Packages

RazorWire lets ASP.NET Core MVC apps update UI by returning Razor fragments from the server instead of building a separate JSON endpoint and client-state rendering loop.

Use [appsurface durable doctor](../../Durable/runtime-doctor.md) for a non-mutating store/runtime diagnosis in text or version-one JSON. It accepts environment-source names and optional paired worker/actual-threshold inputs, and supplies explicit exits and next actions. Clean output links the [canonical Durable worker starter](../../start-here/durable-worker.md) while requiring the diagnosed application's own composition verifier; its null command does not invent or execute that verifier.

AppSurface ships as a coordinated package family. Before installing this package from a prerelease feed, check the [package chooser](https://github.com/forge-trust/AppSurface/blob/main/packages/README.md) and [release hub](https://github.com/forge-trust/AppSurface/blob/main/releases/README.md) for current release risk, migration guidance, and readiness.

`./eng/release` is the repository-owned release cockpit for coordinated AppSurface releases. It prepares the release pull request from the living unreleased note, validates the tagged release state, and emits structured data for GitHub Actions. Release evidence is consistency evidence for repository release artifacts; it is not a signature, hosted-build attestation, or SLSA/Sigstore provenance.

The **ForgeTrust.AppSurface.Web** package provides the bootstrapping logic for building ASP.NET Core applications using the AppSurface module system. It sits on top of the compilation concepts defined in `ForgeTrust.AppSurface.Core`.

This repository-only tool verifies the executable-contract adoption evidence owned by [AppSurface Durable](../../Durable/evidence/executable-contract-adoption.md). It is intentionally dependency-free and measures source shape; it does not load consumer assemblies or infer application policy.

This generated .NET 10 solution is an application-owned, public-preview example of a PostgreSQL-backed Durable Work host with an authenticated external wake. It contains no AppSurface source checkout or repository-test-project dependency. You own the generated host, Work contracts, authentication, deployment, and future upgrades.

.NET Aspire integration for the AppSurface ecosystem.

Deterministic typed testing for AppSurface Aspire profiles.

`ForgeTrust.AppSurface.Auth` provides passive auth contracts for AppSurface modules, including a transition-bound delegated-agent approval vocabulary for local task harnesses.

`ForgeTrust.AppSurface.Auth.Aspire.Keycloak` adds an AppHost-only local Keycloak proof for AppSurface OpenID Connect authentication. It builds on the official Aspire Keycloak hosting integration and keeps Keycloak, containers, and Aspire hosting dependencies out of runtime web app packages.

`ForgeTrust.AppSurface.Auth.AspNetCore` maps host-owned ASP.NET Core authentication and authorization into AppSurface auth contracts.

`ForgeTrust.AppSurface.Auth.AspNetCore.DevAuth` adds fake, local-only ASP.NET Core authentication for AppSurface package consumers who need to try auth-aware endpoints without configuring OIDC, cookies, ASP.NET Identity, or an external identity provider.

`ForgeTrust.AppSurface.Auth.AspNetCore.Oidc` registers named ASP.NET Core cookie and OpenID Connect schemes with AppSurface-safe defaults.

This repository-held package schema turns a complete, reviewed Keycloak recipe into a bounded capture, an offline build context, and evidence about one immutable image. It is not currently published or available as a package install. It is a host-side security workflow, not a Keycloak server, an authentication middleware package, or a package chooser. The package has no Python runtime dependency; its managed runtime dependencies are BouncyCastle.Cryptography and ZstdSharp.Port for compressed Debian payload handling. The supported host profile is Unix with Docker 29-compatible OCI support and the containerd snapshotter. Any future publication requires the separate pure publish decision and coordinated dependency authorization.

`ForgeTrust.AppSurface.Auth.Testing` is a test-only ASP.NET Core authentication harness for proving AppSurface auth behavior.

Caching primitives for AppSurface applications built on top of `Microsoft.Extensions.Caching.Memory`.

Strongly typed configuration primitives for AppSurface applications.

Google Cloud Secret Manager remote secret storage for AppSurface configuration.

OS-backed local secret posture for AppSurface configuration.

Modular bootstrapping for .NET Console applications using [CliFx](https://github.com/Tyrrrz/CliFx).

The foundation of the AppSurface ecosystem. This package defines the core abstractions, the startup pipeline, and the module system that powers all other AppSurface libraries.

Autofac IoC container integration for AppSurface modules.

Provider-neutral deployment contracts for AppSurface. The package describes explicit run-to-completion migration jobs, validates immutable image and source evidence, emits canonical JSON, and defines render and verification seams without depending on Aspire, a cloud SDK, Terraform, or a secret provider.

This provider compiles AppSurface migration-job intent into reviewable Google Cloud Run v2 Job Terraform/OpenTofu JSON and verifies deployed configuration through read-only `gcloud` commands.

Documentation site generation and hosting for AppSurface web applications.

AppSurface host for serving or exporting AppSurface Docs as an application.

The [runtime doctor reference](../runtime-doctor.md) explains how canonical diagnostic descriptors support connected-store diagnosis and preserve separate application verification.

Optional Google Cloud Tasks transport for one named, payload-free wake to an existing Durable external-activation host. This package owns task construction and a bounded creation receipt. It does not own Work, host authentication, queue administration, outboxes, recovery, or business decisions.

Use the [runtime doctor](../runtime-doctor.md) to inspect one connected store with a restricted runtime credential. Migration 0011 retention checks are local structural evidence; [complete deployment preflight](../heartbeat-retention-operations.md#complete-runtime-set-preflight-and-proof-checklist) requires its own reviewed inputs.

The [runtime doctor](../runtime-doctor.md) provides a separate one-store CLI observation. It does not replace these host-health or pump-admission contracts, or their application-owned decisions.

This public-preview .NET template package creates an application-owned .NET 10 ASP.NET Core host and test project for externally activated, PostgreSQL-backed Durable Work. It uses the native `dotnet new` engine, the stable short name `appsurface-durable-worker`, and source name `AppSurfaceDurableWorker`. It is installed with `dotnet new install`; do not add the template package as a runtime `PackageReference`.

The [runtime doctor contract](../runtime-doctor.md) has separate fixed-observation, real PostgreSQL and installed-candidate proofs. These builders verify host interpretation; they cannot substitute for the doctor's persisted catalog and package evidence.

`ForgeTrust.AppSurface.Evidence.Aspire` provides the separate, consumer-owned `EvidenceHostBootstrap` lifecycle for resource-backed and browser E2E evidence. It keeps test/evidence code out of the normal application `AppHost`: no application host discovers or invokes it automatically.

`ForgeTrust.AppSurface.Evidence.Cli` supplies the internal workflow used by the public `appsurface evidence` commands. Most adopters install the [AppSurface CLI](../../Cli/ForgeTrust.AppSurface.Cli/README.md), not this package directly.

`ForgeTrust.AppSurface.Evidence.Contracts` is the stable vocabulary for a CI run that says what changed, which evidence was required, what actually ran, and whether a downstream gate may consume the result.

`ForgeTrust.AppSurface.Evidence.Coverage` is a private implementation package shared by the [AppSurface CLI](../../Cli/ForgeTrust.AppSurface.Cli/README.md) and its first-party [Evidence workflow](../ForgeTrust.AppSurface.Evidence.Cli/README.md). It ships only as a transitive support package; it is not a consumer extension point, direct-install package, or separately supported integration package.

`ForgeTrust.AppSurface.Evidence.Planner` turns an explicit diff and a checked-in `EvidencePolicy` into one deterministic `EvidencePlan`. It is the boundary that makes a coverage or E2E gate explainable before work begins.

`ForgeTrust.AppSurface.Evidence.Readiness` is a .NET 10, BCL-only package for a bounded HTTP readiness condition. It contains no Aspire, EvidenceHost bootstrap, planner, producer, browser, or telemetry dependency. Use it in an ordinary test that already owns an `HttpClient`; Aspire integrations compose the same probe with application startup and resource health.

`ForgeTrust.AppSurface.Flow` provides stable contracts for typed long-running app processes.

`ForgeTrust.AppSurface.Flow.DurableTask` maps AppSurface Flow definitions into durable orchestration decisions.

`ForgeTrust.AppSurface.Intelligence` defines privacy-checked product-intelligence contracts for AppSurface and host/package contract packs. It is not an analytics vendor package and it does not configure transport, storage, dashboards, retention, access control, browser autocapture, session replay, or OpenTelemetry exporters.

`ForgeTrust.AppSurface.MarkdownSnippets` keeps checked-in Markdown code fences synchronized with source-owned samples. It is intentionally a generator and verifier only: rendered documentation consumes normal Markdown after the generated blocks have been materialized.

`ForgeTrust.AppSurface.Observability` registers application-side OpenTelemetry logging, tracing, and metrics for AppSurface apps. Use it when an app should send operational telemetry to Aspire or another OTLP collector without making the app depend on `ForgeTrust.AppSurface.Aspire`.

`ForgeTrust.AppSurface.PackageIndex` owns the curated package chooser, readiness dashboard, package-gate policy, and the generated `## Release Guidance` region in public package READMEs. Start with the generated [package chooser](../../packages/README.md) when deciding which package a consumer should install; use this guide when you are changing the repository's package-story policy rather than one package's authored technical documentation.

`ForgeTrust.AppSurface.ReleaseContracts` is the small, transitive package that keeps AppSurface's published Docs package and repository release tooling on the same release-metadata vocabulary. It is published so a clean consumer restore of `ForgeTrust.AppSurface.Docs` can resolve its exact dependency graph; application authors normally install Docs or use the [`appsurface release compose`](../../Cli/ForgeTrust.AppSurface.Cli/README.md#appsurface-release-compose) command instead of adding this package directly.

`ForgeTrust.AppSurface.Theming` defines immutable semantic light/dark pairs for AppSurface-owned UI. It is deliberately not a site-wide design system: it does not style application components, choose a user preference, persist a cookie, inspect a request, implement tenant policy, or load remote theme packs.

This package provides a modular integration for OpenAPI (Swagger) document generation in AppSurface web applications.

`ForgeTrust.AppSurface.Web.Push` is the optional safe rail between AppSurface Web's [shared PWA worker](../ForgeTrust.AppSurface.Web/Docs/pwa-install.md) and an application-owned notification product. It handles bounded browser subscription intake, VAPID key custody, [RFC 8291](https://www.rfc-editor.org/rfc/rfc8291) encryption, one-attempt push-service requests, safe response classification, and conditional stale-subscription cleanup. The host retains identity, tenants, preferences, persistence, recipients, send timing, and retry policy.

This package integrates the [Scalar](https://scalar.com/) API Reference UI into AppSurface web applications.

Node-free Tailwind CSS build and development-watch integration for AppSurface web applications.

These packages retain the original one-RID native Tailwind standalone executable artifacts for direct or compatibility-oriented use. They are no longer dependencies of ForgeTrust.AppSurface.Web.Tailwind's normal installation path.

`ForgeTrust.AppSurface.Workers` defines host-neutral contracts for durable worker chains and projection repair.

`ForgeTrust.AppSurface.Workers.DurableTask` maps AppSurface durable worker contracts into Durable Task-facing decisions.

`ForgeTrust.RazorWire.Auth.AspNetCore` connects RazorWire auth projection helpers to host-owned ASP.NET Core policies through `ForgeTrust.AppSurface.Auth.AspNetCore`.

The **RazorWire CLI** is a command-line tool for managing RazorWire projects. Its primary feature is exporting a reactive RazorWire site into CDN-ready static files by default, with an opt-in hybrid mode for deployments that still provide server routing.

This repository tool uses the public [EvidenceHost lifecycle](../../start-here/evidencehost.md) to validate AppSurface itself. It runs explicit producers against a supplied CLI package, checks published behavior independently, and emits a canonical plan and manifest. Use it when changing [coverage storage](../../guides/coverage-storage.md), package installation, or the native Evidence execution facilities.