chore: init

Extracted from internal tooling and rebuilt as an open-source CLI framework.
Includes core runtime, middleware system, config loader, bundler, CLI scaffolding
tooling, utilities, examples, documentation, and contributing standards.

Co-Authored-By: Claude <noreply@anthropic.com>

Author: zrosenbauer

.changeset/README.md

@@ -0,0 +1,8 @@
+# Changesets
+
+Hello and welcome! This folder has been automatically generated by `@changesets/cli`, a build tool that works
+with multi-package repos, or single-package repos to help you version and publish your code. You can
+find the full documentation for it [in our repository](https://github.com/changesets/changesets)
+
+We have a quick list of common questions to get you started engaging with this project in
+[our documentation](https://github.com/changesets/changesets/blob/main/docs/common-questions.md)

.changeset/config.json

@@ -0,0 +1,11 @@
+{
+  "$schema": "https://unpkg.com/@changesets/config@3.1.2/schema.json",
+  "changelog": "@changesets/cli/changelog",
+  "commit": false,
+  "fixed": [],
+  "linked": [],
+  "access": "public",
+  "baseBranch": "main",
+  "updateInternalDependencies": "patch",
+  "ignore": []
+}

.changeset/tall-bears-relate.md

@@ -0,0 +1,2 @@
+---
+---

.claude/rules/documentation.md

@@ -0,0 +1,44 @@
+---
+paths:
+  - '**/*.md'
+  - '!CLAUDE.md'
+  - '!.claude/**'
+---
+
+# Documentation Rules
+
+## Principles
+
+- **Succinct** — no fluff, get to the point
+- **Actionable** — lead with what to do, not background
+- **Scannable** — tables, headers, and lists over paragraphs
+- **Consistent** — use the same structure across all documents
+
+## Templates
+
+Use the correct template based on document type. See `contributing/standards/documentation/writing.md` for full templates:
+
+| Type | Structure | Title Convention |
+|---|---|---|
+| Standard | Overview > Rules > Resources > References | Noun phrase |
+| Guide | Prerequisites > Steps > Verification > Troubleshooting | Starts with verb |
+| Overview | Architecture > Key Concepts > Usage > Configuration | Topic name |
+| Troubleshooting | Issue sections with Fix blocks | "Domain Troubleshooting" |
+
+## Sections
+
+- **Resources** — external URLs only
+- **References** — internal relative links only
+- Never mix external and internal links in the same section
+
+## Formatting
+
+- Code examples: minimal snippets showing the pattern, not full files
+- Specify language on all fenced code blocks (```ts, ```bash, etc.)
+- Use tables for structured comparisons (Correct vs Incorrect, options, conventions)
+- Prefer relative links for internal docs, full URLs for external
+
+## Diagrams
+
+- Use Mermaid with Catppuccin Mocha theme
+- See `contributing/standards/documentation/diagrams.md` for color palette and conventions

.claude/rules/errors.md

@@ -0,0 +1,52 @@
+---
+paths:
+  - 'packages/**/src/**/*.ts'
+---
+
+# Error Handling Rules
+
+All expected failures use the `Result<T, E>` tuple type. Never throw exceptions.
+
+## Result Type
+
+```ts
+type Result<T, E = Error> = readonly [E, null] | readonly [null, T]
+```
+
+- Success: `[null, value]`
+- Failure: `[error, null]`
+
+## Conventions
+
+- Define domain-specific error interfaces with a descriptive `type` or `reason` field
+- Create type aliases for domain results (e.g., `type ConfigResult<T> = Result<T, ConfigError>`)
+- Use `ok()` and `fail()` constructors where available (e.g., `HandlerResult` in kidd package)
+- Wrap async operations that can reject with a try/catch that returns a Result tuple
+
+## Chaining with Early Returns
+
+```ts
+const [configError, config] = loadConfig(workspace)
+if (configError) return [configError, null]
+
+const [resolveError, script] = resolveScript(config, name)
+if (resolveError) return [resolveError, null]
+
+return [null, script]
+```
+
+## Error Type Pattern
+
+```ts
+interface ConfigError {
+  readonly type: 'invalid_toml' | 'missing_field' | 'unknown_workspace'
+  readonly message: string
+}
+```
+
+## Rules
+
+- Never throw inside a function that returns `Result`
+- Always check the error element before accessing the value
+- Use `ts-pattern` `match` for exhaustive handling of multiple error variants
+- Map low-level errors (e.g., jose errors) to domain-specific error reasons

.claude/rules/testing.md

@@ -0,0 +1,67 @@
+---
+paths:
+  - '**/*.test.ts'
+---
+
+# Testing Rules
+
+All tests use [Vitest](https://vitest.dev). Follow these conventions in every test file.
+
+## Structure
+
+- Place test files in `test/` directory within the package (e.g., `packages/js/test/verifier.test.ts`)
+- Name `describe` blocks after the module or function under test
+- Name test cases as `should + expected behavior`
+- One assertion focus per test case
+
+```ts
+import { describe, it, expect } from 'vitest'
+
+describe('resolveScript', () => {
+  it('should resolve path relative to workspace root', () => {
+    const result = resolveScriptPath('build', '/project')
+    expect(result).toBe('/project/scripts/build.ts')
+  })
+})
+```
+
+## Mocking
+
+- Use `vi.mock` for module-level mocks and `vi.fn` for individual functions
+- Mock all external I/O (file system, network, timers)
+- Reset mocks in `beforeEach` with `vi.clearAllMocks()`
+- Use `vi.mocked()` for type-safe mock access
+
+## Organization
+
+- Group related tests with nested `describe` blocks
+- Use `beforeEach` for shared setup, never shared mutable state across tests
+- Delete or fix skipped tests — never leave `it.skip` without a reason
+
+## Error Testing
+
+- Test Result tuples by destructuring `[error, value]`
+- Assert the error element before accessing the value
+- Use `toMatchObject` for partial matching on error shapes
+
+```ts
+it('should return error result for missing config', async () => {
+  const [error] = await loadConfig('/missing')
+  expect(error).toMatchObject({ type: 'parse_error' })
+})
+```
+
+## Coverage Targets
+
+| Area | Minimum |
+|---|---|
+| Critical paths (config, auth) | 100% |
+| Business logic | 80% |
+| Utilities | 70% |
+
+## Anti-patterns
+
+- Do not test implementation details — test behavior and outcomes
+- Do not test framework code — trust dependencies
+- Do not use shared mutable state between tests
+- Do not create large monolithic test files — split by feature

.claude/rules/typescript.md

@@ -0,0 +1,64 @@
+---
+paths:
+  - 'packages/**/*.ts'
+---
+
+# TypeScript Rules
+
+These rules are enforced by OXLint (`.oxlintrc.json`) and must be followed in all code under `packages/`:
+
+## Functional programming
+
+- **No `let`** — use `const` only. No reassignment, no mutation.
+- **No loops** (`for`, `while`, `do...while`, `for...in`, `for...of`) — use `map`, `filter`, `reduce`, `flatMap`, etc. Prefer `es-toolkit` utilities.
+- **No classes** — use plain objects, closures, and factory functions.
+- **No `this`** — never reference `this`.
+- **No `throw`** — no throw statements or throw expressions. Return errors as values.
+- **No IIFEs** — no immediately invoked function expressions. Extract into a named function and call it.
+- **No expression statements** — every expression must be used (assigned, returned, or passed). Config files (`.config.ts`) are exempt.
+- **Immutable data** — no mutating objects or arrays after creation. Config files are exempt.
+- **Prefer tacit (point-free)** — e.g. `arr.filter(isEven)` not `arr.filter((x) => isEven(x))`.
+- **Functional parameters** — functions must declare explicit parameters (no `arguments`, no rest-only patterns).
+
+## TypeScript strictness
+
+- **No `any`** — use `unknown`, generics, or proper types.
+- **No non-null assertions** (`!`) — use explicit null checks.
+- **No optional chaining** (`?.`) — use explicit `if`/`else` or pattern matching.
+- **No ternaries** — use `if`/`else` or `match` expressions.
+- **ESM only** with `verbatimModuleSyntax` — use `import type` for type-only imports.
+
+## General
+
+- **No `eval`**, `new Function()`, or implied eval.
+- **No `var`** — use `const`.
+- **No param reassignment** — parameters are immutable.
+- **No bitwise operators**, `++`/`--`, `void`, `with`, `continue`, or multi-assign.
+- **No circular imports**, self-imports, or duplicate imports.
+- **Prefer `node:` protocol** for Node.js builtins (e.g. `import fs from 'node:fs'`).
+- **Use `es-toolkit`** over hand-rolling utility functions.
+
+## File structure
+
+Every source file follows this order:
+1. **Imports** — node builtins, blank line, external packages, blank line, internal (farthest-to-closest, alphabetical). Top-level `import type`, no inline type specifiers.
+2. **Module-level constants**
+3. **Exported functions** — public API first, each with full JSDoc
+4. **Section separator** (`// ---------------------------------------------------------------------------`)
+5. **Private helpers** — non-exported functions, each with JSDoc including `@private`
+
+## Exports
+
+- **Inline exports only** — use `export` directly on declarations (`export function`, `export interface`, `export const`). Never batch-export local declarations with `export { foo, bar }`.
+- **Re-exports allowed** — barrel/index files may use `export { foo } from './bar.js'` and `export type { Baz } from './baz.js'`.
+
+## JSDoc
+
+- **All functions** require JSDoc — exported and non-exported.
+- **Non-exported functions** must include the `@private` tag.
+- **Test files** are exempt.
+
+## Formatting (OXFmt)
+
+- 100-char line width, 2-space indent, semicolons, single quotes, trailing commas
+- Import sorting: builtin > external > internal > parent/sibling/index

.github/workflows/ci.yml

@@ -0,0 +1,41 @@
+name: CI
+
+on:
+  push:
+    branches:
+      - main
+  pull_request:
+    branches:
+      - main
+
+jobs:
+  ci:
+    name: CI
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout Repo
+        uses: actions/checkout@v4
+
+      - name: Setup pnpm
+        uses: pnpm/action-setup@v4
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: 22
+          cache: 'pnpm'
+
+      - name: Install Dependencies
+        run: pnpm install --frozen-lockfile
+
+      - name: Lint
+        run: pnpm lint
+
+      - name: Typecheck
+        run: pnpm typecheck
+
+      - name: Test
+        run: pnpm test
+
+      - name: Build
+        run: pnpm build

.github/workflows/release.yml

@@ -0,0 +1,41 @@
+name: Release
+
+on:
+  push:
+    branches:
+      - main
+
+concurrency: ${{ github.workflow }}-${{ github.ref }}
+
+jobs:
+  release:
+    name: Release
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout Repo
+        uses: actions/checkout@v4
+
+      - name: Setup pnpm
+        uses: pnpm/action-setup@v4
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: 22
+          cache: 'pnpm'
+
+      - name: Install Dependencies
+        run: pnpm install --frozen-lockfile
+
+      - name: Build
+        run: pnpm build
+
+      - name: Create Release Pull Request or Publish
+        id: changesets
+        uses: changesets/action@v1
+        with:
+          publish: pnpm release
+          version: pnpm version
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          NPM_TOKEN: ${{ secrets.NPM_TOKEN }}