Packages

RazorWire lets ASP.NET Core MVC apps update UI by returning Razor fragments from the server instead of building a separate JSON endpoint and client-state rendering loop.

The **AppSurface CLI** is the command-line home for repository-level AppSurface workflows. It is packaged as a .NET tool with the command name `appsurface`.

`./eng/release` is the repository-owned release cockpit for coordinated AppSurface releases. It prepares the release pull request from the living unreleased note, validates the tagged release state, and emits structured data for GitHub Actions. Release evidence is consistency evidence for repository release artifacts; it is not a signature, hosted-build attestation, or SLSA/Sigstore provenance.

The **ForgeTrust.AppSurface.Web** package provides the bootstrapping logic for building ASP.NET Core applications using the AppSurface module system. It sits on top of the compilation concepts defined in `ForgeTrust.AppSurface.Core`.

.NET Aspire integration for the AppSurface ecosystem.

Deterministic typed testing for AppSurface Aspire profiles.

`ForgeTrust.AppSurface.Auth` provides passive auth contracts for AppSurface modules.

`ForgeTrust.AppSurface.Auth.Aspire.Keycloak` adds an AppHost-only local Keycloak proof for AppSurface OpenID Connect authentication. It builds on the official Aspire Keycloak hosting integration and keeps Keycloak, containers, and Aspire hosting dependencies out of runtime web app packages.

`ForgeTrust.AppSurface.Auth.AspNetCore` maps host-owned ASP.NET Core authentication and authorization into AppSurface auth contracts.

`ForgeTrust.AppSurface.Auth.AspNetCore.DevAuth` adds fake, local-only ASP.NET Core authentication for AppSurface package consumers who need to try auth-aware endpoints without configuring OIDC, cookies, ASP.NET Identity, or an external identity provider.

`ForgeTrust.AppSurface.Auth.AspNetCore.Oidc` registers named ASP.NET Core cookie and OpenID Connect schemes with AppSurface-safe defaults.

`ForgeTrust.AppSurface.Auth.Testing` is a test-only ASP.NET Core authentication harness for proving AppSurface auth behavior.

Caching primitives for AppSurface applications built on top of `Microsoft.Extensions.Caching.Memory`.

Strongly typed configuration primitives for AppSurface applications.

Google Cloud Secret Manager remote secret storage for AppSurface configuration.

OS-backed local secret posture for AppSurface configuration.

Modular bootstrapping for .NET Console applications using [CliFx](https://github.com/Tyrrrz/CliFx).

The foundation of the AppSurface ecosystem. This package defines the core abstractions, the startup pipeline, and the module system that powers all other AppSurface libraries.

Autofac IoC container integration for AppSurface modules.

Provider-neutral deployment contracts for AppSurface. The package describes explicit run-to-completion migration jobs, validates immutable image and source evidence, emits canonical JSON, and defines render and verification seams without depending on Aspire, a cloud SDK, Terraform, or a secret provider.

This provider compiles AppSurface migration-job intent into reviewable Google Cloud Run v2 Job Terraform/OpenTofu JSON and verifies deployed configuration through read-only `gcloud` commands.

Documentation site generation and hosting for AppSurface web applications.

AppSurface host for serving or exporting AppSurface Docs as an application.

`ForgeTrust.AppSurface.Durable` is the adopter-facing contract package for durable Work, resumable [AppSurface Flow](../../Flow/ForgeTrust.AppSurface.Flow/README.md), schedules, serialization, registration, and clients. Runtime-provider and operator APIs live in [`ForgeTrust.AppSurface.Durable.Provider`](../ForgeTrust.AppSurface.Durable.Provider/README.md).

Choose this package when an application must commit its domain mutation and durable Work acceptance in the same PostgreSQL transaction, and when process-loss recovery must use explicit leases, runtime/scope fences, effect permits, and provider-safety policy. Choose a larger workflow platform for arbitrary deterministic replay, child workflows, or unbounded fan-out. PostgreSQL is this provider's sole durable truth.

`ForgeTrust.AppSurface.Durable.Provider` is the runtime-provider and operator SPI for [`ForgeTrust.AppSurface.Durable`](../ForgeTrust.AppSurface.Durable/README.md). It depends on that adopter package; the adopter package never depends on Provider. Production providers implement this public SPI without friend access.

`ForgeTrust.AppSurface.Flow` provides stable contracts for typed long-running app processes.

`ForgeTrust.AppSurface.Flow.DurableTask` maps AppSurface Flow definitions into durable orchestration decisions.

`ForgeTrust.AppSurface.Intelligence` defines privacy-checked product-intelligence contracts for AppSurface and host/package contract packs. It is not an analytics vendor package and it does not configure transport, storage, dashboards, retention, access control, browser autocapture, session replay, or OpenTelemetry exporters.

`ForgeTrust.AppSurface.MarkdownSnippets` keeps checked-in Markdown code fences synchronized with source-owned samples. It is intentionally a generator and verifier only: rendered documentation consumes normal Markdown after the generated blocks have been materialized.

`ForgeTrust.AppSurface.Observability` registers application-side OpenTelemetry logging, tracing, and metrics for AppSurface apps. Use it when an app should send operational telemetry to Aspire or another OTLP collector without making the app depend on `ForgeTrust.AppSurface.Aspire`.

`ForgeTrust.AppSurface.PackageIndex` owns the curated package chooser, readiness dashboard, package-gate policy, and the generated `## Release Guidance` region in public package READMEs. Start with the generated [package chooser](../../packages/README.md) when deciding which package a consumer should install; use this guide when you are changing the repository's package-story policy rather than one package's authored technical documentation.

`ForgeTrust.AppSurface.Theming` defines immutable semantic light/dark pairs for AppSurface-owned UI. It is deliberately not a site-wide design system: it does not style application components, choose a user preference, persist a cookie, inspect a request, implement tenant policy, or load remote theme packs.

This package provides a modular integration for OpenAPI (Swagger) document generation in AppSurface web applications.

`ForgeTrust.AppSurface.Web.Push` is the optional safe rail between AppSurface Web's [shared PWA worker](../ForgeTrust.AppSurface.Web/Docs/pwa-install.md) and an application-owned notification product. It handles bounded browser subscription intake, VAPID key custody, [RFC 8291](https://www.rfc-editor.org/rfc/rfc8291) encryption, one-attempt push-service requests, safe response classification, and conditional stale-subscription cleanup. The host retains identity, tenants, preferences, persistence, recipients, send timing, and retry policy.

This package integrates the [Scalar](https://scalar.com/) API Reference UI into AppSurface web applications.

Tailwind CSS integration for AppSurface web applications with zero Node.js dependency.

Platform-specific runtime packages that carry the official standalone Tailwind CLI binaries used by `ForgeTrust.AppSurface.Web.Tailwind`.

`ForgeTrust.AppSurface.Workers` defines host-neutral contracts for durable worker chains and projection repair.

`ForgeTrust.AppSurface.Workers.DurableTask` maps AppSurface durable worker contracts into Durable Task-facing decisions.

`ForgeTrust.RazorWire.Auth.AspNetCore` connects RazorWire auth projection helpers to host-owned ASP.NET Core policies through `ForgeTrust.AppSurface.Auth.AspNetCore`.

The **RazorWire CLI** is a command-line tool for managing RazorWire projects. Its primary feature is exporting a reactive RazorWire site into CDN-ready static files by default, with an opt-in hybrid mode for deployments that still provide server routing.