forgeos 0.1.0-alpha.4 → 0.1.0-alpha.41

package/src/forge/make/index.ts

@@ -21,6 +21,13 @@ import {
   renderListQuery,
   renderLiveQuery,
   renderNextAiPackage,
+  renderNuxtApp,
+  renderNuxtConfig,
+  renderNuxtForgeComposable,
+  renderNuxtForgePlugin,
+  renderNuxtPackage,
+  renderNuxtStatusComponent,
+  renderNuxtTsconfig,
   renderPage,
   renderPlaceholderTest,
   renderPolicyFile,
@@ -107,7 +114,7 @@ const EXPLANATIONS: Record<MakeIntent["kind"], string> = {
   page:
     "Adds a minimal app page under web/app/<route>/page.tsx.",
   ui:
-    "Adds a minimal Vite React web app with ForgeProvider devAuth and a generated client bridge.",
+    "Adds a minimal Vite React or Nuxt Vue web app with generated Forge client bindings.",
   "ai-chat":
     "Adds a Forge AI agent definition and a React chat component that calls the Forge /ai/agents/run runtime endpoint.",
   resource:
@@ -193,6 +200,13 @@ function chooseSchemaFile(workspaceRoot: string): string {
   return "src/forge/schema.ts";
 }
 
+function schemaHasTenantsTable(workspaceRoot: string): boolean {
+  const schema = readIfExists(workspaceRoot, chooseSchemaFile(workspaceRoot)) ?? "";
+  return schema.includes('name: "tenants"') ||
+    schema.includes("name: 'tenants'") ||
+    /\btenants\s*=\s*(?:defineTable|table)\s*\(/.test(schema);
+}
+
 function choosePolicyFile(workspaceRoot: string): string {
   if (fileExists(workspaceRoot, "src/policies.ts")) {
     return "src/policies.ts";
@@ -461,9 +475,14 @@ function parseFieldOptions(options: MakeCommandOptions): {
   field?: MakeFieldSpec;
   diagnostics: Diagnostic[];
 } {
+  const fieldSpecs = options.fieldSpecs.map((fieldSpec) =>
+    options.values && /^[a-zA-Z][a-zA-Z0-9_]*:enum(?::|$)/.test(fieldSpec)
+      ? fieldSpec.replace(":enum", `:enum(${options.values})`)
+      : fieldSpec,
+  );
   const rawFields = [
     ...(options.fieldsRaw ? [options.fieldsRaw] : []),
-    ...options.fieldSpecs,
+    ...fieldSpecs,
   ];
   const parsed = parseFields(rawFields);
   const diagnostics = [...parsed.diagnostics];
@@ -513,7 +532,7 @@ function buildIntent(options: MakeCommandOptions): {
   const kind = options.primitive as MakeIntent["kind"];
   const fieldOptions = parseFieldOptions(options);
   const diagnostics = [...fieldOptions.diagnostics];
-  if (options.framework && !["vite", "next"].includes(options.framework)) {
+  if (options.framework && !["vite", "next", "nuxt"].includes(options.framework)) {
     diagnostics.push(
       diagnostic("error", "FORGE_MAKE_PATCH_UNSAFE", `unsupported frontend framework '${options.framework}'`),
     );
@@ -523,7 +542,7 @@ function buildIntent(options: MakeCommandOptions): {
       diagnostic(
         "warning",
         "FORGE_MAKE_UI_FRAMEWORK_EXPERIMENTAL",
-        "forge make ui currently generates the Vite React bridge; Next support should use the b2b-support-web template",
+        "forge make ui currently generates Vite React and Nuxt Vue bridges; Next support should use the b2b-support-web template",
       ),
     );
   }
@@ -544,6 +563,8 @@ function buildIntent(options: MakeCommandOptions): {
     kind === "command"
       ? actionName?.replace(/^(create|update|delete)/, "") || "create"
       : "read";
+  const tenantScoped =
+    options.tenantScoped || (kind === "resource" && schemaHasTenantsTable(options.workspaceRoot));
 
   return {
     diagnostics,
@@ -553,7 +574,7 @@ function buildIntent(options: MakeCommandOptions): {
       table,
       field: fieldOptions.field,
       fields,
-      tenantScoped: options.tenantScoped || kind === "resource",
+      tenantScoped,
       crud: options.withCrud || kind === "resource",
       liveQuery: options.withLiveQuery || kind === "resource" || kind === "livequery",
       react:
@@ -574,6 +595,7 @@ function buildIntent(options: MakeCommandOptions): {
       trigger: options.trigger ?? options.event ?? (table ? `${singular}.created` : undefined),
       component: options.component,
       route: options.name ? kebabCase(options.name) : undefined,
+      framework: options.framework,
       withAi: options.withAi || kind === "ai-chat",
       withCreateForm: options.withCreateForm || kind === "resource",
     },
@@ -794,6 +816,18 @@ function addFrontendFiles(plan: MakePlan, workspaceRoot: string, intent: MakeInt
     return;
   }
   if (intent.kind === "ui") {
+    if (intent.framework === "nuxt") {
+      plan.filesToCreate.push(
+        createFile(workspaceRoot, "web/package.json", "Add Nuxt web package", renderNuxtPackage(intent.name)),
+        createFile(workspaceRoot, "web/nuxt.config.ts", "Add Nuxt runtime config", renderNuxtConfig()),
+        createFile(workspaceRoot, "web/tsconfig.json", "Add Nuxt TypeScript config", renderNuxtTsconfig()),
+        createFile(workspaceRoot, "web/composables/forge.ts", "Add Forge Vue composable bridge", renderNuxtForgeComposable()),
+        createFile(workspaceRoot, "web/plugins/forge.ts", "Add Forge Nuxt plugin", renderNuxtForgePlugin()),
+        createFile(workspaceRoot, "web/app.vue", "Add Nuxt app shell", renderNuxtApp()),
+        createFile(workspaceRoot, "web/components/ForgeStatus.vue", "Add Forge status component", renderNuxtStatusComponent()),
+      );
+      return;
+    }
     plan.filesToCreate.push(
       createFile(workspaceRoot, "web/package.json", "Add Vite React web package", renderVitePackage(intent.name)),
       createFile(workspaceRoot, "web/tsconfig.json", "Add web TypeScript config", renderViteTsconfig()),
@@ -878,7 +912,7 @@ function buildPlan(options: MakeCommandOptions): MakePlan {
     kind: "resource" as const,
     name: options.name ?? "resource",
     fields: [],
-    tenantScoped: true,
+    tenantScoped: false,
     crud: true,
     liveQuery: true,
     react: true,

package/src/forge/make/templates.ts

@@ -637,9 +637,9 @@ export function renderVitePackage(appName: string): string {
   },
   "dependencies": {
     "@ai-sdk/react": "^3.0.0",
-    "@vitejs/plugin-react": "^4.3.4",
+    "@vitejs/plugin-react": "^6.0.2",
     "ai": "^6.0.0",
-    "vite": "^6.0.5",
+    "vite": "^8.0.16",
     "react": "^19.0.0",
     "react-dom": "^19.0.0"
   },
@@ -652,6 +652,159 @@ export function renderVitePackage(appName: string): string {
 `;
 }
 
+export function renderNuxtPackage(appName: string): string {
+  return `{
+  "name": "${kebabCase(appName)}-web",
+  "private": true,
+  "type": "module",
+  "scripts": {
+    "dev": "nuxt dev --host 127.0.0.1",
+    "build": "nuxt build",
+    "typecheck": "nuxt typecheck"
+  },
+  "dependencies": {
+    "nuxt": "^4.0.0",
+    "vue": "^3.5.38"
+  },
+  "devDependencies": {
+    "typescript": "^5.7.3"
+  }
+}
+`;
+}
+
+export function renderNuxtConfig(): string {
+  return `export default defineNuxtConfig({
+  compatibilityDate: "2026-06-18",
+  runtimeConfig: {
+    public: {
+      forgeUrl: process.env.NUXT_PUBLIC_FORGE_URL ?? "http://127.0.0.1:3765",
+    },
+  },
+  typescript: {
+    strict: true,
+  },
+});
+`;
+}
+
+export function renderNuxtTsconfig(): string {
+  return `{
+  "extends": "./.nuxt/tsconfig.json"
+}
+`;
+}
+
+export function renderNuxtForgeComposable(): string {
+  return `export const forgeUrl = "http://127.0.0.1:3765";
+
+export { api } from "../../src/forge/_generated/api";
+export { createForgeClient, ForgeError } from "../../src/forge/_generated/client";
+export {
+  ForgeVuePlugin,
+  provideForge,
+  useForgeAuth,
+  useForgeClient,
+  useForgeCommand,
+  useForgeLiveQuery,
+  useForgeQuery,
+} from "../../src/forge/_generated/vue";
+`;
+}
+
+export function renderNuxtForgePlugin(): string {
+  return `import { ForgeVuePlugin } from "../composables/forge";
+
+export default defineNuxtPlugin((nuxtApp) => {
+  const config = useRuntimeConfig();
+
+  nuxtApp.vueApp.use(ForgeVuePlugin, {
+    url: String(config.public.forgeUrl),
+    devAuth: true,
+  });
+});
+`;
+}
+
+export function renderNuxtApp(): string {
+  return `<script setup lang="ts">
+import ForgeStatus from "./components/ForgeStatus.vue";
+</script>
+
+<template>
+  <main class="shell">
+    <p class="eyebrow">ForgeOS Nuxt app</p>
+    <h1>Full-stack loop ready</h1>
+    <ForgeStatus />
+  </main>
+</template>
+
+<style scoped>
+.shell {
+  width: min(760px, calc(100vw - 32px));
+  margin: 0 auto;
+  padding: 48px 0;
+}
+
+.eyebrow {
+  color: #58655f;
+  font-size: 0.82rem;
+  font-weight: 800;
+  text-transform: uppercase;
+}
+
+h1 {
+  margin: 0 0 12px;
+  color: #17211d;
+  font-size: 2.2rem;
+}
+</style>
+`;
+}
+
+export function renderNuxtStatusComponent(): string {
+  return `<script setup lang="ts">
+import { computed } from "vue";
+import { useForgeAuth } from "../composables/forge";
+
+const auth = useForgeAuth();
+const tenantLabel = computed(() => auth?.tenantId ?? "dev-tenant");
+const roleLabel = computed(() => auth?.role ?? "owner");
+</script>
+
+<template>
+  <section class="status-panel">
+    <span class="status-dot" aria-hidden="true" />
+    <p>
+      Connected as <strong>{{ roleLabel }}</strong> on
+      <strong>{{ tenantLabel }}</strong>.
+    </p>
+  </section>
+</template>
+
+<style scoped>
+.status-panel {
+  display: flex;
+  align-items: center;
+  gap: 10px;
+  margin-top: 24px;
+  color: #26332d;
+}
+
+.status-dot {
+  width: 10px;
+  height: 10px;
+  border-radius: 999px;
+  background: #1f9d55;
+}
+
+p {
+  margin: 0;
+}
+</style>
+`;
+}
+
 export function renderNextAiPackage(appName: string): string {
   return `{
   "name": "${kebabCase(appName)}-web",

package/src/forge/make/types.ts

@@ -61,6 +61,7 @@ export interface MakeIntent {
   trigger?: string;
   component?: string;
   route?: string;
+  framework?: "vite" | "next" | "nuxt";
   withAi: boolean;
   withCreateForm: boolean;
 }
@@ -130,7 +131,7 @@ export interface MakeCommandOptions {
   event?: string;
   trigger?: string;
   component?: string;
-  framework?: "vite" | "next";
+  framework?: "vite" | "next" | "nuxt";
   withAi: boolean;
   withCrud: boolean;
   withLiveQuery: boolean;

package/src/forge/policy.ts

@@ -1 +1 @@
-export { can, canRole, definePolicies, public_ } from "./server.ts";
+export { can, canPermission, canRole, definePolicies, public_ } from "./server.ts";

package/src/forge/react/index.ts

@@ -3,7 +3,12 @@ import * as React from "react";
 export type ForgeReactAuth = {
   userId?: string;
   tenantId?: string;
+  organizationId?: string;
+  organizationMembershipId?: string;
   role?: string;
+  roles?: string[];
+  permissions?: string[];
+  claims?: Record<string, unknown>;
   token?: string;
   getToken?: () => string | Promise<string>;
   headers?: Record<string, string>;
@@ -24,7 +29,12 @@ export type ForgeDevAuthConfig =
   | {
       userId?: string;
       tenantId?: string;
+      organizationId?: string;
+      organizationMembershipId?: string;
       role?: string;
+      roles?: string[];
+      permissions?: string[];
+      claims?: Record<string, unknown>;
       headers?: Record<string, string>;
     };
 
@@ -35,6 +45,22 @@ export type ForgeReactError = Error & {
   details?: unknown;
 };
 
+export type ForgeCommandCallResult<T = unknown> =
+  | {
+      ok: true;
+      result: T;
+      status: number;
+      traceId?: string;
+      diagnostics?: { code: string; message: string }[];
+    }
+  | {
+      ok: false;
+      error: { code: string; message: string; details?: unknown };
+      status: number;
+      traceId?: string;
+      diagnostics?: { code: string; message: string }[];
+    };
+
 export type LiveSnapshot<T> = {
   subscriptionId: string;
   revision: number;
@@ -46,6 +72,7 @@ export type ForgeReactClient = {
   lastTraceId?: string;
   query(name: string, args: unknown): Promise<unknown>;
   command(name: string, args: unknown): Promise<unknown>;
+  commandResult?(name: string, args: unknown): Promise<ForgeCommandCallResult<unknown>>;
   liveQuery(
     name: string,
     args: unknown,
@@ -86,6 +113,22 @@ export type UseCommandResult<TArgs, TResult> = {
   reset: () => void;
 };
 
+export type UseCommandResultOptions<TResult> = {
+  onSuccess?: (result: TResult) => void;
+  onError?: (error: ForgeReactError) => void;
+  onSettled?: (result: ForgeCommandCallResult<TResult>) => void;
+};
+
+export type UseCommandResultHook<TArgs, TResult> = {
+  run: (args: TArgs) => Promise<ForgeCommandCallResult<TResult>>;
+  loading: boolean;
+  error: ForgeReactError | null;
+  result: ForgeCommandCallResult<TResult> | undefined;
+  data: TResult | undefined;
+  traceId?: string;
+  reset: () => void;
+};
+
 export type UseLiveQueryOptions = {
   enabled?: boolean;
 };
@@ -113,6 +156,10 @@ export type ForgeReactBindings<TClient extends ForgeReactClient = ForgeReactClie
     name: string,
     options?: UseCommandOptions<TResult>,
   ) => UseCommandResult<TArgs, TResult>;
+  useCommandResult: <TArgs = unknown, TResult = unknown>(
+    name: string,
+    options?: UseCommandResultOptions<TResult>,
+  ) => UseCommandResultHook<TArgs, TResult>;
   useLiveQuery: <TResult = unknown>(
     name: string,
     args: unknown,
@@ -155,6 +202,29 @@ function toForgeError(error: unknown): ForgeReactError {
   return wrapped;
 }
 
+function commandErrorToForgeError(result: Extract<ForgeCommandCallResult, { ok: false }>): ForgeReactError {
+  const error = new Error(result.error.message) as ForgeReactError;
+  error.code = result.error.code;
+  error.status = result.status;
+  error.traceId = result.traceId;
+  error.details = result.error.details ?? result.diagnostics;
+  return error;
+}
+
+function caughtErrorToCommandResult(error: unknown): ForgeCommandCallResult<never> {
+  const forgeError = toForgeError(error);
+  return {
+    ok: false,
+    status: forgeError.status ?? 0,
+    traceId: forgeError.traceId,
+    error: {
+      code: forgeError.code ?? "FORGE_REACT_COMMAND_FAILED",
+      message: forgeError.message,
+      details: forgeError.details,
+    },
+  };
+}
+
 function resolveDevAuth(devAuth: ForgeDevAuthConfig | undefined): ForgeReactAuthProvider | undefined {
   if (!devAuth) {
     return undefined;
@@ -162,9 +232,16 @@ function resolveDevAuth(devAuth: ForgeDevAuthConfig | undefined): ForgeReactAuth
   const config = typeof devAuth === "object" ? devAuth : {};
   return {
     userId: config.userId ?? "dev-user",
-    tenantId: config.tenantId ?? "dev-tenant",
+    tenantId: config.tenantId ?? config.organizationId ?? "dev-tenant",
     role: config.role ?? "owner",
-    headers: config.headers,
+    ...(config.organizationId ? { organizationId: config.organizationId } : {}),
+    ...(config.organizationMembershipId
+      ? { organizationMembershipId: config.organizationMembershipId }
+      : {}),
+    ...(config.roles ? { roles: config.roles } : {}),
+    ...(config.permissions ? { permissions: config.permissions } : {}),
+    ...(config.claims ? { claims: config.claims } : {}),
+    ...(config.headers ? { headers: config.headers } : {}),
   };
 }
 
@@ -327,6 +404,86 @@ export function createForgeReactBindings<TClient extends ForgeReactClient>(
     };
   }
 
+  function useCommandResult<TArgs = unknown, TResult = unknown>(
+    name: string,
+    options?: UseCommandResultOptions<TResult>,
+  ): UseCommandResultHook<TArgs, TResult> {
+    const client = useForgeClient();
+    const [state, setState] = React.useState<{
+      loading: boolean;
+      error: ForgeReactError | null;
+      result: ForgeCommandCallResult<TResult> | undefined;
+      data: TResult | undefined;
+      traceId?: string;
+    }>({
+      loading: false,
+      error: null,
+      result: undefined,
+      data: undefined,
+    });
+
+    const run = React.useCallback(
+      async (args: TArgs): Promise<ForgeCommandCallResult<TResult>> => {
+        setState((prev) => ({ ...prev, loading: true, error: null }));
+        let result: ForgeCommandCallResult<TResult>;
+        if (typeof client.commandResult === "function") {
+          result = (await client.commandResult(name, args)) as ForgeCommandCallResult<TResult>;
+        } else {
+          try {
+            const data = (await client.command(name, args)) as TResult;
+            result = {
+              ok: true,
+              result: data,
+              status: 200,
+              traceId: client.lastTraceId,
+            };
+          } catch (error) {
+            result = caughtErrorToCommandResult(error);
+          }
+        }
+
+        if (result.ok) {
+          setState({
+            loading: false,
+            error: null,
+            result,
+            data: result.result,
+            traceId: result.traceId ?? client.lastTraceId,
+          });
+          options?.onSuccess?.(result.result);
+        } else {
+          const forgeError = commandErrorToForgeError(result);
+          setState({
+            loading: false,
+            error: forgeError,
+            result,
+            data: undefined,
+            traceId: result.traceId,
+          });
+          options?.onError?.(forgeError);
+        }
+        options?.onSettled?.(result);
+        return result;
+      },
+      [client, name, options?.onError, options?.onSettled, options?.onSuccess],
+    );
+
+    const reset = React.useCallback(() => {
+      setState({
+        loading: false,
+        error: null,
+        result: undefined,
+        data: undefined,
+      });
+    }, []);
+
+    return {
+      ...state,
+      run,
+      reset,
+    };
+  }
+
   function useLiveQuery<TResult = unknown>(
     name: string,
     args: unknown,
@@ -413,6 +570,7 @@ export function createForgeReactBindings<TClient extends ForgeReactClient>(
     useAuth,
     useQuery,
     useCommand,
+    useCommandResult,
     useLiveQuery,
   };
 }

package/src/forge/refactor/index.ts

@@ -420,6 +420,7 @@ function createCommandProgram(
     module: ts.ModuleKind.ESNext,
     moduleResolution: ts.ModuleResolutionKind.Bundler,
     noEmit: true,
+    noLib: true,
     skipLibCheck: true,
     strict: true,
     target: ts.ScriptTarget.ES2022,

package/src/forge/repair/rules/index.ts

@@ -228,7 +228,7 @@ export const repairRules: RepairRule[] = [
         failureKind: "secrets",
         code: "FORGE_SECRET_DIRECT_PROCESS_ENV",
         summary: `Secret/config usage is unsafe or missing for ${secret}.`,
-        likelyCause: "Code reads process.env directly, accesses secrets in a forbidden runtime, or the environment lacks a required secret.",
+        likelyCause: "Code reads secret/config values through process.env in Forge runtime code, accesses secrets in a forbidden runtime, or the environment lacks a required secret.",
         confidence: "high",
         suggestedRepairs: [
           {
@@ -466,7 +466,7 @@ export function explainDiagnostic(code: string): string {
     FORGE_GUARD_VIOLATION: "A package or capability is used in a runtime context where it is forbidden. Move side effects to actions/workflows.",
     FORGE_POLICY_UNKNOWN: "A runtime entry references a missing policy. Create or correct the policy, then simulate expected roles.",
     FORGE_POLICY_DENIED: "The caller auth context does not satisfy the policy. Fix test auth or intentionally update policy roles.",
-    FORGE_SECRET_DIRECT_PROCESS_ENV: "Code reads process.env directly. Use ctx.secrets/ctx.config in allowed runtime contexts.",
+    FORGE_SECRET_DIRECT_PROCESS_ENV: "Code reads secret/config values through process.env in Forge runtime code. Use ctx.secrets/ctx.config in allowed runtime contexts.",
     FORGE_AI_FORBIDDEN_CONTEXT: "AI is being used in a deterministic context. Move AI calls to action/workflow/server runtime.",
     FORGE_WORKFLOW_STEP_FAILED: "A workflow step failed. Inspect the workflow run and trace before retrying.",
     FORGE_OUTBOX_PROCESS_FAILED: "An outbox delivery failed. Inspect the subscribed action and retry after fixing the cause.",