forgeos 0.1.0-alpha.0

package/src/forge/runtime/auth/resolve.ts

@@ -0,0 +1,74 @@
+import type { AuthContext } from "./types.ts";
+
+export interface AuthHeaderInput {
+  userId?: string;
+  tenantId?: string;
+  role?: string;
+}
+
+export interface CliAuthInput {
+  userId?: string;
+  tenantId?: string;
+  role?: string;
+}
+
+export function resolveAuthFromHeaders(input: AuthHeaderInput): AuthContext {
+  const { userId, tenantId, role } = input;
+  if (userId && role) {
+    return {
+      kind: "user",
+      userId,
+      ...(tenantId ? { tenantId } : {}),
+      role,
+      roles: [role],
+      permissions: [],
+      token: {
+        issuer: "dev-headers",
+        audience: "dev",
+        subject: userId,
+        authProvider: "dev-headers",
+      },
+      claims: {},
+    };
+  }
+  return { kind: "anonymous" };
+}
+
+export function resolveAuthFromCli(input: CliAuthInput): AuthContext {
+  return resolveAuthFromHeaders(input);
+}
+
+export function parseAuthHeaders(headers: Headers): AuthContext {
+  return resolveAuthFromHeaders({
+    userId: headers.get("x-forge-user-id") ?? undefined,
+    tenantId: headers.get("x-forge-tenant-id") ?? undefined,
+    role: headers.get("x-forge-role") ?? undefined,
+  });
+}
+
+export function systemAuthFromSnapshot(
+  snapshot: AuthContext,
+  tenantId?: string,
+): AuthContext {
+  if (snapshot.kind === "user") {
+    return {
+      kind: "system",
+      tenantId: tenantId ?? snapshot.tenantId,
+      triggeredBy: snapshot,
+    };
+  }
+
+  if (snapshot.kind === "system") {
+    return {
+      kind: "system",
+      tenantId: tenantId ?? snapshot.tenantId,
+      triggeredBy: snapshot.triggeredBy ?? snapshot,
+    };
+  }
+
+  return {
+    kind: "system",
+    ...(tenantId ? { tenantId } : {}),
+    triggeredBy: { kind: "anonymous" },
+  };
+}

package/src/forge/runtime/auth/types.ts

@@ -0,0 +1,87 @@
+export type AuthContext =
+  | {
+      kind: "user";
+      userId: string;
+      tenantId?: string;
+      role?: string;
+      roles?: string[];
+      permissions?: string[];
+      email?: string;
+      name?: string;
+      token?: {
+        issuer: string;
+        audience: string | string[];
+        subject: string;
+        expiresAt?: number;
+        issuedAt?: number;
+        authProvider: string;
+      };
+      claims?: Record<string, unknown>;
+    }
+  | {
+      kind: "system";
+      tenantId?: string;
+      triggeredBy?: AuthSnapshot;
+    }
+  | { kind: "anonymous" };
+
+export type AuthSnapshot =
+  | {
+      kind: "user";
+      userId: string;
+      tenantId?: string;
+      role?: string;
+      roles?: string[];
+      permissions?: string[];
+      email?: string;
+      name?: string;
+      token?: {
+        issuer: string;
+        audience: string | string[];
+        subject: string;
+        expiresAt?: number;
+        issuedAt?: number;
+        authProvider: string;
+      };
+      claims?: Record<string, unknown>;
+    }
+  | {
+      kind: "system";
+      tenantId?: string;
+      triggeredBy?: AuthSnapshot;
+    }
+  | { kind: "anonymous" };
+
+export function isUserAuth(auth: AuthContext): auth is Extract<AuthContext, { kind: "user" }> {
+  return auth.kind === "user";
+}
+
+export function isSystemAuth(auth: AuthContext): auth is Extract<AuthContext, { kind: "system" }> {
+  return auth.kind === "system";
+}
+
+export function snapshotAuth(auth: AuthContext): AuthSnapshot {
+  if (auth.kind === "user") {
+    return {
+      kind: "user",
+      userId: auth.userId,
+      ...(auth.tenantId ? { tenantId: auth.tenantId } : {}),
+      ...(auth.role ? { role: auth.role } : {}),
+      ...(auth.roles ? { roles: auth.roles } : {}),
+      ...(auth.permissions ? { permissions: auth.permissions } : {}),
+      ...(auth.email ? { email: auth.email } : {}),
+      ...(auth.name ? { name: auth.name } : {}),
+      ...(auth.token ? { token: auth.token } : {}),
+    };
+  }
+
+  if (auth.kind === "system") {
+    return {
+      kind: "system",
+      ...(auth.tenantId ? { tenantId: auth.tenantId } : {}),
+      ...(auth.triggeredBy ? { triggeredBy: auth.triggeredBy } : {}),
+    };
+  }
+
+  return { kind: "anonymous" };
+}

package/src/forge/runtime/auth/verifier.ts

@@ -0,0 +1,138 @@
+import { createRemoteJWKSet, errors, jwtVerify, type JWTPayload } from "jose";
+import {
+  FORGE_AUTH_INVALID_AUDIENCE,
+  FORGE_AUTH_INVALID_ISSUER,
+  FORGE_AUTH_INVALID_TOKEN,
+  FORGE_AUTH_JWKS_FAILED,
+  FORGE_AUTH_TOKEN_EXPIRED,
+} from "../../compiler/diagnostics/codes.ts";
+import type { ForgeAuthConfig } from "./config.ts";
+import { ForgeAuthError } from "./errors.ts";
+import type { VerifiedTokenMetadata } from "./claims.ts";
+
+const jwksCache = new Map<string, ReturnType<typeof createRemoteJWKSet>>();
+const oidcDiscoveryCache = new Map<string, Promise<string>>();
+
+function getRemoteJwks(jwksUri: string): ReturnType<typeof createRemoteJWKSet> {
+  const cached = jwksCache.get(jwksUri);
+  if (cached) {
+    return cached;
+  }
+  const jwks = createRemoteJWKSet(new URL(jwksUri));
+  jwksCache.set(jwksUri, jwks);
+  return jwks;
+}
+
+function oidcMetadataUrl(issuer: string): string {
+  return `${issuer.replace(/\/+$/, "")}/.well-known/openid-configuration`;
+}
+
+export async function discoverOidcJwksUri(issuer: string): Promise<string> {
+  const cached = oidcDiscoveryCache.get(issuer);
+  if (cached) {
+    return cached;
+  }
+
+  const discovered = (async () => {
+    const response = await fetch(oidcMetadataUrl(issuer));
+    if (!response.ok) {
+      throw new ForgeAuthError(
+        FORGE_AUTH_JWKS_FAILED,
+        `OIDC discovery failed with status ${response.status}`,
+      );
+    }
+    const metadata = (await response.json()) as { jwks_uri?: unknown };
+    if (typeof metadata.jwks_uri !== "string" || metadata.jwks_uri.length === 0) {
+      throw new ForgeAuthError(
+        FORGE_AUTH_JWKS_FAILED,
+        "OIDC discovery did not include jwks_uri",
+      );
+    }
+    return metadata.jwks_uri;
+  })();
+
+  oidcDiscoveryCache.set(issuer, discovered);
+  return discovered;
+}
+
+function classifyJoseError(error: unknown): ForgeAuthError {
+  if (error instanceof ForgeAuthError) {
+    return error;
+  }
+  if (error instanceof errors.JWTExpired) {
+    return new ForgeAuthError(FORGE_AUTH_TOKEN_EXPIRED, "JWT token is expired", {
+      cause: error,
+    });
+  }
+  if (error instanceof errors.JWTClaimValidationFailed) {
+    const claim = error.claim;
+    if (claim === "iss") {
+      return new ForgeAuthError(
+        FORGE_AUTH_INVALID_ISSUER,
+        "JWT issuer did not match Forge auth config",
+        { cause: error },
+      );
+    }
+    if (claim === "aud") {
+      return new ForgeAuthError(
+        FORGE_AUTH_INVALID_AUDIENCE,
+        "JWT audience did not match Forge auth config",
+        { cause: error },
+      );
+    }
+  }
+  if (error instanceof errors.JWKSNoMatchingKey || error instanceof errors.JOSEError) {
+    return new ForgeAuthError(
+      FORGE_AUTH_INVALID_TOKEN,
+      "JWT token could not be verified",
+      { cause: error },
+    );
+  }
+  return new ForgeAuthError(FORGE_AUTH_INVALID_TOKEN, "JWT token is invalid", {
+    cause: error,
+  });
+}
+
+function jwtPayloadToRecord(payload: JWTPayload): Record<string, unknown> {
+  return { ...payload };
+}
+
+export async function verifyJwtToken(
+  token: string,
+  config: ForgeAuthConfig,
+): Promise<{ payload: Record<string, unknown>; token: VerifiedTokenMetadata }> {
+  try {
+    const jwksUri =
+      config.mode === "oidc"
+        ? await discoverOidcJwksUri(config.issuer ?? "")
+        : config.jwksUri;
+
+    if (!jwksUri) {
+      throw new ForgeAuthError(
+        FORGE_AUTH_JWKS_FAILED,
+        "FORGE_AUTH_JWKS_URI is required for JWT auth",
+      );
+    }
+
+    const verified = await jwtVerify(token, getRemoteJwks(jwksUri), {
+      issuer: config.issuer,
+      audience: config.audience,
+      algorithms: config.algorithms,
+    });
+    const payload = jwtPayloadToRecord(verified.payload);
+
+    return {
+      payload,
+      token: {
+        issuer: verified.payload.iss,
+        audience: verified.payload.aud,
+        subject: verified.payload.sub,
+        expiresAt: verified.payload.exp,
+        issuedAt: verified.payload.iat,
+        authProvider: config.mode,
+      },
+    };
+  } catch (error) {
+    throw classifyJoseError(error);
+  }
+}

package/src/forge/runtime/context/create-context.ts

@@ -0,0 +1,204 @@
+import type { DbClient } from "../db/generated-client.ts";
+import type { DbTransaction } from "../db/adapter.ts";
+import type { ActionSubscription } from "../../compiler/types/action-subscriptions.ts";
+import type { TelemetryContext } from "../telemetry/types.ts";
+import type { AuthContext } from "../auth/types.ts";
+import type { RuntimeContext } from "../../compiler/types/runtime.ts";
+import { snapshotAuth } from "../auth/types.ts";
+import { createNoopTelemetryContext } from "../telemetry/context.ts";
+import { insertOutbox } from "../db/outbox.ts";
+import type { ConfigContext, SecretsContext } from "../secrets/types.ts";
+import type { RuntimeEnvStore } from "../secrets/types.ts";
+import { loadEnvFiles } from "../secrets/env-loader.ts";
+import { loadEnvSchema, loadSecretRegistry } from "../secrets/check.ts";
+import { createRuntimeSecretsBundle } from "../secrets/runtime-bundle.ts";
+import { createAiContext } from "../ai/context.ts";
+import type { AiContext } from "../ai/types.ts";
+import { isMockAiEnabled } from "../ai/state.ts";
+import { currentReleaseInfo, type RuntimeReleaseInfo } from "../release/runtime.ts";
+
+export interface ForgeContext {
+  db: DbClient;
+  emit: (eventType: string, payload: unknown) => Promise<void>;
+  env: Record<string, string | undefined>;
+  telemetry: TelemetryContext;
+  auth: AuthContext;
+  secrets: SecretsContext;
+  config: ConfigContext;
+  ai: AiContext;
+  release: RuntimeReleaseInfo;
+}
+
+let sharedEnvStore: RuntimeEnvStore | null = null;
+let sharedEnvWorkspaceRoot: string | null = null;
+
+export function initializeRuntimeEnv(
+  workspaceRoot: string,
+  envFiles?: string[],
+): RuntimeEnvStore {
+  const { store } = loadEnvFiles({ workspaceRoot, envFiles });
+  sharedEnvStore = store;
+  sharedEnvWorkspaceRoot = workspaceRoot;
+  return store;
+}
+
+export function getRuntimeEnvStore(workspaceRoot?: string): RuntimeEnvStore {
+  if (sharedEnvStore && (!workspaceRoot || workspaceRoot === sharedEnvWorkspaceRoot)) {
+    return sharedEnvStore;
+  }
+
+  if (workspaceRoot) {
+    return initializeRuntimeEnv(workspaceRoot);
+  }
+
+  return {
+    loadedFiles: [],
+    resolve(name: string): string | undefined {
+      return process.env[name];
+    },
+    snapshot(): Record<string, string | undefined> {
+      return { ...process.env };
+    },
+  };
+}
+
+function buildSecretsConfigAndAi(
+  workspaceRoot: string | undefined,
+  runtimeKind: RuntimeContext,
+  store: RuntimeEnvStore,
+  telemetry: TelemetryContext,
+  options?: { mockAi?: boolean },
+): {
+  secrets: SecretsContext;
+  config: ConfigContext;
+  ai: AiContext;
+  env: Record<string, string | undefined>;
+} {
+  const registry = workspaceRoot ? loadSecretRegistry(workspaceRoot) : null;
+  const envSchema = workspaceRoot ? loadEnvSchema(workspaceRoot) : null;
+  const bundle = createRuntimeSecretsBundle({
+    store,
+    registry,
+    envSchema,
+    runtimeKind,
+  });
+
+  const ai = createAiContext({
+    secrets: bundle.secrets,
+    telemetry,
+    runtimeKind,
+    mockAi: options?.mockAi ?? isMockAiEnabled(),
+    envelope: {
+      traceId: telemetry.traceId,
+      tenantId:
+        undefined,
+    },
+  });
+
+  return {
+    secrets: bundle.secrets,
+    config: bundle.config,
+    ai,
+    env: store.snapshot(),
+  };
+}
+
+export function createForgeContext(
+  tx: DbTransaction,
+  db: DbClient,
+  subscriptions: ActionSubscription[],
+  telemetry: TelemetryContext,
+  auth: AuthContext,
+  options?: {
+    env?: Record<string, string | undefined>;
+    runtimeKind?: RuntimeContext;
+    workspaceRoot?: string;
+    store?: RuntimeEnvStore;
+    mockAi?: boolean;
+  },
+): ForgeContext {
+  const runtimeKind = options?.runtimeKind ?? "command";
+  const store =
+    options?.store ??
+    (options?.workspaceRoot
+      ? getRuntimeEnvStore(options.workspaceRoot)
+      : getRuntimeEnvStore());
+  const { secrets, config, ai, env } = buildSecretsConfigAndAi(
+    options?.workspaceRoot,
+    runtimeKind,
+    store,
+    telemetry,
+    { mockAi: options?.mockAi },
+  );
+
+  return {
+    db,
+    env: options?.env ?? env,
+    telemetry,
+    auth,
+    secrets,
+    config,
+    ai,
+    release: currentReleaseInfo(),
+    emit: async (eventType, payload) => {
+      const enriched =
+        payload && typeof payload === "object" && !Array.isArray(payload)
+          ? { ...(payload as Record<string, unknown>), traceId: telemetry.traceId }
+          : { value: payload, traceId: telemetry.traceId };
+
+      const result = await insertOutbox(
+        tx,
+        eventType,
+        enriched,
+        subscriptions,
+        snapshotAuth(auth),
+      );
+      if (!result.ok) {
+        throw new Error(result.diagnostic.message);
+      }
+    },
+  };
+}
+
+export function createActionContext(
+  db: DbClient,
+  telemetry: TelemetryContext,
+  auth: AuthContext,
+  options?: {
+    env?: Record<string, string | undefined>;
+    workspaceRoot?: string;
+    store?: RuntimeEnvStore;
+    runtimeKind?: RuntimeContext;
+    mockAi?: boolean;
+  },
+): ForgeContext {
+  const runtimeKind = options?.runtimeKind ?? "action";
+  const store =
+    options?.store ??
+    (options?.workspaceRoot
+      ? getRuntimeEnvStore(options.workspaceRoot)
+      : getRuntimeEnvStore());
+  const { secrets, config, ai, env } = buildSecretsConfigAndAi(
+    options?.workspaceRoot,
+    runtimeKind,
+    store,
+    telemetry,
+    { mockAi: options?.mockAi },
+  );
+
+  return {
+    db,
+    env: options?.env ?? env,
+    telemetry,
+    auth,
+    secrets,
+    config,
+    ai,
+    release: currentReleaseInfo(),
+    emit: async () => {
+      /* actions invoked by outbox worker do not emit */
+    },
+  };
+}
+
+export { createNoopTelemetryContext };

package/src/forge/runtime/context/create-query-context.ts

@@ -0,0 +1,34 @@
+import type { TelemetryContext } from "../telemetry/types.ts";
+import type { AuthContext } from "../auth/types.ts";
+import type { ReadOnlyDbClient } from "../db/read-only-client.ts";
+import { assertQueryContextForbidden } from "../db/read-only-client.ts";
+
+export interface QueryContext {
+  db: ReadOnlyDbClient;
+  telemetry: TelemetryContext;
+  auth: AuthContext;
+  emit: never;
+  secrets: never;
+  ai: never;
+}
+
+export function createQueryContext(
+  db: ReadOnlyDbClient,
+  telemetry: TelemetryContext,
+  auth: AuthContext,
+): QueryContext {
+  return {
+    db,
+    telemetry,
+    auth,
+    get emit(): never {
+      return assertQueryContextForbidden("emit");
+    },
+    get secrets(): never {
+      return assertQueryContextForbidden("secrets");
+    },
+    get ai(): never {
+      return assertQueryContextForbidden("ai");
+    },
+  };
+}

package/src/forge/runtime/db/adapter.ts

@@ -0,0 +1,31 @@
+export interface DbQueryResult {
+  rows: Record<string, unknown>[];
+  rowCount: number;
+}
+
+export interface DbTransaction {
+  query(sql: string, params?: unknown[]): Promise<DbQueryResult>;
+  commit(): Promise<void>;
+  rollback(): Promise<void>;
+}
+
+export type DbAdapterKind = "pglite" | "postgres" | "memory";
+
+export interface DbAdapter {
+  kind: DbAdapterKind;
+  query(sql: string, params?: unknown[]): Promise<DbQueryResult>;
+  begin(): Promise<DbTransaction>;
+  close(): Promise<void>;
+}
+
+export function adapterAsTransaction(adapter: DbAdapter): DbTransaction {
+  return {
+    query: (sql, params) => adapter.query(sql, params),
+    commit: async () => {
+      /* non-transactional */
+    },
+    rollback: async () => {
+      /* non-transactional */
+    },
+  };
+}

package/src/forge/runtime/db/factory.ts

@@ -0,0 +1,83 @@
+import { join } from "node:path";
+import { createDiagnostic } from "../../compiler/diagnostics/create.ts";
+import { FORGE_DB_CONNECT_FAILED } from "../../compiler/diagnostics/codes.ts";
+import type { Diagnostic } from "../../compiler/types/diagnostic.ts";
+import type { DbAdapter, DbAdapterKind } from "./adapter.ts";
+import { createMemoryAdapter } from "./memory-adapter.ts";
+import { createPgliteAdapter } from "./pglite-adapter.ts";
+import { createPostgresAdapter } from "./postgres-adapter.ts";
+
+export interface CreateDbAdapterOptions {
+  kind: DbAdapterKind;
+  workspaceRoot?: string;
+  databaseUrl?: string;
+  dataDir?: string;
+}
+
+export interface CreateDbAdapterResult {
+  adapter: DbAdapter | null;
+  diagnostics: Diagnostic[];
+}
+
+const DEFAULT_PGLITE_DIR = ".forge/pglite";
+
+export async function createDbAdapter(
+  options: CreateDbAdapterOptions,
+): Promise<CreateDbAdapterResult> {
+  const diagnostics: Diagnostic[] = [];
+
+  try {
+    if (options.kind === "memory") {
+      return { adapter: createMemoryAdapter(), diagnostics };
+    }
+
+    if (options.kind === "pglite") {
+      const workspaceRoot = options.workspaceRoot ?? process.cwd();
+      const dataDir = options.dataDir ?? join(workspaceRoot, DEFAULT_PGLITE_DIR);
+      const adapter = await createPgliteAdapter(dataDir);
+      return { adapter, diagnostics };
+    }
+
+    if (options.kind === "postgres") {
+      const databaseUrl = options.databaseUrl ?? process.env.DATABASE_URL;
+      if (!databaseUrl) {
+        diagnostics.push(
+          createDiagnostic({
+            severity: "error",
+            code: FORGE_DB_CONNECT_FAILED,
+            message: "postgres adapter requires --database-url or DATABASE_URL",
+          }),
+        );
+        return { adapter: null, diagnostics };
+      }
+
+      const result = await createPostgresAdapter(databaseUrl);
+      if (!result.adapter) {
+        diagnostics.push(result.diagnostic);
+        return { adapter: null, diagnostics };
+      }
+
+      await result.adapter.query("SELECT 1");
+      return { adapter: result.adapter, diagnostics };
+    }
+
+    diagnostics.push(
+      createDiagnostic({
+        severity: "error",
+        code: FORGE_DB_CONNECT_FAILED,
+        message: `unsupported db adapter kind '${options.kind as string}'`,
+      }),
+    );
+    return { adapter: null, diagnostics };
+  } catch (error) {
+    const message = error instanceof Error ? error.message : "database connection failed";
+    diagnostics.push(
+      createDiagnostic({
+        severity: "error",
+        code: FORGE_DB_CONNECT_FAILED,
+        message,
+      }),
+    );
+    return { adapter: null, diagnostics };
+  }
+}