forgeos 0.1.0-alpha.0

package/src/forge/runtime/db/migrate.ts

@@ -0,0 +1,132 @@
+import type { SqlPlan } from "../../compiler/data-graph/sql/types.ts";
+import { createDiagnostic } from "../../compiler/diagnostics/create.ts";
+import { FORGE_DB_MIGRATION_FAILED } from "../../compiler/diagnostics/codes.ts";
+import type { Diagnostic } from "../../compiler/types/diagnostic.ts";
+import type { DbAdapter } from "./adapter.ts";
+
+export interface MigrationRecord {
+  id: string;
+  checksum: string;
+  applied_at: string;
+}
+
+export interface MigrationStatus {
+  applied: MigrationRecord[];
+  pending: string[];
+}
+
+export interface SqlPlanDiff {
+  addedTables: string[];
+  removedTables: string[];
+  checksumChanged: boolean;
+  currentChecksum: string;
+  appliedChecksum: string | null;
+}
+
+function allChanges(plan: SqlPlan): string[] {
+  return [
+    ...plan.systemTables.map((change) => change.sql),
+    ...plan.tables.map((change) => change.sql),
+    ...plan.indexes.map((change) => change.sql),
+  ];
+}
+
+export async function applyMigrations(
+  adapter: DbAdapter,
+  sqlPlan: SqlPlan,
+): Promise<Diagnostic[]> {
+  const diagnostics: Diagnostic[] = [];
+
+  try {
+    for (const sql of allChanges(sqlPlan)) {
+      await adapter.query(sql);
+    }
+
+    await adapter.query(
+      `INSERT INTO _forge_migrations (id, checksum) VALUES ($1, $2)
+       ON CONFLICT (id) DO UPDATE SET checksum = EXCLUDED.checksum, applied_at = now()`,
+      [sqlPlan.migrationId, sqlPlan.checksum],
+    );
+  } catch (error) {
+    const message = error instanceof Error ? error.message : "migration failed";
+    diagnostics.push(
+      createDiagnostic({
+        severity: "error",
+        code: FORGE_DB_MIGRATION_FAILED,
+        message,
+      }),
+    );
+  }
+
+  return diagnostics;
+}
+
+export async function resetDatabase(
+  adapter: DbAdapter,
+  sqlPlan: SqlPlan,
+): Promise<Diagnostic[]> {
+  const diagnostics: Diagnostic[] = [];
+
+  try {
+    for (const change of [...sqlPlan.tables].reverse()) {
+      if (change.table) {
+        await adapter.query(`DROP TABLE IF EXISTS "${change.table}" CASCADE`);
+      }
+    }
+
+    await adapter.query(`TRUNCATE TABLE _forge_migrations`);
+    await adapter.query(`TRUNCATE TABLE _forge_trace_spans RESTART IDENTITY CASCADE`);
+    await adapter.query(`TRUNCATE TABLE _forge_telemetry_events RESTART IDENTITY CASCADE`);
+    await adapter.query(`TRUNCATE TABLE _forge_live_subscription_debug RESTART IDENTITY CASCADE`);
+    await adapter.query(`TRUNCATE TABLE _forge_live_invalidations RESTART IDENTITY CASCADE`);
+    await adapter.query(`TRUNCATE TABLE _forge_workflow_steps RESTART IDENTITY CASCADE`);
+    await adapter.query(`TRUNCATE TABLE _forge_workflow_runs RESTART IDENTITY CASCADE`);
+    await adapter.query(`TRUNCATE TABLE _forge_outbox_deliveries RESTART IDENTITY CASCADE`);
+    await adapter.query(`TRUNCATE TABLE _forge_outbox RESTART IDENTITY CASCADE`);
+
+    diagnostics.push(...(await applyMigrations(adapter, sqlPlan)));
+  } catch (error) {
+    const message = error instanceof Error ? error.message : "database reset failed";
+    diagnostics.push(
+      createDiagnostic({
+        severity: "error",
+        code: FORGE_DB_MIGRATION_FAILED,
+        message,
+      }),
+    );
+  }
+
+  return diagnostics;
+}
+
+export async function getMigrationStatus(adapter: DbAdapter): Promise<MigrationStatus> {
+  const result = await adapter.query(
+    `SELECT id, checksum, applied_at::text AS applied_at FROM _forge_migrations ORDER BY applied_at ASC`,
+  );
+
+  const applied = result.rows.map((row) => ({
+    id: String(row.id),
+    checksum: String(row.checksum),
+    applied_at: String(row.applied_at),
+  }));
+
+  return {
+    applied,
+    pending: [],
+  };
+}
+
+export function diffSqlPlan(current: SqlPlan, appliedChecksum: string | null): SqlPlanDiff {
+  const currentTables = current.tables
+    .map((change) => change.table)
+    .filter((table): table is string => table !== undefined)
+    .sort();
+
+  return {
+    addedTables: currentTables,
+    removedTables: [],
+    checksumChanged: appliedChecksum !== null && appliedChecksum !== current.checksum,
+    currentChecksum: current.checksum,
+    appliedChecksum: appliedChecksum,
+  };
+}

package/src/forge/runtime/db/outbox.ts

@@ -0,0 +1,54 @@
+import { createDiagnostic } from "../../compiler/diagnostics/create.ts";
+import { FORGE_DB_OUTBOX_WRITE_FAILED } from "../../compiler/diagnostics/codes.ts";
+import type { ActionSubscription } from "../../compiler/types/action-subscriptions.ts";
+import type { Diagnostic } from "../../compiler/types/diagnostic.ts";
+import type { DbTransaction } from "../db/adapter.ts";
+
+export interface OutboxInsertResult {
+  outboxId: number;
+}
+
+export async function insertOutbox(
+  tx: DbTransaction,
+  eventType: string,
+  payload: unknown,
+  subscriptions: ActionSubscription[],
+  authContext?: unknown,
+): Promise<
+  { ok: true; outboxId: number } | { ok: false; diagnostic: Diagnostic }
+> {
+  try {
+    const outboxResult = await tx.query(
+      `INSERT INTO _forge_outbox (event_type, payload, auth_context) VALUES ($1, $2::jsonb, $3::jsonb) RETURNING id`,
+      [eventType, JSON.stringify(payload), JSON.stringify(authContext ?? null)],
+    );
+
+    const outboxId = Number(outboxResult.rows[0]?.id);
+    if (!Number.isFinite(outboxId)) {
+      throw new Error("outbox insert did not return id");
+    }
+
+    const matching = subscriptions.filter(
+      (subscription) => subscription.eventType === eventType,
+    );
+
+    for (const subscription of matching) {
+      await tx.query(
+        `INSERT INTO _forge_outbox_deliveries (outbox_id, action_name, status) VALUES ($1, $2, 'pending')`,
+        [outboxId, subscription.actionName],
+      );
+    }
+
+    return { ok: true, outboxId };
+  } catch (error) {
+    const message = error instanceof Error ? error.message : "outbox write failed";
+    return {
+      ok: false,
+      diagnostic: createDiagnostic({
+        severity: "error",
+        code: FORGE_DB_OUTBOX_WRITE_FAILED,
+        message,
+      }),
+    };
+  }
+}

package/src/forge/runtime/db/pglite-adapter.ts

@@ -0,0 +1,51 @@
+import { PGlite } from "@electric-sql/pglite";
+import type { DbAdapter, DbQueryResult, DbTransaction } from "./adapter.ts";
+
+function toQueryResult(result: {
+  rows: Record<string, unknown>[];
+  affectedRows?: number;
+}): DbQueryResult {
+  return {
+    rows: result.rows,
+    rowCount: result.affectedRows ?? result.rows.length,
+  };
+}
+
+export class PgliteAdapter implements DbAdapter {
+  readonly kind = "pglite" as const;
+  private db: PGlite;
+
+  constructor(dataDir: string) {
+    this.db = new PGlite(dataDir);
+  }
+
+  async query(sql: string, params: unknown[] = []): Promise<DbQueryResult> {
+    const result = await this.db.query(sql, params);
+    return toQueryResult(result as { rows: Record<string, unknown>[]; affectedRows?: number });
+  }
+
+  async begin(): Promise<DbTransaction> {
+    await this.db.query("BEGIN");
+    const adapter = this;
+
+    return {
+      query: (sql, params = []) => adapter.query(sql, params),
+      commit: async () => {
+        await adapter.query("COMMIT");
+      },
+      rollback: async () => {
+        await adapter.query("ROLLBACK");
+      },
+    };
+  }
+
+  async close(): Promise<void> {
+    await this.db.close();
+  }
+}
+
+export async function createPgliteAdapter(dataDir: string): Promise<DbAdapter> {
+  const adapter = new PgliteAdapter(dataDir);
+  await adapter.query("SELECT 1");
+  return adapter;
+}

package/src/forge/runtime/db/postgres-adapter.ts

@@ -0,0 +1,112 @@
+import { createDiagnostic } from "../../compiler/diagnostics/create.ts";
+import { FORGE_DB_ADAPTER_UNAVAILABLE } from "../../compiler/diagnostics/codes.ts";
+import type { Diagnostic } from "../../compiler/types/diagnostic.ts";
+import type { DbAdapter, DbQueryResult, DbTransaction } from "./adapter.ts";
+
+interface PostgresClient {
+  query(sql: string, params?: unknown[]): Promise<{ rows: Record<string, unknown>[] }>;
+  close(): Promise<void>;
+}
+
+function loadBunSql(databaseUrl: string): PostgresClient | null {
+  try {
+    const bunGlobal = globalThis as {
+      Bun?: {
+        SQL?: new (url: string) => {
+          unsafe: (sql: string, params?: unknown[]) => Promise<Record<string, unknown>[]>;
+          close: () => Promise<void>;
+        };
+      };
+    };
+
+    if (!bunGlobal.Bun?.SQL) {
+      return null;
+    }
+
+    const client = new bunGlobal.Bun.SQL(databaseUrl);
+    return {
+      query: async (sql, params = []) => {
+        const rows = await client.unsafe(sql, params);
+        return { rows: rows as Record<string, unknown>[] };
+      },
+      close: async () => {
+        await client.close();
+      },
+    };
+  } catch {
+    return null;
+  }
+}
+
+async function loadPostgresJs(databaseUrl: string): Promise<PostgresClient | null> {
+  try {
+    const module = await import("postgres");
+    const createSql = module.default;
+    const sql = createSql(databaseUrl);
+    return {
+      query: async (statement, params = []) => {
+        const rows = await sql.unsafe(statement, params as never[]);
+        return { rows: rows as Record<string, unknown>[] };
+      },
+      close: async () => {
+        await sql.end({ timeout: 5 });
+      },
+    };
+  } catch {
+    return null;
+  }
+}
+
+export class PostgresAdapter implements DbAdapter {
+  readonly kind = "postgres" as const;
+  private client: PostgresClient;
+
+  constructor(client: PostgresClient) {
+    this.client = client;
+  }
+
+  async query(sql: string, params: unknown[] = []): Promise<DbQueryResult> {
+    const result = await this.client.query(sql, params);
+    return {
+      rows: result.rows,
+      rowCount: result.rows.length,
+    };
+  }
+
+  async begin(): Promise<DbTransaction> {
+    await this.query("BEGIN");
+    const adapter = this;
+
+    return {
+      query: (sql, params = []) => adapter.query(sql, params),
+      commit: async () => {
+        await adapter.query("COMMIT");
+      },
+      rollback: async () => {
+        await adapter.query("ROLLBACK");
+      },
+    };
+  }
+
+  async close(): Promise<void> {
+    await this.client.close();
+  }
+}
+
+export async function createPostgresAdapter(
+  databaseUrl: string,
+): Promise<{ adapter: DbAdapter } | { adapter: null; diagnostic: Diagnostic }> {
+  const client = loadBunSql(databaseUrl) ?? await loadPostgresJs(databaseUrl);
+  if (!client) {
+    return {
+      adapter: null,
+      diagnostic: createDiagnostic({
+        severity: "error",
+        code: FORGE_DB_ADAPTER_UNAVAILABLE,
+        message: "postgres adapter requires Bun.SQL or the postgres npm package",
+      }),
+    };
+  }
+
+  return { adapter: new PostgresAdapter(client) };
+}

package/src/forge/runtime/db/read-only-client.ts

@@ -0,0 +1,97 @@
+import {
+  FORGE_QUERY_AI_FORBIDDEN,
+  FORGE_QUERY_EMIT_FORBIDDEN,
+  FORGE_QUERY_SECRET_FORBIDDEN,
+  FORGE_QUERY_WRITE_FORBIDDEN,
+  FORGE_LIVEQUERY_WRITE_FORBIDDEN,
+} from "../../compiler/diagnostics/codes.ts";
+import type { TableMapEntry } from "../../compiler/data-graph/sql/serialize.ts";
+import type { DbTransaction } from "./adapter.ts";
+import {
+  createGeneratedDbClient,
+  type TableClient,
+} from "./generated-client.ts";
+import type { AuthContext } from "../auth/types.ts";
+import { tenantIdFromAuth } from "../live/dependency-tracker.ts";
+
+export interface ReadOnlyTableClient {
+  all(): Promise<Record<string, unknown>[]>;
+  get(id: string): Promise<Record<string, unknown> | null>;
+  where(partial: Partial<Record<string, unknown>>): Promise<Record<string, unknown>[]>;
+  count(): Promise<number>;
+}
+
+export type ReadOnlyDbClient = Record<string, ReadOnlyTableClient>;
+
+function forbidden(operation: string, liveQuery = false): never {
+  const code =
+    operation === "emit"
+      ? FORGE_QUERY_EMIT_FORBIDDEN
+      : operation === "secrets"
+        ? FORGE_QUERY_SECRET_FORBIDDEN
+        : operation === "ai"
+          ? FORGE_QUERY_AI_FORBIDDEN
+          : liveQuery
+            ? FORGE_LIVEQUERY_WRITE_FORBIDDEN
+            : FORGE_QUERY_WRITE_FORBIDDEN;
+  throw new Error(`${code}: ${operation} is forbidden in query context`);
+}
+
+function wrapReadOnlyTable(
+  tableName: string,
+  table: TableClient,
+  options?: {
+    onRead?: (table: string, tenantId: string | null) => void;
+    tenantId?: string | null;
+    liveQuery?: boolean;
+  },
+): ReadOnlyTableClient {
+  const recordRead = () => options?.onRead?.(tableName, options.tenantId ?? null);
+  return {
+    all: () => {
+      recordRead();
+      return table.all();
+    },
+    get: (id) => {
+      recordRead();
+      return table.get(id);
+    },
+    where: (partial) => {
+      recordRead();
+      return table.where(partial);
+    },
+    count: async () => {
+      recordRead();
+      const rows = await table.all();
+      return rows.length;
+    },
+  };
+}
+
+export function createReadOnlyDbClient(
+  tx: DbTransaction,
+  tableMap: Record<string, TableMapEntry>,
+  options?: {
+    auth?: AuthContext;
+    onRead?: (table: string, tenantId: string | null) => void;
+    liveQuery?: boolean;
+  },
+): ReadOnlyDbClient {
+  const writable = createGeneratedDbClient(tx, tableMap, options);
+  const client: ReadOnlyDbClient = {};
+  const tenantId = tenantIdFromAuth(options?.auth);
+
+  for (const [tableName, table] of Object.entries(writable).sort()) {
+    client[tableName] = wrapReadOnlyTable(tableName, table, {
+      onRead: options?.onRead,
+      tenantId,
+      liveQuery: options?.liveQuery,
+    });
+  }
+
+  return client;
+}
+
+export function assertQueryContextForbidden(property: "emit" | "secrets" | "ai"): never {
+  forbidden(property);
+}

package/src/forge/runtime/db/session-context.ts

@@ -0,0 +1,62 @@
+import type { AuthContext } from "../auth/types.ts";
+import type { DbTransaction } from "./adapter.ts";
+
+export interface DbSessionContextSetting {
+  name: string;
+  value: string;
+}
+
+function jsonArray(values: string[] | undefined): string {
+  return JSON.stringify(values ?? []);
+}
+
+export function dbSessionContextFromAuth(auth: AuthContext): DbSessionContextSetting[] {
+  if (auth.kind === "user") {
+    return [
+      { name: "forge.tenant_id", value: auth.tenantId ?? "" },
+      { name: "forge.user_id", value: auth.userId },
+      { name: "forge.role", value: auth.role ?? auth.roles?.[0] ?? "" },
+      { name: "forge.roles", value: jsonArray(auth.roles) },
+      { name: "forge.permissions", value: jsonArray(auth.permissions) },
+    ];
+  }
+
+  if (auth.kind === "system") {
+    return [
+      { name: "forge.tenant_id", value: auth.tenantId ?? "" },
+      { name: "forge.user_id", value: "system" },
+      { name: "forge.role", value: "system" },
+      { name: "forge.roles", value: JSON.stringify(["system"]) },
+      { name: "forge.permissions", value: JSON.stringify([]) },
+    ];
+  }
+
+  return [
+    { name: "forge.tenant_id", value: "" },
+    { name: "forge.user_id", value: "" },
+    { name: "forge.role", value: "" },
+    { name: "forge.roles", value: JSON.stringify([]) },
+    { name: "forge.permissions", value: JSON.stringify([]) },
+  ];
+}
+
+export async function setDbSessionContext(
+  tx: DbTransaction,
+  auth: AuthContext,
+): Promise<void> {
+  for (const setting of dbSessionContextFromAuth(auth)) {
+    await tx.query("SELECT set_config($1, $2, true)", [setting.name, setting.value]);
+  }
+}
+
+export function databaseUrlUsesPostgresSuperuser(databaseUrl: string | undefined): boolean {
+  if (!databaseUrl) {
+    return false;
+  }
+  try {
+    const parsed = new URL(databaseUrl);
+    return parsed.username === "postgres";
+  } catch {
+    return false;
+  }
+}