forgeos 0.1.0-alpha.2 → 0.1.0-alpha.21

package/src/forge/compiler/diagnostics/codes.ts

@@ -14,6 +14,7 @@ export const FORGE_AUTH_INVALID_AUDIENCE = "FORGE_AUTH_INVALID_AUDIENCE" as cons
 export const FORGE_AUTH_TOKEN_EXPIRED = "FORGE_AUTH_TOKEN_EXPIRED" as const;
 export const FORGE_AUTH_JWKS_FAILED = "FORGE_AUTH_JWKS_FAILED" as const;
 export const FORGE_AUTH_CLAIM_MISSING = "FORGE_AUTH_CLAIM_MISSING" as const;
+export const FORGE_AUTH_CLAIM_INVALID = "FORGE_AUTH_CLAIM_INVALID" as const;
 export const FORGE_AUTH_TENANT_MISSING = "FORGE_AUTH_TENANT_MISSING" as const;
 export const FORGE_AUTH_DEV_HEADERS_IN_PRODUCTION =
   "FORGE_AUTH_DEV_HEADERS_IN_PRODUCTION" as const;
@@ -26,11 +27,20 @@ export const FORGE_DUP_RUNTIME_ENTRY = "FORGE_DUP_RUNTIME_ENTRY" as const;
 export const FORGE_RUNTIME_UNRESOLVABLE = "FORGE_RUNTIME_UNRESOLVABLE" as const;
 export const FORGE_RUNTIME_NOT_FOUND = "FORGE_RUNTIME_NOT_FOUND" as const;
 export const FORGE_RUNTIME_GUARD_BLOCKED = "FORGE_RUNTIME_GUARD_BLOCKED" as const;
+export const FORGE_EXTERNAL_RUNTIME_NOT_FOUND =
+  "FORGE_EXTERNAL_RUNTIME_NOT_FOUND" as const;
+export const FORGE_EXTERNAL_RUNTIME_UNSUPPORTED =
+  "FORGE_EXTERNAL_RUNTIME_UNSUPPORTED" as const;
+export const FORGE_EXTERNAL_RUNTIME_FAILED =
+  "FORGE_EXTERNAL_RUNTIME_FAILED" as const;
+export const FORGE_EXTERNAL_RUNTIME_BAD_RESPONSE =
+  "FORGE_EXTERNAL_RUNTIME_BAD_RESPONSE" as const;
 export const FORGE_DEV_SERVER_ERROR = "FORGE_DEV_SERVER_ERROR" as const;
 export const FORGE_DEV_WATCH_FAILED = "FORGE_DEV_WATCH_FAILED" as const;
 export const FORGE_DEV_INVOKE_FAILED = "FORGE_DEV_INVOKE_FAILED" as const;
 export const FORGE_DEV_DOCTOR_MISSING_ARTIFACT =
   "FORGE_DEV_DOCTOR_MISSING_ARTIFACT" as const;
+export const FORGE_DEV_DB_RESET = "FORGE_DEV_DB_RESET" as const;
 export const FORGE_DB_CONNECT_FAILED = "FORGE_DB_CONNECT_FAILED" as const;
 export const FORGE_DB_MIGRATION_FAILED = "FORGE_DB_MIGRATION_FAILED" as const;
 export const FORGE_DB_UNSUPPORTED_FIELD_TYPE =
@@ -47,6 +57,7 @@ export const FORGE_RLS_UNSUPPORTED_TENANT_TYPE =
 export const FORGE_RLS_FORCE_DISABLED = "FORGE_RLS_FORCE_DISABLED" as const;
 export const FORGE_RLS_APPLY_FAILED = "FORGE_RLS_APPLY_FAILED" as const;
 export const FORGE_RLS_TEST_FAILED = "FORGE_RLS_TEST_FAILED" as const;
+export const FORGE_RLS_MUTATION_FAILED = "FORGE_RLS_MUTATION_FAILED" as const;
 export const FORGE_RLS_SESSION_CONTEXT_MISSING =
   "FORGE_RLS_SESSION_CONTEXT_MISSING" as const;
 export const FORGE_RLS_SESSION_CONTEXT_UNSAFE =
@@ -90,6 +101,8 @@ export const FORGE_RELEASE_DIRTY_WORKTREE =
 export const FORGE_RELEASE_GENERATED_DRIFT =
   "FORGE_RELEASE_GENERATED_DRIFT" as const;
 export const FORGE_RELEASE_ID_MISSING = "FORGE_RELEASE_ID_MISSING" as const;
+export const FORGE_RELEASE_PACKAGE_PACK_FAILED =
+  "FORGE_RELEASE_PACKAGE_PACK_FAILED" as const;
 export const FORGE_SOURCEMAP_PUBLIC_EXPOSURE =
   "FORGE_SOURCEMAP_PUBLIC_EXPOSURE" as const;
 export const FORGE_SOURCEMAP_UPLOAD_MISSING =
@@ -214,6 +227,8 @@ export const FORGE_TEST_DOCKER_REQUIRED = "FORGE_TEST_DOCKER_REQUIRED" as const;
 export const FORGE_TEST_BROWSER_REQUIRED = "FORGE_TEST_BROWSER_REQUIRED" as const;
 export const FORGE_VERIFY_CHANGED_INCOMPLETE =
   "FORGE_VERIFY_CHANGED_INCOMPLETE" as const;
+export const FORGE_VERIFY_NO_TESTS_SELECTED =
+  "FORGE_VERIFY_NO_TESTS_SELECTED" as const;
 export const FORGE_VERIFY_SCRIPT_TIMEOUT =
   "FORGE_VERIFY_SCRIPT_TIMEOUT" as const;
 export const FORGE_REPAIR_SOURCE_NOT_FOUND =
@@ -315,6 +330,12 @@ export const FORGE_TELEMETRY_PAYLOAD_TRUNCATED =
   "FORGE_TELEMETRY_PAYLOAD_TRUNCATED" as const;
 export const FORGE_TELEMETRY_SINK_FAILED = "FORGE_TELEMETRY_SINK_FAILED" as const;
 export const FORGE_TELEMETRY_UNKNOWN_SINK = "FORGE_TELEMETRY_UNKNOWN_SINK" as const;
+export const FORGE_WEBHOOK_SIGNATURE_INVALID =
+  "FORGE_WEBHOOK_SIGNATURE_INVALID" as const;
+export const FORGE_WEBHOOK_TIMESTAMP_INVALID =
+  "FORGE_WEBHOOK_TIMESTAMP_INVALID" as const;
+export const FORGE_WEBHOOK_REPLAY_DETECTED =
+  "FORGE_WEBHOOK_REPLAY_DETECTED" as const;
 export const FORGE_POLICY_DENIED = "FORGE_POLICY_DENIED" as const;
 export const FORGE_POLICY_MISSING = "FORGE_POLICY_MISSING" as const;
 export const FORGE_POLICY_UNKNOWN = "FORGE_POLICY_UNKNOWN" as const;
@@ -338,6 +359,7 @@ export const FORGE_AI_SECRET_MISSING = "FORGE_AI_SECRET_MISSING" as const;
 export const FORGE_AI_DYNAMIC_PROVIDER = "FORGE_AI_DYNAMIC_PROVIDER" as const;
 export const FORGE_AI_GENERATION_FAILED = "FORGE_AI_GENERATION_FAILED" as const;
 export const FORGE_AI_USAGE_UNAVAILABLE = "FORGE_AI_USAGE_UNAVAILABLE" as const;
+export const FORGE_AI_REDTEAM_FAILED = "FORGE_AI_REDTEAM_FAILED" as const;
 export const FORGE_QUERY_WRITE_FORBIDDEN = "FORGE_QUERY_WRITE_FORBIDDEN" as const;
 export const FORGE_QUERY_EMIT_FORBIDDEN = "FORGE_QUERY_EMIT_FORBIDDEN" as const;
 export const FORGE_QUERY_SECRET_FORBIDDEN = "FORGE_QUERY_SECRET_FORBIDDEN" as const;
@@ -379,6 +401,7 @@ export const DIAGNOSTIC_CODES = [
   FORGE_AUTH_TOKEN_EXPIRED,
   FORGE_AUTH_JWKS_FAILED,
   FORGE_AUTH_CLAIM_MISSING,
+  FORGE_AUTH_CLAIM_INVALID,
   FORGE_AUTH_TENANT_MISSING,
   FORGE_AUTH_DEV_HEADERS_IN_PRODUCTION,
   FORGE_AUTH_MODE_INVALID,
@@ -389,10 +412,15 @@ export const DIAGNOSTIC_CODES = [
   FORGE_RUNTIME_UNRESOLVABLE,
   FORGE_RUNTIME_NOT_FOUND,
   FORGE_RUNTIME_GUARD_BLOCKED,
+  FORGE_EXTERNAL_RUNTIME_NOT_FOUND,
+  FORGE_EXTERNAL_RUNTIME_UNSUPPORTED,
+  FORGE_EXTERNAL_RUNTIME_FAILED,
+  FORGE_EXTERNAL_RUNTIME_BAD_RESPONSE,
   FORGE_DEV_SERVER_ERROR,
   FORGE_DEV_WATCH_FAILED,
   FORGE_DEV_INVOKE_FAILED,
   FORGE_DEV_DOCTOR_MISSING_ARTIFACT,
+  FORGE_DEV_DB_RESET,
   FORGE_DB_CONNECT_FAILED,
   FORGE_DB_MIGRATION_FAILED,
   FORGE_DB_UNSUPPORTED_FIELD_TYPE,
@@ -406,6 +434,7 @@ export const DIAGNOSTIC_CODES = [
   FORGE_RLS_FORCE_DISABLED,
   FORGE_RLS_APPLY_FAILED,
   FORGE_RLS_TEST_FAILED,
+  FORGE_RLS_MUTATION_FAILED,
   FORGE_RLS_SESSION_CONTEXT_MISSING,
   FORGE_RLS_SESSION_CONTEXT_UNSAFE,
   FORGE_DB_SUPERUSER_RUNTIME,
@@ -433,6 +462,7 @@ export const DIAGNOSTIC_CODES = [
   FORGE_RELEASE_DIRTY_WORKTREE,
   FORGE_RELEASE_GENERATED_DRIFT,
   FORGE_RELEASE_ID_MISSING,
+  FORGE_RELEASE_PACKAGE_PACK_FAILED,
   FORGE_SOURCEMAP_PUBLIC_EXPOSURE,
   FORGE_SOURCEMAP_UPLOAD_MISSING,
   FORGE_SOURCEMAP_UPLOAD_FAILED,
@@ -510,6 +540,7 @@ export const DIAGNOSTIC_CODES = [
   FORGE_TEST_DOCKER_REQUIRED,
   FORGE_TEST_BROWSER_REQUIRED,
   FORGE_VERIFY_CHANGED_INCOMPLETE,
+  FORGE_VERIFY_NO_TESTS_SELECTED,
   FORGE_REPAIR_SOURCE_NOT_FOUND,
   FORGE_REPAIR_UNKNOWN_FAILURE,
   FORGE_REPAIR_NO_RULE_MATCHED,
@@ -575,6 +606,9 @@ export const DIAGNOSTIC_CODES = [
   FORGE_TELEMETRY_PAYLOAD_TRUNCATED,
   FORGE_TELEMETRY_SINK_FAILED,
   FORGE_TELEMETRY_UNKNOWN_SINK,
+  FORGE_WEBHOOK_SIGNATURE_INVALID,
+  FORGE_WEBHOOK_TIMESTAMP_INVALID,
+  FORGE_WEBHOOK_REPLAY_DETECTED,
   FORGE_POLICY_DENIED,
   FORGE_POLICY_MISSING,
   FORGE_POLICY_UNKNOWN,
@@ -595,6 +629,7 @@ export const DIAGNOSTIC_CODES = [
   FORGE_AI_DYNAMIC_PROVIDER,
   FORGE_AI_GENERATION_FAILED,
   FORGE_AI_USAGE_UNAVAILABLE,
+  FORGE_AI_REDTEAM_FAILED,
   FORGE_QUERY_WRITE_FORBIDDEN,
   FORGE_QUERY_EMIT_FORBIDDEN,
   FORGE_QUERY_SECRET_FORBIDDEN,

package/src/forge/compiler/diagnostics/create.ts

@@ -49,7 +49,7 @@ function defaultGuidanceForCode(code: string): DiagnosticGuidance | null {
   }
   if (code === "FORGE_SECRET_DIRECT_PROCESS_ENV") {
     return {
-      fixHint: "Use ctx.secrets or ctx.config instead of reading process.env directly from app runtime code.",
+      fixHint: "Use ctx.secrets or ctx.config for Forge runtime secrets/config; public frontend bridge env may use the framework's public env surface.",
       suggestedCommands: ["forge repair diagnose --diagnostic FORGE_SECRET_DIRECT_PROCESS_ENV --json", "forge refactor replace-process-env <ENV_NAME> --dry-run --json"],
       docs: ["src/forge/_generated/runtimeRules.md"],
     };
@@ -71,7 +71,7 @@ function defaultGuidanceForCode(code: string): DiagnosticGuidance | null {
   if (code.startsWith("FORGE_RLS_")) {
     return {
       fixHint: "Inspect generated RLS SQL and validate tenant isolation before applying migrations.",
-      suggestedCommands: ["forge rls check --json", "forge rls print --json"],
+      suggestedCommands: ["forge rls check --json", "forge rls test --db postgres --json"],
       docs: ["src/forge/_generated/agentContract.json"],
     };
   }
@@ -106,7 +106,12 @@ function defaultGuidanceForCode(code: string): DiagnosticGuidance | null {
   if (code.startsWith("FORGE_FRONTEND_")) {
     return {
       fixHint: "Use the generated frontend bridge and inspect src/forge/_generated/frontendGraph.json before editing UI wiring.",
-      suggestedCommands: ["forge inspect frontend --json", "forge make ui --framework vite --dry-run --json", "forge generate"],
+      suggestedCommands: [
+        "forge inspect frontend --json",
+        "forge make ui --framework vite --dry-run --json",
+        "forge make ui --framework nuxt --dry-run --json",
+        "forge generate",
+      ],
       docs: ["src/forge/_generated/frontendGraph.json", "AGENTS.md"],
     };
   }

package/src/forge/compiler/diagnostics/index.ts

@@ -37,6 +37,8 @@ export {
   FORGE_LIVEQUERY_UNKNOWN,
   FORGE_LIVEQUERY_SUBSCRIPTION_FAILED,
   FORGE_LIVEQUERY_RERUN_FAILED,
+  FORGE_RELEASE_PACKAGE_PACK_FAILED,
+  FORGE_VERIFY_NO_TESTS_SELECTED,
   DIAGNOSTIC_CODES,
 } from "./codes.ts";
 export type { DiagnosticCode } from "./codes.ts";

package/src/forge/compiler/emitter/barrel.ts

@@ -33,6 +33,9 @@ export function buildBarrelIndexBody(exportFilePaths: string[]): string {
 
   const lines = unique.map((path) => {
     const exportPath = toBarrelExportPath(path);
+    if (exportPath === "./vue") {
+      return `export * as vue from "${exportPath}";`;
+    }
     return `export * from "${exportPath}";`;
   });
 

package/src/forge/compiler/emitter/render.ts

@@ -59,6 +59,7 @@ export function renderBody(file: EmitFile): string {
  */
 export function render(file: EmitFile, context: RenderContext): string {
   const body = renderBody(file);
+  const kind = detectArtifactKind(file.path);
 
   if (file.contentHash !== hashStable(body)) {
     throw new Error(
@@ -66,6 +67,10 @@ export function render(file: EmitFile, context: RenderContext): string {
     );
   }
 
+  if (kind === "json") {
+    return body;
+  }
+
   return prependDeterministicHeader(body, {
     generatorVersion: context.generatorVersion,
     inputHash: context.inputHash,

package/src/forge/compiler/external-manifest/registry.ts

@@ -0,0 +1,205 @@
+import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import { dirname, join, resolve } from "node:path";
+import { createDiagnostic } from "../diagnostics/create.ts";
+import { hashStable } from "../primitives/hash.ts";
+import { serializeCanonical } from "../primitives/serialize.ts";
+import type { Diagnostic } from "../types/diagnostic.ts";
+import {
+  FORGE_EXTERNAL_MANIFEST_PROTOCOL_VERSION,
+  FORGE_EXTERNAL_MANIFEST_REGISTRY,
+  type ForgeExternalManifest,
+  type ForgeExternalManifestRegistryFile,
+  type ForgeExternalService,
+  type ForgeExternalServiceEntry,
+  type ForgeExternalServiceGraph,
+} from "./types.ts";
+import {
+  validateExternalManifest,
+  validateExternalManifestRegistry,
+} from "./validate.ts";
+
+function parseJsonFile(path: string): { value: unknown | null; diagnostics: Diagnostic[] } {
+  try {
+    return { value: JSON.parse(readFileSync(path, "utf8")), diagnostics: [] };
+  } catch (error) {
+    return {
+      value: null,
+      diagnostics: [
+        createDiagnostic({
+          severity: "error",
+          code: "FORGE_EXTERNAL_MANIFEST_PARSE",
+          message: `failed to parse external manifest JSON: ${error instanceof Error ? error.message : String(error)}`,
+          file: path,
+          docs: ["docs/forge-protocol.md", "schemas/forge-manifest.schema.json"],
+        }),
+      ],
+    };
+  }
+}
+
+function registryPath(workspaceRoot: string): string {
+  return join(workspaceRoot, FORGE_EXTERNAL_MANIFEST_REGISTRY);
+}
+
+function rootManifestPath(workspaceRoot: string): string {
+  return join(workspaceRoot, "forge.manifest.json");
+}
+
+function normalizeManifests(manifests: ForgeExternalManifest[]): ForgeExternalManifest[] {
+  return [...manifests].sort((a, b) => a.service.name.localeCompare(b.service.name));
+}
+
+function serviceFromManifest(manifest: ForgeExternalManifest): ForgeExternalService {
+  const entries: ForgeExternalServiceEntry[] = manifest.entries.map((entry) => ({
+    ...entry,
+    service: manifest.service.name,
+    language: manifest.language,
+    ...(manifest.framework ? { framework: manifest.framework } : {}),
+    transport: manifest.service.transport,
+    source: "external",
+  }));
+  return {
+    name: manifest.service.name,
+    language: manifest.language,
+    ...(manifest.framework ? { framework: manifest.framework } : {}),
+    transport: manifest.service.transport,
+    ...(manifest.service.baseUrl ? { baseUrl: manifest.service.baseUrl } : {}),
+    ...(manifest.service.command ? { command: manifest.service.command } : {}),
+    ...(manifest.service.commandArgs ? { commandArgs: manifest.service.commandArgs } : {}),
+    ...(manifest.service.health ? { health: manifest.service.health } : {}),
+    entries,
+  };
+}
+
+function duplicateServiceDiagnostics(
+  manifests: ForgeExternalManifest[],
+  file: string,
+): Diagnostic[] {
+  const seen = new Set<string>();
+  const diagnostics: Diagnostic[] = [];
+  for (const manifest of manifests) {
+    if (seen.has(manifest.service.name)) {
+      diagnostics.push(createDiagnostic({
+        severity: "error",
+        code: "FORGE_EXTERNAL_SERVICE_DUPLICATE",
+        message: `external service '${manifest.service.name}' is imported more than once`,
+        file,
+        fixHint: "Keep one manifest per external service name in .forge/external-manifests.json.",
+        docs: ["docs/forge-protocol.md"],
+      }));
+    }
+    seen.add(manifest.service.name);
+  }
+  return diagnostics;
+}
+
+export function readExternalManifestFile(path: string): {
+  manifest: ForgeExternalManifest | null;
+  diagnostics: Diagnostic[];
+} {
+  const parsed = parseJsonFile(path);
+  if (parsed.value === null) {
+    return { manifest: null, diagnostics: parsed.diagnostics };
+  }
+  const result = validateExternalManifest(parsed.value, { file: path });
+  return { manifest: result.manifest, diagnostics: [...parsed.diagnostics, ...result.diagnostics] };
+}
+
+export function loadExternalManifestRegistry(
+  workspaceRoot: string,
+): { registry: ForgeExternalManifestRegistryFile; diagnostics: Diagnostic[]; path: string } {
+  const path = registryPath(workspaceRoot);
+  const diagnostics: Diagnostic[] = [];
+  const manifests: ForgeExternalManifest[] = [];
+
+  if (existsSync(path)) {
+    const parsed = parseJsonFile(path);
+    diagnostics.push(...parsed.diagnostics);
+    if (parsed.value !== null) {
+      const result = validateExternalManifestRegistry(parsed.value, { file: path });
+      diagnostics.push(...result.diagnostics);
+      if (result.registry) {
+        manifests.push(...result.registry.manifests);
+      }
+    }
+  }
+
+  const rootPath = rootManifestPath(workspaceRoot);
+  if (existsSync(rootPath)) {
+    const result = readExternalManifestFile(rootPath);
+    diagnostics.push(...result.diagnostics);
+    if (result.manifest) {
+      manifests.push(result.manifest);
+    }
+  }
+
+  diagnostics.push(...duplicateServiceDiagnostics(manifests, path));
+  return {
+    path,
+    registry: {
+      schemaVersion: "0.1.0",
+      manifests: normalizeManifests(manifests),
+    },
+    diagnostics,
+  };
+}
+
+export function buildExternalServiceGraph(workspaceRoot: string): ForgeExternalServiceGraph {
+  const loaded = loadExternalManifestRegistry(workspaceRoot);
+  const services = loaded.registry.manifests.map(serviceFromManifest);
+  return {
+    schemaVersion: "0.1.0",
+    protocolVersion: FORGE_EXTERNAL_MANIFEST_PROTOCOL_VERSION,
+    registryPath: FORGE_EXTERNAL_MANIFEST_REGISTRY,
+    inputHash: hashStable(serializeCanonical({ services, diagnostics: loaded.diagnostics })),
+    services,
+    diagnostics: loaded.diagnostics,
+  };
+}
+
+export function importExternalManifest(
+  workspaceRoot: string,
+  inputPath: string,
+): { graph: ForgeExternalServiceGraph; diagnostics: Diagnostic[]; imported: boolean; path: string } {
+  const absoluteInput = resolve(workspaceRoot, inputPath);
+  const result = readExternalManifestFile(absoluteInput);
+  if (!result.manifest || result.diagnostics.some((diagnostic) => diagnostic.severity === "error")) {
+    return {
+      graph: buildExternalServiceGraph(workspaceRoot),
+      diagnostics: result.diagnostics,
+      imported: false,
+      path: absoluteInput,
+    };
+  }
+
+  const loaded = loadExternalManifestRegistry(workspaceRoot);
+  const remaining = loaded.registry.manifests.filter(
+    (manifest) => manifest.service.name !== result.manifest?.service.name,
+  );
+  const registry: ForgeExternalManifestRegistryFile = {
+    schemaVersion: "0.1.0",
+    manifests: normalizeManifests([...remaining, result.manifest]),
+  };
+  const path = registryPath(workspaceRoot);
+  mkdirSync(dirname(path), { recursive: true });
+  writeFileSync(path, `${serializeCanonical(registry).trimEnd()}\n`, "utf8");
+  const graph = buildExternalServiceGraph(workspaceRoot);
+  return {
+    graph,
+    diagnostics: [...loaded.diagnostics, ...result.diagnostics],
+    imported: true,
+    path,
+  };
+}
+
+export function serializeExternalServiceGraphJson(graph: ForgeExternalServiceGraph): string {
+  return serializeCanonical(graph);
+}
+
+export function serializeExternalServiceGraphTs(graph: ForgeExternalServiceGraph): string {
+  return `export const externalServices = ${JSON.stringify(
+    JSON.parse(serializeExternalServiceGraphJson(graph)),
+    null,
+    2,
+  )} as const;\n`;
+}

package/src/forge/compiler/external-manifest/types.ts

@@ -0,0 +1,91 @@
+import type { Diagnostic } from "../types/diagnostic.ts";
+
+export const FORGE_EXTERNAL_MANIFEST_PROTOCOL_VERSION = "1.0";
+export const FORGE_EXTERNAL_MANIFEST_REGISTRY = ".forge/external-manifests.json";
+
+export type ForgeExternalManifestLanguage =
+  | "go"
+  | "java"
+  | "kotlin"
+  | "csharp"
+  | "rust"
+  | "python"
+  | "typescript"
+  | string;
+
+export type ForgeExternalTransportKind = "http" | "grpc" | "stdio";
+export type ForgeExternalEntryKind = "command" | "query";
+export type ForgeExternalEntryRisk = "read" | "write" | "destructive" | "external";
+export type ForgeExternalTransactionMode =
+  | "read-only"
+  | "external-managed"
+  | "forge-managed"
+  | "saga";
+
+export interface ForgeExternalManifestService {
+  name: string;
+  transport: ForgeExternalTransportKind;
+  baseUrl?: string;
+  command?: string;
+  commandArgs?: string[];
+  health?: string;
+}
+
+export interface ForgeExternalManifestEntry {
+  name: string;
+  kind: ForgeExternalEntryKind;
+  description?: string;
+  path?: string;
+  method?: "GET" | "POST";
+  inputSchema?: unknown;
+  outputSchema?: unknown;
+  policy?: string;
+  tenantScoped?: boolean;
+  transaction?: ForgeExternalTransactionMode;
+  risk?: ForgeExternalEntryRisk;
+  needsApproval?: boolean;
+  effects?: string[];
+}
+
+export interface ForgeExternalManifest {
+  forgeProtocol: typeof FORGE_EXTERNAL_MANIFEST_PROTOCOL_VERSION;
+  language: ForgeExternalManifestLanguage;
+  framework?: string;
+  service: ForgeExternalManifestService;
+  entries: ForgeExternalManifestEntry[];
+  schemas?: Record<string, unknown>;
+}
+
+export interface ForgeExternalManifestRegistryFile {
+  schemaVersion: "0.1.0";
+  manifests: ForgeExternalManifest[];
+}
+
+export interface ForgeExternalServiceEntry extends ForgeExternalManifestEntry {
+  service: string;
+  language: ForgeExternalManifestLanguage;
+  framework?: string;
+  transport: ForgeExternalTransportKind;
+  source: "external";
+}
+
+export interface ForgeExternalService {
+  name: string;
+  language: ForgeExternalManifestLanguage;
+  framework?: string;
+  transport: ForgeExternalTransportKind;
+  baseUrl?: string;
+  command?: string;
+  commandArgs?: string[];
+  health?: string;
+  entries: ForgeExternalServiceEntry[];
+}
+
+export interface ForgeExternalServiceGraph {
+  schemaVersion: "0.1.0";
+  protocolVersion: typeof FORGE_EXTERNAL_MANIFEST_PROTOCOL_VERSION;
+  inputHash: string;
+  registryPath: string;
+  services: ForgeExternalService[];
+  diagnostics: Diagnostic[];
+}