forgeos 0.1.0-alpha.58 → 0.1.0-alpha.60

package/AGENTS.md

@@ -1,4 +1,4 @@
-// @forge-generated generator=0.1.0-alpha.58 input=195942726f1885a6c7556503abb9f76ac8ee4cfa1bc0725c319a77c97d08c195 content=721818a6f9a664aa898092d4aa5cd68cbbd8ad6e150c7d3ad3ef785a2e3fcf53
+// @forge-generated generator=0.1.0-alpha.60 input=dd73ff0861775ded0c4b42b55e3261a44043d4c09aa3c9f5641d3c23b17e2e6c content=721818a6f9a664aa898092d4aa5cd68cbbd8ad6e150c7d3ad3ef785a2e3fcf53
 # AGENTS.md
 
 <!-- forge-generated:start -->

package/CHANGELOG.md

@@ -1,5 +1,23 @@
 # forgeos
 
+## 0.1.0-alpha.60
+
+### Patch Changes
+
+- Fix the real WorkOS/AuthKit session bridge for Forge runtime calls.
+
+  - Generated WorkOS React bridges now pass normalized `/session` claims into
+    `ForgeProvider` auth so commands, queries, and liveQueries receive user,
+    role, permissions, membership, and tenant headers.
+  - WorkOS browser env sync now includes optional tenant mapping variables for
+    apps that use internal UUID tenants while WorkOS emits hosted `org_...`
+    organization ids.
+  - WorkOS dev sessions now derive permissions from active Forge policies when
+    AuthKit returns a role without permission claims, and normalize WorkOS
+    organization ids before cookie-backed runtime calls touch tenant-scoped data.
+  - `forge workos doctor` now validates that generated browser bridges pass
+    WorkOS claims into Forge auth instead of only exposing a UI session.
+
 ## 0.1.0-alpha.58
 
 ### Patch Changes

package/docs/changelog.md

@@ -6,6 +6,20 @@ The canonical source file in the repository is `CHANGELOG.md`.
 
 ## Unreleased
 
+## 0.1.0-alpha.60
+
+- Fixed the real WorkOS/AuthKit session bridge so generated React apps pass
+  normalized `/session` claims into `ForgeProvider` auth for commands, queries,
+  and liveQueries.
+- Added optional WorkOS organization-to-Forge tenant mapping env support for
+  apps that use internal UUID tenant ids while WorkOS emits hosted `org_...`
+  organization ids.
+- WorkOS dev sessions now derive permissions from active Forge policies when
+  AuthKit returns a role without permission claims, then normalize WorkOS
+  organization ids before cookie-backed runtime calls touch tenant-scoped data.
+- `forge workos doctor` now validates that generated browser bridges pass
+  WorkOS claims into Forge auth instead of only exposing a UI session.
+
 ## 0.1.0-alpha.58
 
 - Fixed generated WorkOS AuthKit route helper TypeScript output by reading

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "forgeos",
-  "version": "0.1.0-alpha.58",
+  "version": "0.1.0-alpha.60",
   "description": "Agent-native application framework and compiler for building Forge apps without a mandatory dashboard.",
   "type": "module",
   "license": "MIT",

package/src/forge/_generated/releaseManifest.json

@@ -1 +1 @@
-{"defaultProvider":"local","diagnostics":[],"env":{"deployEnv":"FORGE_DEPLOY_ENV","deployId":"FORGE_DEPLOY_ID","publicReleaseId":"NEXT_PUBLIC_FORGE_RELEASE_ID","releaseId":"FORGE_RELEASE_ID"},"gitSha":"unknown","optionalProviders":["local","sentry-compatible","sentry","glitchtip","bugsink","otel","custom"],"packageName":"forgeos","packageVersion":"0.1.0-alpha.58","releaseId":"forgeos@0.1.0-alpha.58+unknown","schemaVersion":"0.1.0"}
+{"defaultProvider":"local","diagnostics":[],"env":{"deployEnv":"FORGE_DEPLOY_ENV","deployId":"FORGE_DEPLOY_ID","publicReleaseId":"NEXT_PUBLIC_FORGE_RELEASE_ID","releaseId":"FORGE_RELEASE_ID"},"gitSha":"unknown","optionalProviders":["local","sentry-compatible","sentry","glitchtip","bugsink","otel","custom"],"packageName":"forgeos","packageVersion":"0.1.0-alpha.60","releaseId":"forgeos@0.1.0-alpha.60+unknown","schemaVersion":"0.1.0"}

package/src/forge/_generated/releaseManifest.ts

@@ -1,4 +1,4 @@
-// @forge-generated generator=0.1.0-alpha.58 input=195942726f1885a6c7556503abb9f76ac8ee4cfa1bc0725c319a77c97d08c195 content=8104f3f07c4474c0d9d56bf89444a70d0a709d06a30739a7153bdb9d054f3ed2
+// @forge-generated generator=0.1.0-alpha.60 input=dd73ff0861775ded0c4b42b55e3261a44043d4c09aa3c9f5641d3c23b17e2e6c content=185c42e22dbf3b1cc6e329af86d71f513f19cde067ec0e4ea0a228df020c30f9
 export const releaseManifest = {
   "defaultProvider": "local",
   "diagnostics": [],
@@ -19,7 +19,7 @@ export const releaseManifest = {
     "custom"
   ],
   "packageName": "forgeos",
-  "packageVersion": "0.1.0-alpha.58",
-  "releaseId": "forgeos@0.1.0-alpha.58+unknown",
+  "packageVersion": "0.1.0-alpha.60",
+  "releaseId": "forgeos@0.1.0-alpha.60+unknown",
   "schemaVersion": "0.1.0"
 } as const;

package/src/forge/cli/workos.ts

@@ -1819,6 +1819,15 @@ function collectWorkOSChecks(workspaceRoot: string, preferredSeedPath = DEFAULT_
     ["/login", "/logout", "/session"].every((route) => generatedFrontendAuthBridge.includes(route));
   const authBridgeProvidesSessionClaims =
     includesAll(generatedFrontendAuthBridge, ["useForgeWorkOSSession", "/session", "claims"]);
+  const authBridgePassesClaimsToForge =
+    includesAll(generatedFrontendAuthBridge, [
+      "workOSSessionToForgeAuth",
+      "forgeTenantIdForWorkOSOrganization",
+      "workOSAuthProvider",
+      "auth={workOSAuthProvider}",
+      "permissions: claims.permissions",
+      "organizationId: forgeTenantId",
+    ]);
   const authSessionProxyConfigured = webAuthSessionProxyConfigured(workspaceRoot);
 
   return [
@@ -1877,9 +1886,10 @@ function collectWorkOSChecks(workspaceRoot: string, preferredSeedPath = DEFAULT_
       name: "browser-authkit-bridge",
       ok: !hasWeb || generatedFrontendAuthBridge.includes("ForgeProvider") &&
         authBridgeUsesBackendRoutes &&
-        authBridgeProvidesSessionClaims,
+        authBridgeProvidesSessionClaims &&
+        authBridgePassesClaimsToForge,
       detail: hasWeb
-        ? "generated web/src/lib/workos-auth.tsx bridge uses backend-owned AuthKit routes, ForgeProvider, and normalized /session claims"
+        ? "generated web/src/lib/workos-auth.tsx bridge uses backend-owned AuthKit routes and passes normalized WorkOS claims into ForgeProvider auth"
         : "no web workspace detected",
     },
     {

package/src/forge/compiler/integration/add.ts

@@ -552,6 +552,8 @@ function syncWorkOSPublicWebEnv(workspaceRoot: string, frontendWorkspace: string
     VITE_FORGE_URL: source.VITE_FORGE_URL || "http://localhost:3765",
     VITE_WORKOS_CLIENT_ID: clientId,
     VITE_WORKOS_REDIRECT_URI: redirectUri,
+    VITE_FORGE_WORKOS_TENANT_MAP: source.VITE_FORGE_WORKOS_TENANT_MAP || "",
+    VITE_FORGE_WORKOS_TENANT_ID_FALLBACK: source.VITE_FORGE_WORKOS_TENANT_ID_FALLBACK || "",
   };
   const envRel = `${frontendWorkspace}/.env.local`;
   const envPath = join(workspaceRoot, envRel);

package/src/forge/compiler/integration/templates/workos.ts

@@ -288,6 +288,9 @@ export function renderWorkosEnvExample(_input: IntegrationTemplateInput): string
     "VITE_FORGE_URL=http://localhost:3765",
     "VITE_WORKOS_CLIENT_ID=",
     "VITE_WORKOS_REDIRECT_URI=http://localhost:5173/callback",
+    "# Optional: map hosted WorkOS organization IDs to Forge tenant IDs when your app uses internal UUID tenants.",
+    "# VITE_FORGE_WORKOS_TENANT_MAP={\"org_...\":\"11111111-1111-4111-8111-111111111111\"}",
+    "# VITE_FORGE_WORKOS_TENANT_ID_FALLBACK=",
     "",
     "# WorkOS token claims expected by ForgeOS after forge add auth workos:",
     "# sub, email, organization_id, role, roles, permissions, organization_membership_id",
@@ -306,6 +309,8 @@ export function renderWorkosReactBridge(_input: IntegrationTemplateInput): strin
     "const clientId = import.meta.env.VITE_WORKOS_CLIENT_ID as string | undefined;",
     "const redirectUri = import.meta.env.VITE_WORKOS_REDIRECT_URI as string | undefined;",
     "const forgeApiUrl = import.meta.env.VITE_FORGE_URL as string | undefined;",
+    "const workosTenantMap = import.meta.env.VITE_FORGE_WORKOS_TENANT_MAP as string | undefined;",
+    "const workosTenantFallback = import.meta.env.VITE_FORGE_WORKOS_TENANT_ID_FALLBACK as string | undefined;",
     "",
     "function workOSApiUrl(path: string): URL {",
     "  if (typeof window !== 'undefined' && forgeApiUrl) {",
@@ -321,12 +326,70 @@ export function renderWorkosReactBridge(_input: IntegrationTemplateInput): strin
     "  return Boolean(clientId && redirectUri);",
     "}",
     "",
+    "function forgeTenantIdForWorkOSOrganization(claims: ForgeWorkOSBrowserSession['claims']) {",
+    "  if (!claims) {",
+    "    return undefined;",
+    "  }",
+    "  const explicitTenant = claims.tenant_id ?? claims.forge_tenant_id;",
+    "  if (explicitTenant) {",
+    "    return explicitTenant;",
+    "  }",
+    "  const organizationId = claims.organization_id;",
+    "  if (!organizationId) {",
+    "    return undefined;",
+    "  }",
+    "  if (workosTenantMap) {",
+    "    try {",
+    "      const parsed = JSON.parse(workosTenantMap) as Record<string, string>;",
+    "      if (parsed[organizationId]) {",
+    "        return parsed[organizationId];",
+    "      }",
+    "    } catch {",
+    "      // Keep authentication usable; forge workos doctor validates mapping syntax separately.",
+    "    }",
+    "  }",
+    "  if (organizationId.startsWith('org_') && workosTenantFallback) {",
+    "    return workosTenantFallback;",
+    "  }",
+    "  return organizationId;",
+    "}",
+    "",
+    "function workOSSessionToForgeAuth(session: ForgeWorkOSBrowserSession | null | undefined) {",
+    "  const claims = session?.claims;",
+    "  if (!claims?.sub) {",
+    "    return {};",
+    "  }",
+    "  const forgeTenantId = forgeTenantIdForWorkOSOrganization(claims);",
+    "  return {",
+    "    userId: claims.sub,",
+    "    tenantId: forgeTenantId,",
+    "    organizationId: forgeTenantId,",
+    "    organizationMembershipId: claims.organization_membership_id,",
+    "    role: claims.role ?? claims.roles?.[0],",
+    "    roles: claims.roles,",
+    "    permissions: claims.permissions,",
+    "    claims,",
+    "  };",
+    "}",
+    "",
+    "const workOSAuthProvider = async () => {",
+    "  const response = await fetch(workOSApiUrl('/session'), { credentials: 'include' });",
+    "  if (response.status === 401) {",
+    "    return {};",
+    "  }",
+    "  if (!response.ok) {",
+    "    throw new Error(`WorkOS session request failed with HTTP ${response.status}`);",
+    "  }",
+    "  const payload = await response.json() as { ok?: boolean; session?: ForgeWorkOSBrowserSession | null };",
+    "  return workOSSessionToForgeAuth(payload.ok ? payload.session ?? null : null);",
+    "};",
+    "",
     "export function ForgeWorkOSAuthProvider({ children }: { children: ReactNode }) {",
     "  if (!clientId || !redirectUri) {",
     "    throw new Error(\"WorkOS AuthKit requires VITE_WORKOS_CLIENT_ID and VITE_WORKOS_REDIRECT_URI\");",
     "  }",
     "  return (",
-    "    <ForgeProvider url={forgeUrl}>",
+    "    <ForgeProvider url={forgeUrl} auth={workOSAuthProvider}>",
     "      {children}",
     "    </ForgeProvider>",
     "  );",
@@ -338,6 +401,8 @@ export function renderWorkosReactBridge(_input: IntegrationTemplateInput): strin
     "    sub?: string;",
     "    email?: string;",
     "    organization_id?: string;",
+    "    tenant_id?: string;",
+    "    forge_tenant_id?: string;",
     "    organization_membership_id?: string;",
     "    role?: string;",
     "    roles?: string[];",
@@ -836,7 +901,8 @@ export function renderWorkosSession(_input: IntegrationTemplateInput): string {
   ].join("\n");
 }
 
-export function renderWorkosAuthRoutes(_input: IntegrationTemplateInput): string {
+export function renderWorkosAuthRoutes(input: IntegrationTemplateInput): string {
+  const fallbackRolePermissions = rolePermissions(permissionsFromApp(input));
   return [
     "/** Forge generated framework-agnostic WorkOS AuthKit routes. */",
     'import type { WorkOS } from "@workos-inc/node";',
@@ -878,6 +944,18 @@ export function renderWorkosAuthRoutes(_input: IntegrationTemplateInput): string
     "  };",
     "}",
     "",
+    "const forgeWorkOSFallbackRolePermissions = {",
+    ...Object.entries(fallbackRolePermissions).map(([role, permissions]) =>
+      `  ${JSON.stringify(role)}: [${permissions.map((permission) => JSON.stringify(permission)).join(", ")}],`
+    ),
+    "} as const;",
+    "",
+    "function fallbackPermissionsForRole(role: string | undefined): string[] {",
+    "  if (!role) return [];",
+    "  const permissions = forgeWorkOSFallbackRolePermissions[role.toLowerCase() as keyof typeof forgeWorkOSFallbackRolePermissions];",
+    "  return permissions ? [...permissions] : [];",
+    "}",
+    "",
     "export function getWorkOSAuthorizationUrl(input: { workos: WorkOS; config: ForgeWorkOSAuthKitConfig; state?: string }): string {",
     "  if (!input.config.redirectUri) throw new Error(\"WORKOS_REDIRECT_URI is required\");",
     "  const url = new URL(input.workos.userManagement.getAuthorizationUrl({",
@@ -915,7 +993,7 @@ export function renderWorkosAuthRoutes(_input: IntegrationTemplateInput): string
     "  const organizationMembershipId = resolved?.organizationMembershipId ?? resultOrganizationMembershipId;",
     "  const role = resolved?.role ?? (typeof rawResult.role === \"string\" ? rawResult.role : resultRoles[0]);",
     "  const roles = resolved?.roles ?? resultRoles;",
-    "  const permissions = resolved?.permissions ?? resultPermissions;",
+    "  const permissions = resolved?.permissions ?? (resultPermissions.length > 0 ? resultPermissions : fallbackPermissionsForRole(role));",
     "  return {",
     "    user: workOSSessionUser(user),",
     "    accessToken: result.accessToken,",

package/src/forge/dev/server.ts

@@ -508,8 +508,85 @@ function workOSDevSessionClaims(session: WorkOSDevSession): Record<string, unkno
   };
 }
 
+function parseWorkOSTenantMap(value: string | undefined): Record<string, string> {
+  if (!value) {
+    return {};
+  }
+  try {
+    const parsed = JSON.parse(value) as unknown;
+    if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
+      return {};
+    }
+    return Object.fromEntries(
+      Object.entries(parsed as Record<string, unknown>)
+        .filter((entry): entry is [string, string] =>
+          typeof entry[0] === "string" &&
+          typeof entry[1] === "string" &&
+          entry[0].length > 0 &&
+          entry[1].length > 0
+        ),
+    );
+  } catch {
+    return {};
+  }
+}
+
+function mapWorkOSTenantId(
+  envStore: ReturnType<typeof getRuntimeEnvStore>,
+  organizationId: unknown,
+): string | undefined {
+  if (typeof organizationId !== "string" || organizationId.length === 0) {
+    return undefined;
+  }
+  const tenantMap = {
+    ...parseWorkOSTenantMap(envStore.resolve("FORGE_WORKOS_TENANT_MAP")),
+    ...parseWorkOSTenantMap(envStore.resolve("VITE_FORGE_WORKOS_TENANT_MAP")),
+  };
+  if (tenantMap[organizationId]) {
+    return tenantMap[organizationId];
+  }
+  const fallback =
+    normalizeOptionalId(envStore.resolve("FORGE_WORKOS_TENANT_ID_FALLBACK")) ??
+    normalizeOptionalId(envStore.resolve("VITE_FORGE_WORKOS_TENANT_ID_FALLBACK"));
+  if (organizationId.startsWith("org_") && fallback) {
+    return fallback;
+  }
+  return organizationId;
+}
+
+function mapWorkOSClaimsTenant(
+  envStore: ReturnType<typeof getRuntimeEnvStore>,
+  claims: Record<string, unknown>,
+): Record<string, unknown> {
+  const rawOrganizationId = claims.organization_id;
+  const mappedTenantId = mapWorkOSTenantId(envStore, rawOrganizationId);
+  if (!mappedTenantId || mappedTenantId === rawOrganizationId) {
+    return claims;
+  }
+  return {
+    ...claims,
+    workos_organization_id: rawOrganizationId,
+    organization_id: mappedTenantId,
+    tenant_id: mappedTenantId,
+  };
+}
+
+function enrichWorkOSDevSession(workspaceRoot: string, session: WorkOSDevSession): WorkOSDevSession {
+  const role = session.role ?? session.roles?.[0];
+  const permissions = session.permissions && session.permissions.length > 0
+    ? session.permissions
+    : deriveDevPermissionsForRole(workspaceRoot, role);
+  return {
+    ...session,
+    ...(role && !session.role ? { role } : {}),
+    ...(role && (!session.roles || session.roles.length === 0) ? { roles: [role] } : {}),
+    ...(permissions.length > 0 ? { permissions } : {}),
+  };
+}
+
 function authFromWorkOSDevSessionCookie(
   request: Request,
+  workspaceRoot: string,
   envStore: ReturnType<typeof getRuntimeEnvStore>,
 ): AuthContext | null {
   const cookiePassword = envStore.resolve("WORKOS_COOKIE_PASSWORD");
@@ -523,7 +600,10 @@ function authFromWorkOSDevSessionCookie(
   if (!session) {
     return null;
   }
-  const claims = workOSDevSessionClaims(session);
+  const claims = mapWorkOSClaimsTenant(
+    envStore,
+    workOSDevSessionClaims(enrichWorkOSDevSession(workspaceRoot, session)),
+  );
   return resolveAuthFromHeaders({
     userId: typeof claims.sub === "string" ? claims.sub : undefined,
     tenantId: typeof claims.organization_id === "string" ? claims.organization_id : undefined,
@@ -541,6 +621,7 @@ function authFromWorkOSDevSessionCookie(
 
 async function authenticateDevRequest(
   request: Request,
+  workspaceRoot: string,
   authConfig: ReturnType<typeof loadAuthConfigFromEnv>,
   envStore: ReturnType<typeof getRuntimeEnvStore>,
 ): Promise<AuthContext> {
@@ -549,13 +630,13 @@ async function authenticateDevRequest(
     if (headerAuth.kind !== "anonymous") {
       return headerAuth;
     }
-    return authFromWorkOSDevSessionCookie(request, envStore) ?? headerAuth;
+    return authFromWorkOSDevSessionCookie(request, workspaceRoot, envStore) ?? headerAuth;
   }
 
   try {
     return await authenticateHeaders(request.headers, authConfig);
   } catch (error) {
-    const cookieAuth = authFromWorkOSDevSessionCookie(request, envStore);
+    const cookieAuth = authFromWorkOSDevSessionCookie(request, workspaceRoot, envStore);
     if (cookieAuth) {
       return cookieAuth;
     }
@@ -1585,6 +1666,20 @@ export async function startDevServer(
               const membership = (result.organizationMembership ?? {}) as Record<string, unknown>;
               const accessToken = typeof result.accessToken === "string" ? result.accessToken : "";
               const refreshToken = typeof result.refreshToken === "string" ? result.refreshToken : undefined;
+              const roles = Array.isArray(result.roles)
+                ? result.roles.filter((role): role is string => typeof role === "string")
+                : [];
+              const role =
+                typeof result.role === "string"
+                  ? result.role
+                  : typeof (membership.role as Record<string, unknown> | undefined)?.slug === "string"
+                    ? String((membership.role as Record<string, unknown>).slug)
+                    : roles[0];
+              const permissions = Array.isArray(result.permissions)
+                ? result.permissions.filter((permission): permission is string => typeof permission === "string")
+                : [];
+              const effectivePermissions =
+                permissions.length > 0 ? permissions : deriveDevPermissionsForRole(workspaceRoot, role);
               const session: WorkOSDevSession = {
                 user,
                 accessToken,
@@ -1599,17 +1694,9 @@ export async function startDevServer(
                   : typeof membership.id === "string"
                     ? { organizationMembershipId: membership.id }
                     : {}),
-                ...(typeof result.role === "string" ? { role: result.role } : {}),
-                ...(Array.isArray(result.roles)
-                  ? { roles: result.roles.filter((role): role is string => typeof role === "string") }
-                  : {}),
-                ...(Array.isArray(result.permissions)
-                  ? {
-                      permissions: result.permissions.filter(
-                        (permission): permission is string => typeof permission === "string",
-                      ),
-                    }
-                  : {}),
+                ...(role ? { role } : {}),
+                ...(roles.length > 0 ? { roles } : role ? { roles: [role] } : {}),
+                ...(effectivePermissions.length > 0 ? { permissions: effectivePermissions } : {}),
                 issuedAt: Math.floor(Date.now() / 1000),
               };
               return redirectResponse(
@@ -1660,7 +1747,16 @@ export async function startDevServer(
               cookiePassword,
             );
             return session
-              ? jsonResponse({ ok: true, session: { user: session.user, claims: workOSDevSessionClaims(session) } })
+              ? jsonResponse({
+                  ok: true,
+                  session: {
+                    user: session.user,
+                    claims: mapWorkOSClaimsTenant(
+                      envStore,
+                      workOSDevSessionClaims(enrichWorkOSDevSession(workspaceRoot, session)),
+                    ),
+                  },
+                })
               : jsonResponse({ ok: false, session: null }, 401);
           }
         }
@@ -1885,7 +1981,7 @@ export async function startDevServer(
             }
           }
 
-          const auth = await authenticateDevRequest(request, authConfig, getRuntimeEnvStore(workspaceRoot));
+          const auth = await authenticateDevRequest(request, workspaceRoot, authConfig, getRuntimeEnvStore(workspaceRoot));
           const lastRevision = Number(
             request.headers.get("last-event-id") ??
               url.searchParams.get("lastRevision") ??
@@ -2009,7 +2105,7 @@ export async function startDevServer(
               400,
             );
           }
-          const auth = await authenticateDevRequest(request, authConfig, getRuntimeEnvStore(workspaceRoot));
+          const auth = await authenticateDevRequest(request, workspaceRoot, authConfig, getRuntimeEnvStore(workspaceRoot));
           const envStore = getRuntimeEnvStore(workspaceRoot);
           const secretRegistry = loadSecretRegistry(workspaceRoot);
           const bundle = createRuntimeSecretsBundle({
@@ -2129,7 +2225,7 @@ export async function startDevServer(
           }
 
           const purpose = body.purpose ?? "dev_agent_chat";
-          const auth = await authenticateDevRequest(request, authConfig, getRuntimeEnvStore(workspaceRoot));
+          const auth = await authenticateDevRequest(request, workspaceRoot, authConfig, getRuntimeEnvStore(workspaceRoot));
           const envStore = getRuntimeEnvStore(workspaceRoot);
           const secretRegistry = loadSecretRegistry(workspaceRoot);
           const bundle = createRuntimeSecretsBundle({
@@ -2544,7 +2640,7 @@ export async function startDevServer(
           const externalInvoke = parseExternalInvoke(pathname);
           if (externalInvoke) {
             const args = await parseRequestArgs(request);
-            const auth = await authenticateDevRequest(request, authConfig, getRuntimeEnvStore(workspaceRoot));
+            const auth = await authenticateDevRequest(request, workspaceRoot, authConfig, getRuntimeEnvStore(workspaceRoot));
             const result = await runExternalEntry(
               workspaceRoot,
               {
@@ -2612,7 +2708,7 @@ export async function startDevServer(
             }
 
             const args = await parseRequestArgs(request);
-            const auth = await authenticateDevRequest(request, authConfig, getRuntimeEnvStore(workspaceRoot));
+            const auth = await authenticateDevRequest(request, workspaceRoot, authConfig, getRuntimeEnvStore(workspaceRoot));
 
             const result = await runQuery(
               workspaceRoot,
@@ -2685,7 +2781,7 @@ export async function startDevServer(
             }
 
             const args = await parseRequestArgs(request);
-            const auth = await authenticateDevRequest(request, authConfig, getRuntimeEnvStore(workspaceRoot));
+            const auth = await authenticateDevRequest(request, workspaceRoot, authConfig, getRuntimeEnvStore(workspaceRoot));
 
             await prepareRuntimeEnvironment(workspaceRoot, {
               mock: options.mock,

package/src/forge/version.ts

@@ -1,3 +1,3 @@
-export const FORGEOS_VERSION = "0.1.0-alpha.58";
+export const FORGEOS_VERSION = "0.1.0-alpha.60";
 export const GENERATOR_VERSION = FORGEOS_VERSION;
 export const CLI_VERSION = FORGEOS_VERSION;