@aventara/cli 1.0.0-rc.0 → 1.0.0-rc.2

package/CHANGELOG.md

@@ -1,5 +1,265 @@
 # @aventara/cli
 
+## 1.0.0-rc.2
+
+### Patch Changes
+
+- `aventara init`'s refusal of a TypeScript 7 project names the supported range: "use TypeScript 5.7 to 6" (it said
+  "use TypeScript 6 or 5"). The Prisma adapter's `typescript` peer range starts at 5.7.0 now.
+- An agent skill for your AI coding agent. `aventara new` and `aventara init` write `.claude/skills/aventara/`:
+  `SKILL.md` (the Agent Skills format Claude Code reads: when to use it, and one rule per task) and
+  `reference/config.md`, `reference/stages.md`, `reference/recipes.md` and `reference/errors.md` (`@aventara/core`'s
+  `ERRORS.md`), for the Aventara version they install. They also add a short Aventara section to `AGENTS.md`, between
+  `<!-- aventara:start -->` and `<!-- aventara:end -->`, for agents that read `AGENTS.md`: an existing `AGENTS.md`
+  keeps everything else, and `CLAUDE.md` is never written.
+- `aventara skill` refreshes those files for the `@aventara/core` installed in the project (its version and its
+  `ERRORS.md`; it runs none of the project's packages). It rewrites the skill files it wrote, keeps one you changed
+  and says so (`--force` replaces it), and replaces only the marked section of `AGENTS.md`.
+- `aventara new` and `aventara init` write an `aventara:prepare` script that also passes
+  `--config src/aventara.config.ts`, so the generated types know which fields your configuration computes: a
+  variant's guards, pipes and filters may leave exactly those out of a create. A project set up before keeps working;
+  add the flag to its script to get the precise types.
+- The agent skill says that a `Date` or bytes value a stage is told is that stage's own copy, so changing it in place
+  changes nothing another stage sees, what is written or what the caller receives; and that a `compute.read` stage with
+  no `dependsOn` computes from the same inputs for every row, so its value usually belongs in response metadata or
+  `ctx.$state`. In rc.1 it said neither.
+- The agent skill says that a `compute.read` stage is told the row frozen: it returns its field's value, and writing
+  into `record` answers `A3000`. Its error reference lists a nested write that writes its relation back (`A2004`,
+  `V1012`).
+- The agent skill says that a computed value its field's `format` refuses (a relative path for `format: "url"`)
+  answers `A3000`, as a value of the wrong type does.
+- Released with the other Aventara packages, and `aventara new` and `aventara init` install them at 1.0.0-rc.2.
+
+## 1.0.0-rc.1
+
+### Patch Changes
+
+- 7e3d06f: Breaking: the configuration has a new shape. Every layer (the root, `application` and `client`) now holds the
+  same six keys: `exposed`, `transactionsStyle`, `limits`, `pipelines`, `resources` and `exemptions`. Everything about
+  one Resource lives under `resources.<Resource>`: its fields, and each field's `definition` and `pipelines`. The old
+  keys are refused when the framework starts, with a message that names where each one moved:
+
+  | Before (rc.0)                                           | Now (rc.1)                                                                          |
+  | ------------------------------------------------------- | ----------------------------------------------------------------------------------- |
+  | `fields: { Post: { url: { type, nullable, … } } }`      | `resources: { Post: { fields: { url: { definition: { type, nullable, … } } } } }`   |
+  | `behaviors: { Post: { fields: { slug: { create } } } }` | `resources: { Post: { fields: { slug: { pipelines: { compute: { create } } } } } }` |
+  | `transactions: "none"`                                  | `transactionsStyle: "none"`                                                         |
+  | `restrictions`                                          | `exposed` + `exemptions` (see below)                                                |
+  | `@aventara/core/json`                                   | `@aventara/core/avz`                                                                |
+
+  Before:
+
+  ```ts
+  createFramework({
+    api: "/api",
+    adapter,
+    transactions: "interactive",
+    fields: {
+      Post: {
+        url: {
+          type: { scalar: "string" },
+          nullable: false,
+          list: false,
+          lifecycle: ["VIRTUAL"],
+        },
+      },
+    },
+    behaviors: {
+      Post: {
+        fields: {
+          url: {
+            read: {
+              dependsOn: ["slug"],
+              compute: ({ record }) => `/p/${record.slug}`,
+            },
+          },
+        },
+      },
+    },
+  });
+  ```
+
+  After:
+
+  ```ts
+  createFramework({
+    api: "/api",
+    adapter,
+    transactionsStyle: "interactive",
+    resources: {
+      Post: {
+        fields: {
+          url: {
+            definition: {
+              type: { scalar: "string" },
+              nullable: false,
+              list: false,
+              lifecycle: ["VIRTUAL"],
+            },
+            pipelines: {
+              compute: {
+                read: {
+                  dependsOn: ["slug"],
+                  compute: ({ record }) => `/p/${record.slug}`,
+                },
+              },
+            },
+          },
+        },
+      },
+    },
+  });
+  ```
+
+  What else changed:
+
+  - A field is defined at the root only. A `definition` in `application` or `client` is refused
+    (`CONFIG_FORBIDDEN_IN_OVERLAY`). Define the field
+    at the root; `application` and `client` can still add compute stages to it.
+  - Computed values chain. When the root and an overlay both compute a field, the root's stage runs first and the
+    overlay's receives its result as `value`. A stage can no longer be turned off with `false`. Returning `undefined`
+    keeps the current value. An upsert computes its create branch with `compute.create` and its update branch with
+    `compute.update`.
+  - A discovered field keeps the adapter's facts. On a field the adapter discovered you may restate its own `type`,
+    `nullable` and `list`, and give a Json field its shape (`definition.json`). Setting a different type, any `format`
+    or any `capabilities` on it is refused. `format` is for fields you add, and it must be one of zod's named string
+    formats (`"email"`, `"url"`, `"uuid"`, …); any other name is a type error and refused at startup.
+  - A misplaced key is a type error. In a configuration written inline in `createFramework({ ... })` or
+    `AventaraModule.forRoot`, a key that has no place there (a typo, an old key, `compute` on a relation field, a field
+    name neither your schema nor the root has) is now a type error at that key, and still refused at startup.
+  - A Resource whose name starts with `$` is refused at startup (`$` names are the framework's).
+  - The Json shape builder moved from `@aventara/core/json` to `@aventara/core/avz`. Change the import; `AvZ` is
+    the same.
+
+  `exposed` and `exemptions`, which replace `restrictions`, have their own entry.
+
+- 6317811: Breaking: `exposed` and `exemptions` replace `restrictions`. Every layer (the root, `application` and `client`)
+  says what it exposes with two keys: `exposed`, the layer's default, and `exemptions`, the entries that are the
+  opposite of it.
+
+  - `exposed: true` (the root's default) exposes everything the layer above offers, and `exemptions` lists what to
+    hide. `exposed: false` exposes nothing, and `exemptions` lists the only things to expose.
+  - In `exemptions`, `true` exempts an entry whole, `false` and `[]` exempt nothing, a list exempts the listed
+    entries one level down, and an object goes one level deeper. A Resource takes `true`, `false` or
+    `{ operations, fields }`. Operations are nested: `operations: { find: ["many"], update: { unique: true } }`.
+    A field takes a list of capability names, or an object per capability whose token lists name filter operators,
+    directives, reducers or pagination kinds.
+  - A list now always means "exempt these". rc.0's `filter: ["equals"]` meant "keep only `equals`"; under
+    `exposed: true` the same intent is the list of the operators to remove.
+  - Overlays only narrow. `application` and `client` start from the root's view. An overlay can no longer bring
+    back what the root hid (rc.0's `hidden: false`); that is now refused at startup, and the message names the other
+    overlay to hide it in instead. Expose an entry at the root and hide it in the overlay that must not see it.
+  - An overlay that sets `exemptions` must also set its own `exposed`.
+  - Relation positions are the adapter's: an exemption can no longer narrow where a relation is projected or written.
+  - A unique operation (`find.unique`, `update.unique`, `delete.unique`, `upsert.unique`) needs an identifier. Picking
+    one without the identifier's fields, or hiding every identifier while one stays exposed, is refused at startup
+    with `COMPILER_MISSING_IDENTIFIER` instead of the operation silently disappearing.
+
+  Every name in `exemptions` must exist, in both styles: a Resource, field, family, variant, capability or token the
+  adapter does not offer is refused at startup with its path (`COMPILER_UNKNOWN_RESOURCE`, `COMPILER_UNKNOWN_FIELD`,
+  `COMPILER_UNAVAILABLE_OPERATION`, `COMPILER_UNAVAILABLE_CAPABILITY`), and in a configuration written inline in
+  `createFramework({ ... })` it is a type error first. Under `exposed: true`, hiding in an overlay what the root
+  already hid does nothing.
+
+  Before (rc.0):
+
+  ```ts
+  createFramework({
+    api: "/api",
+    adapter,
+    restrictions: {
+      User: {
+        fields: {
+          passwordHash: { hidden: true },
+          email: { capabilities: { filter: ["equals"] } },
+        },
+      },
+    },
+    client: {
+      restrictions: {
+        AuditLog: { hidden: true },
+        Post: { operations: { delete: { unique: false } } },
+      },
+    },
+  });
+  ```
+
+  After (rc.1):
+
+  ```ts
+  createFramework({
+    api: "/api",
+    adapter,
+    // The root: `exposed` defaults to true, so these are hidden from every origin.
+    exemptions: {
+      resources: {
+        User: {
+          fields: {
+            passwordHash: true,
+            email: { filter: ["contains", "startsWith"] }, // remove every operator but `equals`
+          },
+        },
+      },
+    },
+    client: {
+      exposed: true,
+      exemptions: {
+        resources: {
+          AuditLog: true,
+          Post: { operations: { delete: ["unique"] } },
+        },
+      },
+    },
+  });
+  ```
+
+  Or expose only what a frontend calls:
+
+  ```ts
+    client: {
+      exposed: false,
+      exemptions: {
+        resources: {
+          Post: {
+            operations: { find: ["many", "unique"], create: ["one"] },
+            fields: { id: ["select"], title: ["select", "create"], body: ["select", "create"] },
+          },
+        },
+      },
+    },
+  ```
+
+  `aventara init` and `aventara new` now write `exposed: true` into `src/aventara.config.ts`, with a comment that
+  links the exposure documentation.
+
+- 9c52482: A `$connect` to a row that does not exist now answers `404 A2003` (not found), the same as reading a missing row.
+  Before, it answered `422 A2004`. This covers a to-one `$connect` in `create`, `update` and `upsert`, a to-many
+  `$connect`, and the same writes inside a transaction plan, where `cause.operation` names the step. The message is
+  unchanged: "The operation's arguments referenced a record that does not exist." On `update.first`, the same mistake
+  answered `A2014` before, as if the row had changed underneath; it now answers `A2003` too, and a duplicate unique value
+  written through `update.first` answers `409 A2008` instead of `A3001`.
+
+  Clearer top-level messages for an unknown Resource or operation. `A2001` now says "The requested Resource is not
+  available." and `A2002` says "The requested operation is not available on this Resource.", instead of "Operation
+  arguments failed framework validation.", which stays the message of `A2004`, `A2007` and `A2009`. A transaction step
+  whose operation is outside the standard grammar now carries the same issue message as a single call, naming the
+  operation and the Resource (for example `Operation "dance.one" is not available on Resource "posts".`), instead of
+  "Operation is not part of the standard operation grammar."
+
+  A `$ref` with no `fingerprint` is `V1000` (required value missing) and answers `422 A2004`. Before, it was `V1017`
+  (fingerprint mismatch) under `A2007`. A fingerprint that is present but wrong is still `V1017`.
+
+  `aventara init` and `aventara new` link to the documentation at https://aventara-framework.vercel.app. The old
+  address redirects, so links already written into projects keep working.
+
+- 8db76e7: `aventara new` and `aventara init` write a `diagnostics` sink into `src/aventara.config.ts`. When something fails
+  inside the server, the caller gets a plain 500 and the Nest log said only which request failed; the raw error went to
+  a sink the scaffold did not set. Now the sink logs the raw error with its stack through Nest's `Logger` (context
+  `Aventara`), at error level, right after that line. Replace it with your own reporter when you have one.
+
+- `aventara new` and `aventara init` write `api: '/api'` into `src/aventara.config.ts` (the root key was renamed from
+  `entrypoint`).
+
 ## 1.0.0-rc.0
 
 ### Major Changes

package/README.md

@@ -6,10 +6,11 @@ The `aventara` command: it scaffolds an Aventara server on NestJS 12.
 npm i -g @aventara/cli@rc  # or run it once: npx @aventara/cli@rc <command>
 aventara new my-api           # a new NestJS project with Aventara
 aventara init                 # Aventara added to the NestJS 12 project in this directory
+aventara skill                # refresh the agent skill for the installed @aventara/core
 ```
 
-It is run once, globally or through `npx`; it is not a dependency of the projects it writes. The frontend's side —
-`framework.client.ts` and the generated client — is `@aventara/client`'s (`npx @aventara/client@rc init`).
+It is run once, globally or through `npx`; it is not a dependency of the projects it writes. The frontend's side
+(`framework.client.ts` and the generated client) belongs to `@aventara/client` (`npx @aventara/client@rc init`).
 
 ## `aventara new <name>`
 
@@ -17,22 +18,24 @@ Runs the pinned `nest new` (`npx -y @nestjs/cli@12.0.8 new …`, or `pnpm dlx
 `src/app.module.ts` is what that version writes, then runs exactly `aventara init`'s pipeline over the new project and
 installs it. A directory that exists and is not empty is refused before anything runs.
 
-Once installed, the project gets its first git commit, `Initial Aventara Scaffold` — the lockfile in it, `.env` not
-(it is in `.gitignore`). No commit is made, and one line says why, when git is not installed, when git has no
+Once installed, the project gets its first git commit, `Initial Aventara Scaffold`, with the lockfile in it and
+without `.env` (it is in `.gitignore`). No commit is made, and one line says why, when git is not installed, when git has no
 `user.name`/`user.email`, or when the directory is already inside a git repository (a monorepo: commit it there).
 `--skip-git` makes no repository and no commit.
 
 ## `aventara init`
 
-Runs inside an existing **NestJS 12** project (refused: no `package.json`, another Nest major, TypeScript 7, a yarn-only
-lockfile, a project already initialized).
+Runs inside an existing NestJS 12 project. It refuses a directory with no `package.json`, another Nest major,
+TypeScript 7, a yarn-only lockfile, or a project already initialized.
 
-- **No ORM yet:** the ORM and the database are asked (or taken from the flags), and everything below is written.
-- **Prisma already there:** the installed Prisma must be one an Aventara adapter supports — today Prisma 7, `^7.10.0`,
-  SQLite or PostgreSQL, a driver adapter, the `prisma-client` generator — or the run is refused in one sentence, with
-  nothing written. Your schema, Prisma config and service are **reused and never written**, and your `.env` only gains
-  a `CORS_ORIGINS` line at its end when it has none; init finds the class extending `PrismaClient` and the module
-  exporting it, or asks.
+In a project with no ORM yet, the ORM and the database are asked (or taken from the flags), and everything below is
+written.
+
+In a project that already uses Prisma, the installed Prisma must be one an Aventara adapter supports, or the run is
+refused in one sentence with nothing written. Today that is Prisma 7 (`^7.10.0`) on SQLite or PostgreSQL, with a driver
+adapter and the `prisma-client` generator. Your schema, Prisma config and service are reused and never written, and
+your `.env` only gains a `CORS_ORIGINS` line at its end when it has none. Init finds the class extending `PrismaClient`
+and the module exporting it, or asks.
 
 ### Questions and flags
 
@@ -42,20 +45,20 @@ possible answer is shown, not asked.
 
 | Flag | Question | Default |
 |---|---|---|
-| `<name>` (`new` only) | The project directory. | — (required) |
+| `<name>` (`new` only) | The project directory. | required |
 | `--orm <alias>` | The ORM, as an adapter's alias: `prisma7` (Prisma 7, `@aventara/prisma7-adapter`). `--help` lists the aliases that exist. | the only one there is |
 | `--db <provider>` | The database: the adapter's providers (`sqlite`, `postgresql`). | `sqlite` |
-| `--package-manager <npm\|pnpm>` | — | the lockfile's, else the one that launched the CLI, else npm |
+| `--package-manager <npm\|pnpm>` | The package manager. | the lockfile's, else the one that launched the CLI, else npm |
 | `--prisma-service <path#Export>` (`init`) | Your Prisma service, when more than one, or none, is found. | the one found; none → write `src/prisma.service.ts` |
 | `--prisma-module <path#Export>` (`init`) | The Nest module that provides and exports it. | the one found |
 | `--skip-install` | Write the files; print the install instead of running it. | |
 | `--skip-git` (`new`) | Passed to `nest new`. | |
-| `-y`, `--yes` | Accept every unanswered default **and** replace existing content that differs. | |
+| `-y`, `--yes` | Accept every unanswered default, and replace existing content that differs. | |
 | `--verbose` | Show the output of `nest new` and the install as they run. | |
 
-While it works, each step is shown on stderr — `[3/4] Installing dependencies (npm install)` — with a spinner and the
-seconds so far on a terminal, or as one plain line per step (`… done (12.4s)`) in a pipe, in CI (`CI`) or with
-`NO_COLOR`; the output of `nest new` and the install is shown only if it fails, or with `--verbose`.
+While it works, each step is shown on stderr, such as `[3/4] Installing dependencies (npm install)`. On a terminal it
+has a spinner and the seconds so far; in a pipe, in CI (`CI`) or with `NO_COLOR` it is one plain line per step
+(`… done (12.4s)`). The output of `nest new` and the install is shown only if it fails, or with `--verbose`.
 
 Existing content that differs from what would be written (a `.env` key, a script, a file) is listed, and replaced only
 when you confirm, or with `--yes`; where nobody can be asked, the run stops and touches nothing.
@@ -64,17 +67,19 @@ when you confirm, or with `--yes`; where nobody can be asked, the run stops and
 
 | Path | Owner afterwards |
 |---|---|
-| `prisma/schema.prisma` — `prisma-client` generating into `src/generated/prisma`, a `User` model | you |
-| `prisma.config.ts` — loads `.env` itself (Prisma does not) | you |
-| `src/prisma.service.ts` — `PrismaService` extending the client with the driver adapter, refusing a missing `DATABASE_URL` before the server listens; `PrismaModule` | you |
-| `src/aventara.config.ts` — `aventaraConfig(prisma)`: the entrypoint (`/api`), and the restrictions and pipelines you add | you |
-| `src/app.module.ts` — one edit: the imports, `PrismaModule` and `AventaraModule.forRootAsync({ … })`; printed instead when the file is not the shape expected | you |
-| `test/app.e2e-spec.ts` — one edit: a `GET /api/_contract` → 200 test after Nest's `GET /` test; left alone when the file is not Nest's | you |
-| `src/main.ts` — one edit after `NestFactory.create`: `app.enableCors(…)` for the comma-separated origins in `CORS_ORIGINS`, and CORS off when it is unset or empty, then a commented-out platform-level rate limiter (`express-rate-limit`; Nest's `@nestjs/throttler` is a guard, which does not run on Aventara's routes); left alone when the file already configures CORS, printed when it has no such line | you |
+| `prisma/schema.prisma`: `prisma-client` generating into `src/generated/prisma`, a `User` model | you |
+| `prisma.config.ts`: loads `.env` itself (Prisma does not) | you |
+| `src/prisma.service.ts`: `PrismaService` extending the client with the driver adapter, refusing a missing `DATABASE_URL` before the server listens; `PrismaModule` | you |
+| `src/aventara.config.ts`: `aventaraConfig(prisma)`: the `api` mount path (`/api`), a `diagnostics` sink that logs the raw error of a server failure, with its stack, through Nest's `Logger`, and the `exposed`/`exemptions`, `pipelines` and `resources` you add | you |
+| `src/app.module.ts`: one edit that adds the imports, `PrismaModule` and `AventaraModule.forRootAsync({ … })`; printed instead when the file is not the shape expected | you |
+| `test/app.e2e-spec.ts`: one edit that adds a `GET /api/_contract` → 200 test after Nest's `GET /` test; left alone when the file is not Nest's | you |
+| `src/main.ts`: one edit after `NestFactory.create`: `app.enableCors(…)` for the comma-separated origins in `CORS_ORIGINS`, and CORS off when it is unset or empty, then a commented-out platform-level rate limiter (`express-rate-limit`; Nest's `@nestjs/throttler` is a guard, which does not run on Aventara's routes); left alone when the file already configures CORS, printed when it has no such line | you |
 | `.env` (`DATABASE_URL`, and `CORS_ORIGINS="http://localhost:5173,http://localhost:3001"` appended unless a line sets it), `.gitignore` (`/src/generated/`, `/dev.db*`, `.env`) | you |
-| `package.json` — `@aventara/*` at this CLI's version, `prisma`, `@prisma/client` and the driver at `7.10.0`; `aventara:prepare`, run by `postinstall` and by `prebuild`, `prestart`, `prestart:dev` and `prestart:debug`, and the `.env` on the start scripts and `test:e2e` (`--env-file`, `--env-file-if-exists`) | you |
-| `pnpm-workspace.yaml` (pnpm only) — `allowBuilds` for Prisma's and SQLite's install scripts | you |
-| `src/generated/prisma/**`, `src/generated/aventara/discovery.artifact.ts` | **generated** by `aventara:prepare` (run on every install, build and start, so a schema change needs only a restart); never edit |
+| `package.json`: `@aventara/*` at this CLI's version, `prisma`, `@prisma/client` and the driver at `7.10.0`; `aventara:prepare`, run by `postinstall` and by `prebuild`, `prestart`, `prestart:dev` and `prestart:debug`, and the `.env` on the start scripts and `test:e2e` (`--env-file`, `--env-file-if-exists`) | you |
+| `pnpm-workspace.yaml` (pnpm only): `allowBuilds` for Prisma's and SQLite's install scripts | you |
+| `src/generated/prisma/**`, `src/generated/aventara/discovery.artifact.ts` | generated by `aventara:prepare` (run on every install, build and start, so a schema change needs only a restart); never edit |
+| `.claude/skills/aventara/` (`SKILL.md`, `reference/*.md`, `.aventara-skill.json`): the agent skill your AI coding agent reads | Aventara's: `aventara skill` refreshes it, and keeps a file you changed unless `--force` |
+| `AGENTS.md`: an Aventara section between `<!-- aventara:start -->` and `<!-- aventara:end -->`, appended to an existing file | you, except the marked section |
 
 ### Next steps it prints
 
@@ -111,23 +116,37 @@ curl -s -X POST http://localhost:3000/api/_resources/User/find/many \
 Leave out an identity header and the answer is `400 A2000`, naming the header that is missing. The hash changes
 whenever the schema or the configuration does: fetch it again, and regenerate the client.
 
-- **Resource keys are the model names, as written.** `model User` is `User` everywhere: on the wire
-  (`/_resources/User/find/many`) and in the generated client (`avClient.User.find.many({})`). Nothing is renamed,
-  lower-cased or pluralized.
-- **Results are read-only.** A list result is a `readonly` array: type it `readonly User[]`, not `User[]` —
-  `const users: readonly User[] = await avClient.User.find.many({});`.
+Resource keys are the model names, as written. `model User` is `User` everywhere: on the wire
+(`/_resources/User/find/many`) and in the generated client (`avClient.User.find.many({})`). Nothing is renamed,
+lower-cased or pluralized.
+
+Results are read-only. A list result is a `readonly` array, so type it `readonly User[]`:
+`const users: readonly User[] = await avClient.User.find.many({});`.
+
+## `aventara skill`
+
+Writes the agent skill for the `@aventara/core` installed in the project in this directory: its version, and its
+`ERRORS.md` as `reference/errors.md`. It reads those files and runs none of the project's packages. A skill file it
+wrote before is replaced; one you changed is kept, with a warning, unless you pass `--force`. In `AGENTS.md` only the
+text between the Aventara markers is replaced (or the section appended), and `CLAUDE.md` is never written. Run it with
+the CLI at your `@aventara/core` version: `npx @aventara/cli@<version> skill`.
 
 ## Supported
 
-NestJS 12; Node `^22.18.0 || >=24.2.0` (on any other Node the bin refuses in one sentence naming that range;
-on Node 22 use npm ≥ 11 — Node 22's bundled npm 10 cannot install Nest 12's own scaffold; a CommonJS project's jest
-e2e needs Node ≥ 24.9, Nest's and Jest's limit); npm and pnpm (yarn is not supported); ESM and
-CommonJS projects; Prisma 7 (`^7.10.0`) on SQLite and PostgreSQL. The ORMs, majors, databases and drivers on offer are
-**generated** from the Aventara adapter packages that exist (`src/catalog/adapter.catalog.generated.ts`), never listed
-by hand: a future
-`@aventara/prisma8-adapter` appears by existing.
+- NestJS 12.
+- Node `^22.18.0 || >=24.2.0`. On any other Node the bin refuses in one sentence naming that range. On Node 22 use
+  npm ≥ 11, because Node 22's bundled npm 10 cannot install Nest 12's own scaffold. A CommonJS project's jest e2e needs
+  Node ≥ 24.9, which is Nest's and Jest's limit.
+- npm and pnpm. Yarn is not supported.
+- ESM and CommonJS projects.
+- Prisma 7 (`^7.10.0`) on SQLite and PostgreSQL.
+
+The ORMs, majors, databases and drivers on offer are generated from the Aventara adapter packages that exist
+(`src/catalog/adapter.catalog.generated.ts`), never listed by hand, so a future `@aventara/prisma8-adapter` appears
+once it exists.
 
 ## License
 
-PolyForm Shield 1.0.0 with an additional permission — free to use, including in commercial applications; you may not
-use it to build a product that competes with Aventara itself. See `LICENSE` and `LICENSE-ADDITIONAL-PERMISSION.md`.
+PolyForm Shield 1.0.0 with an additional permission. It is free to use, including in commercial applications, but you
+may not use it to build a product that competes with Aventara itself. See `LICENSE` and
+`LICENSE-ADDITIONAL-PERMISSION.md`.

package/dist/apply/conflict.confirmer.js

@@ -1,5 +1,5 @@
-export class ConflictsNotConfirmedError extends Error {
-    name = "ConflictsNotConfirmedError";
+export class AvConflictsNotConfirmedError extends Error {
+    name = "AvConflictsNotConfirmedError";
 }
 export function conflictWarning(conflicts) {
     return `${conflicts.join(", ")} already ${conflicts.length === 1 ? "has" : "have"} other content, and initializing will replace ${conflicts.length === 1 ? "it" : "them"}`;
@@ -10,7 +10,7 @@ export async function confirmConflicts(conflicts, consent) {
     }
     const them = conflicts.length === 1 ? "it" : "them";
     if (!consent.prompter.interactive) {
-        throw new ConflictsNotConfirmedError(`not initializing, and nothing was touched: ${conflicts.join(", ")} already ${conflicts.length === 1 ? "has" : "have"} other content and nobody can be asked (stdin is not a terminal); run \`aventara init --yes\` to replace ${them}`);
+        throw new AvConflictsNotConfirmedError(`not initializing, and nothing was touched: ${conflicts.join(", ")} already ${conflicts.length === 1 ? "has" : "have"} other content and nobody can be asked (stdin is not a terminal); run \`aventara init --yes\` to replace ${them}`);
     }
     consent.prompter.say(`aventara: warning: ${conflictWarning(conflicts)}.`);
     const answer = await consent.prompter.ask({
@@ -19,6 +19,6 @@ export async function confirmConflicts(conflicts, consent) {
         defaultValue: "N",
     });
     if (!/^y(?:es)?$/i.test(answer.trim())) {
-        throw new ConflictsNotConfirmedError(`cancelled, and nothing was touched; run again and answer yes to replace ${them}`);
+        throw new AvConflictsNotConfirmedError(`cancelled, and nothing was touched; run again and answer yes to replace ${them}`);
     }
 }

package/dist/cli.js

@@ -1,23 +1,25 @@
 import { readFileSync } from "node:fs";
-import { ConflictsNotConfirmedError } from "./apply/conflict.confirmer.js";
+import { AvConflictsNotConfirmedError } from "./apply/conflict.confirmer.js";
 import { ADAPTER_CATALOG } from "./catalog/adapter.catalog.generated.js";
-import { CliCommandError, commandUsage, parseCliCommand, usage, } from "./command/command.parser.js";
-import { ProjectRefusedError } from "./project/project.inspector.js";
+import { AvCliCommandError, commandUsage, parseCliCommand, usage, } from "./command/command.parser.js";
+import { AvProjectRefusedError } from "./project/project.inspector.js";
 import { runCommand } from "./run/command.runner.js";
-import { InstallFailedError, runInit } from "./run/init.orchestrator.js";
+import { AvInstallFailedError, runInit } from "./run/init.orchestrator.js";
 import { runNew } from "./run/new.orchestrator.js";
+import { AvSkillRefusedError, runSkill } from "./run/skill.orchestrator.js";
 import { progressModeOf } from "./run/step.reporter.js";
-import { UnansweredQuestionsError, } from "./wizard/answer.resolver.js";
-import { createReadlinePrompter, WizardCancelledError, } from "./wizard/readline.prompter.js";
-import { WizardAnswerError } from "./wizard/wizard.questions.js";
+import { AvUnansweredQuestionsError, } from "./wizard/answer.resolver.js";
+import { AvWizardCancelledError, createReadlinePrompter, } from "./wizard/readline.prompter.js";
+import { AvWizardAnswerError } from "./wizard/wizard.questions.js";
 const REFUSALS = [
-    CliCommandError,
-    WizardAnswerError,
-    UnansweredQuestionsError,
-    WizardCancelledError,
-    ProjectRefusedError,
-    ConflictsNotConfirmedError,
-    InstallFailedError,
+    AvCliCommandError,
+    AvWizardAnswerError,
+    AvUnansweredQuestionsError,
+    AvWizardCancelledError,
+    AvProjectRefusedError,
+    AvConflictsNotConfirmedError,
+    AvInstallFailedError,
+    AvSkillRefusedError,
 ];
 const MANIFEST = new URL("../package.json", import.meta.url);
 function ownVersion() {
@@ -38,6 +40,14 @@ export async function runCli(argv, io) {
             io.stdout(`${ownVersion()}\n`);
             return 0;
         }
+        if (command.command === "skill") {
+            return runSkill(command, {
+                directory: io.cwd,
+                stdout: io.stdout,
+                stderr: io.stderr,
+                cliVersion: ownVersion(),
+            });
+        }
         if (command.command === "init") {
             return await runInit(command, {
                 directory: io.cwd,

package/dist/command/command.parser.js

@@ -1,6 +1,6 @@
 import { INIT_FLAG_QUESTIONS, NEW_QUESTIONS, ormAliasesSentence, } from "../wizard/wizard.questions.js";
-export class CliCommandError extends Error {
-    name = "CliCommandError";
+export class AvCliCommandError extends Error {
+    name = "AvCliCommandError";
 }
 const OPTIONS = [
     {
@@ -72,7 +72,18 @@ On a terminal every unanswered question is asked; anywhere else, pass its flag
 or --yes, or the run stops before writing anything.
 `;
 }
+const SKILL_SUMMARY = "Write or refresh the agent skill (.claude/skills/aventara/) and the Aventara section of AGENTS.md, for the installed @aventara/core.";
+const SKILL_USAGE = `Usage: aventara skill [options]
+
+${SKILL_SUMMARY}
+
+Options:
+    --force  also replace skill files you changed (AGENTS.md outside the Aventara section is never touched)
+`;
 export function commandUsage(command, catalog) {
+    if (command === "skill") {
+        return SKILL_USAGE;
+    }
     return `Usage: ${SYNOPSIS[command]}
 
 ${SUMMARY[command]}
@@ -92,6 +103,8 @@ ${usageLines("new", catalog)}
   ${SYNOPSIS.init}         ${SUMMARY.init}
 ${usageLines("init", catalog)}
 
+  aventara skill [--force]       ${SKILL_SUMMARY}
+
   aventara --help                 Print this and exit 0.
   aventara <command> --help       Print that command's usage and exit 0.
   aventara --version, -v          Print this CLI's version and exit 0.
@@ -101,7 +114,7 @@ ${asked(catalog)}`;
 export function parseCliCommand(argv) {
     const [command, ...rest] = argv;
     if (command === undefined) {
-        throw new CliCommandError(`a command is required: new or init; ${HELP}`);
+        throw new AvCliCommandError(`a command is required: new, init or skill; ${HELP}`);
     }
     if (command === "--help" || command === "-h") {
         return { command: "help" };
@@ -109,8 +122,11 @@ export function parseCliCommand(argv) {
     if (command === "--version" || command === "-v") {
         return { command: "version" };
     }
+    if (command === "skill") {
+        return parseSkillCommand(rest);
+    }
     if (command !== "new" && command !== "init") {
-        throw new CliCommandError(`unknown command ${JSON.stringify(command)}: the commands are new and init; ${HELP}`);
+        throw new AvCliCommandError(`unknown command ${JSON.stringify(command)}: the commands are new, init and skill; ${HELP}`);
     }
     if (rest.includes("--help") || rest.includes("-h")) {
         return { command: "help", topic: command };
@@ -124,7 +140,7 @@ export function parseCliCommand(argv) {
         const argument = rest[index];
         if (!argument.startsWith("-")) {
             if (positional === undefined || given[positional.id] !== undefined) {
-                throw new CliCommandError(`unexpected argument ${JSON.stringify(argument)}: aventara ${command} takes ${positional === undefined ? "no" : "one"} positional argument; ${HELP}`);
+                throw new AvCliCommandError(`unexpected argument ${JSON.stringify(argument)}: aventara ${command} takes ${positional === undefined ? "no" : "one"} positional argument; ${HELP}`);
             }
             given[positional.id] = argument;
             continue;
@@ -137,20 +153,20 @@ export function parseCliCommand(argv) {
         const canonical = question?.flag ?? option?.flag ?? flag;
         if (question === undefined && option === undefined) {
             const elsewhere = ["new", "init"].filter((other) => QUESTIONS[other].some((candidate) => candidate.flag === flag));
-            throw new CliCommandError(elsewhere.length === 0
+            throw new AvCliCommandError(elsewhere.length === 0
                 ? `unknown flag ${flag}; ${HELP}`
                 : `${flag} is a flag of aventara ${elsewhere.join(" and ")}, not aventara ${command}; ${HELP}`);
         }
         if (option !== undefined && !option.commands.includes(command)) {
-            throw new CliCommandError(`${option.flag} is a flag of aventara ${option.commands.join(" and ")}, not aventara ${command}; ${HELP}`);
+            throw new AvCliCommandError(`${option.flag} is a flag of aventara ${option.commands.join(" and ")}, not aventara ${command}; ${HELP}`);
         }
         if (seen.has(canonical)) {
-            throw new CliCommandError(`${canonical} was given twice; ${HELP}`);
+            throw new AvCliCommandError(`${canonical} was given twice; ${HELP}`);
         }
         seen.add(canonical);
         if (question === undefined) {
             if (inline !== undefined) {
-                throw new CliCommandError(`${canonical} takes no value; ${HELP}`);
+                throw new AvCliCommandError(`${canonical} takes no value; ${HELP}`);
             }
             options[option.key] = true;
             continue;
@@ -158,7 +174,7 @@ export function parseCliCommand(argv) {
         const value = inline ?? rest[index + 1];
         if (value === undefined ||
             (inline === undefined && value.startsWith("-"))) {
-            throw new CliCommandError(`${canonical} takes a value; ${HELP}`);
+            throw new AvCliCommandError(`${canonical} takes a value; ${HELP}`);
         }
         if (inline === undefined) {
             index += 1;
@@ -174,3 +190,21 @@ export function parseCliCommand(argv) {
         ...(options.verbose === true ? { verbose: true } : {}),
     };
 }
+function parseSkillCommand(rest) {
+    if (rest.includes("--help") || rest.includes("-h")) {
+        return { command: "help", topic: "skill" };
+    }
+    let force = false;
+    for (const argument of rest) {
+        if (argument !== "--force") {
+            throw new AvCliCommandError(argument.startsWith("-")
+                ? `unknown flag ${argument.split("=")[0]}; ${HELP}`
+                : `unexpected argument ${JSON.stringify(argument)}: aventara skill takes no positional argument; ${HELP}`);
+        }
+        if (force) {
+            throw new AvCliCommandError(`--force was given twice; ${HELP}`);
+        }
+        force = true;
+    }
+    return { command: "skill", force };
+}