health_check():
-    return {"status": "ok", "service": "diffweave-bridge", "mcp_connected": True}
-
-
-@app.get("/api/mcp/tools")
-async def list_mcp_tools():
-    """Discover all MCP tools exposed by the underlying DocWeave server."""
-    from mcp_server import list_tools
-    tools = await list_tools()
-    return [
-        {
-            "name": t.name,
-            "description": t.description,
-            "inputSchema": t.inputSchema,
-        }
-        for t in tools
-    ]
-
+    return {"status": "synced", "cli_config": "~/.diffweave/credentials.json"}
 
 # ---------------------------------------------------------------------------
 # Workspaces
 # ---------------------------------------------------------------------------
 
 @app.get("/api/workspaces")
-async def get_workspaces():
+async def get_workspaces(authorization: str = Header(None)):
     try:
+        from sqlalchemy import text
+        user = None
+        if authorization and authorization.startswith("Bearer "):
+            token = authorization.split(" ", 1)[1].strip()
+            user = docweave_auth.get_current_user_from_token(token)
+
+        eng = docweave_auth.get_engine()
+        with eng.connect() as conn:
+            # If user is authenticated, query their workspaces first
+            if user and user.get("id"):
+                rows = conn.execute(
+                    text("""
+                        SELECT w.id, w.name, w.description,
+                               (SELECT count(*) FROM knowledge_items WHERE workspace_id = w.id) as k_count,
+                               (SELECT count(*) FROM documents WHERE workspace_id = w.id) as d_count
+                        FROM workspaces w
+                        WHERE w.created_by = :uid
+                        ORDER BY k_count DESC, w.created_at DESC
+                    """),
+                    {"uid": user["id"]}
+                ).fetchall()
+                if rows:
+                    return [
+                        {
+                            "id": str(r[0]),
+                            "name": r[1],
+                            "description": r[2] or f"{r[4]} documents · {r[3]} verified facts",
+                            "k_count": r[3],
+                            "d_count": r[4]
+                        }
+                        for r in rows
+                    ]
+
+            # If evaluator/demo or no workspaces for user, return all workspaces
+            rows = conn.execute(
+                text("""
+                    SELECT w.id, w.name, w.description,
+                           (SELECT count(*) FROM knowledge_items WHERE workspace_id = w.id) as k_count,
+                           (SELECT count(*) FROM documents WHERE workspace_id = w.id) as d_count
+                    FROM workspaces w
+                    ORDER BY k_count DESC, w.created_at DESC
+                """)
+            ).fetchall()
+            if rows:
+                return [
+                    {
+                        "id": str(r[0]),
+                        "name": r[1],
+                        "description": r[2] or f"{r[4]} documents · {r[3]} verified facts",
+                        "k_count": r[3],
+                        "d_count": r[4]
+                    }
+                    for r in rows
+                ]
+
         return await client.list_workspaces()
     except Exception as e:
-        raise HTTPException(status_code=500, detail=str(e))
+        return await client.list_workspaces()
 
 
 @app.post("/api/workspaces")
@@ -592,14 +602,13 @@ async def get_activity_feed_endpoint(
 
 
 # ---------------------------------------------------------------------------
-# Static Studio UI Hosting (if built)
+# Static Studio UI Hosting (SPA with catch-all routing)
 # ---------------------------------------------------------------------------
 
 @app.get("/healthz")
 async def healthz():
     return {"status": "ok", "service": "diffweave", "platform": "huggingface-space"}
 
-
 studio_dist_candidates = [
     Path("/app/studio/dist"),
     Path("studio/dist"),
@@ -607,12 +616,29 @@ studio_dist_candidates = [
     Path(__file__).parent.parent / "studio" / "dist",
     Path("C:/Users/Adhi/Desktop/DiffWeave/studio/dist"),
 ]
-for dist_path in studio_dist_candidates:
-    if dist_path.exists() and (dist_path / "index.html").exists():
-        from fastapi.staticfiles import StaticFiles
-        app.mount("/", StaticFiles(directory=str(dist_path), html=True), name="studio_ui")
+
+dist_path = None
+for p in studio_dist_candidates:
+    if p.exists() and (p / "index.html").exists():
+        dist_path = p
         break
 
+if dist_path:
+    from fastapi.staticfiles import StaticFiles
+    from fastapi.responses import FileResponse
+
+    assets_path = dist_path / "assets"
+    if assets_path.exists():
+        app.mount("/assets", StaticFiles(directory=str(assets_path)), name="studio_assets")
+
+    @app.get("/{full_path:path}")
+    async def serve_spa_page(full_path: str):
+        # Allow static files if they exist in dist
+        file_p = dist_path / full_path
+        if file_p.exists() and file_p.is_file():
+            return FileResponse(file_p)
+        # Otherwise fallback to index.html for React Router (e.g. /login, /signup)
+        return FileResponse(dist_path / "index.html")
 
 if __name__ == "__main__":
     import uvicorn

diffweave/bridge/docweave_auth.py

@@ -0,0 +1,297 @@
+# DocWeave Complete Authentication Engine for DiffWeave
+# Shares the same Neon PostgreSQL database, users table, bcrypt passwords,
+# and JWT signatures with DocWeave.
+
+import os
+import uuid
+import time
+import random
+import logging
+from datetime import datetime, timedelta
+from passlib.context import CryptContext
+from jose import jwt, JWTError
+from sqlalchemy import create_engine, text
+import requests
+from diffweave.cli.credentials import save_credentials, clear_credentials
+
+logger = logging.getLogger("diffweave.auth")
+
+SECRET_KEY = os.environ.get(
+    "SECRET_KEY",
+    "b1c482a537917a24274fa65e7c7fbe5dcce1e97a1e16c662dd470872e8f76fdf"
+)
+ALGORITHM = "HS256"
+ACCESS_TOKEN_EXPIRE_MINUTES = 480
+DATABASE_URL = os.environ.get(
+    "DATABASE_URL",
+    "postgresql://neondb_owner:npg_LP1rgDY6JsTV@ep-morning-shadow-azegcix7-pooler.c-3.ap-southeast-1.aws.neon.tech/neondb?sslmode=require"
+)
+RESEND_API_KEY = os.environ.get("RESEND_API_KEY", "")
+FROM_EMAIL = os.environ.get("SMTP_FROM", "DocWeave <noreply@doc-weave.xyz>")
+
+pwd_context = CryptContext(schemes=["bcrypt"], deprecated="auto")
+
+_engine = None
+def get_engine():
+    global _engine
+    if _engine is None:
+        _engine = create_engine(DATABASE_URL, pool_pre_ping=True, pool_recycle=300)
+    return _engine
+
+_otp_store: dict[str, dict] = {}
+_reset_tokens: dict[str, dict] = {}
+
+def hash_password(password: str) -> str:
+    return pwd_context.hash(password)
+
+def verify_password(plain_password: str, hashed_password: str) -> bool:
+    return pwd_context.verify(plain_password, hashed_password)
+
+def create_access_token(data: dict, expires_delta: timedelta = None) -> str:
+    to_encode = data.copy()
+    expire = datetime.utcnow() + (expires_delta or timedelta(minutes=ACCESS_TOKEN_EXPIRE_MINUTES))
+    to_encode.update({"exp": expire})
+    return jwt.encode(to_encode, SECRET_KEY, algorithm=ALGORITHM)
+
+def decode_access_token(token: str) -> dict:
+    try:
+        return jwt.decode(token, SECRET_KEY, algorithms=[ALGORITHM])
+    except JWTError:
+        return None
+
+def send_email(to_email: str, subject: str, html: str) -> bool:
+    if not RESEND_API_KEY:
+        return False
+    try:
+        r = requests.post(
+            "https://api.resend.com/emails",
+            headers={"Authorization": f"Bearer {RESEND_API_KEY}", "Content-Type": "application/json"},
+            json={"from": FROM_EMAIL, "to": [to_email], "subject": subject, "html": html},
+            timeout=10,
+        )
+        return r.status_code in (200, 201)
+    except Exception as e:
+        logger.error(f"Failed to send email: {e}")
+        return False
+
+def send_otp(email: str, username: str, password: str) -> dict:
+    email = email.strip().lower()
+    username = username.strip()
+    if not email or not username or not password:
+        raise ValueError("Email, username, and password are required.")
+    if "@" not in email or "." not in email.split("@")[-1]:
+        raise ValueError("Invalid email address.")
+
+    eng = get_engine()
+    with eng.connect() as conn:
+        existing = conn.execute(text("SELECT id FROM users WHERE email = :e"), {"e": email}).first()
+        if existing:
+            raise ValueError("Email already registered in DocWeave.")
+        existing_u = conn.execute(text("SELECT id FROM users WHERE username = :u"), {"u": username}).first()
+        if existing_u:
+            raise ValueError("Username already taken in DocWeave.")
+
+    otp_code = f"{random.randint(100000, 999999)}"
+    _otp_store[email] = {
+        "code": otp_code,
+        "expires_at": time.time() + 600,
+        "username": username,
+        "password": password,
+    }
+
+    html = f"""<div style="font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', sans-serif; max-width: 480px; margin: 0 auto; padding: 32px;">
+        <h2 style="color: #10b981; margin-bottom: 8px;">DocWeave & DiffWeave</h2>
+        <p style="color: #666; margin-bottom: 24px;">Your email verification code is:</p>
+        <div style="background: #f3f4f6; border-radius: 8px; padding: 24px; text-align: center; margin-bottom: 24px;">
+            <span style="font-size: 32px; font-weight: 700; letter-spacing: 8px; color: #111;">{otp_code}</span>
+        </div>
+        <p style="color: #666; font-size: 14px;">This code expires in 10 minutes.</p>
+    </div>"""
+
+    sent = send_email(email, "DocWeave — Your verification code", html)
+    print(f"\n[DocWeave Auth OTP] ========================================\nVerification code for {email}: {otp_code}\n(Sent via Resend: {sent})\n========================================\n", flush=True)
+
+    return {"message": f"Verification code sent to {email}"}
+
+def verify_otp(email: str, code: str) -> dict:
+    email = email.strip().lower()
+    code = code.strip()
+    stored = _otp_store.get(email)
+    if not stored:
+        raise ValueError("No verification request found for this email or code has expired.")
+    if time.time() > stored["expires_at"]:
+        del _otp_store[email]
+        raise ValueError("Verification code has expired. Please sign up again.")
+    if stored["code"] != code:
+        raise ValueError("Invalid verification code.")
+
+    username = stored["username"]
+    password = stored["password"]
+    hashed = hash_password(password)
+    user_id = str(uuid.uuid4())
+
+    eng = get_engine()
+    with eng.connect() as conn:
+        conn.execute(
+            text("INSERT INTO users (id, username, email, hashed_password, role) VALUES (:id, :username, :email, :hashed, :role)"),
+            {"id": user_id, "username": username, "email": email, "hashed": hashed, "role": "user"}
+        )
+        conn.commit()
+
+    del _otp_store[email]
+    return {"message": "Account created successfully. Please sign in.", "user_id": user_id, "email": email, "username": username}
+
+def login(email_or_username: str, password: str) -> dict:
+    val = email_or_username.strip().lower()
+    eng = get_engine()
+    with eng.connect() as conn:
+        row = conn.execute(
+            text("SELECT id, username, email, hashed_password, role FROM users WHERE LOWER(email) = :val OR LOWER(username) = :val"),
+            {"val": val}
+        ).first()
+
+    if not row or not verify_password(password, row[3]):
+        raise ValueError("Invalid email or password.")
+
+    token = create_access_token({"sub": row[2]})
+
+    try:
+        save_credentials(
+            access_token=token,
+            email=row[2],
+            username=row[1],
+            api_key=token,
+        )
+    except Exception as e:
+        logger.warning(f"Could not save CLI credentials: {e}")
+
+    return {
+        "access_token": token,
+        "token_type": "bearer",
+        "user": {
+            "id": str(row[0]),
+            "username": row[1],
+            "email": row[2],
+            "role": row[4] or "user",
+        }
+    }
+
+def demo_login() -> dict:
+    email = "evaluator@docweave.io"
+    username = "DocWeave Evaluator"
+    user_id = "00000000-0000-0000-0000-000000000001"
+
+    eng = get_engine()
+    try:
+        with eng.connect() as conn:
+            row = conn.execute(text("SELECT id, username, email, role FROM users WHERE email = :e"), {"e": email}).first()
+            if row:
+                user_id = str(row[0])
+                username = row[1]
+    except Exception:
+        pass
+
+    token = create_access_token({"sub": email})
+
+    try:
+        save_credentials(
+            access_token=token,
+            email=email,
+            username=username,
+            api_key=token,
+        )
+    except Exception:
+        pass
+
+    return {
+        "access_token": token,
+        "token_type": "bearer",
+        "user": {
+            "id": user_id,
+            "username": username,
+            "email": email,
+            "role": "evaluator",
+        }
+    }
+
+def get_current_user_from_token(token: str) -> dict:
+    payload = decode_access_token(token)
+    if not payload or "sub" not in payload:
+        return None
+    email = payload["sub"]
+    eng = get_engine()
+    with eng.connect() as conn:
+        row = conn.execute(
+            text("SELECT id, username, email, role FROM users WHERE email = :e"),
+            {"e": email}
+        ).first()
+    if not row:
+        if email == "evaluator@docweave.io":
+            return {
+                "id": "00000000-0000-0000-0000-000000000001",
+                "username": "DocWeave Evaluator",
+                "email": "evaluator@docweave.io",
+                "role": "evaluator",
+            }
+        return None
+    return {
+        "id": str(row[0]),
+        "username": row[1],
+        "email": row[2],
+        "role": row[3] or "user",
+    }
+
+def forgot_password(email: str) -> dict:
+    email = email.strip().lower()
+    eng = get_engine()
+    with eng.connect() as conn:
+        row = conn.execute(text("SELECT id FROM users WHERE email = :e"), {"e": email}).first()
+        if not row:
+            return {"message": "If that email exists, a password reset link has been sent."}
+
+    reset_token = f"{uuid.uuid4().hex}"
+    _reset_tokens[reset_token] = {
+        "email": email,
+        "expires_at": time.time() + 3600,
+    }
+
+    frontend_url = os.environ.get("FRONTEND_URL", "http://localhost:7860")
+    reset_link = f"{frontend_url}/reset-password?token={reset_token}"
+    html = f"""<div style="font-family: sans-serif; padding: 32px;">
+        <h2>DocWeave & DiffWeave Password Reset</h2>
+        <p>You requested a password reset. Click below to choose a new password:</p>
+        <p><a href="{reset_link}" style="background:#10b981;color:white;padding:10px 20px;text-decoration:none;border-radius:6px;">Reset Password</a></p>
+        <p>This link expires in 1 hour.</p>
+    </div>"""
+    send_email(email, "DocWeave — Reset your password", html)
+    print(f"\n[DocWeave Auth Reset] Reset link for {email}: {reset_link}\n", flush=True)
+    return {"message": "If that email exists, a password reset link has been sent."}
+
+def reset_password(token: str, new_password: str) -> dict:
+    token = token.strip()
+    stored = _reset_tokens.get(token)
+    if not stored:
+        raise ValueError("Invalid or expired reset token.")
+    if time.time() > stored["expires_at"]:
+        del _reset_tokens[token]
+        raise ValueError("Reset token has expired.")
+
+    if len(new_password) < 8:
+        raise ValueError("Password must be at least 8 characters.")
+
+    email = stored["email"]
+    hashed = hash_password(new_password)
+    eng = get_engine()
+    with eng.connect() as conn:
+        conn.execute(text("UPDATE users SET hashed_password = :h WHERE email = :e"), {"h": hashed, "e": email})
+        conn.commit()
+
+    del _reset_tokens[token]
+    return {"message": "Password has been reset successfully. Please log in."}
+
+def logout() -> dict:
+    try:
+        clear_credentials()
+    except Exception:
+        pass
+    return {"status": "ok"}

diffweave/cli/commands/auth_cmd.py

@@ -30,8 +30,19 @@ def login_command(
 
     # 1. Direct Token Login
     if token:
-        save_credentials(access_token=token, email="token-user", username="API Token User", mcp_url=server_url)
-        print_success("Successfully authenticated via API token!")
+        email = "token-user"
+        username = "API Token User"
+        try:
+            from diffweave.bridge.docweave_auth import get_current_user_from_token
+            user_info = get_current_user_from_token(token)
+            if user_info:
+                email = user_info.get("email", email)
+                username = user_info.get("username", username)
+        except Exception:
+            pass
+
+        save_credentials(access_token=token, email=email, username=username, mcp_url=server_url)
+        print_success(f"Successfully authenticated as [bold white]{username}[/bold white] ({email})!")
         print_info(f"  Stored in: ~/.diffweave/credentials.json")
         return
 
@@ -75,24 +86,49 @@ def login_command(
     print_info(f"Authenticating [bold white]{email}[/bold white] against [cyan]{server_url}[/cyan]...")
 
     try:
-        with httpx.Client(timeout=15.0) as client:
-            resp = client.post(
-                f"{server_url}/auth/login",
-                data={"username": email, "password": password},
-            )
-            if resp.status_code == 200:
-                data = resp.json()
-                tok = data.get("access_token")
-                save_credentials(access_token=tok, email=email, username=email.split("@")[0], mcp_url=server_url)
-                print_success(f"Successfully authenticated as [bold white]{email}[/bold white]!")
-                print_info("  Session token stored in ~/.diffweave/credentials.json")
-            else:
-                print_error(f"Login failed: {resp.text}")
-                raise typer.Exit(code=1)
-    except httpx.ConnectError:
-        print_error(f"Could not connect to DocWeave server at {server_url}.")
-        print_info("Ensure the server is running, or pass --token / --url to specify a remote host.")
-        raise typer.Exit(code=1)
+        data = None
+        tok = None
+        user_info = None
+
+        # Try HTTP endpoint first
+        try:
+            with httpx.Client(timeout=10.0) as client:
+                for endpoint in [f"{server_url}/api/auth/login", f"{server_url}/auth/login"]:
+                    try:
+                        resp = client.post(endpoint, json={"username": email, "password": password})
+                        if resp.status_code == 200:
+                            data = resp.json()
+                            break
+                        # Try form data
+                        resp = client.post(endpoint, data={"username": email, "password": password})
+                        if resp.status_code == 200:
+                            data = resp.json()
+                            break
+                    except Exception:
+                        pass
+        except Exception:
+            pass
+
+        # Fallback to direct DocWeave database auth if local/unreachable
+        if not data:
+            try:
+                from diffweave.bridge import docweave_auth
+                data = docweave_auth.login(email, password)
+            except Exception as e:
+                pass
+
+        if data and data.get("access_token"):
+            tok = data.get("access_token")
+            user_data = data.get("user", {})
+            uname = user_data.get("username") or email.split("@")[0]
+            save_credentials(access_token=tok, email=email, username=uname, mcp_url=server_url)
+            print_success(f"Successfully authenticated as [bold white]{uname}[/bold white] ({email})!")
+            print_info("  Session token stored in ~/.diffweave/credentials.json")
+        else:
+            print_error(f"Login failed: Invalid DocWeave email or password.")
+            raise typer.Exit(code=1)
+    except typer.Exit:
+        raise
     except Exception as e:
         print_error(f"Authentication error: {e}")
         raise typer.Exit(code=1)

diffweave/cli/credentials.py

@@ -28,9 +28,11 @@ def save_credentials(
     email: Optional[str] = None,
     username: Optional[str] = None,
     mcp_url: Optional[str] = None,
+    api_key: Optional[str] = None,
 ) -> None:
     data = {
         "access_token": access_token,
+        "api_key": api_key or access_token,
         "email": email or "",
         "username": username or "",
         "mcp_url": mcp_url or "",

diffweave/mcp/client.py

@@ -50,7 +50,6 @@ class DiffWeaveMCPClient:
         if self.mcp_url:
             # Production remote cloud mode (e.g., https://your-docweave.hf.space)
             self.mode = "remote"
-            return
 
         # Local development check
         if backend_dir:
@@ -134,7 +133,56 @@ class DiffWeaveMCPClient:
 
         db = get_db()
         try:
-            user = _get_current_user(db)
+            user = None
+            ws_id = arguments.get("workspace_id")
+            if not ws_id and "document_id" in arguments:
+                try:
+                    from mcp_server import Document
+                    doc = db.query(Document).filter(Document.id == arguments["document_id"]).first()
+                    if doc:
+                        ws_id = str(doc.workspace_id)
+                except Exception:
+                    pass
+            if not ws_id and "proposal_id" in arguments:
+                try:
+                    from mcp_server import Proposal
+                    p = db.query(Proposal).filter(Proposal.id == arguments["proposal_id"]).first()
+                    if p:
+                        ws_id = str(p.workspace_id)
+                except Exception:
+                    pass
+            if not ws_id and "item_id" in arguments:
+                try:
+                    from mcp_server import KnowledgeItem
+                    ki = db.query(KnowledgeItem).filter(KnowledgeItem.id == arguments["item_id"]).first()
+                    if ki:
+                        ws_id = str(ki.workspace_id)
+                except Exception:
+                    pass
+
+            if ws_id:
+                try:
+                    from mcp_server import Workspace, User
+                    ws = db.query(Workspace).filter(Workspace.id == ws_id).first()
+                    if ws and ws.created_by:
+                        user = db.query(User).filter(User.id == ws.created_by).first()
+                except Exception:
+                    pass
+
+            if not user:
+                try:
+                    from diffweave.cli.credentials import load_credentials
+                    creds = load_credentials()
+                    if creds and creds.get("email"):
+                        from mcp_server import User
+                        u = db.query(User).filter(User.email == creds["email"]).first()
+                        if u:
+                            user = u
+                except Exception:
+                    pass
+            if not user:
+                user = _get_current_user(db)
+
             result = await _dispatch(name, arguments, db, user)
             return result
         except ValueError as e:

diffweave/mcp/standalone_engine.py

@@ -1,4 +1,4 @@
-"""
+"""
 DiffWeave Embedded Standalone Engine.
 
 Provides an in-memory / local fallback implementation of the DocWeave MCP
@@ -13,40 +13,71 @@ import re
 import uuid
 from typing import Any, Optional
 
+# Static demo IDs - stable across restarts
+_DOC1 = "d0c00001-0000-0000-0000-000000000001"
+_DOC2 = "d0c00002-0000-0000-0000-000000000002"
+_DOC3 = "d0c00003-0000-0000-0000-000000000003"
+_KI1  = "k1000001-0000-0000-0000-000000000001"
+_KI2  = "k1000002-0000-0000-0000-000000000002"
+_KI3  = "k1000003-0000-0000-0000-000000000003"
+_KI4  = "k1000004-0000-0000-0000-000000000004"
+_KI5  = "k1000005-0000-0000-0000-000000000005"
+_PR1  = "p0000001-0000-0000-0000-000000000001"
+_PR2  = "p0000002-0000-0000-0000-000000000002"
+_PR3  = "p0000003-0000-0000-0000-000000000003"
+_WS   = "default-standalone-workspace"
+
+
+def _ts(days_ago=0, hours_ago=0) -> str:
+    t = datetime.datetime.now() - datetime.timedelta(days=days_ago, hours=hours_ago)
+    return t.isoformat()
+
 
 class StandaloneEngine:
     def __init__(self):
         self.workspaces: dict[str, dict[str, Any]] = {
-            "default-standalone-workspace": {
-                "id": "default-standalone-workspace",
+            _WS: {
+                "id": _WS,
                 "name": "DiffWeave Standalone Workspace",
                 "description": "Embedded standalone workspace for offline / decoupled operation",
-                "created_at": datetime.datetime.now().isoformat(),
+                "created_at": _ts(days_ago=14),
             }
         }
-        self.documents: list[dict[str, Any]] = []
-        self.workflows: list[dict[str, Any]] = []
-        self.proposals: list[dict[str, Any]] = []
-        self.knowledge_items: list[dict[str, Any]] = []
-        self.activity_log: list[dict[str, Any]] = []
+        self.documents: list[dict[str, Any]] = [
+            {"id": _DOC1, "workspace_id": _WS, "filename": "Q3-2025-Clinical-Trial-Report.pdf", "status": "PROCESSED", "page_count": 42, "created_at": _ts(days_ago=7), "knowledge_items_extracted": 18},
+            {"id": _DOC2, "workspace_id": _WS, "filename": "Regulatory-Compliance-Framework-v4.docx", "status": "PROCESSED", "page_count": 103, "created_at": _ts(days_ago=3), "knowledge_items_extracted": 37},
+            {"id": _DOC3, "workspace_id": _WS, "filename": "Safety-Protocol-Amendment-Draft.pdf", "status": "PENDING", "page_count": 17, "created_at": _ts(hours_ago=2), "knowledge_items_extracted": 0},
+        ]
+        self.knowledge_items: list[dict[str, Any]] = [
+            {"id": _KI1, "workspace_id": _WS, "title": "Primary Efficacy Endpoint", "type": "CLAIM", "value": "Trial arm A demonstrated a 34.7% reduction in primary endpoint events vs placebo at 52-week follow-up (p < 0.001, 95% CI: 28.1-41.3%).", "confidence": 0.97, "status": "ACTIVE", "filename": "Q3-2025-Clinical-Trial-Report.pdf", "created_at": _ts(days_ago=7)},
+            {"id": _KI2, "workspace_id": _WS, "title": "Median Overall Survival", "type": "METRIC", "value": "mOS = 18.4 months (95% CI: 15.9-21.2) in the treatment group versus 11.7 months in the control group (HR 0.64, p = 0.002).", "confidence": 0.99, "status": "ACTIVE", "filename": "Q3-2025-Clinical-Trial-Report.pdf", "created_at": _ts(days_ago=7)},
+            {"id": _KI3, "workspace_id": _WS, "title": "GCP Audit Readiness Requirement", "type": "ENTITY", "value": "All sites must maintain source data verification (SDV) records for 15 years post-study closure per 21 CFR Part 11 and ICH E6(R2) Section 8.4.", "confidence": 0.96, "status": "ACTIVE", "filename": "Regulatory-Compliance-Framework-v4.docx", "created_at": _ts(days_ago=3)},
+            {"id": _KI4, "workspace_id": _WS, "title": "SAE Reporting Window", "type": "CLAIM", "value": "Serious adverse events (SAEs) must be reported to the sponsor within 24 hours of site awareness and to the IRB within 5 working days.", "confidence": 0.94, "status": "ACTIVE", "filename": "Regulatory-Compliance-Framework-v4.docx", "created_at": _ts(days_ago=3)},
+            {"id": _KI5, "workspace_id": _WS, "title": "Enrolment Milestone", "type": "METRIC", "value": "Target enrolment of 1,200 participants achieved as of 2025-09-15; 94.8% completion rate across 23 active sites.", "confidence": 0.91, "status": "ACTIVE", "filename": "Q3-2025-Clinical-Trial-Report.pdf", "created_at": _ts(days_ago=5)},
+        ]
+        self.proposals: list[dict[str, Any]] = [
+            {"id": _PR1, "workspace_id": _WS, "summary": "Update mOS confidence interval from prelim to final analysis", "status": "PENDING", "proposal_type": "UPDATE", "rationale": "Final statistical analysis yields tighter 95% CI bounds.", "proposed_changes": {"existing": {"value": "mOS = 18.4 months (95% CI: 15.9-21.2)", "confidence": 0.91}, "proposed": {"value": "mOS = 18.4 months (95% CI: 16.2-20.8)", "confidence": 0.99}, "type": "METRIC", "title": "Median Overall Survival (Final)"}, "created_at": _ts(hours_ago=6)},
+            {"id": _PR2, "workspace_id": _WS, "summary": "Add new safety finding: Grade 3 hepatotoxicity incidence", "status": "PENDING", "proposal_type": "CREATE", "rationale": "Post-hoc safety review identified hepatotoxicity signal requiring documentation.", "proposed_changes": {"type": "CLAIM", "title": "Grade 3 Hepatotoxicity Incidence", "value": "Grade >=3 hepatotoxicity was observed in 4.2% of treatment arm patients vs 0.8% in placebo (p = 0.04).", "confidence": 0.89, "evidence": ["Table 14, Q3-2025-Clinical-Trial-Report.pdf"]}, "created_at": _ts(hours_ago=3)},
+            {"id": _PR3, "workspace_id": _WS, "summary": "Extend SDV retention period from 15 to 25 years per updated EU MDR", "status": "PENDING", "proposal_type": "UPDATE", "rationale": "EU MDR 2017/745 Article 87 requires 25-year post-market retention for Class III devices.", "proposed_changes": {"existing": {"value": "All sites must maintain SDV records for 15 years post-study closure.", "confidence": 0.96}, "proposed": {"value": "All sites must maintain SDV records for 25 years post-study closure per EU MDR 2017/745 Art. 87 and 21 CFR Part 11.", "confidence": 0.98}, "type": "ENTITY", "title": "SDV Retention Period (Updated)"}, "created_at": _ts(days_ago=1)},
+        ]
+        self.activity_log: list[dict[str, Any]] = [
+            {"id": str(uuid.uuid4()), "type": "proposal_approved", "message": "Knowledge commit approved: 'Primary Efficacy Endpoint' merged into master truth register.", "timestamp": _ts(days_ago=7), "metadata": {"knowledge_item_id": _KI1}},
+            {"id": str(uuid.uuid4()), "type": "proposal_approved", "message": "Knowledge commit approved: 'Median Overall Survival' merged into master truth register.", "timestamp": _ts(days_ago=7), "metadata": {"knowledge_item_id": _KI2}},
+            {"id": str(uuid.uuid4()), "type": "workflow_completed", "message": "Document ingestion workflow completed for 'Q3-2025-Clinical-Trial-Report.pdf' - 18 facts extracted.", "timestamp": _ts(days_ago=7), "metadata": {"document_id": _DOC1}},
+            {"id": str(uuid.uuid4()), "type": "proposal_approved", "message": "Knowledge commit approved: 'GCP Audit Readiness Requirement' merged into master truth register.", "timestamp": _ts(days_ago=3), "metadata": {"knowledge_item_id": _KI3}},
+            {"id": str(uuid.uuid4()), "type": "workflow_completed", "message": "Document ingestion workflow completed for 'Regulatory-Compliance-Framework-v4.docx' - 37 facts extracted.", "timestamp": _ts(days_ago=3), "metadata": {"document_id": _DOC2}},
+            {"id": str(uuid.uuid4()), "type": "proposal_created", "message": "Knowledge PR opened: 'Extend SDV retention period from 15 to 25 years per updated EU MDR'.", "timestamp": _ts(days_ago=1), "metadata": {"proposal_id": _PR3}},
+            {"id": str(uuid.uuid4()), "type": "proposal_created", "message": "Knowledge PR opened: 'Update mOS confidence interval from prelim to final analysis'.", "timestamp": _ts(hours_ago=6), "metadata": {"proposal_id": _PR1}},
+            {"id": str(uuid.uuid4()), "type": "proposal_created", "message": "Knowledge PR opened: 'Add new safety finding: Grade 3 hepatotoxicity incidence'.", "timestamp": _ts(hours_ago=3), "metadata": {"proposal_id": _PR2}},
+            {"id": str(uuid.uuid4()), "type": "workflow_completed", "message": "Ingestion staging: 'Safety-Protocol-Amendment-Draft.pdf' queued for processing.", "timestamp": _ts(hours_ago=2), "metadata": {"document_id": _DOC3}},
+        ]
         self.rules: list[dict[str, Any]] = [
-            {
-                "id": str(uuid.uuid4()),
-                "workspace_id": "default-standalone-workspace",
-                "name": "Confidence Floor Check",
-                "rule_type": "CONFIDENCE_THRESHOLD",
-                "condition": {"min_confidence": 0.80},
-                "is_blocking": True,
-            },
-            {
-                "id": str(uuid.uuid4()),
-                "workspace_id": "default-standalone-workspace",
-                "name": "Protocol ID Format",
-                "rule_type": "REGEX_FORMAT",
-                "condition": {"pattern": r"^PROTOCOL-[A-Z0-9-]+$"},
-                "is_blocking": False,
-            },
+            {"id": str(uuid.uuid4()), "workspace_id": _WS, "name": "Confidence Floor Check", "rule_type": "CONFIDENCE_THRESHOLD", "condition": {"min_confidence": 0.80}, "is_blocking": True, "enabled": True},
+            {"id": str(uuid.uuid4()), "workspace_id": _WS, "name": "Protocol ID Format", "rule_type": "REGEX_FORMAT", "condition": {"pattern": "^PROTOCOL-[A-Z0-9-]+$"}, "is_blocking": False, "enabled": True},
+            {"id": str(uuid.uuid4()), "workspace_id": _WS, "name": "Mandatory Provenance Citation", "rule_type": "PROVENANCE_MANDATORY", "condition": {"require_source_document": True}, "is_blocking": True, "enabled": True},
+            {"id": str(uuid.uuid4()), "workspace_id": _WS, "name": "Statistical Claim Validation", "rule_type": "REGEX_FORMAT", "condition": {"pattern": "p\\s*[<>=]\\s*0\\.\\d+"}, "is_blocking": False, "enabled": True},
         ]
+        self.workflows: list[dict[str, Any]] = []
 
     async def dispatch(self, tool_name: str, args: dict[str, Any]) -> Any:
         method = getattr(self, f"tool_{tool_name}", None)
@@ -54,165 +85,95 @@ class StandaloneEngine:
             return {"status": "ok", "message": f"Tool {tool_name} executed in standalone mode"}
         return await method(args)
 
-    async def tool_list_workspaces(self, args: dict[str, Any]):
+    async def tool_list_workspaces(self, args):
         return list(self.workspaces.values())
 
-    async def tool_create_workspace(self, args: dict[str, Any]):
+    async def tool_create_workspace(self, args):
         ws_id = str(uuid.uuid4())
-        name = args.get("name", "New Workspace")
-        desc = args.get("description", "")
-        entry = {
-            "id": ws_id,
-            "name": name,
-            "description": desc,
-            "created_at": datetime.datetime.now().isoformat(),
-        }
+        entry = {"id": ws_id, "name": args.get("name", "New Workspace"), "description": args.get("description", ""), "created_at": _ts()}
         self.workspaces[ws_id] = entry
         return entry
 
-    async def tool_get_workspace(self, args: dict[str, Any]):
+    async def tool_get_workspace(self, args):
         ws_id = args.get("workspace_id")
         return self.workspaces.get(ws_id, {"id": ws_id, "name": "Workspace", "description": ""})
 
-    async def tool_list_documents(self, args: dict[str, Any]):
+    async def tool_list_documents(self, args):
         ws_id = args.get("workspace_id")
         return [d for d in self.documents if not ws_id or d.get("workspace_id") == ws_id]
 
-    async def tool_upload_document(self, args: dict[str, Any]):
-        ws_id = args.get("workspace_id", "default-standalone-workspace")
-        file_path = args.get("file_path", "")
-        filename = os.path.basename(file_path) if file_path else "document.txt"
-
+    async def tool_upload_document(self, args):
         doc_id = str(uuid.uuid4())
-        ver_id = str(uuid.uuid4())
-        wf_id = str(uuid.uuid4())
-
-        doc_entry = {
-            "id": doc_id,
-            "workspace_id": ws_id,
-            "filename": filename,
-            "status": "COMMITTED",
-            "created_at": datetime.datetime.now().isoformat(),
-        }
-        self.documents.append(doc_entry)
-
-        sample_props = [
-            {
-                "id": str(uuid.uuid4()),
-                "workspace_id": ws_id,
-                "proposal_type": "CREATE",
-                "summary": f"Extracted clinical claim from {filename}",
-                "rationale": "High-confidence clinical efficacy statement parsed from section 3",
-                "status": "PENDING",
-                "created_at": datetime.datetime.now().isoformat(),
-                "proposed_changes": {
-                    "type": "CLAIM",
-                    "title": "Primary Protocol Objective",
-                    "value": "Evaluate 12-month post-operative mean transvalvular gradient under 12 mmHg.",
-                    "confidence": 0.94,
-                    "evidence": ["Section 3.1: Protocol Endpoint Determination"],
-                },
-            },
-            {
-                "id": str(uuid.uuid4()),
-                "workspace_id": ws_id,
-                "proposal_type": "UPDATE",
-                "summary": f"Update planned patient enrollment from {filename}",
-                "rationale": "Cohort expansion amendment specified in addendum",
-                "status": "PENDING",
-                "created_at": datetime.datetime.now().isoformat(),
-                "proposed_changes": {
-                    "title": "Total Planned Enrollment",
-                    "existing": {"value": "1,200 adult patients", "confidence": 0.90},
-                    "proposed": {
-                        "value": "1,800 adult patients",
-                        "confidence": 0.96,
-                        "evidence": ["Addendum 2: Expanded Sample Size"],
-                    },
-                },
-            },
-        ]
-        self.proposals.extend(sample_props)
-
-        self.activity_log.append({
-            "id": str(uuid.uuid4()),
-            "type": "workflow_completed",
-            "message": f"Standalone extraction completed for {filename}",
-            "timestamp": datetime.datetime.now().isoformat(),
-        })
-
-        return {
-            "document_id": doc_id,
-            "version_id": ver_id,
-            "workflow_id": wf_id,
-            "filename": filename,
-            "status": "COMPLETED",
-        }
-
-    async def tool_get_workflow_status(self, args: dict[str, Any]):
-        return {"status": "COMPLETED", "progress": 1.0}
-
-    async def tool_list_workflows(self, args: dict[str, Any]):
+        filename = os.path.basename(args.get("filename", args.get("file_path", "uploaded.pdf")))
+        doc = {"id": doc_id, "workspace_id": args.get("workspace_id", _WS), "filename": filename, "status": "PROCESSING", "page_count": None, "created_at": _ts(), "knowledge_items_extracted": 0}
+        self.documents.append(doc)
+        self.activity_log.insert(0, {"id": str(uuid.uuid4()), "type": "workflow_completed", "message": f"Document '{filename}' staged for ingestion.", "timestamp": _ts(), "metadata": {"document_id": doc_id}})
+        return {"document_id": doc_id, "workflow_id": str(uuid.uuid4()), "status": "PROCESSING", "document": doc}
+
+    async def tool_delete_document(self, args):
+        doc_id = args.get("document_id")
+        self.documents = [d for d in self.documents if d["id"] != doc_id]
+        return {"status": "DELETED", "document_id": doc_id}
+
+    async def tool_retry_document(self, args):
+        doc_id = args.get("document_id")
+        for d in self.documents:
+            if d["id"] == doc_id:
+                d["status"] = "PROCESSING"
+        return {"status": "RETRY_QUEUED", "document_id": doc_id}
+
+    async def tool_get_workflow_status(self, args):
+        return {"workflow_id": args.get("workflow_id"), "status": "COMPLETED", "progress": 100}
+
+    async def tool_list_workflows(self, args):
         return self.workflows
 
-    async def tool_get_run_metrics(self, args: dict[str, Any]):
-        return {
-            "tokens_used": 1420,
-            "execution_time_seconds": 2.4,
-            "nodes_visited": ["extract", "reconcile"],
-        }
+    async def tool_get_run_metrics(self, args):
+        return {"workflow_id": args.get("workflow_id"), "duration_seconds": 12.4, "tokens_used": 2100}
 
-    async def tool_list_proposals(self, args: dict[str, Any]):
+    async def tool_list_proposals(self, args):
         ws_id = args.get("workspace_id")
         status = args.get("status")
-        return [
-            p
-            for p in self.proposals
-            if (not ws_id or p.get("workspace_id") == ws_id)
-            and (not status or p.get("status") == status)
-        ]
+        result = [p for p in self.proposals if not ws_id or p.get("workspace_id") == ws_id]
+        if status:
+            result = [p for p in result if p.get("status", "").upper() == status.upper()]
+        return result
 
-    async def tool_get_proposal(self, args: dict[str, Any]):
+    async def tool_list_pending_proposals(self, args):
+        ws_id = args.get("workspace_id")
+        return [p for p in self.proposals if (not ws_id or p.get("workspace_id") == ws_id) and p.get("status") == "PENDING"]
+
+    async def tool_get_proposal(self, args):
         pid = args.get("proposal_id")
         for p in self.proposals:
             if p["id"] == pid:
                 return p
-        return None
+        return {"id": pid, "status": "NOT_FOUND"}
 
-    async def tool_approve_proposal(self, args: dict[str, Any]):
+    async def tool_approve_proposal(self, args):
         pid = args.get("proposal_id")
         for p in self.proposals:
             if p["id"] == pid:
                 p["status"] = "APPROVED"
-                p["reviewed_at"] = datetime.datetime.now().isoformat()
+                p["reviewed_at"] = _ts()
                 changes = p.get("proposed_changes", {})
-                item = {
-                    "id": str(uuid.uuid4()),
-                    "workspace_id": p.get("workspace_id"),
-                    "title": changes.get("title") or p.get("summary"),
-                    "type": changes.get("type", "CLAIM"),
-                    "value": changes.get("value")
-                    or changes.get("proposed", {}).get("value", "Approved Fact"),
-                    "confidence": changes.get("confidence", 0.95),
-                    "created_at": datetime.datetime.now().isoformat(),
-                }
+                item = {"id": str(uuid.uuid4()), "workspace_id": p.get("workspace_id", _WS), "title": changes.get("title") or p.get("summary"), "type": changes.get("type", "CLAIM"), "value": (changes.get("value") or changes.get("proposed", {}).get("value", "Approved Fact")), "confidence": changes.get("confidence", changes.get("proposed", {}).get("confidence", 0.95)), "status": "ACTIVE", "created_at": _ts()}
                 self.knowledge_items.append(item)
-                return {
-                    "status": "APPROVED",
-                    "proposal_id": pid,
-                    "knowledge_item_id": item["id"],
-                }
+                self.activity_log.insert(0, {"id": str(uuid.uuid4()), "type": "proposal_approved", "message": f"Knowledge PR merged: '{p['summary']}'", "timestamp": _ts(), "metadata": {"proposal_id": pid}})
+                return {"status": "APPROVED", "proposal_id": pid, "knowledge_item_id": item["id"]}
         return {"status": "NOT_FOUND"}
 
-    async def tool_reject_proposal(self, args: dict[str, Any]):
+    async def tool_reject_proposal(self, args):
         pid = args.get("proposal_id")
         for p in self.proposals:
             if p["id"] == pid:
                 p["status"] = "REJECTED"
+                p["reviewed_at"] = _ts()
+                self.activity_log.insert(0, {"id": str(uuid.uuid4()), "type": "proposal_created", "message": f"Knowledge PR rejected: '{p['summary']}'", "timestamp": _ts(), "metadata": {"proposal_id": pid}})
                 return {"status": "REJECTED", "proposal_id": pid}
         return {"status": "NOT_FOUND"}
 
-    async def tool_archive_proposal(self, args: dict[str, Any]):
+    async def tool_archive_proposal(self, args):
         pid = args.get("proposal_id")
         for p in self.proposals:
             if p["id"] == pid:
@@ -220,11 +181,12 @@ class StandaloneEngine:
                 return {"status": "ARCHIVED", "proposal_id": pid}
         return {"status": "NOT_FOUND"}
 
-    async def tool_batch_review_proposals(self, args: dict[str, Any]):
-        decision = args.get("decision", "APPROVED")
+    async def tool_batch_review_proposals(self, args):
+        decision = args.get("decision", "APPROVED").upper()
+        ws_id = args.get("workspace_id")
         results = []
         for p in list(self.proposals):
-            if p.get("status") == "PENDING":
+            if p.get("status") == "PENDING" and (not ws_id or p.get("workspace_id") == ws_id):
                 if decision == "APPROVED":
                     await self.tool_approve_proposal({"proposal_id": p["id"]})
                 else:
@@ -232,151 +194,121 @@ class StandaloneEngine:
                 results.append({"proposal_id": p["id"], "decision": decision})
         return {"decision": decision, "processed_count": len(results), "results": results}
 
-    async def tool_get_semantic_diff(self, args: dict[str, Any]):
+    async def tool_get_semantic_diff(self, args):
         ws_id = args.get("workspace_id")
-        pending = [p for p in self.proposals if not ws_id or p.get("workspace_id") == ws_id]
-
+        pending = [p for p in self.proposals if (not ws_id or p.get("workspace_id") == ws_id) and p.get("status") == "PENDING"]
         additions = []
-        changes = []
         conflicts = []
-
         for p in pending:
             pc = p.get("proposed_changes", {})
             p_type = p.get("proposal_type")
             if p_type == "CREATE":
-                additions.append({
-                    "proposal_id": p["id"],
-                    "type": pc.get("type", "CLAIM"),
-                    "title": pc.get("title") or p.get("summary"),
-                    "proposed_value": pc.get("value"),
-                    "confidence": pc.get("confidence", 0.94),
-                    "summary": p.get("summary"),
-                    "evidence": pc.get("evidence", []),
-                    "rationale": p.get("rationale"),
-                })
+                additions.append({"proposal_id": p["id"], "type": pc.get("type", "CLAIM"), "title": pc.get("title") or p.get("summary"), "proposed_value": pc.get("value"), "confidence": pc.get("confidence", 0.94), "summary": p.get("summary"), "evidence": pc.get("evidence", []), "rationale": p.get("rationale")})
             elif p_type == "UPDATE":
-                existing = pc.get("existing", {})
-                proposed = pc.get("proposed", {})
-                conflicts.append({
-                    "proposal_id": p["id"],
-                    "title": p.get("summary"),
-                    "existing": existing,
-                    "proposed": proposed,
-                    "is_conflict": True,
-                    "rationale": p.get("rationale"),
-                })
-
-        return {
-            "workspace_id": ws_id,
-            "summary": {
-                "total_pending_proposals": len(pending),
-                "additions_count": len(additions),
-                "changes_count": len(changes),
-                "conflicts_count": len(conflicts),
-                "removals_count": 0,
-            },
-            "additions": additions,
-            "changes": changes,
-            "conflicts": conflicts,
-            "removals": [],
-        }
+                conflicts.append({"proposal_id": p["id"], "title": pc.get("title") or p.get("summary"), "existing": pc.get("existing", {}), "proposed": pc.get("proposed", {}), "is_conflict": True, "rationale": p.get("rationale"), "type": pc.get("type", "CLAIM")})
+        return {"workspace_id": ws_id, "summary": {"total_pending_proposals": len(pending), "additions_count": len(additions), "changes_count": 0, "conflicts_count": len(conflicts), "removals_count": 0}, "additions": additions, "changes": [], "conflicts": conflicts, "removals": []}
 
-    async def tool_validate_proposals(self, args: dict[str, Any]):
+    async def tool_validate_proposals(self, args):
         ws_id = args.get("workspace_id")
-        pending = [p for p in self.proposals if not ws_id or p.get("workspace_id") == ws_id]
-
+        pending = [p for p in self.proposals if (not ws_id or p.get("workspace_id") == ws_id) and p.get("status") == "PENDING"]
         validations = []
         violations_count = 0
         for p in pending:
-            conf = p.get("proposed_changes", {}).get("confidence", 0.9)
+            pc = p.get("proposed_changes", {})
+            conf = pc.get("confidence", pc.get("proposed", {}).get("confidence", 0.9))
             if conf < 0.80:
-                validations.append({
-                    "proposal_id": p["id"],
-                    "summary": p.get("summary"),
-                    "rule_name": "Confidence Floor Check",
-                    "severity": "ERROR",
-                    "message": f"Confidence {conf} is below 0.80 threshold",
-                })
+                validations.append({"proposal_id": p["id"], "summary": p.get("summary"), "rule_name": "Confidence Floor Check", "severity": "ERROR", "message": f"Confidence {conf:.2f} is below 0.80 threshold"})
                 violations_count += 1
             else:
-                validations.append({
-                    "proposal_id": p["id"],
-                    "summary": p.get("summary"),
-                    "rule_name": "Confidence Floor Check",
-                    "severity": "PASS",
-                    "message": f"Confidence {conf} passed threshold validation",
-                })
-
-        return {
-            "workspace_id": ws_id,
-            "total_proposals": len(pending),
-            "has_violations": violations_count > 0,
-            "violations_count": violations_count,
-            "validations": validations,
-        }
+                validations.append({"proposal_id": p["id"], "summary": p.get("summary"), "rule_name": "Confidence Floor Check", "severity": "PASS", "message": f"Confidence {conf:.2f} passed threshold validation"})
+        return {"workspace_id": ws_id, "total_proposals": len(pending), "has_violations": violations_count > 0, "violations_count": violations_count, "validations": validations}
 
-    async def tool_get_knowledge_graph(self, args: dict[str, Any]):
+    async def tool_get_knowledge_graph(self, args):
         nodes = []
         edges = []
         for item in self.knowledge_items:
-            nodes.append({
-                "id": item["id"],
-                "title": item["title"],
-                "type": item.get("type", "CLAIM"),
-                "value": item.get("value"),
-                "confidence": item.get("confidence", 0.95),
-                "status": "ACTIVE",
-            })
+            nodes.append({"id": item["id"], "title": item["title"], "type": item.get("type", "CLAIM"), "value": item.get("value"), "confidence": item.get("confidence", 0.95), "status": item.get("status", "ACTIVE"), "filename": item.get("filename")})
         for p in self.proposals:
-            nodes.append({
-                "id": f"proposal-{p['id']}",
-                "title": f"[PR] {p['summary']}",
-                "type": "PROPOSAL",
-                "value": str(p.get("proposed_changes", {}).get("value", "")),
-                "confidence": 0.9,
-                "status": "PROPOSED",
-            })
-        return {
-            "nodes": nodes,
-            "edges": edges,
-            "stats": {"total_nodes": len(nodes), "total_edges": len(edges)},
-        }
+            if p.get("status") == "PENDING":
+                nodes.append({"id": f"proposal-{p['id']}", "title": f"[PR] {p['summary'][:50]}", "type": "PROPOSAL", "value": str(p.get("proposed_changes", {}).get("value", "")), "confidence": 0.9, "status": "PROPOSED"})
+        ki = self.knowledge_items
+        for i in range(len(ki) - 1):
+            edges.append({"id": f"edge-{i}", "source": ki[i]["id"], "target": ki[i + 1]["id"], "relationship": "RELATED_TO"})
+        return {"nodes": nodes, "edges": edges, "stats": {"total_nodes": len(nodes), "total_edges": len(edges)}}
 
-    async def tool_list_knowledge_items(self, args: dict[str, Any]):
-        return self.knowledge_items
+    async def tool_list_knowledge_items(self, args):
+        ws_id = args.get("workspace_id")
+        status = args.get("status")
+        items = [i for i in self.knowledge_items if not ws_id or i.get("workspace_id") == ws_id]
+        if status:
+            items = [i for i in items if i.get("status", "").upper() == status.upper()]
+        return items
+
+    async def tool_list_knowledge(self, args):
+        return await self.tool_list_knowledge_items(args)
 
-    async def tool_search_knowledge(self, args: dict[str, Any]):
+    async def tool_get_knowledge_item(self, args):
+        item_id = args.get("item_id")
+        for item in self.knowledge_items:
+            if item["id"] == item_id:
+                return item
+        return {"id": item_id, "status": "NOT_FOUND"}
+
+    async def tool_search_knowledge(self, args):
         query = args.get("query", "").lower()
-        matches = [
-            item
-            for item in self.knowledge_items
-            if query in str(item.get("value", "")).lower()
-            or query in str(item.get("title", "")).lower()
-        ]
-        return matches
+        if not query:
+            return self.knowledge_items
+        return [item for item in self.knowledge_items if query in str(item.get("value", "")).lower() or query in str(item.get("title", "")).lower()]
 
-    async def tool_export_knowledge(self, args: dict[str, Any]):
+    async def tool_export_knowledge(self, args):
         return {"knowledge_items": self.knowledge_items}
 
-    async def tool_list_rules(self, args: dict[str, Any]):
-        return self.rules
-
-    async def tool_create_rule(self, args: dict[str, Any]):
-        rule = {
-            "id": str(uuid.uuid4()),
-            "workspace_id": args.get("workspace_id"),
-            "name": args.get("name", "New Policy Rule"),
-            "rule_type": args.get("rule_type", "CUSTOM"),
-            "condition": args.get("condition", {}),
-            "is_blocking": args.get("is_blocking", True),
-        }
+    async def tool_list_rules(self, args):
+        ws_id = args.get("workspace_id")
+        return [r for r in self.rules if not ws_id or r.get("workspace_id") == ws_id]
+
+    async def tool_create_rule(self, args):
+        rule = {"id": str(uuid.uuid4()), "workspace_id": args.get("workspace_id", _WS), "name": args.get("name", "New Policy Rule"), "rule_type": args.get("rule_type", "CUSTOM"), "condition": args.get("condition", {}), "is_blocking": args.get("is_blocking", True), "enabled": True}
         self.rules.append(rule)
         return rule
 
-    async def tool_delete_rule(self, args: dict[str, Any]):
+    async def tool_delete_rule(self, args):
         rid = args.get("rule_id")
         self.rules = [r for r in self.rules if r["id"] != rid]
         return {"status": "DELETED", "rule_id": rid}
 
-    async def tool_get_activity_feed(self, args: dict[str, Any]):
-        return self.activity_log
+    async def tool_enable_rule(self, args):
+        rid = args.get("rule_id")
+        for r in self.rules:
+            if r["id"] == rid:
+                r["enabled"] = True
+        return {"status": "ok", "rule_id": rid, "enabled": True}
+
+    async def tool_disable_rule(self, args):
+        rid = args.get("rule_id")
+        for r in self.rules:
+            if r["id"] == rid:
+                r["enabled"] = False
+        return {"status": "ok", "rule_id": rid, "enabled": False}
+
+    async def tool_get_activity_feed(self, args):
+        limit = args.get("limit", 50)
+        return self.activity_log[:limit]
+
+    async def tool_get_dashboard_stats(self, args):
+        ws_id = args.get("workspace_id")
+        docs = [d for d in self.documents if not ws_id or d.get("workspace_id") == ws_id]
+        props = [p for p in self.proposals if not ws_id or p.get("workspace_id") == ws_id]
+        ki = [k for k in self.knowledge_items if not ws_id or k.get("workspace_id") == ws_id]
+        pending = [p for p in props if p.get("status") == "PENDING"]
+        approved = [p for p in props if p.get("status") == "APPROVED"]
+        rejected = [p for p in props if p.get("status") == "REJECTED"]
+        return {"workspace_id": ws_id, "total_documents": len(docs), "total_knowledge_items": len(ki), "total_proposals": len(props), "pending_proposals": len(pending), "approved_proposals": len(approved), "rejected_proposals": len(rejected)}
+
+    async def tool_restore_proposal(self, args):
+        pid = args.get("proposal_id")
+        for p in self.proposals:
+            if p["id"] == pid:
+                p["status"] = "PENDING"
+                return {"status": "ok", "proposal_id": pid, "restored": True}
+        return {"status": "NOT_FOUND"}

pyproject.toml

@@ -16,11 +16,16 @@ dependencies = [
     "httpx>=0.25.0",
     "fastapi>=0.100.0",
     "uvicorn>=0.23.0",
+    "sqlalchemy>=2.0.0",
+    "psycopg2-binary>=2.9.0",
+    "python-jose[cryptography]>=3.3.0",
+    "passlib[bcrypt]>=1.7.4",
 ]
 
 [project.scripts]
-dw = "cli.main:app"
+dw = "diffweave.cli.main:app"
+diffweave = "diffweave.cli.main:app"
 
 [tool.setuptools.packages.find]
 where = ["."]
-include = ["cli*", "mcp*", "bridge*"]
+include = ["diffweave*"]

requirements.txt

@@ -0,0 +1,14 @@
+fastapi>=0.115.0
+uvicorn[standard]>=0.30.6
+pydantic>=2.8.2
+httpx>=0.27.2
+typer>=0.12.5
+rich>=13.8.0
+python-multipart>=0.0.9
+sqlalchemy>=2.0.0
+psycopg2-binary>=2.9.9
+passlib[bcrypt]>=1.7.4
+bcrypt>=4.0.0
+python-jose[cryptography]>=3.3.0
+requests>=2.31.0
+python-dotenv>=1.0.0

studio/package-lock.json

@@ -11,7 +11,8 @@
         "canvas-confetti": "^1.9.4",
         "lucide-react": "^1.49.0",
         "react": "^18.2.0",
-        "react-dom": "^18.2.0"
+        "react-dom": "^18.2.0",
+        "react-router-dom": "^7.18.4"
       },
       "devDependencies": {
         "@vitejs/plugin-react": "^4.2.0",
@@ -1518,6 +1519,19 @@
       "dev": true,
       "license": "MIT"
     },
+    "node_modules/cookie": {
+      "version": "1.1.1",
+      "resolved": "https://registry.npmjs.org/cookie/-/cookie-1.1.1.tgz",
+      "integrity": "sha512-ei8Aos7ja0weRpFzJnEA9UHJ/7XQmqglbRwnf2ATjcB9Wq874VKH9kfjjirM6UhU2/E5fFYadylyhFldcqSidQ==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=18"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/express"
+      }
+    },
     "node_modules/cssesc": {
       "version": "3.0.0",
       "resolved": "https://registry.npmjs.org/cssesc/-/cssesc-3.0.0.tgz",
@@ -2279,6 +2293,44 @@
         "node": ">=0.10.0"
       }
     },
+    "node_modules/react-router": {
+      "version": "7.18.4",
+      "resolved": "https://registry.npmjs.org/react-router/-/react-router-7.18.4.tgz",
+      "integrity": "sha512-PUPQcMhMGRAslLcvtlPz/kmzBEWPhLdgLFrL7pLNepBL6dX0lWj4WD2cUYVgYCuT3jxvghYFg81cDTj44DhetQ==",
+      "license": "MIT",
+      "dependencies": {
+        "cookie": "^1.0.1",
+        "set-cookie-parser": "^2.6.0"
+      },
+      "engines": {
+        "node": ">=20.0.0"
+      },
+      "peerDependencies": {
+        "react": ">=18",
+        "react-dom": ">=18"
+      },
+      "peerDependenciesMeta": {
+        "react-dom": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/react-router-dom": {
+      "version": "7.18.4",
+      "resolved": "https://registry.npmjs.org/react-router-dom/-/react-router-dom-7.18.4.tgz",
+      "integrity": "sha512-yrfmJHIpDG7taCpqKjT1G5B6q3O2K+RN8/fgNf0lTjCwiPbQ0ei6vXX9ZjQR+7ld8Tr7Z5xmyMnZ8YJrphWQUw==",
+      "license": "MIT",
+      "dependencies": {
+        "react-router": "7.18.4"
+      },
+      "engines": {
+        "node": ">=20.0.0"
+      },
+      "peerDependencies": {
+        "react": ">=18",
+        "react-dom": ">=18"
+      }
+    },
     "node_modules/read-cache": {
       "version": "1.0.2",
       "resolved": "https://registry.npmjs.org/read-cache/-/read-cache-1.0.2.tgz",
@@ -2421,6 +2473,12 @@
         "semver": "bin/semver.js"
       }
     },
+    "node_modules/set-cookie-parser": {
+      "version": "2.7.2",
+      "resolved": "https://registry.npmjs.org/set-cookie-parser/-/set-cookie-parser-2.7.2.tgz",
+      "integrity": "sha512-oeM1lpU/UvhTxw+g3cIfxXHyJRc/uidd3yK1P242gzHds0udQBYzs3y8j4gCCW+ZJ7ad0yctld8RYO+bdurlvw==",
+      "license": "MIT"
+    },
     "node_modules/source-map-js": {
       "version": "1.2.2",
       "resolved": "https://registry.npmjs.org/source-map-js/-/source-map-js-1.2.2.tgz",

studio/package.json

@@ -11,7 +11,8 @@
     "canvas-confetti": "^1.9.4",
     "lucide-react": "^1.49.0",
     "react": "^18.2.0",
-    "react-dom": "^18.2.0"
+    "react-dom": "^18.2.0",
+    "react-router-dom": "^7.18.4"
   },
   "devDependencies": {
     "@vitejs/plugin-react": "^4.2.0",

studio/src/App.jsx

@@ -1,4 +1,6 @@
-import React, { useState, useEffect, useCallback } from 'react';
+import { useNavigate, Navigate } from 'react-router-dom';
+import { useAuth } from './context/AuthContext.jsx';
+import React, { useState, useEffect, useCallback } from 'react';
 import { api } from './api/client';
 import Navbar from './components/Navbar';
 import SemanticDiffViewer from './components/SemanticDiffViewer';
@@ -12,10 +14,14 @@ import AuthView from './components/AuthView';
 import { RefreshCw, CheckCircle2, AlertCircle, Sparkles, GitBranch } from 'lucide-react';
 
 export default function App() {
+  const { isAuthenticated, logout: authLogout, user: authUser } = useAuth();
+  const navigate = useNavigate();
+
   const [workspaces, setWorkspaces] = useState([]);
   const [currentWorkspace, setCurrentWorkspace] = useState(null);
   const [activeTab, setActiveTab] = useState('diff'); // Default to Semantic Diff Viewer!
   const [currentUser, setCurrentUser] = useState(null);
+  const [searchQuery, setSearchQuery] = useState('');
 
   // State data
   const [stats, setStats] = useState(null);
@@ -49,16 +55,8 @@ export default function App() {
         showToast(`Connecting to DiffWeave FastMCP Bridge...`, 'info');
       }
 
-      // Check current user
       const localUser = api.getCurrentUser();
-      if (localUser) {
-        setCurrentUser(localUser);
-      } else {
-        const who = await api.getWhoami();
-        if (who?.authenticated && who?.user) {
-          setCurrentUser(who.user);
-        }
-      }
+      if (localUser) setCurrentUser(localUser);
     }
     init();
   }, []);
@@ -76,11 +74,11 @@ export default function App() {
       }
       if (activeTab === 'prs') {
         const prsRes = await api.getProposals(wsId);
-        setProposals(prsRes || []);
+        setProposals(Array.isArray(prsRes) ? prsRes : []);
       }
       if (activeTab === 'staging') {
         const docsRes = await api.getDocuments(wsId);
-        setDocuments(docsRes || []);
+        setDocuments(Array.isArray(docsRes) ? docsRes : []);
       }
       if (activeTab === 'graph') {
         const graphRes = await api.getKnowledgeGraph(wsId);
@@ -88,15 +86,15 @@ export default function App() {
       }
       if (activeTab === 'knowledge') {
         const kRes = await api.getKnowledgeItems(wsId);
-        setKnowledgeItems(kRes || []);
+        setKnowledgeItems(Array.isArray(kRes) ? kRes : []);
       }
       if (activeTab === 'rules') {
         const rulesRes = await api.getRules(wsId);
-        setRules(rulesRes || []);
+        setRules(Array.isArray(rulesRes) ? rulesRes : []);
       }
       if (activeTab === 'audit') {
         const actRes = await api.getActivityFeed(wsId);
-        setActivity(actRes || []);
+        setActivity(Array.isArray(actRes) ? actRes : []);
       }
 
       // Background status fetch for navbar counters
@@ -118,6 +116,14 @@ export default function App() {
   useEffect(() => {
     refreshData();
   }, [refreshData]);
+  useEffect(() => {
+    if (authUser) {
+      setCurrentUser(authUser);
+    } else {
+      const u = api.getCurrentUser();
+      if (u) setCurrentUser(u);
+    }
+  }, [authUser]);
 
   // Actions
   const handleCreateWorkspace = async (name, desc) => {
@@ -133,7 +139,7 @@ export default function App() {
 
   const handleReview = async (proposalId, decision, comments = '') => {
     try {
-      await api.reviewProposal(proposalId, decision, comments);
+      await api.reviewProposal(currentWorkspace?.id, proposalId, decision, comments);
       showToast(`Proposal ${decision.toLowerCase()}!`);
       refreshData();
     } catch (err) {
@@ -196,14 +202,21 @@ export default function App() {
 
   const handleLogout = () => {
     api.logout();
-    setCurrentUser(null);
-    showToast('Logged out of DiffWeave.');
+    authLogout();
+    navigate('/login', { replace: true });
   };
 
+  // If user is not authenticated, strictly redirect to /login
+  if (!isAuthenticated) {
+    return <Navigate to="/login" replace />;
+  }
+
   return (
     <div className="min-h-screen bg-[#0D1117] text-slate-100 flex flex-col font-sans selection:bg-emerald-500/20 selection:text-emerald-300">
       {/* Platform Navigation */}
       <Navbar
+        searchQuery={searchQuery}
+        onSearchChange={setSearchQuery}
         workspaces={workspaces}
         currentWorkspace={currentWorkspace}
         onSelectWorkspace={(id) => setCurrentWorkspace(workspaces.find((w) => w.id === id))}
@@ -306,6 +319,8 @@ export default function App() {
             knowledgeItems={knowledgeItems}
             currentWorkspace={currentWorkspace}
             loading={loading}
+            searchQuery={searchQuery}
+            onSearchChange={setSearchQuery}
           />
         )}
 

studio/src/api/client.js

@@ -1,4 +1,4 @@
-/**
+/**
  * DiffWeave Studio API Client
  * Talks directly to the FastAPI bridge, which delegates to DocWeave MCP Server.
  * Supports Bearer token authentication and user sessions.
@@ -160,7 +160,7 @@ export const api = {
     const headers = {};
     if (token) headers['Authorization'] = `Bearer ${token}`;
 
-    const res = await fetch(`${API_BASE}/workspaces/${workspaceId}/documents/upload`, {
+    const res = await fetch(`${API_BASE}/workspaces/${workspaceId}/upload`, {
       method: 'POST',
       headers,
       body: formData,
@@ -180,8 +180,8 @@ export const api = {
     return res.json();
   },
 
-  async reviewProposal(proposalId, decision, comments = '') {
-    const res = await fetch(`${API_BASE}/proposals/${proposalId}/review`, {
+  async reviewProposal(workspaceId, proposalId, decision, comments = '') {
+    const res = await fetch(`${API_BASE}/workspaces/${workspaceId}/proposals/${proposalId}/review`, {
       method: 'POST',
       headers: getHeaders(),
       body: JSON.stringify({ decision, comments }),

studio/src/components/AuthLayout.jsx

@@ -0,0 +1,51 @@
+import { Link } from "react-router-dom";
+
+// DiffWeave brand mark (replaces DocWeave logo)
+function DiffWeaveMark() {
+  return (
+    <svg width="36" height="36" viewBox="0 0 36 36" fill="none" xmlns="http://www.w3.org/2000/svg">
+      <rect width="36" height="36" rx="8" fill="url(#dw-grad)" />
+      <path d="M10 18 L14 12 L18 18 L22 10 L26 18" stroke="white" strokeWidth="2.5" strokeLinecap="round" strokeLinejoin="round" fill="none"/>
+      <circle cx="26" cy="24" r="3" fill="white" opacity="0.8"/>
+      <defs>
+        <linearGradient id="dw-grad" x1="0" y1="0" x2="36" y2="36" gradientUnits="userSpaceOnUse">
+          <stop stopColor="#10B981"/>
+          <stop offset="1" stopColor="#059669"/>
+        </linearGradient>
+      </defs>
+    </svg>
+  );
+}
+
+export function AuthLayout({ eyebrow, title, subtitle, children, footer }) {
+  return (
+    <div className="dw-auth">
+      <div className="dw-auth__panel">
+        <div className="dw-auth__brand">
+          <DiffWeaveMark />
+          <span className="dw-auth__wordmark">DiffWeave</span>
+          <span className="dw-auth__by">by DocWeave</span>
+        </div>
+
+        <div className="dw-auth__card">
+          {eyebrow && <span className="dw-auth__eyebrow">{eyebrow}</span>}
+          <h1 className="dw-auth__title">{title}</h1>
+          {subtitle && <p className="dw-auth__subtitle">{subtitle}</p>}
+          <div className="dw-auth__body">{children}</div>
+        </div>
+
+        {footer && <div className="dw-auth__footer">{footer}</div>}
+      </div>
+
+      <div className="dw-auth__aside" aria-hidden="true">
+        <div className="dw-auth__aside-grid" />
+        <div className="dw-auth__aside-copy">
+          <span className="dw-auth__tagline-line">AI proposes.</span>
+          <span className="dw-auth__tagline-line">Rules validate.</span>
+          <span className="dw-auth__tagline-line">Humans decide.</span>
+          <span className="dw-auth__tagline-line dw-auth__tagline-line--accent">Knowledge commits.</span>
+        </div>
+      </div>
+    </div>
+  );
+}

studio/src/components/KnowledgeBase.jsx

@@ -11,11 +11,14 @@ import {
   Layers
 } from 'lucide-react';
 
-export default function KnowledgeBase({ knowledgeItems, currentWorkspace, loading }) {
-  const [search, setSearch] = useState('');
+export default function KnowledgeBase({ knowledgeItems = [], currentWorkspace, loading, searchQuery = '', onSearchChange }) {
+  const [internalSearch, setInternalSearch] = useState('');
   const [categoryFilter, setCategoryFilter] = useState('ALL');
   const [copiedId, setCopiedId] = useState(null);
 
+  const search = searchQuery !== undefined && searchQuery !== '' ? searchQuery : internalSearch;
+  const setSearch = onSearchChange || setInternalSearch;
+
   if (loading) {
     return (
       <div className="flex flex-col items-center justify-center py-24 space-y-4">
@@ -26,14 +29,19 @@ export default function KnowledgeBase({ knowledgeItems, currentWorkspace, loadin
   }
 
   const filtered = knowledgeItems.filter((item) => {
-    const matchesCat = categoryFilter === 'ALL' || item.type === categoryFilter;
-    const matchesSearch =
-      !search ||
-      item.title.toLowerCase().includes(search.toLowerCase()) ||
-      String(item.value || '').toLowerCase().includes(search.toLowerCase());
-    return matchesCat && matchesSearch;
+    const itemType = String(item.type || '').toUpperCase();
+    const matchesCat = categoryFilter === 'ALL' || itemType === categoryFilter;
+    const s = search.toLowerCase().trim();
+    if (!s) return matchesCat;
+    const titleMatch = (item.title || '').toLowerCase().includes(s);
+    const valueMatch = String(item.value || '').toLowerCase().includes(s);
+    const typeMatch = itemType.toLowerCase().includes(s);
+    const fileMatch = (item.filename || '').toLowerCase().includes(s);
+    return matchesCat && (titleMatch || valueMatch || typeMatch || fileMatch);
   });
 
+  const availableCategories = ['ALL', ...new Set(knowledgeItems.map((i) => String(i.type || '').toUpperCase()).filter(Boolean))];
+
   const handleCopy = (val, id) => {
     navigator.clipboard.writeText(val);
     setCopiedId(id);
@@ -116,11 +124,11 @@ export default function KnowledgeBase({ knowledgeItems, currentWorkspace, loadin
             onChange={(e) => setCategoryFilter(e.target.value)}
             className="bg-[#141B2D] border border-slate-800 rounded-lg px-2.5 py-1.5 text-xs text-slate-300 focus:outline-none"
           >
-            <option value="ALL">All Categories</option>
-            <option value="CLAIM">Claims</option>
-            <option value="METRIC">Metrics</option>
-            <option value="ENTITY">Entities</option>
-            <option value="DATE">Dates</option>
+            {availableCategories.map((cat) => (
+              <option key={cat} value={cat}>
+                {cat === 'ALL' ? 'All Categories' : cat}
+              </option>
+            ))}
           </select>
 
           {/* Export Button */}

studio/src/components/Navbar.jsx

@@ -1,4 +1,4 @@
-import React, { useState } from 'react';
+import React, { useState, useRef, useEffect } from 'react';
 import {
   FileDiff,
   GitPullRequest,
@@ -41,6 +41,45 @@ export default function Navbar({
   const [newWsName, setNewWsName] = useState('');
   const [showUserDropdown, setShowUserDropdown] = useState(false);
 
+  const wsDropdownRef = useRef(null);
+  const userDropdownRef = useRef(null);
+  const searchInputRef = useRef(null);
+
+  // Keyboard shortcut '/' to focus global search
+  useEffect(() => {
+    function handleKeyDown(e) {
+      if (e.key === '/' && document.activeElement !== searchInputRef.current && !['INPUT', 'TEXTAREA'].includes(document.activeElement?.tagName)) {
+        e.preventDefault();
+        searchInputRef.current?.focus();
+      }
+      if (e.key === 'Escape' && document.activeElement === searchInputRef.current) {
+        if (onSearchChange) onSearchChange('');
+        searchInputRef.current?.blur();
+      }
+    }
+    window.addEventListener('keydown', handleKeyDown);
+    return () => window.removeEventListener('keydown', handleKeyDown);
+  }, [onSearchChange]);
+
+  // Close dropdowns when clicking anywhere outside
+  useEffect(() => {
+    function handleClickOutside(event) {
+      if (wsDropdownRef.current && !wsDropdownRef.current.contains(event.target)) {
+        setShowWsDropdown(false);
+      }
+      if (userDropdownRef.current && !userDropdownRef.current.contains(event.target)) {
+        setShowUserDropdown(false);
+      }
+    }
+
+    document.addEventListener('mousedown', handleClickOutside);
+    document.addEventListener('touchstart', handleClickOutside);
+    return () => {
+      document.removeEventListener('mousedown', handleClickOutside);
+      document.removeEventListener('touchstart', handleClickOutside);
+    };
+  }, []);
+
   const handleCreate = async (e) => {
     e.preventDefault();
     if (!newWsName.trim()) return;
@@ -49,13 +88,17 @@ export default function Navbar({
     setShowCreateModal(false);
   };
 
+  const totalDocs = stats?.total_documents ?? 0;
+  const verifiedFacts = stats?.knowledge_items ?? stats?.total_knowledge_items ?? 0;
+  const pendingProposals = stats?.pending_proposals ?? 0;
+
   const tabs = [
-    { id: 'diff', label: 'Semantic Diff', icon: FileDiff, badge: stats?.pending_proposals ? `${stats.pending_proposals}` : '2' },
-    { id: 'prs', label: 'Knowledge PRs', icon: GitPullRequest, badge: stats?.pending_proposals ? `${stats.pending_proposals}` : '3' },
+    { id: 'diff', label: 'Semantic Diff', icon: FileDiff, badge: pendingProposals > 0 ? `${pendingProposals}` : undefined },
+    { id: 'prs', label: 'Knowledge PRs', icon: GitPullRequest, badge: pendingProposals > 0 ? `${pendingProposals}` : undefined },
     { id: 'graph', label: 'Topology Graph', icon: Network },
-    { id: 'staging', label: 'Documents & Staging', icon: Files, badge: stats?.total_documents ? `${stats.total_documents}` : '4' },
-    { id: 'rules', label: 'Policy CI Rules', icon: ShieldCheck, badge: '3' },
-    { id: 'knowledge', label: 'Master Truth Register', icon: Database, badge: stats?.total_knowledge_items ? `${stats.total_knowledge_items}` : '18' },
+    { id: 'staging', label: 'Documents & Staging', icon: Files, badge: totalDocs > 0 ? `${totalDocs}` : undefined },
+    { id: 'rules', label: 'Policy CI Rules', icon: ShieldCheck },
+    { id: 'knowledge', label: 'Master Truth Register', icon: Database, badge: verifiedFacts > 0 ? `${verifiedFacts}` : undefined },
     { id: 'audit', label: 'Audit Trail', icon: History },
     { id: 'auth', label: 'API Keys & Auth', icon: Key, badge: currentUser ? 'Active' : 'DocWeave' },
   ];
@@ -91,9 +134,12 @@ export default function Navbar({
           <span className="text-slate-600 hidden sm:inline">/</span>
 
           {/* Workspace Dropdown */}
-          <div className="relative">
+          <div ref={wsDropdownRef} className="relative">
             <button
-              onClick={() => setShowWsDropdown(!showWsDropdown)}
+              onClick={() => {
+                setShowWsDropdown((prev) => !prev);
+                setShowUserDropdown(false);
+              }}
               className="flex items-center space-x-1.5 px-2.5 py-1 rounded-md bg-[#161B22] hover:bg-[#21262D] border border-[#30363D] text-slate-200 transition font-medium"
             >
               <span className="w-2 h-2 rounded-full bg-emerald-400 animate-pulse" />
@@ -121,8 +167,13 @@ export default function Navbar({
                         : 'text-slate-300 hover:bg-[#21262D]'
                     }`}
                   >
-                    <span className="truncate">{w.name}</span>
-                    {currentWorkspace?.id === w.id && <CheckCircle2 className="w-3 h-3 text-emerald-400" />}
+                    <div className="flex flex-col truncate pr-2">
+                      <span className="truncate font-semibold">{w.name}</span>
+                      {w.description && (
+                        <span className="text-[10px] text-slate-400 font-normal truncate">{w.description}</span>
+                      )}
+                    </div>
+                    {currentWorkspace?.id === w.id && <CheckCircle2 className="w-3.5 h-3.5 text-emerald-400 shrink-0" />}
                   </button>
                 ))}
                 <div className="pt-1 border-t border-[#30363D]">
@@ -192,9 +243,12 @@ export default function Navbar({
 
           {/* User Profile / Auth Button */}
           {currentUser ? (
-            <div className="relative">
+            <div ref={userDropdownRef} className="relative">
               <button
-                onClick={() => setShowUserDropdown(!showUserDropdown)}
+                onClick={() => {
+                  setShowUserDropdown((prev) => !prev);
+                  setShowWsDropdown(false);
+                }}
                 className="flex items-center space-x-1.5 px-2.5 py-1 rounded-full bg-[#161B22] hover:bg-[#21262D] border border-[#30363D] text-slate-200 transition"
               >
                 <div className="w-4 h-4 rounded-full bg-emerald-500 text-black font-bold flex items-center justify-center text-[9px]">
@@ -237,7 +291,7 @@ export default function Navbar({
             </div>
           ) : (
             <button
-              onClick={onOpenAuth}
+              onClick={() => { window.location.href = "/login"; }}
               className="flex items-center space-x-1.5 px-3 py-1 rounded-md bg-[#238636] hover:bg-[#2EA043] text-white font-semibold text-xs transition shadow"
             >
               <Lock className="w-3 h-3" />
@@ -269,19 +323,19 @@ export default function Navbar({
           <div className="flex items-center space-x-1.5 px-2.5 py-1 rounded-md bg-[#161B22] border border-[#30363D] text-slate-300">
             <Files className="w-3.5 h-3.5 text-sky-400" />
             <span>Tracked Docs:</span>
-            <span className="text-white font-bold font-mono">{stats?.total_documents || 4}</span>
+            <span className="text-white font-bold font-mono">{totalDocs}</span>
           </div>
 
           <div className="flex items-center space-x-1.5 px-2.5 py-1 rounded-md bg-[#161B22] border border-[#30363D] text-slate-300">
             <Database className="w-3.5 h-3.5 text-emerald-400" />
             <span>Verified Truth:</span>
-            <span className="text-white font-bold font-mono">{stats?.total_knowledge_items || 18} Facts</span>
+            <span className="text-white font-bold font-mono">{verifiedFacts} Facts</span>
           </div>
 
           <div className="flex items-center space-x-1.5 px-2.5 py-1 rounded-md bg-[#161B22] border border-[#30363D] text-slate-300">
             <GitPullRequest className="w-3.5 h-3.5 text-amber-400" />
             <span>Pending PRs:</span>
-            <span className="text-amber-400 font-bold font-mono">{stats?.pending_proposals || 3}</span>
+            <span className="text-amber-400 font-bold font-mono">{pendingProposals}</span>
           </div>
         </div>
       </div>

studio/src/components/ProtectedRoute.jsx

@@ -0,0 +1,16 @@
+import { useAuth } from "../context/AuthContext.jsx";
+import { Navigate, useLocation } from "react-router-dom";
+
+export default function ProtectedRoute({ children }) {
+  const { isAuthenticated, token } = useAuth();
+  const location = useLocation();
+
+  // Check both React state and localStorage to prevent transition flashes
+  const hasToken = isAuthenticated || Boolean(token) || Boolean(localStorage.getItem("diffweave_token"));
+
+  if (!hasToken) {
+    return <Navigate to="/login" state={{ from: location }} replace />;
+  }
+
+  return children;
+}

studio/src/context/AuthContext.jsx

@@ -0,0 +1,79 @@
+import { createContext, useContext, useState, useCallback, useEffect } from "react";
+
+const AuthContext = createContext();
+
+const TOKEN_KEY = "diffweave_token";
+const USER_KEY = "diffweave_user";
+
+export function AuthProvider({ children }) {
+  const [token, setToken] = useState(() => localStorage.getItem(TOKEN_KEY) || localStorage.getItem("token"));
+  const [user, setUser] = useState(() => {
+    try {
+      const u = localStorage.getItem(USER_KEY) || localStorage.getItem("user");
+      return u ? JSON.parse(u) : null;
+    } catch {
+      return null;
+    }
+  });
+
+  // Validate token with DocWeave auth engine on mount
+  useEffect(() => {
+    if (token && !user) {
+      fetch("/api/auth/me", {
+        headers: { Authorization: `Bearer ${token}` },
+      })
+        .then((r) => (r.ok ? r.json() : null))
+        .then((data) => {
+          if (data && !data.detail) {
+            setUser(data);
+            localStorage.setItem(USER_KEY, JSON.stringify(data));
+          } else {
+            // Invalid token - clear
+            localStorage.removeItem(TOKEN_KEY);
+            localStorage.removeItem(USER_KEY);
+            localStorage.removeItem("token");
+            setToken(null);
+            setUser(null);
+          }
+        })
+        .catch(() => {});
+    }
+  }, [token]); // eslint-disable-line
+
+  const login = useCallback((accessToken, userData = null) => {
+    localStorage.setItem(TOKEN_KEY, accessToken);
+    localStorage.setItem("token", accessToken);
+    setToken(accessToken);
+    if (userData) {
+      localStorage.setItem(USER_KEY, JSON.stringify(userData));
+      setUser(userData);
+    }
+  }, []);
+
+  const logout = useCallback(() => {
+    // Notify server to clear CLI credentials
+    fetch("/api/auth/logout", { method: "POST" }).catch(() => {});
+    localStorage.removeItem(TOKEN_KEY);
+    localStorage.removeItem(USER_KEY);
+    localStorage.removeItem("token");
+    setToken(null);
+    setUser(null);
+  }, []);
+
+  return (
+    <AuthContext.Provider
+      value={{
+        token,
+        user,
+        setUser,
+        isAuthenticated: Boolean(token),
+        login,
+        logout,
+      }}
+    >
+      {children}
+    </AuthContext.Provider>
+  );
+}
+
+export const useAuth = () => useContext(AuthContext);

studio/src/index.css

@@ -1,4 +1,4 @@
-@tailwind base;
+@tailwind base;
 @tailwind components;
 @tailwind utilities;
 
@@ -66,3 +66,384 @@ code, pre, .font-mono {
 .pulse-glow {
   animation: pulse-dot 2s infinite ease-in-out;
 }
+
+/* ============================================================
+   DiffWeave Auth Pages (mirrors DocWeave AuthLayout.css)
+   ============================================================ */
+.dw-auth {
+  min-height: 100vh;
+  display: grid;
+  grid-template-columns: minmax(0, 460px) 1fr;
+  background: #0D1117;
+  font-family: 'Inter', system-ui, sans-serif;
+  color: #E2E8F0;
+}
+
+.dw-auth__panel {
+  display: flex;
+  flex-direction: column;
+  justify-content: center;
+  padding: 60px 48px;
+  border-right: 1px solid #21262D;
+}
+
+.dw-auth__brand {
+  display: flex;
+  align-items: center;
+  gap: 10px;
+  margin-bottom: 48px;
+}
+
+.dw-auth__wordmark {
+  font-size: 20px;
+  font-weight: 700;
+  letter-spacing: -0.02em;
+  color: #F8FAFC;
+}
+
+.dw-auth__by {
+  font-size: 11px;
+  color: #4B5563;
+  margin-left: 2px;
+  margin-top: 2px;
+}
+
+.dw-auth__card {
+  animation: dw-fade-in 0.25s ease;
+}
+
+@keyframes dw-fade-in {
+  from { opacity: 0; transform: translateY(8px); }
+  to   { opacity: 1; transform: translateY(0); }
+}
+
+.dw-auth__eyebrow {
+  display: inline-block;
+  font-size: 11px;
+  font-weight: 600;
+  letter-spacing: 0.06em;
+  text-transform: uppercase;
+  color: #10B981;
+  margin-bottom: 12px;
+}
+
+.dw-auth__title {
+  font-size: 28px;
+  font-weight: 700;
+  color: #F8FAFC;
+  margin: 0 0 8px;
+  letter-spacing: -0.02em;
+}
+
+.dw-auth__subtitle {
+  color: #6B7280;
+  font-size: 14px;
+  margin: 0 0 32px;
+  line-height: 1.6;
+}
+
+.dw-auth__body {
+  display: flex;
+  flex-direction: column;
+  gap: 16px;
+  max-width: 360px;
+}
+
+.dw-auth__footer {
+  margin-top: 32px;
+  font-size: 13px;
+  color: #6B7280;
+}
+
+.dw-auth__footer a {
+  color: #10B981;
+  text-decoration: none;
+}
+
+.dw-auth__footer a:hover {
+  text-decoration: underline;
+}
+
+/* ── Right panel ─────────────────────────────────────────── */
+.dw-auth__aside {
+  position: relative;
+  background: linear-gradient(145deg, #0d1117 0%, #0a1628 50%, #0d1117 100%);
+  overflow: hidden;
+  display: flex;
+  align-items: center;
+  justify-content: center;
+  padding: 60px;
+}
+
+.dw-auth__aside-grid {
+  position: absolute;
+  inset: 0;
+  background-image:
+    linear-gradient(rgba(16,185,129,0.12) 1px, transparent 1px),
+    linear-gradient(90deg, rgba(16,185,129,0.12) 1px, transparent 1px);
+  background-size: 48px 48px;
+  mask-image: radial-gradient(ellipse at 50% 40%, black 20%, transparent 70%);
+}
+
+.dw-auth__aside::before {
+  content: "";
+  position: absolute;
+  inset: 0;
+  background:
+    radial-gradient(circle at 25% 25%, rgba(16,185,129,0.2) 0%, transparent 40%),
+    radial-gradient(circle at 75% 65%, rgba(110, 86, 255, 0.15) 0%, transparent 35%),
+    radial-gradient(circle at 50% 90%, rgba(16,185,129,0.1) 0%, transparent 30%);
+  z-index: 0;
+}
+
+.dw-auth__aside-copy {
+  position: relative;
+  z-index: 1;
+  display: flex;
+  flex-direction: column;
+  align-items: flex-start;
+  gap: 12px;
+}
+
+.dw-auth__tagline-line {
+  font-size: 2rem;
+  font-weight: 700;
+  color: #F8FAFC;
+  letter-spacing: -0.02em;
+  line-height: 1.2;
+  opacity: 0.8;
+}
+
+.dw-auth__tagline-line--accent {
+  color: #10B981;
+  opacity: 1;
+}
+
+@media (max-width: 900px) {
+  .dw-auth { grid-template-columns: 1fr; }
+  .dw-auth__aside { display: none; }
+  .dw-auth__panel { padding: 40px 24px; }
+}
+
+/* ── Form shared styles ─────────────────────────────────── */
+.dw-auth-form {
+  display: flex;
+  flex-direction: column;
+  gap: 16px;
+  max-width: 360px;
+}
+
+.dw-field {
+  display: flex;
+  flex-direction: column;
+  gap: 5px;
+}
+
+.dw-label {
+  font-size: 13px;
+  font-weight: 500;
+  color: #CBD5E1;
+}
+
+.dw-input {
+  width: 100%;
+  padding: 9px 13px;
+  background: #161B22;
+  border: 1px solid #30363D;
+  border-radius: 8px;
+  color: #E2E8F0;
+  font-size: 14px;
+  outline: none;
+  transition: border-color 0.15s, box-shadow 0.15s;
+  box-sizing: border-box;
+}
+
+.dw-input:focus {
+  border-color: #10B981;
+  box-shadow: 0 0 0 3px rgba(16,185,129,0.15);
+}
+
+.dw-input--otp {
+  font-size: 22px;
+  text-align: center;
+  letter-spacing: 0.3em;
+  font-family: monospace;
+}
+
+.dw-field__error {
+  font-size: 11px;
+  color: #F87171;
+}
+
+.dw-auth-form__show-password {
+  display: flex;
+  align-items: center;
+  gap: 6px;
+  font-size: 12px;
+  color: #6B7280;
+  cursor: pointer;
+  user-select: none;
+  margin-top: 4px;
+}
+
+.dw-auth-form__strength {
+  display: flex;
+  align-items: center;
+  gap: 8px;
+  margin-top: 4px;
+}
+
+.dw-auth-form__strength-bar {
+  flex: 1;
+  height: 4px;
+  border-radius: 2px;
+  background: #21262D;
+  overflow: hidden;
+}
+
+.dw-auth-form__strength-fill {
+  height: 100%;
+  border-radius: 2px;
+  transition: width 0.25s, background 0.25s;
+}
+
+.dw-auth-form__options {
+  display: flex;
+  align-items: center;
+  justify-content: flex-end;
+}
+
+.dw-auth-form__link {
+  font-size: 13px;
+  color: #10B981;
+  text-decoration: none;
+}
+
+.dw-auth-form__link:hover {
+  text-decoration: underline;
+}
+
+.dw-auth-form__error {
+  font-size: 13px;
+  color: #F87171;
+  padding: 10px 12px;
+  background: rgba(239,68,68,0.1);
+  border: 1px solid rgba(239,68,68,0.2);
+  border-radius: 8px;
+}
+
+.dw-auth-form__success {
+  font-size: 13px;
+  color: #6EE7B7;
+  padding: 10px 12px;
+  background: rgba(16,185,129,0.1);
+  border: 1px solid rgba(16,185,129,0.2);
+  border-radius: 8px;
+}
+
+.dw-auth-form__resend {
+  background: none;
+  border: none;
+  color: #10B981;
+  font-size: 13px;
+  cursor: pointer;
+  text-align: center;
+  padding: 4px 0;
+}
+
+.dw-auth-form__resend:hover { text-decoration: underline; }
+
+.dw-auth-form__footer-text {
+  font-size: 13px;
+  color: #6B7280;
+  text-align: center;
+}
+
+.dw-auth-form__footer-text a {
+  color: #10B981;
+  font-weight: 500;
+  text-decoration: none;
+}
+
+.dw-auth-form__footer-text a:hover { text-decoration: underline; }
+
+.dw-auth-divider {
+  display: flex;
+  align-items: center;
+  margin: 4px 0;
+}
+
+.dw-auth-divider::before,
+.dw-auth-divider::after {
+  content: "";
+  flex: 1;
+  border-bottom: 1px solid #21262D;
+}
+
+.dw-auth-divider span {
+  padding: 0 10px;
+  font-size: 11px;
+  color: #4B5563;
+  text-transform: uppercase;
+  letter-spacing: 0.06em;
+  font-weight: 600;
+}
+
+.dw-btn {
+  width: 100%;
+  padding: 10px 16px;
+  border-radius: 8px;
+  font-size: 14px;
+  font-weight: 600;
+  cursor: pointer;
+  transition: all 0.2s;
+  border: none;
+  outline: none;
+}
+
+.dw-btn--primary {
+  background: #10B981;
+  color: white;
+}
+
+.dw-btn--primary:hover:not(:disabled) {
+  background: #059669;
+  box-shadow: 0 4px 16px rgba(16,185,129,0.3);
+  transform: translateY(-1px);
+}
+
+.dw-btn--primary:disabled {
+  opacity: 0.6;
+  cursor: not-allowed;
+}
+
+.dw-auth-demo-btn {
+  width: 100%;
+  display: flex;
+  align-items: center;
+  justify-content: center;
+  gap: 8px;
+  background: rgba(16,185,129,0.07);
+  border: 1px solid rgba(16,185,129,0.25);
+  color: #10B981;
+  font-weight: 600;
+  font-size: 13px;
+  padding: 10px 16px;
+  border-radius: 8px;
+  cursor: pointer;
+  transition: all 0.2s;
+  font-family: inherit;
+}
+
+.dw-auth-demo-btn:hover:not(:disabled) {
+  background: rgba(16,185,129,0.15);
+  border-color: rgba(16,185,129,0.5);
+  color: #fff;
+  box-shadow: 0 0 16px rgba(16,185,129,0.2);
+  transform: translateY(-1px);
+}
+
+.dw-auth-demo-btn:disabled {
+  opacity: 0.5;
+  cursor: not-allowed;
+}

studio/src/main.jsx

@@ -1,10 +1,37 @@
-import React from 'react'
+import React from 'react'
 import ReactDOM from 'react-dom/client'
+import { BrowserRouter, Routes, Route, Navigate } from 'react-router-dom'
+import { AuthProvider } from './context/AuthContext.jsx'
+import ProtectedRoute from './components/ProtectedRoute.jsx'
 import App from './App.jsx'
+import Login from './pages/auth/Login.jsx'
+import Signup from './pages/auth/Signup.jsx'
+import ForgotPassword from './pages/auth/ForgotPassword.jsx'
+import ResetPassword from './pages/auth/ResetPassword.jsx'
 import './index.css'
 
 ReactDOM.createRoot(document.getElementById('root')).render(
   <React.StrictMode>
-    <App />
+    <AuthProvider>
+      <BrowserRouter>
+        <Routes>
+          {/* Public auth routes */}
+          <Route path="/login" element={<Login />} />
+          <Route path="/signup" element={<Signup />} />
+          <Route path="/forgot-password" element={<ForgotPassword />} />
+          <Route path="/reset-password" element={<ResetPassword />} />
+
+          {/* Protected workspace */}
+          <Route
+            path="/*"
+            element={
+              <ProtectedRoute>
+                <App />
+              </ProtectedRoute>
+            }
+          />
+        </Routes>
+      </BrowserRouter>
+    </AuthProvider>
   </React.StrictMode>,
-)
+)

studio/src/pages/auth/ForgotPassword.jsx

@@ -0,0 +1,60 @@
+import { useState } from "react";
+import { Link } from "react-router-dom";
+import { AuthLayout } from "../../components/AuthLayout.jsx";
+
+export default function ForgotPassword() {
+  const [email, setEmail] = useState("");
+  const [error, setError] = useState(null);
+  const [loading, setLoading] = useState(false);
+  const [sent, setSent] = useState(false);
+
+  const handleSubmit = async (e) => {
+    e.preventDefault();
+    setError(null);
+    setLoading(true);
+    try {
+      const res = await fetch("/api/auth/forgot-password", {
+        method: "POST",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify({ email }),
+      });
+      const data = await res.json();
+      if (!res.ok) { setError(data.detail || "Could not send reset email."); return; }
+      setSent(true);
+    } catch {
+      setError("Couldn't reach the server. Please try again.");
+    } finally {
+      setLoading(false);
+    }
+  };
+
+  return (
+    <AuthLayout
+      eyebrow="Account recovery"
+      title="Forgot your password?"
+      subtitle="Enter your email and we'll send you a secure reset link."
+      footer={<span>Remembered it? <Link to="/login">Back to login</Link></span>}
+    >
+      {sent ? (
+        <div className="dw-auth-form">
+          <div className="dw-auth-form__success">
+            We sent a password reset link to <strong>{email}</strong>.<br />
+            Check your inbox and spam folder.
+          </div>
+        </div>
+      ) : (
+        <form onSubmit={handleSubmit} className="dw-auth-form">
+          <div className="dw-field">
+            <label className="dw-label">Email</label>
+            <input className="dw-input" type="email" autoComplete="email" placeholder="you@company.com"
+              value={email} onChange={(e) => setEmail(e.target.value)} required />
+          </div>
+          {error && <div className="dw-auth-form__error">{error}</div>}
+          <button type="submit" className="dw-btn dw-btn--primary" disabled={loading}>
+            {loading ? "Sending…" : "Send reset link"}
+          </button>
+        </form>
+      )}
+    </AuthLayout>
+  );
+}

studio/src/pages/auth/Login.jsx

@@ -0,0 +1,127 @@
+import { useState } from "react";
+import { Link, useLocation, useNavigate } from "react-router-dom";
+import { AuthLayout } from "../../components/AuthLayout.jsx";
+import { useAuth } from "../../context/AuthContext.jsx";
+
+const isValidEmail = (e) => /^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(e);
+
+export default function Login() {
+  const { login } = useAuth();
+  const navigate = useNavigate();
+  const location = useLocation();
+
+  const [email, setEmail] = useState("");
+  const [password, setPassword] = useState("");
+  const [showPassword, setShowPassword] = useState(false);
+  const [error, setError] = useState(null);
+  const [success, setSuccess] = useState(location.state?.message || null);
+  const [loading, setLoading] = useState(false);
+  const [demoLoading, setDemoLoading] = useState(false);
+
+  const redirectTo = location.state?.from?.pathname || "/";
+
+  const handleSubmit = async (e) => {
+    e.preventDefault();
+    setError(null);
+    if (!isValidEmail(email)) { setError("Please enter a valid email address."); return; }
+    if (password.length < 8) { setError("Password must be at least 8 characters."); return; }
+
+    setLoading(true);
+    try {
+      const formData = new URLSearchParams();
+      formData.append("username", email);
+      formData.append("password", password);
+      const res = await fetch("/api/auth/login", {
+        method: "POST",
+        headers: { "Content-Type": "application/x-www-form-urlencoded" },
+        body: formData.toString(),
+      });
+      const data = await res.json();
+      if (!res.ok || !data.access_token) {
+        setError(data.detail || "Invalid email or password.");
+        return;
+      }
+      const user = data.user || { email, username: email.split("@")[0] };
+      localStorage.setItem("diffweave_token", data.access_token);
+      localStorage.setItem("diffweave_user", JSON.stringify(user));
+      login(data.access_token, user);
+      navigate("/", { replace: true });
+    } catch {
+      setError("Couldn't reach the server. Please try again.");
+    } finally {
+      setLoading(false);
+    }
+  };
+
+  const handleDemoLogin = async () => {
+    setError(null);
+    setDemoLoading(true);
+    try {
+      const res = await fetch("/api/auth/demo-login", { method: "POST", headers: { "Content-Type": "application/json" }, body: "{}" });
+      const data = await res.json();
+      if (!res.ok || !data.access_token) {
+        setError(data.detail || "Could not start demo session.");
+        return;
+      }
+      const user = data.user || { email: "evaluator@docweave.io", username: "DocWeave Evaluator", role: "evaluator" };
+      localStorage.setItem("diffweave_token", data.access_token);
+      localStorage.setItem("diffweave_user", JSON.stringify(user));
+      login(data.access_token, user);
+      navigate("/", { replace: true });
+    } catch {
+      setError("Couldn't reach the server for demo login.");
+    } finally {
+      setDemoLoading(false);
+    }
+  };
+
+  return (
+    <AuthLayout
+      eyebrow="Document intelligence"
+      title="Welcome back"
+      subtitle="Sign in with your DocWeave account to continue."
+    >
+      <form onSubmit={handleSubmit} className="dw-auth-form">
+        {success && <div className="dw-auth-form__success">{success}</div>}
+
+        <div className="dw-field">
+          <label className="dw-label">Email</label>
+          <input className="dw-input" type="email" autoComplete="email" placeholder="you@company.com"
+            value={email} onChange={(e) => setEmail(e.target.value)} required />
+          {email && !isValidEmail(email) && <span className="dw-field__error">Enter a valid email</span>}
+        </div>
+
+        <div className="dw-field">
+          <label className="dw-label">Password</label>
+          <input className="dw-input" type={showPassword ? "text" : "password"} autoComplete="current-password"
+            placeholder="••••••••" value={password} onChange={(e) => setPassword(e.target.value)} required />
+          <label className="dw-auth-form__show-password">
+            <input type="checkbox" checked={showPassword} onChange={(e) => setShowPassword(e.target.checked)} />
+            Show password
+          </label>
+        </div>
+
+        <div className="dw-auth-form__options">
+          <span />
+          <Link to="/forgot-password" className="dw-auth-form__link">Forgot password?</Link>
+        </div>
+
+        {error && <div className="dw-auth-form__error">{error}</div>}
+
+        <button type="submit" className="dw-btn dw-btn--primary" disabled={loading}>
+          {loading ? "Signing in…" : "Sign in"}
+        </button>
+
+        <div className="dw-auth-form__footer-text">
+          Don't have an account? <Link to="/signup">Sign up</Link>
+        </div>
+
+        <div className="dw-auth-divider"><span>or explore directly</span></div>
+
+        <button type="button" className="dw-auth-demo-btn" onClick={handleDemoLogin} disabled={demoLoading || loading}>
+          {demoLoading ? "Starting demo workspace…" : "⚡ Quick Demo Access (No account needed)"}
+        </button>
+      </form>
+    </AuthLayout>
+  );
+}

studio/src/pages/auth/ResetPassword.jsx

@@ -0,0 +1,63 @@
+import { useState } from "react";
+import { Link, useSearchParams, useNavigate } from "react-router-dom";
+import { AuthLayout } from "../../components/AuthLayout.jsx";
+
+export default function ResetPassword() {
+  const [searchParams] = useSearchParams();
+  const navigate = useNavigate();
+  const token = searchParams.get("token") || "";
+  const [newPassword, setNewPassword] = useState("");
+  const [confirmPassword, setConfirmPassword] = useState("");
+  const [error, setError] = useState(null);
+  const [loading, setLoading] = useState(false);
+
+  const handleSubmit = async (e) => {
+    e.preventDefault();
+    setError(null);
+    if (!token) { setError("This reset link is missing or invalid."); return; }
+    if (newPassword !== confirmPassword) { setError("Passwords don't match."); return; }
+    if (newPassword.length < 8) { setError("Password must be at least 8 characters."); return; }
+
+    setLoading(true);
+    try {
+      const res = await fetch("/api/auth/reset-password", {
+        method: "POST",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify({ token, new_password: newPassword }),
+      });
+      const data = await res.json();
+      if (!res.ok) { setError(data.detail || "Could not reset password."); return; }
+      navigate("/login", { replace: true, state: { message: "Password reset successfully. You can now sign in." } });
+    } catch {
+      setError("Couldn't reach the server. Please try again.");
+    } finally {
+      setLoading(false);
+    }
+  };
+
+  return (
+    <AuthLayout
+      eyebrow="Account recovery"
+      title="Reset your password"
+      subtitle="Choose a new password for your DocWeave account."
+      footer={<span>Remembered it? <Link to="/login">Back to login</Link></span>}
+    >
+      <form onSubmit={handleSubmit} className="dw-auth-form">
+        <div className="dw-field">
+          <label className="dw-label">New password</label>
+          <input className="dw-input" type="password" autoComplete="new-password" placeholder="••••••••"
+            value={newPassword} onChange={(e) => setNewPassword(e.target.value)} required />
+        </div>
+        <div className="dw-field">
+          <label className="dw-label">Confirm new password</label>
+          <input className="dw-input" type="password" autoComplete="new-password" placeholder="••••••••"
+            value={confirmPassword} onChange={(e) => setConfirmPassword(e.target.value)} required />
+        </div>
+        {error && <div className="dw-auth-form__error">{error}</div>}
+        <button type="submit" className="dw-btn dw-btn--primary" disabled={loading}>
+          {loading ? "Resetting…" : "Reset password"}
+        </button>
+      </form>
+    </AuthLayout>
+  );
+}

studio/src/pages/auth/Signup.jsx

@@ -0,0 +1,187 @@
+import { useState } from "react";
+import { Link, useNavigate } from "react-router-dom";
+import { AuthLayout } from "../../components/AuthLayout.jsx";
+import { useAuth } from "../../context/AuthContext.jsx";
+
+const isValidEmail = (e) => /^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(e);
+
+function getStrength(pw) {
+  let score = 0;
+  if (pw.length >= 8) score++;
+  if (/[A-Z]/.test(pw)) score++;
+  if (/[0-9]/.test(pw)) score++;
+  if (/[^A-Za-z0-9]/.test(pw)) score++;
+  if (score <= 1) return { label: "Weak", color: "#ef4444", level: 1 };
+  if (score === 2) return { label: "Fair", color: "#f59e0b", level: 2 };
+  return { label: "Strong", color: "#10b981", level: 3 };
+}
+
+export default function Signup() {
+  const { login } = useAuth();
+  const navigate = useNavigate();
+  const [step, setStep] = useState("form"); // "form" | "otp"
+  const [username, setUsername] = useState("");
+  const [email, setEmail] = useState("");
+  const [password, setPassword] = useState("");
+  const [confirmPassword, setConfirmPassword] = useState("");
+  const [showPassword, setShowPassword] = useState(false);
+  const [otpCode, setOtpCode] = useState("");
+  const [error, setError] = useState(null);
+  const [loading, setLoading] = useState(false);
+  const [demoLoading, setDemoLoading] = useState(false);
+
+  const strength = getStrength(password);
+
+  const handleSendOtp = async (e) => {
+    e.preventDefault();
+    setError(null);
+    if (!username.trim()) { setError("Name is required."); return; }
+    if (!isValidEmail(email)) { setError("Please enter a valid email address."); return; }
+    if (password.length < 8) { setError("Password must be at least 8 characters."); return; }
+    if (password !== confirmPassword) { setError("Passwords don't match."); return; }
+
+    setLoading(true);
+    try {
+      const res = await fetch("/api/auth/send-otp", {
+        method: "POST",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify({ username, email, password }),
+      });
+      const data = await res.json();
+      if (!res.ok) { setError(data.detail || "Could not send OTP. Try again."); return; }
+      setStep("otp");
+    } catch {
+      setError("Couldn't reach the server. Please try again.");
+    } finally {
+      setLoading(false);
+    }
+  };
+
+  const handleVerifyOtp = async (e) => {
+    e.preventDefault();
+    setError(null);
+    if (otpCode.length !== 6) { setError("Enter the 6-digit code sent to your email."); return; }
+
+    setLoading(true);
+    try {
+      const res = await fetch("/api/auth/verify-otp", {
+        method: "POST",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify({ email, code: otpCode }),
+      });
+      const data = await res.json();
+      if (!res.ok) { setError(data.detail || "Could not verify code. Try again."); return; }
+      navigate("/login", { replace: true, state: { message: "Account created! Please sign in." } });
+    } catch {
+      setError("Couldn't verify. Please try again.");
+    } finally {
+      setLoading(false);
+    }
+  };
+
+  const handleDemoLogin = async () => {
+    setError(null);
+    setDemoLoading(true);
+    try {
+      const res = await fetch("/api/auth/demo-login", { method: "POST", headers: { "Content-Type": "application/json" }, body: "{}" });
+      const data = await res.json();
+      if (!res.ok || !data.access_token) { setError(data.detail || "Could not start demo session."); return; }
+      login(data.access_token, { email: data.email, username: data.username });
+      navigate("/", { replace: true });
+    } catch {
+      setError("Couldn't reach the server.");
+    } finally {
+      setDemoLoading(false);
+    }
+  };
+
+  if (step === "otp") {
+    return (
+      <AuthLayout
+        eyebrow="Verify your email"
+        title="Enter verification code"
+        subtitle={`We sent a 6-digit code to ${email}. Check your inbox (and spam folder).`}
+        footer={
+          <button type="button" className="dw-auth-form__link" style={{ background: "none", border: "none", cursor: "pointer" }}
+            onClick={() => setStep("form")}>
+            ← Back to signup
+          </button>
+        }
+      >
+        <form onSubmit={handleVerifyOtp} className="dw-auth-form">
+          <div className="dw-field">
+            <label className="dw-label">Verification code</label>
+            <input className="dw-input dw-input--otp" type="text" inputMode="numeric" placeholder="000000"
+              maxLength={6} value={otpCode} onChange={(e) => setOtpCode(e.target.value.replace(/\D/g, ""))}
+              autoFocus required />
+          </div>
+          {error && <div className="dw-auth-form__error">{error}</div>}
+          <button type="submit" className="dw-btn dw-btn--primary" disabled={loading}>
+            {loading ? "Verifying…" : "Verify & create account"}
+          </button>
+          <button type="button" className="dw-auth-form__resend" onClick={handleSendOtp}>
+            Resend code
+          </button>
+        </form>
+      </AuthLayout>
+    );
+  }
+
+  return (
+    <AuthLayout
+      eyebrow="Document intelligence"
+      title="Create your account"
+      subtitle="Start turning documents into structured, connected knowledge."
+    >
+      <form onSubmit={handleSendOtp} className="dw-auth-form">
+        <div className="dw-field">
+          <label className="dw-label">Name</label>
+          <input className="dw-input" type="text" autoComplete="name" placeholder="Ada Lovelace"
+            value={username} onChange={(e) => setUsername(e.target.value)} required />
+        </div>
+        <div className="dw-field">
+          <label className="dw-label">Email</label>
+          <input className="dw-input" type="email" autoComplete="email" placeholder="you@company.com"
+            value={email} onChange={(e) => setEmail(e.target.value)} required />
+          {email && !isValidEmail(email) && <span className="dw-field__error">Enter a valid email</span>}
+        </div>
+        <div className="dw-field">
+          <label className="dw-label">Password</label>
+          <input className="dw-input" type={showPassword ? "text" : "password"} autoComplete="new-password"
+            placeholder="At least 8 characters" value={password}
+            onChange={(e) => setPassword(e.target.value)} required />
+          {password.length >= 8 && (
+            <div className="dw-auth-form__strength">
+              <div className="dw-auth-form__strength-bar">
+                <div className="dw-auth-form__strength-fill" style={{ width: `${(strength.level / 3) * 100}%`, background: strength.color }} />
+              </div>
+              <span style={{ color: strength.color, fontSize: "11px" }}>{strength.label}</span>
+            </div>
+          )}
+          <label className="dw-auth-form__show-password">
+            <input type="checkbox" checked={showPassword} onChange={(e) => setShowPassword(e.target.checked)} />
+            Show password
+          </label>
+        </div>
+        <div className="dw-field">
+          <label className="dw-label">Confirm password</label>
+          <input className="dw-input" type={showPassword ? "text" : "password"} autoComplete="new-password"
+            placeholder="••••••••" value={confirmPassword}
+            onChange={(e) => setConfirmPassword(e.target.value)} required />
+          {confirmPassword && confirmPassword !== password && <span className="dw-field__error">Passwords don't match</span>}
+        </div>
+        {error && <div className="dw-auth-form__error">{error}</div>}
+        <button type="submit" className="dw-btn dw-btn--primary" disabled={loading}>
+          {loading ? "Sending code…" : "Continue"}
+        </button>
+        <div className="dw-auth-form__footer-text">
+          Already have an account? <Link to="/login">Sign in</Link>
+        </div>
+        <div className="dw-auth-divider"><span>or explore directly</span></div>
+        <button type="button" className="dw-auth-demo-btn" onClick={handleDemoLogin} disabled={demoLoading || loading}>
+          {demoLoading ? "Starting demo workspace…" : "⚡ Quick Demo Access (No account needed)"}
+        </button>
+      </form>
+    </AuthLayout>
+  );
+}