forgeos 0.1.0-alpha.38 → 0.1.0-alpha.39

package/AGENTS.md

@@ -1,4 +1,4 @@
-// @forge-generated generator=0.1.0-alpha.38 input=1b961b8fed6ae0e07fb70ef025922e4a191655d9aca0f6c8617be2f88c204192 content=721818a6f9a664aa898092d4aa5cd68cbbd8ad6e150c7d3ad3ef785a2e3fcf53
+// @forge-generated generator=0.1.0-alpha.39 input=1c15364ea76cedba476c98d2f661e485cdee778fa10e7b06f7db1b6f23b1dc4a content=721818a6f9a664aa898092d4aa5cd68cbbd8ad6e150c7d3ad3ef785a2e3fcf53
 # AGENTS.md
 
 <!-- forge-generated:start -->

package/CHANGELOG.md

@@ -1,5 +1,20 @@
 # forgeos
 
+## 0.1.0-alpha.39
+
+### Patch Changes
+
+- Harden real WorkOS seed setup for production-like field tests.
+
+  - Emit valid YAML for generated `workos-seed.yml` files by skipping the
+    JavaScript-style deterministic header on YAML artifacts.
+  - Make `forge workos seed --dry-run` the validation-only path and let
+    `forge workos seed --file workos-seed.yml --json` delegate to the
+    authenticated WorkOS CLI.
+  - Treat known WorkOS duplicate-resource seed responses such as permission
+    slugs already in use as an already-applied seed instead of a hard failure.
+  - Ignore `.workos-seed-state.json` in newly scaffolded apps.
+
 ## 0.1.0-alpha.37
 
 ### Patch Changes

package/docs/changelog.md

@@ -6,6 +6,14 @@ The canonical source file in the repository is `CHANGELOG.md`.
 
 ## Unreleased
 
+## 0.1.0-alpha.39
+
+- Hardened real WorkOS seed setup: generated `workos-seed.yml` files no longer
+  use `// @forge-generated` headers, `forge workos seed --dry-run` is the
+  validation-only path, real seed runs handle known duplicate-resource WorkOS
+  responses as already-applied state, and scaffolded apps ignore
+  `.workos-seed-state.json` by default.
+
 ## 0.1.0-alpha.38
 
 - Added first-class production deployment commands:

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "forgeos",
-  "version": "0.1.0-alpha.38",
+  "version": "0.1.0-alpha.39",
   "description": "Agent-native application framework and compiler for building Forge apps without a mandatory dashboard.",
   "type": "module",
   "license": "MIT",

package/src/forge/_generated/releaseManifest.json

@@ -1 +1 @@
-{"defaultProvider":"local","diagnostics":[],"env":{"deployEnv":"FORGE_DEPLOY_ENV","deployId":"FORGE_DEPLOY_ID","publicReleaseId":"NEXT_PUBLIC_FORGE_RELEASE_ID","releaseId":"FORGE_RELEASE_ID"},"gitSha":"unknown","optionalProviders":["local","sentry-compatible","sentry","glitchtip","bugsink","otel","custom"],"packageName":"forgeos","packageVersion":"0.1.0-alpha.38","releaseId":"forgeos@0.1.0-alpha.38+unknown","schemaVersion":"0.1.0"}
+{"defaultProvider":"local","diagnostics":[],"env":{"deployEnv":"FORGE_DEPLOY_ENV","deployId":"FORGE_DEPLOY_ID","publicReleaseId":"NEXT_PUBLIC_FORGE_RELEASE_ID","releaseId":"FORGE_RELEASE_ID"},"gitSha":"unknown","optionalProviders":["local","sentry-compatible","sentry","glitchtip","bugsink","otel","custom"],"packageName":"forgeos","packageVersion":"0.1.0-alpha.39","releaseId":"forgeos@0.1.0-alpha.39+unknown","schemaVersion":"0.1.0"}

package/src/forge/_generated/releaseManifest.ts

@@ -1,4 +1,4 @@
-// @forge-generated generator=0.1.0-alpha.38 input=1b961b8fed6ae0e07fb70ef025922e4a191655d9aca0f6c8617be2f88c204192 content=71d83a9364c458ef2ffea0838d343e066e959d81819610519960a33118827078
+// @forge-generated generator=0.1.0-alpha.39 input=1c15364ea76cedba476c98d2f661e485cdee778fa10e7b06f7db1b6f23b1dc4a content=d76bcca47149c3378aca45191d0df75cbc6c25b49548ba94b7e2ac4ecbaa91a8
 export const releaseManifest = {
   "defaultProvider": "local",
   "diagnostics": [],
@@ -19,7 +19,7 @@ export const releaseManifest = {
     "custom"
   ],
   "packageName": "forgeos",
-  "packageVersion": "0.1.0-alpha.38",
-  "releaseId": "forgeos@0.1.0-alpha.38+unknown",
+  "packageVersion": "0.1.0-alpha.39",
+  "releaseId": "forgeos@0.1.0-alpha.39+unknown",
   "schemaVersion": "0.1.0"
 } as const;

package/src/forge/cli/main.ts

@@ -36,7 +36,7 @@ function formatHelp(): string {
     "  forge workos install --yes --json  Delegate AuthKit setup to npx --yes workos@latest install",
     "  forge workos doctor --json  Check WorkOS AuthKit/FGA files, claims, seed, webhook, and tenant guards",
     "  forge workos doctor --yes --json  Run local checks, then delegate to npx --yes workos@latest doctor",
-    "  forge workos seed --file workos-seed.yml --json  Plan WorkOS CLI seed",
+    "  forge workos seed --file workos-seed.yml --dry-run --json  Validate WorkOS seed without hosted changes",
     "  forge deploy plan --target docker --json  Explain production deploy gates and commands",
     "  forge deploy check --production --json  Gate auth, DB, metadata, generated artifacts, and liveQuery readiness",
     "  forge deploy render docker  Write Docker production deploy files under deploy/",

package/src/forge/cli/new.ts

@@ -69,6 +69,7 @@ const REQUIRED_GITIGNORE_PATHS = [
   ".forge/impact/",
   ".forge/agent-adapters/",
   ".forge/studio/",
+  ".workos-seed-state.json",
 ] as const;
 
 const DEFAULT_FORGE_PACKAGE_SPEC = "npm:forgeos@alpha";

package/src/forge/cli/output.ts

@@ -232,8 +232,8 @@ export function buildAddJson(
                 "forge workos install --yes --json",
                 "forge workos doctor --json",
                 "forge workos doctor --yes --json",
+                "forge workos seed --file workos-seed.yml --dry-run --json",
                 "forge workos seed --file workos-seed.yml --json",
-                "forge workos seed --file workos-seed.yml --yes --json",
                 "forge auth check --json",
                 "forge auth prove --json",
               ]

package/src/forge/cli/workos.ts

@@ -1,5 +1,6 @@
-import { existsSync, readFileSync } from "node:fs";
-import { join } from "node:path";
+import { existsSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { basename, join } from "node:path";
 import { spawnSync } from "node:child_process";
 import { GENERATED_DIR } from "../compiler/emitter/constants.ts";
 import { stripDeterministicHeader } from "../compiler/primitives/header.ts";
@@ -84,6 +85,14 @@ function readText(root: string, path: string): string {
   return stripDeterministicHeader(readFileSync(absolute, "utf8"));
 }
 
+function readRawText(root: string, path: string): string {
+  const absolute = join(root, path);
+  if (!existsSync(absolute)) {
+    return "";
+  }
+  return readFileSync(absolute, "utf8");
+}
+
 function includesAll(haystack: string, needles: string[]): boolean {
   return needles.every((needle) => haystack.includes(needle));
 }
@@ -389,6 +398,54 @@ function collectWorkOSChecks(workspaceRoot: string): WorkOSCheck[] {
   ];
 }
 
+function prepareSeedFileForWorkOSCli(
+  workspaceRoot: string,
+  file: string,
+): { file: string; sanitized: boolean; cleanup: () => void } {
+  const raw = readRawText(workspaceRoot, file);
+  const stripped = stripDeterministicHeader(raw);
+  if (!raw || raw === stripped) {
+    return { file, sanitized: false, cleanup: () => undefined };
+  }
+
+  const tempDir = mkdtempSync(join(tmpdir(), "forge-workos-seed-"));
+  const preparedFile = join(tempDir, basename(file));
+  writeFileSync(preparedFile, stripped, "utf8");
+  return {
+    file: preparedFile,
+    sanitized: true,
+    cleanup: () => rmSync(tempDir, { recursive: true, force: true }),
+  };
+}
+
+function isWorkOSSeedAlreadyApplied(stdout: string, stderr: string): boolean {
+  const output = `${stdout}\n${stderr}`;
+  return /(?:permission|role|resource type|organization|slug|domain)[^\n]*(?:already in use|already exists|exists already)|already in use/i
+    .test(output);
+}
+
+function seedData(input: {
+  seed: WorkOSSeedSummary;
+  activePermissions: string[];
+  expectedResourceTypes: string[];
+  unusedSeedPermissions: string[];
+  dryRun?: boolean;
+  seedFileSanitized?: boolean;
+  seedAlreadyApplied?: boolean;
+  nextCommand?: string;
+}): Record<string, unknown> {
+  return {
+    seed: input.seed,
+    activePermissions: input.activePermissions,
+    expectedResourceTypes: input.expectedResourceTypes,
+    unusedSeedPermissions: input.unusedSeedPermissions,
+    dryRun: input.dryRun ?? false,
+    seedFileSanitized: input.seedFileSanitized ?? false,
+    seedAlreadyApplied: input.seedAlreadyApplied ?? false,
+    ...(input.nextCommand ? { nextCommand: input.nextCommand } : {}),
+  };
+}
+
 export function runWorkOSDoctorCommand(options: WorkOSCommandOptions): WorkOSCommandResult {
   const checks = collectWorkOSChecks(options.workspaceRoot);
   const ok = checks.every((check) => check.ok);
@@ -505,33 +562,62 @@ export function runWorkOSSeedCommand(options: WorkOSCommandOptions): WorkOSComma
       checks,
       command,
       applied: false,
-      data: { seed, activePermissions, expectedResourceTypes, unusedSeedPermissions },
+      data: seedData({ seed, activePermissions, expectedResourceTypes, unusedSeedPermissions }),
       exitCode: 1,
     };
   }
-  if (!options.yes || options.dryRun) {
+  if (options.dryRun) {
     return {
       ok: true,
       kind: "workos-seed",
       checks,
       command,
       applied: false,
-      data: { seed, activePermissions, expectedResourceTypes, unusedSeedPermissions },
+      data: seedData({
+        seed,
+        activePermissions,
+        expectedResourceTypes,
+        unusedSeedPermissions,
+        dryRun: true,
+        nextCommand: `forge workos seed --file ${file} --json`,
+      }),
       exitCode: 0,
     };
   }
-  const child = runExternalCommand(command, options);
-  return {
-    ok: child.status === 0,
-    kind: "workos-seed",
-    checks,
-    command,
-    applied: child.status === 0,
-    data: { seed, activePermissions, expectedResourceTypes, unusedSeedPermissions },
-    stdout: child.stdout,
-    stderr: child.stderr,
-    exitCode: child.status === 0 ? 0 : 1,
-  };
+  const preparedSeed = prepareSeedFileForWorkOSCli(options.workspaceRoot, seed.path);
+  const delegatedCommand = [
+    "npx",
+    "--yes",
+    "workos@latest",
+    "seed",
+    "--file",
+    preparedSeed.file,
+  ];
+  try {
+    const child = runExternalCommand(delegatedCommand, options);
+    const seedAlreadyApplied =
+      child.status !== 0 && isWorkOSSeedAlreadyApplied(child.stdout, child.stderr);
+    return {
+      ok: child.status === 0 || seedAlreadyApplied,
+      kind: "workos-seed",
+      checks,
+      command: delegatedCommand,
+      applied: child.status === 0,
+      data: seedData({
+        seed,
+        activePermissions,
+        expectedResourceTypes,
+        unusedSeedPermissions,
+        seedFileSanitized: preparedSeed.sanitized,
+        seedAlreadyApplied,
+      }),
+      stdout: child.stdout,
+      stderr: child.stderr,
+      exitCode: child.status === 0 || seedAlreadyApplied ? 0 : 1,
+    };
+  } finally {
+    preparedSeed.cleanup();
+  }
 }
 
 export function runWorkOSCommand(options: WorkOSCommandOptions): WorkOSCommandResult {
@@ -562,7 +648,16 @@ export function formatWorkOSHuman(result: WorkOSCommandResult): string {
     lines.push("external WorkOS doctor not run; pass --yes to execute the WorkOS CLI command");
   }
   if (result.kind === "workos-seed" && !result.applied) {
-    lines.push("seed not applied; pass --yes to execute the WorkOS CLI command");
+    const data = result.data && typeof result.data === "object"
+      ? result.data as { dryRun?: boolean; seedAlreadyApplied?: boolean; nextCommand?: string }
+      : {};
+    if (data.seedAlreadyApplied) {
+      lines.push("seed already appears applied; WorkOS reported existing resources");
+    } else if (data.dryRun) {
+      lines.push(`seed dry-run only; run ${data.nextCommand ?? "forge workos seed --file workos-seed.yml --json"} to execute the WorkOS CLI command`);
+    } else {
+      lines.push("seed not applied; inspect stdout/stderr from the WorkOS CLI command");
+    }
   }
   return `${lines.join("\n")}\n`;
 }

package/src/forge/compiler/integration/plan.ts

@@ -41,11 +41,23 @@ export interface IntegrationPlanInput {
   existingLock: ForgeLock | null;
 }
 
+function headerForGeneratedPath(path: string): EmitFile["header"] {
+  return path.endsWith(".yml") || path.endsWith(".yaml") ? "none" : undefined;
+}
+
+function headerForRootFile(path: string): EmitFile["header"] {
+  if (path.endsWith(".env.example") || path.endsWith(".yml") || path.endsWith(".yaml")) {
+    return "none";
+  }
+  return "deterministic";
+}
+
 function makeEmitFile(path: string, content: string): EmitFile {
   return {
     path,
     content,
     contentHash: hashStable(content),
+    header: headerForGeneratedPath(path),
   };
 }
 
@@ -236,7 +248,7 @@ export function buildIntegrationEmitPlan(input: IntegrationPlanInput): EmitPlan
       path: rootFile,
       content,
       contentHash: hashStable(content),
-      header: rootFile.endsWith(".env.example") ? "none" : "deterministic",
+      header: headerForRootFile(rootFile),
     });
   }
 

package/src/forge/compiler/integration/templates/workos.ts

@@ -184,8 +184,8 @@ export function renderWorkosAuthkit(_input: IntegrationTemplateInput): string {
     '  "forge workos install --yes --json",',
     '  "forge workos doctor --json",',
     '  "forge workos doctor --yes --json",',
+    '  "forge workos seed --file workos-seed.yml --dry-run --json",',
     '  "forge workos seed --file workos-seed.yml --json",',
-    '  "forge workos seed --file workos-seed.yml --yes --json",',
     '  "forge auth check --json",',
     '  "forge auth prove --json",',
     "] as const;",
@@ -1077,8 +1077,8 @@ export function renderWorkosDoc(input: IntegrationTemplateInput): string {
     "forge workos install --yes --json",
     "forge workos doctor --json",
     "forge workos doctor --yes --json",
+    "forge workos seed --file workos-seed.yml --dry-run --json",
     "forge workos seed --file workos-seed.yml --json",
-    "forge workos seed --file workos-seed.yml --yes --json",
     "forge auth check --json",
     "forge auth prove --json",
     "forge check --json",

package/src/forge/version.ts

@@ -1,3 +1,3 @@
-export const FORGEOS_VERSION = "0.1.0-alpha.38";
+export const FORGEOS_VERSION = "0.1.0-alpha.39";
 export const GENERATOR_VERSION = FORGEOS_VERSION;
 export const CLI_VERSION = FORGEOS_VERSION;