forgeos 0.1.0-alpha.0

package/src/forge/runtime/release/runtime.ts

@@ -0,0 +1,322 @@
+import { createHash } from "node:crypto";
+import { readFileSync, statSync } from "node:fs";
+import { join, relative } from "node:path";
+import { nodeFileSystem } from "../../compiler/fs/index.ts";
+import { spawnSync } from "node:child_process";
+import { createDiagnostic } from "../../compiler/diagnostics/create.ts";
+import {
+  FORGE_RELEASE_DIRTY_WORKTREE,
+  FORGE_RELEASE_PROVIDER_CONFIG_MISSING,
+  FORGE_SOURCEMAP_PUBLIC_EXPOSURE,
+} from "../../compiler/diagnostics/codes.ts";
+import { GENERATED_DIR } from "../../compiler/emitter/constants.ts";
+import { serializeCanonical } from "../../compiler/primitives/serialize.ts";
+import type {
+  ArtifactManifest,
+  BuildInfo,
+  DeployManifest,
+  ReleaseArtifact,
+  ReleaseExportProvider,
+  ReleaseManifest,
+  SourceMapEntry,
+  SourceMapManifest,
+  SymbolicationManifest,
+} from "../../compiler/release/types.ts";
+import type { Diagnostic } from "../../compiler/types/diagnostic.ts";
+
+export interface RuntimeReleaseInfo {
+  releaseId?: string;
+  deployId?: string;
+  environment?: string;
+}
+
+export function currentReleaseInfo(): RuntimeReleaseInfo {
+  return {
+    releaseId: process.env.FORGE_RELEASE_ID ?? process.env.NEXT_PUBLIC_FORGE_RELEASE_ID,
+    deployId: process.env.FORGE_DEPLOY_ID,
+    environment: process.env.FORGE_DEPLOY_ENV ?? process.env.FORGE_ENV ?? process.env.NODE_ENV,
+  };
+}
+
+function packageInfo(workspaceRoot: string): { name: string; version: string } {
+  const pkg = JSON.parse((nodeFileSystem.readText(join(workspaceRoot, "package.json")) ?? "")) as {
+    name?: string;
+    version?: string;
+  };
+  return { name: pkg.name ?? "forge-app", version: pkg.version ?? "0.0.0" };
+}
+
+function gitSha(workspaceRoot: string): string {
+  const result = spawnSync("git", ["rev-parse", "--short", "HEAD"], {
+    cwd: workspaceRoot,
+    encoding: "utf8",
+  });
+  return result.status === 0 ? result.stdout.trim() || "nogit" : "nogit";
+}
+
+function isDirty(workspaceRoot: string): boolean {
+  const result = spawnSync("git", ["status", "--porcelain"], {
+    cwd: workspaceRoot,
+    encoding: "utf8",
+  });
+  return result.status === 0 && result.stdout.trim().length > 0;
+}
+
+function releaseDir(workspaceRoot: string, releaseId: string): string {
+  return join(workspaceRoot, ".forge", "releases", releaseId.replace(/[^\w@.+-]/g, "_"));
+}
+
+function sha256(path: string): string {
+  return createHash("sha256").update(readFileSync(path)).digest("hex");
+}
+
+function listFiles(root: string): string[] {
+  const files: string[] = [];
+  function walk(dir: string): void {
+    if (!nodeFileSystem.exists(dir)) {
+      return;
+    }
+    for (const entry of nodeFileSystem.readDir(dir)) {
+      const absolute = join(dir, entry.name);
+      if (entry.isDirectory) {
+        if (entry.name === "node_modules" || entry.name === ".forge" || entry.name === ".git") {
+          continue;
+        }
+        walk(absolute);
+      } else if (entry.isFile) {
+        files.push(absolute);
+      }
+    }
+  }
+  walk(root);
+  return files.sort();
+}
+
+function artifactKind(path: string): ReleaseArtifact["kind"] {
+  if (path.endsWith(".js")) {
+    return "javascript";
+  }
+  if (path.endsWith(".map")) {
+    return "sourcemap";
+  }
+  if (path.endsWith(".json")) {
+    return "manifest";
+  }
+  return "asset";
+}
+
+function isPublicArtifact(relativePath: string): boolean {
+  return relativePath.startsWith("public/") ||
+    relativePath.includes("/public/") ||
+    relativePath.includes(".next/static/");
+}
+
+export function collectReleaseArtifacts(workspaceRoot: string, releaseId: string): {
+  artifactManifest: ArtifactManifest;
+  sourceMapManifest: SourceMapManifest;
+  symbolicationManifest: SymbolicationManifest;
+} {
+  const roots = ["dist", "build", ".next", "web/.next", "public"];
+  const artifacts: ReleaseArtifact[] = [];
+  const sourceMaps: SourceMapEntry[] = [];
+  const diagnostics: Diagnostic[] = [];
+
+  for (const root of roots) {
+    const absoluteRoot = join(workspaceRoot, root);
+    for (const absolute of listFiles(absoluteRoot)) {
+      const rel = relative(workspaceRoot, absolute).replace(/\\/g, "/");
+      if (!rel.endsWith(".js") && !rel.endsWith(".map") && !rel.endsWith(".json")) {
+        continue;
+      }
+      const stat = statSync(absolute);
+      const artifact: ReleaseArtifact = {
+        path: rel,
+        kind: artifactKind(rel),
+        public: isPublicArtifact(rel),
+        sizeBytes: stat.size,
+        sha256: sha256(absolute),
+      };
+      if (rel.endsWith(".js") && nodeFileSystem.exists(join(workspaceRoot, `${rel}.map`))) {
+        artifact.sourceMap = `${rel}.map`;
+      }
+      artifacts.push(artifact);
+      if (rel.endsWith(".map")) {
+        if (artifact.public) {
+          diagnostics.push(
+            createDiagnostic({
+              severity: "warning",
+              code: FORGE_SOURCEMAP_PUBLIC_EXPOSURE,
+              message: `public source map detected: ${rel}`,
+              file: rel,
+            }),
+          );
+        }
+        try {
+          const map = JSON.parse((nodeFileSystem.readText(absolute) ?? "")) as {
+            file?: string;
+            sources?: string[];
+            debug_id?: string;
+            debugId?: string;
+          };
+          sourceMaps.push({
+            generatedFile: map.file ?? rel.replace(/\.map$/, ""),
+            sourceMapFile: rel,
+            sources: [...(map.sources ?? [])].sort(),
+            public: artifact.public,
+            ...(map.debug_id || map.debugId ? { debugId: map.debug_id ?? map.debugId } : {}),
+          });
+        } catch {
+          // Keep the artifact entry even when the source map body is invalid.
+        }
+      }
+    }
+  }
+
+  const artifactManifest: ArtifactManifest = {
+    schemaVersion: "0.1.0",
+    releaseId,
+    artifacts: artifacts.sort((a, b) => a.path.localeCompare(b.path)),
+    diagnostics,
+  };
+  const sourceMapManifest: SourceMapManifest = {
+    schemaVersion: "0.1.0",
+    releaseId,
+    sourceMaps: sourceMaps.sort((a, b) => a.sourceMapFile.localeCompare(b.sourceMapFile)),
+    diagnostics,
+  };
+  return {
+    artifactManifest,
+    sourceMapManifest,
+    symbolicationManifest: {
+      schemaVersion: "0.1.0",
+      releaseId,
+      localSymbolication: true,
+      sourceMapCount: sourceMaps.length,
+      providers: ["local", "sentry-compatible", "sentry", "glitchtip", "bugsink", "otel", "custom"],
+      diagnostics,
+    },
+  };
+}
+
+export function prepareRelease(options: {
+  workspaceRoot: string;
+  env: string;
+  allowDirty: boolean;
+}): {
+  ok: boolean;
+  releaseId: string;
+  releaseDir: string;
+  diagnostics: Diagnostic[];
+} {
+  const diagnostics: Diagnostic[] = [];
+  if (options.env === "production" && !options.allowDirty && isDirty(options.workspaceRoot)) {
+    diagnostics.push(
+      createDiagnostic({
+        severity: "error",
+        code: FORGE_RELEASE_DIRTY_WORKTREE,
+        message: "production release requires a clean git worktree or --allow-dirty",
+      }),
+    );
+  }
+
+  const pkg = packageInfo(options.workspaceRoot);
+  const sha = gitSha(options.workspaceRoot);
+  const releaseId = `${pkg.name}@${pkg.version}+${sha}`;
+  const deployId = `${options.env}-${releaseId}`;
+  const dir = releaseDir(options.workspaceRoot, releaseId);
+  nodeFileSystem.mkdirp(dir);
+
+  const collected = collectReleaseArtifacts(options.workspaceRoot, releaseId);
+  const releaseManifest: ReleaseManifest = {
+    schemaVersion: "0.1.0",
+    releaseId,
+    packageName: pkg.name,
+    packageVersion: pkg.version,
+    gitSha: sha,
+    defaultProvider: "local",
+    optionalProviders: ["local", "sentry-compatible", "sentry", "glitchtip", "bugsink", "otel", "custom"],
+    env: {
+      releaseId: "FORGE_RELEASE_ID",
+      deployId: "FORGE_DEPLOY_ID",
+      deployEnv: "FORGE_DEPLOY_ENV",
+      publicReleaseId: "NEXT_PUBLIC_FORGE_RELEASE_ID",
+    },
+    diagnostics,
+  };
+  const deployManifest: DeployManifest = {
+    schemaVersion: "0.1.0",
+    deployId,
+    releaseId,
+    environment: options.env,
+    attributes: {
+      "service.version": releaseId,
+      "deployment.environment": options.env,
+      "forge.release_id": releaseId,
+      "forge.deploy_id": deployId,
+    },
+  };
+  const buildInfo: BuildInfo = {
+    schemaVersion: "0.1.0",
+    packageName: pkg.name,
+    packageVersion: pkg.version,
+    gitSha: sha,
+    releaseId,
+    generatedHash: sha256(join(options.workspaceRoot, "forge.lock")),
+  };
+
+  const files: Array<[string, unknown]> = [
+    ["release.json", releaseManifest],
+    [`deploy.${options.env}.json`, deployManifest],
+    ["artifacts.json", collected.artifactManifest],
+    ["sourcemaps.json", collected.sourceMapManifest],
+    ["symbolication.json", collected.symbolicationManifest],
+    ["graph-hashes.json", {
+      appGraph: fileHash(options.workspaceRoot, `${GENERATED_DIR}/appGraph.json`),
+      packageGraph: fileHash(options.workspaceRoot, `${GENERATED_DIR}/packageGraph.json`),
+      runtimeGraph: fileHash(options.workspaceRoot, `${GENERATED_DIR}/runtimeGraph.json`),
+      dataGraph: fileHash(options.workspaceRoot, `${GENERATED_DIR}/dataGraph.json`),
+      policyRegistry: fileHash(options.workspaceRoot, `${GENERATED_DIR}/policyRegistry.json`),
+    }],
+    ["telemetry-correlation.json", {
+      releaseId,
+      deployId,
+      environment: options.env,
+      attributes: deployManifest.attributes,
+    }],
+    ["build-info.json", buildInfo],
+  ];
+  for (const [name, value] of files) {
+    nodeFileSystem.writeText(join(dir, name), serializeCanonical(value));
+  }
+
+  return {
+    ok: diagnostics.every((diagnostic) => diagnostic.severity !== "error"),
+    releaseId,
+    releaseDir: dir.replace(/\\/g, "/"),
+    diagnostics: [...diagnostics, ...collected.artifactManifest.diagnostics],
+  };
+}
+
+function fileHash(workspaceRoot: string, relativePath: string): string | null {
+  const absolute = join(workspaceRoot, relativePath);
+  return nodeFileSystem.exists(absolute) ? sha256(absolute) : null;
+}
+
+export function providerConfigDiagnostics(provider: ReleaseExportProvider): Diagnostic[] {
+  if (provider === "local" || provider === "otel") {
+    return [];
+  }
+  const sentryCompatible =
+    process.env.FORGE_ERROR_TRACKING_DSN ||
+    (provider === "sentry" ? process.env.SENTRY_DSN : undefined);
+  if (sentryCompatible) {
+    return [];
+  }
+  return [
+    createDiagnostic({
+      severity: "error",
+      code: FORGE_RELEASE_PROVIDER_CONFIG_MISSING,
+      message: `release provider '${provider}' requires explicit DSN/config; no upload was attempted`,
+    }),
+  ];
+}

package/src/forge/runtime/release/symbolicate.ts

@@ -0,0 +1,175 @@
+import { nodeFileSystem } from "../../compiler/fs/index.ts";
+import { join, normalize } from "node:path";
+import { createDiagnostic } from "../../compiler/diagnostics/create.ts";
+import { FORGE_SOURCEMAP_SYMBOLICATION_FAILED } from "../../compiler/diagnostics/codes.ts";
+import type {
+  SourceMapManifest,
+  StacktraceInput,
+  SymbolicatedFrame,
+  SymbolicationResult,
+} from "../../compiler/release/types.ts";
+
+const BASE64 = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/";
+
+function decodeVlq(segment: string): number[] {
+  const values: number[] = [];
+  let value = 0;
+  let shift = 0;
+  for (const char of segment) {
+    const integer = BASE64.indexOf(char);
+    if (integer < 0) {
+      continue;
+    }
+    const continuation = integer & 32;
+    const digit = integer & 31;
+    value += digit << shift;
+    if (continuation) {
+      shift += 5;
+      continue;
+    }
+    const negative = value & 1;
+    values.push((value >> 1) * (negative ? -1 : 1));
+    value = 0;
+    shift = 0;
+  }
+  return values;
+}
+
+interface Mapping {
+  generatedLine: number;
+  generatedColumn: number;
+  sourceIndex: number;
+  originalLine: number;
+  originalColumn: number;
+  nameIndex?: number;
+}
+
+interface SourceMapV3 {
+  version: number;
+  file?: string;
+  sources: string[];
+  names?: string[];
+  mappings: string;
+}
+
+function parseMappings(map: SourceMapV3): Mapping[] {
+  const mappings: Mapping[] = [];
+  let sourceIndex = 0;
+  let originalLine = 0;
+  let originalColumn = 0;
+  let nameIndex = 0;
+
+  const lines = map.mappings.split(";");
+  for (let lineIndex = 0; lineIndex < lines.length; lineIndex++) {
+    let generatedColumn = 0;
+    const segments = lines[lineIndex]?.split(",").filter(Boolean) ?? [];
+    for (const segment of segments) {
+      const values = decodeVlq(segment);
+      if (values.length < 4) {
+        continue;
+      }
+      generatedColumn += values[0] ?? 0;
+      sourceIndex += values[1] ?? 0;
+      originalLine += values[2] ?? 0;
+      originalColumn += values[3] ?? 0;
+      if (values.length >= 5) {
+        nameIndex += values[4] ?? 0;
+      }
+      mappings.push({
+        generatedLine: lineIndex + 1,
+        generatedColumn,
+        sourceIndex,
+        originalLine: originalLine + 1,
+        originalColumn,
+        ...(values.length >= 5 ? { nameIndex } : {}),
+      });
+    }
+  }
+  return mappings;
+}
+
+function basenamePath(path: string): string {
+  return normalize(path).replace(/\\/g, "/").split("/").pop() ?? path;
+}
+
+function findSourceMap(
+  workspaceRoot: string,
+  manifest: SourceMapManifest,
+  file: string,
+): string | null {
+  const normalizedFile = file.replace(/\\/g, "/");
+  const match = manifest.sourceMaps.find(
+    (entry) =>
+      entry.generatedFile === normalizedFile ||
+      entry.generatedFile.endsWith(normalizedFile) ||
+      basenamePath(entry.generatedFile) === basenamePath(normalizedFile),
+  );
+  if (!match) {
+    return null;
+  }
+  const absolute = join(workspaceRoot, match.sourceMapFile);
+  return nodeFileSystem.exists(absolute) ? absolute : null;
+}
+
+function symbolicateFrame(map: SourceMapV3, frame: { line: number; column: number }): SymbolicatedFrame["original"] {
+  const mappings = parseMappings(map)
+    .filter((mapping) => mapping.generatedLine === frame.line)
+    .sort((a, b) => a.generatedColumn - b.generatedColumn);
+  const candidate =
+    mappings.filter((mapping) => mapping.generatedColumn <= frame.column).at(-1) ??
+    mappings[0];
+  if (!candidate) {
+    return undefined;
+  }
+  return {
+    source: map.sources[candidate.sourceIndex] ?? "unknown",
+    line: candidate.originalLine,
+    column: candidate.originalColumn,
+    ...(candidate.nameIndex !== undefined && map.names?.[candidate.nameIndex]
+      ? { name: map.names[candidate.nameIndex] }
+      : {}),
+  };
+}
+
+export function symbolicateStacktrace(input: {
+  workspaceRoot: string;
+  manifest: SourceMapManifest;
+  stacktrace: StacktraceInput;
+}): SymbolicationResult {
+  const frames: SymbolicatedFrame[] = [];
+  const diagnostics = [];
+
+  for (const frame of input.stacktrace.frames) {
+    const sourceMapPath = findSourceMap(input.workspaceRoot, input.manifest, frame.file);
+    if (!sourceMapPath) {
+      frames.push({ generated: frame });
+      diagnostics.push(
+        createDiagnostic({
+          severity: "warning",
+          code: FORGE_SOURCEMAP_SYMBOLICATION_FAILED,
+          message: `no source map found for ${frame.file}`,
+        }),
+      );
+      continue;
+    }
+
+    try {
+      const map = JSON.parse((nodeFileSystem.readText(sourceMapPath) ?? "")) as SourceMapV3;
+      frames.push({
+        generated: frame,
+        original: symbolicateFrame(map, frame),
+      });
+    } catch (error) {
+      frames.push({ generated: frame });
+      diagnostics.push(
+        createDiagnostic({
+          severity: "warning",
+          code: FORGE_SOURCEMAP_SYMBOLICATION_FAILED,
+          message: error instanceof Error ? error.message : "source map parse failed",
+        }),
+      );
+    }
+  }
+
+  return { frames, diagnostics };
+}

package/src/forge/runtime/runner/command-transaction.ts

@@ -0,0 +1,193 @@
+import { createDiagnostic } from "../../compiler/diagnostics/create.ts";
+import {
+  FORGE_DB_TRANSACTION_FAILED,
+  FORGE_POLICY_DENIED,
+  FORGE_TENANT_SCOPE_VIOLATION,
+} from "../../compiler/diagnostics/codes.ts";
+import type { TableMapEntry } from "../../compiler/data-graph/sql/serialize.ts";
+import type { Diagnostic } from "../../compiler/types/diagnostic.ts";
+import type { RuntimeEntry } from "../../compiler/types/runtime-graph.ts";
+import type { DbAdapter } from "../db/adapter.ts";
+import { setDbSessionContext } from "../db/session-context.ts";
+import {
+  createGeneratedDbClient,
+  TenantScopeViolationError,
+} from "../db/generated-client.ts";
+import { createForgeContext } from "../context/create-context.ts";
+import { loadActionSubscriptions } from "../outbox/subscriptions.ts";
+import { createTelemetryContext } from "../telemetry/context.ts";
+import { recordExceptionOutsideTx } from "../telemetry/buffer.ts";
+import { generateTraceId } from "../telemetry/correlation.ts";
+import type { AuthContext } from "../auth/types.ts";
+import { checkCommandPolicy } from "../policy/check.ts";
+import { createWriteTracker } from "../live/dependency-tracker.ts";
+import {
+  notifyLiveWakeup,
+  writeLiveInvalidations,
+} from "../live/invalidation-log.ts";
+import type { LiveSubscriptionManager } from "../live/types.ts";
+
+export interface CommandRuntime {
+  adapter: DbAdapter;
+  tableMap: Record<string, TableMapEntry>;
+  workspaceRoot: string;
+  requestId?: string;
+  auth?: AuthContext;
+  liveManager?: LiveSubscriptionManager;
+}
+
+export interface CommandTransactionResult {
+  ok: boolean;
+  result?: unknown;
+  diagnostics: Diagnostic[];
+  traceId?: string;
+}
+
+type CtxHandler = (ctx: unknown, args: unknown) => unknown | Promise<unknown>;
+
+export async function runCommandWithTransaction(
+  entry: RuntimeEntry,
+  handler: CtxHandler,
+  args: unknown,
+  runtime: CommandRuntime,
+): Promise<CommandTransactionResult> {
+  const diagnostics: Diagnostic[] = [];
+  const traceId = generateTraceId();
+  const auth = runtime.auth ?? { kind: "anonymous" as const };
+
+  const preflightTelemetry = createTelemetryContext({
+    adapter: runtime.adapter,
+    traceId,
+    requestId: runtime.requestId,
+    runtime: { kind: "command", name: entry.name },
+    bufferInTransaction: false,
+    workspaceRoot: runtime.workspaceRoot,
+  });
+
+  const policyCheck = await checkCommandPolicy({
+    workspaceRoot: runtime.workspaceRoot,
+    entry,
+    auth,
+    telemetry: preflightTelemetry,
+  });
+
+  if (!policyCheck.allowed) {
+    return {
+      ok: false,
+      diagnostics: [...diagnostics, ...policyCheck.diagnostics],
+      traceId,
+    };
+  }
+
+  const tx = await runtime.adapter.begin();
+
+  try {
+    await setDbSessionContext(tx, auth);
+
+    const telemetry = createTelemetryContext({
+      adapter: runtime.adapter,
+      tx,
+      traceId,
+      requestId: runtime.requestId,
+      runtime: { kind: "command", name: entry.name },
+      bufferInTransaction: true,
+      workspaceRoot: runtime.workspaceRoot,
+    });
+
+    const writeTracker = createWriteTracker();
+    const db = createGeneratedDbClient(tx, runtime.tableMap, {
+      auth,
+      writeTracker,
+    });
+    const { subscriptions } = loadActionSubscriptions(runtime.workspaceRoot);
+    const ctx = createForgeContext(tx, db, subscriptions, telemetry, auth, {
+      workspaceRoot: runtime.workspaceRoot,
+      runtimeKind: "command",
+    });
+    const result = await handler(ctx, args);
+    const invalidations = await writeLiveInvalidations(tx, {
+      changes: writeTracker.changes.map((change) => ({ ...change, traceId })),
+      sourceKind: "command",
+      sourceName: entry.name,
+      traceId,
+    });
+    await tx.commit();
+
+    const latestRevision = Math.max(
+      0,
+      ...invalidations.map((invalidation) => invalidation.revision),
+    );
+    if (latestRevision > 0) {
+      await notifyLiveWakeup(runtime.adapter, latestRevision);
+      if (runtime.liveManager) {
+        for (const change of writeTracker.changes) {
+          await runtime.liveManager.notifyDataChanged(change);
+        }
+      }
+    } else {
+      for (const change of writeTracker.changes) {
+        await runtime.liveManager?.notifyDataChanged(change);
+      }
+    }
+
+    return {
+      ok: true,
+      result,
+      diagnostics: [...diagnostics, ...policyCheck.diagnostics],
+      traceId,
+    };
+  } catch (error) {
+    try {
+      await tx.rollback();
+    } catch {
+      // ignore rollback errors
+    }
+
+    if (error instanceof TenantScopeViolationError) {
+      await preflightTelemetry.capture("forge.tenant_scope.denied", {
+        table: error.table,
+        operation: error.operation,
+      });
+
+      diagnostics.push(
+        createDiagnostic({
+          severity: "error",
+          code: FORGE_TENANT_SCOPE_VIOLATION,
+          message: error.message,
+          file: entry.file,
+        }),
+      );
+
+      return {
+        ok: false,
+        diagnostics,
+        traceId,
+      };
+    }
+
+    await recordExceptionOutsideTx(runtime.adapter, error, traceId, {
+      kind: "command",
+      name: entry.name,
+    }, { requestId: runtime.requestId });
+
+    const message = error instanceof Error ? error.message : "command transaction failed";
+    diagnostics.push(
+      createDiagnostic({
+        severity: "error",
+        code: FORGE_DB_TRANSACTION_FAILED,
+        message: `command '${entry.name}' failed: ${message}`,
+        file: entry.file,
+      }),
+    );
+
+    return {
+      ok: false,
+      diagnostics,
+      traceId,
+    };
+  }
+}
+
+export function isPolicyDeniedResult(result: CommandTransactionResult): boolean {
+  return result.diagnostics.some((diagnostic) => diagnostic.code === FORGE_POLICY_DENIED);
+}