@tsfpp/agents 1.0.3 → 1.1.1

package/CHANGELOG.md

@@ -10,6 +10,24 @@ Versioning follows [Semantic Versioning](https://semver.org/).
 
 ## [Unreleased]
 
+## [1.1.1] - 2026-05-16
+
+### Added
+
+- Added bootstrap shell script at `bin/bootstrap.sh`.
+- Exposed bootstrap command in package metadata via `tsfpp-bootstrap`.
+
+## [1.1.0] - 2026-05-16
+
+### Added
+
+- Updated `init.mjs` to deploy Copilot reusable skills into `.github/skills/`.
+- Added Copilot reusable skills to installer output:
+  - `copilot/skills/coding-standard/SKILL.md`
+  - `copilot/skills/prelude-api/SKILL.md`
+  - `copilot/skills/boundary-api/SKILL.md`
+  - `copilot/skills/react-coding-standard/SKILL.md`
+
 ## [1.0.3] - 2026-05-16
 
 ### Changed

package/README.md

@@ -50,6 +50,11 @@ node node_modules/@tsfpp/agents/init.mjs
   prompts/
     tsfpp-new-module.prompt.md
     tsfpp-boundary-review.prompt.md
+  skills/
+    coding-standard/SKILL.md
+    prelude-api/SKILL.md
+    boundary-api/SKILL.md
+    react-coding-standard/SKILL.md
 .claude/
   CLAUDE.md                          ← Claude Code project context
 ```

package/bin/bootstrap.sh

@@ -0,0 +1,103 @@
+#!/usr/bin/env bash
+# tsfpp-bootstrap.sh — spin up a TSF++ sandbox in the current directory
+# Usage: bash tsfpp-bootstrap.sh [project-name]
+# If no name is given, the current directory is used as-is.
+
+set -euo pipefail
+
+# ── Colours ───────────────────────────────────────────────────────────────────
+
+GREEN='\033[0;32m'
+DIM='\033[2m'
+RESET='\033[0m'
+
+ok()  { echo -e "${GREEN}✓${RESET} $1"; }
+dim() { echo -e "${DIM}$1${RESET}"; }
+
+# ── Project directory ─────────────────────────────────────────────────────────
+
+PROJECT_NAME="${1:-}"
+
+if [[ -n "$PROJECT_NAME" ]]; then
+  mkdir -p "$PROJECT_NAME"
+  cd "$PROJECT_NAME"
+  ok "Created directory: $PROJECT_NAME"
+fi
+
+# ── 1. pnpm init ──────────────────────────────────────────────────────────────
+
+dim "Initialising package.json…"
+pnpm init --yes > /dev/null
+ok "pnpm init"
+
+# ── 2. Install TSF++ ecosystem ────────────────────────────────────────────────
+
+dim "Installing TSF++ packages (this may take a moment)…"
+pnpm add -D \
+  typescript \
+  @tsfpp/standard \
+  @tsfpp/tsconfig \
+  @tsfpp/eslint-config \
+  @tsfpp/prelude \
+  @tsfpp/boundary \
+  @tsfpp/agents
+ok "Installed TSF++ ecosystem"
+
+# ── 3. tsconfig.json ──────────────────────────────────────────────────────────
+
+dim "Writing tsconfig.json…"
+cat > tsconfig.json << 'EOF'
+{
+  "extends": "@tsfpp/tsconfig/app",
+  "compilerOptions": {
+    "rootDir": "src"
+  },
+  "include": ["src"]
+}
+EOF
+ok "tsconfig.json"
+
+# ── 4. eslint.config.js ───────────────────────────────────────────────────────
+
+dim "Writing eslint.config.js…"
+cat > eslint.config.js << 'EOF'
+import tsfpp from '@tsfpp/eslint-config'
+export default tsfpp
+EOF
+ok "eslint.config.js"
+
+# ── 5. package.json — type + scripts ─────────────────────────────────────────
+
+dim "Patching package.json…"
+npm pkg set type="module"                           --silent
+npm pkg set scripts.typecheck="tsc --noEmit"        --silent
+npm pkg set scripts.lint="eslint src"               --silent
+npm pkg set scripts.check="pnpm typecheck && pnpm lint" --silent
+ok "package.json scripts"
+
+# ── 6. src/index.ts ───────────────────────────────────────────────────────────
+
+dim "Creating src/index.ts…"
+mkdir -p src
+cat > src/index.ts << 'EOF'
+// TSF++ sandbox — start here
+// Import from @tsfpp/prelude to explore ADTs and combinators:
+//
+// import { ok, err, some, none, pipe, absurd } from '@tsfpp/prelude'
+EOF
+ok "src/index.ts"
+
+# ── 7. Copilot agents (.github) ───────────────────────────────────────────────
+
+dim "Installing Copilot agents…"
+node node_modules/@tsfpp/agents/init.mjs
+ok "Copilot agents installed"
+
+# ── 8. Done ───────────────────────────────────────────────────────────────────
+
+echo ""
+echo -e "${GREEN}TSF++ sandbox ready.${RESET}"
+echo ""
+echo "  pnpm check     — typecheck + lint"
+echo "  code .         — open in VS Code"
+echo ""

package/copilot/agents/tsfpp-audit.agent.md

@@ -132,7 +132,8 @@ Append each completed slice to the report:
 - [x] 5.1 — Pipelines via `pipe` from prelude
 - [x] 6.x — No `throw` in core
 - [x] 7.x — JSDoc on all exports
-- [x] 9.x — No direct `ramda` import
+- [x] 8.x — Prefer prelude ADTs/constructors/helpers (no downstream reimplementation in domain code)
+- [x] 9.x — Dependency hygiene (no deprecated dependencies, no banned imports per policy, no layer-violating imports)
 
 #### Deviation register
 
@@ -146,10 +147,10 @@ Append each completed slice to the report:
 ## Focus-specific rule sets
 
 ### `types`
-1.4 (no bare interface) · 1.5 (no `any`) · 1.6 (no `!` or `as`) · 3.x (readonly) · branded types on domain primitives · smart constructor completeness · exhaustive sum-type dispatch
+1.4 (no bare interface) · 1.5 (no `any`) · 1.6 (no `!` or `as`) · 3.x (readonly) · branded types on domain primitives · smart constructor completeness · exhaustive sum-type dispatch · prelude ADT/constructor/helper reuse (no downstream reimplementation)
 
 ### `boundary`
-API_CODING_STANDARD.md Rules 1–5 · Zod schema completeness · Result/Option at I/O · `extractContext` usage · `apiErrorToResponse` coverage · no raw `throw` across boundaries · `@tsfpp/boundary` response builders used
+API_CODING_STANDARD.md Rules 1–5 · Zod schema completeness · Result/Option at I/O · `extractContext` usage · `apiErrorToResponse` coverage · no raw `throw` across boundaries · `@tsfpp/boundary` response builders used · avoid boundary-local ADT/helper reinvention when prelude equivalents exist
 
 ### `complexity`
 Function body ≤ 40 lines · cyclomatic complexity ≤ 10 · nesting ≤ 4 · arity ≤ 3 positional params · pipeline depth ≤ 8 stages

package/copilot/skills/boundary-api/SKILL.md

@@ -0,0 +1,232 @@
+---
+name: boundary-api
+description: >
+  Complete API surface of @tsfpp/boundary: typed request context, RFC 9457 error
+  responses, ApiError taxonomy, response builders, cursor pagination, long-running
+  operations, bulk operations, idempotency, observability middleware, webhook
+  signing, rate-limit headers, CORS, and cache policy. Load when writing or
+  reviewing any HTTP handler that imports from @tsfpp/boundary, or when choosing
+  between response builders, error mappers, or middleware composition patterns.
+---
+
+# @tsfpp/boundary API
+
+Framework-agnostic Fetch API primitives. One peer dependency: `@tsfpp/prelude`.
+`kind` is the discriminant for all ADTs in this module.
+
+## Import path
+
+```ts
+import { extractContext, apiErrorToResponse, ... } from '@tsfpp/boundary';
+```
+
+---
+
+## Core exports by group
+
+### Branded primitives
+
+| Type | Smart constructor | Constraint |
+|---|---|---|
+| `TraceId` | `mkTraceId(raw)` → `Option<TraceId>` | any non-empty string |
+| `PrincipalId` | `mkPrincipalId(raw)` → `Option<PrincipalId>` | any non-empty string |
+| `Cursor` | internal — use `encodeCursor` | never construct directly |
+| `IdempotencyKey` | `mkIdempotencyKey(raw)` → `Option<IdempotencyKey>` | `[A-Za-z0-9_-]{1,255}` |
+| `WebhookEventId` | `mkWebhookEventId(raw)` → `Option<WebhookEventId>` | any non-empty string |
+
+### Request context
+
+| Export | Description |
+|---|---|
+| `RequestContext` | `{ traceId, principalId: Option<PrincipalId>, idempotencyKey: Option<IdempotencyKey>, method, url, routeTemplate }` |
+| `extractContext(req, routeTemplate)` | Call at the top of every handler. Reads `traceparent` / `x-request-id` / `x-trace-id`; generates UUID fallback. `routeTemplate` must be the parameterised path (`/v1/tracks/:id`), never the resolved URL. |
+| `extractTraceId(req)` | Reads trace headers only; generates UUID fallback. |
+
+### Validation
+
+| Export | Description |
+|---|---|
+| `ValidationError` | `{ kind: 'validation'; message: string; issues: ReadonlyArray<FieldIssue> }` |
+| `FieldIssue` | `{ field: string; message: string }` |
+| `fromZodError(zodError)` | Lifts a `ZodError` into a `ValidationError`. Use after `safeParse`. |
+| `mkValidationError(message, issues?)` | Manual construction for non-Zod sources. |
+
+### `ApiError` taxonomy
+
+Discriminated union on `kind`. Pass to `apiErrorToResponse`; never construct `ProblemDetails` manually for these variants.
+
+| `kind` | Extra fields | HTTP |
+|---|---|---|
+| `validation` | `message`, `issues: ReadonlyArray<FieldIssue>` | 422 |
+| `not_found` | `resource: string`, `id: string` | 404 |
+| `conflict` | `detail: string` | 409 |
+| `permission` | `required: string` | 403 |
+| `unauthenticated` | — | 401 + `WWW-Authenticate` |
+| `rate_limit` | `retryAfterSeconds?: number` | 429 + `Retry-After` |
+| `precondition` | `detail: string` | 412 |
+| `gone` | `resource: string` | 410 |
+| `dependency` | `dependency: string`, `cause: unknown` | 502 — **log `cause` before calling mapper** |
+| `internal` | `cause: unknown` | 500 — **log `cause` before calling mapper** |
+
+### Problem Details (RFC 9457)
+
+| Export | Description |
+|---|---|
+| `ProblemDetails` | `{ type, title, status, code, detail?, instance?, traceId, errors? }` |
+| `mkProblem(status, code, title, traceId, opts?)` | Constructs a `ProblemDetails`. `type` defaults to `'about:blank'`. |
+| `problemResponse(problem, headers?)` | `Response` with `Content-Type: application/problem+json`. |
+
+### Response builders
+
+| Export | Status | Notes |
+|---|---|---|
+| `okResponse(body, headers?)` | 200 | |
+| `createdResponse(body, location, headers?)` | 201 | Sets `Location` header |
+| `acceptedResponse(operation, location, headers?)` | 202 | LRO — sets `Location` header |
+| `noContentResponse(headers?)` | 204 | No body — use after mutations with no return value |
+| `redirectResponse(status, location, headers?)` | 301/302/307/308 | Prefer 308 over 301, 307 over 302 |
+| `jsonResponse(status, body, headers?)` | any | Fallback when the above don't fit |
+
+### Error mapping
+
+| Export | Description |
+|---|---|
+| `apiErrorToProblem(error, ctx)` | `ApiError` → `ProblemDetails`. Exhaustive; never leaks `cause`. |
+| `apiErrorToResponse(error, ctx)` | `ApiError` → `Response`. Adds `WWW-Authenticate` on `unauthenticated`, `Retry-After` on `rate_limit`. **Prefer this over manual `problemResponse`**. |
+| `ErrorMapper<E>` | `(error: E, ctx: RequestContext) => Response` — implement for app-specific variants; delegate canonical variants to `apiErrorToResponse`. |
+
+### Pagination
+
+| Export | Description |
+|---|---|
+| `Paginated<T>` | `{ items: ReadonlyArray<T>; nextCursor: Cursor \| null; totalCount: number \| null }` |
+| `PageQuery` | `{ limit: number; cursor: Cursor \| null }` |
+| `mkPaginated(items, nextCursor, totalCount?)` | Constructs a `Paginated<T>` body. `totalCount` — return `null` unless precomputed. |
+| `parsePaginationQuery(url, maxLimit?)` | Validates `limit` and `cursor` from URL query string → `Result<PageQuery, ValidationError>` |
+| `encodeCursor(payload)` | Record → opaque `Cursor` (base64url) |
+| `decodeCursor(cursor)` | `Cursor` → `Option<Record<string, unknown>>` |
+
+### Long-running operations
+
+`Operation<T>` is a discriminated union on `kind`: `running | succeeded | failed | cancelled`.
+
+| Export | Description |
+|---|---|
+| `mkRunningOp(operationId, progress?)` | `progress` 0–100 |
+| `mkSucceededOp(operationId, result, createdAt)` | |
+| `mkFailedOp(operationId, error, createdAt)` | |
+| `mkCancelledOp(operationId, createdAt)` | |
+
+Return `acceptedResponse(op, pollUrl)` from the trigger handler; return `okResponse(op)` from the polling handler.
+
+### Bulk operations
+
+| Export | Description |
+|---|---|
+| `BulkItem<T>` | `ok` (200/201) or `error` (4xx/5xx) variant |
+| `BulkResponse<T>` | `{ items: ReadonlyArray<BulkItem<T>> }` |
+| `mkBulkOkItem(body, status?)` | Successful item |
+| `mkBulkErrorItem(problem)` | Failed item from `ProblemDetails` |
+| `bulkResponse(items)` | `207 Multi-Status` |
+
+### Rate limiting
+
+| Export | Description |
+|---|---|
+| `RateLimitState` | `{ limit: number; remaining: number; resetAt: Date }` |
+| `rateLimitHeaders(state)` | `RateLimit-Limit`, `RateLimit-Remaining`, `RateLimit-Reset` — attach to **all** responses on rate-limited endpoints, not just 429s |
+| `retryAfterHeader(seconds)` | `Retry-After` — add on 429 in addition to `rateLimitHeaders` |
+
+### Security and CORS
+
+| Export | Description |
+|---|---|
+| `baselineSecurityHeaders` | `HSTS`, `CSP`, `Referrer-Policy`, `X-Content-Type-Options`, `X-Frame-Options`, `Cache-Control: no-store` — merge into every response |
+| `corsHeaders(allowedOrigins, requestOrigin, opts?)` | Never reflects `Origin` blindly. Returns `{}` for unlisted origins. Always sets `Vary: Origin`. `allowedOrigins` comes from config, never from headers. |
+
+### Idempotency
+
+| Export | Description |
+|---|---|
+| `IdempotencyStore` | Port — `check`, `markInFlight`, `store`. Implement with Redis / Postgres / any durable store. |
+| `IdempotencyLookup` | Union — `first_request \| replay \| in_flight \| key_conflict` |
+| `StoredResponse` | Serialisable response snapshot for replay |
+| `withIdempotency(store)` | `(RawHandler) → RawHandler` HOF — full lifecycle |
+
+### Observability
+
+| Export | Description |
+|---|---|
+| `RequestLogger` | Port — `info(entry)`, `error(entry)`. Implement with pino, winston, etc. |
+| `RequestLog` | Structured log entry type |
+| `withRequestLog(logger, routeTemplate)` | `(RawHandler) → RawHandler` HOF — one entry per request |
+
+### Webhooks
+
+| Export | Description |
+|---|---|
+| `signWebhook(secret, id, body)` | HMAC-SHA256 over `{timestamp}.{body}` → `WebhookSignatureHeaders` |
+| `verifyWebhook(secret, headers, body, maxAge?)` | Verifies signature + timestamp recency (default 5 min). Constant-time comparison. |
+| `WebhookSignatureHeaders` | `x-webhook-id`, `x-webhook-timestamp`, `x-webhook-signature` |
+
+### Cache headers
+
+| Export | Description |
+|---|---|
+| `CachePolicy` | `'no-store' \| 'private-revalidate' \| 'public-short' \| 'public-long' \| 'immutable'` |
+| `cacheHeaders(policy, etag?)` | Builds appropriate `Cache-Control` / `ETag` headers |
+
+### Handler types
+
+| Export | Description |
+|---|---|
+| `RawHandler` | `(req: Request) => Promise<Response>` |
+| `HandlerFactory<Deps>` | `(deps: Deps) => RawHandler` — canonical factory shape |
+
+---
+
+## Canonical handler shape
+
+```ts
+export const createTrackHandler: HandlerFactory<Deps> = (deps) => async (req) => {
+  const ctx = extractContext(req, '/v1/tracks');         // 1. context first
+
+  const raw    = await req.json().catch(() => null);
+  const parsed = schema.safeParse(raw);
+  if (!parsed.success) return apiErrorToResponse(fromZodError(parsed.error), ctx); // 2. validate
+
+  const result = await deps.tracks.create(parsed.data); // 3. use case
+  if (isErr(result)) return apiErrorToResponse(result.error, ctx);
+
+  return createdResponse(result.value, `/v1/tracks/${result.value.id}`, {
+    'X-Request-Id': ctx.traceId,
+  });                                                    // 4. respond
+};
+```
+
+## Middleware composition via `pipe`
+
+Compose outermost-last. `withRequestLog` must be outermost so it captures every outcome including idempotency replays.
+
+```ts
+const handler: RawHandler = pipe(
+  createTrackHandler(deps),               // innermost: business logic
+  withIdempotency(idempotencyStore),      // middle: replay / in-flight guard
+  withRequestLog(logger, '/v1/tracks'),   // outermost: structured log
+);
+```
+
+## Custom error extension pattern
+
+```ts
+type AppError = ApiError | QuotaExceededError;
+
+const appErrorToResponse: ErrorMapper<AppError> = (error, ctx) => {
+  switch (error.kind) {
+    case 'quota_exceeded':
+      return problemResponse(mkProblem(429, 'quota_exceeded', '...', ctx.traceId));
+    default:
+      return apiErrorToResponse(error, ctx); // delegate canonical variants
+  }
+};
+```

package/copilot/skills/coding-standard/SKILL.md

@@ -0,0 +1,162 @@
+---
+name: coding-standard
+description: >
+  Normative TSF++ coding rules for all TypeScript in this repository. Load when
+  writing, reviewing, or auditing any TypeScript file: enforces forbidden
+  constructs, hard rules by rule number, layer-specific constraints (core, api,
+  dal, react, cli), discriminant conventions (_tag vs kind), deviation procedure,
+  and size limits. Supersedes general TypeScript conventions wherever they
+  conflict.
+---
+
+# TSF++ coding standard — v1.1.0
+
+Standard version: 1.1.0 (2026-05-15). When this skill and the full `CODING_STANDARD.md` conflict, the file wins.
+
+---
+
+## Never (MUST NOT — all layers)
+
+```
+class · this · new · instanceof · namespace · prototype inheritance
+enum          → use string literal unions or `as const` objects
+interface     → use `type`; deviation requires // DEVIATION(1.4): <reason>
+any           → use `unknown` at I/O boundaries and narrow in scope
+as            → only inside a smart constructor body after validation
+!             → non-null assertion forbidden everywhere
+let · var
+for · while · do..while
+push · pop · splice · sort · reverse · fill · copyWithin  (mutating methods)
+property assignment · delete
+throw         → only at adapter boundaries (Rule 6.2); core uses Result<T,E>
+==  !=        → use === !==
+truthiness checks on non-booleans  (if (str) · if (value))
+optional params ?  → use Option<T> or a defaults record
+default:      in an exhaustive switch  → use absurd(x)
+direct _tag comparison outside @tsfpp/prelude  → use exported guards
+import from 'ramda'  → use @tsfpp/prelude
+```
+
+---
+
+## Hard rules (all layers)
+
+| Rule | Level | Constraint |
+|------|-------|-----------|
+| 1.1 | MUST | Sum types: tagged discriminated union with a literal discriminant |
+| 1.2 | MUST | Exhaustive `switch` ends in `default: return absurd(x)` |
+| 1.3 | MUST | Nominal distinctions via branded types; only smart constructors (`mk*`, `from*`, `as*`) |
+| 1.4 | MUST | `type` aliases; `interface` requires `// DEVIATION(1.4): <reason>` |
+| 1.5 | MUST | No `any`; `unknown` at I/O boundaries, narrowed in scope |
+| 1.6 | MUST | No `!`; no `as` outside smart constructor bodies |
+| 1.8 | MUST | No `enum`; string literal unions or `as const` |
+| 1.9 | MUST | No `class` · `this` · `new` · `instanceof` · `namespace` |
+| 1.11 | MUST | Access prelude ADT discriminants via exported guards only (`isOk`, `isSome`, …) |
+| 1.12 | MUST | Discriminant convention: `_tag` for prelude/library ADTs · `kind` for domain ADTs |
+| 2.1 | MUST | `const` only; no `let`/`var` |
+| 2.2 | MUST | `ReadonlyArray<T>` everywhere |
+| 2.3 | MUST | No mutating methods or property assignment |
+| 2.5 | MUST | `as const` for literal narrowing and config tables |
+| 3.x | MUST | `readonly` on every record field |
+| 4.1 | MUST | Every sum-type `switch` exhaustive; `default: return absurd(x)` |
+| 4.5 | MUST | Strict equality only; no truthiness on non-booleans |
+| 5.1 | MUST | Pipelines via `pipe` from `@tsfpp/prelude` |
+| 6.2 | MUST | `throw` only in adapter boundaries; wrap with `tryCatch`/`tryCatchAsync` |
+| 6.3 | MUST | No `null`/`undefined` propagation; use `Option<A>` |
+| 6.6 | MUST | Prefer `Promise.allSettled` over `Promise.all` when partial failure is meaningful |
+| 7.x | MUST | JSDoc on every exported symbol; algebraic laws for combinators |
+| 8.4 | MUST | Parse, don't validate: convert `unknown` to domain types at the boundary |
+| 9.6 | MUST | Pre-commit hooks enforce lint and typecheck |
+| 11.1 | MUST | One type, one file; related constructors co-located |
+| 11.2 | MUST | File ≤ 400 lines; 800 absolute maximum with deviation |
+
+**Size limits:** function body ≤ 40 lines · cyclomatic complexity ≤ 10 · nesting depth ≤ 4.
+
+---
+
+## Discriminant convention (Rule 1.12)
+
+| ADT origin | Discriminant field | Example |
+|---|---|---|
+| `@tsfpp/prelude` (Result, Option) | `_tag` | `{ _tag: 'Ok'; value: A }` |
+| Domain code | `kind` | `{ kind: 'pending'; orderId: OrderId }` |
+
+Access prelude ADTs through exported guards only — never `result._tag === 'Ok'`.  
+`_tag` in a `switch` is permitted only when exhaustiveness via `absurd` requires it.
+
+---
+
+## Key idioms
+
+```ts
+// Sum type — domain ADT (kind)
+type OrderStatus =
+  | { readonly kind: 'pending';   readonly orderId: OrderId }
+  | { readonly kind: 'fulfilled'; readonly orderId: OrderId; readonly at: Date }
+
+// Exhaustive match
+const label = (s: OrderStatus): string => {
+  switch (s.kind) {
+    case 'pending':   return 'Pending'
+    case 'fulfilled': return 'Fulfilled'
+    default:          return absurd(s)
+  }
+}
+
+// Branded type — smart constructor only
+type TrackId = Brand<string, 'TrackId'>
+const mkTrackId = (raw: string): Option<TrackId> =>
+  raw.length > 0
+    // eslint-disable-next-line @typescript-eslint/consistent-type-assertions -- DEVIATION(1.6): smart-constructor body
+    ? some(raw as TrackId)
+    : none
+
+// Deviation marker
+// DEVIATION(1.4): third-party plugin augmentation requires interface
+```
+
+---
+
+## Deviation procedure
+
+Every MUST violation requires all three:
+1. Inline comment: `// DEVIATION(N.M): <one-line justification>`
+2. At least one reviewer sign-off
+3. Entry in `DEVIATIONS.md` for project-wide deviations
+
+---
+
+## Layer constraints
+
+### `core`
+- Zero framework imports. Zero I/O. Zero effects. Zero `Promise` in signatures.
+- Domain types only: sum types, product types, branded types, smart constructors.
+- No `@tsfpp/boundary`, no `process`, `fs`, `fetch`.
+
+### `api`
+- All input parsed with Zod at the boundary; lifted into `Result<A, ZodError>`.
+- Handlers return `Promise<Response>` via `@tsfpp/boundary` response builders.
+- Errors mapped through `apiErrorToResponse`; never raw `throw`.
+- Context extracted via `extractContext`; never read raw headers in business logic.
+- Handler shape: parse → domain map → use-case call → response map. Nothing else.
+- Architecture: transport → boundary → use-case → domain core → adapters. One-way only.
+
+### `dal`
+- Adapter pattern: implement a port (interface) defined by the domain.
+- Wrap all third-party calls in `tryCatchAsync` from `@tsfpp/prelude`.
+- Map infrastructure errors to typed domain error ADTs before returning.
+- No domain logic. No HTTP semantics. Pure data translation.
+
+### `react`
+- Component state as discriminated union with `kind` discriminant; never boolean soup.
+- Data fetching via TanStack Query; no raw `useEffect` for fetching.
+- `useEffect` only for genuine external synchronisation; requires an explanatory comment.
+- Props as `readonly` record; no optional props — use `Option<T>`.
+- Components are pure render functions; side effects are isolated.
+- Prop drilling limit: 2 levels; extract context or compose instead.
+
+### `cli`
+- `process.argv` parsed at the entry point boundary only; typed `Args` ADT internally.
+- `process.exit` only at the outermost boundary after all async work resolves.
+- Errors as `Result<T, E>`; convert to exit codes only at the shell boundary.
+- No `console.log` in core — use a `Logger` port.

package/copilot/skills/prelude-api/SKILL.md

@@ -0,0 +1,233 @@
+---
+name: prelude-api
+description: >
+  Provides the complete API surface of @tsfpp/prelude: all exported combinators,
+  ADTs, and utility functions for Option, Result, List, ReadonlyMap, ReadonlySet,
+  branded types, and record decoding. Load this skill when writing or reviewing
+  TypeScript that imports from @tsfpp/prelude, when choosing between
+  map/flatMap/traverseArray, when constructing or querying ReadonlyMap or
+  ReadonlySet, when decoding unknown runtime values, or when deciding between
+  pipe and flow.
+---
+
+# @tsfpp/prelude API
+
+All combinators are curried data-last and compose with `pipe`.
+
+## Import path
+
+```ts
+import { pipe, ok, err, some, none, ... } from '@tsfpp/prelude';
+```
+
+Never import from `ramda` directly. Never import sub-paths.
+
+---
+
+## Core exports
+
+| Group | Exports |
+|---|---|
+| Combinators | `pipe`, `flow`, `comp`, `complement` |
+| Exhaustiveness | `absurd` |
+| Option | `some`, `none`, `isSome`, `isNone`, `mapO`, `flatMapO`, `orElse`, `getOrElse` |
+| Result | `ok`, `err`, `isOk`, `isErr`, `map`, `flatMap`, `flatMapAsync`, `tryCatch`, `tryCatchAsync`, `tap`, `tapErr` |
+| Unit | `unit`, `Unit` |
+| Guards / conversions | `fromNullable`, `toNullable`, `isRecord`, `fromUnknownString`, `fromUnknownArray`, `fromUnknownArrayOf`, `fromNonEmptyString` |
+| Record decoding | `UnknownRecord`, `getStringField`, `getNumberField`, `getBooleanField`, `getTypedField` |
+| Branded types | `Brand`, `Every`, `Any`, `mkEvery`, `mkAny` |
+| Collections | `traverseArray`, `traverseArrayO`, `sequenceArrayO`, `unique` |
+| List ADT | `List`, `nil`, `cons`, `singletonList`, `isCons`, `isNil`, `fromArray`, `toArray`, `headList`, `tailList`, `isEmptyList`, `lengthList`, `mapList`, `flatMapList`, `appendList`, `reverseList`, `filterList`, `foldList`, `foldLeftList`, `foldLeftListCurried`, `traverseList` |
+| ReadonlyMap | `intoMap`, `entriesOfMap`, `assoc`, `dissoc`, `lookup` |
+| ReadonlySet | `intoSet`, `conj`, `disj`, `member` |
+
+---
+
+## Decision rules
+
+### `map` vs `flatMap`
+
+- Transformation **cannot fail** → `map` / `mapO`
+- Transformation **can fail or be absent** → `flatMap` / `flatMapO`
+- Mismatching produces `Result<Result<T,E>,E>` or `Option<Option<T>>` — always wrong.
+
+```ts
+const upper = map((s: string) => s.toUpperCase())(name);   // cannot fail
+const valid = flatMap(validateEmail)(input);                // can fail
+```
+
+### `orElse` vs `getOrElse`
+
+- Keep `Option` context → `orElse(() => some(fallback))`
+- Collapse to concrete value → `getOrElse(() => fallback)`
+
+### `pipe` vs `flow`
+
+- Initial value is at hand → `pipe(value, f, g, h)`
+- Named or reusable pipeline → `flow(f, g, h)` — returns a function
+- `flow(f, g, h)(x) ≡ pipe(x, f, g, h)`
+
+### `tap` vs `tapErr`
+
+Use for side effects (logging, metrics). Neither changes the value.
+
+```ts
+pipe(
+  parseInput(raw),
+  tap((v)    => log.debug({ parsed: v })),
+  flatMap(validate),
+  tapErr((e) => log.warn({ error: e })),
+)
+```
+
+Never break the chain to log. Always use `tap`/`tapErr`.
+
+### `Result<Unit, E>` for success-only operations
+
+Use `ok(unit)` when an operation succeeds but produces no value (write, save, dispatch). Never use `Result<void, E>`.
+
+```ts
+import { ok, err, unit, type Result, type Unit } from '@tsfpp/prelude';
+
+const save = (x: Foo): Result<Unit, SaveError> =>
+  persist(x) ? ok(unit) : err({ code: 'WRITE_FAILED' });
+```
+
+### `absurd` for exhaustive matching
+
+Switch on `_tag` only in exhaustive `switch`. Use exported guards (`isOk`, `isSome`) everywhere else.
+
+```ts
+switch (result._tag) {
+  case 'Ok':  return result.value;
+  case 'Err': return result.error;
+  default:    return absurd(result);
+}
+```
+
+---
+
+## Boundary patterns
+
+### Wrapping throwing third-party code
+
+```ts
+const parsed = tryCatch(
+  () => JSON.parse(raw),
+  (e) => `parse failed: ${String(e)}`,
+);
+```
+
+Never use raw `try/catch` inside your own code. Return `Result` directly.
+
+### Lifting Zod into `Result`
+
+```ts
+const fromZod =
+  <A>(schema: ZodSchema<A>) =>
+  (raw: unknown): Result<A, ZodError> => {
+    const r = schema.safeParse(raw);
+    return r.success ? ok(r.data) : err(r.error);
+  };
+```
+
+Zod owns the boundary. The prelude owns everything after.
+
+### Decoding `unknown` records
+
+```ts
+import { isRecord, getStringField, getNumberField, isSome, type UnknownRecord } from '@tsfpp/prelude';
+
+const decode = (raw: unknown): Result<Foo, string> => {
+  if (!isRecord(raw)) return err('not an object');
+  const name = getStringField(raw, 'name');   // Option<string> — rejects empty/whitespace
+  const age  = getNumberField(raw, 'age');    // Option<number> — rejects NaN/Infinity
+  return isSome(name) && isSome(age)
+    ? ok({ name: name.value, age: age.value })
+    : err('missing fields');
+};
+```
+
+For domain types, use `getTypedField` with a runtime guard:
+
+```ts
+const userId = getTypedField(payload, 'userId', isUserId); // Option<UserId>
+```
+
+---
+
+## Array patterns
+
+### `traverseArray` — map a fallible function, short-circuit on first `Err`
+
+```ts
+const all = traverseArray(parseFoo)(rawItems); // Result<ReadonlyArray<Foo>, E>
+// Never: rawItems.map(parseFoo) — produces ReadonlyArray<Result<Foo,E>>
+```
+
+### `traverseArrayO` / `sequenceArrayO` — collect only if every element is `Some`
+
+```ts
+traverseArrayO(fromNullable)([1, 2, 3]);    // Some([1, 2, 3])
+traverseArrayO(fromNullable)([1, null, 3]); // None
+
+// Already have ReadonlyArray<Option<A>>? Use sequenceArrayO directly:
+sequenceArrayO([some(1), some(2)]); // Some([1, 2])
+sequenceArrayO([some(1), none]);    // None
+```
+
+### `fromUnknownArrayOf` — guard typed arrays from unknown
+
+```ts
+const strings = fromUnknownArrayOf(
+  (v): v is string => typeof v === 'string'
+)(raw); // Option<ReadonlyArray<string>>
+```
+
+---
+
+## ReadonlyMap combinators
+
+Always construct maps with `intoMap`. Never call `new Map()` directly.
+
+```ts
+import { intoMap, entriesOfMap, assoc, dissoc, lookup } from '@tsfpp/prelude';
+
+const m  = intoMap([['a', 1], ['b', 2]]); // ReadonlyMap<string, number>
+const v  = pipe(m, lookup('a'));           // Some(1)
+const m2 = pipe(m, assoc('c', 3));        // insert or replace
+const m3 = pipe(m2, dissoc('a'));          // remove
+const es = entriesOfMap(m);               // ReadonlyArray<readonly [string, number]>
+```
+
+---
+
+## ReadonlySet combinators
+
+Always construct sets with `intoSet`. Never call `new Set()` directly.
+
+```ts
+import { intoSet, conj, disj, member } from '@tsfpp/prelude';
+
+const s   = intoSet([1, 2, 2, 3]);  // ReadonlySet<number> — {1, 2, 3}
+const s2  = pipe(s, conj(4));       // add
+const s3  = pipe(s2, disj(2));      // remove (no-ops when absent)
+const has = pipe(s, member(1));     // true
+```
+
+---
+
+## `List` vs `ReadonlyArray`
+
+Use `List` when: prepend-heavy (`cons` is O(1)), structurally recursive, pattern-matching on head/tail.
+Use `ReadonlyArray` when: random access, interop with APIs, append-heavy.
+
+```ts
+import { fromArray, toArray, isCons, isNil } from '@tsfpp/prelude';
+
+const asList = fromArray(rawArray);
+// ... structural processing with isCons / isNil guards ...
+const result = toArray(asList);
+```
+
+Fold operations: `foldList` (right-associative), `foldLeftList` / `foldLeftListCurried` (left-associative).

package/copilot/skills/react-coding-standard/SKILL.md

@@ -0,0 +1,342 @@
+---
+name: react-coding-standard
+description: >
+  Normative TSF++/React rules for all .tsx and React-relevant .ts files:
+  component shape, props contracts, state elimination ladder, effect discipline,
+  memoization policy, server state via TanStack Query, forms via React Hook Form
+  and Zod, routing via TanStack Router, global state via Zustand/Jotai, Tailwind
+  and cva styling, accessibility, testing, and module organisation. Profile of
+  coding-standard — all base TSF++ rules still apply. Load when writing or
+  reviewing any component, hook, form, route, or store file.
+---
+
+# TSF++/React coding standard — v1.0.0
+
+Profile of `CODING_STANDARD.md`. Every base TSF++ rule applies unchanged. This skill adds React-specific rules and refinements.
+
+---
+
+## Never (MUST NOT — React-specific additions)
+
+```
+class components / function declarations for components  (Rule 1.1)
+module-level mutable state in components or hooks        (Rule 1.5)
+optional flag props for mutually exclusive variants      (Rule 2.2)
+prop drilling beyond two component levels                (Rule 2.3)
+{...rest} spread onto DOM without explicit allow-list    (Rule 2.4)
+DOM event types in domain callbacks                      (Rule 2.7)
+useState for server state                                (Rule 3.2)
+URL-shaped state in component state                      (Rule 3.3)
+I/O inside reducers or store actions                     (Rule 3.8)
+Context for high-frequency / per-keystroke state         (Rule 3.7)
+useEffect for derived state                              (Rule 4.2)
+useEffect for data fetching                              (Rule 4.3)
+useEffect for user-event reactions                       (Rule 4.4)
+effect that subscribes without returning a cleanup       (Rule 4.5)
+disabling react-hooks/exhaustive-deps                    (Rule 4.6)
+speculative useMemo / useCallback / React.memo           (Rule 5.1–5.3)
+inline fetch in components                               (Rule 7.1)
+inline string-array query keys                           (Rule 7.2)
+throw in submit handlers                                 (Rule 8.2)
+per-field useState in forms                              (Rule 8.5)
+hand-built URL strings for navigation                    (Rule 9.3)
+useStore((s) => s) — whole-store selection               (Rule 10.4)
+inline hex codes or magic pixel values in className      (Rule 11.4)
+if/else string concatenation for Tailwind variants       (Rule 11.3)
+div with onClick for an action                           (Rule 16.1)
+data-testid queries in tests                             (Rule 17.1)
+stubbing fetch in tests                                  (Rule 17.3)
+cross-feature deep imports past a feature's barrel       (Rule 18.2)
+shared/ui importing from features/*                      (Rule 18.3)
+```
+
+---
+
+## 1 — Component shape
+
+```ts
+// MUST: arrow const, explicit return type, ReactElement | ReactNode | null
+const UserCard = ({ user }: UserCardProps): ReactElement => (
+  <article className="rounded-lg border p-4">
+    <h2>{user.displayName}</h2>
+  </article>
+)
+```
+
+- One public (exported) component per file (Rule 1.3)
+- `.tsx` if and only if the file contains JSX (Rule 1.4)
+- Co-locate component, types, test, story in one directory (Rule 1.6)
+
+---
+
+## 2 — Props contracts
+
+```ts
+// MUST: type alias, Props suffix, all fields readonly
+type ButtonProps =
+  | { readonly kind: 'submit'; readonly loading: boolean;  readonly children: ReactNode }
+  | { readonly kind: 'link';   readonly href: string;      readonly children: ReactNode }
+  | { readonly kind: 'icon';   readonly icon: ReactElement; readonly label: string }
+```
+
+- Mutually exclusive variants → discriminated union, never optional flags (Rule 2.2)
+- Callbacks accept domain types, not DOM events (Rule 2.7): `onSelect: (id: UserId) => void`
+- Boolean props named affirmatively: `open`, `closable` — not `isOpen`, `enabled` (Rule 2.5)
+- Content slots: `ReactNode` over `string | ReactElement` (Rule 2.6)
+
+---
+
+## 3 — State elimination ladder (Rule 3.1)
+
+Exhaust top-to-bottom before introducing state:
+
+1. Derivable from props? → compute during render
+2. Derivable from existing state? → compute during render or `useMemo` if expensive
+3. Belongs in URL? → router (search params, path params)
+4. Server data? → TanStack Query
+5. Form state? → React Hook Form
+6. Ephemeral UI state, one component? → `useState` / `useReducer`
+7. Shared between siblings? → lift to common ancestor (Rule 3.5: lift no higher than needed)
+8. Shared across distant subtrees, low-frequency? → Context
+9. Shared across distant subtrees, high-frequency? → Zustand / Jotai
+
+Skip a rung with `// DEVIATION(3.1): <reason>`.
+
+**`useReducer` over `useState`** when state has more than two related fields or transitions form a state machine (Rule 3.4):
+
+```ts
+type WizardState =
+  | { readonly kind: 'step1' }
+  | { readonly kind: 'step2'; readonly name: string }
+  | { readonly kind: 'submitted'; readonly result: SubmitResult }
+```
+
+---
+
+## 4 — Effect discipline
+
+`useEffect` is reserved exclusively for synchronizing with systems **outside React**: subscriptions, browser APIs, imperative libraries, observers (Rule 4.1).
+
+Legitimate: WebSocket, `IntersectionObserver`, `document.title`, canvas/map imperative init.
+
+```ts
+// MUST: cleanup every subscribing effect
+useEffect(() => {
+  const id = window.setInterval(tick, 1000)
+  return () => window.clearInterval(id)   // Rule 4.5
+}, [tick])
+```
+
+| Pattern | Correct tool |
+|---|---|
+| Derived value | Compute inline or `useMemo` |
+| Data fetching | TanStack Query |
+| User-event reaction | Event handler |
+| Subscription | `useEffect` with cleanup |
+
+---
+
+## 5 — Memoization policy
+
+**Speculative memoization is forbidden.** Add only after a profiler measurement identifies re-renders as the bottleneck.
+
+- `useMemo` — only when result is passed to a memoized consumer or is genuinely expensive (Rule 5.1)
+- `useCallback` — only when callback is passed to a memoized component or used in another hook's dep array (Rule 5.2)
+- `React.memo` — only after profiler measurement (Rule 5.3)
+- When the React Compiler is enabled: remove all manual memoization (Rule 5.5)
+
+Always document the reason inline: `// Reason: passed to memoized DataGrid`
+
+---
+
+## 6 — Composition patterns
+
+- Prefer composition (children, slots) over deeply parameterized props (Rule 6.1)
+- Compound components communicate via typed context, not implicit child ordering (Rule 6.2)
+- Component does exactly one thing: present, fetch, lay out, or coordinate (Rule 6.4)
+- Presentation components must be storybookable with mock props only (Rule 6.5)
+- JSX nesting depth ≤ 4; extract sub-components beyond that (Rule 6.6)
+
+---
+
+## 7 — Server state (TanStack Query)
+
+```ts
+// Query key factory — typed, factory-shaped (Rule 7.2)
+const userKeys = {
+  all:    ['users'] as const,
+  byId:   (id: UserId)       => [...userKeys.all, id] as const,
+  list:   (f: UserFilter)    => [...userKeys.all, 'list', f] as const,
+}
+
+// Query functions return T; mutation functions return Result<T, E> (Rule 7.3)
+// Post-mutation effects (invalidation, navigation, toasts) in onSuccess/onError (Rule 7.4)
+// Optimistic updates require all three: onMutate + onError rollback + onSettled (Rule 7.5)
+```
+
+Use TanStack Router loaders for route-level data; component-level queries for sub-resources and on-demand reads (Rule 7.6).
+
+---
+
+## 8 — Forms (React Hook Form + Zod)
+
+```ts
+// MUST: Zod schema is the single source of truth (Rule 8.1)
+const userSchema = z.object({
+  email: z.string().email(),
+  age:   z.number().int().min(18),
+})
+type UserForm = z.infer<typeof userSchema>
+
+const form = useForm<UserForm>({ resolver: zodResolver(userSchema) })
+
+// Submit returns Result<T, E> — never throw (Rule 8.2)
+const onSubmit = async (data: UserForm): Promise<Result<User, FormError>> => { ... }
+```
+
+- Field validation in the schema only, never in `onChange` handlers (Rule 8.3)
+- Compose schemas (`partial`, `pick`, `extend`) instead of duplicating them (Rule 8.4)
+
+---
+
+## 9 — Routing (TanStack Router)
+
+```ts
+// MUST: typed navigate; never hand-built URL strings (Rule 9.3)
+navigate({ to: '/users/$id', params: { id } })
+
+// MUST: search params validated by Zod at the route definition (Rule 9.2)
+```
+
+- Routes declared with full type inference for params and search (Rule 9.1)
+- Lazy-load routes not on the critical path (Rule 9.4)
+
+---
+
+## 10 — Global state (Zustand / Jotai)
+
+Global store exists only after the elimination ladder is exhausted (Rule 10.1).
+
+```ts
+// MUST: narrow selection — never whole-store (Rule 10.4)
+const userName = useUserStore((s) => s.user.name)
+
+// Store actions are pure (state, payload) => state; no I/O inside (Rule 10.3)
+// Zustand: sliced by domain (Rule 10.2)
+// Jotai: prefer for graph/canvas/grid with many small independent atoms (Rule 10.5)
+// Persistence: opt-in per slice/atom; validate with Zod on rehydrate (Rule 10.6)
+```
+
+---
+
+## 11 — Styling (Tailwind + shadcn/ui)
+
+```ts
+// MUST: cva for variants (Rule 11.3)
+const buttonVariants = cva('rounded-lg px-3 py-2', {
+  variants: {
+    variant: {
+      primary:     'bg-primary text-primary-foreground',
+      destructive: 'bg-destructive text-destructive-foreground',
+    },
+  },
+  defaultVariants: { variant: 'primary' },
+})
+
+// MUST: cn/clsx for conditional classes (Rule 11.2)
+const cls = cn('rounded-lg p-4', active && 'ring-2', disabled && 'opacity-50')
+
+// MUST: design tokens only — no hex/pixel literals (Rule 11.4)
+// Good: className="bg-background text-foreground gap-4"
+// Bad:  className="bg-[#0a0a0a] gap-[17px]"
+```
+
+- shadcn/ui components are vendored, not depended on as a package (Rule 11.5)
+- `style={{ ... }}` only for runtime-computed values (e.g. CSS variables driven by state) (Rule 11.6)
+
+---
+
+## 12 — Animation (framer-motion)
+
+```ts
+// MUST: variants at module scope, not inline (Rule 12.2)
+const fadeVariants = { hidden: { opacity: 0 }, visible: { opacity: 1 } } as const
+
+// MUST: respect prefers-reduced-motion (Rule 12.3)
+const reduced = useReducedMotion()
+```
+
+CSS keyframes only for purely decorative loops with no state interaction.
+
+---
+
+## 13 — Loading and error boundaries
+
+- Every async dependency has explicit loading and error states (Rule 13.1)
+- Error boundaries wrap every route and isolated feature subtree (Rule 13.2)
+- Error boundaries log to an observability sink and show a recoverable fallback (Rule 13.3)
+- Suspense boundaries at content-meaningful seams, not per-atom (Rule 13.4)
+
+---
+
+## 14 — Custom hooks
+
+- Name starts with `use` (Rule 14.1)
+- One hook, one responsibility; >1 unrelated returned values → split (Rule 14.2)
+- Consistent return shape: value, tuple, or record — pick one (Rule 14.3)
+- Return type is explicit and exported (Rule 14.4)
+
+---
+
+## 15 — Performance
+
+- Lists with >~50 visible items use TanStack Virtual or equivalent (Rule 15.3)
+- Heavy dependencies (charts, editors, PDF) are dynamic-imported (Rule 15.2)
+- Profile before optimizing; DevTools Profiler is the source of truth (Rule 15.5)
+
+---
+
+## 16 — Accessibility
+
+- Interactive elements use semantic HTML: `button`, `a`, `input`, `select` — never `div` with `onClick` (Rule 16.1)
+- Forms: associated `label`; icon-buttons: `aria-label`; images: `alt` (Rule 16.2)
+- Keyboard navigation covers every interactive flow; focus order logical, visible, traps escapable (Rule 16.3)
+- Color is never the sole channel for state; pair with text or icon (Rule 16.4)
+- Radix UI / shadcn/ui for dialogs, menus, popovers, tabs, tooltips (Rule 16.5)
+
+---
+
+## 17 — Testing
+
+```ts
+// MUST: query by accessible role, not data-testid (Rule 17.1)
+screen.getByRole('button', { name: /submit/i })
+
+// MUST: network mocked with MSW, not by stubbing fetch (Rule 17.3)
+// Pure logic (reducers, selectors, validators) unit-tested + fast-check (Rule 17.2)
+```
+
+---
+
+## 18 — Module organisation
+
+```
+src/
+  features/
+    user-profile/
+      UserCard.tsx          ← component
+      UserCard.types.ts
+      UserCard.test.tsx
+      useUser.ts            ← hook
+      userKeys.ts           ← query key factory
+      userSchema.ts         ← Zod schema
+  shared/
+    ui/                     ← shadcn primitives, generic atoms (no features/* imports)
+    hooks/                  ← cross-feature hooks
+    lib/                    ← cn, formatters, type guards
+  routes/                   ← route tree
+  app/                      ← root, providers, error boundary
+```
+
+- Cross-feature imports go through the feature's `index.ts` barrel only (Rule 18.2)
+- Path aliases (`@/features/...`) configured in `tsconfig.json`; no deep relative imports (Rule 18.4)

package/init.mjs

@@ -2,7 +2,7 @@
 /**
  * @tsfpp/agents init
  *
- * Copies Copilot agents, instructions, prompts, and Claude Code configuration
+ * Copies Copilot agents, instructions, prompts, skills, and Claude Code configuration
  * into the correct locations in the consumer's project. Also generates
  * eslint.config.js if not already present.
  *
@@ -48,6 +48,12 @@ const FILES = [
   ['copilot/prompts/tsfpp-new-module.prompt.md',         '.github/prompts/tsfpp-new-module.prompt.md'],
   ['copilot/prompts/tsfpp-boundary-review.prompt.md',    '.github/prompts/tsfpp-boundary-review.prompt.md'],
 
+  // Reusable skills
+  ['copilot/skills/coding-standard/SKILL.md',            '.github/skills/coding-standard/SKILL.md'],
+  ['copilot/skills/prelude-api/SKILL.md',                '.github/skills/prelude-api/SKILL.md'],
+  ['copilot/skills/boundary-api/SKILL.md',               '.github/skills/boundary-api/SKILL.md'],
+  ['copilot/skills/react-coding-standard/SKILL.md',      '.github/skills/react-coding-standard/SKILL.md'],
+
   // Claude Code
   ['claude/CLAUDE.md',                                   '.claude/CLAUDE.md'],
 ];
@@ -186,7 +192,7 @@ async function confirm(question) {
 
 console.log();
 console.log(bold('  @tsfpp/agents — init'));
-console.log(dim('  Sets up Copilot agents, instructions, and ESLint config.\n'));
+console.log(dim('  Sets up Copilot agents, instructions, prompts, skills, and ESLint config.\n'));
 
 const results = { copied: [], skipped: [], failed: [] };
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tsfpp/agents",
-  "version": "1.0.3",
+  "version": "1.1.1",
   "description": "Workspace AI tooling for TSF++ projects: scoped instructions, coding agents, and reusable prompts",
   "keywords": [
     "tsfpp",
@@ -25,7 +25,8 @@
     "node": ">=18.0.0"
   },
   "bin": {
-    "tsfpp-agents": "./init.mjs"
+    "tsfpp-agents": "./init.mjs",
+    "tsfpp-bootstrap": "./bin/bootstrap.sh"
   },
   "files": [
     "copilot/",