@fonderie/cli 0.3.0 → 0.4.0

package/bin/fonderie.mjs

@@ -317,6 +317,36 @@ async function adminFetch(method, path, body) {
   console.log(typeof result === 'string' ? result : JSON.stringify(result, null, 2));
 }
 
+// ── fonderie admin <page> — read a deployment's operator surface (@fonderie/admin) ─
+// One page per operator question. Read-only; the prefix defaults to /_admin
+// and follows FONDERIE_ADMIN_PREFIX when the app moved it.
+const ADMIN_PAGES = {
+  attention: { path: '',                     about: 'what needs the operator today' },
+  manifest:  { path: '/manifest',            about: 'modules, versions, readiness, the route table' },
+  doctor:    { path: '/doctor',              about: 'every reconciliation check, on demand' },
+  config:    { path: '/config',              about: 'readiness per module + env presence' },
+  routes:    { path: '/routes',              about: 'every exposed route with its guard' },
+  tokens:    { path: '/access/tokens',       about: 'the admin token verdict + legacy per-brick tokens' },
+  log:       { path: '/activity/admin-log',  about: 'who did what through the surface (--limit, --before)' },
+};
+async function adminCmd() {
+  const pageName = argv[1];
+  const page = ADMIN_PAGES[pageName];
+  if (!page) {
+    console.error(`fonderie admin <${Object.keys(ADMIN_PAGES).join('|')}>`);
+    for (const [k, v] of Object.entries(ADMIN_PAGES)) console.error(`  ${k.padEnd(10)} ${v.about}`);
+    process.exit(2);
+  }
+  const prefix = (process.env.FONDERIE_ADMIN_PREFIX || '/_admin').replace(/\/$/, '');
+  const q = new URLSearchParams();
+  const limit = arg('--limit', undefined);
+  const before = arg('--before', undefined);
+  if (pageName === 'log' && limit) q.set('limit', limit);
+  if (pageName === 'log' && before) q.set('before', before);
+  const qs = q.toString();
+  return adminFetch('GET', prefix + page.path + (qs ? `?${qs}` : ''));
+}
+
 // The supported management verbs (kubectl-inspired) — the single source of truth
 // for the CLI's config/secret surface. Each maps to a method + optional path
 // suffix + what it requires (a key, a body value, a --to-version).
@@ -398,6 +428,7 @@ else if (cmd === 'init') doInit();
 else if (cmd === 'config') resourceCmd('config', '/admin/config').catch((e) => { console.error(e.message); process.exit(1); });
 else if (cmd === 'secret') resourceCmd('secret', '/admin/secrets').catch((e) => { console.error(e.message); process.exit(1); });
 else if (cmd === 'template') resourceCmd('template', '/admin/templates').catch((e) => { console.error(e.message); process.exit(1); });
+else if (cmd === 'admin') adminCmd().catch((e) => { console.error(e.message); process.exit(1); });
 else {
   console.log(`fonderie — the Fonderie CLI (lazy skills for coding agents)
 
@@ -411,6 +442,8 @@ else {
   fonderie secret <get|set|delete|history|rollback|reveal> [key] [value] [--env <e>] ...
   fonderie template <get|set|delete|history|rollback> [type] [text] [--locale <l>] [--subject <s>] [--html <h>] ...
       manage a live deployment over its admin API — set FONDERIE_ADMIN_URL + FONDERIE_ADMIN_TOKEN
+  fonderie admin <attention|manifest|doctor|config|routes|tokens|log> [--limit <n>] [--before <cursor>]
+      read a deployment's operator surface (@fonderie/admin) — same env; FONDERIE_ADMIN_PREFIX if moved
 
 Zero deps. No MCP server. A binary + markdown that runs in any agent harness.`);
   if (cmd && cmd !== 'help' && cmd !== '--help') process.exit(2);

package/bin/fonderie.test.mjs

@@ -55,8 +55,12 @@ if (!existsSync(join(out, 'fonderie', 'auth.md'))) fail('missing lazy body fonde
 if (existsSync(join(out, 'fonderie', 'workspaces.md'))) fail('should NOT emit a body for an uninstalled package');
 if (!/class BillingModule/.test(readFileSync(join(out, 'fonderie', 'billing.md'), 'utf8'))) fail('billing body missing its signatures');
 
-// router should be small (lazy) — a few hundred to ~2k tokens, not the 6-28k eager brain
-if (Math.ceil(router.length / 4) > 3000) fail(`router too big (~${Math.ceil(router.length / 4)} tok) — lazy defeated`);
+// Router stays lazy: it lists one row per concept + invariants, so it grows with
+// the catalog (61 concepts ≈ 5.9k tok as of 2026-08). The budget guards the lazy
+// win — the router must stay well under the 6–28k eager brain it replaces, not
+// that it be tiny. Bump this if the catalog legitimately grows; shrink the router
+// (e.g. collapse uninstalled concepts) if it approaches the eager range.
+if (Math.ceil(router.length / 4) > 8000) fail(`router too big (~${Math.ceil(router.length / 4)} tok) — lazy defeated`);
 
 // --- init → generates the skill AND wires a fresh-keeping postinstall ---
 const proj2 = mkdtempSync(join(tmpdir(), 'fonderie-init-'));
@@ -128,6 +132,19 @@ await (async () => {
   if (find('POST', '/admin/config/feature.x/rollback')?.body?.toVersion !== 2) fail('rollback: toVersion body wrong');
   if (!find('POST', '/admin/secrets/stripe.key/reveal?environment=prod')) fail('secret reveal: wrong path');
 
+  // fonderie admin <page> — the operator surface, read-only, prefix-aware
+  await cli(['admin', 'manifest']);
+  await cli(['admin', 'attention']);
+  await cli(['admin', 'log', '--limit', '5', '--before', 'abc']);
+  await execFileP('node', [bin, 'admin', 'doctor'], { env: { ...env, FONDERIE_ADMIN_PREFIX: '/ops/' } });
+  if (!find('GET', '/_admin/manifest')?.auth?.includes('sekret')) fail('admin manifest: wrong request/auth');
+  if (!find('GET', '/_admin')) fail('admin attention: should hit the prefix root');
+  if (!find('GET', '/_admin/activity/admin-log?limit=5&before=abc')) fail('admin log: flags not forwarded');
+  if (!find('GET', '/ops/doctor')) fail('admin doctor: FONDERIE_ADMIN_PREFIX not honoured');
+  let unknown = 0;
+  try { await cli(['admin', 'nope']); } catch (e) { unknown = e.code; }
+  if (unknown !== 2) fail(`admin <unknown page> should exit 2, got ${unknown}`);
+
   // 409 conflict → exit 2 (reload + retry)
   let code = 0;
   try { await cli(['config', 'set', 'conflict', 'x']); } catch (e) { code = e.code; }

package/data/knowledge.json

@@ -36,17 +36,17 @@
       "recipe": "teams-invites"
     },
     "permissions.rbac": {
-      "description": "roles and permissions — admin/member/viewer, access control",
+      "description": "roles and permissions — admin/member/viewer, access control. Backend-only: @fonderie/permissions has no HTTP routes (server-side requirePermission/requireRole middleware + PermissionsEngine.can/.assert). For a frontend role-management UI, see react-workspaces.hooks / vue-workspaces.composables (useRoles, useMemberRoles) — role CRUD is exposed under @fonderie/workspaces' routes.",
       "package": "permissions",
       "recipe": "rbac"
     },
     "courier.messaging": {
-      "description": "SEND any transactional message — email, SMS, push; use this for password-reset, email-verification, welcome, and invite emails (auth.* is who can log in, courier is what delivers the message)",
+      "description": "SEND any transactional message — email, SMS, push; use this for password-reset, email-verification, welcome, and invite emails (auth.* is who can log in, courier is what delivers the message). No end-user-facing HTTP API — messages are sent server-side via the event bus, not called from a frontend. For an admin template-editor UI, see react-courier-admin.templates / vue-courier-admin.templates.",
       "package": "courier",
       "recipe": "transactional-email"
     },
     "webhooks.in-out": {
-      "description": "receive webhooks (Stripe) and emit your own to other apps",
+      "description": "receive webhooks (Stripe) and emit your own to other apps — full CRUD on outbound endpoints plus delivery history and test-send. Session-authenticated like billing/workspaces/audit (not the admin-token model courier-admin/config-admin use). For a frontend endpoint manager, see react-webhooks.hooks / vue-webhooks.composables.",
       "package": "webhooks",
       "recipe": "webhooks-in-out"
     },
@@ -55,11 +55,11 @@
       "package": "events"
     },
     "config.flags": {
-      "description": "feature flags, remote config, kill switches",
+      "description": "feature flags, remote config, kill switches. No end-user-facing HTTP API — apps read config server-side or via defineConfig(); the only HTTP surface is the admin-token-guarded /admin/config and /admin/secrets management API. For an admin dashboard UI, see react-config-admin.admin / vue-config-admin.admin.",
       "package": "config"
     },
     "audit.trail": {
-      "description": "workspace-scoped audit log — who did what, compliance",
+      "description": "workspace-scoped audit log — who did what, compliance. One read-only route (GET /audit); no create/update/delete API since events are written internally by other modules. For a frontend log viewer, see react-audit.hooks / vue-audit.composables — session-authenticated like billing/workspaces, not the admin-token model courier-admin/config-admin use.",
       "package": "audit"
     },
     "rate-limit.throttle": {
@@ -67,7 +67,7 @@
       "package": "rate-limit"
     },
     "customers.crm": {
-      "description": "customer records / CRM tied to billing",
+      "description": "customer records / CRM tied to billing — session-authenticated like billing/workspaces/audit/webhooks (not the admin-token model courier-admin/config-admin use). Widest surface in the SDK: core customer CRUD + blacklist, plus emails/phones/addresses/notes/tags/relationships/labels sub-resources (35 routes). Only the label is editable on an existing email/phone/address, not the value — remove and re-add to change it. For a frontend customer manager, see react-customers.hooks / vue-customers.composables.",
       "package": "customers"
     },
     "core.app": {
@@ -77,6 +77,226 @@
     "store.database": {
       "description": "Postgres access and append-only migrations",
       "package": "store"
+    },
+    "react-auth.hooks": {
+      "description": "React hooks for auth — useLogin, useRegister, useSession, useLogout, useForgotPassword, useResetPassword, useVerifyEmail, wrapping @fonderie/client",
+      "package": "react-auth",
+      "recipe": "react-auth-wiring"
+    },
+    "react-auth.screens": {
+      "description": "pre-built React auth screens (LoginScreen, RegisterScreen, ForgotPasswordScreen) built on react-auth hooks — bring your own styling",
+      "package": "react-auth-screens",
+      "recipe": "react-auth-screens-wiring"
+    },
+    "react-native-auth.hooks": {
+      "description": "React Native hooks for auth — same shape as react-auth, token persisted to AsyncStorage instead of localStorage",
+      "package": "react-native-auth",
+      "recipe": "react-native-auth-wiring"
+    },
+    "react-native-auth.screens": {
+      "description": "pre-built React Native auth screens (LoginScreen, RegisterScreen, ForgotPasswordScreen) built on react-native-auth hooks",
+      "package": "react-native-auth-screens",
+      "recipe": "react-native-auth-screens-wiring"
+    },
+    "vue-auth.composables": {
+      "description": "Vue composables for auth — useLogin, useRegister, useSession, useLogout, useForgotPassword, useResetPassword, useVerifyEmail, wrapping @fonderie/client",
+      "package": "vue-auth",
+      "recipe": "vue-auth-wiring"
+    },
+    "vue-auth.screens": {
+      "description": "pre-built Vue auth screens (LoginScreen, RegisterScreen, ForgotPasswordScreen) built on vue-auth composables via Vue's h() render API",
+      "package": "vue-auth-screens",
+      "recipe": "vue-auth-screens-wiring"
+    },
+    "react-billing.hooks": {
+      "description": "React hooks for billing — usePlans, usePlan, useSubscription, useCheckout, useBillingPortal, useUsage, useRecordUsage, plus usePlanAdmin (create/update/delete plans) wrapping @fonderie/client's BillingClient. usePlanAdmin's routes are the one write surface in this SDK with no requireAuth/admin-token gate server-side — the app must authorize access to it itself before shipping any UI built on it.",
+      "package": "react-billing",
+      "recipe": "react-billing-wiring"
+    },
+    "react-billing.screens": {
+      "description": "pre-built React billing screens (PricingScreen, SubscriptionScreen) built on react-billing hooks — bring your own styling",
+      "package": "react-billing-screens",
+      "recipe": "react-billing-screens-wiring"
+    },
+    "react-native-billing.hooks": {
+      "description": "React Native billing hooks — re-exports react-billing wholesale (no platform-specific storage, unlike auth)",
+      "package": "react-native-billing",
+      "recipe": "react-native-billing-wiring"
+    },
+    "react-native-billing.screens": {
+      "description": "pre-built React Native billing screens (PricingScreen, SubscriptionScreen) built on react-native-billing hooks",
+      "package": "react-native-billing-screens",
+      "recipe": "react-native-billing-screens-wiring"
+    },
+    "vue-billing.composables": {
+      "description": "Vue composables for billing — usePlans, usePlan, useSubscription, useCheckout, useBillingPortal, useUsage, useRecordUsage, plus usePlanAdmin (create/update/delete plans) wrapping @fonderie/client's BillingClient. usePlanAdmin's routes are the one write surface in this SDK with no requireAuth/admin-token gate server-side — the app must authorize access to it itself before shipping any UI built on it.",
+      "package": "vue-billing",
+      "recipe": "vue-billing-wiring"
+    },
+    "vue-billing.screens": {
+      "description": "pre-built Vue billing screens (PricingScreen, SubscriptionScreen) built on vue-billing composables via Vue's h() render API",
+      "package": "vue-billing-screens",
+      "recipe": "vue-billing-screens-wiring"
+    },
+    "react-workspaces.hooks": {
+      "description": "React hooks for workspaces — useWorkspaces, useCreateWorkspace, useWorkspaceProfile (update/archive/restore the current workspace — action-only, no read hook since there's no 'get current workspace' route), useMembers, useRemoveMember, useInvitations, useAcceptInvitation, useWorkspaceSettings, plus role management (useRoles, useUpdateRole, useSetRolePermissions, useMemberRoles) — @fonderie/permissions has no HTTP API of its own, role CRUD lives here under @fonderie/workspaces' routes. Wraps @fonderie/client's WorkspacesClient.",
+      "package": "react-workspaces",
+      "recipe": "react-workspaces-wiring"
+    },
+    "react-workspaces.screens": {
+      "description": "pre-built React workspaces screens (TeamMembersScreen, InviteMembersScreen) built on react-workspaces hooks — bring your own styling",
+      "package": "react-workspaces-screens",
+      "recipe": "react-workspaces-screens-wiring"
+    },
+    "react-native-workspaces.hooks": {
+      "description": "React Native workspaces hooks — re-exports react-workspaces wholesale (no platform-specific storage, unlike auth)",
+      "package": "react-native-workspaces",
+      "recipe": "react-native-workspaces-wiring"
+    },
+    "react-native-workspaces.screens": {
+      "description": "pre-built React Native workspaces screens (TeamMembersScreen, InviteMembersScreen) built on react-native-workspaces hooks",
+      "package": "react-native-workspaces-screens",
+      "recipe": "react-native-workspaces-screens-wiring"
+    },
+    "vue-workspaces.composables": {
+      "description": "Vue composables for workspaces — useWorkspaces, useCreateWorkspace, useWorkspaceProfile (update/archive/restore the current workspace — action-only, no read composable since there's no 'get current workspace' route), useMembers, useRemoveMember, useInvitations, useAcceptInvitation, useWorkspaceSettings, plus role management (useRoles, useUpdateRole, useSetRolePermissions, useMemberRoles) — @fonderie/permissions has no HTTP API of its own, role CRUD lives here under @fonderie/workspaces' routes. Wraps @fonderie/client's WorkspacesClient.",
+      "package": "vue-workspaces",
+      "recipe": "vue-workspaces-wiring"
+    },
+    "vue-workspaces.screens": {
+      "description": "pre-built Vue workspaces screens (TeamMembersScreen, InviteMembersScreen) built on vue-workspaces composables via Vue's h() render API",
+      "package": "vue-workspaces-screens",
+      "recipe": "vue-workspaces-screens-wiring"
+    },
+    "react-courier-admin.templates": {
+      "description": "React hooks for courier's email/SMS/push template admin API — useTemplates, useTemplate, useSaveTemplate, useDeleteTemplate, useTemplateRevisions (list + rollback). Admin-token authenticated via a standalone CourierAdminClient — does NOT share FonderieClient's session token with auth/billing/workspaces.",
+      "package": "react-courier-admin",
+      "recipe": "react-courier-admin-wiring"
+    },
+    "react-courier-admin.screens": {
+      "description": "pre-built React screens (TemplateListScreen, TemplateEditorScreen with revision history + rollback) built on react-courier-admin hooks — an admin-dashboard surface, bring your own styling",
+      "package": "react-courier-admin-screens",
+      "recipe": "react-courier-admin-screens-wiring"
+    },
+    "vue-courier-admin.composables": {
+      "description": "Vue composables for courier's email/SMS/push template admin API — useTemplates, useTemplate, useSaveTemplate, useDeleteTemplate, useTemplateRevisions (list + rollback). Admin-token authenticated via a standalone CourierAdminClient — does NOT share FonderieClient's session token with auth/billing/workspaces.",
+      "package": "vue-courier-admin",
+      "recipe": "vue-courier-admin-wiring"
+    },
+    "vue-courier-admin.screens": {
+      "description": "pre-built Vue screens (TemplateListScreen, TemplateEditorScreen with revision history + rollback) built on vue-courier-admin composables via Vue's h() render API — an admin-dashboard surface",
+      "package": "vue-courier-admin-screens",
+      "recipe": "vue-courier-admin-screens-wiring"
+    },
+    "react-config-admin.admin": {
+      "description": "React hooks for config's feature-flag/remote-config + secrets admin API — useConfigEntries, useConfigEntry, useSaveConfigEntry, useDeleteConfigEntry, useConfigRevisions and the secret equivalents (useSecrets, useSecret, useSaveSecret, useDeleteSecret, useSecretRevisions) plus useRevealSecret. Admin-token authenticated via a standalone ConfigAdminClient — does NOT share FonderieClient's session token with auth/billing/workspaces.",
+      "package": "react-config-admin",
+      "recipe": "react-config-admin-wiring"
+    },
+    "react-config-admin.screens": {
+      "description": "pre-built React screens (ConfigListScreen: config + masked secrets dashboard; ConfigEditorScreen: JSON/secret editor with revision history + rollback) built on react-config-admin hooks — an admin-dashboard surface, bring your own styling",
+      "package": "react-config-admin-screens",
+      "recipe": "react-config-admin-screens-wiring"
+    },
+    "vue-config-admin.admin": {
+      "description": "Vue composables for config's feature-flag/remote-config + secrets admin API — same set as react-config-admin.admin. Admin-token authenticated via a standalone ConfigAdminClient — does NOT share FonderieClient's session token with auth/billing/workspaces.",
+      "package": "vue-config-admin",
+      "recipe": "vue-config-admin-wiring"
+    },
+    "vue-config-admin.screens": {
+      "description": "pre-built Vue screens (ConfigListScreen, ConfigEditorScreen) built on vue-config-admin composables via Vue's h() render API — an admin-dashboard surface",
+      "package": "vue-config-admin-screens",
+      "recipe": "vue-config-admin-screens-wiring"
+    },
+    "react-audit.hooks": {
+      "description": "React hook for the audit log — useAuditEvents, cursor-paginated with type/actorId/date-range filters and loadMore. Read-only (@fonderie/audit has one route); session-authenticated like billing/workspaces, wraps @fonderie/client's AuditClient.",
+      "package": "react-audit",
+      "recipe": "react-audit-wiring"
+    },
+    "react-audit.screens": {
+      "description": "pre-built React screen (AuditLogScreen: type/actor filters, expandable JSON payload, load-more) built on react-audit's useAuditEvents — bring your own styling",
+      "package": "react-audit-screens",
+      "recipe": "react-audit-screens-wiring"
+    },
+    "react-native-audit.hooks": {
+      "description": "React Native audit log hook — re-exports react-audit wholesale (no platform-specific storage, unlike auth)",
+      "package": "react-native-audit",
+      "recipe": "react-native-audit-wiring"
+    },
+    "react-native-audit.screens": {
+      "description": "pre-built React Native screen (AuditLogScreen) built on react-native-audit's useAuditEvents",
+      "package": "react-native-audit-screens",
+      "recipe": "react-native-audit-screens-wiring"
+    },
+    "vue-audit.composables": {
+      "description": "Vue composable for the audit log — useAuditEvents, cursor-paginated with type/actorId/date-range filters and loadMore. Read-only (@fonderie/audit has one route); session-authenticated like billing/workspaces, wraps @fonderie/client's AuditClient.",
+      "package": "vue-audit",
+      "recipe": "vue-audit-wiring"
+    },
+    "vue-audit.screens": {
+      "description": "pre-built Vue screen (AuditLogScreen) built on vue-audit's useAuditEvents via Vue's h() render API",
+      "package": "vue-audit-screens",
+      "recipe": "vue-audit-screens-wiring"
+    },
+    "react-webhooks.hooks": {
+      "description": "React hooks for webhook endpoints — useWebhookEndpoints (list/create/delete), useWebhookEndpoint (get/update), useWebhookDeliveries (delivery history), useTestWebhookEndpoint (send a test event). Session-authenticated like billing/workspaces/audit, wraps @fonderie/client's WebhooksClient. createEndpoint's signing secret is only returned once, at creation.",
+      "package": "react-webhooks",
+      "recipe": "react-webhooks-wiring"
+    },
+    "react-webhooks-screens.screens": {
+      "description": "pre-built React screens (WebhooksListScreen: create form + list + test/delete + one-time secret banner; WebhookDetailScreen: edit form + delivery history) built on react-webhooks' hooks — bring your own styling",
+      "package": "react-webhooks-screens",
+      "recipe": "react-webhooks-screens-wiring"
+    },
+    "react-native-webhooks.hooks": {
+      "description": "React Native webhook hooks — re-exports react-webhooks wholesale (no platform-specific storage, unlike auth)",
+      "package": "react-native-webhooks",
+      "recipe": "react-native-webhooks-wiring"
+    },
+    "react-native-webhooks-screens.screens": {
+      "description": "pre-built React Native screens (WebhooksListScreen, WebhookDetailScreen) built on react-native-webhooks' hooks, using FlatList/TextInput/TouchableOpacity",
+      "package": "react-native-webhooks-screens",
+      "recipe": "react-native-webhooks-screens-wiring"
+    },
+    "vue-webhooks.composables": {
+      "description": "Vue composables for webhook endpoints — useWebhookEndpoints, useWebhookEndpoint, useWebhookDeliveries, useTestWebhookEndpoint. Session-authenticated like billing/workspaces/audit, wraps @fonderie/client's WebhooksClient. Endpoint IDs are read once at setup; call refresh() after changing them.",
+      "package": "vue-webhooks",
+      "recipe": "vue-webhooks-wiring"
+    },
+    "vue-webhooks-screens.screens": {
+      "description": "pre-built Vue screens (WebhooksListScreen, WebhookDetailScreen) built on vue-webhooks' composables via Vue's h() render API, emitting select-endpoint / navigate-list",
+      "package": "vue-webhooks-screens",
+      "recipe": "vue-webhooks-screens-wiring"
+    },
+    "react-customers.hooks": {
+      "description": "React hooks for customers — useCustomers (list/create/delete/blacklist), useCustomer (get/update), plus one combined hook per sub-resource: useCustomerEmails, useCustomerPhones, useCustomerAddresses, useCustomerNotes, useCustomerTags, useCustomerRelationships, useCustomerLabels. Session-authenticated like billing/workspaces/audit/webhooks, wraps @fonderie/client's CustomersClient. Only the label is editable on an existing email/phone/address, not the value.",
+      "package": "react-customers",
+      "recipe": "react-customers-wiring"
+    },
+    "react-customers-screens.screens": {
+      "description": "pre-built React screens (CustomersListScreen: search + create + blacklist badge; CustomerDetailScreen: profile edit + inline emails/phones/tags/notes) built on react-customers' hooks — relationships and label vocabulary aren't covered, use the hooks directly for those",
+      "package": "react-customers-screens",
+      "recipe": "react-customers-screens-wiring"
+    },
+    "react-native-customers.hooks": {
+      "description": "React Native customer hooks — re-exports react-customers wholesale (no platform-specific storage, unlike auth)",
+      "package": "react-native-customers",
+      "recipe": "react-native-customers-wiring"
+    },
+    "react-native-customers-screens.screens": {
+      "description": "pre-built React Native screens (CustomersListScreen, CustomerDetailScreen) built on react-native-customers' hooks, using FlatList/TextInput/TouchableOpacity",
+      "package": "react-native-customers-screens",
+      "recipe": "react-native-customers-screens-wiring"
+    },
+    "vue-customers.composables": {
+      "description": "Vue composables for customers — useCustomers, useCustomer, plus one combined composable per sub-resource: useCustomerEmails, useCustomerPhones, useCustomerAddresses, useCustomerNotes, useCustomerTags, useCustomerRelationships, useCustomerLabels. Session-authenticated like billing/workspaces/audit/webhooks, wraps @fonderie/client's CustomersClient.",
+      "package": "vue-customers",
+      "recipe": "vue-customers-wiring"
+    },
+    "vue-customers-screens.screens": {
+      "description": "pre-built Vue screens (CustomersListScreen, CustomerDetailScreen) built on vue-customers' composables via Vue's h() render API, emitting select-customer / navigate-list",
+      "package": "vue-customers-screens",
+      "recipe": "vue-customers-screens-wiring"
     }
   },
   "recipes": {
@@ -198,6 +418,528 @@
         "webhook-route-before-auth-mw",
         "rate-limit-default-on"
       ]
+    },
+    "react-auth-wiring": {
+      "when": "adding auth to a React web app",
+      "packages": [
+        "client",
+        "react-auth"
+      ],
+      "invariants": [
+        "frontend-client-injection",
+        "frontend-token-storage"
+      ]
+    },
+    "react-auth-screens-wiring": {
+      "when": "adding auth to a React web app with pre-built UI, not just hooks",
+      "packages": [
+        "client",
+        "react-auth",
+        "react-auth-screens"
+      ],
+      "invariants": [
+        "frontend-client-injection",
+        "frontend-token-storage"
+      ]
+    },
+    "react-native-auth-wiring": {
+      "when": "adding auth to a React Native app",
+      "packages": [
+        "client",
+        "react-native-auth"
+      ],
+      "invariants": [
+        "frontend-client-injection",
+        "frontend-token-storage"
+      ]
+    },
+    "react-native-auth-screens-wiring": {
+      "when": "adding auth to a React Native app with pre-built UI, not just hooks",
+      "packages": [
+        "client",
+        "react-native-auth",
+        "react-native-auth-screens"
+      ],
+      "invariants": [
+        "frontend-client-injection",
+        "frontend-token-storage"
+      ]
+    },
+    "vue-auth-wiring": {
+      "when": "adding auth to a Vue 3 app",
+      "packages": [
+        "client",
+        "vue-auth"
+      ],
+      "invariants": [
+        "frontend-client-injection",
+        "frontend-token-storage"
+      ]
+    },
+    "vue-auth-screens-wiring": {
+      "when": "adding auth to a Vue 3 app with pre-built UI, not just composables",
+      "packages": [
+        "client",
+        "vue-auth",
+        "vue-auth-screens"
+      ],
+      "invariants": [
+        "frontend-client-injection",
+        "frontend-token-storage"
+      ]
+    },
+    "react-billing-wiring": {
+      "when": "adding billing/pricing/checkout to a React web app",
+      "packages": [
+        "client",
+        "react-billing"
+      ],
+      "invariants": [
+        "frontend-client-injection",
+        "frontend-shared-token"
+      ]
+    },
+    "react-billing-screens-wiring": {
+      "when": "adding billing to a React web app with pre-built UI, not just hooks",
+      "packages": [
+        "client",
+        "react-billing",
+        "react-billing-screens"
+      ],
+      "invariants": [
+        "frontend-client-injection",
+        "frontend-shared-token"
+      ]
+    },
+    "react-native-billing-wiring": {
+      "when": "adding billing/pricing/checkout to a React Native app",
+      "packages": [
+        "client",
+        "react-native-billing"
+      ],
+      "invariants": [
+        "frontend-client-injection",
+        "frontend-shared-token"
+      ]
+    },
+    "react-native-billing-screens-wiring": {
+      "when": "adding billing to a React Native app with pre-built UI, not just hooks",
+      "packages": [
+        "client",
+        "react-native-billing",
+        "react-native-billing-screens"
+      ],
+      "invariants": [
+        "frontend-client-injection",
+        "frontend-shared-token"
+      ]
+    },
+    "vue-billing-wiring": {
+      "when": "adding billing/pricing/checkout to a Vue 3 app",
+      "packages": [
+        "client",
+        "vue-billing"
+      ],
+      "invariants": [
+        "frontend-client-injection",
+        "frontend-shared-token"
+      ]
+    },
+    "vue-billing-screens-wiring": {
+      "when": "adding billing to a Vue 3 app with pre-built UI, not just composables",
+      "packages": [
+        "client",
+        "vue-billing",
+        "vue-billing-screens"
+      ],
+      "invariants": [
+        "frontend-client-injection",
+        "frontend-shared-token"
+      ]
+    },
+    "react-workspaces-wiring": {
+      "when": "adding teams/workspaces UI to a React web app",
+      "packages": [
+        "client",
+        "react-workspaces"
+      ],
+      "invariants": [
+        "frontend-client-injection",
+        "frontend-shared-token",
+        "frontend-workspace-scoping"
+      ]
+    },
+    "react-workspaces-screens-wiring": {
+      "when": "adding teams/workspaces to a React web app with pre-built UI, not just hooks",
+      "packages": [
+        "client",
+        "react-workspaces",
+        "react-workspaces-screens"
+      ],
+      "invariants": [
+        "frontend-client-injection",
+        "frontend-shared-token",
+        "frontend-workspace-scoping"
+      ]
+    },
+    "react-native-workspaces-wiring": {
+      "when": "adding teams/workspaces UI to a React Native app",
+      "packages": [
+        "client",
+        "react-native-workspaces"
+      ],
+      "invariants": [
+        "frontend-client-injection",
+        "frontend-shared-token",
+        "frontend-workspace-scoping"
+      ]
+    },
+    "react-native-workspaces-screens-wiring": {
+      "when": "adding teams/workspaces to a React Native app with pre-built UI, not just hooks",
+      "packages": [
+        "client",
+        "react-native-workspaces",
+        "react-native-workspaces-screens"
+      ],
+      "invariants": [
+        "frontend-client-injection",
+        "frontend-shared-token",
+        "frontend-workspace-scoping"
+      ]
+    },
+    "vue-workspaces-wiring": {
+      "when": "adding teams/workspaces UI to a Vue 3 app",
+      "packages": [
+        "client",
+        "vue-workspaces"
+      ],
+      "invariants": [
+        "frontend-client-injection",
+        "frontend-shared-token",
+        "frontend-workspace-scoping"
+      ]
+    },
+    "vue-workspaces-screens-wiring": {
+      "when": "adding teams/workspaces to a Vue 3 app with pre-built UI, not just composables",
+      "packages": [
+        "client",
+        "vue-workspaces",
+        "vue-workspaces-screens"
+      ],
+      "invariants": [
+        "frontend-client-injection",
+        "frontend-shared-token",
+        "frontend-workspace-scoping"
+      ]
+    },
+    "react-courier-admin-wiring": {
+      "when": "building an admin dashboard to edit courier's email/SMS/push templates in React",
+      "packages": [
+        "client",
+        "react-courier-admin"
+      ],
+      "invariants": [
+        "frontend-admin-token"
+      ]
+    },
+    "react-courier-admin-screens-wiring": {
+      "when": "building an admin dashboard for courier templates in React with pre-built UI, not just hooks",
+      "packages": [
+        "client",
+        "react-courier-admin",
+        "react-courier-admin-screens"
+      ],
+      "invariants": [
+        "frontend-admin-token"
+      ]
+    },
+    "vue-courier-admin-wiring": {
+      "when": "building an admin dashboard to edit courier's email/SMS/push templates in Vue 3",
+      "packages": [
+        "client",
+        "vue-courier-admin"
+      ],
+      "invariants": [
+        "frontend-admin-token"
+      ]
+    },
+    "vue-courier-admin-screens-wiring": {
+      "when": "building an admin dashboard for courier templates in Vue 3 with pre-built UI, not just composables",
+      "packages": [
+        "client",
+        "vue-courier-admin",
+        "vue-courier-admin-screens"
+      ],
+      "invariants": [
+        "frontend-admin-token"
+      ]
+    },
+    "react-config-admin-wiring": {
+      "when": "building an admin dashboard to manage feature flags/remote config and secrets in React",
+      "packages": [
+        "client",
+        "react-config-admin"
+      ],
+      "invariants": [
+        "frontend-admin-token"
+      ]
+    },
+    "react-config-admin-screens-wiring": {
+      "when": "building a config/secrets admin dashboard in React with pre-built UI, not just hooks",
+      "packages": [
+        "client",
+        "react-config-admin",
+        "react-config-admin-screens"
+      ],
+      "invariants": [
+        "frontend-admin-token"
+      ]
+    },
+    "vue-config-admin-wiring": {
+      "when": "building an admin dashboard to manage feature flags/remote config and secrets in Vue 3",
+      "packages": [
+        "client",
+        "vue-config-admin"
+      ],
+      "invariants": [
+        "frontend-admin-token"
+      ]
+    },
+    "vue-config-admin-screens-wiring": {
+      "when": "building a config/secrets admin dashboard in Vue 3 with pre-built UI, not just composables",
+      "packages": [
+        "client",
+        "vue-config-admin",
+        "vue-config-admin-screens"
+      ],
+      "invariants": [
+        "frontend-admin-token"
+      ]
+    },
+    "react-audit-wiring": {
+      "when": "showing an audit/activity log in a React web app",
+      "packages": [
+        "client",
+        "react-audit"
+      ],
+      "invariants": [
+        "frontend-client-injection",
+        "frontend-shared-token",
+        "frontend-workspace-scoping"
+      ]
+    },
+    "react-audit-screens-wiring": {
+      "when": "showing an audit/activity log in a React web app with pre-built UI, not just the hook",
+      "packages": [
+        "client",
+        "react-audit",
+        "react-audit-screens"
+      ],
+      "invariants": [
+        "frontend-client-injection",
+        "frontend-shared-token",
+        "frontend-workspace-scoping"
+      ]
+    },
+    "react-native-audit-wiring": {
+      "when": "showing an audit/activity log in a React Native app",
+      "packages": [
+        "client",
+        "react-native-audit"
+      ],
+      "invariants": [
+        "frontend-client-injection",
+        "frontend-shared-token",
+        "frontend-workspace-scoping"
+      ]
+    },
+    "react-native-audit-screens-wiring": {
+      "when": "showing an audit/activity log in a React Native app with pre-built UI, not just the hook",
+      "packages": [
+        "client",
+        "react-native-audit",
+        "react-native-audit-screens"
+      ],
+      "invariants": [
+        "frontend-client-injection",
+        "frontend-shared-token",
+        "frontend-workspace-scoping"
+      ]
+    },
+    "vue-audit-wiring": {
+      "when": "showing an audit/activity log in a Vue 3 app",
+      "packages": [
+        "client",
+        "vue-audit"
+      ],
+      "invariants": [
+        "frontend-client-injection",
+        "frontend-shared-token",
+        "frontend-workspace-scoping"
+      ]
+    },
+    "vue-audit-screens-wiring": {
+      "when": "showing an audit/activity log in a Vue 3 app with pre-built UI, not just the composable",
+      "packages": [
+        "client",
+        "vue-audit",
+        "vue-audit-screens"
+      ],
+      "invariants": [
+        "frontend-client-injection",
+        "frontend-shared-token",
+        "frontend-workspace-scoping"
+      ]
+    },
+    "react-webhooks-wiring": {
+      "when": "managing webhook endpoints in a React web app",
+      "packages": [
+        "client",
+        "react-webhooks"
+      ],
+      "invariants": [
+        "frontend-client-injection",
+        "frontend-shared-token",
+        "frontend-workspace-scoping"
+      ]
+    },
+    "react-webhooks-screens-wiring": {
+      "when": "managing webhook endpoints in a React web app with pre-built UI, not just the hooks",
+      "packages": [
+        "client",
+        "react-webhooks",
+        "react-webhooks-screens"
+      ],
+      "invariants": [
+        "frontend-client-injection",
+        "frontend-shared-token",
+        "frontend-workspace-scoping"
+      ]
+    },
+    "react-native-webhooks-wiring": {
+      "when": "managing webhook endpoints in a React Native app",
+      "packages": [
+        "client",
+        "react-native-webhooks"
+      ],
+      "invariants": [
+        "frontend-client-injection",
+        "frontend-shared-token",
+        "frontend-workspace-scoping"
+      ]
+    },
+    "react-native-webhooks-screens-wiring": {
+      "when": "managing webhook endpoints in a React Native app with pre-built UI, not just the hooks",
+      "packages": [
+        "client",
+        "react-native-webhooks",
+        "react-native-webhooks-screens"
+      ],
+      "invariants": [
+        "frontend-client-injection",
+        "frontend-shared-token",
+        "frontend-workspace-scoping"
+      ]
+    },
+    "vue-webhooks-wiring": {
+      "when": "managing webhook endpoints in a Vue 3 app",
+      "packages": [
+        "client",
+        "vue-webhooks"
+      ],
+      "invariants": [
+        "frontend-client-injection",
+        "frontend-shared-token",
+        "frontend-workspace-scoping"
+      ]
+    },
+    "vue-webhooks-screens-wiring": {
+      "when": "managing webhook endpoints in a Vue 3 app with pre-built UI, not just the composables",
+      "packages": [
+        "client",
+        "vue-webhooks",
+        "vue-webhooks-screens"
+      ],
+      "invariants": [
+        "frontend-client-injection",
+        "frontend-shared-token",
+        "frontend-workspace-scoping"
+      ]
+    },
+    "react-customers-wiring": {
+      "when": "managing customers/CRM records in a React web app",
+      "packages": [
+        "client",
+        "react-customers"
+      ],
+      "invariants": [
+        "frontend-client-injection",
+        "frontend-shared-token",
+        "frontend-workspace-scoping"
+      ]
+    },
+    "react-customers-screens-wiring": {
+      "when": "managing customers/CRM records in a React web app with pre-built UI, not just the hooks",
+      "packages": [
+        "client",
+        "react-customers",
+        "react-customers-screens"
+      ],
+      "invariants": [
+        "frontend-client-injection",
+        "frontend-shared-token",
+        "frontend-workspace-scoping"
+      ]
+    },
+    "react-native-customers-wiring": {
+      "when": "managing customers/CRM records in a React Native app",
+      "packages": [
+        "client",
+        "react-native-customers"
+      ],
+      "invariants": [
+        "frontend-client-injection",
+        "frontend-shared-token",
+        "frontend-workspace-scoping"
+      ]
+    },
+    "react-native-customers-screens-wiring": {
+      "when": "managing customers/CRM records in a React Native app with pre-built UI, not just the hooks",
+      "packages": [
+        "client",
+        "react-native-customers",
+        "react-native-customers-screens"
+      ],
+      "invariants": [
+        "frontend-client-injection",
+        "frontend-shared-token",
+        "frontend-workspace-scoping"
+      ]
+    },
+    "vue-customers-wiring": {
+      "when": "managing customers/CRM records in a Vue 3 app",
+      "packages": [
+        "client",
+        "vue-customers"
+      ],
+      "invariants": [
+        "frontend-client-injection",
+        "frontend-shared-token",
+        "frontend-workspace-scoping"
+      ]
+    },
+    "vue-customers-screens-wiring": {
+      "when": "managing customers/CRM records in a Vue 3 app with pre-built UI, not just the composables",
+      "packages": [
+        "client",
+        "vue-customers",
+        "vue-customers-screens"
+      ],
+      "invariants": [
+        "frontend-client-injection",
+        "frontend-shared-token",
+        "frontend-workspace-scoping"
+      ]
     }
   },
   "invariants": {
@@ -206,6 +948,12 @@
     "logout-provided": "@fonderie/auth mounts POST /auth/logout with session invalidation — do not hand-roll stateless-JWT logout.",
     "webhook-route-before-auth-mw": "Register the billing/Stripe webhook route before global auth middleware so signature-verified callbacks are not rejected as unauthenticated.",
     "workspaces-requires-billing": "@fonderie/workspaces peer-depends on @fonderie/billing; register billing before workspaces.",
-    "email-provider-default": "Do NOT stop to ask which email provider to use. Default to SMTP via CourierModule's SMTP channel, configured from process.env (SMTP_URL or SMTP_HOST/PORT/USER/PASS), fail-fast if missing. Note the choice in a comment; the operator can swap providers later. Picking a sensible default and proceeding is required — a blocked task is a failed task."
+    "email-provider-default": "Do NOT stop to ask which email provider to use. Default to SMTP via CourierModule's SMTP channel, configured from process.env (SMTP_URL or SMTP_HOST/PORT/USER/PASS), fail-fast if missing. Note the choice in a comment; the operator can swap providers later. Picking a sensible default and proceeding is required — a blocked task is a failed task.",
+    "frontend-client-injection": "Every @fonderie/*-auth, @fonderie/*-billing, @fonderie/*-workspaces, @fonderie/*-audit, @fonderie/*-webhooks, and @fonderie/*-customers hook/composable takes the matching @fonderie/client sub-client instance (client.auth, client.billing, client.workspaces, client.audit, client.webhooks, or client.customers) as an argument — instantiate one @fonderie/client FonderieClient at the app root and pass the sub-client down (React context, Vue provide/inject, or a prop), do not construct a new client per hook call.",
+    "frontend-token-storage": "The access token is persisted client-side by the auth hook/composable itself on login/register and restored on mount (localStorage for react-auth and vue-auth, AsyncStorage for react-native-auth) — do not re-implement token persistence in app code, and do not read/write that storage key directly.",
+    "frontend-shared-token": "client.auth, client.billing, client.workspaces, client.audit, client.webhooks, and client.customers share one TokenStore inside FonderieClient — signing in via a *-auth package's useLogin/useRegister automatically authenticates client.billing/client.workspaces/client.audit/client.webhooks/client.customers requests too. Do not call setAccessToken on those sub-clients yourself or construct one outside FonderieClient.",
+    "frontend-workspace-scoping": "@fonderie/*-workspaces, @fonderie/*-billing, @fonderie/*-audit, @fonderie/*-webhooks, and @fonderie/*-customers requests are scoped to a team via client.workspaces.setWorkspaceId(id) / client.billing.setWorkspaceId(id) / client.audit.setWorkspaceId(id) / client.webhooks.setWorkspaceId(id) / client.customers.setWorkspaceId(id) — all five fall back to the caller's personal workspace when unset (same X-Workspace-ID header, same server-side fallback pattern in @fonderie/workspaces' withWorkspace, @fonderie/billing's resolveSubscriber, @fonderie/audit's route handler, @fonderie/webhooks' route handler, and @fonderie/customers' route handler). Do not thread a workspace id through individual hook calls.",
+    "frontend-admin-token": "@fonderie/*-courier-admin and @fonderie/*-config-admin hooks/composables take a CourierAdminClient or ConfigAdminClient, each constructed standalone with { baseUrl, adminToken } — NOT a sub-client of FonderieClient, and NOT covered by frontend-client-injection/frontend-shared-token. Each authenticates with its own server-configured static admin bearer token (CourierModule's / ConfigModule's adminToken config), not the signed-in user's session, and the two do not share a token with each other either. Never expose an admin token to a general end-user build; these clients are for an internal/admin-only app.",
+    "party-model": "Three distinct parties — never conflate them. A USER is the authenticated principal (@fonderie/auth, table fonderie_users, resolved to ctx.user by requireAuth). A MEMBER is a user's membership in a workspace/team (@fonderie/workspaces — where multi-tenancy and roles live). A CUSTOMER is a CRM record of someone the USER'S BUSINESS serves (@fonderie/customers, workspace-scoped); it never logs in and is never billed. Logins are users, tenancy is members, CRM records are customers. See docs/ARCHITECTURE.md."
   }
 }

package/package.json

@@ -1,9 +1,9 @@
 {
 	"name": "@fonderie/cli",
-	"version": "0.3.0",
+	"version": "0.4.0",
 	"description": "The Fonderie CLI — teaches any coding agent the SDK without loading it eagerly. `fonderie skill` writes a lazy skill (a small router + per-package bodies read on demand); `fonderie query` answers what to install for a capability. Zero deps, runs anywhere.",
 	"keywords": [
-		"fonderie-js",
+		"fonderiejs",
 		"cli",
 		"skill",
 		"ai-agent",
@@ -33,11 +33,11 @@
 	},
 	"repository": {
 		"type": "git",
-		"url": "git+https://github.com/fonderiejs/sdk.git",
+		"url": "git+https://github.com/fonderiejs/fonderie.git",
 		"directory": "packages/cli"
 	},
-	"homepage": "https://github.com/fonderiejs/sdk/tree/main/packages/cli#readme",
+	"homepage": "https://github.com/fonderiejs/fonderie/tree/main/packages/cli#readme",
 	"bugs": {
-		"url": "https://github.com/fonderiejs/sdk/issues"
+		"url": "https://github.com/fonderiejs/fonderie/issues"
 	}
 }