forgeos 0.1.0-alpha.4 → 0.1.0-alpha.41

package/src/forge/compiler/package-upgrades/planner.ts

@@ -102,17 +102,138 @@ function readPackageJson(workspaceRoot: string): {
   };
 }
 
-function dependencyType(workspaceRoot: string, packageName: string): "dependency" | "devDependency" {
+type DependencyType = "dependency" | "devDependency";
+
+interface NpmAliasSpec {
+  packageName: string;
+  versionOrRange?: string;
+}
+
+interface PackageResolution {
+  requestedName: string;
+  packageName: string;
+  dependencyName: string;
+  dependencySpec?: string;
+  dependencyType: DependencyType;
+  isNpmAlias: boolean;
+  current: PackageApi;
+}
+
+function matchesPackageName(candidate: PackageApi, packageName: string): boolean {
+  return candidate.name === packageName || candidate.packageName === packageName;
+}
+
+function parseNpmAliasSpec(spec: string): NpmAliasSpec | null {
+  if (!spec.startsWith("npm:")) {
+    return null;
+  }
+  const target = spec.slice("npm:".length);
+  if (!target) {
+    return null;
+  }
+  const separator =
+    target.startsWith("@")
+      ? target.indexOf("@", target.indexOf("/") + 1)
+      : target.indexOf("@");
+  if (separator === -1) {
+    return { packageName: target };
+  }
+  return {
+    packageName: target.slice(0, separator),
+    versionOrRange: target.slice(separator + 1),
+  };
+}
+
+function dependencyEntries(
+  pkg: ReturnType<typeof readPackageJson>,
+): Array<{ type: DependencyType; name: string; spec: string }> {
+  return [
+    ...Object.entries(pkg.dependencies ?? {}).map(([name, spec]) => ({
+      type: "dependency" as const,
+      name,
+      spec,
+    })),
+    ...Object.entries(pkg.devDependencies ?? {}).map(([name, spec]) => ({
+      type: "devDependency" as const,
+      name,
+      spec,
+    })),
+  ];
+}
+
+function dependencyType(workspaceRoot: string, packageName: string): DependencyType {
   const pkg = readPackageJson(workspaceRoot);
   if (packageName in (pkg.devDependencies ?? {})) {
     return "devDependency";
   }
+  for (const entry of dependencyEntries(pkg)) {
+    const alias = parseNpmAliasSpec(entry.spec);
+    if (alias?.packageName === packageName) {
+      return entry.type;
+    }
+  }
   return "dependency";
 }
 
-function currentPackageApi(workspaceRoot: string, packageName: string): PackageApi | null {
+function resolvePackageForUpgrade(workspaceRoot: string, requestedName: string): PackageResolution | null {
   const graph = readGeneratedJson<PackageGraph>(workspaceRoot, `${GENERATED_DIR}/packageGraph.json`);
-  return graph?.packages.find((pkg) => pkg.name === packageName) ?? null;
+  if (!graph) {
+    return null;
+  }
+  const pkg = readPackageJson(workspaceRoot);
+  const entries = dependencyEntries(pkg);
+
+  const aliasEntry = entries.find((entry) => {
+    const alias = parseNpmAliasSpec(entry.spec);
+    return entry.name === requestedName || alias?.packageName === requestedName;
+  });
+  if (aliasEntry) {
+    const alias = parseNpmAliasSpec(aliasEntry.spec);
+    const packageName = alias?.packageName ?? aliasEntry.name;
+    const current = graph.packages.find((candidate) => matchesPackageName(candidate, packageName)) ??
+      graph.packages.find((candidate) => candidate.name === aliasEntry.name);
+    if (current) {
+      return {
+        requestedName,
+        packageName,
+        dependencyName: aliasEntry.name,
+        dependencySpec: aliasEntry.spec,
+        dependencyType: aliasEntry.type,
+        isNpmAlias: Boolean(alias),
+        current,
+      };
+    }
+  }
+
+  const current = graph.packages.find((candidate) => matchesPackageName(candidate, requestedName));
+  if (!current) {
+    return null;
+  }
+  const directEntry = entries.find((entry) => {
+    const alias = parseNpmAliasSpec(entry.spec);
+    return entry.name === requestedName || alias?.packageName === requestedName;
+  });
+  const alias = directEntry ? parseNpmAliasSpec(directEntry.spec) : null;
+  const packageName = alias?.packageName ?? current.packageName ?? requestedName;
+  return {
+    requestedName,
+    packageName,
+    dependencyName: directEntry?.name ?? requestedName,
+    dependencySpec: directEntry?.spec,
+    dependencyType: directEntry?.type ?? dependencyType(workspaceRoot, requestedName),
+    isNpmAlias: Boolean(alias),
+    current,
+  };
+}
+
+function packageSpecForDependency(
+  resolution: Pick<PackageResolution, "packageName" | "dependencyName" | "isNpmAlias">,
+  version: string,
+): string {
+  if (resolution.isNpmAlias) {
+    return `${resolution.dependencyName}@npm:${resolution.packageName}@${version}`;
+  }
+  return `${resolution.packageName}@${version}`;
 }
 
 function fixtureMetadata(registryDir: string | undefined, packageName: string): {
@@ -348,9 +469,9 @@ export async function createUpgradePlan(
 ): Promise<UpgradePlannerResult> {
   const diagnostics: Diagnostic[] = [];
   const packageManager = detectPackageManager(options.workspaceRoot);
-  const current = currentPackageApi(options.workspaceRoot, options.packageName);
+  const resolution = resolvePackageForUpgrade(options.workspaceRoot, options.packageName);
 
-  if (!current) {
+  if (!resolution) {
     return {
       ok: false,
       diagnostics: [
@@ -363,10 +484,11 @@ export async function createUpgradePlan(
       exitCode: 1,
     };
   }
+  const current = resolution.current;
 
   const targetInfo = await resolveTargetVersion({
     workspaceRoot: options.workspaceRoot,
-    packageName: options.packageName,
+    packageName: resolution.packageName,
     currentVersion: current.version,
     target: options.target,
     registryDir: options.registryDir ?? process.env.FORGE_DEPS_REGISTRY_DIR,
@@ -388,7 +510,7 @@ export async function createUpgradePlan(
 
   const analyzed = await analyzeTargetPackage({
     workspaceRoot: options.workspaceRoot,
-    packageName: options.packageName,
+    packageName: resolution.packageName,
     versionInfo: targetInfo,
     packageManager,
     registryDir: options.registryDir ?? process.env.FORGE_DEPS_REGISTRY_DIR,
@@ -398,7 +520,7 @@ export async function createUpgradePlan(
     return { ok: false, diagnostics, exitCode: 1 };
   }
 
-  const recipe = resolveByPackageName(options.packageName) ?? undefined;
+  const recipe = resolveByPackageName(resolution.packageName) ?? undefined;
   const currentClassified = { api: current, classification: classify(current, recipe), recipe };
   const targetClassified = {
     api: analyzed.api,
@@ -425,7 +547,7 @@ export async function createUpgradePlan(
   }
 
   const affected = analyzeUpgradeImpact({
-    packageName: options.packageName,
+    packageName: resolution.packageName,
     appGraph,
     runtimeGraph,
     queryRegistry,
@@ -436,21 +558,35 @@ export async function createUpgradePlan(
   const bump = semverBump(current.version, analyzed.api.version);
   const risk = buildRiskReport({ bump, apiDiff, runtimeDiff, affected });
   const commands = recommendedCommands(affected);
+  const toInfo = {
+    ...targetInfo,
+    version: analyzed.api.version,
+    spec: packageSpecForDependency(resolution, analyzed.api.version),
+  };
   const planDir = packagePlanDir(
     options.workspaceRoot,
-    options.packageName,
+    resolution.dependencyName,
     current.version,
     analyzed.api.version,
   );
-  const id = `${packageKey(options.packageName)}-${current.version}-to-${analyzed.api.version}`;
+  const id = `${packageKey(resolution.dependencyName)}-${current.version}-to-${analyzed.api.version}`;
   const plan: PackageUpgradePlan = {
     schemaVersion: "0.1.0",
     plannerVersion: GENERATOR_VERSION,
     id,
-    packageName: options.packageName,
+    packageName: resolution.packageName,
+    ...(resolution.requestedName !== resolution.packageName
+      ? { requestedPackageName: resolution.requestedName }
+      : {}),
+    ...(resolution.isNpmAlias ? { dependencyAlias: resolution.dependencyName } : {}),
     ...(recipe?.alias ? { integrationAlias: recipe.alias } : {}),
-    from: { version: current.version, spec: `${options.packageName}@${current.version}` },
-    to: { ...targetInfo, version: analyzed.api.version },
+    from: {
+      version: current.version,
+      spec: resolution.isNpmAlias
+        ? packageSpecForDependency(resolution, current.version)
+        : `${resolution.packageName}@${current.version}`,
+    },
+    to: toInfo,
     packageManager,
     semver: {
       bump,
@@ -512,18 +648,19 @@ export function listOutdatedFromFixture(options: {
 
   return graph.packages
     .flatMap((pkg) => {
-      const metadata = fixtureMetadata(registryDir, pkg.name);
+      const packageName = pkg.packageName ?? pkg.name;
+      const metadata = fixtureMetadata(registryDir, packageName);
       const latest = metadata?.["dist-tags"]?.latest;
       if (!latest || latest === pkg.version) {
         return [];
       }
-      const recipe = resolveByPackageName(pkg.name);
+      const recipe = resolveByPackageName(packageName);
       return [{
-        name: pkg.name,
+        name: packageName,
         current: pkg.version,
         wanted: latest,
         latest,
-        type: dependencyType(options.workspaceRoot, pkg.name),
+        type: dependencyType(options.workspaceRoot, packageName),
         managedByRecipe: Boolean(recipe),
         ...(recipe?.alias ? { recipe: recipe.alias } : {}),
       }];

package/src/forge/compiler/package-upgrades/types.ts

@@ -146,6 +146,8 @@ export interface PackageUpgradePlan {
   plannerVersion: string;
   id: string;
   packageName: string;
+  requestedPackageName?: string;
+  dependencyAlias?: string;
   integrationAlias?: string;
   from: PackageVersionInfo;
   to: PackageVersionInfo;

package/src/forge/compiler/policy-registry/build.ts

@@ -11,6 +11,7 @@ import { hashStable } from "../primitives/hash.ts";
 import { canonicalJson } from "../primitives/serialize.ts";
 import type { AppGraph } from "../types/app-graph.ts";
 import type { DataGraph } from "../types/data-graph.ts";
+import type { ForgeExternalServiceGraph } from "../external-manifest/types.ts";
 import type {
   CommandAuthBinding,
   PermissionMatrix,
@@ -56,15 +57,29 @@ function stableSortQueryAuth(bindings: QueryAuthBinding[]): QueryAuthBinding[] {
 
 function buildPermissionMatrix(policies: PolicyRule[]): PermissionMatrixEntry[] {
   return policies
-    .filter((policy) => policy.kind === "roles")
+    .filter((policy) => policy.kind === "roles" || policy.kind === "permissions")
     .map((policy) => ({
       policy: policy.name,
       roles: [...policy.roles].sort(),
+      permissions: [...policy.permissions].sort(),
     }))
     .sort((a, b) => (a.policy < b.policy ? -1 : a.policy > b.policy ? 1 : 0));
 }
 
-export function buildPolicyRegistry(appGraph: AppGraph): PolicyRegistry {
+function authFromExternalPolicy(policy: string | undefined): CommandAuthBinding["auth"] {
+  if (!policy) {
+    return { kind: "public" };
+  }
+  if (policy === "public" || policy === "system" || policy === "user") {
+    return { kind: policy };
+  }
+  return { kind: "policy", policy };
+}
+
+export function buildPolicyRegistry(
+  appGraph: AppGraph,
+  externalServices?: ForgeExternalServiceGraph,
+): PolicyRegistry {
   const policies: PolicyRule[] = [];
   const commandAuth: CommandAuthBinding[] = [];
   const queryAuth: QueryAuthBinding[] = [];
@@ -84,6 +99,7 @@ export function buildPolicyRegistry(appGraph: AppGraph): PolicyRegistry {
           name: parsed.name,
           kind: parsed.kind,
           roles: parsed.roles,
+          permissions: parsed.permissions,
           file: symbol.file,
           symbolId: symbol.id,
         };
@@ -152,6 +168,28 @@ export function buildPolicyRegistry(appGraph: AppGraph): PolicyRegistry {
     }
   }
 
+  for (const service of externalServices?.services ?? []) {
+    for (const entry of service.entries) {
+      const qualifiedName = `${service.name}.${entry.name}`;
+      const binding = {
+        file: `external:${service.name}`,
+        symbolId: `external:${service.name}:${entry.kind}:${entry.name}`,
+        auth: authFromExternalPolicy(entry.policy),
+      };
+      if (entry.kind === "command") {
+        commandAuth.push({
+          commandName: qualifiedName,
+          ...binding,
+        });
+      } else {
+        queryAuth.push({
+          queryName: qualifiedName,
+          ...binding,
+        });
+      }
+    }
+  }
+
   const sortedPolicies = stableSortPolicies(policies);
   const sortedCommandAuth = stableSortCommandAuth(commandAuth);
   const sortedQueryAuth = stableSortQueryAuth(queryAuth);
@@ -167,6 +205,9 @@ export function buildPolicyRegistry(appGraph: AppGraph): PolicyRegistry {
           code: FORGE_POLICY_UNKNOWN,
           message: `command '${binding.commandName}' references unknown policy '${binding.auth.policy}'`,
           file: binding.file,
+          fixHint: binding.file.startsWith("external:")
+            ? "Define this policy in the Forge app or change the external manifest policy to public, user, or system."
+            : undefined,
         }),
       );
     }
@@ -183,6 +224,9 @@ export function buildPolicyRegistry(appGraph: AppGraph): PolicyRegistry {
           code: FORGE_POLICY_UNKNOWN,
           message: `query '${binding.queryName}' references unknown policy '${binding.auth.policy}'`,
           file: binding.file,
+          fixHint: binding.file.startsWith("external:")
+            ? "Define this policy in the Forge app or change the external manifest policy to public, user, or system."
+            : undefined,
         }),
       );
     }
@@ -195,6 +239,7 @@ export function buildPolicyRegistry(appGraph: AppGraph): PolicyRegistry {
     inputHash: hashStable(
       canonicalJson({
         appInputHash: appGraph.inputHash,
+        externalInputHash: externalServices?.inputHash ?? "",
         analyzerVersion: POLICY_REGISTRY_ANALYZER_VERSION,
       }),
     ),

package/src/forge/compiler/policy-registry/parse.ts

@@ -1,5 +1,7 @@
 const POLICY_ROLE_PATTERN =
   /["']([^"']+)["']\s*:\s*canRole\s*\(\s*([^)]*)\)/g;
+const POLICY_PERMISSION_PATTERN =
+  /["']([^"']+)["']\s*:\s*canPermission\s*\(\s*([^)]*)\)/g;
 
 const COMMAND_AUTH_CAN_PATTERN = /auth\s*:\s*can\s*\(\s*["']([^"']+)["']\s*\)/;
 const COMMAND_AUTH_PUBLIC_PATTERN = /auth\s*:\s*public_\s*\(\s*\)/;
@@ -16,15 +18,28 @@ function parseRolesFromCanRoleArg(arg: string): string[] {
   return roles;
 }
 
+function parseStringsFromArg(arg: string): string[] {
+  const values: string[] = [];
+  for (const match of arg.matchAll(/["']([^"']+)["']/g)) {
+    const value = match[1];
+    if (value && !values.includes(value)) {
+      values.push(value);
+    }
+  }
+  return values;
+}
+
 export function parsePoliciesFromSlice(sourceSlice: string): Array<{
   name: string;
-  kind: "roles" | "public" | "system";
+  kind: "roles" | "permissions" | "public" | "system";
   roles: string[];
+  permissions: string[];
 }> {
   const policies: Array<{
     name: string;
-    kind: "roles" | "public" | "system";
+    kind: "roles" | "permissions" | "public" | "system";
     roles: string[];
+    permissions: string[];
   }> = [];
 
   for (const match of sourceSlice.matchAll(POLICY_ROLE_PATTERN)) {
@@ -37,6 +52,21 @@ export function parsePoliciesFromSlice(sourceSlice: string): Array<{
       name,
       kind: "roles",
       roles: parseRolesFromCanRoleArg(rolesArg),
+      permissions: [],
+    });
+  }
+
+  for (const match of sourceSlice.matchAll(POLICY_PERMISSION_PATTERN)) {
+    const name = match[1];
+    const permissionsArg = match[2] ?? "";
+    if (!name) {
+      continue;
+    }
+    policies.push({
+      name,
+      kind: "permissions",
+      roles: [],
+      permissions: parseStringsFromArg(permissionsArg),
     });
   }
 

package/src/forge/compiler/recipes/definitions.ts

@@ -190,6 +190,67 @@ export const ZOD_RECIPE: IntegrationRecipe = {
   docs: ["zod.md"],
 };
 
+export const CONVEX_RECIPE: IntegrationRecipe = {
+  alias: "convex",
+  packages: [{ packageName: "convex" }],
+  supportedVersionRange: ">=1.0.0",
+  recipeVersion: "1.0.0",
+  contexts: {
+    allowed: ["client", "server", "action", "workflow", "endpoint", "test", "build"],
+    denied: ["shared", "query", "liveQuery", "command", "edge"],
+  },
+  capabilities: networkCapability(
+    ["*.convex.cloud", "*.convex.site"],
+    ["recipe:convex", "Convex client/server package connects to Convex deployments"],
+  ),
+  secrets: [
+    secret("NEXT_PUBLIC_CONVEX_URL", false),
+    secret("CONVEX_URL", false),
+    secret("CONVEX_DEPLOYMENT", false),
+    secret("CONVEX_DEPLOY_KEY", false),
+  ],
+  adapters: [],
+  testkits: ["convex.mock.ts"],
+  docs: ["convex.md"],
+};
+
+export const WORKOS_RECIPE: IntegrationRecipe = {
+  alias: "workos",
+  packages: [{ packageName: "@workos-inc/node" }],
+  supportedVersionRange: ">=10.0.0",
+  recipeVersion: "1.0.0",
+  contexts: {
+    allowed: ["server", "action", "workflow", "endpoint", "test", "build"],
+    denied: ["shared", "client", "query", "liveQuery", "command", "edge"],
+  },
+  capabilities: networkCapability(
+    ["api.workos.com"],
+    ["recipe:workos", "WorkOS SDK calls AuthKit, Organizations, Admin Portal, and FGA APIs"],
+  ),
+  secrets: [
+    secret("WORKOS_API_KEY"),
+    secret("WORKOS_CLIENT_ID"),
+    secret("WORKOS_COOKIE_PASSWORD"),
+    secret("WORKOS_REDIRECT_URI", false),
+    secret("WORKOS_WEBHOOK_SECRET", false),
+  ],
+  adapters: ["workos.server.ts"],
+  integrations: [
+    "workos/authkit.ts",
+    "workos/auth-routes.ts",
+    "workos/fga.ts",
+    "workos/http-handler.ts",
+    "workos/resource-map.ts",
+    "workos/seed.ts",
+    "workos/session.ts",
+    "workos/webhook.ts",
+    "workos/workos-seed.yml",
+  ],
+  rootFiles: [".env.example", "src/policies.workos.ts", "web/src/lib/workos-auth.tsx", "workos-seed.yml"],
+  testkits: ["workos.mock.ts"],
+  docs: ["workos.md"],
+};
+
 export const FORGE_RECIPE: IntegrationRecipe = {
   alias: "forge",
   packages: [{ packageName: "forge" }],
@@ -283,6 +344,8 @@ export const REFERENCE_ALIASES = [
   "posthog",
   "sentry",
   "zod",
+  "convex",
+  "workos",
   "ai",
 ] as const;
 

package/src/forge/compiler/recipes/index.ts

@@ -15,6 +15,8 @@ export {
   POSTHOG_RECIPE,
   SENTRY_RECIPE,
   ZOD_RECIPE,
+  CONVEX_RECIPE,
+  WORKOS_RECIPE,
   AI_RECIPE,
   AI_PROVIDER_RECIPES,
 } from "./definitions.ts";

package/src/forge/compiler/recipes/registry.ts

@@ -3,11 +3,13 @@ import type { PackageRecipe } from "../types/integration.ts";
 import {
   AI_PROVIDER_RECIPES,
   AI_RECIPE,
+  CONVEX_RECIPE,
   FORGE_RECIPE,
   POSTHOG_RECIPE,
   REFERENCE_ALIASES,
   SENTRY_RECIPE,
   STRIPE_RECIPE,
+  WORKOS_RECIPE,
   ZOD_RECIPE,
 } from "./definitions.ts";
 
@@ -23,6 +25,8 @@ const REFERENCE_RECIPES: Record<string, IntegrationRecipe> = {
   posthog: POSTHOG_RECIPE,
   sentry: SENTRY_RECIPE,
   zod: ZOD_RECIPE,
+  convex: CONVEX_RECIPE,
+  workos: WORKOS_RECIPE,
   forge: FORGE_RECIPE,
   ai: AI_RECIPE,
 };
@@ -32,6 +36,8 @@ const ALL_RECIPES: IntegrationRecipe[] = [
   POSTHOG_RECIPE,
   SENTRY_RECIPE,
   ZOD_RECIPE,
+  CONVEX_RECIPE,
+  WORKOS_RECIPE,
   FORGE_RECIPE,
   AI_RECIPE,
   ...AI_PROVIDER_RECIPES,

package/src/forge/compiler/test-graph/build.ts

@@ -16,6 +16,14 @@ import type {
 
 const TEST_RE = /\.(test|spec)\.(ts|tsx)$/;
 
+function isTemporaryTestPath(path: string): boolean {
+  return path.split("/").some((segment) => segment === ".tmp" || segment === "__tmp__");
+}
+
+function isTestGraphCandidate(path: string): boolean {
+  return TEST_RE.test(path) && !isTemporaryTestPath(path);
+}
+
 function emptyCoverage(): TestCoverage {
   return {
     commands: [],
@@ -40,7 +48,7 @@ function collectTestsFromDisk(workspaceRoot: string): SourceFile[] {
   const { sources } = walkWorkspaceSources({
     workspaceRoot,
     roots: ["tests", "web"],
-    excludeRelativePath: (path) => !TEST_RE.test(path),
+    excludeRelativePath: (path) => !isTestGraphCandidate(path),
   });
   return sources.sort((a, b) => a.path.localeCompare(b.path));
 }
@@ -208,7 +216,7 @@ export function buildTestGraph(input: {
   const diskTests = collectTestsFromDisk(input.workspaceRoot);
   const byPath = new Map<string, SourceFile>();
   for (const source of input.sources) {
-    if (TEST_RE.test(source.path)) {
+    if (isTestGraphCandidate(source.path)) {
       byPath.set(source.path, source);
     }
   }
@@ -216,7 +224,7 @@ export function buildTestGraph(input: {
     byPath.set(source.path, source);
   }
 
-  const allSources = [...input.sources.filter((s) => TEST_RE.test(s.path)), ...diskTests];
+  const allSources = [...input.sources.filter((s) => isTestGraphCandidate(s.path)), ...diskTests];
   const tests: TestGraphEntry[] = [...byPath.values()]
     .sort((a, b) => a.path.localeCompare(b.path))
     .map((source) => {

package/src/forge/compiler/types/app-graph.ts

@@ -13,7 +13,13 @@ export type ForgeKind =
   | "workflow"
   | "agent"
   | "aiTool"
-  | "telemetryEvent";
+  | "telemetryEvent"
+  | "code.function"
+  | "code.class"
+  | "code.interface"
+  | "code.type"
+  | "code.const"
+  | "code.enum";
 
 export interface ForgeSymbol {
   id: string;
@@ -26,7 +32,7 @@ export interface ForgeSymbol {
   meta: Record<string, JsonValue>;
 }
 
-export type ForgeEdgeKind = "references" | "registers" | "guards" | "emits";
+export type ForgeEdgeKind = "references" | "registers" | "guards" | "emits" | "imports";
 
 export interface ForgeEdge {
   from: string;