forgeos 0.1.0-alpha.7 → 0.1.0-alpha.71

package/src/forge/runtime/telemetry/buffer.ts

@@ -34,7 +34,10 @@ export async function insertTelemetryEvent(
 
   const id = Number(result.rows[0]?.id);
   if (!Number.isFinite(id)) {
-    throw new Error("telemetry insert did not return id");
+    // Some adapters can successfully apply INSERT ... RETURNING while omitting
+    // returned rows. Telemetry must not turn a successful runtime request into
+    // FORGE_DEV_SERVER_ERROR; SQL execution failures still throw from runQuery.
+    return 0;
   }
   return id;
 }

package/src/forge/runtime/telemetry/scrubber.ts

@@ -4,6 +4,7 @@ import {
   FORGE_TELEMETRY_SECRET_REDACTED,
 } from "../../compiler/diagnostics/codes.ts";
 import type { Diagnostic } from "../../compiler/types/diagnostic.ts";
+import { hashStable } from "../../compiler/primitives/hash.ts";
 
 const SECRET_KEY_PATTERN =
   /password|secret|token|apikey|authorization|cookie/i;
@@ -101,6 +102,28 @@ function scrubObject(
   return result;
 }
 
+function summarizeValue(value: unknown): Record<string, unknown> {
+  if (Array.isArray(value)) {
+    return { type: "array", length: value.length };
+  }
+  if (value && typeof value === "object") {
+    return {
+      type: "object",
+      keys: Object.keys(value as Record<string, unknown>).sort().slice(0, 20),
+    };
+  }
+  if (typeof value === "string") {
+    return { type: "string", length: value.length };
+  }
+  return { type: value === null ? "null" : typeof value };
+}
+
+function summarizePayload(payload: Record<string, unknown>): Record<string, unknown> {
+  return Object.fromEntries(
+    Object.entries(payload).map(([key, value]) => [key, summarizeValue(value)]),
+  );
+}
+
 function truncateString(
   value: string,
   maxBytes: number,
@@ -148,7 +171,8 @@ export function scrubEnvelopePayload<T extends Record<string, unknown>>(
   }
 
   const serialized = JSON.stringify(scrubbed);
-  if (Buffer.byteLength(serialized, "utf8") > MAX_PAYLOAD_BYTES) {
+  const originalBytes = Buffer.byteLength(serialized, "utf8");
+  if (originalBytes > MAX_PAYLOAD_BYTES) {
     diagnostics.push(
       createDiagnostic({
         severity: "warning",
@@ -156,10 +180,16 @@ export function scrubEnvelopePayload<T extends Record<string, unknown>>(
         message: `truncated telemetry payload to ${MAX_PAYLOAD_BYTES} bytes`,
       }),
     );
-    const parsed = JSON.parse(
-      truncateString(serialized, MAX_PAYLOAD_BYTES, diagnostics, "payload"),
-    ) as T;
-    return { value: parsed, diagnostics };
+    return {
+      value: {
+        truncated: true,
+        originalBytes,
+        maxBytes: MAX_PAYLOAD_BYTES,
+        hash: hashStable(serialized),
+        summary: summarizePayload(scrubbed),
+      } as unknown as T,
+      diagnostics,
+    };
   }
 
   return { value: scrubbed, diagnostics };

package/src/forge/runtime/webhooks/security.ts

@@ -6,7 +6,7 @@ import {
   FORGE_WEBHOOK_TIMESTAMP_INVALID,
 } from "../../compiler/diagnostics/codes.ts";
 
-export type WebhookProvider = "generic" | "github" | "stripe";
+export type WebhookProvider = "generic" | "github" | "stripe" | "workos";
 
 export interface WebhookReplayStore {
   has(eventId: string): boolean | Promise<boolean>;
@@ -69,12 +69,14 @@ function fail(
   return { ok: false, provider, code, reason };
 }
 
-function parseStripeHeader(header: string): { timestamp?: number; signatures: string[] } {
+function parseTimestampedSignatureHeader(header: string): { timestampRaw?: string; timestamp?: number; signatures: string[] } {
   const signatures: string[] = [];
+  let timestampRaw: string | undefined;
   let timestamp: number | undefined;
   for (const part of header.split(",")) {
     const [key, value] = part.split("=", 2).map((item) => item.trim());
     if (key === "t") {
+      timestampRaw = value;
       const parsed = Number(value);
       if (Number.isFinite(parsed)) {
         timestamp = parsed;
@@ -84,7 +86,7 @@ function parseStripeHeader(header: string): { timestamp?: number; signatures: st
       signatures.push(value);
     }
   }
-  return { timestamp, signatures };
+  return { timestampRaw, timestamp, signatures };
 }
 
 function validateTimestamp(input: {
@@ -131,9 +133,11 @@ export async function verifyWebhookSignature(
   let valid = false;
   let timestamp: number | undefined;
 
-  if (input.provider === "stripe") {
-    const parsed = parseStripeHeader(signatureHeader);
-    timestamp = parsed.timestamp;
+  if (input.provider === "stripe" || input.provider === "workos") {
+    const parsed = parseTimestampedSignatureHeader(signatureHeader);
+    timestamp = input.provider === "workos" && parsed.timestamp !== undefined
+      ? parsed.timestamp / 1000
+      : parsed.timestamp;
     const timestampFailure = validateTimestamp({
       provider: input.provider,
       timestamp,
@@ -143,7 +147,8 @@ export async function verifyWebhookSignature(
     if (timestampFailure) {
       return timestampFailure;
     }
-    const signedPayload = `${timestamp}.${Buffer.from(bytes(input.payload)).toString("utf8")}`;
+    const timestampForSignature = parsed.timestampRaw ?? String(parsed.timestamp);
+    const signedPayload = `${timestampForSignature}.${Buffer.from(bytes(input.payload)).toString("utf8")}`;
     const expected = hmacHex(input.secret, signedPayload);
     valid = parsed.signatures.some((signature) => safeEqualHex(signature, expected));
   } else if (input.provider === "github") {

package/src/forge/server.ts

@@ -1,9 +1,10 @@
 export type ForgeAuthRule =
   | { kind: "policy"; policy: string }
   | { kind: "roles"; roles: string[] }
+  | { kind: "permissions"; permissions: string[] }
   | { kind: "public" };
 
-export type ForgeDefinition<T extends Record<string, unknown>> = T;
+export type ForgeDefinition<T> = T;
 
 export type ForgeRecord = Record<string, any>;
 
@@ -63,23 +64,49 @@ export interface ForgeContext {
   };
 }
 
+export type ForgeInputSchema<TOutput = unknown> =
+  | { parse(input: unknown, ...args: any[]): TOutput }
+  | { _output: TOutput }
+  | { _type: TOutput };
+
+export type InferForgeInput<TSchema> =
+  TSchema extends { parse(input: unknown, ...args: any[]): infer TOutput }
+    ? TOutput
+    : TSchema extends { _output: infer TOutput }
+      ? TOutput
+      : TSchema extends { _type: infer TOutput }
+        ? TOutput
+        : unknown;
+
+type ForgeInputShape<TSchema> =
+  | { input: TSchema; inputSchema?: never }
+  | { inputSchema: TSchema; input?: never };
+
 export type ForgeCommandDefinition<TArgs = unknown, TResult = unknown> = Record<string, unknown> & {
   auth?: ForgeAuthRule;
+  input?: unknown;
+  inputSchema?: unknown;
   handler: (ctx: ForgeContext, args: TArgs) => TResult | Promise<TResult>;
 };
 
 export type ForgeQueryDefinition<TArgs = unknown, TResult = unknown> = Record<string, unknown> & {
   auth?: ForgeAuthRule;
+  input?: unknown;
+  inputSchema?: unknown;
   handler: (ctx: ForgeContext, args?: TArgs) => TResult | Promise<TResult>;
 };
 
 export type ForgeLiveQueryDefinition<TArgs = unknown, TResult = unknown> = Record<string, unknown> & {
   auth?: ForgeAuthRule;
+  input?: unknown;
+  inputSchema?: unknown;
   handler: (ctx: ForgeContext, args?: TArgs) => TResult | Promise<TResult>;
 };
 
 export type ForgeActionDefinition<TEvent = unknown, TResult = unknown> = Record<string, unknown> & {
   event?: string;
+  input?: unknown;
+  inputSchema?: unknown;
   handler: (ctx: ForgeContext, event: TEvent) => TResult | Promise<TResult>;
 };
 
@@ -134,23 +161,55 @@ export function canRole(...roles: string[]): ForgeAuthRule {
   return { kind: "roles", roles };
 }
 
+export function canPermission(...permissions: string[]): ForgeAuthRule {
+  return { kind: "permissions", permissions };
+}
+
 export function public_(): ForgeAuthRule {
   return { kind: "public" };
 }
 
-export function command<T extends ForgeCommandDefinition>(definition: T): ForgeDefinition<T> {
+export function command<T extends (...args: never[]) => unknown>(definition: T): ForgeDefinition<T>;
+export function command<TSchema extends ForgeInputSchema, TResult = unknown>(
+  definition: ForgeCommandDefinition<InferForgeInput<TSchema>, TResult> & ForgeInputShape<TSchema>,
+): ForgeDefinition<ForgeCommandDefinition<InferForgeInput<TSchema>, TResult> & ForgeInputShape<TSchema>>;
+export function command<TArgs = unknown, TResult = unknown>(
+  definition: ForgeCommandDefinition<TArgs, TResult>,
+): ForgeDefinition<ForgeCommandDefinition<TArgs, TResult>>;
+export function command<T>(definition: T): ForgeDefinition<T> {
   return definition;
 }
 
-export function query<T extends ForgeQueryDefinition>(definition: T): ForgeDefinition<T> {
+export function query<T extends (...args: never[]) => unknown>(definition: T): ForgeDefinition<T>;
+export function query<TSchema extends ForgeInputSchema, TResult = unknown>(
+  definition: ForgeQueryDefinition<InferForgeInput<TSchema>, TResult> & ForgeInputShape<TSchema>,
+): ForgeDefinition<ForgeQueryDefinition<InferForgeInput<TSchema>, TResult> & ForgeInputShape<TSchema>>;
+export function query<TArgs = unknown, TResult = unknown>(
+  definition: ForgeQueryDefinition<TArgs, TResult>,
+): ForgeDefinition<ForgeQueryDefinition<TArgs, TResult>>;
+export function query<T>(definition: T): ForgeDefinition<T> {
   return definition;
 }
 
-export function liveQuery<T extends ForgeLiveQueryDefinition>(definition: T): ForgeDefinition<T> {
+export function liveQuery<T extends (...args: never[]) => unknown>(definition: T): ForgeDefinition<T>;
+export function liveQuery<TSchema extends ForgeInputSchema, TResult = unknown>(
+  definition: ForgeLiveQueryDefinition<InferForgeInput<TSchema>, TResult> & ForgeInputShape<TSchema>,
+): ForgeDefinition<ForgeLiveQueryDefinition<InferForgeInput<TSchema>, TResult> & ForgeInputShape<TSchema>>;
+export function liveQuery<TArgs = unknown, TResult = unknown>(
+  definition: ForgeLiveQueryDefinition<TArgs, TResult>,
+): ForgeDefinition<ForgeLiveQueryDefinition<TArgs, TResult>>;
+export function liveQuery<T>(definition: T): ForgeDefinition<T> {
   return definition;
 }
 
-export function action<T extends ForgeActionDefinition>(definition: T): ForgeDefinition<T> {
+export function action<T extends (...args: never[]) => unknown>(definition: T): ForgeDefinition<T>;
+export function action<TSchema extends ForgeInputSchema, TResult = unknown>(
+  definition: ForgeActionDefinition<InferForgeInput<TSchema>, TResult> & ForgeInputShape<TSchema>,
+): ForgeDefinition<ForgeActionDefinition<InferForgeInput<TSchema>, TResult> & ForgeInputShape<TSchema>>;
+export function action<TEvent = unknown, TResult = unknown>(
+  definition: ForgeActionDefinition<TEvent, TResult>,
+): ForgeDefinition<ForgeActionDefinition<TEvent, TResult>>;
+export function action<T>(definition: T): ForgeDefinition<T> {
   return definition;
 }
 
@@ -173,8 +232,13 @@ export function step<T extends (...args: any[]) => unknown>(
   return { kind: "step", name, handler };
 }
 
-export function workflow<T extends Record<string, unknown>>(definition: T): ForgeDefinition<T> {
-  return definition;
+export function workflow<T extends Record<string, unknown>>(
+  definition: T,
+): ForgeDefinition<T & { __forge: { kind: "workflow" } }> {
+  return {
+    ...definition,
+    __forge: { kind: "workflow" },
+  };
 }
 
 export {