forgeos 0.1.0-alpha.7 → 0.1.0-alpha.9

package/AGENTS.md

@@ -1,4 +1,4 @@
-// @forge-generated generator=0.1.0-alpha.7 input=4fe172e9300b7393cef5b37bfef064fb779c42d420e54af7e07045ad230330a9 content=1611635edf59c122b013ba76c85bd333ab3b30b289aaea04a9074f9438782a50
+// @forge-generated generator=0.1.0-alpha.9 input=f9063a03ef56a20a89f1418951bede5ab5ed87d800bb0512a0d0445309642a36 content=1611635edf59c122b013ba76c85bd333ab3b30b289aaea04a9074f9438782a50
 # AGENTS.md
 
 <!-- forge-generated:start -->

package/CHANGELOG.md

@@ -1,5 +1,19 @@
 # forgeos
 
+## 0.1.0-alpha.9
+
+### Patch Changes
+
+- Reuse compiler classifier package signals across export classification, dropping repeated package signal scans.
+- Reuse serialized graph JSON when rendering the largest generated TypeScript graph artifacts.
+- Keep generated Forge artifacts aligned with the `0.1.0-alpha.9` compiler/runtime version.
+
+## 0.1.0-alpha.8
+
+### Patch Changes
+
+- [`7568756`](https://github.com/Stahldavid/forge/commit/756875688873dd60d3d6cf700a7bb7c211968c69) Thanks [@Stahldavid](https://github.com/Stahldavid)! - Publish prerelease packages through the ForgeOS alpha publisher so npm dist-tags stay aligned.
+
 ## 0.1.0-alpha.7
 
 ### Patch Changes

package/adapters/go/README.md

@@ -0,0 +1,23 @@
+# Forge Go Adapter
+
+`adapters/go` is the minimal Go SDK for external Forge runtimes. It registers
+commands and queries, emits `forge.manifest.json`, and exposes a Forge-compatible
+HTTP handler.
+
+```go
+app := forge.New("billing", forge.BaseURL("http://127.0.0.1:8787"))
+
+app.Command("createInvoice", forge.Handle(createInvoice),
+    forge.Policy("billing.manage"),
+    forge.TenantScoped(true),
+    forge.NeedsApproval(true),
+)
+
+app.Query("listInvoices", forge.Handle(listInvoices),
+    forge.Policy("billing.manage"),
+    forge.TenantScoped(true),
+)
+```
+
+The HTTP handler accepts Forge runtime envelopes on `/commands/:name` and
+`/queries/:name`, then returns `{ "ok": true, "result": ... }` envelopes.

package/adapters/go/go.mod

@@ -0,0 +1,3 @@
+module github.com/Stahldavid/forge/adapters/go
+
+go 1.22

package/adapters/go/http.go

@@ -0,0 +1,149 @@
+package forge
+
+import (
+	"encoding/json"
+	"errors"
+	"net/http"
+	"strings"
+)
+
+func (registry *Registry) HTTPHandler() http.Handler {
+	mux := http.NewServeMux()
+	mux.HandleFunc(registry.service.Health, registry.handleHealth)
+	mux.HandleFunc("/manifest", registry.handleManifest)
+	mux.HandleFunc("/commands/", registry.handleRuntime(KindCommand, "/commands/"))
+	mux.HandleFunc("/queries/", registry.handleRuntime(KindQuery, "/queries/"))
+	return mux
+}
+
+func (registry *Registry) handleHealth(response http.ResponseWriter, request *http.Request) {
+	writeJSON(response, http.StatusOK, map[string]any{
+		"ok":      true,
+		"service": registry.service.Name,
+	})
+}
+
+func (registry *Registry) handleManifest(response http.ResponseWriter, request *http.Request) {
+	baseURL := request.URL.Query().Get("baseUrl")
+	if baseURL == "" {
+		baseURL = registry.service.BaseURL
+	}
+	writeJSON(response, http.StatusOK, registry.Manifest(baseURL))
+}
+
+func (registry *Registry) handleRuntime(kind EntryKind, prefix string) http.HandlerFunc {
+	return func(response http.ResponseWriter, request *http.Request) {
+		name := strings.TrimPrefix(request.URL.Path, prefix)
+		registered, ok := registry.lookup[lookupKey(kind, name)]
+		if !ok {
+			writeError(response, http.StatusNotFound, "", "FORGE_GO_ENTRY_NOT_FOUND", "external entry not found")
+			return
+		}
+		if request.Method != http.MethodPost && request.Method != http.MethodGet {
+			writeError(response, http.StatusMethodNotAllowed, "", "FORGE_GO_METHOD_NOT_ALLOWED", "external entry only accepts GET or POST")
+			return
+		}
+
+		envelope, err := readRequestEnvelope(request)
+		traceID := traceIDFrom(request, envelope)
+		if err != nil {
+			writeError(response, http.StatusBadRequest, traceID, "FORGE_GO_BAD_REQUEST", err.Error())
+			return
+		}
+		if envelope.Forge.Service == "" {
+			envelope.Forge.Service = registry.service.Name
+		}
+		if envelope.Forge.Entry == "" {
+			envelope.Forge.Entry = name
+		}
+		if envelope.Forge.Kind == "" {
+			envelope.Forge.Kind = string(kind)
+		}
+		if envelope.Forge.TraceID == "" {
+			envelope.Forge.TraceID = traceID
+		}
+		if envelope.Auth.Kind == "" {
+			envelope.Auth = authFromHeaders(request.Header)
+		}
+
+		call := &Context{
+			Auth:    envelope.Auth,
+			Forge:   envelope.Forge,
+			Headers: request.Header,
+		}
+		result, err := registered.handler(request.Context(), call, envelope.Args)
+		if err != nil {
+			writeError(response, http.StatusInternalServerError, envelope.Forge.TraceID, "FORGE_GO_HANDLER_FAILED", err.Error())
+			return
+		}
+		writeJSON(response, http.StatusOK, ResponseEnvelope{
+			OK:      true,
+			Result:  result,
+			TraceID: envelope.Forge.TraceID,
+		})
+	}
+}
+
+func readRequestEnvelope(request *http.Request) (RequestEnvelope, error) {
+	if request.Method == http.MethodGet {
+		args := request.URL.Query().Get("args")
+		if args == "" {
+			args = "{}"
+		}
+		return RequestEnvelope{Args: json.RawMessage(args)}, nil
+	}
+	defer request.Body.Close()
+	var envelope RequestEnvelope
+	decoder := json.NewDecoder(request.Body)
+	if err := decoder.Decode(&envelope); err != nil {
+		return envelope, err
+	}
+	if len(envelope.Args) == 0 {
+		envelope.Args = json.RawMessage("{}")
+	}
+	if !json.Valid(envelope.Args) {
+		return envelope, errors.New("request args must be valid JSON")
+	}
+	return envelope, nil
+}
+
+func authFromHeaders(headers http.Header) Auth {
+	auth := Auth{Kind: headers.Get("x-forge-auth-kind")}
+	if auth.Kind == "" {
+		auth.Kind = "anonymous"
+	}
+	auth.UserID = headers.Get("x-forge-user-id")
+	auth.TenantID = headers.Get("x-forge-tenant-id")
+	auth.Role = headers.Get("x-forge-role")
+	return auth
+}
+
+func traceIDFrom(request *http.Request, envelope RequestEnvelope) string {
+	if envelope.Forge.TraceID != "" {
+		return envelope.Forge.TraceID
+	}
+	return request.Header.Get("x-forge-trace-id")
+}
+
+func writeError(response http.ResponseWriter, status int, traceID string, code string, message string) {
+	writeJSON(response, status, ResponseEnvelope{
+		OK: false,
+		Diagnostics: []Diagnostic{{
+			Severity: "error",
+			Code:     code,
+			Message:  message,
+			Docs:     []string{"docs/forge-protocol.md"},
+		}},
+		Error: &ErrorInfo{
+			Code:    code,
+			Message: message,
+		},
+		TraceID: traceID,
+	})
+}
+
+func writeJSON(response http.ResponseWriter, status int, body any) {
+	response.Header().Set("content-type", "application/json")
+	response.WriteHeader(status)
+	_ = json.NewEncoder(response).Encode(body)
+}

package/adapters/go/registry.go

@@ -0,0 +1,234 @@
+package forge
+
+import (
+	"encoding/json"
+	"io"
+)
+
+type Registry struct {
+	service   Service
+	framework string
+	schemas   map[string]any
+	entries   []registeredEntry
+	lookup    map[string]registeredEntry
+}
+
+type registeredEntry struct {
+	entry   Entry
+	handler HandlerFunc
+}
+
+type RegistryOption func(*Registry)
+type EntryOption func(*Entry)
+
+func New(serviceName string, options ...RegistryOption) *Registry {
+	registry := &Registry{
+		service: Service{
+			Name:      serviceName,
+			Transport: "http",
+			Health:    "/health",
+		},
+		framework: "net/http",
+		schemas:   map[string]any{},
+		lookup:    map[string]registeredEntry{},
+	}
+	for _, option := range options {
+		option(registry)
+	}
+	return registry
+}
+
+func Framework(value string) RegistryOption {
+	return func(registry *Registry) {
+		registry.framework = value
+	}
+}
+
+func BaseURL(value string) RegistryOption {
+	return func(registry *Registry) {
+		registry.service.BaseURL = value
+	}
+}
+
+func Health(path string) RegistryOption {
+	return func(registry *Registry) {
+		registry.service.Health = path
+	}
+}
+
+func SchemaRef(name string, schema any) RegistryOption {
+	return func(registry *Registry) {
+		registry.schemas[name] = schema
+	}
+}
+
+func (registry *Registry) Command(name string, handler HandlerFunc, options ...EntryOption) {
+	entry := Entry{
+		Name:        name,
+		Kind:        KindCommand,
+		Path:        "/commands/" + name,
+		Method:      "POST",
+		Transaction: TransactionExternalManaged,
+		Risk:        RiskWrite,
+	}
+	registry.add(entry, handler, options...)
+}
+
+func (registry *Registry) Query(name string, handler HandlerFunc, options ...EntryOption) {
+	entry := Entry{
+		Name:        name,
+		Kind:        KindQuery,
+		Path:        "/queries/" + name,
+		Method:      "POST",
+		Transaction: TransactionReadOnly,
+		Risk:        RiskRead,
+	}
+	registry.add(entry, handler, options...)
+}
+
+func (registry *Registry) add(entry Entry, handler HandlerFunc, options ...EntryOption) {
+	for _, option := range options {
+		option(&entry)
+	}
+	registered := registeredEntry{entry: entry, handler: handler}
+	registry.entries = append(registry.entries, registered)
+	registry.lookup[lookupKey(entry.Kind, entry.Name)] = registered
+}
+
+func Description(value string) EntryOption {
+	return func(entry *Entry) {
+		entry.Description = value
+	}
+}
+
+func Path(value string) EntryOption {
+	return func(entry *Entry) {
+		entry.Path = value
+	}
+}
+
+func Method(value string) EntryOption {
+	return func(entry *Entry) {
+		entry.Method = value
+	}
+}
+
+func InputSchema(schema any) EntryOption {
+	return func(entry *Entry) {
+		entry.InputSchema = schema
+	}
+}
+
+func OutputSchema(schema any) EntryOption {
+	return func(entry *Entry) {
+		entry.OutputSchema = schema
+	}
+}
+
+func Policy(value string) EntryOption {
+	return func(entry *Entry) {
+		entry.Policy = value
+	}
+}
+
+func TenantScoped(value bool) EntryOption {
+	return func(entry *Entry) {
+		entry.TenantScoped = value
+	}
+}
+
+func TransactionMode(value Transaction) EntryOption {
+	return func(entry *Entry) {
+		entry.Transaction = value
+	}
+}
+
+func EntryRisk(value Risk) EntryOption {
+	return func(entry *Entry) {
+		entry.Risk = value
+	}
+}
+
+func NeedsApproval(value bool) EntryOption {
+	return func(entry *Entry) {
+		entry.NeedsApproval = &value
+	}
+}
+
+func Effects(values ...string) EntryOption {
+	return func(entry *Entry) {
+		entry.Effects = append([]string{}, values...)
+	}
+}
+
+func ReadOnly() EntryOption {
+	return func(entry *Entry) {
+		entry.Transaction = TransactionReadOnly
+		entry.Risk = RiskRead
+	}
+}
+
+func (registry *Registry) Manifest(baseURL string) Manifest {
+	service := registry.service
+	if baseURL != "" {
+		service.BaseURL = baseURL
+	}
+	entries := make([]Entry, 0, len(registry.entries))
+	for _, registered := range registry.entries {
+		entries = append(entries, registered.entry)
+	}
+	manifest := Manifest{
+		ForgeProtocol: ProtocolVersion,
+		Language:      "go",
+		Framework:     registry.framework,
+		Service:       service,
+		Entries:       entries,
+	}
+	if len(registry.schemas) > 0 {
+		manifest.Schemas = registry.schemas
+	}
+	return manifest
+}
+
+func (registry *Registry) MarshalManifest(baseURL string) ([]byte, error) {
+	return json.MarshalIndent(registry.Manifest(baseURL), "", "  ")
+}
+
+func (registry *Registry) WriteManifest(writer io.Writer, baseURL string) error {
+	encoded, err := registry.MarshalManifest(baseURL)
+	if err != nil {
+		return err
+	}
+	if _, err := writer.Write(encoded); err != nil {
+		return err
+	}
+	_, err = writer.Write([]byte("\n"))
+	return err
+}
+
+func Object(properties map[string]any, required ...string) Schema {
+	schema := Schema{
+		"type":       "object",
+		"properties": properties,
+	}
+	if len(required) > 0 {
+		schema["required"] = required
+	}
+	return schema
+}
+
+func String() Schema {
+	return Schema{"type": "string"}
+}
+
+func Boolean() Schema {
+	return Schema{"type": "boolean"}
+}
+
+func Array(items any) Schema {
+	return Schema{"type": "array", "items": items}
+}
+
+func lookupKey(kind EntryKind, name string) string {
+	return string(kind) + ":" + name
+}

package/adapters/go/types.go

@@ -0,0 +1,136 @@
+package forge
+
+import (
+	"context"
+	"encoding/json"
+	"net/http"
+)
+
+const ProtocolVersion = "1.0"
+
+type EntryKind string
+type Risk string
+type Transaction string
+
+const (
+	KindCommand EntryKind = "command"
+	KindQuery   EntryKind = "query"
+
+	RiskRead        Risk = "read"
+	RiskWrite       Risk = "write"
+	RiskDestructive Risk = "destructive"
+	RiskExternal    Risk = "external"
+
+	TransactionReadOnly        Transaction = "read-only"
+	TransactionExternalManaged Transaction = "external-managed"
+	TransactionForgeManaged    Transaction = "forge-managed"
+	TransactionSaga            Transaction = "saga"
+)
+
+type Schema map[string]any
+
+type Manifest struct {
+	ForgeProtocol string         `json:"forgeProtocol"`
+	Language      string         `json:"language"`
+	Framework     string         `json:"framework,omitempty"`
+	Service       Service        `json:"service"`
+	Entries       []Entry        `json:"entries"`
+	Schemas       map[string]any `json:"schemas,omitempty"`
+}
+
+type Service struct {
+	Name      string `json:"name"`
+	Transport string `json:"transport"`
+	BaseURL   string `json:"baseUrl,omitempty"`
+	Command   string `json:"command,omitempty"`
+	Health    string `json:"health,omitempty"`
+}
+
+type Entry struct {
+	Name          string      `json:"name"`
+	Kind          EntryKind   `json:"kind"`
+	Description   string      `json:"description,omitempty"`
+	Path          string      `json:"path,omitempty"`
+	Method        string      `json:"method,omitempty"`
+	InputSchema   any         `json:"inputSchema,omitempty"`
+	OutputSchema  any         `json:"outputSchema,omitempty"`
+	Policy        string      `json:"policy,omitempty"`
+	TenantScoped  bool        `json:"tenantScoped,omitempty"`
+	Transaction   Transaction `json:"transaction,omitempty"`
+	Risk          Risk        `json:"risk,omitempty"`
+	NeedsApproval *bool       `json:"needsApproval,omitempty"`
+	Effects       []string    `json:"effects,omitempty"`
+}
+
+type Auth struct {
+	Kind        string         `json:"kind"`
+	UserID      string         `json:"userId,omitempty"`
+	TenantID    string         `json:"tenantId,omitempty"`
+	Role        string         `json:"role,omitempty"`
+	Roles       []string       `json:"roles,omitempty"`
+	Permissions []string       `json:"permissions,omitempty"`
+	Email       string         `json:"email,omitempty"`
+	Name        string         `json:"name,omitempty"`
+	Claims      map[string]any `json:"claims,omitempty"`
+}
+
+type ForgeCall struct {
+	Service string `json:"service"`
+	Entry   string `json:"entry"`
+	Kind    string `json:"kind"`
+	TraceID string `json:"traceId"`
+}
+
+type Context struct {
+	Auth    Auth
+	Forge   ForgeCall
+	Headers http.Header
+}
+
+type HandlerFunc func(context.Context, *Context, json.RawMessage) (any, error)
+
+type RequestEnvelope struct {
+	Args  json.RawMessage `json:"args"`
+	Auth  Auth            `json:"auth"`
+	Forge ForgeCall       `json:"forge"`
+}
+
+type ResponseEnvelope struct {
+	OK          bool         `json:"ok"`
+	Result      any          `json:"result,omitempty"`
+	Diagnostics []Diagnostic `json:"diagnostics,omitempty"`
+	Error       *ErrorInfo   `json:"error,omitempty"`
+	TraceID     string       `json:"traceId,omitempty"`
+}
+
+type Diagnostic struct {
+	Severity string   `json:"severity"`
+	Code     string   `json:"code"`
+	Message  string   `json:"message"`
+	File     string   `json:"file,omitempty"`
+	FixHint  string   `json:"fixHint,omitempty"`
+	Docs     []string `json:"docs,omitempty"`
+}
+
+type ErrorInfo struct {
+	Code    string `json:"code"`
+	Message string `json:"message"`
+}
+
+func Decode(raw json.RawMessage, target any) error {
+	if len(raw) == 0 || string(raw) == "null" {
+		raw = json.RawMessage("{}")
+	}
+	return json.Unmarshal(raw, target)
+}
+
+func Handle[In any, Out any](handler func(context.Context, *Context, In) (Out, error)) HandlerFunc {
+	return func(ctx context.Context, call *Context, raw json.RawMessage) (any, error) {
+		var input In
+		if err := Decode(raw, &input); err != nil {
+			var zero Out
+			return zero, err
+		}
+		return handler(ctx, call, input)
+	}
+}

package/docs/changelog.md

@@ -0,0 +1,82 @@
+# Changelog
+
+Release history for the `forgeos` npm package (`alpha` dist-tag).
+
+The canonical source file in the repository is `CHANGELOG.md`.
+
+## Unreleased
+
+Release and packaging hardening:
+
+- Added `forge --version` / `forge --version --json`.
+- Updated `create-forgeos-app` help to read the wrapper package version instead of a hardcoded string and bumped the wrapper to `0.1.0-alpha.2`.
+- Added dependency vulnerability evidence with an explicit waiver file and CI release gate.
+- Updated generated web template dependencies to current Vite/plugin-react and Next majors.
+
+## 0.1.0-alpha.5
+
+Release alignment for the public alpha channel:
+
+- Added `forge ai redteam --model-level --json` with deterministic prompt-injection, secret-exfiltration, approval-bypass, cross-tenant, and indirect tool-injection probes.
+- Added `forge security prove --full --json` support for source checkouts, with graceful structural-proof fallback when packaged apps do not include ForgeOS test fixtures.
+- Strengthened npm publish workflows to run `security prove --db postgres --full --json`.
+- Added public registry smoke coverage for `forgeos@alpha` and `create-forgeos-app@alpha`.
+- Bumped the create-app wrapper package line to `create-forgeos-app@0.1.0-alpha.1`.
+
+## 0.1.0-alpha.4
+
+Security assurance and release evidence hardening:
+
+- Added value-aware telemetry redaction for known secret values in safe-looking fields, messages, details, outputs, and stack traces.
+- Added webhook signature, timestamp, and replay protection helpers with Stripe/GitHub/generic HMAC coverage.
+- Added HTTP tenant-isolation tests that exercise the dev server/API boundary, not only the internal runtime executor.
+- Added `forge rls mutate-test --json` to kill dangerous generated RLS mutations such as missing FORCE RLS, missing policies, unconditional predicates, and `BYPASSRLS`.
+- Extended `forge security prove --json` with RLS mutation proof and invariant-level evidence metadata.
+- Added scripts to split security evidence by invariant and emit basic release supply-chain evidence plus CycloneDX SBOM.
+- Strengthened publish/security workflows so release gates use Postgres-backed security proof, RLS mutation proof, release evidence, and SBOM generation.
+
+## 0.1.0-alpha.3
+
+Native Forge AI agents on top of Vercel AI SDK v6:
+
+- Added `aiTool` and `agent` primitives with generated `agentTools.json` / `agentTools.md`.
+- Added `ctx.agent.run` and `ctx.ai.runAgent` using AI SDK `ToolLoopAgent`.
+- Added auto-tools for commands, queries, and liveQueries with read-only vs approval-required writes.
+- Added dev agent endpoints: `POST /ai/agents/run` and `POST /ai/agents/chat`.
+- Extended `forge ai` CLI with `tools`, `agents`, and `trace` subcommands.
+- Added `forge inspect agent-tools` and agent tool metadata in `agentContract.json`.
+- Upgraded runtime dependency to AI SDK v6 for tool calling, streaming UI, and MCP compatibility.
+
+Documentation:
+
+- Added public [AI](ai.md) page and AST-aware `rename command` codemod docs.
+- Full RTD expansion: [Agent Workflow](agent-workflow.md), [Frontend](frontend.md), [Security & Data](security-and-data.md), [Authoring](authoring.md), [Testing & Repair](testing-and-repair.md), [Self-Host](self-host.md), [Templates](templates.md), Material theme, search, and Mermaid diagrams.
+
+## 0.1.0-alpha.2
+
+Windows and generated-app hardening:
+
+- Fixed Node ESM handler loading on Windows by importing generated app modules through `file://` URLs across commands, queries, liveQueries, outbox actions, workflow steps, mocks, and telemetry adapters.
+- Fixed `forge dev` SSE streaming on the Node HTTP fallback so liveQuery snapshots are flushed immediately instead of buffering forever.
+- Hardened generated app scaffolding and web dev spawning on Windows.
+- Updated the B2B support template to route frontend imports through `web/lib/forge.ts` and use safer handler input validation.
+- Added focused tests for Node compatibility, template scaffolding, runtime imports, and streaming responses.
+- Added `create-forgeos-app@alpha` for `npm create forgeos-app@alpha`.
+- Added GitHub Packages mirror workflow for scoped package publishing.
+
+## 0.1.0-alpha.1
+
+Republish alpha with the dependency/API oracle improvements:
+
+- Added dependency API inspection commands for agents: `forge deps api`, `forge deps trace`, and `forge deps runtime-compat`.
+- Added dependency API summaries to `agentContract.json`.
+- Added package resolution traces, runtime compatibility metadata, and runtime/type mismatch diagnostics to `packageGraph`.
+- Reduced package graph warning noise for `package.json` metadata exports, declaration-file subpaths, and pattern exports.
+
+## 0.1.0-alpha.0
+
+Initial alpha packaging baseline for ForgeOS.
+
+This release line validates npm installation, the `forge` CLI binary, template creation, generated contracts, and the agent-native local development loop.
+
+Added Read the Docs-ready public documentation, generator/package version alignment checks, and a broad generated-app field-test harness for release hardening.