forgeos 0.1.0-alpha.34 → 0.1.0-alpha.35

package/AGENTS.md

@@ -1,4 +1,4 @@
-// @forge-generated generator=0.1.0-alpha.34 input=ce9cf8b6c553d7de8113eb2a388d269cb8c90d4bb15c013a7ab907ef207619b9 content=721818a6f9a664aa898092d4aa5cd68cbbd8ad6e150c7d3ad3ef785a2e3fcf53
+// @forge-generated generator=0.1.0-alpha.35 input=a41a4935f71e0376ad8546906f6e5bd7c01f6e033fc3aba669f636ad528e9881 content=721818a6f9a664aa898092d4aa5cd68cbbd8ad6e150c7d3ad3ef785a2e3fcf53
 # AGENTS.md
 
 <!-- forge-generated:start -->

package/CHANGELOG.md

@@ -1,5 +1,16 @@
 # forgeos
 
+## 0.1.0-alpha.35
+
+### Patch Changes
+
+- Harden field-test regressions found while building WorkOS-style multi-tenant apps.
+
+  - Resolve camelCase `ref:` targets such as `ref:accessRequests` to canonical SQL table names like `access_requests`, and report unknown refs before invalid SQL reaches PGlite.
+  - Allow WorkOS-like local dev auth headers through dev-server CORS, including organization, membership, permissions, roles, and claims headers.
+  - Teach the generated agent contract and capability map to recognize camelCase `ctx.db` aliases for snake_case tables.
+  - Avoid printing fake `http://127.0.0.1:0` API URLs in `forge dev --port 0` startup diagnostics.
+
 ## 0.1.0-alpha.34
 
 ### Patch Changes

package/docs/changelog.md

@@ -6,6 +6,20 @@ The canonical source file in the repository is `CHANGELOG.md`.
 
 ## Unreleased
 
+## 0.1.0-alpha.35
+
+- Hardened field-test regressions found while building WorkOS-style
+  multi-tenant apps.
+- Resolved camelCase `ref:` targets such as `ref:accessRequests` to canonical
+  SQL table names like `access_requests`, and reported unknown refs before
+  invalid SQL reaches PGlite.
+- Allowed WorkOS-like local dev auth headers through dev-server CORS,
+  including organization, membership, permissions, roles, and claims headers.
+- Taught the generated agent contract and capability map to recognize
+  camelCase `ctx.db` aliases for snake_case tables.
+- Avoided printing fake `http://127.0.0.1:0` API URLs in
+  `forge dev --port 0` startup diagnostics.
+
 ## 0.1.0-alpha.34
 
 - Hardened the ForgeOS app-building DX after the Vendor Access field test.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "forgeos",
-  "version": "0.1.0-alpha.34",
+  "version": "0.1.0-alpha.35",
   "description": "Agent-native application framework and compiler for building Forge apps without a mandatory dashboard.",
   "type": "module",
   "license": "MIT",

package/src/forge/_generated/releaseManifest.json

@@ -1 +1 @@
-{"defaultProvider":"local","diagnostics":[],"env":{"deployEnv":"FORGE_DEPLOY_ENV","deployId":"FORGE_DEPLOY_ID","publicReleaseId":"NEXT_PUBLIC_FORGE_RELEASE_ID","releaseId":"FORGE_RELEASE_ID"},"gitSha":"unknown","optionalProviders":["local","sentry-compatible","sentry","glitchtip","bugsink","otel","custom"],"packageName":"forgeos","packageVersion":"0.1.0-alpha.34","releaseId":"forgeos@0.1.0-alpha.34+unknown","schemaVersion":"0.1.0"}
+{"defaultProvider":"local","diagnostics":[],"env":{"deployEnv":"FORGE_DEPLOY_ENV","deployId":"FORGE_DEPLOY_ID","publicReleaseId":"NEXT_PUBLIC_FORGE_RELEASE_ID","releaseId":"FORGE_RELEASE_ID"},"gitSha":"unknown","optionalProviders":["local","sentry-compatible","sentry","glitchtip","bugsink","otel","custom"],"packageName":"forgeos","packageVersion":"0.1.0-alpha.35","releaseId":"forgeos@0.1.0-alpha.35+unknown","schemaVersion":"0.1.0"}

package/src/forge/_generated/releaseManifest.ts

@@ -1,4 +1,4 @@
-// @forge-generated generator=0.1.0-alpha.34 input=ce9cf8b6c553d7de8113eb2a388d269cb8c90d4bb15c013a7ab907ef207619b9 content=1a3f239bc322349796830461349167bb154a27e57fb1f10868c788194b3be97e
+// @forge-generated generator=0.1.0-alpha.35 input=a41a4935f71e0376ad8546906f6e5bd7c01f6e033fc3aba669f636ad528e9881 content=55c7152fe779387c1acecdd5901f3a8affd1cfc9de8ef40b1c8883e083ebfa8a
 export const releaseManifest = {
   "defaultProvider": "local",
   "diagnostics": [],
@@ -19,7 +19,7 @@ export const releaseManifest = {
     "custom"
   ],
   "packageName": "forgeos",
-  "packageVersion": "0.1.0-alpha.34",
-  "releaseId": "forgeos@0.1.0-alpha.34+unknown",
+  "packageVersion": "0.1.0-alpha.35",
+  "releaseId": "forgeos@0.1.0-alpha.35+unknown",
   "schemaVersion": "0.1.0"
 } as const;

package/src/forge/cli/dev.ts

@@ -595,6 +595,17 @@ export async function resolveAvailableWebPort(input: {
   };
 }
 
+export function devStartupConsoleUrlOptions(input: {
+  host: string;
+  port: number;
+  webUrl?: string;
+}): { apiUrl?: string; webUrl?: string } {
+  return {
+    ...(input.port === 0 ? {} : { apiUrl: `http://${input.host}:${input.port}` }),
+    ...(input.webUrl ? { webUrl: input.webUrl } : {}),
+  };
+}
+
 export interface DevWatchGenerateFailureEvent {
   schemaVersion: "0.1.0";
   event: "dev.generate_failed";
@@ -1138,8 +1149,7 @@ export async function runDevCommand(
       mode: "startup",
       strictSecrets: false,
       includeImpact: true,
-      apiUrl: `http://${host}:${port}`,
-      ...(webUrl ? { webUrl } : {}),
+      ...devStartupConsoleUrlOptions({ host, port, ...(webUrl ? { webUrl } : {}) }),
     });
     if (options.json) {
       process.stdout.write(formatDevConsoleJson(startupCycle));

package/src/forge/compiler/agent-contract/build.ts

@@ -283,9 +283,33 @@ function escapeRegExp(value: string): string {
   return value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
 }
 
+function toSnakeCaseName(name: string): string {
+  return name
+    .replace(/([a-z0-9])([A-Z])/g, "$1_$2")
+    .replace(/[-\s]+/g, "_")
+    .toLowerCase();
+}
+
+function toCamelCaseName(name: string): string {
+  return name.replace(/[_-]([a-zA-Z0-9])/g, (_match, char: string) => char.toUpperCase());
+}
+
+function dbTableLookup(dataGraph: AgentContractInput["dataGraph"]): Map<string, string> {
+  const lookup = new Map<string, string>();
+  for (const table of dataGraph.tables) {
+    lookup.set(table.name, table.name);
+    lookup.set(table.exportName, table.name);
+    lookup.set(toSnakeCaseName(table.name), table.name);
+    lookup.set(toSnakeCaseName(table.exportName), table.name);
+    lookup.set(toCamelCaseName(table.name), table.name);
+    lookup.set(toCamelCaseName(table.exportName), table.name);
+  }
+  return lookup;
+}
+
 function addDbAliasesForText(
   text: string,
-  tableNames: Set<string>,
+  tableLookup: Map<string, string>,
   aliases: Map<string, string>,
 ): void {
   for (const match of text.matchAll(
@@ -293,8 +317,9 @@ function addDbAliasesForText(
   )) {
     const alias = match[1] ?? "";
     const table = match[2] ?? match[3] ?? "";
-    if (alias && tableNames.has(table)) {
-      aliases.set(alias, table);
+    const canonicalTable = tableLookup.get(table);
+    if (alias && canonicalTable) {
+      aliases.set(alias, canonicalTable);
     }
   }
 
@@ -304,8 +329,9 @@ function addDbAliasesForText(
       const [rawTable, rawAlias] = part.split(":").map((value) => value.trim());
       const table = rawTable?.replace(/["'`]/g, "") ?? "";
       const alias = (rawAlias ?? rawTable ?? "").replace(/\s*=.*$/, "").trim();
-      if (tableNames.has(table) && alias) {
-        aliases.set(alias, table);
+      const canonicalTable = tableLookup.get(table);
+      if (canonicalTable && alias) {
+        aliases.set(alias, canonicalTable);
       }
     }
   }
@@ -313,26 +339,28 @@ function addDbAliasesForText(
 
 function dbTablesForText(
   text: string,
-  tableNames: Set<string>,
+  tableLookup: Map<string, string>,
   ops: Set<string>,
 ): string[] {
   const tables: string[] = [];
   for (const match of text.matchAll(/ctx\.db\.([A-Za-z_$][A-Za-z0-9_$]*)\s*\.\s*([A-Za-z_$][A-Za-z0-9_$]*)/g)) {
     const table = match[1] ?? "";
     const op = match[2] ?? "";
-    if (tableNames.has(table) && ops.has(op)) {
-      tables.push(table);
+    const canonicalTable = tableLookup.get(table);
+    if (canonicalTable && ops.has(op)) {
+      tables.push(canonicalTable);
     }
   }
   for (const match of text.matchAll(/ctx\.db\s*\[\s*["'`]([^"'`]+)["'`]\s*\]\s*\.\s*([A-Za-z_$][A-Za-z0-9_$]*)/g)) {
     const table = match[1] ?? "";
     const op = match[2] ?? "";
-    if (tableNames.has(table) && ops.has(op)) {
-      tables.push(table);
+    const canonicalTable = tableLookup.get(table);
+    if (canonicalTable && ops.has(op)) {
+      tables.push(canonicalTable);
     }
   }
   const aliases = new Map<string, string>();
-  addDbAliasesForText(text, tableNames, aliases);
+  addDbAliasesForText(text, tableLookup, aliases);
   for (const [alias, table] of aliases) {
     const aliasPattern = new RegExp(`\\b${escapeRegExp(alias)}\\s*\\.\\s*([A-Za-z_$][A-Za-z0-9_$]*)`, "g");
     for (const match of text.matchAll(aliasPattern)) {
@@ -348,10 +376,10 @@ function dbTablesForText(
 function dbTablesForFile(
   workspaceRoot: string,
   file: string | undefined,
-  tableNames: Set<string>,
+  tableLookup: Map<string, string>,
   ops: Set<string>,
 ): string[] {
-  return dbTablesForText(sourceTextWithLocalImports(workspaceRoot, file), tableNames, ops);
+  return dbTablesForText(sourceTextWithLocalImports(workspaceRoot, file), tableLookup, ops);
 }
 
 function emittedEventsForFile(workspaceRoot: string, file: string | undefined): string[] {
@@ -1222,7 +1250,7 @@ export function buildAgentContractArtifacts(
   );
 
   const runtimeEntries = new Map(input.runtimeGraph.entries.map((entry) => [entry.name, entry]));
-  const tableNames = new Set(input.dataGraph.tables.map((table) => table.name));
+  const tableLookup = dbTableLookup(input.dataGraph);
   const externalEntries = input.externalServices?.services.flatMap((service) => service.entries) ?? [];
   const localCommandInfos: AgentContract["commands"] = sorted(Object.keys(input.apiSurface.commands), (name) => name).map((name) => {
     const entry = runtimeEntries.get(name);
@@ -1232,8 +1260,8 @@ export function buildAgentContractArtifacts(
       file,
       source: "local" as const,
       policy: authPolicy(commandAuth.get(name)),
-      tablesRead: dbTablesForFile(input.workspaceRoot, file, tableNames, DB_READ_OPS),
-      tablesWritten: dbTablesForFile(input.workspaceRoot, file, tableNames, DB_WRITE_OPS),
+      tablesRead: dbTablesForFile(input.workspaceRoot, file, tableLookup, DB_READ_OPS),
+      tablesWritten: dbTablesForFile(input.workspaceRoot, file, tableLookup, DB_WRITE_OPS),
       emits: emittedEventsForFile(input.workspaceRoot, file),
       allowedPackages: entry ? packageNamesForModule(input.appGraph, entry.moduleId) : [],
       forbiddenCapabilities: forbiddenForContext(input.classified, "command"),
@@ -1268,7 +1296,7 @@ export function buildAgentContractArtifacts(
     policy: authPolicy(queryAuth.get(query.name)),
     readOnly: true,
     tenantScoped: input.tenantScope.tables.length > 0,
-    tablesRead: dbTablesForFile(input.workspaceRoot, query.file, tableNames, DB_READ_OPS),
+    tablesRead: dbTablesForFile(input.workspaceRoot, query.file, tableLookup, DB_READ_OPS),
     allowedPackages: packageNamesForModule(input.appGraph, query.moduleId),
     forbiddenCapabilities: forbiddenForContext(input.classified, "query"),
     http: httpEndpointFor("query", query.name),
@@ -1296,7 +1324,7 @@ export function buildAgentContractArtifacts(
   );
   const liveQueryInfos: AgentContract["liveQueries"] = sorted(input.liveQueryRegistry.liveQueries, (liveQuery) => liveQuery.name).map(
     (liveQuery) => {
-      const tablesRead = dbTablesForFile(input.workspaceRoot, liveQuery.file, tableNames, DB_READ_OPS);
+      const tablesRead = dbTablesForFile(input.workspaceRoot, liveQuery.file, tableLookup, DB_READ_OPS);
       return {
         name: liveQuery.name,
         file: liveQuery.file,

package/src/forge/compiler/data-graph/sql/ddl.ts

@@ -102,39 +102,41 @@ function parseFieldType(
   field: DataField,
   tableName: string,
   diagnostics: Diagnostic[],
+  refTables: Map<string, string>,
 ): ParsedFieldType | null {
   const declared = field.type.trim();
   const nullable = declared.endsWith("?");
-  const raw = (nullable ? declared.slice(0, -1) : declared).trim().toLowerCase();
+  const raw = (nullable ? declared.slice(0, -1) : declared).trim();
+  const lowered = raw.toLowerCase();
 
   const withNullability = (parsed: Omit<ParsedFieldType, "nullable">): ParsedFieldType => ({
     ...parsed,
     ...(nullable ? { nullable: true } : {}),
   });
 
-  if (raw === "uuid") {
+  if (lowered === "uuid") {
     return withNullability({ sqlType: "uuid" });
   }
-  if (raw === "text" || raw === "string") {
+  if (lowered === "text" || lowered === "string") {
     return withNullability({ sqlType: "text" });
   }
-  if (raw === "number") {
+  if (lowered === "number") {
     return withNullability({ sqlType: "double precision" });
   }
-  if (raw === "integer" || raw === "int") {
+  if (lowered === "integer" || lowered === "int") {
     return withNullability({ sqlType: "integer" });
   }
-  if (raw === "boolean" || raw === "bool") {
+  if (lowered === "boolean" || lowered === "bool") {
     return withNullability({ sqlType: "boolean" });
   }
-  if (raw === "timestamp" || raw === "timestamptz") {
+  if (lowered === "timestamp" || lowered === "timestamptz") {
     return withNullability({ sqlType: "timestamptz" });
   }
-  if (raw === "json") {
+  if (lowered === "json") {
     return withNullability({ sqlType: "jsonb" });
   }
 
-  if (raw.startsWith("enum:")) {
+  if (lowered.startsWith("enum:")) {
     const values = raw
       .slice("enum:".length)
       .split(",")
@@ -158,11 +160,11 @@ function parseFieldType(
     };
   }
 
-  if (raw.startsWith("enum_")) {
+  if (lowered.startsWith("enum_")) {
     return withNullability({ sqlType: "text" });
   }
 
-  if (raw.startsWith("ref:")) {
+  if (lowered.startsWith("ref:")) {
     const refTable = raw.slice("ref:".length).trim();
     if (!refTable) {
       diagnostics.push(
@@ -174,14 +176,25 @@ function parseFieldType(
       );
       return null;
     }
+    const resolvedRefTable = refTables.get(refTable) ?? refTables.get(toSnakeCase(refTable));
+    if (!resolvedRefTable) {
+      diagnostics.push(
+        createDiagnostic({
+          severity: "error",
+          code: FORGE_DB_INVALID_SQL_PLAN,
+          message: `unknown ref target '${refTable}' on ${tableName}.${field.name}; expected one of ${[...new Set(refTables.values())].sort().join(", ")}`,
+        }),
+      );
+      return null;
+    }
     return {
       ...(nullable ? { nullable: true } : {}),
       sqlType: "uuid",
-      references: { table: toSnakeCase(refTable), column: "id" },
+      references: { table: resolvedRefTable, column: "id" },
     };
   }
 
-  if (raw === "ref") {
+  if (lowered === "ref") {
     return {
       ...(nullable ? { nullable: true } : {}),
       sqlType: "uuid",
@@ -199,6 +212,18 @@ function parseFieldType(
   return null;
 }
 
+function buildReferenceTableLookup(tables: DataTable[]): Map<string, string> {
+  const lookup = new Map<string, string>();
+  for (const table of tables) {
+    const sqlTableName = toSnakeCase(table.name);
+    lookup.set(table.name, sqlTableName);
+    lookup.set(table.exportName, sqlTableName);
+    lookup.set(sqlTableName, sqlTableName);
+    lookup.set(toSnakeCase(table.exportName), sqlTableName);
+  }
+  return lookup;
+}
+
 function defaultExprForField(field: DataField): string | undefined {
   const name = field.name;
   const type = field.type.trim().replace(/\?$/, "").toLowerCase();
@@ -217,7 +242,11 @@ function defaultExprForField(field: DataField): string | undefined {
   return undefined;
 }
 
-function buildColumns(table: DataTable, diagnostics: Diagnostic[]): ColumnDef[] {
+function buildColumns(
+  table: DataTable,
+  diagnostics: Diagnostic[],
+  refTables: Map<string, string>,
+): ColumnDef[] {
   const columns: ColumnDef[] = [];
   const fields = [...table.fields].sort((a, b) =>
     a.name < b.name ? -1 : a.name > b.name ? 1 : 0,
@@ -236,7 +265,7 @@ function buildColumns(table: DataTable, diagnostics: Diagnostic[]): ColumnDef[]
   }
 
   for (const field of fields) {
-    const parsed = parseFieldType(field, table.name, diagnostics);
+    const parsed = parseFieldType(field, table.name, diagnostics, refTables);
     if (!parsed) {
       continue;
     }
@@ -311,9 +340,13 @@ function buildForeignKeyIndexes(tableName: string, columns: ColumnDef[]): IndexD
   return indexes;
 }
 
-function buildTableChange(table: DataTable, diagnostics: Diagnostic[]): SqlChange | null {
+function buildTableChange(
+  table: DataTable,
+  diagnostics: Diagnostic[],
+  refTables: Map<string, string>,
+): SqlChange | null {
   const tableName = toSnakeCase(table.name);
-  const columns = buildColumns(table, diagnostics);
+  const columns = buildColumns(table, diagnostics, refTables);
 
   if (columns.length === 0) {
     diagnostics.push(
@@ -351,6 +384,7 @@ export function buildSqlPlan(dataGraph: DataGraph): SqlPlan {
   const diagnostics: Diagnostic[] = [];
   const tables: SqlChange[] = [];
   const indexes: SqlChange[] = [];
+  const refTables = buildReferenceTableLookup(dataGraph.tables);
 
   const systemTables: SqlChange[] = [
     {
@@ -406,7 +440,7 @@ export function buildSqlPlan(dataGraph: DataGraph): SqlPlan {
   ];
 
   for (const table of stableSortTables(dataGraph.tables)) {
-    const change = buildTableChange(table, diagnostics);
+    const change = buildTableChange(table, diagnostics, refTables);
     if (!change) {
       continue;
     }

package/src/forge/dev/server.ts

@@ -333,12 +333,27 @@ function markdownResponse(body: string, status = 200): Response {
 }
 
 function corsPreflight(): Response {
+  const allowedHeaders = [
+    "Authorization",
+    "Content-Type",
+    "WorkOS-Signature",
+    "x-forge-user-id",
+    "x-forge-tenant-id",
+    "x-forge-organization-id",
+    "x-forge-organization-membership-id",
+    "x-forge-role",
+    "x-forge-roles",
+    "x-forge-permissions",
+    "x-forge-claims",
+    "x-forge-auth-kind",
+    "x-forge-trace-id",
+  ];
   return new Response(null, {
     status: 204,
     headers: {
       "Access-Control-Allow-Origin": "*",
       "Access-Control-Allow-Methods": "GET, POST, OPTIONS",
-      "Access-Control-Allow-Headers": "Authorization, Content-Type, WorkOS-Signature, x-forge-user-id, x-forge-tenant-id, x-forge-role, x-forge-roles, x-forge-permissions",
+      "Access-Control-Allow-Headers": allowedHeaders.join(", "),
     },
   });
 }

package/src/forge/version.ts

@@ -1,3 +1,3 @@
-export const FORGEOS_VERSION = "0.1.0-alpha.34";
+export const FORGEOS_VERSION = "0.1.0-alpha.35";
 export const GENERATOR_VERSION = FORGEOS_VERSION;
 export const CLI_VERSION = FORGEOS_VERSION;