forgeos 0.1.0-alpha.46 → 0.1.0-alpha.47

package/AGENTS.md

@@ -1,4 +1,4 @@
-// @forge-generated generator=0.1.0-alpha.46 input=fa019b5420e754f08100c96852edfc9ea0b39a6b050cbd9bc99106b88775c207 content=721818a6f9a664aa898092d4aa5cd68cbbd8ad6e150c7d3ad3ef785a2e3fcf53
+// @forge-generated generator=0.1.0-alpha.47 input=2bfccc8587b228260a6fa7172aa13b90311bacf5c1ddfa549d864e057cb0c6bf content=721818a6f9a664aa898092d4aa5cd68cbbd8ad6e150c7d3ad3ef785a2e3fcf53
 # AGENTS.md
 
 <!-- forge-generated:start -->

package/CHANGELOG.md

@@ -1,5 +1,23 @@
 # forgeos
 
+## 0.1.0-alpha.47
+
+### Patch Changes
+
+- Tighten the WorkOS real-auth proof and production deploy readiness gates.
+
+  - `forge workos setup --real` and `forge workos prove --real` now validate
+    the real OIDC/JWT and WorkOS environment before attempting hosted setup,
+    with specific failed checks such as `setup:real-env-forge_auth_audience`
+    instead of a generic setup failure.
+  - `forge deploy check --production` now requires WorkOS-backed apps to carry
+    hosted seed evidence in `.workos-seed-state.json` that matches the current
+    `workos-seed.yml`, pointing operators at `forge workos prove --real` when
+    hosted seed state is missing or stale.
+  - Update production, self-hosting, and field-test documentation so local mock
+    field-test evidence, hosted WorkOS seed evidence, and deploy env evidence
+    have clear boundaries.
+
 ## 0.1.0-alpha.46
 
 ### Patch Changes

package/docs/changelog.md

@@ -6,6 +6,19 @@ The canonical source file in the repository is `CHANGELOG.md`.
 
 ## Unreleased
 
+## 0.1.0-alpha.47
+
+- `forge workos setup --real` and `forge workos prove --real` now validate the
+  real OIDC/JWT and WorkOS environment before hosted setup, surfacing exact
+  failed checks like `setup:real-env-forge_auth_audience`.
+- `forge deploy check --production` now requires WorkOS-backed apps to include
+  hosted seed evidence in `.workos-seed-state.json` matching the current
+  `workos-seed.yml`, with a direct `forge workos prove --real --file
+  workos-seed.yml --json` remediation.
+- Clarified production, self-host, and field-test docs so local mock evidence,
+  hosted WorkOS seed evidence, and production deploy env evidence are treated
+  as separate gates.
+
 ## 0.1.0-alpha.46
 
 - `forge deps upgrade-apply` and `forge deps upgrade-rollback` now accept the

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "forgeos",
-  "version": "0.1.0-alpha.46",
+  "version": "0.1.0-alpha.47",
   "description": "Agent-native application framework and compiler for building Forge apps without a mandatory dashboard.",
   "type": "module",
   "license": "MIT",

package/src/forge/_generated/releaseManifest.json

@@ -1 +1 @@
-{"defaultProvider":"local","diagnostics":[],"env":{"deployEnv":"FORGE_DEPLOY_ENV","deployId":"FORGE_DEPLOY_ID","publicReleaseId":"NEXT_PUBLIC_FORGE_RELEASE_ID","releaseId":"FORGE_RELEASE_ID"},"gitSha":"unknown","optionalProviders":["local","sentry-compatible","sentry","glitchtip","bugsink","otel","custom"],"packageName":"forgeos","packageVersion":"0.1.0-alpha.46","releaseId":"forgeos@0.1.0-alpha.46+unknown","schemaVersion":"0.1.0"}
+{"defaultProvider":"local","diagnostics":[],"env":{"deployEnv":"FORGE_DEPLOY_ENV","deployId":"FORGE_DEPLOY_ID","publicReleaseId":"NEXT_PUBLIC_FORGE_RELEASE_ID","releaseId":"FORGE_RELEASE_ID"},"gitSha":"unknown","optionalProviders":["local","sentry-compatible","sentry","glitchtip","bugsink","otel","custom"],"packageName":"forgeos","packageVersion":"0.1.0-alpha.47","releaseId":"forgeos@0.1.0-alpha.47+unknown","schemaVersion":"0.1.0"}

package/src/forge/_generated/releaseManifest.ts

@@ -1,4 +1,4 @@
-// @forge-generated generator=0.1.0-alpha.46 input=fa019b5420e754f08100c96852edfc9ea0b39a6b050cbd9bc99106b88775c207 content=715d49dd9abed8465a5cf5e82713973aab97cc178fda3b1e8b1647b93683ee58
+// @forge-generated generator=0.1.0-alpha.47 input=2bfccc8587b228260a6fa7172aa13b90311bacf5c1ddfa549d864e057cb0c6bf content=8f94368d298a28e68f6aaaf12350b8c58f890a4dc0d060299824515dce02cae6
 export const releaseManifest = {
   "defaultProvider": "local",
   "diagnostics": [],
@@ -19,7 +19,7 @@ export const releaseManifest = {
     "custom"
   ],
   "packageName": "forgeos",
-  "packageVersion": "0.1.0-alpha.46",
-  "releaseId": "forgeos@0.1.0-alpha.46+unknown",
+  "packageVersion": "0.1.0-alpha.47",
+  "releaseId": "forgeos@0.1.0-alpha.47+unknown",
   "schemaVersion": "0.1.0"
 } as const;

package/src/forge/cli/deploy.ts

@@ -609,6 +609,18 @@ Required production posture:
 - issuer, audience, and JWKS/discovery settings match the auth provider
 - any provider secrets listed in the example are set in the deployment secret store
 
+For WorkOS-backed apps, local dry-runs are not enough for production deploy
+readiness. Run:
+
+\`\`\`bash
+forge workos prove --real --file workos-seed.yml --json
+\`\`\`
+
+This applies or confirms hosted WorkOS config/seed through the WorkOS CLI and
+writes \`.workos-seed-state.json\`. \`forge deploy check --production\` requires
+that state to match the current \`workos-seed.yml\` before treating WorkOS
+posture as production evidence.
+
 ## 2. Prove the app before traffic
 
 \`\`\`bash
@@ -616,6 +628,7 @@ forge generate --check --json
 forge check --json
 forge authmd generate --json
 forge auth prove --scenario multi-tenant --json
+forge workos prove --real --file workos-seed.yml --json
 forge field-test run --realistic --json
 forge deploy check --production --json
 \`\`\`
@@ -825,6 +838,21 @@ async function buildChecks(options: DeployCommandOptions): Promise<DeployCommand
       command: "forge workos doctor --json",
       details: workosDoctor.checks,
     });
+    const workosData = workosDoctor.data && typeof workosDoctor.data === "object"
+      ? workosDoctor.data as { seedState?: { exists?: boolean; valid?: boolean; matchesSeedHash?: boolean | null; alreadyApplied?: boolean } }
+      : {};
+    const seedState = workosData.seedState;
+    const hostedSeedOk = Boolean(seedState?.exists && seedState.valid && seedState.matchesSeedHash === true);
+    checks.push({
+      name: "workos-hosted-seed",
+      ok: !options.production || hostedSeedOk,
+      severity: options.production ? "error" : "warning",
+      message: hostedSeedOk
+        ? `WorkOS hosted seed state matches workos-seed.yml${seedState?.alreadyApplied ? " and records idempotent existing resources" : ""}`
+        : "WorkOS production deploy requires hosted seed evidence matching workos-seed.yml",
+      command: "forge workos prove --real --file workos-seed.yml --json",
+      details: seedState,
+    });
   }
   const tenantProofRequired = auth.requiresTenant || hasWorkOSIntegration(options.workspaceRoot);
   const tenantProof = tenantProofRequired

package/src/forge/cli/workos.ts

@@ -329,6 +329,34 @@ function workosJwksUri(clientId: string | undefined): string {
   return clientId ? `https://api.workos.com/sso/jwks/${clientId}` : "https://api.workos.com/sso/jwks/<WORKOS_CLIENT_ID>";
 }
 
+function collectWorkOSRealEnvChecks(workspaceRoot: string): WorkOSCheck[] {
+  const env = readRealEnv(workspaceRoot);
+  const authMode = env.FORGE_AUTH_MODE;
+  const clientId = env.WORKOS_CLIENT_ID || env.VITE_WORKOS_CLIENT_ID;
+  const required = [
+    ["WORKOS_API_KEY", "WorkOS API key is required to apply hosted seed/config"],
+    ["WORKOS_CLIENT_ID", "WorkOS client ID is required for AuthKit and JWKS discovery"],
+    ["WORKOS_COOKIE_PASSWORD", "cookie password is required for AuthKit session signing"],
+    ["FORGE_AUTH_ISSUER", "Forge OIDC issuer must be https://api.workos.com"],
+    ["FORGE_AUTH_AUDIENCE", "Forge OIDC audience must match the WorkOS client/application audience"],
+    ["FORGE_AUTH_JWKS_URI", `Forge JWKS URI must be configured, usually ${workosJwksUri(clientId)}`],
+  ] as const;
+  return [
+    {
+      name: "real-env-auth-mode",
+      ok: authMode === "oidc" || authMode === "jwt",
+      detail: authMode === "oidc" || authMode === "jwt"
+        ? `FORGE_AUTH_MODE=${authMode} is production-capable`
+        : "FORGE_AUTH_MODE must be oidc or jwt before running hosted WorkOS proof",
+    },
+    ...required.map(([name, detail]) => ({
+      name: `real-env-${name.toLowerCase()}`,
+      ok: hasValue(env, name),
+      detail: hasValue(env, name) ? `${name} is present` : `${name} is missing: ${detail}`,
+    })),
+  ];
+}
+
 export function collectPolicyPermissions(workspaceRoot: string): string[] {
   const registry = readJson(workspaceRoot, `${GENERATED_DIR}/policyRegistry.json`) as {
     policies?: Array<{ permissions?: string[] }>;
@@ -1141,7 +1169,9 @@ export function runWorkOSSeedCommand(options: WorkOSCommandOptions): WorkOSComma
 export function runWorkOSSetupCommand(options: WorkOSCommandOptions): WorkOSCommandResult {
   const file = options.file ?? DEFAULT_SEED_FILE;
   const checks = collectWorkOSChecks(options.workspaceRoot);
-  const localOk = checks.every((check) => check.ok);
+  const realEnvChecks = options.real ? collectWorkOSRealEnvChecks(options.workspaceRoot) : [];
+  const allChecks = [...checks, ...realEnvChecks];
+  const localOk = allChecks.every((check) => check.ok);
   const seed = parseSeedFile(options.workspaceRoot, file);
   const seedState = readWorkOSSeedState(options.workspaceRoot, seed);
   const setupDryRun = options.dryRun || !options.real;
@@ -1151,7 +1181,7 @@ export function runWorkOSSetupCommand(options: WorkOSCommandOptions): WorkOSComm
     return {
       ok: false,
       kind: "workos-setup",
-      checks,
+      checks: allChecks,
       command,
       applied: false,
       data: {
@@ -1195,7 +1225,7 @@ export function runWorkOSSetupCommand(options: WorkOSCommandOptions): WorkOSComm
   return {
     ok: seedResult.ok,
     kind: "workos-setup",
-    checks: seedResult.checks,
+    checks: [...seedResult.checks, ...realEnvChecks],
     command: seedResult.command,
     applied: seedResult.ok,
     data: {
@@ -1233,6 +1263,9 @@ export function runWorkOSProveCommand(options: WorkOSCommandOptions): WorkOSComm
     real: options.real ?? false,
     file,
   });
+  const setupBlockingChecks = setup.checks
+    .filter((check) => !check.ok)
+    .map((check) => ({ ...check, name: `setup:${check.name}` }));
   const checks: WorkOSCheck[] = [
     ...doctor.checks.map((check) => ({ ...check, name: `doctor:${check.name}` })),
     {
@@ -1242,6 +1275,7 @@ export function runWorkOSProveCommand(options: WorkOSCommandOptions): WorkOSComm
         ? `${file} is valid, app-aware, and ready for hosted application`
         : `${file} failed seed validation before hosted application`,
     },
+    ...setupBlockingChecks,
     {
       name: options.real ? "setup:real" : "setup:dry-run",
       ok: setup.ok,

package/src/forge/version.ts

@@ -1,3 +1,3 @@
-export const FORGEOS_VERSION = "0.1.0-alpha.46";
+export const FORGEOS_VERSION = "0.1.0-alpha.47";
 export const GENERATOR_VERSION = FORGEOS_VERSION;
 export const CLI_VERSION = FORGEOS_VERSION;