forgeos 0.1.0-alpha.37 → 0.1.0-alpha.39

package/AGENTS.md

@@ -1,4 +1,4 @@
-// @forge-generated generator=0.1.0-alpha.37 input=055c7d65fca3d6d8b05af2899c233ff69d377edf0f46f719e2d164ee0574309a content=721818a6f9a664aa898092d4aa5cd68cbbd8ad6e150c7d3ad3ef785a2e3fcf53
+// @forge-generated generator=0.1.0-alpha.39 input=1c15364ea76cedba476c98d2f661e485cdee778fa10e7b06f7db1b6f23b1dc4a content=721818a6f9a664aa898092d4aa5cd68cbbd8ad6e150c7d3ad3ef785a2e3fcf53
 # AGENTS.md
 
 <!-- forge-generated:start -->

package/CHANGELOG.md

@@ -1,5 +1,20 @@
 # forgeos
 
+## 0.1.0-alpha.39
+
+### Patch Changes
+
+- Harden real WorkOS seed setup for production-like field tests.
+
+  - Emit valid YAML for generated `workos-seed.yml` files by skipping the
+    JavaScript-style deterministic header on YAML artifacts.
+  - Make `forge workos seed --dry-run` the validation-only path and let
+    `forge workos seed --file workos-seed.yml --json` delegate to the
+    authenticated WorkOS CLI.
+  - Treat known WorkOS duplicate-resource seed responses such as permission
+    slugs already in use as an already-applied seed instead of a hard failure.
+  - Ignore `.workos-seed-state.json` in newly scaffolded apps.
+
 ## 0.1.0-alpha.37
 
 ### Patch Changes

package/docs/changelog.md

@@ -6,6 +6,43 @@ The canonical source file in the repository is `CHANGELOG.md`.
 
 ## Unreleased
 
+## 0.1.0-alpha.39
+
+- Hardened real WorkOS seed setup: generated `workos-seed.yml` files no longer
+  use `// @forge-generated` headers, `forge workos seed --dry-run` is the
+  validation-only path, real seed runs handle known duplicate-resource WorkOS
+  responses as already-applied state, and scaffolded apps ignore
+  `.workos-seed-state.json` by default.
+
+## 0.1.0-alpha.38
+
+- Added first-class production deployment commands:
+  `forge deploy plan`, `forge deploy render docker`,
+  `forge deploy check --production`, and
+  `forge deploy verify --production`.
+- Generated Docker deployment files now use the app's detected package manager,
+  require the matching lockfile for production checks, read
+  `deploy/.env.production`, and avoid hidden hard-coded `DATABASE_URL`
+  overrides.
+- Added `forge field-test create`, `forge field-test run`, and
+  `forge field-test report`, including runtime/auth probe summaries and
+  `productionEvidence` so field-test reports can feed
+  `forge deploy check --production`.
+- Split `forge release doctor` into npm publish readiness and production deploy
+  readiness, so package publishing is not confused with a production-ready app
+  claim.
+- Made `forge handoff --json` include commit-ready files by default, excluding
+  generated and operational artifacts while reporting how much noise was
+  filtered out.
+- Clarified local auth versus production auth with `forge auth status` posture
+  classifications, local `x-forge-*` header reporting, and production proof
+  next actions.
+- Added `dbGuide` to `forge doctor runtime` and `forge doctor pglite` so agents
+  know when to use `--db memory`, `--db pglite`, stop an active process, or run
+  local PGlite repair.
+- Updated production, self-host, field-test, security, troubleshooting, and CLI
+  docs to reflect the new deploy/auth/database workflow.
+
 ## 0.1.0-alpha.37
 
 - Fixed `forge deps upgrade-plan` for npm alias installs used by ForgeOS apps.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "forgeos",
-  "version": "0.1.0-alpha.37",
+  "version": "0.1.0-alpha.39",
   "description": "Agent-native application framework and compiler for building Forge apps without a mandatory dashboard.",
   "type": "module",
   "license": "MIT",

package/src/forge/_generated/releaseManifest.json

@@ -1 +1 @@
-{"defaultProvider":"local","diagnostics":[],"env":{"deployEnv":"FORGE_DEPLOY_ENV","deployId":"FORGE_DEPLOY_ID","publicReleaseId":"NEXT_PUBLIC_FORGE_RELEASE_ID","releaseId":"FORGE_RELEASE_ID"},"gitSha":"unknown","optionalProviders":["local","sentry-compatible","sentry","glitchtip","bugsink","otel","custom"],"packageName":"forgeos","packageVersion":"0.1.0-alpha.37","releaseId":"forgeos@0.1.0-alpha.37+unknown","schemaVersion":"0.1.0"}
+{"defaultProvider":"local","diagnostics":[],"env":{"deployEnv":"FORGE_DEPLOY_ENV","deployId":"FORGE_DEPLOY_ID","publicReleaseId":"NEXT_PUBLIC_FORGE_RELEASE_ID","releaseId":"FORGE_RELEASE_ID"},"gitSha":"unknown","optionalProviders":["local","sentry-compatible","sentry","glitchtip","bugsink","otel","custom"],"packageName":"forgeos","packageVersion":"0.1.0-alpha.39","releaseId":"forgeos@0.1.0-alpha.39+unknown","schemaVersion":"0.1.0"}

package/src/forge/_generated/releaseManifest.ts

@@ -1,4 +1,4 @@
-// @forge-generated generator=0.1.0-alpha.37 input=055c7d65fca3d6d8b05af2899c233ff69d377edf0f46f719e2d164ee0574309a content=1e26c5249853569091c1b295aab06bd2b9546462328fe8126eda099222430b61
+// @forge-generated generator=0.1.0-alpha.39 input=1c15364ea76cedba476c98d2f661e485cdee778fa10e7b06f7db1b6f23b1dc4a content=d76bcca47149c3378aca45191d0df75cbc6c25b49548ba94b7e2ac4ecbaa91a8
 export const releaseManifest = {
   "defaultProvider": "local",
   "diagnostics": [],
@@ -19,7 +19,7 @@ export const releaseManifest = {
     "custom"
   ],
   "packageName": "forgeos",
-  "packageVersion": "0.1.0-alpha.37",
-  "releaseId": "forgeos@0.1.0-alpha.37+unknown",
+  "packageVersion": "0.1.0-alpha.39",
+  "releaseId": "forgeos@0.1.0-alpha.39+unknown",
   "schemaVersion": "0.1.0"
 } as const;

package/src/forge/cli/auth.ts

@@ -12,6 +12,12 @@ import { loadSecretRegistry } from "../runtime/secrets/check.ts";
 import { existsSync } from "node:fs";
 import { join } from "node:path";
 import { normalizeForgeCliCommandsInValue } from "../workspace/forge-cli.ts";
+import {
+  collectExpectedResourceTypes,
+  collectPolicyPermissions,
+  missingValues,
+  parseSeedFile,
+} from "./workos.ts";
 
 export type AuthSubcommand = "check" | "config" | "decode" | "test-token" | "jwks" | "prove" | "status";
 
@@ -92,14 +98,59 @@ function buildAuthPosture(workspaceRoot: string) {
   const productionMode = config.mode === "jwt" || config.mode === "oidc";
   const errors = configErrors(config);
   const configReady = errors.length === 0;
+  const classification = config.mode === "dev-headers"
+    ? "local-dev"
+    : config.mode === "disabled"
+      ? "unauthenticated"
+      : configReady
+        ? "production-ready"
+        : "production-incomplete";
+  const reason = productionMode
+    ? configReady
+      ? "jwt/oidc production auth configuration is present"
+      : "jwt/oidc production auth is selected but required settings are missing"
+    : config.mode === "disabled"
+      ? "auth is disabled; this is not suitable for public production traffic"
+      : "dev-headers auth is local-only and is not real production authentication";
   return normalizeForgeCliCommandsInValue(workspaceRoot, {
     schemaVersion: "0.1.0",
     mode: config.mode,
+    classification,
     localOnly: config.mode === "dev-headers",
     productionReady: productionMode && configReady,
     requiresTenant: config.requiresTenant,
     bearerHeader: productionMode ? "Authorization: Bearer <token>" : null,
     tenantClaim: config.claims.tenantId ?? "tenant_id",
+    environment: {
+      current: classification,
+      localDevelopment: config.mode === "dev-headers",
+      publicProduction: productionMode && configReady,
+      warning: reason,
+    },
+    localDevHeaders: config.mode === "dev-headers"
+      ? {
+          acceptedHeaders: [
+            "x-forge-user-id",
+            "x-forge-tenant-id",
+            "x-forge-role",
+            "x-forge-roles",
+            "x-forge-permissions",
+          ],
+          scope: "forge dev, tests, and local agent workflows only",
+          neverProduction: true,
+        }
+      : null,
+    productionRequirements: {
+      requiredMode: "jwt or oidc",
+      bearerHeader: "Authorization: Bearer <token>",
+      requiredEnv: [
+        "FORGE_AUTH_MODE",
+        "FORGE_AUTH_ISSUER",
+        "FORGE_AUTH_AUDIENCE",
+        config.mode === "oidc" ? "OIDC discovery at FORGE_AUTH_ISSUER" : "FORGE_AUTH_JWKS_URI",
+      ],
+      proofCommand: "forge auth prove --prod --token <jwt> --json",
+    },
     productionChecklist: [
       { item: "auth mode is jwt or oidc", ok: productionMode },
       { item: "FORGE_AUTH_ISSUER configured", ok: Boolean(config.issuer) },
@@ -109,11 +160,7 @@ function buildAuthPosture(workspaceRoot: string) {
       { item: "permission claim mapped", ok: Boolean(config.claims.permissions) },
       { item: "dev-headers disabled for public runtime", ok: config.mode !== "dev-headers" },
     ],
-    reason: productionMode
-      ? configReady
-        ? "jwt/oidc production auth configuration is present"
-        : "jwt/oidc production auth is selected but required settings are missing"
-      : "dev-headers auth is local-only and is not real production authentication",
+    reason,
     nextActions: productionMode
       ? configReady
         ? ["forge auth prove --prod --token <jwt> --json", "forge serve --json"]
@@ -122,12 +169,26 @@ function buildAuthPosture(workspaceRoot: string) {
   });
 }
 
+function permissionSubsetForRestrictedTenant(permissions: string[]): string[] {
+  const readonly = permissions.filter((permission) =>
+    /(^|[:._-])(read|list|view|inspect|search)($|[:._-])/.test(permission)
+  );
+  if (readonly.length > 0) return readonly;
+  return permissions.slice(0, Math.max(1, Math.floor(permissions.length / 2)));
+}
+
 function buildMultiTenantProof(workspaceRoot: string, workos: ReturnType<typeof detectWorkOS>, requiresTenant: boolean) {
   const rootSeedPresent = existsSync(join(workspaceRoot, "workos-seed.yml"));
   const generatedSeedPresent = existsSync(join(workspaceRoot, "src/forge/_generated/integrations/workos/workos-seed.yml"));
   const authMdPresent = existsSync(join(workspaceRoot, "public/auth.md"));
   const metadataPresent = existsSync(join(workspaceRoot, "public/.well-known/oauth-protected-resource"));
-  const permissions = ["onboarding:read", "invitations:create", "tasks:update"];
+  const activePermissions = collectPolicyPermissions(workspaceRoot);
+  const expectedResourceTypes = collectExpectedResourceTypes(workspaceRoot);
+  const seed = parseSeedFile(workspaceRoot);
+  const missingSeedPermissions = missingValues(activePermissions, seed.permissions);
+  const missingSeedResources = missingValues(expectedResourceTypes, seed.resourceTypes);
+  const acmePermissions = activePermissions;
+  const globexPermissions = permissionSubsetForRestrictedTenant(activePermissions);
   const permissionVocabularyPresent = workos.detected && workos.claimStatus.some((claim) => claim.name === "permissions" && claim.ok);
   const checks = [
     {
@@ -137,13 +198,35 @@ function buildMultiTenantProof(workspaceRoot: string, workos: ReturnType<typeof
     },
     {
       id: "permission-claim",
-      ok: permissionVocabularyPresent,
-      evidence: "Forge permissions claim maps to WorkOS permissions.",
+      ok: activePermissions.length > 0 && permissionVocabularyPresent,
+      evidence: activePermissions.length > 0
+        ? `Forge permissions claim maps to WorkOS permissions: ${activePermissions.join(", ")}.`
+        : "No active policy permissions were found in the generated policy registry.",
     },
     {
       id: "seed-organizations",
       ok: rootSeedPresent || generatedSeedPresent,
-      evidence: rootSeedPresent ? "workos-seed.yml exists at app root." : "generated WorkOS seed exists.",
+      evidence: rootSeedPresent
+        ? "workos-seed.yml exists at app root."
+        : generatedSeedPresent
+          ? "generated WorkOS seed exists."
+          : "no WorkOS seed file found at app root or in generated integrations.",
+    },
+    {
+      id: "seed-permission-coverage",
+      ok: activePermissions.length > 0 && missingSeedPermissions.length === 0,
+      evidence: activePermissions.length === 0
+        ? "No active policy permissions were found in the generated policy registry."
+        : missingSeedPermissions.length === 0
+          ? `seed covers active app permission(s): ${activePermissions.join(", ")}`
+        : `seed missing active app permission(s): ${missingSeedPermissions.join(", ")}`,
+    },
+    {
+      id: "seed-resource-coverage",
+      ok: missingSeedResources.length === 0,
+      evidence: missingSeedResources.length === 0
+        ? `seed covers expected app resource type(s): ${expectedResourceTypes.join(", ") || "none required"}`
+        : `seed missing expected app resource type(s): ${missingSeedResources.join(", ")}`,
     },
     {
       id: "agent-auth-metadata",
@@ -155,14 +238,21 @@ function buildMultiTenantProof(workspaceRoot: string, workos: ReturnType<typeof
     scenario: "multi-tenant",
     ok: checks.every((check) => check.ok),
     claims: {
-      acme: { organization_id: "org_acme", role: "owner", permissions },
-      globex: { organization_id: "org_globex", role: "member", permissions: ["onboarding:read", "tasks:update"] },
+      acme: { organization_id: "org_acme", role: "owner", permissions: acmePermissions },
+      globex: { organization_id: "org_globex", role: "member", permissions: globexPermissions },
+    },
+    appContract: {
+      activePermissions,
+      expectedResourceTypes,
+      seedPath: seed.path,
+      seedPermissions: seed.permissions,
+      seedResourceTypes: seed.resourceTypes,
     },
     invariants: [
       "Acme and Globex must use different organization_id claim values.",
       "Tenant-scoped reads must include the active organization_id.",
       "Tenant-scoped writes must verify the resource tenant before mutation.",
-      "Role-only UI affordances are not sufficient; policies must use permissions/claims.",
+      "Role-only UI affordances are not sufficient; policies must use the app's generated permission vocabulary.",
     ],
     checks,
     nextActions: [
@@ -304,7 +394,31 @@ export async function runAuthCommand(
     };
   }
   if (options.subcommand === "check") {
-    return validateConfig(options.workspaceRoot);
+    const checked = validateConfig(options.workspaceRoot);
+    if (!options.prod) {
+      return checked;
+    }
+    const posture = buildAuthPosture(options.workspaceRoot);
+    const productionReady = posture.productionReady === true;
+    return {
+      ok: checked.ok && productionReady,
+      mode: checked.mode,
+      data: {
+        ...(checked.data && typeof checked.data === "object" ? checked.data as Record<string, unknown> : {}),
+        production: true,
+        authPosture: posture,
+        productionCheck: {
+          ok: productionReady,
+          reason: posture.reason,
+          requiredMode: "jwt or oidc",
+          localOnlyModeRejected: posture.localOnly === true,
+        },
+      },
+      error: productionReady
+        ? checked.error
+        : { code: "FORGE_AUTH_MODE_INVALID", message: "production auth requires FORGE_AUTH_MODE=jwt or oidc; dev-headers is local-only" },
+      exitCode: checked.ok && productionReady ? 0 : 1,
+    };
   }
   if (options.subcommand === "prove") {
     const checked = validateConfig(options.workspaceRoot);
@@ -405,7 +519,51 @@ export function formatAuthJson(result: AuthCommandResult): string {
   return `${JSON.stringify(result, null, 2)}\n`;
 }
 
+function authPostureFromResult(result: AuthCommandResult): Record<string, unknown> | null {
+  const data = result.data && typeof result.data === "object" ? result.data as Record<string, unknown> : {};
+  const direct = data.schemaVersion === "0.1.0" && "classification" in data ? data : null;
+  const nested = data.authPosture && typeof data.authPosture === "object"
+    ? data.authPosture as Record<string, unknown>
+    : null;
+  return direct ?? nested;
+}
+
 export function formatAuthHuman(result: AuthCommandResult): string {
+  const posture = authPostureFromResult(result);
+  if (posture) {
+    const classification = typeof posture.classification === "string" ? posture.classification : result.mode;
+    const reason = typeof posture.reason === "string" ? posture.reason : result.error?.message;
+    const nextActions = Array.isArray(posture.nextActions) ? posture.nextActions.filter((item): item is string => typeof item === "string") : [];
+    const lines = [
+      `Auth ${result.mode}: ${result.ok ? "ok" : "failed"} (${classification})`,
+      `Production ready: ${posture.productionReady === true ? "yes" : "no"}`,
+      ...(reason ? [`Reason: ${reason}`] : []),
+    ];
+    const localDevHeaders = posture.localDevHeaders && typeof posture.localDevHeaders === "object"
+      ? posture.localDevHeaders as Record<string, unknown>
+      : null;
+    const acceptedHeaders = Array.isArray(localDevHeaders?.acceptedHeaders)
+      ? localDevHeaders.acceptedHeaders.filter((item): item is string => typeof item === "string")
+      : posture.localOnly === true || result.mode === "dev-headers"
+        ? [
+            "x-forge-user-id",
+            "x-forge-tenant-id",
+            "x-forge-role",
+            "x-forge-roles",
+            "x-forge-permissions",
+          ]
+        : [];
+    if (acceptedHeaders.length > 0) {
+      lines.push("Local dev headers:", ...acceptedHeaders.map((header) => `  ${header}`));
+    }
+    if (!result.ok && result.error) {
+      lines.push(`${result.error.code}: ${result.error.message}`);
+    }
+    if (nextActions.length > 0) {
+      lines.push("", "Next:", ...nextActions.map((action) => `  ${action}`));
+    }
+    return `${lines.join("\n")}\n`;
+  }
   if (!result.ok) {
     return `Auth ${result.mode}: failed\n${result.error?.code}: ${result.error?.message}\n`;
   }

package/src/forge/cli/commands.ts

@@ -188,8 +188,11 @@ import {
   formatDoctorJson,
   formatPgliteDoctorHuman,
   formatPgliteDoctorJson,
+  formatRuntimeDoctorHuman,
+  formatRuntimeDoctorJson,
   runPgliteDoctorCommand,
   runDoctorCommand,
+  runRuntimeDoctorCommand,
 } from "./doctor.ts";
 import {
   formatWindowsDoctorHuman,
@@ -210,6 +213,17 @@ import {
   formatWorkOSJson,
   runWorkOSCommand,
 } from "./workos.ts";
+import {
+  formatDeployHuman,
+  formatDeployJson,
+  type DeployCommandResult,
+  runDeployCommand,
+} from "./deploy.ts";
+import {
+  formatFieldTestHuman,
+  formatFieldTestJson,
+  runFieldTestCommand,
+} from "./field-test.ts";
 import {
   formatLastHuman,
   formatLastJson,
@@ -1128,8 +1142,9 @@ interface ReleaseDoctorCheck {
   name: string;
   ok: boolean;
   requiredForPublish: boolean;
+  requiredForProduction?: boolean;
   state?: string;
-  result: ReleaseCommandResult | SelfHostCommandResult | DocsCheckResult | PackagePackCheckResult;
+  result: ReleaseCommandResult | SelfHostCommandResult | DocsCheckResult | DeployCommandResult | PackagePackCheckResult;
 }
 
 interface PackagePackCheckResult {
@@ -1150,10 +1165,13 @@ interface ReleaseDoctorResult {
   schemaVersion: "0.1.0";
   ok: boolean;
   readyToPublish: boolean;
+  readyForProductionDeploy: boolean;
   summary: {
     checks: number;
     failed: string[];
     notPrepared: string[];
+    publishBlockers: string[];
+    productionBlockers: string[];
   };
   checks: ReleaseDoctorCheck[];
   nextActions: string[];
@@ -1269,6 +1287,13 @@ export async function runReleaseDoctorCommand(command: Extract<ForgeCommand, { k
     workspaceRoot: command.workspaceRoot,
     json: command.json,
   });
+  const deployProduction = await runDeployCommand({
+    subcommand: "check",
+    workspaceRoot: command.workspaceRoot,
+    json: command.json,
+    target: "docker",
+    production: true,
+  });
   const packagePack = runPackagePackDryRun(command.workspaceRoot);
   const checks: ReleaseDoctorCheck[] = [
     {
@@ -1291,6 +1316,13 @@ export async function runReleaseDoctorCommand(command: Extract<ForgeCommand, { k
       state: selfHost.state,
       result: selfHost,
     },
+    {
+      name: "deploy-production",
+      ok: deployProduction.ok,
+      requiredForPublish: false,
+      requiredForProduction: true,
+      result: deployProduction,
+    },
     {
       name: "docs",
       ok: docs.ok,
@@ -1308,19 +1340,32 @@ export async function runReleaseDoctorCommand(command: Extract<ForgeCommand, { k
   const notPrepared = checks
     .filter((check) => check.state === "missing-prepared-release" || check.state === "not-prepared")
     .map((check) => check.name);
-  const readyToPublish = failed.length === 0 && notPrepared.length === 0;
+  const publishBlockers = checks
+    .filter((check) => check.requiredForPublish && !check.ok)
+    .map((check) => check.name);
+  const productionBlockers = checks
+    .filter((check) => check.requiredForProduction && !check.ok)
+    .map((check) => check.name);
+  const notPreparedPublishBlockers = checks
+    .filter((check) => check.requiredForPublish && (check.state === "missing-prepared-release" || check.state === "not-prepared"))
+    .map((check) => check.name);
+  const readyToPublish = publishBlockers.length === 0 && notPreparedPublishBlockers.length === 0;
+  const readyForProductionDeploy = productionBlockers.length === 0;
   return {
     schemaVersion: "0.1.0",
-    ok: failed.length === 0,
+    ok: readyToPublish,
     readyToPublish,
+    readyForProductionDeploy,
     summary: {
       checks: checks.length,
       failed,
       notPrepared,
+      publishBlockers,
+      productionBlockers,
     },
     checks,
     nextActions: uniqueNextActions(checks.flatMap((check) => check.result.nextActions ?? [])),
-    exitCode: failed.length === 0 ? 0 : 1,
+    exitCode: readyToPublish ? 0 : 1,
   };
 }
 
@@ -1850,6 +1895,11 @@ export async function executeCommand(command: ForgeCommand): Promise<number> {
         process.stdout.write(command.json ? formatPgliteDoctorJson(result) : formatPgliteDoctorHuman(result));
         return result.exitCode;
       }
+      if (command.target === "runtime") {
+        const result = await runRuntimeDoctorCommand({ workspaceRoot: command.workspaceRoot });
+        process.stdout.write(command.json ? formatRuntimeDoctorJson(result) : formatRuntimeDoctorHuman(result));
+        return result.exitCode;
+      }
       const result = await runDoctorCommand({ workspaceRoot: command.workspaceRoot });
       if (command.json) {
         process.stdout.write(formatDoctorJson(result));
@@ -1906,6 +1956,16 @@ export async function executeCommand(command: ForgeCommand): Promise<number> {
       }
       return result.exitCode;
     }
+    case "deploy": {
+      const result = await runDeployCommand(command);
+      process.stdout.write(command.json ? formatDeployJson(result) : formatDeployHuman(result));
+      return result.exitCode;
+    }
+    case "field-test": {
+      const result = await runFieldTestCommand(command);
+      process.stdout.write(command.json ? formatFieldTestJson(result) : formatFieldTestHuman(result));
+      return result.exitCode;
+    }
     case "rls": {
       const result = await runRlsCommand(command);
       if (command.json) {
@@ -1934,7 +1994,15 @@ export async function executeCommand(command: ForgeCommand): Promise<number> {
             [
               `release doctor ${result.ok ? "ok" : "failed"}`,
               `ready to publish: ${result.readyToPublish ? "yes" : "no"}`,
-              ...result.checks.map((check) => `${check.ok ? "ok" : "fail"} ${check.name}${check.state ? ` (${check.state})` : ""}`),
+              `ready for production deploy: ${result.readyForProductionDeploy ? "yes" : "no"}`,
+              ...result.checks.map((check) => {
+                const scope = check.requiredForPublish
+                  ? "publish"
+                  : check.requiredForProduction
+                    ? "production"
+                    : "optional";
+                return `${check.ok ? "ok" : "fail"} ${check.name} [${scope}]${check.state ? ` (${check.state})` : ""}`;
+              }),
               ...(result.nextActions.length > 0 ? ["", "Next:", ...result.nextActions.map((action) => `  ${action}`)] : []),
             ].join("\n").concat("\n"),
           );