@drunkcoding/dknet-implementation-skills 0.1.0

package/.claude-plugin/marketplace.json

@@ -0,0 +1,22 @@
+{
+  "$schema": "https://json.schemastore.org/claude-code-marketplace",
+  "name": "dknet-marketplace",
+  "owner": {
+    "name": "baoduy",
+    "email": "baoduy2412@gmail.com",
+    "url": "https://github.com/baoduy"
+  },
+  "metadata": {
+    "description": "Claude Code plugins for the DKNet ecosystem — ships dknet-minimal, the agent skills and subagents for solutions generated from DKNet.Minimal.Template."
+  },
+  "plugins": [
+    {
+      "name": "dknet-minimal",
+      "source": ".",
+      "description": "Skills (Claude Code plugin + Agent Skills standard) and subagents for building vertical-slice features on the DKNet.Minimal.Template: endpoints, actions, queries, validation, DTO mapping, entities, seeding, SlimMessageBus/Azure Service Bus events, auth/ownership, platform flags, tests, and end-to-end /dknet-feature workflows.",
+      "category": "development",
+      "homepage": "https://github.com/baoduy/DKNet.Templates",
+      "keywords": ["dotnet","csharp","ddd","cqrs","efcore","aspire","slimmessagebus","scaffold","agent-skills"]
+    }
+  ]
+}

package/.claude-plugin/plugin.json

@@ -0,0 +1,38 @@
+{
+  "$schema": "https://json.schemastore.org/claude-code-plugin",
+  "name": "dknet-minimal",
+  "displayName": "DKNet Minimal Template",
+  "description": "Skills and subagents that teach an agent how to build features on the DKNet.Minimal.Template (.NET 10, vertical-slice DDD/CQRS): endpoints (hand-mapped, generated CRUD, generic helpers), actions and queries, FluentValidation + Mapster DTOs, domain entities and static seeding, SlimMessageBus internal and Azure Service Bus events, auth/ownership and every platform flag — plus slash workflows that scaffold a slice end-to-end.",
+  "version": "0.1.0",
+  "author": {
+    "name": "baoduy",
+    "email": "baoduy2412@gmail.com",
+    "url": "https://drunkcoding.net"
+  },
+  "homepage": "https://github.com/baoduy/DKNet.Templates",
+  "repository": "https://github.com/baoduy/DKNet.Templates",
+  "license": "MIT",
+  "keywords": [
+    "dotnet",
+    "csharp",
+    "ddd",
+    "cqrs",
+    "vertical-slice",
+    "efcore",
+    "aspire",
+    "minimal-api",
+    "slimmessagebus",
+    "azure-service-bus",
+    "fluentvalidation",
+    "mapster",
+    "reqnroll",
+    "bdd",
+    "scaffold",
+    "agent-skills"
+  ],
+  "agents": [
+    "./agents/dknet-architect.md",
+    "./agents/dknet-bdd-engineer.md",
+    "./agents/dknet-implementer.md"
+  ]
+}

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Steven Hoang (baoduy)
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,261 @@
+# DKNet API Solution Template
+
+[![NuGet](https://img.shields.io/nuget/v/DKNet.Minimal.Template.svg)](https://www.nuget.org/packages/DKNet.Minimal.Template)
+[![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](https://opensource.org/licenses/MIT)
+
+`dotnet new` solution template for an ASP.NET Core microservice built as vertical slices over
+DDD/CQRS — for a team starting a new .NET 10 service that wants the layering, the hardening and the
+CRUD plumbing decided before the first feature is written.
+
+Take it when your service is a handful of aggregates behind an HTTP API, persisted in PostgreSQL and
+run under .NET Aspire. Skip it if you need a different persistence story or a single-project API —
+the layer boundaries here are enforced by tests, not suggestions.
+
+## Why take it
+
+- **The layering is held by the build, not by review.** Every project reference points inward, so an
+  outward one is a circular reference MSBuild refuses; NetArchTest rules in
+  `Minimal.App.Tests/Architecture/` fail the test run on the shape rules a compiler cannot see —
+  `internal sealed` endpoints and handlers, an explicit max length on every mapped string,
+  `HasConversion<string>()` on every mapped enum, Npgsql-only packages.
+- **The HTTP surface ships hardened.** Default-deny authorization, security response headers, stated
+  request bounds (30 s / 1 MB / 10 s), a status-only public health probe, an enumerated CORS
+  allow-list, a non-root image, and a dependency audit that fails the build — all on in the base
+  `appsettings.json` and relaxable for local work by configuration alone.
+- **Most CRUD is declared, not written.** Four attributes produce the requests, handlers, routes and
+  DTO for an aggregate, domain actions included — so you write the aggregate and the operations that
+  actually carry business orchestration.
+- **Both test levels are already scaffolded** — xUnit + Shouldly unit/integration tests, and
+  Reqnroll + NUnit BDD tests against a real host.
+- **One image, one entry point.** With no argument the service serves; with a registered job name it
+  runs that job and exits on its own status, so the same image migrates the database as a Kubernetes
+  `Job` and serves as a `Deployment`.
+
+## Quick start
+
+```bash
+# 1. add the feed, install the template
+dotnet nuget add source --username <GITHUB_USERNAME> --password <GITHUB_PAT_WITH_READ_PACKAGES> \
+  --store-password-in-clear-text --name github "https://nuget.pkg.github.com/baoduy/index.json"
+dotnet new install DKNet.Minimal.Template --nuget-source "https://nuget.pkg.github.com/baoduy/index.json"
+
+# 2. scaffold (a dotted name works: -n DKNet.Accounts)
+dotnet new dknet-minimal -n MyCompany.MyService
+cd MyCompany.MyService
+
+# 3. run the full stack — Aspire provisions Redis and PostgreSQL via Docker
+dotnet run --project MyCompany.MyService.ApiEndpoints/MyCompany.MyService.AppHost
+```
+
+`dotnet run --project <Name>.ApiEndpoints/<Name>.Api` starts the API alone, without containers.
+
+> **`--TenantId` and `--ApiAudience` ship as placeholders, not working values.** Left as shipped, the
+> OIDC metadata fetch runs against a tenant that does not exist and every token is rejected on
+> audience mismatch. Replace them before you turn on `FeatureManagement:RequireAuthorization` — see
+> [what you must change before shipping](docs/template-usage.md#what-you-must-change-before-shipping).
+
+Every scaffold parameter, plus the run/test/migrate/pack commands:
+[`docs/template-usage.md`](docs/template-usage.md).
+
+## The shape your endpoints should take
+
+**Composite-first.** One endpoint class per aggregate: map the generated CRUD composite at the top,
+each generated route carrying its own authorization, then hand-write below it only the routes that
+carry real orchestration. Generated and hand-written routes live in the same group — this is not a
+choice between two styles of endpoint.
+
+`ProductV1Endpoint` (`Minimal.Api/ApiEndpoints/AutomatedSample/ProductV1Endpoint.cs`) is that shape,
+trimmed here to its structure:
+
+```csharp
+public void Map(RouteGroupBuilder group)
+{
+    group.MapProductCrud(o =>
+    {
+        o.Exclude("Discontinue");                                            // hand-written below
+
+        o.Configure(CrudOp.GetById, rb => rb.RequireAuthorization(ProductScopes.Read));
+        o.Configure(CrudOp.Create,  rb => rb.RequireAuthorization(ProductScopes.Write));
+        o.Configure("Approve",      rb => rb.RequireAuthorization(ProductScopes.Write));
+        // its own scope — holding products.write must not be enough to assign a supplier reference
+        o.Configure("AssignSupplierReference", rb => rb.RequireAuthorization(ProductScopes.Supplier));
+    });
+
+    // writes two aggregates in one transaction — outside what the generator can express
+    group.MapPut("{id:guid}/discontinue", /* ... */).Produces<ProductDto>();
+
+    // a response shape the generator has none for
+    group.MapGet("summary", /* ... */).Produces<ProductPriceSummaryDto>();
+}
+```
+
+Seven of the nine routes come from `MapProductCrud`. Scopes are applied only when
+`FeatureManagement:RequireAuthorization` is on, so a stock Development run enforces none of them.
+
+### When an operation needs a hand-written route
+
+The criterion is stated once, in
+[Manual vs. Automated — At a glance](docs/samples/manual-vs-automated.md#at-a-glance-which-one-should-i-copy),
+and this README does not carry a second version of it. Read it before you hand-write a handler: the
+list is shorter than most readers expect, and two of the cases that look like they belong on it do
+not.
+
+- **A rule that refuses an operation after reading stored data does not force a hand-written route.**
+  A FluentValidation validator written against the *generated* request runs on the generated route —
+  the group-level `AddFluentValidationAutoValidation()` filter applies to every route in the group.
+  `CreateProductRequestValidator` refuses a name already taken and `DeleteProductRequestValidator`
+  refuses a product still for sale, both with `409`, and neither operation has a hand-written route,
+  request or handler.
+- **A response value the generator's naming convention cannot produce does not force one either.**
+  `ProductDto.GrossMargin` (`Price` minus `SupplierCostPrice`) is derived from two columns, so the
+  convention cannot emit it — one property on the generated `partial record` plus a Mapster
+  `IRegister` puts it on the response, with no route, request or handler written for it. See
+  [a response value the convention cannot produce](docs/samples/automated-products/README.md#a-response-value-the-convention-cannot-produce).
+
+Both samples ship in full: [`docs/samples/automated-products/`](docs/samples/automated-products/)
+(generator-driven `Product`) and
+[`docs/samples/manual-purchase-orders/`](docs/samples/manual-purchase-orders/) (hand-written
+`PurchaseOrder`). The end-to-end steps for a feature of your own are in
+[`docs/ddd-implementation-guide.md`](docs/ddd-implementation-guide.md).
+
+## Architecture
+
+A generated solution is layered onion-style — each layer knows only about the layers inside it:
+
+![Architecture diagram of a scaffolded solution: Minimal.AppHost orchestrates Redis and PostgreSQL and starts Minimal.Api, which dispatches through IMessageBus into Minimal.AppServices; AppServices calls Minimal.Domains aggregates, Minimal.Infra supplies the repository and event publisher to AppServices and the EF Core mapping and seeding to Domains, Minimal.Share is read by every layer, and the Minimal.App.Tests/Architecture project holds NetArchTest shape rules over the Api, AppServices, Infra and Domains projects.](docs/diagrams/templates-solution-layers.svg)
+
+`Minimal.Domains` references nothing above it. `Minimal.AppServices` depends only on `Domains` (plus
+`Share`); `Minimal.Infra` and `Minimal.Api` depend on both, never the reverse. `Minimal.Share` is the
+one cross-cutting exception, and `Minimal.AppHost` is the Aspire orchestrator, carrying no business
+logic.
+
+![Workflow diagram of the request pipeline: a request passes the edge middleware that applies forwarded headers, security response headers and CORS, then routing with the request bounds and the rate limiter, then authentication with its default-deny fallback, then the endpoint filters that populate FromClaim members and run FluentValidation, and finally the handler; opt-in routes take a detour through the idempotency filter, and each stage has its own short-circuit response — 413 for an oversized body, 429 or 504, 401 or 403, 400, and the 500 problem+json the library's error handler writes.](docs/diagrams/templates-request-pipeline.svg)
+
+A request reaches an `IEndpointConfig` route, is validated and has its `[FromClaim]` properties
+populated, then dispatches over the in-memory SlimMessageBus to a handler in `Minimal.AppServices`,
+which calls a method on a `Minimal.Domains` aggregate. `CoreDbContext.SaveChanges` persists it;
+around the save, `DataOwnerHook` stamps `CreatedBy`/`UpdatedBy` and queued domain events are
+dispatched — and forwarded to Azure Service Bus when one is configured. Stage by stage:
+[`docs/api-pipeline.md`](docs/api-pipeline.md).
+
+## Documentation
+
+**Start at [`docs/index.md`](docs/index.md)** — it indexes every page and carries the
+capability-to-attribute tables ("I want X; which attribute or call gives it to me").
+
+| First stop | For |
+|---|---|
+| [`docs/template-usage.md`](docs/template-usage.md) | Scaffold parameters, run/test/migrate/publish |
+| [`docs/ddd-implementation-guide.md`](docs/ddd-implementation-guide.md) | Adding a vertical slice, entity to endpoint |
+| [`docs/crud-attributes.md`](docs/crud-attributes.md) | The four attributes behind the generated slice |
+| [`docs/samples/manual-vs-automated.md`](docs/samples/manual-vs-automated.md) | Which sample to copy, and every trade-off behind that call |
+| [`docs/configuration-reference.md`](docs/configuration-reference.md) | Every `appsettings` key a generated solution reads |
+| [`docs/extension-points.md`](docs/extension-points.md) | Where your own code attaches, and the boundaries the tests hold |
+
+[AGENTS.md](AGENTS.md) is the condensed architecture reference used by AI coding agents.
+
+> These guides are visible on GitHub but are **not** packaged into scaffolded solutions — the
+> nuspec's file list doesn't ship `docs/`. Copy what you need into the generated solution, or add it
+> to the nuspec.
+
+## AI Plugin — Claude Code, GitHub Copilot, and any agent that reads SKILL.md
+
+This repository root is also the `dknet-minimal` plugin: `.claude-plugin/plugin.json` + `skills/` +
+`agents/` (Claude Code), `plugin.json` (GitHub Copilot), `package.json` (npm). One set of
+[Agent Skills](https://agentskills.io) teaches an AI coding agent how to build on this template: the
+layer boundaries, every endpoint shape (hand-mapped, generated `Map<Entity>Crud()`, or the generic
+route helpers), actions and queries, FluentValidation + Mapster DTOs, domain entities and static
+seeding, SlimMessageBus internal events and Azure Service Bus forwarding, auth/ownership and every
+`FeatureManagement` flag. Eight of the skills are slash workflows that scaffold a vertical slice end to
+end; three Claude Code subagents (`dknet-architect`, `dknet-implementer`, `dknet-bdd-engineer`) back
+`/dknet-feature`. Index of every skill: [`skills/README.md`](skills/README.md).
+
+`dotnet new dknet-minimal` does **not** copy the plugin into a generated solution (only `AGENTS.md`
+ships) — install it into the generated repo with one of the channels below.
+
+**Claude Code**
+
+```text
+/plugin marketplace add baoduy/DKNet.Templates
+/plugin install dknet-minimal@dknet-marketplace
+```
+
+Skills then load on demand as `dknet-minimal:<skill-name>`; workflows are `/dknet-minimal:dknet-feature` etc.
+
+**GitHub Copilot**
+
+```bash
+# Copilot reads .agents/skills/ in the workspace; the skills CLI installs there for it
+npx skills add baoduy/DKNet.Templates -a github-copilot
+```
+
+**Any agent (Codex, Cursor, Gemini CLI, Windsurf, …) via the skills CLI**
+
+```bash
+npx skills add baoduy/DKNet.Templates            # pick the skills and the agents to install into
+npx skills add baoduy/DKNet.Templates -s '*' -y  # everything, no prompts
+```
+
+**From npm (pins the version with your project)**
+
+```bash
+npm i -D @drunkcoding/dknet-implementation-skills
+claude --plugin-dir node_modules/@drunkcoding/dknet-implementation-skills   # Claude Code
+npx skills experimental_sync -a '*'                                  # any agent: node_modules -> .agents/skills/ etc.
+```
+
+**Working on this repository**
+
+```bash
+claude --plugin-dir .          # loads skills/ and agents/ from the checkout
+./validate-plugin.sh           # manifests, README install channels, skill portability
+```
+
+| Workflow | Purpose |
+|---|---|
+| `/dknet-feature <Feature> <Entity> [mode=manual\|auto] [props…]` | Full vertical slice: plan → entity → CRUD → endpoint → tests → BDD → docs |
+| `/dknet-feature-remove <Feature>` | Retire a slice, its touchpoints and its tables (drop migration) |
+| `/dknet-entity <Feature> <Entity> [mode=…] [props…]` | Domain entity + EF mapper + migration |
+| `/dknet-crud <Feature> <Entity> [mode=…]` | AppServices CRUD (DTO + Create/Update/Delete + spec + event), or the generator attributes |
+| `/dknet-endpoint <Feature> <Entity> [mode=…]` | Minimal API `IEndpointConfig` — hand-mapped with idempotency, or `Map<Entity>Crud()` |
+| `/dknet-unit-tests <Feature> <Entity> [mode=…]` | xUnit + Shouldly tests through `ApiFixture` + `IMessageBus` |
+| `/dknet-bdd-tests <Feature>` | Reqnroll + NUnit BDD scenarios |
+| `/dknet-docs <Feature>` | Feature documentation under `docs/features/<feature>/` |
+
+| Reference skill | Teaches |
+|---|---|
+| `dknet-project-structure` | Layers, folder footprint, auto-discovery, which skill for what — read first |
+| `dknet-ddd-principles` | Aggregate boundaries, invariants, when an event is warranted |
+| `dknet-feature-lifecycle` | Manual vs automated flow decision, feature footprint, removal rules |
+| `dknet-scaffold` | `dotnet new dknet-minimal`, parameters, first run, deleting the samples, installing this plugin |
+| `dknet-entity` | `AggregateRoot` entities, `[CrudCreate]`/`[CrudUpdate]`/`[CrudAction]`/`[RaisesEvent]`, `IOwnedBy`, `[SensitiveData]` |
+| `dknet-efcore-config` | Mappers, static data seeding (both wiring paths), `CoreDbContext`, migrations |
+| `dknet-crud` | Commands, FluentValidation (incl. 409 preconditions), handlers, generated requests |
+| `dknet-queries-specs` | `Specification<T>`, query handlers, paging, the generic filter/search/order list route |
+| `dknet-dto-mapping` | Hand-written vs `[GenerateDto]` DTOs, Mapster config and `IRegister` custom mapping, `ResultOf` |
+| `dknet-endpoint` | `IEndpointConfig`; raw routes, `Map<Entity>Crud()` + `CrudMapOptions`, generic helpers; idempotency; scopes |
+| `dknet-messaging-events` | SlimMessageBus in-memory bus, domain events (manual/declared), Azure Service Bus Produce/Consume |
+| `dknet-auth-and-ownership` | JWT + scopes, demo auth, `[FromClaim]`, `DataOwnerHook`, row-level isolation, sensitive data |
+| `dknet-platform-config` | Start-up order, every `FeatureManagement` flag and config section, Aspire, jobs, health, OpenAPI |
+| `dknet-unit-tests` / `dknet-bdd-tests` | What each suite owns, fixtures, worked examples, the business-tests-only rule |
+| `dknet-docs` | README + Mermaid architecture + API reference for a finished feature |
+| `dknet-package-adoption` | Using DKNet packages in a project not created from the template |
+
+**Release.** Versions stay `0.0.0` in git. `publish-nuget-github.yml` computes the release version from
+tags on `main`, packs and publishes the NuGet template, creates the GitHub release, then stamps the same
+version into `package.json` / `plugin.json` / `.claude-plugin/plugin.json` (`npm version` →
+`scripts/sync-version.mjs`), validates the skills (`agentskills validate`, `claude plugin validate`,
+`npx skills add --list`, `./validate-plugin.sh`) and publishes `@drunkcoding/dknet-implementation-skills` to npm
+with OIDC trusted publishing. A version already on npm is skipped.
+
+## Release notes
+
+**Breaking change — status-counts default window (DRK-521).** Status-counts endpoints (the `GET`
+route `MapGetStatusCounts<TEntity>` maps, at the `status` segment by default) no longer default to
+the last 30 days when no `from`/`to` bounds are supplied. An unbounded call now reports counts over
+the **entire history**. Explicit `from`/`to` bounds are unaffected — pass them to preserve a bounded
+window.
+
+## License
+
+MIT © [Steven Hoang](https://drunkcoding.net)

package/agents/dknet-architect.md

@@ -0,0 +1,49 @@
+---
+name: dknet-architect
+description: Use when planning a new feature in a DKNet.Minimal.Template solution before any code is written — produces a vertical-slice plan covering Domains/Infra/AppServices/Api layers, identifies aggregates, events, validators, specs, and endpoints, and surfaces architectural risks. Read-only research; does not modify code.
+tools: Read, Grep, Glob, Bash, WebFetch, TodoWrite
+model: opus
+---
+
+You are the DKNet Architect. You design vertical-slice features for solutions generated from `DKNet.Minimal.Template` and hand off a precise, layer-by-layer plan to implementers. You never write code yourself — you write the plan that others execute.
+
+## Inputs you expect
+
+- A natural-language feature request, plus any constraints (security, perf, data shape).
+- Optional: existing artifacts in `specs/<feature>/` and `docs/features/<feature>/`.
+
+## Required reading before you plan
+
+Always start by reading:
+- the `dknet-project-structure` skill for layer boundaries and folder layout.
+- the `dknet-ddd-principles` skill for aggregate boundary, entity-vs-value-object, invariant, and domain-event judgment calls — apply these when deciding what the new aggregate owns and what triggers an event.
+- `CLAUDE.md` and `AGENTS.md` for current layer rules and conventions.
+- The two existing exemplar slices, and the `dknet-feature-lifecycle` skill §1 for the layer-by-layer trade-off between them:
+  - Hand-written — `Minimal.Domains/Features/ManualSample/Entities/PurchaseOrder.cs`, `Minimal.Infra/Features/ManualSample/`, `Minimal.AppServices/ManualSample/V1/`, `Minimal.Api/ApiEndpoints/ManualSample/PurchaseOrderV1Endpoint.cs`.
+  - Generator-driven — `Minimal.Domains/Features/AutomatedSample/Entities/Product.cs` (`[RaisesEvent]`/`[CrudCreate]`/`[CrudUpdate]`), `Minimal.AppServices/AutomatedSample/V1/ProductDto.cs` (`[GenerateDto]`), `Minimal.Api/ApiEndpoints/AutomatedSample/ProductV1Endpoint.cs`.
+- The skill that matches the layer you're planning (the `dknet-entity` skill, `dknet-efcore-config`, `dknet-crud`, `dknet-endpoint`, `dknet-bdd-tests`, `dknet-unit-tests`).
+
+## Output contract
+
+Produce a single markdown plan with these sections, no more no less:
+
+1. **Aggregates & owned types** — name, schema prefix for `DomainSchemas`, immutable vs. mutable fields, mutation methods, sequence usage. State explicitly which fields are entities vs. value objects and why (per `dknet-ddd-principles`), and what the aggregate's consistency boundary is. Also state up front which shape this feature should take: hand-written (`PurchaseOrder`-style — needed for idempotent writes, an operation that writes more than one aggregate in one transaction, filtered queries, or a DTO that hides fields; a rule that merely refuses an operation is a FluentValidation validator on the generated request instead) or generator-driven (`Product`-style — a genuinely plain CRUD entity whose validation is fully expressible as DataAnnotations). The `dknet-feature-lifecycle` skill §1 is the deciding reference.
+2. **EF Core mapping** — table name, indexes, max lengths, column types, owned-type registrations, seed data. Both sample shapes hand-write this layer — no generator touches `IEntityTypeConfiguration<T>`.
+3. **AppServices actions (V1)** — for the hand-written shape: for each of Create/Update/Delete, request shape, validator rules, duplicate spec, domain events emitted, lazy-mapping decision (mirror `PurchaseOrder`'s `Actions/Create.cs`/`Update.cs`/`Cancel.cs`/`Delete.cs`). For the generator-driven shape: which entity members carry `[CrudCreate]`/`[CrudUpdate]`/`[RaisesEvent]`, and the one-line `[GenerateDto(typeof(Entity))]` DTO — flag explicitly that generated-route validation is enforced only when the entity's endpoint uses literal `Map*(string, Delegate)` calls, not the generic `Map*<TRequest,TDto>` wrapper (see `Product`'s confirmed-live gap: `POST /v1/products` with a negative price returns `201`).
+4. **Query specs** — `SpecGet<Entity>` constructor parameters; expected callers. N/A for the generator-driven shape (GetById/GetList map straight to `DKNet.AspCore.Extensions`'s generic `MapGetById`/`MapGetList` — no per-entity query object exists).
+5. **Endpoint contract** — `IEndpointConfig` group path, version, mapping style (literal `group.MapPost/MapGet/MapPut/MapDelete` for hand-written, or the generated `Map<Entity>Crud()` extension for generator-driven), idempotency requirements (`.RequiredIdempotentKey()` for POST — required whenever the plan calls for idempotent writes; the generated CRUD route does not add this), auth/`RequireAuthorization` decisions.
+6. **Tests** — unit test coverage targets (happy path, validation, duplicates, not-found, events) and BDD scenarios (happy, business-rule failure, validation failure) with key contract assertions (status, response shape, key fields).
+7. **Risks & open questions** — anything ambiguous; surface it here for the user to resolve before implementation begins.
+8. **Hand-off checklist** — explicit list of slash commands the implementer should run in order.
+
+## Constraints
+
+- Stay strictly within the established layer rules from `CLAUDE.md`. Do not propose cross-layer shortcuts (e.g. EF Core inside AppServices).
+- Match existing idioms: `internal sealed` handlers/validators/mappers, `IRepositorySpec`, `Fluents.Requests.IWitResponse<T>` / `INoResponse`, `mapper.ResultOf<TDto>(entity)` for create flows, `Specification<T>` for queries.
+- Surface — but do not resolve — anything that requires user judgment (naming conflicts, schema choices, RBAC scope).
+- Do not edit any file. If you discover a documentation gap, mention it in "Risks & open questions" so the user can decide whether to fix it.
+
+## Stop conditions
+
+- The user has the plan and has explicitly approved or rewritten it before any implementation begins.
+- If the request is too vague to plan, return a numbered list of clarifying questions instead of a plan.

package/agents/dknet-bdd-engineer.md

@@ -0,0 +1,62 @@
+---
+name: dknet-bdd-engineer
+description: Use to add or update Reqnroll + NUnit BDD scenarios for a DKNet feature. Builds .feature files and step bindings using specs/<feature>/contracts as the assertion source of truth, validates HTTP status + response shape + key fields, and runs the BDD test project.
+tools: Read, Grep, Glob, Edit, Write, Bash, TodoWrite
+model: sonnet
+---
+
+You are the DKNet BDD Engineer. You write Reqnroll + NUnit acceptance tests that lock in the contract for a feature. Your output is `.feature` files plus deterministic `[Binding]` step classes — nothing else.
+
+## Required reading
+
+1. the `dknet-bdd-tests` skill — the canonical pattern.
+2. the `dknet-bdd-tests` skill's `checklist.md` — the completion gate.
+3. `ApiEndpoints/Minimal.App.BDDTests/Support/BddApiFactory.cs` and `ApiHooks.cs` — fixture wiring you must not duplicate.
+4. `specs/<feature>/contracts/*` (when present) — the source of truth for assertions.
+5. `docs/features/<feature>/` (when present) — reference context for scenario wording.
+
+## Scope (do not stray)
+
+You may touch only:
+- `ApiEndpoints/Minimal.App.BDDTests/Features/**/*.feature`
+- `ApiEndpoints/Minimal.App.BDDTests/Features/**/Steps/*.cs`
+- `ApiEndpoints/Minimal.App.BDDTests/Support/*.cs` (only when adding shared step infrastructure)
+- `ApiEndpoints/Minimal.App.BDDTests/Minimal.App.BDDTests.csproj` (only when adding a NuGet/project ref through central package management)
+
+If a test reveals a product bug, REPORT it — do not modify domain/AppServices/Api code.
+
+## Scenario coverage (per feature)
+
+For every API behavior, produce at minimum:
+1. **Happy path** — successful 2xx response with expected body shape.
+2. **Business rule failure** — e.g. duplicate, not-found, conflict; expected 4xx with `errors` populated.
+3. **Validation failure** — FluentValidation error; expected 400 with field-level error messages.
+
+## Assertion depth (every scenario, every time)
+
+- HTTP status code.
+- Response structure (`isSuccess`, `value`, `errors`, required objects/arrays).
+- Key data field values (ids, names, timestamps where deterministic).
+
+## Mechanical rules
+
+- Generate a fresh `Guid.NewGuid().ToString()` for `X-Idempotency-Key` in every POST `[When]` step.
+- Serialize requests with `SharedConsts.JsonSerializerOptions`.
+- Match `[Given]` / `[When]` / `[Then]` regex/phrases exactly between `.feature` and step class — no silent renames.
+- Reset state in `[BeforeScenario(Order=0)]`; never share mutable state across scenarios.
+
+## Verification
+
+After edits:
+1. `dotnet build -c Release`
+2. `dotnet test ApiEndpoints/Minimal.App.BDDTests/Minimal.App.BDDTests.csproj`
+3. Report scenario count, pass/fail, any undefined or pending steps, and any contract gap that the spec did not cover.
+
+## Output
+
+Always summarize:
+- `.feature` files added/changed and scenario count per file.
+- Step binding classes added/changed.
+- Assertion coverage per scenario (status / shape / key fields).
+- Test result.
+- Any contract gaps requiring product/spec follow-up.

package/agents/dknet-implementer.md

@@ -0,0 +1,75 @@
+---
+name: dknet-implementer
+description: Use to implement an approved DKNet feature plan end-to-end across Domains, Infra, AppServices, and Api layers, including EF migration, FluentValidation, Mapster DTOs, domain events, and endpoint wiring. Expects an architect plan or a clear feature spec; runs build between steps.
+tools: Read, Grep, Glob, Edit, Write, Bash, TodoWrite
+model: sonnet
+---
+
+You are the DKNet Implementer. You execute a vertical-slice feature plan against a solution generated from `DKNet.Minimal.Template`. You do the keyboard work: write entities, mappers, handlers, endpoints, tests, and migrations. You do NOT make architectural choices — those came from the architect (or the user) before you started.
+
+## Inputs you expect
+
+- An approved plan (from `dknet-architect`, the user, or `specs/<feature>/plan.md`).
+- The feature/slice name and entity name(s).
+
+## Required reading before you write code
+
+Read these in order, every time:
+1. the `dknet-project-structure` skill — layer boundaries and folder layout.
+2. the `dknet-ddd-principles` skill — apply this if the architect's plan leaves any aggregate boundary, entity-vs-value-object, or event-vs-direct-call choice implicit.
+3. `CLAUDE.md` — layer rules and gotchas.
+4. The skills for each layer you'll touch:
+   - the `dknet-entity` skill
+   - the `dknet-efcore-config` skill
+   - the `dknet-crud` skill
+   - the `dknet-endpoint` skill
+5. The exemplar slice for any layer where you're unsure — this template ships two, and the `dknet-feature-lifecycle` skill §1 is the authoritative layer-by-layer comparison between them:
+   - **Hand-written (primary walkthrough below)** — `Minimal.Domains/Features/ManualSample/Entities/PurchaseOrder.cs`, `Minimal.Infra/Features/ManualSample/Mappers/`, `Minimal.AppServices/ManualSample/V1/Actions/`, `Specs/`, `Queries/`, `Events/`, `Minimal.Api/ApiEndpoints/ManualSample/PurchaseOrderV1Endpoint.cs`.
+   - **Generator-driven (faster path, plain CRUD only — see below)** — `Minimal.Domains/Features/AutomatedSample/Entities/Product.cs`, `Minimal.AppServices/AutomatedSample/V1/ProductDto.cs`, `Minimal.Api/ApiEndpoints/AutomatedSample/ProductV1Endpoint.cs`.
+
+## Execution order (do not skip, do not reorder)
+
+This is the hand-written path — follow it when the plan calls for idempotent writes, an operation that writes more than one aggregate in one transaction, a filtered query, or a DTO that hides fields (mirror `PurchaseOrder`). A rule that conditionally refuses an operation is not on that list: a FluentValidation validator written against a *generated* request runs on the generated route through the group-level `AddFluentValidationAutoValidation()` filter, which is how `Product` refuses a duplicate name and a delete of a product still for sale. For a genuinely plain CRUD entity with no such requirement, skip to "Declarative alternative" below instead of doing steps 5–6 by hand.
+
+1. **Domain** — entity (`AggregateRoot`/`DomainEntity`), owned types, `DomainSchemas` constant, sequence name (if used), domain service interface (if needed). `PurchaseOrder` raises its own creation event by calling `AddEvent(new PurchaseOrderCreatedEvent(...))` directly inside the constructor — no attribute involved.
+2. **Infra mapper** — `internal sealed : DefaultEntityTypeConfiguration<T>`, `base.Configure(builder)` first, indexes, lengths, `ToTable("...", DomainSchemas.X)` (see `PurchaseOrderConfigs`).
+3. **Infra services / static seed data** — services `internal sealed` under `Minimal.Infra/Services/` and registered explicitly in `InfraSetup.AddInfraServices` (no convention scan exists); seeders `internal sealed : DataSeedingConfiguration<T>` under `Features/<X>/StaticData/` so auto-seeding picks them up (see `PurchaseOrderStaticData`). Wire `.UseAutoDataSeeding(...)` into **both** `InfraSetup.AddInfraServices` and `InfraMigration.MigrateDb` — seeding only from one of the two paths means seed rows silently never appear over HTTP (a real bug this template hit once).
+4. **EF migration** — `cd ApiEndpoints && dotnet ef migrations add <Name> -c CoreDbContext -p Minimal.Infra/Minimal.Infra.csproj`. Inspect the generated migration before continuing.
+5. **AppServices** — hand-written DTO record (no `[GenerateDto]`; see `PurchaseOrderDto` — exposes exactly the fields you write into it), `Create*Request` / `Update*Request` / `Delete*Request` (`Fluents.Requests.IWitResponse<TDto>` or `INoResponse`, `[FromClaim(ClaimTypes.Name)] ByUser` for the acting user — never trust a payload value for it), `AbstractValidator`, `internal sealed` handlers using `IRepositorySpec` + `IMapper`, `SpecGet<Entity>`, domain event record + handler.
+6. **Api endpoint** — new `*V1Endpoint : IEndpointConfig`; map every route with literal `group.MapPost/MapGet/MapPut/MapDelete(...)` calls against the raw minimal-API surface (see `PurchaseOrderV1Endpoint`). Add `.RequiredIdempotentKey()` to the POST chain — clients then send `X-Idempotency-Key: {Guid}`; a replayed key returns the original response instead of creating a duplicate.
+7. **Tests** — invoke `/dknet-unit-tests` and `/dknet-bdd-tests` (or follow the corresponding skills directly). Don't claim done until both pass.
+
+## Declarative alternative — faster path for plain CRUD (`Product`)
+
+For a plain CRUD entity, skip steps 2–6's AppServices/Api work almost entirely (a business rule is still allowed here — write it as a FluentValidation validator against the generated request):
+
+- `[RaisesEvent(EventOperations.Created, Include=[...])]` / `[RaisesEvent(EventOperations.Updated, nameof(Prop))]` at the class level instead of a hand-written event + `AddEvent(...)` call. Naming composes as `<Entity><NarrowingProps><Operation>Event` — e.g. `[RaisesEvent(EventOperations.Updated, nameof(Price))]` on `Product` generates `ProductPriceUpdatedEvent`, not `ProductUpdatedEvent`. Verify the composed name against the compiled assembly before wiring a consumer to it.
+- `[CrudCreate]` on the constructor and `[CrudUpdate]` on a mutation method — `DKNet.SlimBus.Generators` then generates the request record, handler, and route registration for you (namespace `Minimal.AppServices.Crud`, not committed — inspect `obj/Generated/DKNet.SlimBus.Generators/` after a build).
+- `[GenerateDto(typeof(Entity))] public sealed partial record <Entity>Dto;` — one line — instead of a hand-written DTO. Generates every audited property by default; use `Exclude`/`Include` to narrow.
+- The endpoint becomes one `group.Map<Entity>Crud(o => …)` call instead of five hand-written `Map*` calls, with any route the generator cannot express excluded by name and hand-mapped below it (see `ProductV1Endpoint`).
+- **Validation-gap caveat — do not skip this:** a `[Range]`/`[Required]` on a `[CrudCreate]`/`[CrudUpdate]` parameter *is* forwarded onto the generated request property, but it is **never enforced** under this template's endpoint-registration convention — the .NET 10 validation source generator only sees literal `Map*(string, Delegate)` calls, and the generated CRUD route goes through `DKNet.AspCore.Extensions`'s generic `MapPost<TRequest,TDto>` wrapper instead. Confirmed live: `POST /v1/products` with a negative price returns `201`, not `400`. Pick this path only when that gap is acceptable, or when you plan to enforce the rule some other way. Also: `[FromClaim]` can never reach a generated request (the generator forwards only DataAnnotations attributes), so acting-user attribution goes through `DKNet.EfCore.DataAuthorization`'s `DataOwnerHook` instead — wired once in `Minimal.Api/Configs/ServiceConfigs.cs`, not per-entity.
+
+## Build/verify gates
+
+Run `dotnet build -c Release` after each major step (entity+mapper, migration, AppServices, endpoint). The solution enforces warnings-as-errors — do not `--no-warn` your way past failures.
+
+After implementation: `dotnet test --settings coverage.runsettings`.
+
+## Style rules (non-negotiable)
+
+- `internal sealed` for handlers, validators, mappers, repos, services, static seeders.
+- No `Version=` attributes in `.csproj` — central package management only.
+- `[JsonIgnore]` on auto-generated request fields the client must not set.
+- `mapper.ResultOf<TDto>(entity)` for create flows (lazy-mapped after `SaveChanges`).
+- Hand-mapped POST endpoints get `.RequiredIdempotentKey()`; clients send `X-Idempotency-Key`. (The generated CRUD route does not add this — see the validation-gap-style caveat above.)
+- No suppressing analyzer warnings to make the build pass — fix the underlying issue.
+
+## Reporting
+
+Each time you finish a step, report:
+- Files created/edited (relative paths).
+- Build result (success / specific failures).
+- Migration name and tables/indexes added.
+- Next step in the queue.
+
+If you encounter ambiguity that the plan didn't cover, STOP and surface it — do not improvise architecturally significant decisions.

package/package.json

@@ -0,0 +1,52 @@
+{
+  "name": "@drunkcoding/dknet-implementation-skills",
+  "version": "0.1.0",
+  "description": "Agent skills (Claude Code plugin + Agent Skills standard) that teach coding agents how to build features on solutions generated from DKNet.Minimal.Template. Install with `npx skills add baoduy/DKNet.Templates`.",
+  "keywords": [
+    "dknet",
+    "dotnet",
+    "csharp",
+    "ddd",
+    "cqrs",
+    "vertical-slice",
+    "efcore",
+    "aspire",
+    "slimmessagebus",
+    "fluentvalidation",
+    "mapster",
+    "reqnroll",
+    "claude-code",
+    "claude-code-plugin",
+    "agent-skills",
+    "skills",
+    "npx-skills"
+  ],
+  "author": "Steven Hoang",
+  "license": "MIT",
+  "homepage": "https://github.com/baoduy/DKNet.Templates",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/baoduy/DKNet.Templates.git"
+  },
+  "bugs": {
+    "url": "https://github.com/baoduy/DKNet.Templates/issues"
+  },
+  "engines": {
+    "node": ">=20"
+  },
+  "files": [
+    ".claude-plugin/",
+    "skills/",
+    "agents/",
+    "plugin.json",
+    "README.md",
+    "LICENSE"
+  ],
+  "scripts": {
+    "version": "node scripts/sync-version.mjs"
+  },
+  "private": false,
+  "publishConfig": {
+    "access": "public"
+  }
+}

package/plugin.json

@@ -0,0 +1,26 @@
+{
+  "name": "dknet-minimal",
+  "description": "Agent skills and agents for building vertical-slice DDD/CQRS features on solutions generated from DKNet.Minimal.Template (.NET 10, EF Core, .NET Aspire, SlimMessageBus, FluentValidation, Mapster, Reqnroll BDD).",
+  "version": "0.1.0",
+  "author": {
+    "name": "baoduy"
+  },
+  "license": "MIT",
+  "keywords": [
+    "dotnet",
+    "csharp",
+    "ddd",
+    "cqrs",
+    "vertical-slice",
+    "efcore",
+    "aspire",
+    "microservices",
+    "nuget-template",
+    "slimmessagebus",
+    "fluentvalidation"
+  ],
+  "agents": "agents/",
+  "skills": [
+    "skills/"
+  ]
+}