Publish the React and Vue wrappers as their own packages (0.8.0)

[cmm-cmm]

Summary

forgedialog advertised having no runtime dependencies while declaring react and vue as peer dependencies and shipping a build of each. They were marked optional, so nothing broke — but two frameworks sat in the dependency tree of a library that has nothing to do with either, and every tool that reads peer dependencies had to be told to ignore them.

The adapters move to packages/react and packages/vue, published as forgedialog-react and forgedialog-vue, matching how the sibling repository already ships forge-select-react and forge-select-vue. Each declares its own framework as a peer dependency and the core as a real one, and each builds with the framework and the core external, so a wrapper never ships a second copy of either.

forgedialog/svelte and forgedialog/web-component stay in the core. Neither needs a framework runtime, so neither costs a peer dependency.

Breaking, hence 0.8.0

forgedialog/react and forgedialog/vue are gone, and the core no longer declares peerDependencies at all. The hook itself is unchanged, so the migration is one import line:

- import { useForgeDialog } from 'forgedialog/react';
+ import { useForgeDialog } from 'forgedialog-react';

npm install forgedialog-react   # or forgedialog-vue

The core's tarball drops to 63 files / 118.2 KiB, from 71 / 120.3.

Why the dependency range is not a caret

The wrappers depend on forgedialog: ">=0.7.0 <1.0.0". On a 0.x core a caret pins the minor, so ^0.7.0 would exclude 0.8.0 — the very release these ship beside. check-release.mjs now refuses a caret range on the core rather than guessing at what it was meant to mean.

Release plumbing

check-release.mjs previously checked the one package it was pointed at. It now covers every package a release publishes and verifies each wrapper's range against the release — proved by setting three wrong ranges and watching each one fail, not by watching it pass.

• npm publish --workspaces runs after the core: a consumer installing a wrapper the moment it appears has to find the core already on the registry.
• Each package gets prepublishOnly, so a clean checkout cannot publish an empty dist.
• validate, lint, and check:package now cover the workspaces, so CI gates them.
• docs/releasing.md gains a step: npm scopes trusted publishing per package, so all three need their own publisher entry. Miss one and the release half-succeeds — core published, wrappers not.

Verification

• npm run validate — now including the workspaces' tests, typecheck, and package checks
• npm run format:check
• npm run test:e2e — not run locally (the pinned Playwright wants a browser build this container does not have). It drives demo/ and the library, neither of which changed. CI runs it.
• Added or updated tests covering the change — each package carries the test for its own hook; the core's adapter suite keeps only Svelte and Web Components

Verified end to end rather than by inspection. All three packages were packed and installed into an empty project, where:

• forgedialog-react and forgedialog-vue export the hook
• forgedialog/react and forgedialog/vue no longer resolve; forgedialog/svelte still does
• the core reports no peerDependencies
• a real React render through the packed dist opens a dialog with the right title and role, clears active on close, and destroys a still-open dialog on unmount
• the install reports found 0 vulnerabilities

publint and attw pass on both packages across node10, node16 (CJS and ESM), and bundler.

Checklist

• Added a changeset — not applicable: this repository writes CHANGELOG.md by hand, and 0.8.0 is written there with the migration.
• Refreshed API reports — not applicable: the reports cover the core's entry points, and the removed adapters never had one.
• Raised a gzip budget — not needed; the core got smaller.
• Refreshed the visual baseline — not needed; demo/ is unchanged.

One note for the record

This branch's lockfile gains tsup/node_modules/esbuild@0.27.7, which npm audit flags low. It is not a regression: main's lockfile simply omitted the entry, while tsup@8.5.1 has always required esbuild ^0.27.0, which the hoisted 0.28.1 cannot satisfy. No patched 0.27.x exists and tsup@latest still pins that range, so forcing 0.28 on it would be an unsupported combination adopted to silence a dev-server advisory this repository never runs. Nothing gates on npm audit, and nothing reaches the published packages.

🤖 Generated with Claude Code

https://claude.ai/code/session_01MtJ3nDatGiv7dHjvZL1uZ4

---

Generated by Claude Code

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Preview URL	Updated (UTC)
✅ Deployment successful! View logs	forge-dialog	75f3c72	Commit Preview URL Branch Preview URL	Sep 02 2026, 12:29 PM