domainforge 0.13.0

package/.github/workflows/dependency-review.yml

@@ -0,0 +1,27 @@
+name: Dependency Review
+
+on:
+  pull_request:
+    branches: [main]
+
+permissions:
+  contents: read
+  pull-requests: write
+
+jobs:
+  dependency-review:
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    steps:
+      - uses: actions/checkout@v6
+        with:
+          fetch-depth: 0 # Fetch full history for comparison
+
+      - name: Dependency Review
+        uses: actions/dependency-review-action@v4
+        with:
+          fail-on-severity: critical # Only fail on critical severity to be conservative
+          allow-licenses: MIT, Apache-2.0, BSD-3-Clause, ISC, LGPL-3.0, BSL-1.0, Zlib, Unicode-3.0, Apache-2.0 WITH LLVM-exception
+          # Allow dependencies with non-standard SPDX license expressions (e.g., Apache-2.0/MIT)
+          # These are typically dual-licensed and safe, but use non-standard separators
+          allow-dependencies-licenses: pkg:cargo/minicov

package/.github/workflows/deploy.yml

@@ -0,0 +1,87 @@
+name: Deploy
+
+# Triggered by component-prefixed tags produced by release-please:
+#   domainforge-core-vX.Y.Z   (Rust crate)      -> release-crates.yml
+#   domainforge-vX.Y.Z     (Python package)  -> release-pypi.yml
+#   domainforge-typescript-vX.Y.Z (TypeScript @godspeedai/domainforge) -> release-npm.yml
+#
+# This workflow is a router: it parses the tag, then dispatches to the
+# already-tested, reusable publish workflow that owns the build + publish
+# logic for that component. There is intentionally no separate `prod`
+# GitHub environment gate — this is a solo-maintainer repository where
+# CI on `main` is the merge gate and a tag push is the release signal.
+on:
+  push:
+    tags:
+      - 'domainforge-core-v*'
+      - 'domainforge-v*'
+      - 'domainforge-typescript-v*'
+
+permissions:
+  contents: read
+
+concurrency:
+  group: deploy-${{ github.ref }}
+  cancel-in-progress: false
+
+jobs:
+  identify:
+    name: Identify Component
+    runs-on: ubuntu-latest
+    outputs:
+      component: ${{ steps.parse.outputs.component }}
+      version: ${{ steps.parse.outputs.version }}
+    steps:
+      - name: Parse tag into component and version
+        id: parse
+        shell: bash
+        run: |
+          # GITHUB_REF_NAME on a tag push = the tag name, e.g. "domainforge-core-v0.12.0"
+          # component = everything before the last "-v"
+          # version   = everything after the last "-v"
+          tag="${GITHUB_REF_NAME}"
+          component="${tag%-v*}"
+          version="${tag##*-v}"
+          echo "Parsed tag: $tag"
+          echo "  component: $component"
+          echo "  version:   $version"
+          # Validate version matches semver pattern
+          if [[ ! "$version" =~ ^[0-9]+\.[0-9]+\.[0-9]+(-[a-zA-Z0-9.-]+)?$ ]]; then
+            echo "::error::Invalid version format '$version' (expected semver X.Y.Z or X.Y.Z-prerelease)" >&2
+            exit 1
+          fi
+          case "$component" in
+            domainforge-core|domainforge|domainforge-typescript) ;;
+            *) echo "::error::Unknown component '$component' (expected domainforge-core|domainforge|domainforge-typescript)" >&2; exit 1 ;;
+          esac
+          echo "component=$component" >> "$GITHUB_OUTPUT"
+          echo "version=$version" >> "$GITHUB_OUTPUT"
+
+  deploy-crates:
+    name: Publish domainforge-core to crates.io
+    if: needs.identify.outputs.component == 'domainforge-core'
+    needs: identify
+    uses: ./.github/workflows/release-crates.yml
+    secrets: inherit
+    permissions:
+      contents: read
+      packages: write
+
+  deploy-pypi:
+    name: Publish domainforge wheels to PyPI
+    if: needs.identify.outputs.component == 'domainforge'
+    needs: identify
+    uses: ./.github/workflows/release-pypi.yml
+    secrets: inherit
+    permissions:
+      contents: read
+      packages: write
+
+  deploy-npm:
+    name: Publish @godspeedai/domainforge to npm
+    if: needs.identify.outputs.component == 'domainforge-typescript'
+    needs: identify
+    uses: ./.github/workflows/release-npm.yml
+    secrets: inherit
+    permissions:
+      contents: read

package/.github/workflows/prepare-release.yml

@@ -0,0 +1,168 @@
+name: Prepare Release
+
+on:
+  workflow_dispatch:
+    inputs:
+      version_bump:
+        description: 'Version bump type'
+        required: true
+        type: choice
+        options:
+          - patch
+          - minor
+          - major
+      prerelease:
+        description: 'Pre-release suffix (leave empty for stable release)'
+        required: false
+        type: string
+        default: ''
+
+permissions:
+  contents: write
+  pull-requests: write
+
+jobs:
+  prepare:
+    name: Prepare Release PR
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v6
+        with:
+          fetch-depth: 0
+
+      - name: Install Rust toolchain
+        uses: dtolnay/rust-toolchain@stable
+        with:
+          toolchain: stable
+
+      - name: Install cargo-edit
+        run: cargo install cargo-edit --locked
+
+      - name: Get current version
+        id: current
+        run: |
+          CURRENT=$(cargo metadata --manifest-path domainforge-core/Cargo.toml --format-version 1 | jq -r '.packages[] | select(.name == "domainforge-core") | .version')
+          echo "version=$CURRENT" >> "$GITHUB_OUTPUT"
+          echo "Current version: $CURRENT"
+
+      - name: Calculate new version
+        id: newversion
+        run: |
+          CURRENT="${{ steps.current.outputs.version }}"
+          BUMP="${{ github.event.inputs.version_bump }}"
+          PRERELEASE="${{ github.event.inputs.prerelease }}"
+          
+          # Parse current version (strip any existing pre-release suffix)
+          IFS='.' read -r MAJOR MINOR PATCH <<< "${CURRENT%-*}"
+          
+          # Bump version based on type
+          case "$BUMP" in
+            major)
+              MAJOR=$((MAJOR + 1))
+              MINOR=0
+              PATCH=0
+              ;;
+            minor)
+              MINOR=$((MINOR + 1))
+              PATCH=0
+              ;;
+            patch)
+              PATCH=$((PATCH + 1))
+              ;;
+          esac
+          
+          NEW_VERSION="${MAJOR}.${MINOR}.${PATCH}"
+          if [ -n "$PRERELEASE" ]; then
+            NEW_VERSION="${NEW_VERSION}-${PRERELEASE}"
+          fi
+          
+          echo "version=$NEW_VERSION" >> "$GITHUB_OUTPUT"
+          echo "New version: $NEW_VERSION"
+
+      - name: Bump Cargo.toml version
+        run: |
+          cargo set-version --manifest-path domainforge-core/Cargo.toml "${{ steps.newversion.outputs.version }}"
+
+      - name: Sync Python version (pyproject.toml)
+        run: |
+          NEW_VERSION="${{ steps.newversion.outputs.version }}"
+          sed -i "s/^version = \".*\"/version = \"$NEW_VERSION\"/" domainforge-python/pyproject.toml
+          echo "Updated domainforge-python/pyproject.toml to version $NEW_VERSION"
+
+      - name: Sync NPM version (package.json)
+        run: |
+          NEW_VERSION="${{ steps.newversion.outputs.version }}"
+          npm version "$NEW_VERSION" --no-git-tag-version --allow-same-version --prefix domainforge-typescript
+          echo "Updated domainforge-typescript/package.json to version $NEW_VERSION"
+
+      - name: Update CHANGELOG.md
+        run: |
+          NEW_VERSION="${{ steps.newversion.outputs.version }}"
+          DATE=$(date +%Y-%m-%d)
+          
+          # Build the new changelog entry (use printf to avoid YAML comment issues with #)
+          H="###"
+          ENTRY=$(printf '%s\n' \
+            "## [${NEW_VERSION}] - ${DATE}" \
+            "" \
+            "${H} Added" \
+            "- (Add new features here)" \
+            "" \
+            "${H} Changed" \
+            "- (Add changes here)" \
+            "" \
+            "${H} Fixed" \
+            "- (Add bug fixes here)" \
+            "")
+          
+          # Create updated changelog atomically
+          if [ -f CHANGELOG.md ]; then
+            # Find the first version heading line number
+            FIRST_VERSION_LINE=$(grep -n "^## \[" CHANGELOG.md | head -1 | cut -d: -f1)
+            if [ -n "$FIRST_VERSION_LINE" ]; then
+              # Has existing version entries - insert before it
+              head -n $((FIRST_VERSION_LINE - 1)) CHANGELOG.md > /tmp/changelog_new.md
+              echo "$ENTRY" >> /tmp/changelog_new.md
+              tail -n "+$FIRST_VERSION_LINE" CHANGELOG.md >> /tmp/changelog_new.md
+            else
+              # No version entries yet - append to file
+              cat CHANGELOG.md > /tmp/changelog_new.md
+              echo "" >> /tmp/changelog_new.md
+              echo "$ENTRY" >> /tmp/changelog_new.md
+            fi
+            mv /tmp/changelog_new.md CHANGELOG.md
+          else
+            # Create new CHANGELOG.md
+            echo "# Changelog" > CHANGELOG.md
+            echo "" >> CHANGELOG.md
+            echo "$ENTRY" >> CHANGELOG.md
+          fi
+
+      - name: Create Pull Request
+        uses: peter-evans/create-pull-request@v6
+        with:
+          token: ${{ secrets.CREATE_PR_TOKEN }}
+          commit-message: "chore: bump version to ${{ steps.newversion.outputs.version }}"
+          branch: release/${{ steps.newversion.outputs.version }}
+          title: "Release v${{ steps.newversion.outputs.version }}"
+          body: |
+            ## Release v${{ steps.newversion.outputs.version }}
+            
+            This PR was automatically created by the prepare-release workflow.
+            
+            ### Checklist
+            - [ ] Update CHANGELOG.md with actual changes
+            - [ ] Review version bump in `domainforge-core/Cargo.toml`
+            - [ ] Run `just all-tests` locally
+            - [ ] Merge this PR
+            - [ ] Create and push tag: `git tag v${{ steps.newversion.outputs.version }} && git push --tags`
+            - [ ] Create GitHub Release from the tag to trigger publishing
+            
+            ### Version Changes
+            - **Previous**: ${{ steps.current.outputs.version }}
+            - **New**: ${{ steps.newversion.outputs.version }}
+            - **Bump Type**: ${{ github.event.inputs.version_bump }}
+          labels: |
+            release
+            automated
+          draft: false

package/.github/workflows/release-crates.yml

@@ -0,0 +1,42 @@
+name: Release Crates
+
+on:
+  workflow_call:
+  workflow_dispatch:
+
+permissions:
+  contents: read
+  packages: write
+
+jobs:
+  publish:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v6
+
+      - name: Decrypt secrets
+        id: secrets
+        uses: ./.github/actions/decrypt-secrets
+        with:
+          sops-age-key: ${{ secrets.SOPS_AGE_KEY }}
+
+      - name: Install Rust toolchain
+        uses: dtolnay/rust-toolchain@stable
+        with:
+          toolchain: stable
+
+      - name: Publish domainforge-core to crates.io
+        run: |
+          set +e
+          OUTPUT=$(cargo publish --manifest-path domainforge-core/Cargo.toml --token ${{ steps.secrets.outputs.cargo-registry-token }} 2>&1)
+          EXIT_CODE=$?
+          echo "$OUTPUT"
+          
+          # Check if already published (not an error)
+          if echo "$OUTPUT" | grep -q "already uploaded\|already exists\|is already published"; then
+            echo "::notice::Crate version already published, skipping"
+            exit 0
+          fi
+          
+          # Propagate actual errors
+          exit $EXIT_CODE

package/.github/workflows/release-npm.yml

@@ -0,0 +1,137 @@
+name: Release NPM
+
+on:
+  workflow_call:
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  publish:
+    name: Publish napi bindings to npm
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v6
+
+      - name: Decrypt secrets
+        id: secrets
+        uses: ./.github/actions/decrypt-secrets
+        with:
+          sops-age-key: ${{ secrets.SOPS_AGE_KEY }}
+
+      - name: Set up Node.js
+        uses: actions/setup-node@v6
+        with:
+          node-version: "24"
+          registry-url: "https://registry.npmjs.org"
+
+      - name: Set up Bun
+        uses: oven-sh/setup-bun@v2
+        with:
+          bun-version: latest
+
+      - name: Install Rust toolchain
+        uses: dtolnay/rust-toolchain@stable
+        with:
+          toolchain: stable
+
+      - name: Install dependencies
+        run: bun install --frozen-lockfile
+
+      - name: Build napi package
+        working-directory: domainforge-typescript
+        run: npm run build
+
+      - name: Patch generated TypeScript declarations
+        working-directory: domainforge-typescript
+        run: python3 ../scripts/patch_napi_types.py
+
+      - name: Smoke test npm pack
+        working-directory: domainforge-typescript
+        run: |
+          npm pack --dry-run 2>&1 | tee /tmp/npm-pack-output.txt
+          grep -q "index.d.ts" /tmp/npm-pack-output.txt || { echo "ERROR: index.d.ts missing from pack"; exit 1; }
+          grep -q "index.js" /tmp/npm-pack-output.txt || { echo "ERROR: index.js missing from pack"; exit 1; }
+          grep -q "domainforge-core.*.node" /tmp/npm-pack-output.txt || { echo "ERROR: native .node binary missing from pack"; exit 1; }
+          echo "npm pack smoke test passed"
+
+      - name: Check if already published
+        working-directory: domainforge-typescript
+        run: |
+          if npm view "@godspeedai/domainforge@$(node -p "require('./package.json').version")" version >/dev/null 2>&1; then
+            echo "Already published, skipping"
+            echo "SKIP_PUBLISH=1" >> $GITHUB_ENV
+          fi
+
+      - name: Publish to npm
+        if: env.SKIP_PUBLISH != '1'
+        working-directory: domainforge-typescript
+        run: npm publish --access public --ignore-scripts
+        env:
+          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN || steps.secrets.outputs.npm-token }}
+
+  publish-wasm:
+    name: Publish WASM package to npm
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v6
+
+      - name: Decrypt secrets
+        id: secrets
+        uses: ./.github/actions/decrypt-secrets
+        with:
+          sops-age-key: ${{ secrets.SOPS_AGE_KEY }}
+
+      - name: Set up Node.js
+        uses: actions/setup-node@v6
+        with:
+          node-version: "24"
+          registry-url: "https://registry.npmjs.org"
+
+      - name: Install Rust toolchain
+        uses: dtolnay/rust-toolchain@stable
+        with:
+          toolchain: stable
+          targets: wasm32-unknown-unknown
+
+      - name: Install wasm-pack
+        run: cargo install wasm-pack --locked
+
+      - name: Build WASM package
+        run: |
+          cd domainforge-core
+          wasm-pack build --target web --release --scope godspeedai -- --features wasm
+          node - <<'NODE'
+          const fs = require('fs');
+          const pkgPath = 'pkg/package.json';
+          const pkg = JSON.parse(fs.readFileSync(pkgPath, 'utf8'));
+          pkg.name = '@godspeedai/domainforge-wasm';
+          pkg.files = ['domainforge_core.js', 'domainforge_core.d.ts', 'domainforge_core_bg.wasm', 'domainforge_core_bg.wasm.d.ts'];
+          fs.writeFileSync(pkgPath, JSON.stringify(pkg, null, 2) + '\n');
+          NODE
+
+      - name: WASM smoke test
+        run: |
+          cd domainforge-core/pkg
+          for f in domainforge_core.js domainforge_core.d.ts domainforge_core_bg.wasm domainforge_core_bg.wasm.d.ts package.json; do
+            test -f "$f" || { echo "ERROR: missing $f in WASM pkg"; exit 1; }
+          done
+          node -e "const p=require('./package.json'); if (p.name !== '@godspeedai/domainforge-wasm') throw new Error('Unexpected package name: ' + p.name); ['version','main','types'].forEach(k => { if(!p[k]) throw new Error('Missing field: ' + k) })"
+          echo "WASM smoke test passed"
+
+      - name: Check if WASM already published
+        run: |
+          cd domainforge-core/pkg
+          if npm view "@godspeedai/domainforge-wasm@$(node -p "require('./package.json').version")" version >/dev/null 2>&1; then
+            echo "Already published, skipping"
+            echo "SKIP_PUBLISH=1" >> $GITHUB_ENV
+          fi
+
+      - name: Publish WASM to npm
+        if: env.SKIP_PUBLISH != '1'
+        run: |
+          cd domainforge-core/pkg
+          npm publish --access public
+        env:
+          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN || steps.secrets.outputs.npm-token }}

package/.github/workflows/release-please.yml

@@ -0,0 +1,29 @@
+name: Release Please
+
+# Triggered on every push to main (the integration branch).
+# release-please scans conventional commits and opens/updates release PRs.
+on:
+  push:
+    branches: [main]
+
+concurrency:
+  group: release-please
+  cancel-in-progress: false
+
+permissions:
+  contents: write
+  pull-requests: write
+
+jobs:
+  release-please:
+    name: Release Please
+    runs-on: ubuntu-latest
+    steps:
+      - uses: googleapis/release-please-action@5c625bfb5d1ff62eadeeb3772007f7f66fdcf071
+        with:
+          # PAT (not GITHUB_TOKEN) so that tags created on release-PR merge
+          # propagate `push: tags` events to deploy.yml. GITHUB_TOKEN-created
+          # refs do not trigger downstream workflows.
+          token: ${{ secrets.CREATE_PR_TOKEN }}
+          config-file: release-please-config.json
+          manifest-file: .release-please-manifest.json

package/.github/workflows/release-pypi.yml

@@ -0,0 +1,96 @@
+name: Release PyPI
+
+on:
+  workflow_call:
+  workflow_dispatch:
+
+permissions:
+  contents: read
+  packages: write
+
+jobs:
+  build-and-publish:
+    name: Publish Wheels (${{ matrix.os }}, ${{ matrix.target }})
+    runs-on: ${{ matrix.os }}
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          # x86_64 targets
+          - os: ubuntu-latest
+            target: x86_64-unknown-linux-gnu
+          - os: macos-15-intel
+            target: x86_64-apple-darwin
+          - os: windows-2025-vs2026
+            target: x86_64-pc-windows-msvc
+          # ARM targets
+          - os: macos-15
+            target: aarch64-apple-darwin
+          - os: ubuntu-latest
+            target: aarch64-unknown-linux-gnu
+            use_zig: true
+    steps:
+      - uses: actions/checkout@v6
+
+      - name: Decrypt secrets
+        id: secrets
+        uses: ./.github/actions/decrypt-secrets
+        with:
+          sops-age-key: ${{ secrets.SOPS_AGE_KEY }}
+
+      - name: Set up Python
+        uses: actions/setup-python@v6
+        with:
+          python-version: "3.11"
+
+      - name: Install Rust toolchain
+        uses: dtolnay/rust-toolchain@stable
+        with:
+          toolchain: stable
+          targets: ${{ matrix.target }}
+
+      - name: Ensure Rust target is installed
+        run: rustup target add ${{ matrix.target }}
+
+      - name: Install maturin
+        run: pip install maturin==1.10.1
+
+      - name: Install Zig (for ARM Linux cross-compile)
+        if: matrix.use_zig == true
+        shell: bash
+        run: |
+          ZIG_VERSION="0.11.0"
+          ZIG_SHA256="2d00e789fec4f71790a6e7bf83ff91d564943c5ee843c5fd966efc474b423047"
+          ZIG_URL="https://ziglang.org/download/${ZIG_VERSION}/zig-linux-x86_64-${ZIG_VERSION}.tar.xz"
+          curl -sSLo "$RUNNER_TEMP/zig.tar.xz" "$ZIG_URL"
+          echo "${ZIG_SHA256}  $RUNNER_TEMP/zig.tar.xz" | sha256sum -c -
+          mkdir -p "$RUNNER_TEMP/zig"
+          tar -xJf "$RUNNER_TEMP/zig.tar.xz" -C "$RUNNER_TEMP/zig" --strip-components=1
+          echo "$RUNNER_TEMP/zig" >> "$GITHUB_PATH"
+          "$RUNNER_TEMP/zig/zig" version
+
+      - name: Build and publish wheels (native)
+        if: matrix.use_zig != true
+        shell: bash
+        working-directory: domainforge-python
+        run: |
+          python -m maturin publish \
+            --features python \
+            --target ${{ matrix.target }} \
+            --skip-existing
+        env:
+          MATURIN_PYPI_TOKEN: ${{ steps.secrets.outputs.pypi-api-token || secrets.PYPI_API_TOKEN }}
+
+      - name: Build and publish wheels (cross-compile with Zig)
+        if: matrix.use_zig == true
+        shell: bash
+        working-directory: domainforge-python
+        run: |
+          python -m maturin publish \
+            --features python \
+            --target ${{ matrix.target }} \
+            --skip-existing \
+            --zig \
+            -i python3.11
+        env:
+          MATURIN_PYPI_TOKEN: ${{ steps.secrets.outputs.pypi-api-token || secrets.PYPI_API_TOKEN }}

package/.gitkeep

@@ -0,0 +1 @@
+This repo intentionally leaves a placeholder at the root to indicate the presence of core assets.

package/.release-please-manifest.json

@@ -0,0 +1,5 @@
+{
+  "domainforge-core": "0.13.0",
+  "domainforge-python": "0.13.0",
+  "domainforge-typescript": "0.13.0"
+}

package/.sea-registry.toml

@@ -0,0 +1,10 @@
+version = 1
+default_namespace = "default"
+
+[[namespaces]]
+namespace = "logistics"
+patterns = ["examples/namespaces/logistics/**/*.sea"]
+
+[[namespaces]]
+namespace = "finance"
+patterns = ["examples/namespaces/finance/**/*.sea"]