forgeos 0.1.0-alpha.51 → 0.1.0-alpha.53

package/AGENTS.md

@@ -1,4 +1,4 @@
-// @forge-generated generator=0.1.0-alpha.51 input=56e2fea9ee90281ea32b5a5f6297bf827b851718f02b6c41f1b3f6f862a7eca8 content=721818a6f9a664aa898092d4aa5cd68cbbd8ad6e150c7d3ad3ef785a2e3fcf53
+// @forge-generated generator=0.1.0-alpha.53 input=3ed440f80e50b242cb2753283b0f3bb633fa0fc4ab79d0242f469d3a6bd258ba content=721818a6f9a664aa898092d4aa5cd68cbbd8ad6e150c7d3ad3ef785a2e3fcf53
 # AGENTS.md
 
 <!-- forge-generated:start -->

package/CHANGELOG.md

@@ -1,5 +1,33 @@
 # forgeos
 
+## 0.1.0-alpha.53
+
+### Patch Changes
+
+- Keep WorkOS FGA proof messaging honest across local and real modes.
+
+  - `forge workos fga doctor --json` now reports local proof timestamps as
+    local proof instead of using real-production wording when the state file was
+    produced by local FGA proof commands.
+  - This prevents local/mock FGA evidence from being mistaken for hosted WorkOS
+    Authorization API proof during production-readiness handoff.
+
+## 0.1.0-alpha.52
+
+### Patch Changes
+
+- Make WorkOS FGA real-rollout failures produce a concrete operator artifact.
+
+  - Generated WorkOS FGA setup guides now include an explicit automation
+    boundary explaining that ForgeOS derives the graph, syncs resources, and
+    proves Authorization API checks, but does not invent unsupported WorkOS
+    resource-type creation commands.
+  - `forge workos fga sync --real --write --json` now remains useful when the
+    WorkOS Authorization API reports missing resource types: the JSON includes
+    `setupGuidePath` and the written guide lists the resource types, parents,
+    permissions, roles, example external IDs, membership env, and rerun
+    commands needed to finish the hosted setup.
+
 ## 0.1.0-alpha.51
 
 ### Patch Changes

package/docs/changelog.md

@@ -6,6 +6,22 @@ The canonical source file in the repository is `CHANGELOG.md`.
 
 ## Unreleased
 
+## 0.1.0-alpha.53
+
+- `forge workos fga doctor --json` now distinguishes local FGA proof timestamps
+  from real WorkOS Authorization API proof timestamps, avoiding production
+  readiness confusion in agent handoffs.
+
+## 0.1.0-alpha.52
+
+- Generated WorkOS FGA setup guides now include an explicit automation boundary
+  describing what ForgeOS can automate versus the hosted WorkOS resource-type
+  configuration that must exist before real resource sync.
+- `forge workos fga sync --real --write --json` now provides a concrete
+  `setupGuidePath` even when real sync fails because hosted WorkOS resource
+  types are missing, so agents have a deterministic artifact for the remaining
+  setup and rerun commands.
+
 ## 0.1.0-alpha.51
 
 - `forge workos fga doctor --real --json` now reports a structured readiness

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "forgeos",
-  "version": "0.1.0-alpha.51",
+  "version": "0.1.0-alpha.53",
   "description": "Agent-native application framework and compiler for building Forge apps without a mandatory dashboard.",
   "type": "module",
   "license": "MIT",

package/src/forge/_generated/releaseManifest.json

@@ -1 +1 @@
-{"defaultProvider":"local","diagnostics":[],"env":{"deployEnv":"FORGE_DEPLOY_ENV","deployId":"FORGE_DEPLOY_ID","publicReleaseId":"NEXT_PUBLIC_FORGE_RELEASE_ID","releaseId":"FORGE_RELEASE_ID"},"gitSha":"unknown","optionalProviders":["local","sentry-compatible","sentry","glitchtip","bugsink","otel","custom"],"packageName":"forgeos","packageVersion":"0.1.0-alpha.51","releaseId":"forgeos@0.1.0-alpha.51+unknown","schemaVersion":"0.1.0"}
+{"defaultProvider":"local","diagnostics":[],"env":{"deployEnv":"FORGE_DEPLOY_ENV","deployId":"FORGE_DEPLOY_ID","publicReleaseId":"NEXT_PUBLIC_FORGE_RELEASE_ID","releaseId":"FORGE_RELEASE_ID"},"gitSha":"unknown","optionalProviders":["local","sentry-compatible","sentry","glitchtip","bugsink","otel","custom"],"packageName":"forgeos","packageVersion":"0.1.0-alpha.53","releaseId":"forgeos@0.1.0-alpha.53+unknown","schemaVersion":"0.1.0"}

package/src/forge/_generated/releaseManifest.ts

@@ -1,4 +1,4 @@
-// @forge-generated generator=0.1.0-alpha.51 input=56e2fea9ee90281ea32b5a5f6297bf827b851718f02b6c41f1b3f6f862a7eca8 content=0e813cc871b8bd6a982fd4ccaf852bbc0a25e9dd49ab6a438de3bba9f0f840ab
+// @forge-generated generator=0.1.0-alpha.53 input=3ed440f80e50b242cb2753283b0f3bb633fa0fc4ab79d0242f469d3a6bd258ba content=a648def26a36193279d13f385b2c17a555fadf46893ffee57e87f439642c958e
 export const releaseManifest = {
   "defaultProvider": "local",
   "diagnostics": [],
@@ -19,7 +19,7 @@ export const releaseManifest = {
     "custom"
   ],
   "packageName": "forgeos",
-  "packageVersion": "0.1.0-alpha.51",
-  "releaseId": "forgeos@0.1.0-alpha.51+unknown",
+  "packageVersion": "0.1.0-alpha.53",
+  "releaseId": "forgeos@0.1.0-alpha.53+unknown",
   "schemaVersion": "0.1.0"
 } as const;

package/src/forge/cli/workos.ts

@@ -1149,6 +1149,13 @@ function workOSFgaSetupGuide(manifest: WorkOSFgaManifest, hostedSetup: WorkOSFga
     "ForgeOS derived this resource graph from the app contract, policies, and workos-seed.yml.",
     "WorkOS resource type configuration is hosted WorkOS configuration. ForgeOS uses the WorkOS CLI/API or SDK to sync resources and prove authorization checks after those resource types exist.",
     "",
+    "## Automation Boundary",
+    "",
+    "- ForgeOS can derive the FGA graph, generate this setup guide, sync WorkOS FGA resources, and run Authorization API access checks.",
+    "- ForgeOS does not invent WorkOS CLI/API calls for resource type creation. The current public WorkOS automation surface supports resources and checks after resource types exist.",
+    "- Configure each non-organization resource type below in hosted WorkOS, then rerun the real sync/proof commands.",
+    "- The `organization` node is treated as the WorkOS tenant root and is not created as an authorization resource.",
+    "",
     "## Resource Types",
     "",
     ...resourceTypes.flatMap((resourceType) => [
@@ -2614,7 +2621,9 @@ function collectWorkOSFgaChecks(input: {
       name: "fga-proof-state",
       ok: !input.requireProof || Boolean(input.state.provedAt),
       detail: input.state.provedAt
-        ? `${WORKOS_FGA_STATE_FILE} records real proof at ${input.state.provedAt}`
+        ? input.state.mode === "real"
+          ? `${WORKOS_FGA_STATE_FILE} records real proof at ${input.state.provedAt}`
+          : `${WORKOS_FGA_STATE_FILE} records local proof at ${input.state.provedAt}`
         : input.requireProof
           ? `${WORKOS_FGA_STATE_FILE} must be produced by forge workos fga prove --real --json`
           : `${WORKOS_FGA_STATE_FILE} proof timestamp not required for this command`,

package/src/forge/version.ts

@@ -1,3 +1,3 @@
-export const FORGEOS_VERSION = "0.1.0-alpha.51";
+export const FORGEOS_VERSION = "0.1.0-alpha.53";
 export const GENERATOR_VERSION = FORGEOS_VERSION;
 export const CLI_VERSION = FORGEOS_VERSION;