forgeos 0.1.0-alpha.3 → 0.1.0-alpha.30

package/src/forge/compiler/client-sdk/build-manifest.ts

@@ -16,11 +16,17 @@ export interface ClientManifest {
     queries: string;
     commands: string;
     liveQueries: string;
+    externalQueries: string;
+    externalCommands: string;
   };
   react: {
     entrypoint: string;
     hooks: string[];
   };
+  vue: {
+    entrypoint: string;
+    composables: string[];
+  };
   excluded: {
     actions: string[];
     workflows: string[];
@@ -41,6 +47,18 @@ export interface ReactManifest {
   clientSafe: true;
 }
 
+export interface VueManifest {
+  schemaVersion: string;
+  generatorVersion: string;
+  inputHash: string;
+  entrypoint: string;
+  composables: string[];
+  queries: string[];
+  commands: string[];
+  liveQueries: string[];
+  clientSafe: true;
+}
+
 const SERVER_ADAPTER_SUFFIX = ".server.ts";
 
 function collectServerAdapters(classified: ClassifiedPackage[]): string[] {
@@ -101,6 +119,8 @@ export function buildClientManifest(
       queries: "POST /queries/:name",
       commands: "POST /commands/:name",
       liveQueries: "GET /live/:name",
+      externalQueries: "POST /external/:service/queries/:name",
+      externalCommands: "POST /external/:service/commands/:name",
     },
     react: {
       entrypoint: "src/forge/_generated/react.ts",
@@ -113,6 +133,17 @@ export function buildClientManifest(
         "useLiveQuery",
       ],
     },
+    vue: {
+      entrypoint: "src/forge/_generated/vue.ts",
+      composables: [
+        "provideForge",
+        "useForgeClient",
+        "useForgeAuth",
+        "useForgeQuery",
+        "useForgeCommand",
+        "useForgeLiveQuery",
+      ],
+    },
     excluded: {
       actions,
       workflows,
@@ -149,3 +180,31 @@ export function buildReactManifest(clientManifest: ClientManifest): ReactManifes
     clientSafe: true,
   };
 }
+
+export function buildVueManifest(clientManifest: ClientManifest): VueManifest {
+  const composables = [
+    "provideForge",
+    "useForgeClient",
+    "useForgeAuth",
+    "useForgeQuery",
+    "useForgeCommand",
+    "useForgeLiveQuery",
+  ];
+
+  return {
+    schemaVersion: "1.0.0",
+    generatorVersion: GENERATOR_VERSION,
+    inputHash: hashStable(
+      canonicalJson({
+        clientInputHash: clientManifest.inputHash,
+        composables,
+      }),
+    ),
+    entrypoint: "src/forge/_generated/vue.ts",
+    composables,
+    queries: clientManifest.queries,
+    commands: clientManifest.commands,
+    liveQueries: clientManifest.liveQueries,
+    clientSafe: true,
+  };
+}

package/src/forge/compiler/client-sdk/render-client.ts

@@ -1,4 +1,4 @@
-import type { ClientManifest, ReactManifest } from "./build-manifest.ts";
+import type { ClientManifest, ReactManifest, VueManifest } from "./build-manifest.ts";
 
 export function renderClientTypesTs(): string {
   return `export type ForgeStaticAuth = {
@@ -52,6 +52,22 @@ export class ForgeError extends Error {
 export type QueryName = keyof typeof import("./api.ts").api.queries;
 export type CommandName = keyof typeof import("./api.ts").api.commands;
 export type LiveQueryName = keyof typeof import("./api.ts").api.liveQueries;
+export type ExternalCommandName = string;
+export type ExternalQueryName = string;
+export type ExternalRuntimeRefObject = {
+  service: string;
+  name: string;
+  kind?: "command" | "query";
+  language?: string;
+  framework?: string;
+  transport?: string;
+};
+export type ExternalCommandRef =
+  | ExternalCommandName
+  | ExternalRuntimeRefObject;
+export type ExternalQueryRef =
+  | ExternalQueryName
+  | ExternalRuntimeRefObject;
 
 export type LiveSnapshot<T> = {
   subscriptionId: string;
@@ -70,6 +86,8 @@ export type ForgeClient = {
   readonly lastTraceId?: string;
   query<Name extends QueryName>(name: Name, args: unknown): Promise<unknown>;
   command<Name extends CommandName>(name: Name, args: unknown): Promise<unknown>;
+  externalQuery<Name extends ExternalQueryRef>(name: Name, args: unknown): Promise<unknown>;
+  externalCommand<Name extends ExternalCommandRef>(name: Name, args: unknown): Promise<unknown>;
   liveQuery<Name extends LiveQueryName>(
     name: Name,
     args: unknown,
@@ -87,6 +105,8 @@ import type {
   ForgeAuthProvider,
   ForgeClient,
   ForgeClientConfig,
+  ExternalCommandRef,
+  ExternalQueryRef,
   LiveQueryOptions,
   LiveSnapshot,
 } from "./clientTypes.ts";
@@ -102,6 +122,11 @@ export type {
   QueryName,
   CommandName,
   LiveQueryName,
+  ExternalCommandName,
+  ExternalQueryName,
+  ExternalRuntimeRefObject,
+  ExternalCommandRef,
+  ExternalQueryRef,
   ForgeResolvedAuth,
   LiveQueryOptions,
   LiveSnapshot,
@@ -179,6 +204,16 @@ function parseJsonPayload(body: unknown): {
   };
 }
 
+function normalizeExternalRef(
+  ref: ExternalCommandRef | ExternalQueryRef,
+): { service: string; name: string } {
+  if (typeof ref === "string") {
+    const [service, ...entryParts] = ref.split(".");
+    return { service: service ?? "", name: entryParts.join(".") };
+  }
+  return { service: ref.service, name: ref.name };
+}
+
 class ForgeHttpClient implements ForgeClient {
   lastTraceId?: string;
 
@@ -192,6 +227,14 @@ class ForgeHttpClient implements ForgeClient {
     return this.invoke("commands", name, args);
   }
 
+  externalQuery(name: ExternalQueryRef, args: unknown): Promise<unknown> {
+    return this.invokeExternal("queries", name, args);
+  }
+
+  externalCommand(name: ExternalCommandRef, args: unknown): Promise<unknown> {
+    return this.invokeExternal("commands", name, args);
+  }
+
   liveQuery(
     name: string,
     args: unknown,
@@ -268,6 +311,68 @@ class ForgeHttpClient implements ForgeClient {
     return payload.result;
   }
 
+  private async invokeExternal(
+    kind: "queries" | "commands",
+    name: ExternalCommandRef | ExternalQueryRef,
+    args: unknown,
+  ): Promise<unknown> {
+    const normalized = normalizeExternalRef(name);
+    const serviceName = normalized.service;
+    const entryName = normalized.name;
+    if (!serviceName || !entryName) {
+      throw new ForgeError(\`External runtime name must be service.entry\`, {
+        code: "FORGE_EXTERNAL_RUNTIME_NOT_FOUND",
+      });
+    }
+    const baseUrl = this.config.url.replace(/\\/$/, "");
+    const url = \`\${baseUrl}/external/\${encodeURIComponent(serviceName)}/\${kind}/\${encodeURIComponent(entryName)}\`;
+    return this.invokeUrl(url, args);
+  }
+
+  private async invokeUrl(url: string, args: unknown): Promise<unknown> {
+    const authHeaders = await resolveAuthHeaders(this.config.auth);
+
+    const response = await fetch(url, {
+      method: "POST",
+      headers: {
+        "Content-Type": "application/json",
+        ...authHeaders,
+      },
+      body: JSON.stringify({ args }),
+    });
+
+    let body: unknown;
+    try {
+      body = await response.json();
+    } catch {
+      throw new ForgeError(\`HTTP \${response.status}\`, {
+        code: "FORGE_HTTP_ERROR",
+        status: response.status,
+      });
+    }
+
+    const payload = parseJsonPayload(body);
+    this.lastTraceId = payload.traceId;
+
+    if (!response.ok || payload.ok === false) {
+      const diagnostic = payload.diagnostics?.find((entry) => entry.code);
+      const code =
+        payload.error?.code ?? diagnostic?.code ?? "FORGE_REQUEST_FAILED";
+      const message =
+        payload.error?.message ??
+        diagnostic?.message ??
+        \`Request failed with status \${response.status}\`;
+      throw new ForgeError(message, {
+        code,
+        traceId: payload.traceId,
+        status: response.status,
+        details: payload.error?.details ?? payload.diagnostics,
+      });
+    }
+
+    return payload.result;
+  }
+
   private async openLiveQuery(
     name: string,
     args: unknown,
@@ -297,19 +402,24 @@ class ForgeHttpClient implements ForgeClient {
     const reader = response.body.getReader();
     let buffer = "";
 
-    while (!signal.aborted) {
-      const { done, value } = await reader.read();
-      if (done) {
-        break;
-      }
-      buffer += decoder.decode(value, { stream: true });
-      let boundary = buffer.indexOf("\\n\\n");
-      while (boundary !== -1) {
-        const frame = buffer.slice(0, boundary);
-        buffer = buffer.slice(boundary + 2);
-        this.handleSseFrame(frame, onSnapshot, onError);
-        boundary = buffer.indexOf("\\n\\n");
+    try {
+      while (!signal.aborted) {
+        const { done, value } = await reader.read();
+        if (done) {
+          break;
+        }
+        buffer += decoder.decode(value, { stream: true });
+        let boundary = buffer.indexOf("\\n\\n");
+        while (boundary !== -1) {
+          const frame = buffer.slice(0, boundary);
+          buffer = buffer.slice(boundary + 2);
+          this.handleSseFrame(frame, onSnapshot, onError);
+          boundary = buffer.indexOf("\\n\\n");
+        }
       }
+    } finally {
+      await reader.cancel().catch(() => undefined);
+      reader.releaseLock();
     }
   }
 
@@ -430,3 +540,68 @@ export declare const useLiveQuery: import("forge/react").ForgeReactBindings["use
 export function renderReactManifestTs(manifest: ReactManifest): string {
   return `export const reactManifest = ${JSON.stringify(manifest, null, 2)} as const;\n`;
 }
+
+export function renderVueTs(): string {
+  return `import { createForgeVueBindings } from "forge/vue";
+import { createForgeClient } from "./client.ts";
+
+export type {
+  ForgeDevAuthConfig,
+  ForgeVueAuth,
+  ForgeVueAuthProvider,
+  ForgeVueBindings,
+  ForgeVueClient,
+  ForgeVueClientConfig,
+  ForgeVueError,
+  ForgeVuePluginOptions,
+  UseForgeCommandOptions,
+  UseForgeCommandResult,
+  UseForgeLiveQueryOptions,
+  UseForgeLiveQueryResult,
+  UseForgeQueryOptions,
+  UseForgeQueryResult,
+} from "forge/vue";
+
+const forgeVue = createForgeVueBindings(createForgeClient);
+
+export const ForgeVuePlugin = forgeVue.ForgeVuePlugin;
+export const provideForge = forgeVue.provideForge;
+export const useForgeClient = forgeVue.useForgeClient;
+export const useForgeAuth = forgeVue.useForgeAuth;
+export const useForgeQuery = forgeVue.useForgeQuery;
+export const useForgeCommand = forgeVue.useForgeCommand;
+export const useForgeLiveQuery = forgeVue.useForgeLiveQuery;
+`;
+}
+
+export function renderVueDts(): string {
+  return `export type {
+  ForgeDevAuthConfig,
+  ForgeVueAuth,
+  ForgeVueAuthProvider,
+  ForgeVueBindings,
+  ForgeVueClient,
+  ForgeVueClientConfig,
+  ForgeVueError,
+  ForgeVuePluginOptions,
+  UseForgeCommandOptions,
+  UseForgeCommandResult,
+  UseForgeLiveQueryOptions,
+  UseForgeLiveQueryResult,
+  UseForgeQueryOptions,
+  UseForgeQueryResult,
+} from "forge/vue";
+
+export declare const ForgeVuePlugin: import("forge/vue").ForgeVueBindings["ForgeVuePlugin"];
+export declare const provideForge: import("forge/vue").ForgeVueBindings["provideForge"];
+export declare const useForgeClient: import("forge/vue").ForgeVueBindings["useForgeClient"];
+export declare const useForgeAuth: import("forge/vue").ForgeVueBindings["useForgeAuth"];
+export declare const useForgeQuery: import("forge/vue").ForgeVueBindings["useForgeQuery"];
+export declare const useForgeCommand: import("forge/vue").ForgeVueBindings["useForgeCommand"];
+export declare const useForgeLiveQuery: import("forge/vue").ForgeVueBindings["useForgeLiveQuery"];
+`;
+}
+
+export function renderVueManifestTs(manifest: VueManifest): string {
+  return `export const vueManifest = ${JSON.stringify(manifest, null, 2)} as const;\n`;
+}

package/src/forge/compiler/data-graph/parse.ts

@@ -36,7 +36,7 @@ function unwrapStringLiteral(node: SyntaxNode): string | null {
   return null;
 }
 
-function extractFieldsFromObject(objectNode: SyntaxNode): DataField[] {
+function extractFieldsFromObject(objectNode: SyntaxNode, options: { skipConfigName?: boolean } = {}): DataField[] {
   const fields: DataField[] = [];
 
   for (const child of objectNode.namedChildren) {
@@ -55,7 +55,7 @@ function extractFieldsFromObject(objectNode: SyntaxNode): DataField[] {
         ? keyNode.text
         : unwrapStringLiteral(keyNode);
 
-    if (!key || key === "name") {
+    if (!key || (options.skipConfigName && key === "name")) {
       continue;
     }
 
@@ -131,7 +131,7 @@ function parseCallArguments(callNode: SyntaxNode): ParsedDefineTable | null {
 
   if (first.type === "object") {
     const tableName = extractNameFromObject(first);
-    const fields = extractFieldsFromObject(first);
+    const fields = extractFieldsFromObject(first, { skipConfigName: true });
     return { tableName, fields };
   }
 

package/src/forge/compiler/data-graph/sql/ddl.ts

@@ -42,6 +42,61 @@ function stableSortTables(tables: DataTable[]): DataTable[] {
   return [...tables].sort((a, b) => (a.name < b.name ? -1 : a.name > b.name ? 1 : 0));
 }
 
+function stableSortTableChangesByReferences(tables: SqlChange[]): SqlChange[] {
+  const orderedInput = [...tables].sort((a, b) => {
+    const tableA = a.table ?? "";
+    const tableB = b.table ?? "";
+    return tableA < tableB ? -1 : tableA > tableB ? 1 : 0;
+  });
+  const byName = new Map<string, SqlChange>();
+
+  for (const table of orderedInput) {
+    if (table.table) {
+      byName.set(table.table, table);
+    }
+  }
+
+  const pending = new Set(byName.keys());
+  const emitted = new Set<string>();
+  const ordered: SqlChange[] = [];
+
+  while (pending.size > 0) {
+    let progressed = false;
+
+    for (const tableName of pending) {
+      const table = byName.get(tableName);
+      if (!table) {
+        pending.delete(tableName);
+        continue;
+      }
+
+      const dependencies = (table.columns ?? [])
+        .map((column) => column.references?.table)
+        .filter((dependency): dependency is string => Boolean(dependency))
+        .filter((dependency) => dependency !== tableName && byName.has(dependency));
+
+      if (dependencies.every((dependency) => emitted.has(dependency))) {
+        ordered.push(table);
+        emitted.add(tableName);
+        pending.delete(tableName);
+        progressed = true;
+      }
+    }
+
+    if (!progressed) {
+      for (const tableName of pending) {
+        const table = byName.get(tableName);
+        if (table) {
+          ordered.push(table);
+        }
+      }
+      break;
+    }
+  }
+
+  return ordered;
+}
+
 function parseFieldType(
   field: DataField,
   tableName: string,
@@ -254,6 +309,7 @@ function buildTableChange(table: DataTable, diagnostics: Diagnostic[]): SqlChang
   return {
     kind: "create_table",
     table: tableName,
+    accessName: table.name,
     columns,
     sql: buildCreateTableSql(tableName, columns),
   };
@@ -342,6 +398,8 @@ export function buildSqlPlan(dataGraph: DataGraph): SqlPlan {
     }
   }
 
+  const orderedTables = stableSortTableChangesByReferences(tables);
+
   indexes.sort((a, b) => {
     const nameA = a.index?.name ?? "";
     const nameB = b.index?.name ?? "";
@@ -364,7 +422,7 @@ export function buildSqlPlan(dataGraph: DataGraph): SqlPlan {
   const payload = {
     schemaVersion: SQL_PLAN_SCHEMA_VERSION,
     systemTables: systemTables.map((change) => change.sql),
-    tables: tables.map((change) => change.sql),
+    tables: orderedTables.map((change) => change.sql),
     indexes: indexes.map((change) => change.sql),
   };
 
@@ -376,7 +434,7 @@ export function buildSqlPlan(dataGraph: DataGraph): SqlPlan {
     migrationId,
     checksum,
     systemTables,
-    tables,
+    tables: orderedTables,
     indexes,
     diagnostics: diagnostics.sort((a, b) => {
       const fileA = a.file ?? "";

package/src/forge/compiler/data-graph/sql/serialize.ts

@@ -15,6 +15,7 @@ export function serializeSqlPlanJson(plan: SqlPlan): string {
     tables: plan.tables.map((change) => ({
       kind: change.kind,
       table: change.table,
+      accessName: change.accessName,
       columns: change.columns,
       sql: change.sql,
     })),
@@ -69,6 +70,9 @@ export function buildTableMap(
         ? { tenantScoped: true, tenantIdColumn }
         : {}),
     };
+    if (change.accessName && change.accessName !== change.table) {
+      map[change.accessName] = map[change.table]!;
+    }
   }
 
   return map;

package/src/forge/compiler/data-graph/sql/types.ts

@@ -21,6 +21,7 @@ export interface IndexDef {
 export interface SqlChange {
   kind: "create_table" | "create_index" | "create_sequence";
   table?: string;
+  accessName?: string;
   columns?: ColumnDef[];
   index?: IndexDef;
   sql: string;

package/src/forge/compiler/diagnostics/codes.ts

@@ -14,6 +14,7 @@ export const FORGE_AUTH_INVALID_AUDIENCE = "FORGE_AUTH_INVALID_AUDIENCE" as cons
 export const FORGE_AUTH_TOKEN_EXPIRED = "FORGE_AUTH_TOKEN_EXPIRED" as const;
 export const FORGE_AUTH_JWKS_FAILED = "FORGE_AUTH_JWKS_FAILED" as const;
 export const FORGE_AUTH_CLAIM_MISSING = "FORGE_AUTH_CLAIM_MISSING" as const;
+export const FORGE_AUTH_CLAIM_INVALID = "FORGE_AUTH_CLAIM_INVALID" as const;
 export const FORGE_AUTH_TENANT_MISSING = "FORGE_AUTH_TENANT_MISSING" as const;
 export const FORGE_AUTH_DEV_HEADERS_IN_PRODUCTION =
   "FORGE_AUTH_DEV_HEADERS_IN_PRODUCTION" as const;
@@ -26,11 +27,20 @@ export const FORGE_DUP_RUNTIME_ENTRY = "FORGE_DUP_RUNTIME_ENTRY" as const;
 export const FORGE_RUNTIME_UNRESOLVABLE = "FORGE_RUNTIME_UNRESOLVABLE" as const;
 export const FORGE_RUNTIME_NOT_FOUND = "FORGE_RUNTIME_NOT_FOUND" as const;
 export const FORGE_RUNTIME_GUARD_BLOCKED = "FORGE_RUNTIME_GUARD_BLOCKED" as const;
+export const FORGE_EXTERNAL_RUNTIME_NOT_FOUND =
+  "FORGE_EXTERNAL_RUNTIME_NOT_FOUND" as const;
+export const FORGE_EXTERNAL_RUNTIME_UNSUPPORTED =
+  "FORGE_EXTERNAL_RUNTIME_UNSUPPORTED" as const;
+export const FORGE_EXTERNAL_RUNTIME_FAILED =
+  "FORGE_EXTERNAL_RUNTIME_FAILED" as const;
+export const FORGE_EXTERNAL_RUNTIME_BAD_RESPONSE =
+  "FORGE_EXTERNAL_RUNTIME_BAD_RESPONSE" as const;
 export const FORGE_DEV_SERVER_ERROR = "FORGE_DEV_SERVER_ERROR" as const;
 export const FORGE_DEV_WATCH_FAILED = "FORGE_DEV_WATCH_FAILED" as const;
 export const FORGE_DEV_INVOKE_FAILED = "FORGE_DEV_INVOKE_FAILED" as const;
 export const FORGE_DEV_DOCTOR_MISSING_ARTIFACT =
   "FORGE_DEV_DOCTOR_MISSING_ARTIFACT" as const;
+export const FORGE_DEV_DB_RESET = "FORGE_DEV_DB_RESET" as const;
 export const FORGE_DB_CONNECT_FAILED = "FORGE_DB_CONNECT_FAILED" as const;
 export const FORGE_DB_MIGRATION_FAILED = "FORGE_DB_MIGRATION_FAILED" as const;
 export const FORGE_DB_UNSUPPORTED_FIELD_TYPE =
@@ -47,6 +57,7 @@ export const FORGE_RLS_UNSUPPORTED_TENANT_TYPE =
 export const FORGE_RLS_FORCE_DISABLED = "FORGE_RLS_FORCE_DISABLED" as const;
 export const FORGE_RLS_APPLY_FAILED = "FORGE_RLS_APPLY_FAILED" as const;
 export const FORGE_RLS_TEST_FAILED = "FORGE_RLS_TEST_FAILED" as const;
+export const FORGE_RLS_MUTATION_FAILED = "FORGE_RLS_MUTATION_FAILED" as const;
 export const FORGE_RLS_SESSION_CONTEXT_MISSING =
   "FORGE_RLS_SESSION_CONTEXT_MISSING" as const;
 export const FORGE_RLS_SESSION_CONTEXT_UNSAFE =
@@ -90,6 +101,8 @@ export const FORGE_RELEASE_DIRTY_WORKTREE =
 export const FORGE_RELEASE_GENERATED_DRIFT =
   "FORGE_RELEASE_GENERATED_DRIFT" as const;
 export const FORGE_RELEASE_ID_MISSING = "FORGE_RELEASE_ID_MISSING" as const;
+export const FORGE_RELEASE_PACKAGE_PACK_FAILED =
+  "FORGE_RELEASE_PACKAGE_PACK_FAILED" as const;
 export const FORGE_SOURCEMAP_PUBLIC_EXPOSURE =
   "FORGE_SOURCEMAP_PUBLIC_EXPOSURE" as const;
 export const FORGE_SOURCEMAP_UPLOAD_MISSING =
@@ -214,6 +227,8 @@ export const FORGE_TEST_DOCKER_REQUIRED = "FORGE_TEST_DOCKER_REQUIRED" as const;
 export const FORGE_TEST_BROWSER_REQUIRED = "FORGE_TEST_BROWSER_REQUIRED" as const;
 export const FORGE_VERIFY_CHANGED_INCOMPLETE =
   "FORGE_VERIFY_CHANGED_INCOMPLETE" as const;
+export const FORGE_VERIFY_NO_TESTS_SELECTED =
+  "FORGE_VERIFY_NO_TESTS_SELECTED" as const;
 export const FORGE_VERIFY_SCRIPT_TIMEOUT =
   "FORGE_VERIFY_SCRIPT_TIMEOUT" as const;
 export const FORGE_REPAIR_SOURCE_NOT_FOUND =
@@ -315,6 +330,12 @@ export const FORGE_TELEMETRY_PAYLOAD_TRUNCATED =
   "FORGE_TELEMETRY_PAYLOAD_TRUNCATED" as const;
 export const FORGE_TELEMETRY_SINK_FAILED = "FORGE_TELEMETRY_SINK_FAILED" as const;
 export const FORGE_TELEMETRY_UNKNOWN_SINK = "FORGE_TELEMETRY_UNKNOWN_SINK" as const;
+export const FORGE_WEBHOOK_SIGNATURE_INVALID =
+  "FORGE_WEBHOOK_SIGNATURE_INVALID" as const;
+export const FORGE_WEBHOOK_TIMESTAMP_INVALID =
+  "FORGE_WEBHOOK_TIMESTAMP_INVALID" as const;
+export const FORGE_WEBHOOK_REPLAY_DETECTED =
+  "FORGE_WEBHOOK_REPLAY_DETECTED" as const;
 export const FORGE_POLICY_DENIED = "FORGE_POLICY_DENIED" as const;
 export const FORGE_POLICY_MISSING = "FORGE_POLICY_MISSING" as const;
 export const FORGE_POLICY_UNKNOWN = "FORGE_POLICY_UNKNOWN" as const;
@@ -338,6 +359,7 @@ export const FORGE_AI_SECRET_MISSING = "FORGE_AI_SECRET_MISSING" as const;
 export const FORGE_AI_DYNAMIC_PROVIDER = "FORGE_AI_DYNAMIC_PROVIDER" as const;
 export const FORGE_AI_GENERATION_FAILED = "FORGE_AI_GENERATION_FAILED" as const;
 export const FORGE_AI_USAGE_UNAVAILABLE = "FORGE_AI_USAGE_UNAVAILABLE" as const;
+export const FORGE_AI_REDTEAM_FAILED = "FORGE_AI_REDTEAM_FAILED" as const;
 export const FORGE_QUERY_WRITE_FORBIDDEN = "FORGE_QUERY_WRITE_FORBIDDEN" as const;
 export const FORGE_QUERY_EMIT_FORBIDDEN = "FORGE_QUERY_EMIT_FORBIDDEN" as const;
 export const FORGE_QUERY_SECRET_FORBIDDEN = "FORGE_QUERY_SECRET_FORBIDDEN" as const;
@@ -379,6 +401,7 @@ export const DIAGNOSTIC_CODES = [
   FORGE_AUTH_TOKEN_EXPIRED,
   FORGE_AUTH_JWKS_FAILED,
   FORGE_AUTH_CLAIM_MISSING,
+  FORGE_AUTH_CLAIM_INVALID,
   FORGE_AUTH_TENANT_MISSING,
   FORGE_AUTH_DEV_HEADERS_IN_PRODUCTION,
   FORGE_AUTH_MODE_INVALID,
@@ -389,10 +412,15 @@ export const DIAGNOSTIC_CODES = [
   FORGE_RUNTIME_UNRESOLVABLE,
   FORGE_RUNTIME_NOT_FOUND,
   FORGE_RUNTIME_GUARD_BLOCKED,
+  FORGE_EXTERNAL_RUNTIME_NOT_FOUND,
+  FORGE_EXTERNAL_RUNTIME_UNSUPPORTED,
+  FORGE_EXTERNAL_RUNTIME_FAILED,
+  FORGE_EXTERNAL_RUNTIME_BAD_RESPONSE,
   FORGE_DEV_SERVER_ERROR,
   FORGE_DEV_WATCH_FAILED,
   FORGE_DEV_INVOKE_FAILED,
   FORGE_DEV_DOCTOR_MISSING_ARTIFACT,
+  FORGE_DEV_DB_RESET,
   FORGE_DB_CONNECT_FAILED,
   FORGE_DB_MIGRATION_FAILED,
   FORGE_DB_UNSUPPORTED_FIELD_TYPE,
@@ -406,6 +434,7 @@ export const DIAGNOSTIC_CODES = [
   FORGE_RLS_FORCE_DISABLED,
   FORGE_RLS_APPLY_FAILED,
   FORGE_RLS_TEST_FAILED,
+  FORGE_RLS_MUTATION_FAILED,
   FORGE_RLS_SESSION_CONTEXT_MISSING,
   FORGE_RLS_SESSION_CONTEXT_UNSAFE,
   FORGE_DB_SUPERUSER_RUNTIME,
@@ -433,6 +462,7 @@ export const DIAGNOSTIC_CODES = [
   FORGE_RELEASE_DIRTY_WORKTREE,
   FORGE_RELEASE_GENERATED_DRIFT,
   FORGE_RELEASE_ID_MISSING,
+  FORGE_RELEASE_PACKAGE_PACK_FAILED,
   FORGE_SOURCEMAP_PUBLIC_EXPOSURE,
   FORGE_SOURCEMAP_UPLOAD_MISSING,
   FORGE_SOURCEMAP_UPLOAD_FAILED,
@@ -510,6 +540,7 @@ export const DIAGNOSTIC_CODES = [
   FORGE_TEST_DOCKER_REQUIRED,
   FORGE_TEST_BROWSER_REQUIRED,
   FORGE_VERIFY_CHANGED_INCOMPLETE,
+  FORGE_VERIFY_NO_TESTS_SELECTED,
   FORGE_REPAIR_SOURCE_NOT_FOUND,
   FORGE_REPAIR_UNKNOWN_FAILURE,
   FORGE_REPAIR_NO_RULE_MATCHED,
@@ -575,6 +606,9 @@ export const DIAGNOSTIC_CODES = [
   FORGE_TELEMETRY_PAYLOAD_TRUNCATED,
   FORGE_TELEMETRY_SINK_FAILED,
   FORGE_TELEMETRY_UNKNOWN_SINK,
+  FORGE_WEBHOOK_SIGNATURE_INVALID,
+  FORGE_WEBHOOK_TIMESTAMP_INVALID,
+  FORGE_WEBHOOK_REPLAY_DETECTED,
   FORGE_POLICY_DENIED,
   FORGE_POLICY_MISSING,
   FORGE_POLICY_UNKNOWN,
@@ -595,6 +629,7 @@ export const DIAGNOSTIC_CODES = [
   FORGE_AI_DYNAMIC_PROVIDER,
   FORGE_AI_GENERATION_FAILED,
   FORGE_AI_USAGE_UNAVAILABLE,
+  FORGE_AI_REDTEAM_FAILED,
   FORGE_QUERY_WRITE_FORBIDDEN,
   FORGE_QUERY_EMIT_FORBIDDEN,
   FORGE_QUERY_SECRET_FORBIDDEN,

package/src/forge/compiler/diagnostics/create.ts

@@ -49,7 +49,7 @@ function defaultGuidanceForCode(code: string): DiagnosticGuidance | null {
   }
   if (code === "FORGE_SECRET_DIRECT_PROCESS_ENV") {
     return {
-      fixHint: "Use ctx.secrets or ctx.config instead of reading process.env directly from app runtime code.",
+      fixHint: "Use ctx.secrets or ctx.config for Forge runtime secrets/config; public frontend bridge env may use the framework's public env surface.",
       suggestedCommands: ["forge repair diagnose --diagnostic FORGE_SECRET_DIRECT_PROCESS_ENV --json", "forge refactor replace-process-env <ENV_NAME> --dry-run --json"],
       docs: ["src/forge/_generated/runtimeRules.md"],
     };
@@ -71,7 +71,7 @@ function defaultGuidanceForCode(code: string): DiagnosticGuidance | null {
   if (code.startsWith("FORGE_RLS_")) {
     return {
       fixHint: "Inspect generated RLS SQL and validate tenant isolation before applying migrations.",
-      suggestedCommands: ["forge rls check --json", "forge rls print --json"],
+      suggestedCommands: ["forge rls check --json", "forge rls test --db postgres --json"],
       docs: ["src/forge/_generated/agentContract.json"],
     };
   }
@@ -106,7 +106,12 @@ function defaultGuidanceForCode(code: string): DiagnosticGuidance | null {
   if (code.startsWith("FORGE_FRONTEND_")) {
     return {
       fixHint: "Use the generated frontend bridge and inspect src/forge/_generated/frontendGraph.json before editing UI wiring.",
-      suggestedCommands: ["forge inspect frontend --json", "forge make ui --framework vite --dry-run --json", "forge generate"],
+      suggestedCommands: [
+        "forge inspect frontend --json",
+        "forge make ui --framework vite --dry-run --json",
+        "forge make ui --framework nuxt --dry-run --json",
+        "forge generate",
+      ],
       docs: ["src/forge/_generated/frontendGraph.json", "AGENTS.md"],
     };
   }

package/src/forge/compiler/diagnostics/index.ts

@@ -37,6 +37,8 @@ export {
   FORGE_LIVEQUERY_UNKNOWN,
   FORGE_LIVEQUERY_SUBSCRIPTION_FAILED,
   FORGE_LIVEQUERY_RERUN_FAILED,
+  FORGE_RELEASE_PACKAGE_PACK_FAILED,
+  FORGE_VERIFY_NO_TESTS_SELECTED,
   DIAGNOSTIC_CODES,
 } from "./codes.ts";
 export type { DiagnosticCode } from "./codes.ts";