forgeos 0.1.0-alpha.0

package/README.md

@@ -0,0 +1,377 @@
+# ForgeOS
+
+Agent-native application framework and compiler for building Forge apps without a mandatory dashboard. ForgeOS turns application source into deterministic runtime contracts, generated clients, safety checks, and machine-readable context that humans and AI coding agents can use safely.
+
+**Status:** private MVP, implemented through H42. The core compiler, local runtime, frontend SDK, production auth, RLS compiler, repair/review loops, UI test bridge, guided intent router, full-stack capability map, clean templates, faster generated checks, showcase app, Windows-safe Bun resolution, native Windows diagnostics/setup, Node-compatible CLI/runtime paths, observable verify timeouts, multi-OS Node CI smoke, release packaging smoke, AST-aware codemods for `extract-action`, `rename field`, and `rename table`, and quieter template workspaces are present. Public release still needs deeper semantic codemods and final npm Trusted Publisher activation.
+
+## Agent-First Quickstart
+
+```bash
+bun install --ignore-scripts
+bun run forge generate
+bun run forge do inspect --json
+bun run forge dev
+bun run forge dev --once --json
+bun run forge inspect all --json
+bun run forge inspect framework --json
+bun run forge doctor
+bun run forge verify --standard
+bun run forge verify --strict
+```
+
+Node is supported for the CLI/runtime path as well:
+
+```bash
+npm install
+npm run forge:node -- generate
+npm run forge:node -- dev --once --json
+npm run forge:node -- inspect framework --json
+```
+
+When working as an AI coder, read:
+
+```txt
+AGENTS.md
+src/forge/_generated/agentContract.json
+src/forge/_generated/runtimeRules.md
+src/forge/_generated/appMap.md
+src/forge/_generated/operationPlaybooks.md
+```
+
+These files describe the app surface, runtime rules, generated files, policies, secrets, workflows, UI routes, commands to run, and common repair/refactor playbooks.
+
+## Create a Test App
+
+```bash
+forge new notes-app --template minimal-web --package-manager npm
+cd notes-app
+npm run dev -- --open
+```
+
+`forge dev` starts the API runtime and the web dev server together when a `web/` app exists. The `--once --json` mode is the central agent/CI diagnostic entrypoint: it checks generated drift, guardrails, frontend routes/bindings, doctor status, impact, and the last test/UI reports in one deterministic response.
+
+Template apps ignore `src/forge/_generated/`, `forge.lock`, and operational `.forge/**` work dirs by default so a freshly created app does not flood git or the editor with generated files. Run `forge generate` after checkout or before verification to recreate the agent contract, client SDK, frontend graph, capability map, and runtime manifests.
+Templates also include workspace editor excludes for generated/runtime directories so source files stay visually prominent.
+
+For release or external smoke testing, choose the Forge package source explicitly:
+
+```bash
+forge new smoke-app --template minimal-web --package-manager npm --forge-spec "npm:forgeos@^0.1.0-alpha.0"
+forge new local-app --template minimal-web --package-manager npm --local-forge
+```
+
+`--forge-spec` writes that dependency spec into the generated app, while `--local-forge` keeps the monorepo/local package workflow. The npm package is published as `forgeos`, but generated apps keep the dependency key, CLI binary, and import surface as `forge` (`forge`, `forge/server`, `forge/react`) by using npm alias specs such as `"forge": "npm:forgeos@^0.1.0-alpha.0"`. CI uses both `--forge-spec "file:$GITHUB_WORKSPACE"` and a packed tarball smoke to prove freshly created apps can install ForgeOS and run outside the framework workspace.
+
+## What ForgeOS Generates
+
+```txt
+src/forge/_generated/
+  api.ts/json
+  client.ts, clientTypes.ts, clientApi.ts
+  react.ts, reactManifest.ts/json
+  appGraph.ts/json
+  dataGraph.ts/json
+  runtimeGraph.ts/json
+  runtimeMatrix.ts/json
+  policyRegistry.ts/json
+  permissionMatrix.ts/json
+  tenantScope.ts/json
+  secretRegistry.ts/json
+  aiRegistry.ts/json
+  workflowRegistry.ts/json
+  liveQueryRegistry.ts/json
+  agentContract.ts/json
+  capabilityMap.ts/json/md
+  agentAdapterManifest.ts/json
+  testGraph.ts/json
+  uiTestManifest.ts/json
+  uiRoutes.ts/json
+  uiScenarios.ts/json
+```
+
+Project-level generated context:
+
+```txt
+AGENTS.md
+forge.lock
+.forge/test-plans/**
+.forge/repairs/**
+.forge/refactors/**
+.forge/ui-runs/**
+```
+
+## Core Capabilities
+
+| Area | What exists now |
+| --- | --- |
+| Compiler | AppGraph, DataGraph, RuntimeGraph, PackageGraph, deterministic generated artifacts, drift checks |
+| Runtime | commands, queries, liveQueries, actions, workflows, durable outbox, local dev server |
+| Data | schema compiler, SQL DDL, migrations, PGlite/Postgres adapter, tenant scope metadata |
+| Policies | RBAC policy registry, permission matrix, simulation, strict policy checks |
+| Auth | dev headers, JWT, OIDC discovery/JWKS verification via `jose`, production-mode guardrails |
+| RLS | Postgres RLS SQL compiler/checks for DB-enforced tenant isolation |
+| Secrets/env | secret registry, env schema, redaction, strict `process.env` checks |
+| AI | provider registry, `ctx.ai`, mock mode, telemetry without prompt/output retention by default |
+| Frontend | generated client SDK, React/Next hooks, template app, liveQuery client support |
+| LiveQuery | durable invalidation log, reconnect/resume semantics, production hardening checks |
+| Self-host | compose/deploy artifacts and self-host checks |
+| Agent contract | `AGENTS.md`, `agentContract.json`, app maps, runtime rules, playbooks, inspect/doctor |
+| Authoring | `forge make`, feature blueprints, safe refactor plans, package upgrade plans |
+| Testing/repair | impact-based test planner, repair loop, structured review, UI/browser test bridge |
+| Adapters | agent adapter export for external AI tools |
+| Intent router | `forge do` maps objectives like fix, verify, connect UI, and add feature into plans, files, risks, and next commands |
+| Full-stack map | `frontendGraph` + `capabilityMap` connect routes, components, hooks, runtime entries, tables, policies, and gaps |
+| Dev loop | `forge dev` prints API/Web URLs, phase health, capability coverage, cache status, diagnostics, and next action |
+| Templates | source-only templates and showcase app avoid committing generated artifacts by default |
+| Verification | `forge verify --smoke`, `--standard`, and `--strict` report per-step duration/command metadata, use impact-selected tests for the standard loop, and time out package scripts predictably |
+
+## Command Map
+
+Prefer task-oriented commands first:
+
+```bash
+forge do "<objective>" --json
+forge do fix --json
+forge do connect-ui --json
+forge do verify --json
+forge dev --once --json
+forge dev
+forge inspect all --json
+forge inspect framework --json
+forge inspect capabilities --json
+forge doctor
+forge verify --standard
+forge verify --strict
+forge impact --changed --json
+forge test plan --changed --json
+forge test run --changed --timeout-ms 120000 --json
+forge repair diagnose --from-last-test-run --json
+forge repair diagnose --from-last-ui-run --json
+forge review run --changed --json
+forge ui smoke --json
+```
+
+Common command groups:
+
+| Command | Purpose |
+| --- | --- |
+| `forge generate` | Analyze source and emit generated artifacts |
+| `forge generate --check` | Fail on generated drift |
+| `forge check --json` | Validate guardrails and emit diagnostics with fix hints |
+| `forge verify --smoke` | Fast local gate: generated drift, Forge checks, typecheck when present, no tests/lint |
+| `forge verify --standard` | Agent development gate: generated drift, Forge/security checks, typecheck, and impact-selected tests |
+| `forge verify --strict` | Full handoff/CI gate: generated drift, Forge/security checks, typecheck, full test script, lint |
+| `forge verify --script-timeout-ms <ms>` | Run package scripts with a predictable timeout and machine-readable timeout diagnostics |
+| `forge do "<objective>" --json` | Guided intent router: choose the right workflow, files, risks, and next action |
+| `forge inspect <target> --json` | Inspect generated app/data/runtime/policy/client/agent/UI surfaces |
+| `forge inspect framework --json` | Inspect ForgeOS framework modules, CLI commands, templates, examples, tests, and preferred entrypoints |
+| `forge doctor --json` | Human/agent health check for project coherence |
+| `forge dev` | Interactive local loop: generated checks, API runtime, DB, worker, watch mode, frontend server, URLs, and next agent checks |
+| `forge dev --once --json` | One-shot diagnostic orchestrator for agents/CI: generated drift/cache hit, check, frontend, capability map, doctor, impact, reports, next actions |
+| `forge run`, `forge query`, `forge live` | Execute and inspect runtime entries locally |
+| `forge db`, `forge rls` | Diff/migrate/status and inspect/check RLS |
+| `forge policy`, `forge secrets`, `forge env`, `forge auth` | Security and configuration operations |
+| `forge make` | Scaffold resources, commands, queries, policies, actions, workflows |
+| `forge feature` | Validate/plan/apply feature blueprints |
+| `forge refactor` | Plan/apply/rollback safe refactors and targeted codemods |
+| `forge impact`, `forge test` | Compute change impact and run targeted checks |
+| `forge test run --timeout-ms <ms>` | Run impact-selected checks with a per-command timeout |
+| `forge repair` | Diagnose failures and produce repair plans |
+| `forge review` | Structured code review with findings and suggested commands |
+| `forge ui` | Browser/UI smoke, scenario, route, snapshot, doctor, and reports |
+| `forge deps` | Package upgrade planning and application |
+| `forge release` | Release/source-map bridge and symbolication |
+| `forge agent`, `forge agent-contract` | Agent-facing contract and adapter exports |
+| `forge self-host` | Self-host packaging and checks |
+
+Refactor codemods are AST-aware where safety matters most:
+
+- `forge refactor extract-action` is binding-aware and preserves unrelated imports, type-only imports, and shadowed locals.
+- `forge refactor rename field <table.field> <table.field>` rewrites structured TS/JS/JSX/TSX and JSON references, preserves locals, and scopes the field change to files/objects linked to the target table. For example, `tickets.priority -> tickets.urgency` does not rewrite a generic `priority` prop in a component with no `tickets` binding.
+- `forge refactor rename table <from> <to>` rewrites table definitions, `ctx.db.<table>` access, policy strings, JSON/blueprints, and import/export specifiers while preserving unrelated locals with the same name.
+
+## Runtime Rules
+
+Commands are transactional and deterministic:
+
+- allowed: `ctx.db`, `ctx.emit`, buffered telemetry
+- forbidden: network packages, direct integrations, `ctx.secrets`, `ctx.ai`, direct `process.env`
+
+Queries and liveQueries are read-only:
+
+- allowed: scoped DB reads
+- forbidden: writes, emits, secrets, AI, network integrations
+
+Actions and workflows handle side effects after commit:
+
+- allowed: integrations, secrets, AI, network packages, retries
+- expected: idempotent behavior and traceable telemetry
+
+Use `src/forge/_generated/runtimeRules.md` as the canonical generated version.
+
+## Showcase App
+
+See [`examples/showcase-forge-app`](examples/showcase-forge-app/README.md).
+
+```bash
+cd examples/showcase-forge-app
+bun install
+bun run generate
+bun run dev
+```
+
+Examples are source-only where practical: generated artifacts, `forge.lock`, package lockfiles, and operational `.forge/**` state are recreated locally. The showcase demonstrates tenant-scoped data, policies, commands, queries, liveQueries, outbox actions, workflows, mock AI, telemetry trace IDs, generated React hooks, `agentContract`, `frontendGraph`, and `capabilityMap`.
+
+## Platform Support
+
+| Platform | Support |
+| --- | --- |
+| Linux | Supported for MVP development |
+| macOS | Supported for MVP development |
+| Windows (WSL) | Supported for MVP development |
+| Windows (native) | Experimental, with `forge doctor windows` and `forge setup windows` |
+
+ForgeOS is Bun-first but no longer Bun-only. The package bin runs through Node via `tsx`, the dev server has a `node:http` fallback, package scripts use the detected package manager, and the Postgres adapter uses `Bun.SQL` when available or the `postgres` npm package under Node.
+
+Known Windows note: ForgeOS resolves Bun through a Windows-safe resolver and ignores known non-Bun `Kiro-Cli\bun` shims. If your shell still resolves a broken app association, invoke Bun from the real install path:
+
+```powershell
+& "$env:USERPROFILE\.bun\bin\bun.exe"
+```
+
+Native Windows diagnostics:
+
+```powershell
+node .\bin\forge.mjs doctor windows --json
+node .\bin\forge.mjs setup windows --json
+```
+
+`forge doctor windows` checks Node, npm, Git, safe Bun resolution, suspicious Bun shims, Git long-path support, PowerShell execution policy, and symlink support. `forge setup windows` is dry-run by default and only applies supported environment fixes with `--yes`.
+
+For Node-only local checks, use:
+
+```powershell
+node .\bin\forge.mjs dev --once --json
+node .\bin\forge.mjs inspect framework --json
+```
+
+## Verification
+
+Fast focused checks:
+
+```bash
+bun run typecheck
+bun run lint
+bun test tests/<area>
+bun run forge generate --check
+forge verify --changed
+```
+
+Full gate:
+
+```bash
+bun test --timeout 120000
+bun run forge verify --strict
+```
+
+UI bridge note: `forge ui` uses Playwright when installed. Without Playwright, `forge ui doctor --json` reports `FORGE_UI_PLAYWRIGHT_MISSING` with fix hints instead of silently failing.
+
+Frontend bridge note: `forge inspect frontend --json` and `forge dev --once --json` expose routes, components, `ForgeProvider`, generated client bindings, raw runtime fetch warnings, and fix hints. Agents should use this before editing UI wiring.
+
+CI note: the main GitHub Actions gate runs the full Bun-based verification path on Ubuntu. A separate Node breadth smoke matrix runs on Ubuntu, Windows, and macOS with Node 22 and 24, including template package-manager smoke for npm, pnpm, yarn, and Bun.
+
+## npm Release
+
+ForgeOS publishes to npm as `forgeos` and exposes the executable as `forge`.
+
+Release automation uses Changesets plus npm Trusted Publishing:
+
+```bash
+npm run changeset
+npm run version-packages
+npm run release:smoke
+```
+
+For the first prerelease publish, use the alpha dist-tag explicitly:
+
+```bash
+npm run release:publish-local-alpha -- --dry-run
+npm run release:publish-local-alpha -- --yes
+```
+
+The normal path is:
+
+```txt
+merge feature PR with changeset
+  -> publish.yml opens/updates a version PR
+merge version PR
+  -> publish.yml publishes through npm OIDC Trusted Publisher
+```
+
+Configure npm Trusted Publisher for package `forgeos`:
+
+| Field | Value |
+| --- | --- |
+| Provider | GitHub Actions |
+| Organization/user | `Stahldavid` |
+| Repository | `forge` |
+| Workflow filename | `publish.yml` |
+| Environment | blank |
+| Allowed action | `npm publish` |
+
+Do not add `NPM_TOKEN` for normal releases. Alpha releases publish with the `alpha` dist-tag so prerelease builds do not become `latest` accidentally. The first manual package creation uses `release:publish-local-alpha`, which publishes from a temporary hardlink-free staging copy and disables provenance because local shells do not have a GitHub OIDC provider. The workflow uses `id-token: write`, Node 24/npm 11+, and provenance for subsequent releases. `npm run release:smoke` runs `npm pack`, creates a fresh app with the packed tarball, installs dependencies, runs `forge dev --once --json`, and verifies the app smoke path.
+
+## Milestone History
+
+```txt
+H1   Hardening, CI, examples
+H2   Reference integration quality
+H3   DataGraph Compiler
+H4   Local command/action runtime
+H5   Local dev server
+H6   DataGraph-backed persistence runtime
+H7   Durable outbox worker
+H8   Lightweight workflow engine
+H9   Telemetry bridge
+H10  Auth, policy engine, tenant isolation
+H11  Secrets & environment runtime
+H12  AI workflow integration
+H13  Query runtime & typed API surface
+H14  Frontend client SDK core
+H15  LiveQuery/Reactivity MVP
+H16  React/Next hooks
+H17  Minimal frontend app template
+H18  Self-host packaging
+H19  Agent Contract & Project Introspection Layer
+H20  Production Auth / JWT & OIDC v1
+H21  Postgres RLS Compiler & DB-enforced tenant isolation
+H22  Package Upgrade Planner
+H23  Release / Source Map Bridge
+H24  Production LiveQuery Hardening
+H25  Authoring primitives: forge make
+H26  Feature Blueprint Compiler
+H27  Safe Refactor / Codemod Engine
+H28  Impact-Based Test Planner
+H29  Repair Loop
+H30  Agent Adapter Export
+H31  Forge Review / Structured Code Review
+H32  UI / Browser Test Bridge
+H33  Intent Router / Guided Dev Loop
+H34  Full-Stack App Contract v2
+H35  Capability Map
+H36  Template hygiene / git noise
+H37  Convex-style forge dev panel
+H38  Fast generated check visibility
+H39  Showcase app
+H40  Windows/runtime hardening
+H41  Node-compatible CLI/runtime
+H42  Verify observability and quieter app workspaces
+```
+
+## Remaining Hardening Before Public Release
+
+- Keep expanding semantic codemods beyond the current AST-aware `extract-action`, `rename field`, and `rename table` paths.
+- Reduce command-selection risk with more task routers and richer inline diagnostics.
+- Keep hardening native Windows setup beyond diagnostics and safe automatic environment fixes.
+- Keep broadening package manager CI from template smoke toward install/build smoke for pnpm and yarn apps.
+- Broaden UI bridge coverage with installed Playwright browsers in CI.

package/bin/forge-bun.mjs

@@ -0,0 +1,110 @@
+#!/usr/bin/env node
+import { existsSync } from "node:fs";
+import { homedir } from "node:os";
+import { basename, delimiter, join, win32 } from "node:path";
+import { spawn } from "node:child_process";
+
+function isWindows() {
+  return process.platform === "win32";
+}
+
+function isKiroBun(path) {
+  return path.replace(/\//g, "\\").toLowerCase().includes("\\kiro-cli\\");
+}
+
+function isBunExecutablePath(path) {
+  const file = (isWindows() ? win32.basename(path) : basename(path)).toLowerCase();
+  return isWindows() ? file === "bun.exe" : file === "bun";
+}
+
+function which(command) {
+  const pathEntries = (process.env.PATH ?? "").split(delimiter).filter(Boolean);
+  const extensions = isWindows() ? [".exe", ".cmd", ".bat", ""] : [""];
+  for (const dir of pathEntries) {
+    for (const extension of extensions) {
+      const candidate = join(dir, `${command}${extension}`);
+      if (existsSync(candidate)) {
+        return candidate;
+      }
+    }
+  }
+  return null;
+}
+
+function normalizeWindowsBun(candidate) {
+  if (!candidate || isKiroBun(candidate)) {
+    return null;
+  }
+  if (candidate.toLowerCase().endsWith(".exe")) {
+    return existsSync(candidate) ? candidate : null;
+  }
+  const exeCandidate = `${candidate}.exe`;
+  return existsSync(exeCandidate) ? exeCandidate : null;
+}
+
+function resolveBunExecutable() {
+  const configured = process.env.FORGE_BUN;
+  if (configured) {
+    if (isWindows()) {
+      const normalized = normalizeWindowsBun(configured);
+      if (normalized) {
+        return normalized;
+      }
+    } else if (existsSync(configured)) {
+      return configured;
+    }
+    throw new Error(`FORGE_BUN does not point to a safe Bun executable: ${configured}`);
+  }
+
+  if (isBunExecutablePath(process.execPath) && existsSync(process.execPath)) {
+    return process.execPath;
+  }
+
+  const fromPath = which("bun");
+  if (!isWindows()) {
+    return fromPath ?? "bun";
+  }
+
+  const normalized = normalizeWindowsBun(fromPath);
+  if (normalized) {
+    return normalized;
+  }
+
+  const homeBun = win32.join(homedir(), ".bun", "bin", "bun.exe");
+  if (existsSync(homeBun)) {
+    return homeBun;
+  }
+
+  throw new Error(
+    "Unable to resolve a safe Bun executable on Windows. Install Bun at ~/.bun/bin/bun.exe or set FORGE_BUN to an existing bun.exe. Refusing to spawn bare bun.exe because Windows may open an app picker.",
+  );
+}
+
+let bunPath;
+try {
+  bunPath = resolveBunExecutable();
+} catch (error) {
+  console.error(error instanceof Error ? error.message : String(error));
+  process.exit(1);
+}
+
+const args = process.argv.slice(2);
+const child = spawn(bunPath, args, {
+  cwd: process.cwd(),
+  env: process.env,
+  stdio: "inherit",
+  windowsHide: true,
+});
+
+child.on("error", (error) => {
+  console.error(error.message);
+  process.exit(1);
+});
+
+child.on("close", (code, signal) => {
+  if (signal) {
+    process.kill(process.pid, signal);
+    return;
+  }
+  process.exit(code ?? 1);
+});

package/bin/forge.mjs

@@ -0,0 +1,19 @@
+#!/usr/bin/env node
+import { dirname, join } from "node:path";
+import { fileURLToPath, pathToFileURL } from "node:url";
+
+const root = dirname(dirname(fileURLToPath(import.meta.url)));
+const entrypoint = join(root, "src", "forge", "cli", "main.ts");
+
+let tsImport;
+try {
+  ({ tsImport } = await import("tsx/esm/api"));
+} catch {
+  console.error("error: Forge requires the 'tsx' package to run under Node.");
+  console.error("Install dependencies with your package manager, then retry.");
+  process.exit(1);
+}
+
+const module = await tsImport(pathToFileURL(entrypoint).href, import.meta.url);
+const exitCode = await module.main(process.argv.slice(2));
+process.exit(exitCode);

package/package.json

@@ -0,0 +1,96 @@
+{
+  "name": "forgeos",
+  "version": "0.1.0-alpha.0",
+  "description": "Agent-native application framework and compiler for building Forge apps without a mandatory dashboard.",
+  "type": "module",
+  "files": [
+    "bin/",
+    "packages/eslint-plugin-forge/",
+    "src/",
+    "templates/",
+    "README.md",
+    "CHANGELOG.md",
+    "CONTRIBUTING.md",
+    "AGENTS.md",
+    ".npmignore"
+  ],
+  "forge": {
+    "sourceRoots": [
+      "src"
+    ]
+  },
+  "bin": {
+    "forge": "bin/forge.mjs"
+  },
+  "exports": {
+    "./react": "./src/forge/react/index.ts",
+    "./server": "./src/forge/server.ts",
+    "./policy": "./src/forge/policy.ts"
+  },
+  "scripts": {
+    "test": "node ./bin/forge-bun.mjs test --timeout 120000",
+    "build": "tsc --noEmit",
+    "typecheck": "tsc --noEmit",
+    "changeset": "changeset",
+    "version-packages": "changeset version",
+    "release": "changeset publish --tag alpha",
+    "release:pack": "npm pack --dry-run",
+    "release:smoke": "node scripts/smoke-packed-package.mjs",
+    "release:publish-local-alpha": "node scripts/publish-local-alpha.mjs",
+    "forge": "node ./bin/forge.mjs",
+    "forge:node": "node ./bin/forge.mjs",
+    "forge:bun": "node ./bin/forge-bun.mjs src/forge/cli/main.ts",
+    "forge:check": "node ./bin/forge.mjs check",
+    "forge:generate": "node ./bin/forge.mjs generate",
+    "forge:generate:check": "node ./bin/forge.mjs generate --check",
+    "lint": "node --import tsx ./src/forge/cli/lint-forge.ts",
+    "verify": "node ./bin/forge.mjs verify",
+    "example:setup": "node scripts/setup-example.mjs"
+  },
+  "publishConfig": {
+    "access": "public",
+    "tag": "alpha"
+  },
+  "engines": {
+    "node": ">=22.14"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/Stahldavid/forge.git"
+  },
+  "homepage": "https://github.com/Stahldavid/forge#readme",
+  "bugs": {
+    "url": "https://github.com/Stahldavid/forge/issues"
+  },
+  "keywords": [
+    "forgeos",
+    "agent-native",
+    "application-framework",
+    "ai-agents",
+    "full-stack",
+    "cli"
+  ],
+  "dependencies": {
+    "@ai-sdk/anthropic": "^2.0.0",
+    "@ai-sdk/openai": "^2.0.0",
+    "@electric-sql/pglite": "^0.2.17",
+    "ai": "^5.0.0",
+    "jose": "^6.2.3",
+    "postgres": "^3.4.5",
+    "react": "^19.2.7",
+    "tree-sitter": "^0.22.4",
+    "tree-sitter-typescript": "^0.23.2",
+    "tsx": "^4.20.6",
+    "typescript": "^5.7.3",
+    "zod": "^3.25.76"
+  },
+  "devDependencies": {
+    "@changesets/changelog-github": "^0.7.0",
+    "@changesets/cli": "^2.31.0",
+    "@types/bun": "1.3.14",
+    "@types/react": "^19.2.17",
+    "@types/react-test-renderer": "^19.1.0",
+    "fast-check": "^3.23.2",
+    "react-test-renderer": "^19.2.7"
+  }
+}

package/packages/eslint-plugin-forge/index.ts

@@ -0,0 +1,15 @@
+export {
+  loadForgeGuardArtifacts,
+  type ForgeGuardArtifacts,
+} from "./src/load-artifacts.ts";
+export {
+  checkSourceForgeGuards,
+  type ForgeGuardSourceViolation,
+} from "./src/check-source.ts";
+export {
+  runForgeGuardRule,
+  forgeGuardRuleDefinition,
+  formatViolationMessage,
+  type ForgeEslintContext,
+  type ForgeEslintSettings,
+} from "./src/rule-no-forge-guard-violation.ts";

package/packages/eslint-plugin-forge/package.json

@@ -0,0 +1,10 @@
+{
+  "name": "eslint-plugin-forge",
+  "version": "0.0.0",
+  "private": true,
+  "type": "module",
+  "main": "./index.ts",
+  "exports": {
+    ".": "./index.ts"
+  }
+}