vendo CLAUDE.md

Vendo

Vendo is a devtool that lets a company's users customize its product: an embedded agent that acts through the host's own API as the user and renders generated UI in a sandboxed, brand-native surface.

Layout

• packages/ — two published packages: the @vendoai/vendo umbrella and the vendoai alias. The ten blocks are no longer packages of their own — they folded into the umbrella and survive as its subpath exports (/core, /ui, /store, /actions, /guard, /apps, /automations, /knowledge, /mcp, /telemetry), backed by directories under packages/vendo/src/. The behavior contract is the exported types/zod schemas and the test suites — there are no prose contract docs; layering enforced by scripts/dependency-guard.mjs in pnpm lint
• examples/ — the demo host demo-bank (Maple) and the framework integration examples (ai-sdk-agent, mastra-agent, claude-code-plugin)
• corpus/ — init-extraction corpus harness (pnpm corpus)
• docs-site/ — the public docs site

Commands

• pnpm install · pnpm typecheck · pnpm lint (turbo-cached) — the local loop
• pnpm build · pnpm test · pnpm test:affected (changed packages only) — on demand, not required before a PR
• Demo: pnpm --filter demo-bank dev (Maple)

Vendo Cloud

• Cloud sells exactly two categories: infrastructure that is painful to run yourself (sandbox, inference, persistence, brokers, hosted automations) and inherently multi-party coordination (sharing, registry, orgs, SSO, billing, console). Everything else stays OSS.
• Hard BYO rule: every single-player capability keeps a no-key bring-your-own path (own Postgres, sandbox account, model key, OAuth apps).
• Adapter rule: one adapter interface per block; Cloud is just another implementation shipped in OSS. VENDO_API_KEY sets Cloud defaults only for adapter slots the host left unset; an explicitly passed adapter always wins; no hidden key-conditional branches. Reference implementation: selectConnections in packages/vendo/src/compose-selection.ts.
• Gating is valid key + meter, nothing else: no capability booleans, no entitlement protocol, no validate endpoint, no client-side checks. Key problems surface on the first real service call.
• Managed inference rides the console's Anthropic-compatible model gateway through the stock @ai-sdk/anthropic provider, so inference traffic does not carry the deployment-identity headers and does not feed the deployment inventory (known, accepted).