# Pegma > An MIT-licensed family of composable backend components — storage, > authorization, identity, audit, webhooks, sessions, rate limiting, billing, mail, > a support desk — > designed to be assembled and maintained by AI agents. Early 0.x: some > packages published, none stable. npm scope: @pegma. GitHub: pegma-dev. Governing principle: optimize for a fresh agent context window — minimize what must be read to make a correct change; mechanize how the change proves itself correct (types and conformance suites over prose). Each component states what it REFUSES to do as prominently as what it owns; treat the refusals as part of the contract. The stack runs in production behind retiregolden.org (Azure). This site deploys on Cloudflare from a public repo (pegma-dev/pegma.dev) as the second reference environment. ## Get started - [Get started](https://pegma.dev/start): put Pegma in a coding agent — install the skill (skill.md), fetch catalog.json for facts and pins, optionally wire the MCP endpoint — then assemble from the scaffold or a green recipe. ## Components - [Spine](https://github.com/pegma-dev/spine): @pegma/spine — shared contracts (PrincipalId, IsoTimestamp, Clock, Logger, typed events with a best-effort in-process bus). Published. - [Storage Core](https://github.com/pegma-dev/storage-core): @pegma/storage-core, @pegma/storage-azure-tables, @pegma/storage-cloudflare-d1 — declared collections, update deciders, conditional deletes, bounded authoritative scans, single-partition transactions, and a conformance suite adapters must pass against a real backend. Published as 0.4.0. - [Authorization Core](https://github.com/pegma-dev/authorization-core): @pegma/authorization-* (contracts, core, policy, auth0, stripe, storage, tokens, identity) — provider-neutral roles, entitlements, permissions, versioned policy, and the Identity claims adapter. Published as 0.1.2. - [Audit](https://github.com/pegma-dev/audit): @pegma/audit — append-only audit records that commit atomically inside the CALLER's transaction; owns no store of its own. Published. - [Health](https://github.com/pegma-dev/health): @pegma/health — composable health probes and HTTP responses for public liveness checks (process, detail, injected Store ping). Published as 0.1.1. - [Support Desk](https://github.com/pegma-dev/support-desk): @pegma/support-desk-* — composable support queue for web and email, authorized by permissions. In development. - [Webhooks](https://github.com/pegma-dev/webhooks): @pegma/webhooks — inbound receipt ledger: idempotent dedup, poison quarantine, retention; at-least-once on purpose. In development and unpublished: Phase 2 is merged into RetireGolden, with its operational exit awaiting production Stripe traffic; Phase 3 is gated on a second real provider. - [Sessions](https://github.com/pegma-dev/sessions): @pegma/sessions — server-side session records: hashed ids, absolute + idle expiry, principal-wide revocation. Published as 0.1.0: Phase 1 is merged, Phase 2 first-consumer migration is merged into RetireGolden, and the early 0.x API remains unstable. - [Rate Limit](https://github.com/pegma-dev/rate-limit): @pegma/rate-limit — an honest in-memory tier and a durable fail-closed tier. Published as 0.1.0. - [Identity](https://github.com/pegma-dev/identity): @pegma/identity — first-party identity: passkeys-first, email-code fallback, NO passwords (a refusal, not a phase); user records in the host's own storage. Published as 0.1.0 and composed by this site's Cloudflare Worker. - [Billing Core](https://github.com/pegma-dev/billing-core): @pegma/billing-core — a provider-agnostic subscription ledger maintained correctly under out-of-order webhook delivery: event-arbitration guard (watermark + snapshot freshness bound + lifecycle-rank tie-breaking), drift-repairing reconciliation, declared sticky/first-wins invariants, single-opportunity checkout reservation. Never sees card data or raw payloads. Planned; extraction from the reference application scheduled deliberately. - [Mail](https://github.com/pegma-dev/mail): @pegma/mail — transactional mail: provider ports and an outbox pattern that owns NO store (jobs commit in the caller's transaction, the audit precedent). Published as 0.1.0 after Identity became its second consumer. Each repository's docs/PROJECT_PLAN.md is the source of truth for its status, design decisions, and non-goals. ## Composition catalog (agents) - [catalog.json](https://pegma.dev/catalog.json): machine-readable composition catalog — components, exact npm pins when known, owns/refuses, dependencies, adapters, and synthetic recipe intents. Compiled at site build. Unpublished packages are flagged (`published: false`, `publishUsability: unpublished`). Do not invent package versions; fetch this document. - Schema and recipe backlog (source docs): https://github.com/pegma-dev/pegma.dev/tree/main/docs/catalog ## Assembly skill (agents) - [skill.md](https://pegma.dev/skill.md): short judgment skill — assemble over generate, explicit composition root, treat refuses as hard constraints, lookup catalog → component → green recipe → fixture. Does **not** hardcode package versions; re-fetch the catalog. Install notes: [https://pegma.dev/skill](https://pegma.dev/skill). ## Composition MCP (agents) - [MCP endpoint](https://pegma.dev/api/mcp): Streamable HTTP MCP over the same catalog. Tools: `list_components`, `get_component`, `list_recipes`, `get_recipe`, `plan_composition`. Public catalog facts only; no private data plane; no auth for reads. Config notes: https://pegma.dev/skill ## Scaffold (agents) - Minimal Cloudflare-shaped composition root (Glass Wing synthetic scaffold): https://github.com/pegma-dev/pegma.dev/tree/main/recipes/scaffold-cf-minimal Empty-ish root with optional health; pin versions from catalog.json. ## Site - [Get started](https://pegma.dev/start): the install hub — skill, catalog, optional MCP, first prompt. - [The stack](https://pegma.dev/stack): every component — owns, refuses, status, links. - [Roadmap](https://pegma.dev/roadmap): the aggregate view; status compiled at build time from the repos' plans. - [Examples](https://pegma.dev/examples): composition recipes with CI-tested fixtures under recipes/ (P1 accounts, P2 audit/mail outbox) plus snippets lifted from package READMEs; each block cites its source. - [Skill](https://pegma.dev/skill): install notes for the assembly skill. - [Account](https://pegma.dev/account): the static shell for pegma.dev's D1-backed first-party Identity reference consumer. The Worker pins the exact Identity, Authorization adapter, Sessions, Mail, rate-limit, and storage releases. Email entry points remain fail closed until the idempotent Resend provider, sender domain, managed secrets, and delivery smoke test are ready.