forgeos 0.1.0-alpha.0

package/src/forge/compiler/package-upgrades/risk.ts

@@ -0,0 +1,208 @@
+import {
+  FORGE_DEPS_API_BREAKING_CHANGE,
+  FORGE_DEPS_CAPABILITY_ADDED,
+  FORGE_DEPS_REMOVED_EXPORT_USED,
+  FORGE_DEPS_RUNTIME_CONTEXT_CHANGED,
+  FORGE_DEPS_SECRET_ADDED,
+  FORGE_DEPS_SIGNATURE_CHANGED_USED,
+} from "../diagnostics/codes.ts";
+import type {
+  PackageApiDiff,
+  RiskLevel,
+  RiskReason,
+  RuntimeDiff,
+  UpgradeImpact,
+  UpgradeRiskReport,
+} from "./types.ts";
+
+export function semverBump(from: string, to: string): "patch" | "minor" | "major" | "prerelease" | "unknown" {
+  const before = parseSemver(from);
+  const after = parseSemver(to);
+  if (!before || !after) {
+    return "unknown";
+  }
+  if (after.prerelease || before.prerelease) {
+    return "prerelease";
+  }
+  if (after.major !== before.major) {
+    return "major";
+  }
+  if (after.minor !== before.minor) {
+    return "minor";
+  }
+  if (after.patch !== before.patch) {
+    return "patch";
+  }
+  return "patch";
+}
+
+function parseSemver(version: string): {
+  major: number;
+  minor: number;
+  patch: number;
+  prerelease: boolean;
+} | null {
+  const match = /^(\d+)\.(\d+)\.(\d+)(-.+)?$/.exec(version);
+  if (!match) {
+    return null;
+  }
+  return {
+    major: Number(match[1]),
+    minor: Number(match[2]),
+    patch: Number(match[3]),
+    prerelease: Boolean(match[4]),
+  };
+}
+
+function levelFromScore(score: number): RiskLevel {
+  if (score > 100) {
+    return "critical";
+  }
+  if (score >= 65) {
+    return "high";
+  }
+  if (score >= 35) {
+    return "medium";
+  }
+  return "low";
+}
+
+function baseRiskForBump(bump: ReturnType<typeof semverBump>): {
+  score: number;
+  reason: RiskReason;
+} {
+  switch (bump) {
+    case "patch":
+      return {
+        score: 15,
+        reason: { code: "FORGE_DEPS_SEMVER_PATCH", severity: "info", message: "patch version upgrade" },
+      };
+    case "minor":
+      return {
+        score: 35,
+        reason: { code: "FORGE_DEPS_SEMVER_MINOR", severity: "warning", message: "minor version upgrade" },
+      };
+    case "major":
+      return {
+        score: 60,
+        reason: { code: "FORGE_DEPS_SEMVER_MAJOR", severity: "warning", message: "major version upgrade" },
+      };
+    case "prerelease":
+      return {
+        score: 60,
+        reason: { code: "FORGE_DEPS_SEMVER_PRERELEASE", severity: "warning", message: "pre-release upgrade" },
+      };
+    default:
+      return {
+        score: 55,
+        reason: { code: "FORGE_DEPS_SEMVER_UNKNOWN", severity: "warning", message: "could not classify semver jump" },
+      };
+  }
+}
+
+export function buildRiskReport(input: {
+  bump: ReturnType<typeof semverBump>;
+  apiDiff: PackageApiDiff;
+  runtimeDiff: RuntimeDiff;
+  affected: UpgradeImpact;
+}): UpgradeRiskReport {
+  const base = baseRiskForBump(input.bump);
+  let score = base.score;
+  const reasons: RiskReason[] = [base.reason];
+
+  if (input.apiDiff.removedExports.length > 0) {
+    score += input.affected.files.length > 0 ? 25 : 15;
+    reasons.push({
+      code: input.affected.files.length > 0
+        ? FORGE_DEPS_REMOVED_EXPORT_USED
+        : FORGE_DEPS_API_BREAKING_CHANGE,
+      severity: "error",
+      message: `${input.apiDiff.removedExports.length} exports were removed`,
+    });
+  }
+
+  if (input.apiDiff.changedSignatures.length > 0) {
+    score += input.affected.files.length > 0 ? 20 : 10;
+    reasons.push({
+      code: input.affected.files.length > 0
+        ? FORGE_DEPS_SIGNATURE_CHANGED_USED
+        : FORGE_DEPS_API_BREAKING_CHANGE,
+      severity: "warning",
+      message: `${input.apiDiff.changedSignatures.length} exported signatures changed`,
+    });
+  }
+
+  if (input.runtimeDiff.contextCompatibilityChanged) {
+    score += 20;
+    reasons.push({
+      code: FORGE_DEPS_RUNTIME_CONTEXT_CHANGED,
+      severity: "error",
+      message: "runtime context compatibility changed",
+    });
+  }
+
+  if (input.runtimeDiff.secretChanges.added.length > 0) {
+    score += 15;
+    reasons.push({
+      code: FORGE_DEPS_SECRET_ADDED,
+      severity: "warning",
+      message: `new secrets required: ${input.runtimeDiff.secretChanges.added.join(", ")}`,
+    });
+  }
+
+  if (input.runtimeDiff.addedCapabilities.length > 0) {
+    score += 15;
+    reasons.push({
+      code: FORGE_DEPS_CAPABILITY_ADDED,
+      severity: "warning",
+      message: `new capabilities detected: ${input.runtimeDiff.addedCapabilities.map((capability) => capability.name).join(", ")}`,
+    });
+  }
+
+  if (input.affected.generatedAdapters.length > 0) {
+    score += 10;
+    reasons.push({
+      code: "FORGE_DEPS_GENERATED_ADAPTER_IMPACTED",
+      severity: "warning",
+      message: "generated integration adapters are affected",
+    });
+  }
+
+  if (
+    input.affected.commands.length > 0 ||
+    input.affected.queries.length > 0 ||
+    input.affected.liveQueries.length > 0
+  ) {
+    score += 15;
+    reasons.push({
+      code: "FORGE_DEPS_BOUNDARY_IMPACTED",
+      severity: "warning",
+      message: "upgrade affects command/query/liveQuery boundaries",
+    });
+  }
+
+  const blockers = reasons
+    .filter((reason) => reason.severity === "error")
+    .map((reason) => ({
+      code: reason.code,
+      message: reason.message,
+      recommendedAction: "Inspect affected files and run forge verify --strict before applying.",
+    }));
+
+  return {
+    level: levelFromScore(Math.min(100, score)),
+    score: Math.min(100, score),
+    reasons,
+    blockers,
+  };
+}
+
+export function recommendedCommands(impact: UpgradeImpact): string[] {
+  return [
+    "forge generate",
+    "forge check",
+    ...(impact.tests.length > 0 ? ["forge test run --changed --json"] : []),
+    "forge verify --standard",
+    "forge verify --strict",
+  ];
+}

package/src/forge/compiler/package-upgrades/types.ts

@@ -0,0 +1,174 @@
+import type { Diagnostic } from "../types/diagnostic.ts";
+import type { PackageManager, RuntimeContext } from "../types/runtime.ts";
+
+export type UpgradeTarget =
+  | { kind: "version"; version: string }
+  | { kind: "dist-tag"; tag: string }
+  | { kind: "semver-bump"; bump: "patch" | "minor" | "major" }
+  | { kind: "range"; range: string }
+  | { kind: "wanted" };
+
+export interface PackageVersionInfo {
+  version: string;
+  spec: string;
+  distTag?: string;
+  integrity?: string;
+  tarballUrl?: string;
+  publishedAt?: string;
+}
+
+export interface ExportChange {
+  entrypoint: string;
+  exportName: string;
+  kind: string;
+}
+
+export interface CallsiteImpact {
+  file: string;
+  symbolName?: string;
+  symbolKind?: string;
+}
+
+export interface SignatureChange {
+  entrypoint: string;
+  exportName: string;
+  before: string;
+  after: string;
+  affectedCallsites: CallsiteImpact[];
+}
+
+export interface EntrypointChange {
+  entrypoint: string;
+  kind: "added" | "removed" | "changed";
+}
+
+export interface PackageApiDiff {
+  removedExports: ExportChange[];
+  addedExports: ExportChange[];
+  changedSignatures: SignatureChange[];
+  changedEntrypoints: EntrypointChange[];
+  changedJSDoc: unknown[];
+  typeResolutionChanges: unknown[];
+}
+
+export interface CapabilityChange {
+  name: string;
+  before?: string;
+  after?: string;
+}
+
+export interface RuntimeDiff {
+  capabilitiesChanged: boolean;
+  addedCapabilities: CapabilityChange[];
+  removedCapabilities: CapabilityChange[];
+  contextCompatibilityChanged: boolean;
+  contextsNowDenied: RuntimeContext[];
+  contextsNowAllowed: RuntimeContext[];
+  secretChanges: {
+    added: string[];
+    removed: string[];
+    changedRequired: string[];
+  };
+  recipeChanged: boolean;
+  previousRecipeVersion?: string;
+  nextRecipeVersion?: string;
+}
+
+export interface UpgradeImportImpact {
+  file: string;
+  specifier: string;
+  importKind: "static" | "dynamic" | "require" | "type";
+}
+
+export interface UpgradeImpact {
+  files: string[];
+  imports: UpgradeImportImpact[];
+  commands: string[];
+  queries: string[];
+  liveQueries: string[];
+  actions: string[];
+  workflows: string[];
+  workflowSteps: string[];
+  endpoints: string[];
+  frontendComponents: string[];
+  generatedAdapters: string[];
+  tests: string[];
+}
+
+export type RiskLevel = "low" | "medium" | "high" | "critical";
+
+export interface RiskReason {
+  code: string;
+  severity: "info" | "warning" | "error";
+  message: string;
+}
+
+export interface RiskBlocker {
+  code: string;
+  message: string;
+  recommendedAction: string;
+}
+
+export interface UpgradeRiskReport {
+  level: RiskLevel;
+  score: number;
+  reasons: RiskReason[];
+  blockers: RiskBlocker[];
+}
+
+export interface SecurityDiff {
+  enabled: boolean;
+  fixed: string[];
+  introduced: string[];
+  diagnostics: Diagnostic[];
+}
+
+export interface GeneratedChange {
+  file: string;
+  reason: string;
+}
+
+export interface UpgradeTestPlan {
+  commands: string[];
+  tests: string[];
+  manualChecks: string[];
+}
+
+export interface RollbackPlan {
+  id: string;
+  snapshotDir: string;
+  files: string[];
+  reinstallCommand: string;
+}
+
+export interface PackageUpgradePlan {
+  schemaVersion: "0.1.0";
+  plannerVersion: string;
+  id: string;
+  packageName: string;
+  integrationAlias?: string;
+  from: PackageVersionInfo;
+  to: PackageVersionInfo;
+  packageManager: PackageManager;
+  semver: {
+    bump: "patch" | "minor" | "major" | "prerelease" | "unknown";
+    rangeChangeRequired: boolean;
+  };
+  apiDiff: PackageApiDiff;
+  runtimeDiff: RuntimeDiff;
+  affected: UpgradeImpact;
+  risk: UpgradeRiskReport;
+  security?: SecurityDiff;
+  generatedChanges: GeneratedChange[];
+  recommendedCommands: string[];
+  testPlan: UpgradeTestPlan;
+  rollback: RollbackPlan;
+  diagnostics: Diagnostic[];
+}
+
+export interface PackageUpgradeRegistry {
+  schemaVersion: "0.1.0";
+  plannerVersion: string;
+  commands: string[];
+  planDirectory: ".forge/upgrades";
+}

package/src/forge/compiler/policy-registry/build.ts

@@ -0,0 +1,266 @@
+import { createDiagnostic } from "../diagnostics/create.ts";
+import {
+  FORGE_POLICY_DUPLICATE,
+  FORGE_POLICY_ROLE_EMPTY,
+  FORGE_POLICY_UNKNOWN,
+  FORGE_TENANT_TABLE_WITHOUT_TENANT_ID,
+} from "../diagnostics/codes.ts";
+import { toSnakeCase } from "../data-graph/sql/naming.ts";
+import { GENERATOR_VERSION } from "../emitter/constants.ts";
+import { hashStable } from "../primitives/hash.ts";
+import { canonicalJson } from "../primitives/serialize.ts";
+import type { AppGraph } from "../types/app-graph.ts";
+import type { DataGraph } from "../types/data-graph.ts";
+import type {
+  CommandAuthBinding,
+  PermissionMatrix,
+  PermissionMatrixEntry,
+  PolicyRegistry,
+  PolicyRule,
+  QueryAuthBinding,
+  TenantScope,
+  TenantScopeEntry,
+} from "../types/policy-registry.ts";
+import {
+  POLICY_REGISTRY_ANALYZER_VERSION,
+  POLICY_REGISTRY_SCHEMA_VERSION,
+} from "./constants.ts";
+import { parseAuthFromSlice, parsePoliciesFromSlice } from "./parse.ts";
+
+function stableSortPolicies(policies: PolicyRule[]): PolicyRule[] {
+  return [...policies].sort((a, b) => {
+    if (a.name !== b.name) {
+      return a.name < b.name ? -1 : 1;
+    }
+    return a.file < b.file ? -1 : 1;
+  });
+}
+
+function stableSortCommandAuth(bindings: CommandAuthBinding[]): CommandAuthBinding[] {
+  return [...bindings].sort((a, b) => {
+    if (a.commandName !== b.commandName) {
+      return a.commandName < b.commandName ? -1 : 1;
+    }
+    return a.file < b.file ? -1 : 1;
+  });
+}
+
+function stableSortQueryAuth(bindings: QueryAuthBinding[]): QueryAuthBinding[] {
+  return [...bindings].sort((a, b) => {
+    if (a.queryName !== b.queryName) {
+      return a.queryName < b.queryName ? -1 : 1;
+    }
+    return a.file < b.file ? -1 : 1;
+  });
+}
+
+function buildPermissionMatrix(policies: PolicyRule[]): PermissionMatrixEntry[] {
+  return policies
+    .filter((policy) => policy.kind === "roles")
+    .map((policy) => ({
+      policy: policy.name,
+      roles: [...policy.roles].sort(),
+    }))
+    .sort((a, b) => (a.policy < b.policy ? -1 : a.policy > b.policy ? 1 : 0));
+}
+
+export function buildPolicyRegistry(appGraph: AppGraph): PolicyRegistry {
+  const policies: PolicyRule[] = [];
+  const commandAuth: CommandAuthBinding[] = [];
+  const queryAuth: QueryAuthBinding[] = [];
+  const diagnostics: PolicyRegistry["diagnostics"] = [];
+  const seenPolicyNames = new Map<string, PolicyRule>();
+
+  for (const symbol of appGraph.symbols) {
+    if (symbol.kind === "policy") {
+      const sourceSlice =
+        typeof symbol.meta.sourceSlice === "string" ? symbol.meta.sourceSlice : "";
+      if (sourceSlice.length === 0) {
+        continue;
+      }
+
+      for (const parsed of parsePoliciesFromSlice(sourceSlice)) {
+        const rule: PolicyRule = {
+          name: parsed.name,
+          kind: parsed.kind,
+          roles: parsed.roles,
+          file: symbol.file,
+          symbolId: symbol.id,
+        };
+
+        if (parsed.kind === "roles" && parsed.roles.length === 0) {
+          diagnostics.push(
+            createDiagnostic({
+              severity: "warning",
+              code: FORGE_POLICY_ROLE_EMPTY,
+              message: `policy '${parsed.name}' has no roles`,
+              file: symbol.file,
+              span: symbol.span,
+            }),
+          );
+        }
+
+        const existing = seenPolicyNames.get(parsed.name);
+        if (existing) {
+          diagnostics.push(
+            createDiagnostic({
+              severity: "warning",
+              code: FORGE_POLICY_DUPLICATE,
+              message: `duplicate policy '${parsed.name}'`,
+              file: symbol.file,
+              span: symbol.span,
+            }),
+          );
+          continue;
+        }
+
+        seenPolicyNames.set(parsed.name, rule);
+        policies.push(rule);
+      }
+    }
+
+    if (symbol.kind === "command") {
+      const sourceSlice =
+        typeof symbol.meta.sourceSlice === "string" ? symbol.meta.sourceSlice : "";
+      const auth =
+        sourceSlice.length > 0
+          ? parseAuthFromSlice(sourceSlice)
+          : { kind: "public" as const };
+
+      commandAuth.push({
+        commandName: symbol.name,
+        file: symbol.file,
+        symbolId: symbol.id,
+        auth,
+      });
+    }
+
+    if (symbol.kind === "query" || symbol.kind === "liveQuery") {
+      const sourceSlice =
+        typeof symbol.meta.sourceSlice === "string" ? symbol.meta.sourceSlice : "";
+      const auth =
+        sourceSlice.length > 0
+          ? parseAuthFromSlice(sourceSlice)
+          : { kind: "public" as const };
+
+      queryAuth.push({
+        queryName: symbol.name,
+        file: symbol.file,
+        symbolId: symbol.id,
+        auth,
+      });
+    }
+  }
+
+  const sortedPolicies = stableSortPolicies(policies);
+  const sortedCommandAuth = stableSortCommandAuth(commandAuth);
+  const sortedQueryAuth = stableSortQueryAuth(queryAuth);
+
+  for (const binding of sortedCommandAuth) {
+    if (binding.auth.kind !== "policy") {
+      continue;
+    }
+    if (!seenPolicyNames.has(binding.auth.policy)) {
+      diagnostics.push(
+        createDiagnostic({
+          severity: "warning",
+          code: FORGE_POLICY_UNKNOWN,
+          message: `command '${binding.commandName}' references unknown policy '${binding.auth.policy}'`,
+          file: binding.file,
+        }),
+      );
+    }
+  }
+
+  for (const binding of sortedQueryAuth) {
+    if (binding.auth.kind !== "policy") {
+      continue;
+    }
+    if (!seenPolicyNames.has(binding.auth.policy)) {
+      diagnostics.push(
+        createDiagnostic({
+          severity: "warning",
+          code: FORGE_POLICY_UNKNOWN,
+          message: `query '${binding.queryName}' references unknown policy '${binding.auth.policy}'`,
+          file: binding.file,
+        }),
+      );
+    }
+  }
+
+  return {
+    schemaVersion: POLICY_REGISTRY_SCHEMA_VERSION,
+    generatorVersion: GENERATOR_VERSION,
+    analyzerVersion: POLICY_REGISTRY_ANALYZER_VERSION,
+    inputHash: hashStable(
+      canonicalJson({
+        appInputHash: appGraph.inputHash,
+        analyzerVersion: POLICY_REGISTRY_ANALYZER_VERSION,
+      }),
+    ),
+    policies: sortedPolicies,
+    commandAuth: sortedCommandAuth,
+    queryAuth: sortedQueryAuth,
+    diagnostics: diagnostics.sort((a, b) => {
+      const fileA = a.file ?? "";
+      const fileB = b.file ?? "";
+      if (fileA !== fileB) {
+        return fileA < fileB ? -1 : 1;
+      }
+      return a.message < b.message ? -1 : a.message > b.message ? 1 : 0;
+    }),
+  };
+}
+
+export function buildPermissionMatrixFromRegistry(
+  registry: PolicyRegistry,
+): PermissionMatrix {
+  return {
+    schemaVersion: POLICY_REGISTRY_SCHEMA_VERSION,
+    generatorVersion: GENERATOR_VERSION,
+    inputHash: registry.inputHash,
+    entries: buildPermissionMatrix(registry.policies),
+  };
+}
+
+export function buildTenantScope(dataGraph: DataGraph): TenantScope {
+  const tables: TenantScopeEntry[] = [];
+  const diagnostics: TenantScope["diagnostics"] = [];
+
+  for (const table of dataGraph.tables) {
+    const tenantField = table.fields.find((field) => field.name === "tenantId");
+    if (tenantField) {
+      tables.push({
+        table: toSnakeCase(table.name),
+        exportName: table.exportName,
+        tenantIdColumn: toSnakeCase("tenantId"),
+        file: table.file,
+      });
+      continue;
+    }
+
+    if (/tenant/i.test(table.name)) {
+      diagnostics.push(
+        createDiagnostic({
+          severity: "warning",
+          code: FORGE_TENANT_TABLE_WITHOUT_TENANT_ID,
+          message: `table '${table.name}' looks tenant-related but has no tenantId field`,
+          file: table.file,
+        }),
+      );
+    }
+  }
+
+  return {
+    schemaVersion: POLICY_REGISTRY_SCHEMA_VERSION,
+    generatorVersion: GENERATOR_VERSION,
+    inputHash: hashStable(
+      canonicalJson({
+        dataInputHash: dataGraph.inputHash,
+        analyzerVersion: POLICY_REGISTRY_ANALYZER_VERSION,
+      }),
+    ),
+    tables: tables.sort((a, b) => (a.table < b.table ? -1 : a.table > b.table ? 1 : 0)),
+    diagnostics,
+  };
+}

package/src/forge/compiler/policy-registry/constants.ts

@@ -0,0 +1,2 @@
+export const POLICY_REGISTRY_SCHEMA_VERSION = "1.0.0";
+export const POLICY_REGISTRY_ANALYZER_VERSION = "policy-registry@1.0.0";