@fonderie/cli 0.1.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Fonderie, Inc.
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,41 @@
+# @fonderie/cli
+
+Teach any coding agent the Fonderie SDK **without loading it eagerly.**
+
+```
+npx @fonderie/cli init         # set up the lazy skill + keep it fresh, once
+npx @fonderie/cli query billing.subscriptions   # what to install for a capability
+```
+
+The old way loaded every package's signatures into the agent's context every
+turn (~6–28k tokens). This writes a small **router** that stays resident and
+**per-package bodies the agent reads only when a task touches them.** Measured on
+a 3-condition, N=3 benchmark: **0.14× the knowledge overhead of the eager skill,
+at equal completion and quality** (`experiments/phase41-2026-07/`).
+
+## Commands
+
+- **`fonderie init [--project <dir>]`** — run once: generates the lazy skill AND
+  adds a `postinstall` (`fonderie skill`) so it **regenerates on every
+  install/update**, staying version-matched to your lockfile. Idempotent; chains
+  onto an existing postinstall rather than clobbering it.
+- **`fonderie skill [--out <dir>] [--project <dir>]`** — write `SKILL.md` (the
+  router: a capability→body table + security invariants) plus one
+  `fonderie/<pkg>.md` body per **installed** `@fonderie/*` package. Point your
+  agent at `.claude/skills`; bodies load on demand.
+- **`fonderie query <concept>`** / **`--concepts`** — answer "what do I install
+  for this capability": the package, the recipe, the wiring, and (if installed)
+  the exact API. Zero resident schema tax — the agent runs it only when it needs
+  discovery.
+
+## How it stays correct
+
+Each package ships its own `brain/` fragment **inside its tarball**, version-
+matched to the code you installed. The CLI reads those from `node_modules`, so
+the skill you get always matches your lockfile — no central registry to skew
+against. Zero dependencies, no server, no build step: a binary and markdown that
+run in Claude Code, Codex, Copilot, Cursor, or a plain shell.
+
+MCP is still available (`@fonderie` brain server) for stateful, long-running
+autonomous loops — the CLI trades a little wall-clock for a large token saving,
+which is the right call for coding agents building a SaaS.

package/bin/fonderie.mjs

@@ -0,0 +1,176 @@
+#!/usr/bin/env node
+// The Fonderie CLI. Two commands, both proven by the N=3 benchmark
+// (PLAN-SKILLS-CLI.md — lazy skills beat the eager brain at 0.14 knowledge
+// overhead vs fat, at equal completion/quality):
+//
+//   fonderie skill [--out <dir>] [--project <dir>]
+//       Write a LAZY skill into <dir> (default .claude/skills): a small router
+//       SKILL.md (always resident) + one body per INSTALLED @fonderie package
+//       (read on demand). Load scales with what the agent does, not the catalogue.
+//
+//   fonderie query <concept>          fonderie query --concepts
+//       Answer "what do I install for this capability" — the package, the recipe,
+//       the wiring. Zero resident schema tax; the agent runs it only when needed.
+//
+// Zero deps. Reads the curated knowledge bundled in ./data + each installed
+// package's own co-located brain/ fragment (version-matched, shipped in its
+// tarball). No MCP server, no build step — a binary + markdown, runs anywhere.
+
+import { readFileSync, readdirSync, writeFileSync, existsSync, mkdirSync } from 'node:fs';
+import { join, dirname } from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const here = dirname(fileURLToPath(import.meta.url));
+const pkgRoot = join(here, '..');
+const K = JSON.parse(readFileSync(join(pkgRoot, 'data/knowledge.json'), 'utf8'));
+const CONCEPTS = Object.entries(K.concepts || {});
+
+const argv = process.argv.slice(2);
+const cmd = argv[0];
+const arg = (f, d) => { const i = argv.indexOf(f); return i >= 0 ? argv[i + 1] : d; };
+
+// installed @fonderie packages in a project (co-located fragments are the data)
+function installed(projectDir) {
+  const dir = join(projectDir, 'node_modules', '@fonderie');
+  if (!existsSync(dir)) return [];
+  return readdirSync(dir).sort()
+    .filter((n) => existsSync(join(dir, n, 'package.json')))
+    .map((n) => ({ name: n, version: JSON.parse(readFileSync(join(dir, n, 'package.json'), 'utf8')).version, dir: join(dir, n) }));
+}
+const fragment = (pkg) => {
+  const f = (name) => { const p = join(pkg.dir, 'brain', name); return existsSync(p) ? readFileSync(p, 'utf8').trim() : ''; };
+  return { signatures: f('signatures.md'), outcomes: f('outcomes.md') };
+};
+
+// ── fonderie query <concept> ────────────────────────────────────────────────
+function doQuery() {
+  if (argv.includes('--concepts')) {
+    for (const [id, c] of CONCEPTS) console.log(`  ${id.padEnd(24)} ${c.description}`);
+    return;
+  }
+  const id = argv[1];
+  const c = id && K.concepts[id];
+  if (!c) {
+    console.error(`unknown concept "${id ?? ''}". Run \`fonderie query --concepts\` for the list.`);
+    process.exit(2);
+  }
+  const projectDir = arg('--project', process.cwd());
+  const inst = installed(projectDir).find((p) => p.name === c.package);
+  console.log(`${id} — ${c.description}\n`);
+  console.log(`Package: @fonderie/${c.package}${inst ? `@${inst.version} (installed)` : ' — run: npm install @fonderie/' + c.package}`);
+  const recipe = c.recipe && K.recipes[c.recipe];
+  if (recipe) {
+    console.log(`Recipe: ${c.recipe} — ${recipe.when}`);
+    console.log(`Wire:   ${recipe.packages.join(' → ')}`);
+    for (const inv of recipe.invariants || []) if (K.invariants[inv]) console.log(`⚠ ${K.invariants[inv]}`);
+  }
+  if (inst) {
+    const fr = fragment(inst);
+    if (fr.signatures) console.log(`\n--- exact API (use these, do not guess) ---\n${fr.signatures}`);
+    if (fr.outcomes) console.log(`\n--- tables + routes registered ---\n${fr.outcomes}`);
+  } else {
+    console.log('\nNot installed yet — install it, run its migrations, wire it per the recipe, and continue. Adding the brick IS the task.');
+  }
+}
+
+// ── fonderie skill — write the lazy router + per-package bodies ──────────────
+function doSkill() {
+  const projectDir = arg('--project', process.cwd());
+  const outDir = arg('--out', join(projectDir, '.claude/skills'));
+  const inst = installed(projectDir);
+  const instNames = new Set(inst.map((p) => p.name));
+  mkdirSync(join(outDir, 'fonderie'), { recursive: true });
+
+  // per-package BODIES (lazy) — only for installed packages, from their own fragment
+  let bodies = 0;
+  for (const p of inst) {
+    const fr = fragment(p);
+    if (!fr.signatures && !fr.outcomes) continue;
+    const body = [`# @fonderie/${p.name}@${p.version}`, '', fr.signatures, fr.outcomes ? '\n' + fr.outcomes : ''].join('\n').trim();
+    writeFileSync(join(outDir, 'fonderie', `${p.name}.md`), body + '\n');
+    bodies++;
+  }
+
+  // ROUTER SKILL.md — small, always resident
+  const L = [];
+  L.push('---');
+  L.push('name: fonderie');
+  L.push('description: Building or modifying a SaaS backend — auth/login/sessions, teams/workspaces, billing/Stripe, roles/permissions, email/SMS, feature flags, audit logs, webhooks, or wiring an API route. Reach for a @fonderie brick instead of hand-writing it.');
+  L.push('---');
+  L.push('');
+  L.push('# Fonderie — router');
+  L.push('');
+  L.push('Do not hand-write auth, billing, teams, permissions, email, webhooks, rate');
+  L.push('limiting, or config. Use the audited `@fonderie/*` brick. For the capability');
+  L.push('your task needs, **read only that package\'s body** — do not load them all.');
+  L.push('');
+  L.push(`Installed here: ${inst.length ? inst.map((p) => `\`@fonderie/${p.name}@${p.version}\``).join(', ') : 'none yet'}.`);
+  L.push('');
+  L.push('## Capability → read this / or discover');
+  L.push('');
+  L.push('| Task needs… | Package | Read (installed) | Or discover (any) |');
+  L.push('| --- | --- | --- | --- |');
+  for (const [id, c] of CONCEPTS) {
+    const readCol = instNames.has(c.package) ? `\`fonderie/${c.package}.md\`` : '— (not installed)';
+    L.push(`| ${c.description} | \`${c.package}\` | ${readCol} | \`fonderie query ${id}\` |`);
+  }
+  L.push('');
+  L.push('**Not installed?** Run the discover command — it names the package + recipe.');
+  L.push('Then `npm install @fonderie/<pkg>`, run its migrations, wire it, and continue.');
+  L.push('Do NOT stop to ask permission or abandon the task; adding the brick IS the task.');
+  L.push('Pick sensible defaults for provider/config choices behind fail-fast env vars.');
+  L.push('');
+  if (Object.keys(K.invariants || {}).length) {
+    L.push('## Security invariants (always apply)');
+    L.push('');
+    for (const [k, v] of Object.entries(K.invariants).sort()) L.push(`- **${k}**: ${v}`);
+    L.push('');
+  }
+  writeFileSync(join(outDir, 'SKILL.md'), L.join('\n') + '\n');
+  const routerTok = Math.ceil(L.join('\n').length / 4);
+  console.log(`Wrote ${outDir}/SKILL.md (router ~${routerTok} tok, always resident) + ${bodies} lazy bodies in fonderie/.`);
+  console.log('Point your agent at .claude/skills. Bodies load only when a task touches that package.');
+}
+
+// ── fonderie init — generate the skill AND keep it fresh on install/update ───
+// Freshness by construction (the R3 goal): a `postinstall` regenerates the skill
+// from node_modules every time packages change, so the resident knowledge is
+// always version-matched to the lockfile — no manual re-run, no skew.
+function doInit() {
+  doSkill();
+  const projectDir = arg('--project', process.cwd());
+  const pjPath = join(projectDir, 'package.json');
+  if (!existsSync(pjPath)) { console.log('\n(no package.json here — skipped postinstall wiring; run `fonderie skill` after installs to refresh.)'); return; }
+  const pj = JSON.parse(readFileSync(pjPath, 'utf8'));
+  pj.scripts ||= {};
+  const HOOK = 'fonderie skill';
+  const cur = pj.scripts.postinstall;
+  if (cur && cur.includes(HOOK)) {
+    console.log('\n✓ postinstall already refreshes the skill.');
+  } else if (cur) {
+    // don't clobber an existing postinstall — chain ours, idempotently
+    pj.scripts.postinstall = `${cur} && ${HOOK}`;
+    writeFileSync(pjPath, JSON.stringify(pj, null, 2) + '\n');
+    console.log(`\n✓ Appended \`${HOOK}\` to your existing postinstall (regenerates the skill on every install).`);
+  } else {
+    pj.scripts.postinstall = HOOK;
+    writeFileSync(pjPath, JSON.stringify(pj, null, 2) + '\n');
+    console.log(`\n✓ Added \`"postinstall": "${HOOK}"\` — the skill regenerates on every install/update, staying version-matched.`);
+  }
+}
+
+// ── dispatch ────────────────────────────────────────────────────────────────
+if (cmd === 'query') doQuery();
+else if (cmd === 'skill') doSkill();
+else if (cmd === 'init') doInit();
+else {
+  console.log(`fonderie — the Fonderie CLI (lazy skills for coding agents)
+
+  fonderie init [--project <dir>]                  set up the lazy skill + keep it fresh (postinstall)
+  fonderie skill [--out <dir>] [--project <dir>]   write the lazy skill (router + bodies)
+  fonderie query <concept>                         what to install for a capability
+  fonderie query --concepts                        list every capability
+
+Zero deps. No MCP server. A binary + markdown that runs in any agent harness.`);
+  if (cmd && cmd !== 'help' && cmd !== '--help') process.exit(2);
+}

package/bin/fonderie.test.mjs

@@ -0,0 +1,80 @@
+#!/usr/bin/env node
+// Smoke test for the fonderie CLI — fabricates a fixture project with a couple of
+// installed @fonderie packages (each with a co-located brain/ fragment) and
+// asserts `skill` writes a router + bodies, and `query` answers correctly.
+// Zero deps; exits non-zero on failure.
+
+import { execFileSync } from 'node:child_process';
+import { mkdtempSync, mkdirSync, writeFileSync, readFileSync, existsSync } from 'node:fs';
+import { join, dirname } from 'node:path';
+import { tmpdir } from 'node:os';
+import { fileURLToPath } from 'node:url';
+
+const here = dirname(fileURLToPath(import.meta.url));
+const bin = join(here, 'fonderie.mjs');
+const fail = (m) => { console.error('FAIL:', m); process.exit(1); };
+const run = (args, opts = {}) => execFileSync('node', [bin, ...args], { encoding: 'utf8', ...opts });
+
+// fixture: auth (with a fragment) + billing (with a fragment) installed
+const proj = mkdtempSync(join(tmpdir(), 'fonderie-cli-'));
+for (const [name, ver, sig] of [['auth', '1.3.2', 'class AuthModule {}'], ['billing', '1.1.2', 'class BillingModule {}']]) {
+  const d = join(proj, 'node_modules', '@fonderie', name);
+  mkdirSync(join(d, 'brain'), { recursive: true });
+  writeFileSync(join(d, 'package.json'), JSON.stringify({ name: `@fonderie/${name}`, version: ver }));
+  writeFileSync(join(d, 'brain', 'signatures.md'), `# @fonderie/${name} — signatures\n\n${sig}\n`);
+}
+
+// --- query --concepts ---
+const list = run(['query', '--concepts']);
+if (!/billing\.subscriptions/.test(list)) fail('query --concepts missing billing.subscriptions');
+
+// --- query an installed concept → returns the fragment signatures ---
+const q = run(['query', 'billing.subscriptions', '--project', proj]);
+if (!/@fonderie\/billing@1\.1\.2 \(installed\)/.test(q)) fail('query did not report installed billing');
+if (!/class BillingModule/.test(q)) fail('query did not inline the installed fragment signatures');
+if (!/Recipe:/.test(q)) fail('query missing recipe');
+
+// --- query a NOT-installed concept → install guidance, no signatures ---
+const qn = run(['query', 'workspaces.teams', '--project', proj]);
+if (!/npm install @fonderie\/workspaces/.test(qn)) fail('query of uninstalled pkg missing install guidance');
+
+// --- skill → router + per-package bodies for installed only ---
+const out = join(proj, '.claude/skills');
+run(['skill', '--project', proj, '--out', out]);
+if (!existsSync(join(out, 'SKILL.md'))) fail('skill did not write SKILL.md');
+const router = readFileSync(join(out, 'SKILL.md'), 'utf8');
+if (!/name: fonderie/.test(router)) fail('router missing frontmatter');
+if (!/fonderie query billing\.subscriptions/.test(router)) fail('router missing discover command');
+if (!/`fonderie\/billing\.md`/.test(router)) fail('router should point to the installed billing body');
+if (!/— \(not installed\)/.test(router)) fail('router should mark uninstalled concepts');
+if (!existsSync(join(out, 'fonderie', 'billing.md'))) fail('missing lazy body fonderie/billing.md');
+if (!existsSync(join(out, 'fonderie', 'auth.md'))) fail('missing lazy body fonderie/auth.md');
+if (existsSync(join(out, 'fonderie', 'workspaces.md'))) fail('should NOT emit a body for an uninstalled package');
+if (!/class BillingModule/.test(readFileSync(join(out, 'fonderie', 'billing.md'), 'utf8'))) fail('billing body missing its signatures');
+
+// router should be small (lazy) — a few hundred to ~2k tokens, not the 6-28k eager brain
+if (Math.ceil(router.length / 4) > 3000) fail(`router too big (~${Math.ceil(router.length / 4)} tok) — lazy defeated`);
+
+// --- init → generates the skill AND wires a fresh-keeping postinstall ---
+const proj2 = mkdtempSync(join(tmpdir(), 'fonderie-init-'));
+mkdirSync(join(proj2, 'node_modules', '@fonderie', 'auth', 'brain'), { recursive: true });
+writeFileSync(join(proj2, 'node_modules', '@fonderie', 'auth', 'package.json'), JSON.stringify({ name: '@fonderie/auth', version: '1.3.2' }));
+writeFileSync(join(proj2, 'node_modules', '@fonderie', 'auth', 'brain', 'signatures.md'), '# auth\n\nclass AuthModule {}\n');
+writeFileSync(join(proj2, 'package.json'), JSON.stringify({ name: 'app', scripts: { build: 'tsc' } }));
+run(['init', '--project', proj2]);
+if (!existsSync(join(proj2, '.claude/skills/SKILL.md'))) fail('init did not write the skill');
+const pj2 = JSON.parse(readFileSync(join(proj2, 'package.json'), 'utf8'));
+if (pj2.scripts.postinstall !== 'fonderie skill') fail(`init did not wire postinstall (got: ${pj2.scripts.postinstall})`);
+if (pj2.scripts.build !== 'tsc') fail('init clobbered an existing script');
+// idempotent: running init again must not double-append
+run(['init', '--project', proj2]);
+const pj2b = JSON.parse(readFileSync(join(proj2, 'package.json'), 'utf8'));
+if (pj2b.scripts.postinstall !== 'fonderie skill') fail(`init not idempotent (got: ${pj2b.scripts.postinstall})`);
+// existing postinstall is chained, not clobbered
+const proj3 = mkdtempSync(join(tmpdir(), 'fonderie-init2-'));
+writeFileSync(join(proj3, 'package.json'), JSON.stringify({ name: 'app', scripts: { postinstall: 'patch-package' } }));
+run(['init', '--project', proj3]);
+const pj3 = JSON.parse(readFileSync(join(proj3, 'package.json'), 'utf8'));
+if (pj3.scripts.postinstall !== 'patch-package && fonderie skill') fail(`init did not chain existing postinstall (got: ${pj3.scripts.postinstall})`);
+
+console.log('fonderie CLI test: all assertions passed (skill, query installed/uninstalled, init wires idempotent fresh-keeping postinstall)');

package/data/knowledge.json

@@ -0,0 +1,211 @@
+{
+  "concepts": {
+    "auth.accounts": {
+      "description": "sign up, log in, sessions, passwords, MFA, email verification",
+      "package": "auth",
+      "recipe": "basic-auth"
+    },
+    "auth.oauth": {
+      "description": "social login / SSO via OAuth providers (Google, GitHub)",
+      "package": "auth",
+      "recipe": "oauth"
+    },
+    "auth.route-guard": {
+      "description": "protect a route or page so only logged-in users reach it",
+      "package": "auth",
+      "recipe": "route-guard"
+    },
+    "billing.subscriptions": {
+      "description": "accept payments, subscription plans, Stripe checkout, invoices",
+      "package": "billing",
+      "recipe": "stripe-checkout"
+    },
+    "billing.per-seat": {
+      "description": "charge per team member / seat",
+      "package": "billing",
+      "recipe": "per-seat-billing"
+    },
+    "billing.plan-gate": {
+      "description": "lock a feature behind a paid plan / entitlements / free-tier limits",
+      "package": "billing",
+      "recipe": "plan-gate"
+    },
+    "workspaces.teams": {
+      "description": "teams, orgs, multi-tenancy, members, email invites",
+      "package": "workspaces",
+      "recipe": "teams-invites"
+    },
+    "permissions.rbac": {
+      "description": "roles and permissions — admin/member/viewer, access control",
+      "package": "permissions",
+      "recipe": "rbac"
+    },
+    "courier.messaging": {
+      "description": "SEND any transactional message — email, SMS, push; use this for password-reset, email-verification, welcome, and invite emails (auth.* is who can log in, courier is what delivers the message)",
+      "package": "courier",
+      "recipe": "transactional-email"
+    },
+    "webhooks.in-out": {
+      "description": "receive webhooks (Stripe) and emit your own to other apps",
+      "package": "webhooks",
+      "recipe": "webhooks-in-out"
+    },
+    "events.bus": {
+      "description": "in-process event bus — react when something happens in another module",
+      "package": "events"
+    },
+    "config.flags": {
+      "description": "feature flags, remote config, kill switches",
+      "package": "config"
+    },
+    "audit.trail": {
+      "description": "workspace-scoped audit log — who did what, compliance",
+      "package": "audit"
+    },
+    "rate-limit.throttle": {
+      "description": "throttle requests — brute force, abuse, spam protection",
+      "package": "rate-limit"
+    },
+    "customers.crm": {
+      "description": "customer records / CRM tied to billing",
+      "package": "customers"
+    },
+    "core.app": {
+      "description": "bootstrap a Fonderie app, register modules, mount on Express/Hono/Koa",
+      "package": "core"
+    },
+    "store.database": {
+      "description": "Postgres access and append-only migrations",
+      "package": "store"
+    }
+  },
+  "recipes": {
+    "basic-auth": {
+      "when": "sign up + log in with email/password",
+      "packages": [
+        "auth",
+        "core",
+        "events",
+        "store"
+      ],
+      "invariants": [
+        "jwt-secret-from-env",
+        "rate-limit-default-on"
+      ]
+    },
+    "oauth": {
+      "when": "social login (Google/GitHub)",
+      "packages": [
+        "auth",
+        "config",
+        "core",
+        "store"
+      ],
+      "invariants": [
+        "jwt-secret-from-env"
+      ]
+    },
+    "route-guard": {
+      "when": "gate a route behind login",
+      "packages": [
+        "auth"
+      ],
+      "invariants": [],
+      "note": "use requireAuth middleware from @fonderie/auth on the protected route"
+    },
+    "teams-invites": {
+      "when": "teams/workspaces with email invites",
+      "packages": [
+        "workspaces",
+        "auth",
+        "courier",
+        "events",
+        "core",
+        "store"
+      ],
+      "invariants": [
+        "workspaces-requires-billing",
+        "email-provider-default"
+      ]
+    },
+    "stripe-checkout": {
+      "when": "charge users / subscription plans",
+      "packages": [
+        "billing",
+        "customers",
+        "core",
+        "store"
+      ],
+      "invariants": [
+        "webhook-route-before-auth-mw",
+        "rate-limit-default-on"
+      ]
+    },
+    "per-seat-billing": {
+      "when": "bill per team member / seat",
+      "packages": [
+        "billing",
+        "workspaces",
+        "core",
+        "store"
+      ],
+      "invariants": [
+        "workspaces-requires-billing"
+      ]
+    },
+    "plan-gate": {
+      "when": "lock a feature behind a paid plan",
+      "packages": [
+        "billing",
+        "permissions"
+      ],
+      "invariants": []
+    },
+    "rbac": {
+      "when": "roles & permissions (admin/member/viewer)",
+      "packages": [
+        "permissions",
+        "workspaces",
+        "core",
+        "store"
+      ],
+      "invariants": []
+    },
+    "transactional-email": {
+      "when": "welcome / reset / invite emails",
+      "packages": [
+        "courier",
+        "events",
+        "config",
+        "core",
+        "store"
+      ],
+      "invariants": [
+        "email-provider-default"
+      ]
+    },
+    "webhooks-in-out": {
+      "when": "receive Stripe webhooks and emit your own",
+      "packages": [
+        "webhooks",
+        "billing",
+        "events",
+        "rate-limit",
+        "core",
+        "store"
+      ],
+      "invariants": [
+        "webhook-route-before-auth-mw",
+        "rate-limit-default-on"
+      ]
+    }
+  },
+  "invariants": {
+    "jwt-secret-from-env": "Read the auth JWT secret from process.env and throw if missing — never ship an insecure hardcoded fallback (the #1 scratch-build flaw, baseline round 0-baseline).",
+    "rate-limit-default-on": "@fonderie/auth enables brute-force rate limiting by default (since auth 1.2.0); do not set rateLimit:false unless you have another limiter in front.",
+    "logout-provided": "@fonderie/auth mounts POST /auth/logout with session invalidation — do not hand-roll stateless-JWT logout.",
+    "webhook-route-before-auth-mw": "Register the billing/Stripe webhook route before global auth middleware so signature-verified callbacks are not rejected as unauthenticated.",
+    "workspaces-requires-billing": "@fonderie/workspaces peer-depends on @fonderie/billing; register billing before workspaces.",
+    "email-provider-default": "Do NOT stop to ask which email provider to use. Default to SMTP via CourierModule's SMTP channel, configured from process.env (SMTP_URL or SMTP_HOST/PORT/USER/PASS), fail-fast if missing. Note the choice in a comment; the operator can swap providers later. Picking a sensible default and proceeding is required — a blocked task is a failed task."
+  }
+}

package/package.json

@@ -0,0 +1,43 @@
+{
+	"name": "@fonderie/cli",
+	"version": "0.1.0",
+	"description": "The Fonderie CLI — teaches any coding agent the SDK without loading it eagerly. `fonderie skill` writes a lazy skill (a small router + per-package bodies read on demand); `fonderie query` answers what to install for a capability. Zero deps, runs anywhere.",
+	"keywords": [
+		"fonderie-js",
+		"cli",
+		"skill",
+		"ai-agent",
+		"claude-code",
+		"codex",
+		"lazy"
+	],
+	"license": "MIT",
+	"type": "module",
+	"bin": {
+		"fonderie": "bin/fonderie.mjs"
+	},
+	"files": [
+		"bin",
+		"data",
+		"LICENSE",
+		"README.md"
+	],
+	"engines": {
+		"node": ">=20"
+	},
+	"scripts": {
+		"test": "node bin/fonderie.test.mjs"
+	},
+	"publishConfig": {
+		"access": "public"
+	},
+	"repository": {
+		"type": "git",
+		"url": "git+https://github.com/fonderiejs/sdk.git",
+		"directory": "packages/cli"
+	},
+	"homepage": "https://github.com/fonderiejs/sdk/tree/main/packages/cli#readme",
+	"bugs": {
+		"url": "https://github.com/fonderiejs/sdk/issues"
+	}
+}