create-relkit 0.7.2 → 0.7.6

package/dist/templates/default/v1/minimal/.agents/skills/relkit/references/jobs-apis.md

@@ -0,0 +1,49 @@
+# Tasks and jobs
+
+Use a task for work that must outlive its initiating request; a function remains a request- or event-scoped operation.
+
+## `defineTask`
+
+```ts
+import { defineTask } from "@relkit/app/tasks";
+import { z } from "@relkit/app/schema";
+
+export default defineTask({
+  id: "orders.export-orders",
+  version: "1",
+  execution: "durable",
+  input: z.object({ orderIds: z.array(z.string()) }),
+  output: z.object({ exported: z.number().int().nonnegative() }),
+  progress: z.object({ completed: z.number().int().nonnegative() }),
+  handler: async ({ orderIds }, context) => {
+    await context.progress.emit({ completed: orderIds.length });
+    return { exported: orderIds.length };
+  },
+});
+```
+
+## `defineJob`
+
+Bind the task to a public job name and an explicit client policy in `src/services/orders/jobs/export-orders.job.ts`:
+
+```ts
+import { defineJob } from "@relkit/app/jobs";
+import exportOrders from "@app/services/orders/tasks/export-orders.task.js";
+
+export default defineJob({
+  id: "orders.export-orders-job",
+  name: "exportOrders",
+  task: exportOrders,
+  client: {
+    public: true,
+    operations: ["trigger", "get", "list", "watch"],
+    fields: ["status", "progress", "output"],
+  },
+});
+```
+
+Expose the task and job through the owning service's `tasks` and `jobs` maps. Keep the task ID and version stable; change the version for an intentional incompatible task contract. Make side effects idempotent because work may retry or resume.
+
+The app's `relkit.config.ts` selects a compatible jobs provider. Run `bun run relkit jobs capabilities` to inspect its actual guarantees; a durable task needs a binding that supports durable execution. `relkit add task` and `relkit add job --target <task-id>` scaffold the pair without running a worker or provisioning a provider.
+
+A trigger admits work and returns a run handle, not the task's output. Keep its `runId` and `operationId`, then read or watch the run; a typed client alone does not authorize a caller. A raw HTTP trigger can return the accepted handle with status `202`. Use `bun run relkit local status` to inspect local provider state before exercising a Docker-backed job.

package/dist/templates/default/v1/minimal/.agents/skills/relkit/references/layout-migration.md

@@ -0,0 +1,35 @@
+# Optional flat layout migration
+
+Flat `src/<name>/service.ts` applications remain supported. Migrate only when grouped placement helps the app. Preview from the application root:
+
+```sh
+bun run relkit migrate layout
+bun run relkit --json migrate layout
+```
+
+The deterministic plan moves complete service roots to `src/services/<name>`, including helpers and assets. It reports import, test, tooling, documentation, and local guidance rewrites, conflicts, and references needing manual action. Preview leaves authored files, lockfiles, generated output, persistent state, migration history, and credentials unchanged.
+
+Stop the app's active development session and resolve touched tracked changes, occupied destinations, mixed boundaries, symlinks, and ambiguous/computed references before applying:
+
+```sh
+bun run relkit migrate layout --write
+```
+
+Write stages the candidate with installed dependencies and requires baseline/candidate check, typecheck, logical graph, and offline deployment compatibility before publication. It does not install packages, run database migrations or seeds, provision providers, or edit global skills. Publication is coordinated across files; the restricted local receipt retains exact before/after bytes and permissions for failure or crash recovery. Keep that receipt private.
+
+Rollback with the exact path returned by the write result:
+
+```sh
+bun run relkit migrate layout --rollback .relkit/migrations/RECEIPT_ID/receipt.json
+```
+
+Rollback refuses later edits or occupied original locations instead of overwriting them. Recovery conflicts preserve user bytes and require inspection of the retained receipt. Successful migration or restoration needs fresh preparation:
+
+```sh
+bun run check
+bun run typecheck
+bun run relkit dev --prepare
+bun run dev
+```
+
+Compare actual application responses and durable runs after the move. Logical service/function/task/job/channel/agent IDs and versions remain unchanged; diagnostic and editor paths point at their real grouped sources.

package/dist/templates/default/v1/minimal/.agents/skills/relkit/references/observability-apis.md

@@ -0,0 +1,53 @@
+# Observability and tracing
+
+RELKIT records HTTP requests and invocation spans automatically. Use `context.log` for structured application records and `context.trace` for application work inside an existing function that needs more detail.
+
+## Log and trace inside a function
+
+```ts
+import { defineFunction } from "@relkit/app/functions";
+import { z } from "@relkit/app/schema";
+
+export default defineFunction({
+  id: "orders.total",
+  input: z.object({ quantity: z.number().int().positive() }),
+  output: z.object({ totalCents: z.number().int().nonnegative() }),
+  handler: async ({ quantity }, context) => {
+    const totalCents = await context.trace.span(
+      "pricing.calculate",
+      { attributes: { "pricing.strategy": "catalog" } },
+      async () => quantity * 1_000,
+    );
+    context.trace.event("pricing.calculated", { "pricing.total_cents": totalCents });
+    context.trace.setAttributes({ "pricing.quantity": quantity });
+    context.log.info("orders.total.calculated", { quantity, totalCents });
+    return { totalCents };
+  },
+});
+```
+
+`span(name, callback)` creates an internal child span; `span(name, { attributes, kind }, callback)` adds attributes and an `internal` or `client` kind. `event(name, attributes?)` adds an event to the active span, and `setAttributes` annotates it. RELKIT ends child spans on success or failure. Attribute values must be strings, finite numbers, or booleans. Do not log secrets or put payloads or random IDs in span attributes.
+
+## Configure capture and export
+
+Edit the existing `relkit.config.ts` and preserve its environment and provider settings:
+
+```ts
+import { defineApp } from "@relkit/app/config";
+import env from "@app/platform/env.js";
+
+export default defineApp({
+  env,
+  telemetry: {
+    redaction: { mode: "development-redacted", maxBytes: 65_536 },
+    localRetention: { maxRecords: 2_000, maxAgeMs: 3_600_000, maxBytes: 16_777_216 },
+    exportSampling: { traceRate: 0.25, minimumLogLevel: "info" },
+  },
+  server: { port: 3000 },
+  inspector: { port: 3210 },
+});
+```
+
+The template already supplies redaction. `localRetention` bounds development history; `exportSampling` controls remote export independently of local capture. Add named Sentry or OTLP exporters only when those integrations and their secret environment bindings are configured. Redact before storage or export. No `relkit add observability` kind exists; configure `telemetry` in `defineApp`.
+
+Run `bun run dev`, make one identifiable HTTP request, then inspect Requests, Traces, and Logs in the Inspector. Use `bun run dev -- --verbose` for DEBUG terminal output or `--json` for structured terminal records. Development history is stored in `.relkit/observability/observability.duckdb`; this is diagnostic history, not business storage.

package/dist/templates/default/v1/minimal/.agents/skills/relkit/references/realtime-apis.md

@@ -0,0 +1,98 @@
+# Realtime channels
+
+Use a channel to notify connected clients about a change. Keep the authoritative state in a route or database query; use channel events to refresh or update that state. Application events deliver backend work, while channels deliver live client updates.
+
+## `defineChannel`
+
+Create `src/services/announcements/channels/announcements.channel.ts`:
+
+```ts
+import { defineChannel } from "@relkit/app/realtime";
+import { z } from "@relkit/app/schema";
+
+const announcements = defineChannel({
+  id: "announcements.feed",
+  params: z.object({}),
+  events: { posted: z.object({ message: z.string(), postedAt: z.string() }) },
+  client: { public: true },
+  replay: { retentionMs: 300_000, maxEvents: 1_000 },
+});
+
+export default announcements;
+```
+
+`params` selects a partition, `events` validates named payloads, and `client` controls browser exposure. Omit `client` for backend-only channels. Use `client: { authorize: async (params, context) => ... }` for protected partitions and verify access to the specific resource, not merely that a session exists. `presence: "count"` adds connection counts. A channel with no events must declare presence.
+
+## Publish and subscribe
+
+After the application change succeeds, publish one validated event from a backend function:
+
+```ts
+import { defineFunction } from "@relkit/app/functions";
+import { z } from "@relkit/app/schema";
+import announcements from "@app/services/announcements/channels/announcements.channel.js";
+
+export default defineFunction({
+  id: "announcements.post",
+  input: z.object({ message: z.string().min(1) }),
+  output: z.object({ accepted: z.literal(true) }),
+  handler: async ({ message }) => {
+    await announcements.trigger({}, "posted", {
+      message,
+      postedAt: new Date().toISOString(),
+    });
+    return { accepted: true as const };
+  },
+});
+```
+
+The `trigger()` receipt confirms the provider accepted the append; it does not prove delivery to every browser. If a database write and publication must be atomic, use an outbox in the database transaction. A retryable publish can pass a RELKIT-issued `idempotencyKey` as the fourth argument.
+
+In a React client with `@relkit/client`, subscribe using the generated channel registry:
+
+```tsx
+"use client";
+
+import { useChannel, useRoute } from "@relkit/client/react";
+
+export default function Announcements() {
+  const announcements = useRoute("GET /announcements", { input: {} });
+  const channel = useChannel("announcements.feed", {
+    params: {},
+    on: { posted: () => void announcements.refetch() },
+    onCaughtUp: async () => {
+      await announcements.refetch();
+    },
+    onGap: async () => {
+      await announcements.refetch();
+    },
+  });
+
+  return <p>Channel: {channel.status}</p>;
+}
+```
+
+Load authoritative state through a route before relying on updates. `onGap` must restore it when replay cannot bridge a disconnect. `channel.status` and `channel.caughtUp` report connection and recovery state. `useRealtime()` is the lower-level subscription manager; a channel descriptor's `getPresence(params)` reads presence when declared.
+
+## Provider and verification
+
+Configure a compatible `realtime` provider and `defaults.realtime` in `relkit.config.ts`. For a one-machine app with `@relkit/local` installed, the relevant configuration is:
+
+```ts
+import { defineApp } from "@relkit/app/config";
+import { localRealtime } from "@relkit/local";
+import env from "@app/platform/env.js";
+
+export default defineApp({
+  env,
+  realtime: localRealtime(),
+  defaults: { realtime: "default" },
+  telemetry: { redaction: { mode: "development-redacted", maxBytes: 65_536 } },
+  server: { port: 3000 },
+  inspector: { port: 3210 },
+});
+```
+
+Merge these fields into an existing `defineApp` while preserving its other providers and settings. Redis supports fanout across application instances. Provider storage, retention, and Redis persistence determine recovery guarantees. Run `bun run check`, `bun run typecheck`, then test publication, browser subscription, reconnect, and gap recovery. Inspect channels in the Inspector while `bun run dev` is running.
+
+The current `relkit add` kinds do not include `channel`. Create the descriptor and provider configuration in the app source.

package/dist/templates/default/v1/minimal/.agents/skills/relkit/references/streaming-apis.md

@@ -0,0 +1,75 @@
+# Streaming responses
+
+Use a typed stream when one request returns a sequence to its caller. It ends with that request and can be cancelled. A realtime channel notifies connected clients across requests; a job watch follows one accepted background run. Agent and job content streams have their own client contracts.
+
+## `streamOf` with `defineFunction`
+
+Create a function in `src/services/reports/functions/stream-report.function.ts`:
+
+```ts
+import { defineFunction, streamOf } from "@relkit/app/functions";
+import { z } from "@relkit/app/schema";
+
+export default defineFunction({
+  id: "reports.stream",
+  input: z.object({ reportId: z.string().min(1) }),
+  output: streamOf(z.object({ completed: z.number().int(), total: z.number().int() })),
+  handler: async function* (_input, context) {
+    for (let completed = 1; completed <= 10; completed += 1) {
+      if (context.signal.aborted) return;
+      yield { completed, total: 10 };
+    }
+  },
+});
+```
+
+`streamOf(itemSchema)` validates each yielded item. The iterator is lazy and single-consumer; its invocation scope stays open until completion or cancellation. Expose this function from its domain service before mapping it to HTTP.
+
+For protected data, read the authenticated session and enforce ownership inside the
+function. Verify an authorized stream through the actual generated HTTP server to
+its completion event, then check other users/tenants and cancellation cleanup.
+Direct test-runtime invocation alone does not verify request context through lazy
+iterator pulls. Keep public descriptors as plain TypeScript.
+
+## `defineRoute` for a stream
+
+In `src/routes/reports/[reportId]/route.ts`, import the public service member:
+
+```ts
+import { defineRoute, http } from "@relkit/app/routes";
+import reports from "@app/services/reports/service.js";
+
+export const GET = defineRoute({
+  target: reports.streamReport,
+  request: http.input({ reportId: http.path("reportId") }),
+  client: { operation: "query" },
+  stream: { format: "sse" },
+});
+```
+
+A function-backed stream preserves typed items and failures with the managed client. Native SSE sends `relkit-item` events and an explicit completion or sanitized error event. For custom text, byte, or Web stream responses, use a raw `defineRoute({ handler })` and a Web `Response`. A raw response does not provide the managed item contract.
+
+## `useStream` in React
+
+With `@relkit/client` and a generated route registry:
+
+```tsx
+"use client";
+
+import { useStream } from "@relkit/client/react";
+
+export default function Report() {
+  const report = useStream("GET /reports/:reportId");
+
+  return (
+    <section>
+      <button onClick={() => void report.start({ reportId: "daily" })}>Start</button>
+      <button onClick={() => report.cancel()}>Cancel</button>
+      <p>Status: {report.status}</p>
+      <p>Items: {report.items.length}</p>
+    </section>
+  );
+}
+```
+
+`useStream` also exposes `reset`. Query-classified streams can opt into `autoStart`; mutation streams require an explicit `start`. Cancelling or ending iteration releases upstream work. Test item validation, normal completion, cancellation, and a failure after the first item by exercising the HTTP/client path.

package/dist/templates/default/v1/minimal/.agents/skills/relkit/references/testing-apis.md

@@ -0,0 +1,71 @@
+# Testing a RELKIT application
+
+Generated projects use Bun's test runner and `@relkit/testing`. Start with the existing `tests/unit` and `tests/integration` examples, then test the boundary that owns the behavior. Keep external providers and test state explicit; `RELKIT_ENV=test` alone does not select fakes.
+
+## Direct function tests
+
+`invokeFunction` runs a function descriptor through RELKIT's input/output validation and handler path without an HTTP server. Import a service's public function through its `service.ts` when testing the public member:
+
+```ts
+import { expect, test } from "bun:test";
+import { invokeFunction } from "@relkit/testing";
+import orders from "@app/services/orders/service.js";
+
+test("createOrder calculates its total", async () => {
+  await expect(
+    invokeFunction(orders.createOrder, { orderId: "order-1", sku: "book", quantity: 3 }),
+  ).resolves.toEqual({ orderId: "order-1", sku: "book", totalCents: 300 });
+});
+```
+
+Pass explicit `env`, `context`, `clients`, or other `InvokeFunctionOptions` when the function needs them. Test invalid input and declared errors as well as success. Direct invocation does not test route mapping or middleware.
+
+For several invocations that share a deterministic clock or provider state, use `createTestRuntime({ app, env, providers, startTimeMs })` and `runtime.invoke(target, input)`. `runtime.clock.advance(ms)` controls its test clock. Always `await runtime.close()` in `finally` or `afterAll`.
+
+## Application and HTTP tests
+
+`createTestApplication` discovers the generated project's routes and services. Pass its existing `relkit.config.ts`; `resourceProviders: "fake"` explicitly replaces graph-required resource providers for local tests:
+
+```ts
+import { afterAll, expect, test } from "bun:test";
+import { createTestApplication } from "@relkit/testing";
+import config from "../../relkit.config.js";
+
+const app = await createTestApplication(config, { resourceProviders: "fake" });
+afterAll(() => app.close());
+
+test("POST /orders maps and validates input", async () => {
+  const response = await app.http.request("/orders", {
+    method: "POST",
+    headers: { "content-type": "application/json" },
+    body: JSON.stringify({ orderId: "order-1", sku: "book", quantity: 3 }),
+  });
+  expect(response.status).toBe(201);
+  expect(await response.json()).toEqual({ orderId: "order-1", sku: "book", totalCents: 300 });
+});
+```
+
+Use `app.http.request`, `get`, or other client methods to assert status, body, and headers. Add requests for invalid input, anonymous callers, and unauthorized resource access where relevant. The harness has `runtime`, `clock`, `fakes`, and `observability` for controlled state and inspection. Options include `env`, `environment`, `bindingValues`, `providers`, and `projectRoot`; use explicit values for test-only configuration. This in-process HTTP boundary does not prove the full production middleware, cookie/origin policy, OpenAPI, or network transport. Verify those against a running backend when relevant.
+
+## Provider and feature tests
+
+- `createTestCacheFake`, `createTestBucketFake`, `createTestJobFake`, and `createTestEventFake` provide owned, inspectable test dependencies. `createTestFakes` groups native clients. Close any separately created fake after use. Replace every configured provider profile the graph needs, not only the one under direct assertion.
+- `createTestHttpClient` exercises a standalone in-memory HTTP application. Use `createTestApplication` when route discovery and service wiring matter. `createTestRealtimeProvider` and `createTestAgentStateProvider` supply local stateful provider replacements.
+- `createTestModel`, `createTestAgent`, and `assertAgentTrace` support deterministic agent execution. Use scripted responses and inspect tool calls or traces instead of live model calls or sleeps.
+- For jobs, assert behavior beyond the descriptor shape: input/output, accepted run handle, progress, retry or cancellation policy, and idempotency where applicable. Use the test job adapter or fake appropriate to the contract.
+- For database and auth integration, migrate an isolated temporary database before starting the application. Supply both parsed RELKIT environment and any native auth process environment required by the provider; close the app before removing test-owned files. Test public and protected requests with real cookies and separate users. A direct function mock does not verify migrations, sessions, or route protection.
+- For realtime, streaming, and observability, test the exposed route or channel contract and recorded events/spans as applicable. Use a running backend for actual transport, connection, and browser behavior.
+
+## Run the generated project checks
+
+```sh
+bun test tests/unit/hello.function.test.ts
+bun run test:unit
+bun run test:integration
+bun run test
+bun run check
+bun run typecheck
+bun run build
+```
+
+Run only scripts present in the generated `package.json`; the task template may have a different test layout. Keep Docker, external providers, and cloud acceptance as explicit integration gates. The installed `@relkit/testing` declarations and the project's existing tests are the source for exact helper options.

package/dist/templates/default/v1/minimal/README.md

@@ -16,3 +16,13 @@ bun run build
 
 The example route is `GET /hello?name=RelKit`. The default project needs no
 Docker daemon, cloud account, or deployment credentials.
+
+Hello lives in `src/services/hello/`, with its public boundary at `service.ts`
+and behavior in `functions/hello.function.ts`. Routes stay in `src/routes/`;
+shared configuration belongs in `src/platform/`. Public descriptors and
+ordinary handlers remain plain TypeScript.
+
+Creation with installation prepares development automatically. After
+`--no-install`, run `bun install` and `bunx --no-install relkit dev --prepare`
+before `bun run dev`. Existing flat applications remain supported; additions
+preserve their root, and `bun run relkit migrate layout` previews an optional move.

package/dist/templates/default/v1/minimal/package.json

@@ -15,12 +15,13 @@
     "graph": "relkit graph print"
   },
   "dependencies": {
-    "@relkit/app": "0.7.2"
+    "@relkit/app": "0.7.6",
+    "effect": "4.0.1"
   },
   "devDependencies": {
     "@types/bun": "1.3.10",
-    "@relkit/cli": "0.7.2",
-    "@relkit/testing": "0.7.2",
+    "@relkit/cli": "0.7.6",
+    "@relkit/testing": "0.7.6",
     "typescript": "5.9.3"
   }
 }

package/dist/templates/default/v1/minimal/src/routes/hello/route.ts

@@ -1,5 +1,6 @@
+/** Maps the HTTP endpoint to its owning service's public member. */
 import { defineRoute } from "@relkit/app/routes";
-import hello from "@app/hello/service.js";
+import hello from "@app/services/hello/service.js";
 
 export const GET = defineRoute({
   target: hello.hello,

package/dist/templates/default/v1/minimal/src/{hello → services/hello}/functions/hello.function.ts

@@ -1,3 +1,4 @@
+/** Returns a validated named greeting and logs each invocation through RELKIT's request context. */
 import { defineFunction } from "@relkit/app/functions";
 import { z } from "@relkit/app/schema";
 
@@ -5,6 +6,12 @@ const hello = defineFunction({
   id: "hello.greet",
   input: z.object({ name: z.string().min(1).default("world") }),
   output: z.object({ message: z.string() }),
+  /**
+   * Logs the greeting invocation and returns the validated greeting response.
+   * @param input - Validated name from the function schema.
+   * @param context - RELKIT invocation context owning structured logging.
+   * @returns Greeting response matching the output schema.
+   */
   handler: async ({ name }, context) => {
     context.log.info("hello invoked", { name });
     return { message: `Hello, ${name}!` };

package/dist/templates/default/v1/minimal/src/services/hello/service.ts

@@ -0,0 +1,5 @@
+/** Declares the hello service boundary and its public members. */
+import { defineService } from "@relkit/app/services";
+import hello from "@app/services/hello/functions/hello.function.js";
+
+export default defineService({ functions: { hello } });

package/dist/templates/default/v1/minimal/tests/unit/hello.function.test.ts

@@ -1,6 +1,7 @@
+/** Checks hello.function through the supported public RELKIT APIs. */
 import { expect, test } from "bun:test";
 import { invokeFunction } from "@relkit/testing";
-import hello from "@app/hello/functions/hello.function.js";
+import hello from "@app/services/hello/functions/hello.function.js";
 
 test("hello returns a greeting", async () => {
   await expect(invokeFunction(hello, { name: "Mustafa" })).resolves.toEqual({

package/dist/templates/default/v1/minimal/tsconfig.json

@@ -8,6 +8,7 @@
     "paths": { "@app/*": ["src/*"] },
     "lib": ["ES2022"],
     "types": ["bun"],
+    "typeRoots": ["./node_modules/@types"],
     "plugins": [{ "name": "@relkit/cli/editor" }],
     "strict": true,
     "noUncheckedIndexedAccess": true,

package/dist/templates/default/v1/tasks/.agents/skills/relkit/SKILL.md

@@ -0,0 +1,48 @@
+---
+name: relkit
+description: Build or extend a RELKIT CLI-generated application using its installed scaffolding and project commands. Use for application config, environments, services, functions, routes, auth, database, jobs, providers, and related app work.
+---
+
+# Work in a RELKIT application
+
+Run commands from the generated application's root, where `relkit.config.ts` and `package.json` live. Use `bun run relkit` to invoke the project's installed CLI. Check `bun run relkit <command> --help` before relying on an option, especially after a dependency upgrade.
+
+## Source placement
+
+New projects place every generic, database, and auth boundary at `src/services/<name>/service.ts`. Keep its functions, events, tasks, jobs, tools, agents, channels, schemas, resources, helpers, and assets under that service. Routes live at `src/routes`; configuration support and environment contracts live at `src/platform`. Application descriptors use plain TypeScript and supported public APIs; Effect imports are not required.
+
+Existing flat projects with `src/<name>/service.ts` remain supported. `relkit add` preserves the detected layout; empty projects default to grouped. Never mix flat and grouped boundaries or add an aggregate `src/services/service.ts`. Across services and from routes, import only the destination's `service.ts`; Platform cannot import services or Routes. Ordinary helpers do not become independently discovered descriptors.
+
+Read [layout migration](references/layout-migration.md) before moving an existing app. Keep logical IDs, exposure, provider profiles, and durable contract versions stable during a source-only move.
+
+## Add application artifacts
+
+Inspect the existing `src/` tree and `relkit.config.ts` before scaffolding. Prefer `relkit add` for supported artifacts, then edit the generated source for the required behavior. An interactive terminal can prompt for missing choices; scripts and noninteractive runs should provide the kind, name, service, route mode, and mappings explicitly.
+
+Read [the CLI reference](references/cli.md) for commands and option patterns covering services, functions, routes, auth, database, and the other add kinds.
+
+## Authoring API references
+
+Read only the reference relevant to the requested change. These examples describe the template's public APIs; check the installed package's TypeScript declarations when an exact option or signature matters.
+
+- [Application configuration and environments](references/config-environments.md)
+- [Functions, services, events, and errors](references/domain-apis.md)
+- [HTTP routes and request policy](references/http-apis.md)
+- [Streaming responses](references/streaming-apis.md)
+- [Tasks and jobs](references/jobs-apis.md)
+- [Agents, tools, and prompts](references/agent-apis.md)
+- [Database, auth, cache, and storage](references/data-apis.md)
+- [Realtime channels](references/realtime-apis.md)
+- [Observability and tracing](references/observability-apis.md)
+- [Testing functions, routes, and providers](references/testing-apis.md)
+
+## Working conventions
+
+- Generic domain services own callable functions and public event contracts. Other domains and routes should import a service's public members through its `service.ts`.
+- A service route maps HTTP methods to existing public callable members. A raw route is a standalone handler. The CLI will not overwrite an existing route file.
+- Database and auth are singletons under `src/services/database` and `src/services/auth`; extend an existing one instead of creating another. Auth may create a database baseline if none exists. Scaffolding does not run migrations, create secrets, or provision cloud resources.
+- Preserve existing application configuration, environment fields, service members, routes, and user changes when specializing generated files.
+
+## Verify the result
+
+Review the CLI's created and updated files, warnings, and next steps. Run `bun run check`, `bun run typecheck`, and focused tests after editing. For HTTP work, exercise the route itself; a direct function test does not cover request mapping. Database and auth work also needs the reported environment and migration steps before runtime verification.

package/dist/templates/default/v1/tasks/.agents/skills/relkit/references/agent-apis.md

@@ -0,0 +1,59 @@
+# Agents, tools, and prompts
+
+| API                                             | Import               | Role                                 |
+| ----------------------------------------------- | -------------------- | ------------------------------------ |
+| `defineAgent`, `defineGraph`, `defineGraphNode` | `@relkit/app/agents` | Model-driven agent or explicit graph |
+| `defineTool`                                    | `@relkit/app/tools`  | Policy-controlled view of a function |
+| `definePrompt`                                  | `@relkit/app`        | Reusable instructions                |
+| `z`                                             | `@relkit/app/schema` | Agent and tool schemas               |
+
+## `defineAgent`
+
+Use `defineAgent` when a model should choose among tools. The agent template provides an executable offline LangChain model example. This shortened form uses the same public options:
+
+```ts
+import { defineAgent } from "@relkit/app/agents";
+import { z } from "@relkit/app/schema";
+import { FakeToolCallingModel } from "langchain";
+import lookup from "@app/services/hello/tools/lookup.tool.js";
+export default defineAgent({
+  id: "hello.assistant",
+  input: z.object({ message: z.string().min(1) }),
+  output: z.object({ answer: z.string() }),
+  model: new FakeToolCallingModel({
+    toolCalls: [[{ name: "relkit_output", args: { value: { answer: "Hello!" } }, id: "output-1" }]],
+  }),
+  instructions: "Answer greeting questions with the available tools.",
+  tools: [lookup],
+  limits: { maxSteps: 4, maxToolCalls: 4, timeoutMs: 10_000 },
+});
+```
+
+Other generated projects may need a native model package and application-owned provider configuration. `limits` requires positive `maxSteps`, `maxToolCalls`, and `timeoutMs`. `instructions` can be text or a `definePrompt` descriptor. A model can call only tools listed in the agent's `tools` array. A fixed sequence can be a function; a stateful explicit workflow can use `defineGraph` and `defineGraphNode`.
+
+## `defineTool` and `definePrompt`
+
+A RELKIT tool wraps a callable function without duplicating its schemas:
+
+```ts
+import { defineTool } from "@relkit/app/tools";
+import lookup from "@app/services/orders/functions/lookup.function.js";
+export default defineTool({
+  id: "orders.lookup",
+  target: lookup,
+  description: "Look up an order by ID",
+  sideEffect: "read",
+  approval: "never",
+  timeoutMs: 2_000,
+});
+```
+
+```ts
+import { definePrompt } from "@relkit/app";
+export default definePrompt("Answer using the available tools.", {
+  id: "hello.assistant-instructions",
+});
+```
+
+`lookup.asTool({ ... })` is the alternate tool form. Choose accurate `sideEffect` (`none`, `read`, `write`, or `external`) and `approval` (`never`, `on-write`, or `always`) policies. Tools are available to MCP by default; set `mcp: false` when a tool should remain inside the app. Permission checks belong in application logic.
+If a browser client needs an agent, configure its explicit `client` contract. Keep provider credentials and native model instances on the server. A typed agent run uses a stable thread ID; resume the same thread instead of creating a replacement run.