forgeos 0.1.0-alpha.46 → 0.1.0-alpha.48

package/AGENTS.md

@@ -1,4 +1,4 @@
-// @forge-generated generator=0.1.0-alpha.46 input=fa019b5420e754f08100c96852edfc9ea0b39a6b050cbd9bc99106b88775c207 content=721818a6f9a664aa898092d4aa5cd68cbbd8ad6e150c7d3ad3ef785a2e3fcf53
+// @forge-generated generator=0.1.0-alpha.48 input=e33f72bcdf6ab58ac5b6405b90a332317f8f763ca9b9521db6a75de4e7a2bc57 content=721818a6f9a664aa898092d4aa5cd68cbbd8ad6e150c7d3ad3ef785a2e3fcf53
 # AGENTS.md
 
 <!-- forge-generated:start -->

package/CHANGELOG.md

@@ -1,5 +1,46 @@
 # forgeos
 
+## 0.1.0-alpha.48
+
+### Patch Changes
+
+- Complete the WorkOS FGA bridge path for production-shaped apps.
+
+  - `forge workos fga plan/sync/prove` now models the derived app resource
+    graph, hosted WorkOS resource-type setup, required membership evidence, and
+    proof scenarios as a first-class FGA manifest.
+  - `forge workos fga sync --real` and `forge workos fga prove --real` can run
+    through the authenticated WorkOS CLI/API path when `WORKOS_API_KEY` is not
+    present, preserving the no-dashboard agent flow while still using real
+    WorkOS Authorization API calls.
+  - FGA setup guidance now distinguishes what ForgeOS can automate
+    (permissions/roles through seed, resources, checks, deploy evidence) from
+    hosted WorkOS resource-type configuration, with precise remediation when
+    resource types are missing.
+  - `forge deploy check --production` now points WorkOS apps at the full FGA
+    sequence: plan, real sync, real proof, and final deploy check.
+  - WorkOS seed generation now preserves inferred FGA parent resources such as
+    `access_request -> vendor`, and regression coverage guards the generated
+    seed, CLI parser, deploy gates, and FGA setup output.
+
+## 0.1.0-alpha.47
+
+### Patch Changes
+
+- Tighten the WorkOS real-auth proof and production deploy readiness gates.
+
+  - `forge workos setup --real` and `forge workos prove --real` now validate
+    the real OIDC/JWT and WorkOS environment before attempting hosted setup,
+    with specific failed checks such as `setup:real-env-forge_auth_audience`
+    instead of a generic setup failure.
+  - `forge deploy check --production` now requires WorkOS-backed apps to carry
+    hosted seed evidence in `.workos-seed-state.json` that matches the current
+    `workos-seed.yml`, pointing operators at `forge workos prove --real` when
+    hosted seed state is missing or stale.
+  - Update production, self-hosting, and field-test documentation so local mock
+    field-test evidence, hosted WorkOS seed evidence, and deploy env evidence
+    have clear boundaries.
+
 ## 0.1.0-alpha.46
 
 ### Patch Changes

package/docs/changelog.md

@@ -6,6 +6,37 @@ The canonical source file in the repository is `CHANGELOG.md`.
 
 ## Unreleased
 
+## 0.1.0-alpha.48
+
+- Added the production-shaped WorkOS FGA flow:
+  `forge workos fga plan`, `sync`, `prove`, and `doctor` now derive an FGA
+  manifest from the app contract, policies, data graph, and `workos-seed.yml`.
+- `forge workos fga sync --real` and `forge workos fga prove --real` can use
+  the authenticated WorkOS CLI/API path when `WORKOS_API_KEY` is not available,
+  so agents can continue the no-dashboard flow after `workos auth login`.
+- FGA setup output now separates hosted WorkOS resource-type configuration from
+  ForgeOS-automated resource sync and authorization checks, and reports missing
+  resource types with exact next actions.
+- `forge deploy check --production` now requires matching WorkOS FGA real
+  sync/proof evidence for WorkOS-backed apps and points operators at
+  `forge workos fga plan --write`, `sync --real`, and `prove --real`.
+- WorkOS seed generation now keeps inferred parent resource relationships such
+  as `access_request -> vendor`, with regression coverage for the generated
+  seed, parser, deploy checks, and FGA plan output.
+
+## 0.1.0-alpha.47
+
+- `forge workos setup --real` and `forge workos prove --real` now validate the
+  real OIDC/JWT and WorkOS environment before hosted setup, surfacing exact
+  failed checks like `setup:real-env-forge_auth_audience`.
+- `forge deploy check --production` now requires WorkOS-backed apps to include
+  hosted seed evidence in `.workos-seed-state.json` matching the current
+  `workos-seed.yml`, with a direct `forge workos prove --real --file
+  workos-seed.yml --json` remediation.
+- Clarified production, self-host, and field-test docs so local mock evidence,
+  hosted WorkOS seed evidence, and production deploy env evidence are treated
+  as separate gates.
+
 ## 0.1.0-alpha.46
 
 - `forge deps upgrade-apply` and `forge deps upgrade-rollback` now accept the

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "forgeos",
-  "version": "0.1.0-alpha.46",
+  "version": "0.1.0-alpha.48",
   "description": "Agent-native application framework and compiler for building Forge apps without a mandatory dashboard.",
   "type": "module",
   "license": "MIT",

package/src/forge/_generated/releaseManifest.json

@@ -1 +1 @@
-{"defaultProvider":"local","diagnostics":[],"env":{"deployEnv":"FORGE_DEPLOY_ENV","deployId":"FORGE_DEPLOY_ID","publicReleaseId":"NEXT_PUBLIC_FORGE_RELEASE_ID","releaseId":"FORGE_RELEASE_ID"},"gitSha":"unknown","optionalProviders":["local","sentry-compatible","sentry","glitchtip","bugsink","otel","custom"],"packageName":"forgeos","packageVersion":"0.1.0-alpha.46","releaseId":"forgeos@0.1.0-alpha.46+unknown","schemaVersion":"0.1.0"}
+{"defaultProvider":"local","diagnostics":[],"env":{"deployEnv":"FORGE_DEPLOY_ENV","deployId":"FORGE_DEPLOY_ID","publicReleaseId":"NEXT_PUBLIC_FORGE_RELEASE_ID","releaseId":"FORGE_RELEASE_ID"},"gitSha":"unknown","optionalProviders":["local","sentry-compatible","sentry","glitchtip","bugsink","otel","custom"],"packageName":"forgeos","packageVersion":"0.1.0-alpha.48","releaseId":"forgeos@0.1.0-alpha.48+unknown","schemaVersion":"0.1.0"}

package/src/forge/_generated/releaseManifest.ts

@@ -1,4 +1,4 @@
-// @forge-generated generator=0.1.0-alpha.46 input=fa019b5420e754f08100c96852edfc9ea0b39a6b050cbd9bc99106b88775c207 content=715d49dd9abed8465a5cf5e82713973aab97cc178fda3b1e8b1647b93683ee58
+// @forge-generated generator=0.1.0-alpha.48 input=e33f72bcdf6ab58ac5b6405b90a332317f8f763ca9b9521db6a75de4e7a2bc57 content=688cbf07ac4fedd1f2f4fc8a3055f32a6f5a8d1ea9df8fe0c2ed81cec120fb3b
 export const releaseManifest = {
   "defaultProvider": "local",
   "diagnostics": [],
@@ -19,7 +19,7 @@ export const releaseManifest = {
     "custom"
   ],
   "packageName": "forgeos",
-  "packageVersion": "0.1.0-alpha.46",
-  "releaseId": "forgeos@0.1.0-alpha.46+unknown",
+  "packageVersion": "0.1.0-alpha.48",
+  "releaseId": "forgeos@0.1.0-alpha.48+unknown",
   "schemaVersion": "0.1.0"
 } as const;

package/src/forge/cli/deploy.ts

@@ -609,6 +609,18 @@ Required production posture:
 - issuer, audience, and JWKS/discovery settings match the auth provider
 - any provider secrets listed in the example are set in the deployment secret store
 
+For WorkOS-backed apps, local dry-runs are not enough for production deploy
+readiness. Run:
+
+\`\`\`bash
+forge workos prove --real --file workos-seed.yml --json
+\`\`\`
+
+This applies or confirms hosted WorkOS config/seed through the WorkOS CLI and
+writes \`.workos-seed-state.json\`. \`forge deploy check --production\` requires
+that state to match the current \`workos-seed.yml\` before treating WorkOS
+posture as production evidence.
+
 ## 2. Prove the app before traffic
 
 \`\`\`bash
@@ -616,6 +628,7 @@ forge generate --check --json
 forge check --json
 forge authmd generate --json
 forge auth prove --scenario multi-tenant --json
+forge workos prove --real --file workos-seed.yml --json
 forge field-test run --realistic --json
 forge deploy check --production --json
 \`\`\`
@@ -825,6 +838,40 @@ async function buildChecks(options: DeployCommandOptions): Promise<DeployCommand
       command: "forge workos doctor --json",
       details: workosDoctor.checks,
     });
+    const workosData = workosDoctor.data && typeof workosDoctor.data === "object"
+      ? workosDoctor.data as { seedState?: { exists?: boolean; valid?: boolean; matchesSeedHash?: boolean | null; alreadyApplied?: boolean } }
+      : {};
+    const seedState = workosData.seedState;
+    const hostedSeedOk = Boolean(seedState?.exists && seedState.valid && seedState.matchesSeedHash === true);
+    checks.push({
+      name: "workos-hosted-seed",
+      ok: !options.production || hostedSeedOk,
+      severity: options.production ? "error" : "warning",
+      message: hostedSeedOk
+        ? `WorkOS hosted seed state matches workos-seed.yml${seedState?.alreadyApplied ? " and records idempotent existing resources" : ""}`
+        : "WorkOS production deploy requires hosted seed evidence matching workos-seed.yml",
+      command: "forge workos prove --real --file workos-seed.yml --json",
+      details: seedState,
+    });
+    const workosFgaDoctor = runWorkOSCommand({
+      subcommand: "fga",
+      fgaAction: "doctor",
+      workspaceRoot: options.workspaceRoot,
+      json: true,
+      yes: false,
+      dryRun: true,
+      real: options.production,
+    });
+    checks.push({
+      name: "workos-fga-proof",
+      ok: !options.production || workosFgaDoctor.exitCode === 0,
+      severity: options.production ? "error" : "warning",
+      message: workosFgaDoctor.exitCode === 0
+        ? "WorkOS FGA resource graph state matches the current app contract and seed"
+        : "WorkOS production deploy requires FGA graph sync/proof evidence matching the current app",
+      command: "forge workos fga prove --real --file workos-seed.yml --json",
+      details: workosFgaDoctor.data,
+    });
   }
   const tenantProofRequired = auth.requiresTenant || hasWorkOSIntegration(options.workspaceRoot);
   const tenantProof = tenantProofRequired
@@ -900,6 +947,9 @@ async function buildChecks(options: DeployCommandOptions): Promise<DeployCommand
   });
 
   const errorFree = checks.every((check) => check.ok || check.severity === "warning");
+  const failureActions = unique(checks.flatMap((check) =>
+    !check.ok && check.command ? expandDeployFailureCommand(check.command) : []
+  ));
   return normalizeForgeCliCommandsInValue(options.workspaceRoot, {
     schemaVersion: "0.1.0",
     ok: errorFree,
@@ -910,11 +960,22 @@ async function buildChecks(options: DeployCommandOptions): Promise<DeployCommand
     checks,
     nextActions: errorFree
       ? ["forge deploy verify --production --url https://app.example.com --json"]
-      : unique(checks.flatMap((check) => !check.ok && check.command ? [check.command] : [])),
+      : failureActions,
     exitCode: errorFree ? 0 : 1,
   });
 }
 
+function expandDeployFailureCommand(command: string): string[] {
+  if (command.includes("forge workos fga prove")) {
+    return [
+      "forge workos fga plan --file workos-seed.yml --write --json",
+      "forge workos fga sync --real --file workos-seed.yml --json",
+      command,
+    ];
+  }
+  return [command];
+}
+
 function renderDocker(options: DeployCommandOptions): DeployCommandResult {
   const dir = join(options.workspaceRoot, "deploy");
   nodeFileSystem.mkdirp(dir);

package/src/forge/cli/main.ts

@@ -43,6 +43,10 @@ function formatHelp(): string {
     "  forge workos seed --file workos-seed.yml --dry-run --json  Validate WorkOS seed without hosted changes",
     "  forge workos prove --file workos-seed.yml --json  Prove local WorkOS/AuthKit/FGA/seed readiness without dashboard changes",
     "  forge workos setup --real --file workos-seed.yml --json  Apply redirect/CORS/homepage config and seed WorkOS without dashboard",
+    "  forge workos fga plan --json  Derive the WorkOS FGA resource graph and proof scenarios from the app",
+    "  forge workos fga plan --write --json  Write .forge/workos-fga-setup.md for hosted FGA resource type setup",
+    "  forge workos fga sync --json  Record an idempotent local FGA graph state for deploy gates",
+    "  forge workos fga prove --json  Prove local FGA graph, cross-tenant denials, and state freshness",
     "  forge deploy plan --target docker --json  Explain production deploy gates and commands",
     "  forge deploy check --production --json  Gate auth, DB, metadata, generated artifacts, and liveQuery readiness",
     "  forge deploy package --target docker  Write Docker production deploy files under deploy/",

package/src/forge/cli/parse.ts

@@ -19,7 +19,7 @@ import type { AgentContractSubcommand } from "./agent-contract.ts";
 import type { AuthSubcommand } from "./auth.ts";
 import type { BaselineSubcommand } from "./baseline.ts";
 import type { AuthMdSubcommand } from "./authmd.ts";
-import type { WorkOSSubcommand } from "./workos.ts";
+import type { WorkOSFgaAction, WorkOSSubcommand } from "./workos.ts";
 import type { DeploySubcommand, DeployTarget } from "./deploy.ts";
 import type { FieldTestSubcommand } from "./field-test.ts";
 import type { SeedSubcommand } from "./seed.ts";
@@ -152,11 +152,14 @@ export type ForgeCommand =
   | {
       kind: "workos";
       subcommand: WorkOSSubcommand;
+      fgaAction?: WorkOSFgaAction;
       json: boolean;
       file?: string;
       yes: boolean;
       dryRun: boolean;
       real?: boolean;
+      write?: boolean;
+      writePath?: string;
       workspaceRoot: string;
     }
   | {
@@ -597,7 +600,8 @@ const AUTH_SUBCOMMANDS: AuthSubcommand[] = [
 ];
 const BASELINE_SUBCOMMANDS: BaselineSubcommand[] = ["create", "status"];
 const AUTHMD_SUBCOMMANDS: AuthMdSubcommand[] = ["generate", "check"];
-const WORKOS_SUBCOMMANDS: WorkOSSubcommand[] = ["install", "doctor", "seed", "setup", "prove"];
+const WORKOS_SUBCOMMANDS: WorkOSSubcommand[] = ["install", "doctor", "seed", "setup", "prove", "fga"];
+const WORKOS_FGA_ACTIONS: WorkOSFgaAction[] = ["plan", "sync", "prove", "doctor"];
 const DEPLOY_SUBCOMMANDS: DeploySubcommand[] = ["plan", "check", "render", "package", "verify"];
 const FIELD_TEST_SUBCOMMANDS: FieldTestSubcommand[] = ["create", "run", "report"];
 const SECURITY_SUBCOMMANDS: SecuritySubcommand[] = ["prove"];
@@ -761,6 +765,11 @@ function parseOptionValue(args: string[], flag: string): string | undefined {
   return args[index + 1];
 }
 
+function parseOptionalOptionValue(args: string[], flag: string): string | undefined {
+  const value = parseOptionValue(args, flag);
+  return value && !value.startsWith("--") ? value : undefined;
+}
+
 function parseOptionValues(args: string[], flag: string): string[] {
   const values: string[] = [];
   for (let index = 0; index < args.length; index++) {
@@ -1444,18 +1453,27 @@ export function parseCli(argv: string[]): ParsedCli {
     case "workos": {
       const subcommand = rest[0] as WorkOSSubcommand | undefined;
       if (!subcommand || !WORKOS_SUBCOMMANDS.includes(subcommand)) {
-        errors.push("forge workos requires subcommand: install, doctor, seed, setup, or prove");
+        errors.push("forge workos requires subcommand: install, doctor, seed, setup, prove, or fga");
+        return { command: null, workspaceRoot, errors };
+      }
+      const fgaAction = subcommand === "fga" ? rest[1] as WorkOSFgaAction | undefined : undefined;
+      if (subcommand === "fga" && (!fgaAction || !WORKOS_FGA_ACTIONS.includes(fgaAction))) {
+        errors.push("forge workos fga requires action: plan, sync, prove, or doctor");
         return { command: null, workspaceRoot, errors };
       }
+      const workOSWritePath = parseOptionalOptionValue(argv, "--write");
       return {
         command: {
           kind: "workos",
           subcommand,
+          ...(fgaAction ? { fgaAction } : {}),
           json: parseFlag(argv, "--json"),
           file: parseOptionValue(argv, "--file"),
           yes: parseFlag(argv, "--yes"),
           dryRun: parseFlag(argv, "--dry-run"),
           real: parseFlag(argv, "--real"),
+          write: parseFlag(argv, "--write"),
+          ...(workOSWritePath ? { writePath: workOSWritePath } : {}),
           workspaceRoot,
         },
         workspaceRoot,