create-relkit 0.7.6 → 0.7.8

package/dist/create-capabilities.js

@@ -1,5 +1,5 @@
 /**
- * Packaged creation support is an allow-list backed by reference-host evidence.
+ * Packaged creation support is an allow-list backed by exact packed readiness evidence.
  * Candidate literals remain parseable so explicit unsupported requests can return
  * a precise pre-staging diagnostic instead of masquerading as syntax errors.
  */
@@ -13,16 +13,16 @@ const entries = Object.freeze([
         deploy: "none",
         examples: true,
         identity: Object.freeze({
-            release: "0.7.6",
+            release: "0.7.8",
             bun: "1.3.10",
             typescript: "5.9.3",
             packageCatalogDigest: "ac7c2f56e61fca5ab890775cf4c483722cb590e488ee7fc4741224cbb4f50ccd",
             template: "default/v1/minimal",
             snapshotProtocol: 1,
         }),
-        templateDigest: "f72fded9c0ceccefc8140e3104ab4a0eabb8f7f92283ec0ff5237f0a772dd0ef",
-        freshEvidence: "docs/evidence/create-capabilities/0.7.6/fresh.json",
-        restartEvidence: "docs/evidence/create-capabilities/0.7.6/restart.json",
+        templateDigest: "579d32ffc180edbf06bb6656099882285cc0d4795601557efdee86d1b470212a",
+        freshEvidence: "docs/evidence/create-capabilities/0.7.8/fresh.json",
+        restartEvidence: "docs/evidence/create-capabilities/0.7.8/restart.json",
     }),
 ]);
 export const CREATE_CAPABILITY_TABLE = Object.freeze({
@@ -92,7 +92,7 @@ function supportedTuples(identity) {
 }
 /**
  * Compares all mandatory tool identity fields without ignoring patch versions.
- * @param left - Recorded reference-host identity.
+ * @param left - Recorded certification identity.
  * @param right - Current executing identity.
  * @returns Whether every mandatory field matches.
  */

package/dist/create-capabilities.types.d.ts

@@ -1,4 +1,4 @@
-/** Describes exact creation tuples and their reference-host package, tool and template evidence identities. */
+/** Describes exact creation tuples and their recorded package, tool and template evidence identities. */
 import type { CreateOptions } from "./options.js";
 /** Complete public creation combination; absence of jobs preserves the native no-jobs option. */
 export interface CreateCapabilityTuple {
@@ -30,7 +30,7 @@ export interface CreateCapabilityIdentity {
 }
 /** Offered tuple backed by complete fresh and restart measurements for its template bytes. */
 export interface CreateCapabilityEvidence extends CreateCapabilityTuple {
-    /** Exact tool and package catalog identity measured by the reference host. */
+    /** Exact tool and package catalog identity measured by the recorded certification host. */
     readonly identity: CreateCapabilityIdentity;
     /** SHA-256 over ordered template paths and their complete bytes. */
     readonly templateDigest: string;

package/dist/create-capabilities.types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"create-capabilities.types.d.ts","sourceRoot":"","sources":["../src/create-capabilities.types.ts"],"names":[],"mappings":"AAAA,+GAA+G;AAC/G,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAElD,iGAAiG;AACjG,MAAM,WAAW,qBAAqB;IACpC,mDAAmD;IACnD,QAAQ,CAAC,QAAQ,EAAE,aAAa,CAAC,UAAU,CAAC,CAAC;IAC7C,0CAA0C;IAC1C,QAAQ,CAAC,KAAK,EAAE,aAAa,CAAC,OAAO,CAAC,CAAC;IACvC,4CAA4C;IAC5C,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAC,QAAQ,CAAC,CAAC;IACzC,kDAAkD;IAClD,QAAQ,CAAC,IAAI,CAAC,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IACtC,0DAA0D;IAC1D,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;CAC5B;AAED,kFAAkF;AAClF,MAAM,WAAW,wBAAwB;IACvC,yCAAyC;IACzC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,iCAAiC;IACjC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,wCAAwC;IACxC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,uDAAuD;IACvD,QAAQ,CAAC,oBAAoB,EAAE,MAAM,CAAC;IACtC,gDAAgD;IAChD,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,gDAAgD;IAChD,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;CACnC;AAED,8FAA8F;AAC9F,MAAM,WAAW,wBAAyB,SAAQ,qBAAqB;IACrE,8EAA8E;IAC9E,QAAQ,CAAC,QAAQ,EAAE,wBAAwB,CAAC;IAC5C,oEAAoE;IACpE,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,4DAA4D;IAC5D,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,8DAA8D;IAC9D,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;CAClC;AAED,oFAAoF;AACpF,MAAM,MAAM,uBAAuB,GAAG,QAAQ,CAAC;IAC7C,+BAA+B;IAC/B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,6BAA6B;IAC7B,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,kCAAkC;IAClC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,0EAA0E;IAC1E,IAAI,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC1B,+BAA+B;IAC/B,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB,CAAC,CAAC"}
+{"version":3,"file":"create-capabilities.types.d.ts","sourceRoot":"","sources":["../src/create-capabilities.types.ts"],"names":[],"mappings":"AAAA,yGAAyG;AACzG,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAElD,iGAAiG;AACjG,MAAM,WAAW,qBAAqB;IACpC,mDAAmD;IACnD,QAAQ,CAAC,QAAQ,EAAE,aAAa,CAAC,UAAU,CAAC,CAAC;IAC7C,0CAA0C;IAC1C,QAAQ,CAAC,KAAK,EAAE,aAAa,CAAC,OAAO,CAAC,CAAC;IACvC,4CAA4C;IAC5C,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAC,QAAQ,CAAC,CAAC;IACzC,kDAAkD;IAClD,QAAQ,CAAC,IAAI,CAAC,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IACtC,0DAA0D;IAC1D,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;CAC5B;AAED,kFAAkF;AAClF,MAAM,WAAW,wBAAwB;IACvC,yCAAyC;IACzC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,iCAAiC;IACjC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,wCAAwC;IACxC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,uDAAuD;IACvD,QAAQ,CAAC,oBAAoB,EAAE,MAAM,CAAC;IACtC,gDAAgD;IAChD,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,gDAAgD;IAChD,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;CACnC;AAED,8FAA8F;AAC9F,MAAM,WAAW,wBAAyB,SAAQ,qBAAqB;IACrE,2FAA2F;IAC3F,QAAQ,CAAC,QAAQ,EAAE,wBAAwB,CAAC;IAC5C,oEAAoE;IACpE,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,4DAA4D;IAC5D,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,8DAA8D;IAC9D,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;CAClC;AAED,oFAAoF;AACpF,MAAM,MAAM,uBAAuB,GAAG,QAAQ,CAAC;IAC7C,+BAA+B;IAC/B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,6BAA6B;IAC7B,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,kCAAkC;IAClC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,0EAA0E;IAC1E,IAAI,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC1B,+BAA+B;IAC/B,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB,CAAC,CAAC"}

package/dist/render-database-sources.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"render-database-sources.d.ts","sourceRoot":"","sources":["../src/render-database-sources.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AAEtD;;;;GAIG;AACH,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,eAAe,GAAG,MAAM,CAiBtE;AAED;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,eAAe,GAAG,MAAM,CA0BlE;AAED;;;;;GAKG;AACH,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,eAAe,EAAE,UAAU,EAAE,MAAM,GAAG,MAAM,CAkBxF"}
+{"version":3,"file":"render-database-sources.d.ts","sourceRoot":"","sources":["../src/render-database-sources.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AAGtD;;;;GAIG;AACH,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,eAAe,GAAG,MAAM,CAiBtE;AAED;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,eAAe,GAAG,MAAM,CA0BlE;AAED;;;;;GAKG;AACH,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,eAAe,EAAE,UAAU,EAAE,MAAM,GAAG,MAAM,CAkBxF"}

package/dist/render-database-sources.js

@@ -1,3 +1,4 @@
+import { dirname } from "node:path";
 /**
  * Renders database Service Source as source text without executing user modules.
  * @param dialect - Supported database dialect.
@@ -6,9 +7,9 @@
 export function databaseServiceSource(dialect) {
     const sqlite = dialect === "sqlite";
     const client = sqlite
-        ? `const sqlite = new Database(env.DATABASE_PATH);\n    return drizzle({ client: sqlite });`
+        ? `const path = env.DATABASE_PATH;\n    if (!path) throw new Error("DATABASE_PATH is required");\n    mkdirSync(dirname(path), { recursive: true });\n    const sqlite = new Database(path);\n    return drizzle({ client: sqlite });`
         : `const url = env.DATABASE_URL;\n    if (!url) throw new Error("DATABASE_URL is required");\n    return drizzle.${dialect === "postgresql" ? "postgres" : "mysql"}(url);`;
-    return `${sqlite ? `import { Database } from "bun:sqlite";\n` : ""}import { defineDrizzleService } from "@relkit/drizzle";
+    return `${sqlite ? `import { Database } from "bun:sqlite";\nimport { mkdirSync } from "node:fs";\nimport { dirname } from "node:path";\n` : ""}import { defineDrizzleService } from "@relkit/drizzle";
 import { drizzle } from "drizzle-orm/${sqlite ? "bun-sqlite" : "bun-sql"}";
 import * as schema from "./schema/index.js";
 
@@ -73,7 +74,7 @@ if (${value} === undefined || ${value}.trim() === ""${invalid}) {
 export default defineConfig({
   schema: "./${schemaPath}",
   dialect: "${dialect}",
-  out: "./drizzle",
+  out: "./${dirname(dirname(schemaPath))}/migrations",
   dbCredentials: { url: ${value} },
 });
 `;

package/dist/render-database-sources.js.map

@@ -1 +1 @@
-{"version":3,"file":"render-database-sources.js","sourceRoot":"","sources":["../src/render-database-sources.ts"],"names":[],"mappings":"AAOA;;;;GAIG;AACH,MAAM,UAAU,qBAAqB,CAAC,OAAwB;IAC5D,MAAM,MAAM,GAAG,OAAO,KAAK,QAAQ,CAAC;IACpC,MAAM,MAAM,GAAG,MAAM;QACnB,CAAC,CAAC,0FAA0F;QAC5F,CAAC,CAAC,iHAAiH,OAAO,KAAK,YAAY,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,OAAO,QAAQ,CAAC;IAC7K,OAAO,GAAG,MAAM,CAAC,CAAC,CAAC,0CAA0C,CAAC,CAAC,CAAC,EAAE;uCAC7B,MAAM,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,SAAS;;;;;;MAMlE,MAAM;;;;CAIX,CAAC;AACF,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,iBAAiB,CAAC,OAAwB;IACxD,IAAI,OAAO,KAAK,QAAQ,EAAE,CAAC;QACzB,OAAO;;;;;;CAMV,CAAC;IACA,CAAC;IACD,IAAI,OAAO,KAAK,YAAY,EAAE,CAAC;QAC7B,OAAO;;;;;;CAMV,CAAC;IACA,CAAC;IACD,OAAO;;;;;;CAMR,CAAC;AACF,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,mBAAmB,CAAC,OAAwB,EAAE,UAAkB;IAC9E,MAAM,QAAQ,GAAG,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,cAAc,CAAC;IACzE,MAAM,KAAK,GAAG,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC;IACpD,MAAM,OAAO,GAAG,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,yBAAyB,CAAC,CAAC,CAAC,EAAE,CAAC;IACtE,OAAO;;QAED,KAAK,kBAAkB,QAAQ;MACjC,KAAK,qBAAqB,KAAK,iBAAiB,OAAO;yBACpC,QAAQ;;;;eAIlB,UAAU;cACX,OAAO;;0BAEK,KAAK;;CAE9B,CAAC;AACF,CAAC"}
+{"version":3,"file":"render-database-sources.js","sourceRoot":"","sources":["../src/render-database-sources.ts"],"names":[],"mappings":"AAMA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAEpC;;;;GAIG;AACH,MAAM,UAAU,qBAAqB,CAAC,OAAwB;IAC5D,MAAM,MAAM,GAAG,OAAO,KAAK,QAAQ,CAAC;IACpC,MAAM,MAAM,GAAG,MAAM;QACnB,CAAC,CAAC,oOAAoO;QACtO,CAAC,CAAC,iHAAiH,OAAO,KAAK,YAAY,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,OAAO,QAAQ,CAAC;IAC7K,OAAO,GAAG,MAAM,CAAC,CAAC,CAAC,sHAAsH,CAAC,CAAC,CAAC,EAAE;uCACzG,MAAM,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,SAAS;;;;;;MAMlE,MAAM;;;;CAIX,CAAC;AACF,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,iBAAiB,CAAC,OAAwB;IACxD,IAAI,OAAO,KAAK,QAAQ,EAAE,CAAC;QACzB,OAAO;;;;;;CAMV,CAAC;IACA,CAAC;IACD,IAAI,OAAO,KAAK,YAAY,EAAE,CAAC;QAC7B,OAAO;;;;;;CAMV,CAAC;IACA,CAAC;IACD,OAAO;;;;;;CAMR,CAAC;AACF,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,mBAAmB,CAAC,OAAwB,EAAE,UAAkB;IAC9E,MAAM,QAAQ,GAAG,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,cAAc,CAAC;IACzE,MAAM,KAAK,GAAG,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC;IACpD,MAAM,OAAO,GAAG,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,yBAAyB,CAAC,CAAC,CAAC,EAAE,CAAC;IACtE,OAAO;;QAED,KAAK,kBAAkB,QAAQ;MACjC,KAAK,qBAAqB,KAAK,iBAAiB,OAAO;yBACpC,QAAQ;;;;eAIlB,UAAU;cACX,OAAO;YACT,OAAO,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;0BACd,KAAK;;CAE9B,CAAC;AACF,CAAC"}

package/dist/render-database.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"render-database.d.ts","sourceRoot":"","sources":["../src/render-database.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAIhC,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,4BAA4B,CAAC;AACnE,YAAY,EAAE,gBAAgB,EAAE,MAAM,4BAA4B,CAAC;AAEnE,OAAO,EAAE,mBAAmB,EAAE,MAAM,2BAA2B,CAAC;AAChE,OAAO,EAEL,KAAK,oBAAoB,EACzB,KAAK,gBAAgB,EACtB,MAAM,uBAAuB,CAAC;AAE/B,OAAO,EAAuC,KAAK,UAAU,EAAE,MAAM,gBAAgB,CAAC;AACtF,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAShD;;;;;GAKG;AACH,eAAO,MAAM,oBAAoB;;;;;mGA4DhC,CAAC;AAEF;;;;;GAKG;AACH,wBAAgB,cAAc,CAC5B,OAAO,EAAE,WAAW,EACpB,OAAO,EAAE,OAAO,CAAC,UAAU,EAAE;IAAE,IAAI,EAAE,UAAU,CAAA;CAAE,CAAC,GACjD,OAAO,CAAC,gBAAgB,CAAC,CAE3B"}
+{"version":3,"file":"render-database.d.ts","sourceRoot":"","sources":["../src/render-database.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAIhC,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,4BAA4B,CAAC;AACnE,YAAY,EAAE,gBAAgB,EAAE,MAAM,4BAA4B,CAAC;AAEnE,OAAO,EAAE,mBAAmB,EAAE,MAAM,2BAA2B,CAAC;AAChE,OAAO,EAEL,KAAK,oBAAoB,EACzB,KAAK,gBAAgB,EACtB,MAAM,uBAAuB,CAAC;AAE/B,OAAO,EAAuC,KAAK,UAAU,EAAE,MAAM,gBAAgB,CAAC;AACtF,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAShD;;;;;GAKG;AACH,eAAO,MAAM,oBAAoB;;;;;mGA2DhC,CAAC;AAEF;;;;;GAKG;AACH,wBAAgB,cAAc,CAC5B,OAAO,EAAE,WAAW,EACpB,OAAO,EAAE,OAAO,CAAC,UAAU,EAAE;IAAE,IAAI,EAAE,UAAU,CAAA;CAAE,CAAC,GACjD,OAAO,CAAC,gBAAgB,CAAC,CAE3B"}

package/dist/render-database.js

@@ -35,10 +35,9 @@ export const renderDatabaseEffect = Effect.fn("Scaffold.renderDatabase")(functio
         yield* builder.dependencyEffect(dependency);
     }
     yield* builder.scriptEffect("db:generate", "bun --bun drizzle-kit generate");
-    yield* builder.scriptEffect("db:migrate", "bun --bun drizzle-kit migrate");
-    yield* builder.gitignoreEffect("/drizzle/");
+    yield* builder.scriptEffect("db:migrate", "relkit db migrate");
     if (request.dialect === "sqlite") {
-        yield* ensureEnvironmentEffect(builder, "DATABASE_PATH", `env.string().default("./app.sqlite")`, "./app.sqlite");
+        yield* ensureEnvironmentEffect(builder, "DATABASE_PATH", `env.string().default("./.relkit/state/app.sqlite")`, "./.relkit/state/app.sqlite");
         yield* builder.gitignoreEffect("*.sqlite");
         yield* builder.gitignoreEffect("*.sqlite-*");
     }

package/dist/render-database.js.map

@@ -1 +1 @@
-{"version":3,"file":"render-database.js","sourceRoot":"","sources":["../src/render-database.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAChC,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,uBAAuB,EAAE,MAAM,sBAAsB,CAAC;AAC/D,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAG/D,OAAO,EAAE,gBAAgB,EAAE,MAAM,6BAA6B,CAAC;AAC/D,OAAO,EAAE,mBAAmB,EAAE,MAAM,2BAA2B,CAAC;AAChE,OAAO,EACL,cAAc,GAGf,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,mBAAmB,EAAE,MAAM,wBAAwB,CAAC;AAC7D,OAAO,EAAE,iBAAiB,EAAE,gBAAgB,EAAmB,MAAM,gBAAgB,CAAC;AACtF,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EAAE,uBAAuB,EAAE,MAAM,wBAAwB,CAAC;AACjE,OAAO,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAC3D,OAAO,EACL,qBAAqB,EACrB,mBAAmB,EACnB,iBAAiB,GAClB,MAAM,8BAA8B,CAAC;AAEtC;;;;;GAKG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,MAAM,CAAC,EAAE,CAAC,yBAAyB,CAAC,CACtE,QAAQ,CAAC,EACP,OAAoB,EACpB,OAAkD;IAMlD,IAAI,OAAO,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,UAAU,KAAK,UAAU,CAAC,EAAE,CAAC;QACpF,OAAO,KAAK,CAAC,CAAC,WAAW,CACvB,IAAI,gBAAgB,CAAC,iBAAiB,CAAC,SAAS,EAAE,oCAAoC,CAAC,CACxF,CAAC;IACJ,CAAC;IACD,MAAM,WAAW,GAAG,KAAK,CAAC,CAAC,SAAS,CAAC,GAAG,EAAE,CACxC,uBAAuB,CAAC,OAAO,CAAC,SAAS,EAAE,UAAU,CAAC,CACvD,CAAC;IACF,MAAM,UAAU,GAAG,GAAG,OAAO,CAAC,WAAW,CAAC,kBAAkB,CAAC;IAC7D,KAAK,CAAC,CAAC,OAAO,CAAC,YAAY,CAAC,WAAW,EAAE,qBAAqB,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC;IACjF,KAAK,CAAC,CAAC,OAAO,CAAC,YAAY,CACzB,UAAU,EACV,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,gBAAgB,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,iBAAiB,CAAC,OAAO,CAAC,OAAO,CAAC,CAC5F,CAAC;IACF,KAAK,CAAC,CAAC,OAAO,CAAC,YAAY,CACzB,mBAAmB,EACnB,mBAAmB,CAAC,OAAO,CAAC,OAAO,EAAE,UAAU,CAAC,CACjD,CAAC;IACF,KAAK,MAAM,UAAU,IAAI,CAAC,iBAAiB,EAAE,aAAa,EAAE,aAAa,CAAU,EAAE,CAAC;QACpF,KAAK,CAAC,CAAC,OAAO,CAAC,gBAAgB,CAAC,UAAU,CAAC,CAAC;IAC9C,CAAC;IACD,KAAK,CAAC,CAAC,OAAO,CAAC,YAAY,CAAC,aAAa,EAAE,gCAAgC,CAAC,CAAC;IAC7E,KAAK,CAAC,CAAC,OAAO,CAAC,YAAY,CAAC,YAAY,EAAE,+BAA+B,CAAC,CAAC;IAC3E,KAAK,CAAC,CAAC,OAAO,CAAC,eAAe,CAAC,WAAW,CAAC,CAAC;IAC5C,IAAI,OAAO,CAAC,OAAO,KAAK,QAAQ,EAAE,CAAC;QACjC,KAAK,CAAC,CAAC,uBAAuB,CAC5B,OAAO,EACP,eAAe,EACf,sCAAsC,EACtC,cAAc,CACf,CAAC;QACF,KAAK,CAAC,CAAC,OAAO,CAAC,eAAe,CAAC,UAAU,CAAC,CAAC;QAC3C,KAAK,CAAC,CAAC,OAAO,CAAC,eAAe,CAAC,YAAY,CAAC,CAAC;IAC/C,CAAC;SAAM,CAAC;QACN,KAAK,CAAC,CAAC,uBAAuB,CAAC,OAAO,EAAE,cAAc,EAAE,cAAc,CAAC,CAAC;QACxE,KAAK,CAAC,CAAC,OAAO,CAAC,aAAa,CAC1B,uBAAuB,EACvB,6DAA6D,CAC9D,CAAC;IACJ,CAAC;IACD,KAAK,CAAC,CAAC,OAAO,CAAC,cAAc,CAAC,qBAAqB,CAAC,CAAC;IACrD,KAAK,CAAC,CAAC,OAAO,CAAC,cAAc,CAAC,oBAAoB,CAAC,CAAC;IACpD,KAAK,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,SAAS,EAAE;QAC/C,MAAM,EAAE,UAAU;QAClB,IAAI,EAAE,WAAW;QACjB,OAAO,EAAE,UAAU;QACnB,EAAE,EAAE,UAAU;KACf,CAAC,CAAC;IACH,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,CAAC;AAC/D,CAAC,EACD,CAAC,MAAM,EAAE,EAAE,CAAC,gBAAgB,CAAC,WAAW,EAAE,yBAAyB,EAAE,cAAc,CAAC,MAAM,CAAC,CAAC,CAC7F,CAAC;AAEF;;;;;GAKG;AACH,MAAM,UAAU,cAAc,CAC5B,OAAoB,EACpB,OAAkD;IAElD,OAAO,mBAAmB,CAAC,oBAAoB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC;AACrE,CAAC"}
+{"version":3,"file":"render-database.js","sourceRoot":"","sources":["../src/render-database.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAChC,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,uBAAuB,EAAE,MAAM,sBAAsB,CAAC;AAC/D,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAG/D,OAAO,EAAE,gBAAgB,EAAE,MAAM,6BAA6B,CAAC;AAC/D,OAAO,EAAE,mBAAmB,EAAE,MAAM,2BAA2B,CAAC;AAChE,OAAO,EACL,cAAc,GAGf,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,mBAAmB,EAAE,MAAM,wBAAwB,CAAC;AAC7D,OAAO,EAAE,iBAAiB,EAAE,gBAAgB,EAAmB,MAAM,gBAAgB,CAAC;AACtF,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EAAE,uBAAuB,EAAE,MAAM,wBAAwB,CAAC;AACjE,OAAO,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAC3D,OAAO,EACL,qBAAqB,EACrB,mBAAmB,EACnB,iBAAiB,GAClB,MAAM,8BAA8B,CAAC;AAEtC;;;;;GAKG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,MAAM,CAAC,EAAE,CAAC,yBAAyB,CAAC,CACtE,QAAQ,CAAC,EACP,OAAoB,EACpB,OAAkD;IAMlD,IAAI,OAAO,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,UAAU,KAAK,UAAU,CAAC,EAAE,CAAC;QACpF,OAAO,KAAK,CAAC,CAAC,WAAW,CACvB,IAAI,gBAAgB,CAAC,iBAAiB,CAAC,SAAS,EAAE,oCAAoC,CAAC,CACxF,CAAC;IACJ,CAAC;IACD,MAAM,WAAW,GAAG,KAAK,CAAC,CAAC,SAAS,CAAC,GAAG,EAAE,CACxC,uBAAuB,CAAC,OAAO,CAAC,SAAS,EAAE,UAAU,CAAC,CACvD,CAAC;IACF,MAAM,UAAU,GAAG,GAAG,OAAO,CAAC,WAAW,CAAC,kBAAkB,CAAC;IAC7D,KAAK,CAAC,CAAC,OAAO,CAAC,YAAY,CAAC,WAAW,EAAE,qBAAqB,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC;IACjF,KAAK,CAAC,CAAC,OAAO,CAAC,YAAY,CACzB,UAAU,EACV,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,gBAAgB,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,iBAAiB,CAAC,OAAO,CAAC,OAAO,CAAC,CAC5F,CAAC;IACF,KAAK,CAAC,CAAC,OAAO,CAAC,YAAY,CACzB,mBAAmB,EACnB,mBAAmB,CAAC,OAAO,CAAC,OAAO,EAAE,UAAU,CAAC,CACjD,CAAC;IACF,KAAK,MAAM,UAAU,IAAI,CAAC,iBAAiB,EAAE,aAAa,EAAE,aAAa,CAAU,EAAE,CAAC;QACpF,KAAK,CAAC,CAAC,OAAO,CAAC,gBAAgB,CAAC,UAAU,CAAC,CAAC;IAC9C,CAAC;IACD,KAAK,CAAC,CAAC,OAAO,CAAC,YAAY,CAAC,aAAa,EAAE,gCAAgC,CAAC,CAAC;IAC7E,KAAK,CAAC,CAAC,OAAO,CAAC,YAAY,CAAC,YAAY,EAAE,mBAAmB,CAAC,CAAC;IAC/D,IAAI,OAAO,CAAC,OAAO,KAAK,QAAQ,EAAE,CAAC;QACjC,KAAK,CAAC,CAAC,uBAAuB,CAC5B,OAAO,EACP,eAAe,EACf,oDAAoD,EACpD,4BAA4B,CAC7B,CAAC;QACF,KAAK,CAAC,CAAC,OAAO,CAAC,eAAe,CAAC,UAAU,CAAC,CAAC;QAC3C,KAAK,CAAC,CAAC,OAAO,CAAC,eAAe,CAAC,YAAY,CAAC,CAAC;IAC/C,CAAC;SAAM,CAAC;QACN,KAAK,CAAC,CAAC,uBAAuB,CAAC,OAAO,EAAE,cAAc,EAAE,cAAc,CAAC,CAAC;QACxE,KAAK,CAAC,CAAC,OAAO,CAAC,aAAa,CAC1B,uBAAuB,EACvB,6DAA6D,CAC9D,CAAC;IACJ,CAAC;IACD,KAAK,CAAC,CAAC,OAAO,CAAC,cAAc,CAAC,qBAAqB,CAAC,CAAC;IACrD,KAAK,CAAC,CAAC,OAAO,CAAC,cAAc,CAAC,oBAAoB,CAAC,CAAC;IACpD,KAAK,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,SAAS,EAAE;QAC/C,MAAM,EAAE,UAAU;QAClB,IAAI,EAAE,WAAW;QACjB,OAAO,EAAE,UAAU;QACnB,EAAE,EAAE,UAAU;KACf,CAAC,CAAC;IACH,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,CAAC;AAC/D,CAAC,EACD,CAAC,MAAM,EAAE,EAAE,CAAC,gBAAgB,CAAC,WAAW,EAAE,yBAAyB,EAAE,cAAc,CAAC,MAAM,CAAC,CAAC,CAC7F,CAAC;AAEF;;;;;GAKG;AACH,MAAM,UAAU,cAAc,CAC5B,OAAoB,EACpB,OAAkD;IAElD,OAAO,mBAAmB,CAAC,oBAAoB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC;AACrE,CAAC"}

package/dist/templates/default/README.md

@@ -8,6 +8,6 @@ scaffolder:
 - `agent` — the minimal example plus a read-only tool and agent descriptor.
 
 Each variant is self-contained and can be copied as a project root. It uses
-the current checked-in RelKit package version (`0.7.6`), Bun `1.3.10`, and
+the current checked-in RelKit package version (`0.7.8`), Bun `1.3.10`, and
 TypeScript `5.9.3`. The generator owns project-name substitution and later
 installation/Git behavior.

package/dist/templates/default/v1/agent/.agents/skills/relkit/SKILL.md

@@ -7,6 +7,20 @@ description: Build or extend a RELKIT CLI-generated application using its instal
 
 Run commands from the generated application's root, where `relkit.config.ts` and `package.json` live. Use `bun run relkit` to invoke the project's installed CLI. Check `bun run relkit <command> --help` before relying on an option, especially after a dependency upgrade.
 
+## Understand the requested work
+
+Infer the intent from the request; do not ask the user to classify it.
+
+- For a feature, establish the problem, scope, expected behavior and acceptance criteria. Explain a short implementation and verification plan before editing, then proceed with the authorized work.
+- For a bug, establish expected versus actual behavior, attempt reproduction, and trace the affected execution path. Distinguish a confirmed cause from a hypothesis, and explain the proposed fix and verification before editing. Report unavailable reproduction honestly.
+- For a discussion, explain options, tradeoffs and a recommendation without changing files. For mixed requests, keep the discussion portion read-only and implement only the requested work.
+
+Before scaffolding a new app, establish the database engine and driver (or an explicit no-database choice) and whether authentication is needed. Ask missing choices together before writing files. Reuse supplied choices and existing project decisions; do not restart onboarding for an unrelated bug or small change. If requested auth needs persistence but the user chose no database, explain and resolve that conflict before scaffolding. Use supported create/add options; do not invent database/auth creation flags or change headless defaults.
+
+Recommend optional modules only when they solve a concrete part of this task: for example, realtime for live order status or a bucket for uploads. Explain the benefit and ask for a selection when the capability was not requested. For an explicitly requested capability, resolve only missing provider/configuration decisions. Check installed CLI help and declarations for support; explain unavailable options before editing. A plan is not another permission gate for work already authorized.
+
+Default to backend work. Do not introduce frontend pages, app.js, assets.css or demo interfaces unless requested. Preserve existing frontend files, explicitly selected fullstack functionality and the framework Inspector. For users and orders, define separate resource endpoints with explicit input/output contracts, validation and applicable authorization; avoid a public table dispatcher controlled by an entity parameter. Internal tables and infrastructure services need no public endpoint. Preserve intentional protocol handlers such as the Better Auth mount and shared internal helpers.
+
 ## Source placement
 
 New projects place every generic, database, and auth boundary at `src/services/<name>/service.ts`. Keep its functions, events, tasks, jobs, tools, agents, channels, schemas, resources, helpers, and assets under that service. Routes live at `src/routes`; configuration support and environment contracts live at `src/platform`. Application descriptors use plain TypeScript and supported public APIs; Effect imports are not required.
@@ -45,4 +59,6 @@ Read only the reference relevant to the requested change. These examples describ
 
 ## Verify the result
 
-Review the CLI's created and updated files, warnings, and next steps. Run `bun run check`, `bun run typecheck`, and focused tests after editing. For HTTP work, exercise the route itself; a direct function test does not cover request mapping. Database and auth work also needs the reported environment and migration steps before runtime verification.
+Review the CLI's created and updated files, warnings, next steps and final diff. Run focused checks after logical changes. Before completion, run applicable check, typecheck, build, unit/integration tests and existing relevant end-to-end coverage. Inspect package.json for actual script names. For HTTP work, test the route's status/body, valid and invalid input, and denied and allowed access where relevant; a direct function test does not cover request mapping or the complete flow. Replay the original bug through the boundary that failed. Backend/API tests do not require an unsolicited frontend.
+
+Database/auth changes also need explicit environment setup and migration steps from [the data reference](references/data-apis.md), followed by persistence/session/authorization verification. Stop all test-owned servers and clients. Report what changed, exact verification performed, and every failed, skipped or blocked check with its effect on confidence. Written code or passing unit tests alone is not fully verified delivery when affected runtime behavior remains untested.

package/dist/templates/default/v1/agent/.agents/skills/relkit/references/cli.md

@@ -24,6 +24,13 @@ These examples use the local binary through `bun run relkit`. The installed CLI'
 
 Database `--dialect` and auth `--database-dialect` also accept `postgresql` and `mysql`. Auth's `--base-path` changes the default `/api/auth` mount. The CLI adds dependencies and an environment example as needed, but it does not apply database migrations or populate secrets. Follow the scaffold's reported next steps after reviewing the schema and environment values.
 
+Run `bun run db:generate`, review tracked SQL/metadata under the database service's
+`migrations` directory, then explicitly run `bun run db:migrate`. The latter uses
+installed `relkit db migrate`, defaulting to root `drizzle.config.ts`; select another
+with `bun run relkit db migrate --config <path>`. Configuration owns the target,
+history and supported log settings; relative paths use the app root. No copied
+runner is needed. See [database tooling](data-apis.md) for environment and failure behavior.
+
 ## Other add kinds
 
 Run `bun run relkit add <kind> --help` for each kind's flags and requirements:

package/dist/templates/default/v1/agent/.agents/skills/relkit/references/data-apis.md

@@ -30,6 +30,22 @@ export default defineDrizzleService({
 
 Open the native connection in the `client({ env })` factory and close it with `dispose` when needed. Discovery does not run the factory. Generate and review migrations with the installed Drizzle tooling; service creation does not create tables or apply migrations. After `bun run check`, generated context declarations provide typed `context.database`.
 
+## Version and apply migration source
+
+New grouped scaffolds configure `src/services/database/migrations` beside the database service and schema. Keep SQL and required Drizzle metadata in Git, outside ignored `.relkit/`. One shared database has one ordered history, including authentication tables; do not create separate histories for business services. Existing flat apps retain their selected database service directory.
+
+Set the required environment in the application root's `.env` or shell, then run:
+
+```sh
+bun run db:generate
+# Review the generated SQL and metadata before applying them.
+bun run db:migrate
+```
+
+`db:generate` uses the installed Drizzle Kit. `db:migrate` invokes installed RELKIT tooling, `relkit db migrate`, without copying a runner into the app. Root `drizzle.config.ts` explicitly owns dialect, schema, migration output, connection and supported log options. To select another config, use `bun run relkit db migrate --config configs/database.ts`; relative output/database paths still use the application root. Keep delegated PostgreSQL/MySQL config deterministic because Kit loads it again. Existing shell variables take precedence over Bun's normal dotenv loading; `.env.example` is documentation only.
+
+Migration applies pending SQL only when explicitly invoked; scaffolding and service startup do not apply it, generate secrets or open the database. SQLite uses the Bun-native driver. PostgreSQL/MySQL delegate to the app's installed Kit under Bun. Missing/empty/incompatible history requires generation or a compatible ORM/Kit pair, not a reset or fallback directory. Review failures before another manual run: SQL is not automatically retried, and dialect-specific partial DDL is not guaranteed to roll back. Keep the generated dependency patch and registration while required by the installed release.
+
 ## `defineBetterAuthService`
 
 ```ts

package/dist/templates/default/v1/agent/.agents/skills/relkit/references/domain-apis.md

@@ -31,6 +31,8 @@ export default defineService({ functions: { greet } });
 
 The service also accepts `events`, `tasks`, and `jobs` maps. Its members appear directly as `service.greet`; there is no `service.functions.greet` namespace. Membership makes a function available across domains, but does not create an HTTP route or grant authorization.
 
+Each `service.ts` constructs and exports exactly one runtime service value. Keep ordinary helpers and error descriptors inside their owning domain; expose callable operations through the service's `functions` map. Do not re-export helpers or descriptors from a specialized database or auth `service.ts`.
+
 Within a domain, import a sibling function directly. Across domains and from routes, import the other domain's `service.ts`. Invoke a function descriptor with `await service.greet.invoke(input)`; do not call its handler directly. Leave an internal function out of the service map. Tools, agents, caches, buckets, and event-only functions are not service members.
 
 ## `defineEvent` and `defineEventFunction`
@@ -89,4 +91,21 @@ export default defineError({
 });
 ```
 
-Declare only expected failures callers should handle on a function. Use the route layer for HTTP-specific request mapping and middleware.
+Declare only expected failures callers should handle on a function. Return each declared error through the public `fail` helper so it appears in the inferred handler result; throwing a declared error from an ordinary helper does not satisfy that contract. Use the route layer for HTTP-specific request mapping and middleware.
+
+```ts
+import { defineFunction, fail } from "@relkit/app/functions";
+import { z } from "@relkit/app/schema";
+import AuthenticationRequired from "../errors/authentication-required.error.js";
+
+export default defineFunction({
+  input: z.object({}),
+  output: z.object({ id: z.string() }),
+  errors: [AuthenticationRequired],
+  handler: async (_input, context) => {
+    const session = await context.auth.getSession();
+    if (session === null) return fail(AuthenticationRequired, {});
+    return { id: session.user.id };
+  },
+});
+```

package/dist/templates/default/v1/agent/gitignore

@@ -2,9 +2,6 @@ node_modules/
 .env
 .env.*
 !.env.example
-.relkit/generated/
-.relkit/build/
-.relkit/state/
-.relkit/observability/
+.relkit/
 coverage/
 dist/

package/dist/templates/default/v1/agent/package.json

@@ -16,15 +16,15 @@
   },
   "dependencies": {
     "@langchain/langgraph": "1.4.14",
-    "@relkit/app": "0.7.6",
-    "@relkit/local": "0.7.6",
+    "@relkit/app": "0.7.8",
+    "@relkit/local": "0.7.8",
     "effect": "4.0.1",
     "langchain": "1.5.10"
   },
   "devDependencies": {
     "@types/bun": "1.3.10",
-    "@relkit/cli": "0.7.6",
-    "@relkit/testing": "0.7.6",
+    "@relkit/cli": "0.7.8",
+    "@relkit/testing": "0.7.8",
     "typescript": "5.9.3"
   }
 }

package/dist/templates/default/v1/agent/tsconfig.json

@@ -19,7 +19,7 @@
     "skipLibCheck": true,
     "forceConsistentCasingInFileNames": true
   },
-  "files": [".relkit/generated/route-module-checks.ts"],
+  "files": [".relkit/generated/route-module-checks.ts", ".relkit/generated/context-registry.d.ts"],
   "include": ["src/**/*.ts", "tests/**/*.ts", "relkit.config.ts"],
   "exclude": ["node_modules", ".relkit"]
 }

package/dist/templates/default/v1/api/.agents/skills/relkit/SKILL.md

@@ -7,6 +7,20 @@ description: Build or extend a RELKIT CLI-generated application using its instal
 
 Run commands from the generated application's root, where `relkit.config.ts` and `package.json` live. Use `bun run relkit` to invoke the project's installed CLI. Check `bun run relkit <command> --help` before relying on an option, especially after a dependency upgrade.
 
+## Understand the requested work
+
+Infer the intent from the request; do not ask the user to classify it.
+
+- For a feature, establish the problem, scope, expected behavior and acceptance criteria. Explain a short implementation and verification plan before editing, then proceed with the authorized work.
+- For a bug, establish expected versus actual behavior, attempt reproduction, and trace the affected execution path. Distinguish a confirmed cause from a hypothesis, and explain the proposed fix and verification before editing. Report unavailable reproduction honestly.
+- For a discussion, explain options, tradeoffs and a recommendation without changing files. For mixed requests, keep the discussion portion read-only and implement only the requested work.
+
+Before scaffolding a new app, establish the database engine and driver (or an explicit no-database choice) and whether authentication is needed. Ask missing choices together before writing files. Reuse supplied choices and existing project decisions; do not restart onboarding for an unrelated bug or small change. If requested auth needs persistence but the user chose no database, explain and resolve that conflict before scaffolding. Use supported create/add options; do not invent database/auth creation flags or change headless defaults.
+
+Recommend optional modules only when they solve a concrete part of this task: for example, realtime for live order status or a bucket for uploads. Explain the benefit and ask for a selection when the capability was not requested. For an explicitly requested capability, resolve only missing provider/configuration decisions. Check installed CLI help and declarations for support; explain unavailable options before editing. A plan is not another permission gate for work already authorized.
+
+Default to backend work. Do not introduce frontend pages, app.js, assets.css or demo interfaces unless requested. Preserve existing frontend files, explicitly selected fullstack functionality and the framework Inspector. For users and orders, define separate resource endpoints with explicit input/output contracts, validation and applicable authorization; avoid a public table dispatcher controlled by an entity parameter. Internal tables and infrastructure services need no public endpoint. Preserve intentional protocol handlers such as the Better Auth mount and shared internal helpers.
+
 ## Source placement
 
 New projects place every generic, database, and auth boundary at `src/services/<name>/service.ts`. Keep its functions, events, tasks, jobs, tools, agents, channels, schemas, resources, helpers, and assets under that service. Routes live at `src/routes`; configuration support and environment contracts live at `src/platform`. Application descriptors use plain TypeScript and supported public APIs; Effect imports are not required.
@@ -45,4 +59,6 @@ Read only the reference relevant to the requested change. These examples describ
 
 ## Verify the result
 
-Review the CLI's created and updated files, warnings, and next steps. Run `bun run check`, `bun run typecheck`, and focused tests after editing. For HTTP work, exercise the route itself; a direct function test does not cover request mapping. Database and auth work also needs the reported environment and migration steps before runtime verification.
+Review the CLI's created and updated files, warnings, next steps and final diff. Run focused checks after logical changes. Before completion, run applicable check, typecheck, build, unit/integration tests and existing relevant end-to-end coverage. Inspect package.json for actual script names. For HTTP work, test the route's status/body, valid and invalid input, and denied and allowed access where relevant; a direct function test does not cover request mapping or the complete flow. Replay the original bug through the boundary that failed. Backend/API tests do not require an unsolicited frontend.
+
+Database/auth changes also need explicit environment setup and migration steps from [the data reference](references/data-apis.md), followed by persistence/session/authorization verification. Stop all test-owned servers and clients. Report what changed, exact verification performed, and every failed, skipped or blocked check with its effect on confidence. Written code or passing unit tests alone is not fully verified delivery when affected runtime behavior remains untested.

package/dist/templates/default/v1/api/.agents/skills/relkit/references/cli.md

@@ -24,6 +24,13 @@ These examples use the local binary through `bun run relkit`. The installed CLI'
 
 Database `--dialect` and auth `--database-dialect` also accept `postgresql` and `mysql`. Auth's `--base-path` changes the default `/api/auth` mount. The CLI adds dependencies and an environment example as needed, but it does not apply database migrations or populate secrets. Follow the scaffold's reported next steps after reviewing the schema and environment values.
 
+Run `bun run db:generate`, review tracked SQL/metadata under the database service's
+`migrations` directory, then explicitly run `bun run db:migrate`. The latter uses
+installed `relkit db migrate`, defaulting to root `drizzle.config.ts`; select another
+with `bun run relkit db migrate --config <path>`. Configuration owns the target,
+history and supported log settings; relative paths use the app root. No copied
+runner is needed. See [database tooling](data-apis.md) for environment and failure behavior.
+
 ## Other add kinds
 
 Run `bun run relkit add <kind> --help` for each kind's flags and requirements:

package/dist/templates/default/v1/api/.agents/skills/relkit/references/data-apis.md

@@ -30,6 +30,22 @@ export default defineDrizzleService({
 
 Open the native connection in the `client({ env })` factory and close it with `dispose` when needed. Discovery does not run the factory. Generate and review migrations with the installed Drizzle tooling; service creation does not create tables or apply migrations. After `bun run check`, generated context declarations provide typed `context.database`.
 
+## Version and apply migration source
+
+New grouped scaffolds configure `src/services/database/migrations` beside the database service and schema. Keep SQL and required Drizzle metadata in Git, outside ignored `.relkit/`. One shared database has one ordered history, including authentication tables; do not create separate histories for business services. Existing flat apps retain their selected database service directory.
+
+Set the required environment in the application root's `.env` or shell, then run:
+
+```sh
+bun run db:generate
+# Review the generated SQL and metadata before applying them.
+bun run db:migrate
+```
+
+`db:generate` uses the installed Drizzle Kit. `db:migrate` invokes installed RELKIT tooling, `relkit db migrate`, without copying a runner into the app. Root `drizzle.config.ts` explicitly owns dialect, schema, migration output, connection and supported log options. To select another config, use `bun run relkit db migrate --config configs/database.ts`; relative output/database paths still use the application root. Keep delegated PostgreSQL/MySQL config deterministic because Kit loads it again. Existing shell variables take precedence over Bun's normal dotenv loading; `.env.example` is documentation only.
+
+Migration applies pending SQL only when explicitly invoked; scaffolding and service startup do not apply it, generate secrets or open the database. SQLite uses the Bun-native driver. PostgreSQL/MySQL delegate to the app's installed Kit under Bun. Missing/empty/incompatible history requires generation or a compatible ORM/Kit pair, not a reset or fallback directory. Review failures before another manual run: SQL is not automatically retried, and dialect-specific partial DDL is not guaranteed to roll back. Keep the generated dependency patch and registration while required by the installed release.
+
 ## `defineBetterAuthService`
 
 ```ts

package/dist/templates/default/v1/api/.agents/skills/relkit/references/domain-apis.md

@@ -31,6 +31,8 @@ export default defineService({ functions: { greet } });
 
 The service also accepts `events`, `tasks`, and `jobs` maps. Its members appear directly as `service.greet`; there is no `service.functions.greet` namespace. Membership makes a function available across domains, but does not create an HTTP route or grant authorization.
 
+Each `service.ts` constructs and exports exactly one runtime service value. Keep ordinary helpers and error descriptors inside their owning domain; expose callable operations through the service's `functions` map. Do not re-export helpers or descriptors from a specialized database or auth `service.ts`.
+
 Within a domain, import a sibling function directly. Across domains and from routes, import the other domain's `service.ts`. Invoke a function descriptor with `await service.greet.invoke(input)`; do not call its handler directly. Leave an internal function out of the service map. Tools, agents, caches, buckets, and event-only functions are not service members.
 
 ## `defineEvent` and `defineEventFunction`
@@ -89,4 +91,21 @@ export default defineError({
 });
 ```
 
-Declare only expected failures callers should handle on a function. Use the route layer for HTTP-specific request mapping and middleware.
+Declare only expected failures callers should handle on a function. Return each declared error through the public `fail` helper so it appears in the inferred handler result; throwing a declared error from an ordinary helper does not satisfy that contract. Use the route layer for HTTP-specific request mapping and middleware.
+
+```ts
+import { defineFunction, fail } from "@relkit/app/functions";
+import { z } from "@relkit/app/schema";
+import AuthenticationRequired from "../errors/authentication-required.error.js";
+
+export default defineFunction({
+  input: z.object({}),
+  output: z.object({ id: z.string() }),
+  errors: [AuthenticationRequired],
+  handler: async (_input, context) => {
+    const session = await context.auth.getSession();
+    if (session === null) return fail(AuthenticationRequired, {});
+    return { id: session.user.id };
+  },
+});
+```

package/dist/templates/default/v1/api/gitignore

@@ -2,9 +2,6 @@ node_modules/
 .env
 .env.*
 !.env.example
-.relkit/generated/
-.relkit/build/
-.relkit/state/
-.relkit/observability/
+.relkit/
 coverage/
 dist/

package/dist/templates/default/v1/api/package.json

@@ -15,13 +15,13 @@
     "graph": "relkit graph print"
   },
   "dependencies": {
-    "@relkit/app": "0.7.6",
+    "@relkit/app": "0.7.8",
     "effect": "4.0.1"
   },
   "devDependencies": {
     "@types/bun": "1.3.10",
-    "@relkit/cli": "0.7.6",
-    "@relkit/testing": "0.7.6",
+    "@relkit/cli": "0.7.8",
+    "@relkit/testing": "0.7.8",
     "typescript": "5.9.3"
   }
 }

package/dist/templates/default/v1/api/tsconfig.json

@@ -19,7 +19,7 @@
     "skipLibCheck": true,
     "forceConsistentCasingInFileNames": true
   },
-  "files": [".relkit/generated/route-module-checks.ts"],
+  "files": [".relkit/generated/route-module-checks.ts", ".relkit/generated/context-registry.d.ts"],
   "include": ["src/**/*.ts", "tests/**/*.ts", "relkit.config.ts"],
   "exclude": ["node_modules", ".relkit"]
 }

package/dist/templates/default/v1/fullstack/.agents/skills/relkit/SKILL.md

@@ -7,6 +7,20 @@ description: Build or extend a RELKIT CLI-generated application using its instal
 
 Run commands from the generated application's root, where `relkit.config.ts` and `package.json` live. Use `bun run relkit` to invoke the project's installed CLI. Check `bun run relkit <command> --help` before relying on an option, especially after a dependency upgrade.
 
+## Understand the requested work
+
+Infer the intent from the request; do not ask the user to classify it.
+
+- For a feature, establish the problem, scope, expected behavior and acceptance criteria. Explain a short implementation and verification plan before editing, then proceed with the authorized work.
+- For a bug, establish expected versus actual behavior, attempt reproduction, and trace the affected execution path. Distinguish a confirmed cause from a hypothesis, and explain the proposed fix and verification before editing. Report unavailable reproduction honestly.
+- For a discussion, explain options, tradeoffs and a recommendation without changing files. For mixed requests, keep the discussion portion read-only and implement only the requested work.
+
+Before scaffolding a new app, establish the database engine and driver (or an explicit no-database choice) and whether authentication is needed. Ask missing choices together before writing files. Reuse supplied choices and existing project decisions; do not restart onboarding for an unrelated bug or small change. If requested auth needs persistence but the user chose no database, explain and resolve that conflict before scaffolding. Use supported create/add options; do not invent database/auth creation flags or change headless defaults.
+
+Recommend optional modules only when they solve a concrete part of this task: for example, realtime for live order status or a bucket for uploads. Explain the benefit and ask for a selection when the capability was not requested. For an explicitly requested capability, resolve only missing provider/configuration decisions. Check installed CLI help and declarations for support; explain unavailable options before editing. A plan is not another permission gate for work already authorized.
+
+Default to backend work. Do not introduce frontend pages, app.js, assets.css or demo interfaces unless requested. Preserve existing frontend files, explicitly selected fullstack functionality and the framework Inspector. For users and orders, define separate resource endpoints with explicit input/output contracts, validation and applicable authorization; avoid a public table dispatcher controlled by an entity parameter. Internal tables and infrastructure services need no public endpoint. Preserve intentional protocol handlers such as the Better Auth mount and shared internal helpers.
+
 ## Source placement
 
 New projects place every generic, database, and auth boundary at `src/services/<name>/service.ts`. Keep its functions, events, tasks, jobs, tools, agents, channels, schemas, resources, helpers, and assets under that service. Routes live at `src/routes`; configuration support and environment contracts live at `src/platform`. Application descriptors use plain TypeScript and supported public APIs; Effect imports are not required.
@@ -45,4 +59,6 @@ Read only the reference relevant to the requested change. These examples describ
 
 ## Verify the result
 
-Review the CLI's created and updated files, warnings, and next steps. Run `bun run check`, `bun run typecheck`, and focused tests after editing. For HTTP work, exercise the route itself; a direct function test does not cover request mapping. Database and auth work also needs the reported environment and migration steps before runtime verification.
+Review the CLI's created and updated files, warnings, next steps and final diff. Run focused checks after logical changes. Before completion, run applicable check, typecheck, build, unit/integration tests and existing relevant end-to-end coverage. Inspect package.json for actual script names. For HTTP work, test the route's status/body, valid and invalid input, and denied and allowed access where relevant; a direct function test does not cover request mapping or the complete flow. Replay the original bug through the boundary that failed. Backend/API tests do not require an unsolicited frontend.
+
+Database/auth changes also need explicit environment setup and migration steps from [the data reference](references/data-apis.md), followed by persistence/session/authorization verification. Stop all test-owned servers and clients. Report what changed, exact verification performed, and every failed, skipped or blocked check with its effect on confidence. Written code or passing unit tests alone is not fully verified delivery when affected runtime behavior remains untested.

package/dist/templates/default/v1/fullstack/.agents/skills/relkit/references/cli.md

@@ -24,6 +24,13 @@ These examples use the local binary through `bun run relkit`. The installed CLI'
 
 Database `--dialect` and auth `--database-dialect` also accept `postgresql` and `mysql`. Auth's `--base-path` changes the default `/api/auth` mount. The CLI adds dependencies and an environment example as needed, but it does not apply database migrations or populate secrets. Follow the scaffold's reported next steps after reviewing the schema and environment values.
 
+Run `bun run db:generate`, review tracked SQL/metadata under the database service's
+`migrations` directory, then explicitly run `bun run db:migrate`. The latter uses
+installed `relkit db migrate`, defaulting to root `drizzle.config.ts`; select another
+with `bun run relkit db migrate --config <path>`. Configuration owns the target,
+history and supported log settings; relative paths use the app root. No copied
+runner is needed. See [database tooling](data-apis.md) for environment and failure behavior.
+
 ## Other add kinds
 
 Run `bun run relkit add <kind> --help` for each kind's flags and requirements:

package/dist/templates/default/v1/fullstack/.agents/skills/relkit/references/data-apis.md

@@ -30,6 +30,22 @@ export default defineDrizzleService({
 
 Open the native connection in the `client({ env })` factory and close it with `dispose` when needed. Discovery does not run the factory. Generate and review migrations with the installed Drizzle tooling; service creation does not create tables or apply migrations. After `bun run check`, generated context declarations provide typed `context.database`.
 
+## Version and apply migration source
+
+New grouped scaffolds configure `src/services/database/migrations` beside the database service and schema. Keep SQL and required Drizzle metadata in Git, outside ignored `.relkit/`. One shared database has one ordered history, including authentication tables; do not create separate histories for business services. Existing flat apps retain their selected database service directory.
+
+Set the required environment in the application root's `.env` or shell, then run:
+
+```sh
+bun run db:generate
+# Review the generated SQL and metadata before applying them.
+bun run db:migrate
+```
+
+`db:generate` uses the installed Drizzle Kit. `db:migrate` invokes installed RELKIT tooling, `relkit db migrate`, without copying a runner into the app. Root `drizzle.config.ts` explicitly owns dialect, schema, migration output, connection and supported log options. To select another config, use `bun run relkit db migrate --config configs/database.ts`; relative output/database paths still use the application root. Keep delegated PostgreSQL/MySQL config deterministic because Kit loads it again. Existing shell variables take precedence over Bun's normal dotenv loading; `.env.example` is documentation only.
+
+Migration applies pending SQL only when explicitly invoked; scaffolding and service startup do not apply it, generate secrets or open the database. SQLite uses the Bun-native driver. PostgreSQL/MySQL delegate to the app's installed Kit under Bun. Missing/empty/incompatible history requires generation or a compatible ORM/Kit pair, not a reset or fallback directory. Review failures before another manual run: SQL is not automatically retried, and dialect-specific partial DDL is not guaranteed to roll back. Keep the generated dependency patch and registration while required by the installed release.
+
 ## `defineBetterAuthService`
 
 ```ts

package/dist/templates/default/v1/fullstack/.agents/skills/relkit/references/domain-apis.md

@@ -31,6 +31,8 @@ export default defineService({ functions: { greet } });
 
 The service also accepts `events`, `tasks`, and `jobs` maps. Its members appear directly as `service.greet`; there is no `service.functions.greet` namespace. Membership makes a function available across domains, but does not create an HTTP route or grant authorization.
 
+Each `service.ts` constructs and exports exactly one runtime service value. Keep ordinary helpers and error descriptors inside their owning domain; expose callable operations through the service's `functions` map. Do not re-export helpers or descriptors from a specialized database or auth `service.ts`.
+
 Within a domain, import a sibling function directly. Across domains and from routes, import the other domain's `service.ts`. Invoke a function descriptor with `await service.greet.invoke(input)`; do not call its handler directly. Leave an internal function out of the service map. Tools, agents, caches, buckets, and event-only functions are not service members.
 
 ## `defineEvent` and `defineEventFunction`
@@ -89,4 +91,21 @@ export default defineError({
 });
 ```
 
-Declare only expected failures callers should handle on a function. Use the route layer for HTTP-specific request mapping and middleware.
+Declare only expected failures callers should handle on a function. Return each declared error through the public `fail` helper so it appears in the inferred handler result; throwing a declared error from an ordinary helper does not satisfy that contract. Use the route layer for HTTP-specific request mapping and middleware.
+
+```ts
+import { defineFunction, fail } from "@relkit/app/functions";
+import { z } from "@relkit/app/schema";
+import AuthenticationRequired from "../errors/authentication-required.error.js";
+
+export default defineFunction({
+  input: z.object({}),
+  output: z.object({ id: z.string() }),
+  errors: [AuthenticationRequired],
+  handler: async (_input, context) => {
+    const session = await context.auth.getSession();
+    if (session === null) return fail(AuthenticationRequired, {});
+    return { id: session.user.id };
+  },
+});
+```

package/dist/templates/default/v1/fullstack/gitignore

@@ -1,4 +1,6 @@
 node_modules
 .next
-.relkit
+.relkit/
 .env
+.env.*
+!.env.example

package/dist/templates/default/v1/fullstack/package.json

@@ -15,9 +15,9 @@
   },
   "dependencies": {
     "@langchain/langgraph": "1.4.14",
-    "@relkit/app": "0.7.6",
-    "@relkit/client": "0.7.6",
-    "@relkit/local": "0.7.6",
+    "@relkit/app": "0.7.8",
+    "@relkit/client": "0.7.8",
+    "@relkit/local": "0.7.8",
     "@tanstack/react-query": "5.102.3",
     "effect": "4.0.1",
     "langchain": "1.5.10",
@@ -26,8 +26,8 @@
     "react-dom": "19.2.8"
   },
   "devDependencies": {
-    "@relkit/cli": "0.7.6",
-    "@relkit/testing": "0.7.6",
+    "@relkit/cli": "0.7.8",
+    "@relkit/testing": "0.7.8",
     "@types/bun": "1.3.10",
     "@types/react": "19.2.18",
     "@types/react-dom": "19.2.7",

package/dist/templates/default/v1/fullstack/tsconfig.json

@@ -18,7 +18,7 @@
     "noEmit": true,
     "skipLibCheck": true
   },
-  "files": [".relkit/generated/route-module-checks.ts"],
+  "files": [".relkit/generated/route-module-checks.ts", ".relkit/generated/context-registry.d.ts"],
   "include": ["src/**/*.ts", "tests/**/*.ts", "relkit.config.ts"],
   "exclude": ["node_modules", ".relkit", "web"]
 }

package/dist/templates/default/v1/minimal/.agents/skills/relkit/SKILL.md

@@ -7,6 +7,20 @@ description: Build or extend a RELKIT CLI-generated application using its instal
 
 Run commands from the generated application's root, where `relkit.config.ts` and `package.json` live. Use `bun run relkit` to invoke the project's installed CLI. Check `bun run relkit <command> --help` before relying on an option, especially after a dependency upgrade.
 
+## Understand the requested work
+
+Infer the intent from the request; do not ask the user to classify it.
+
+- For a feature, establish the problem, scope, expected behavior and acceptance criteria. Explain a short implementation and verification plan before editing, then proceed with the authorized work.
+- For a bug, establish expected versus actual behavior, attempt reproduction, and trace the affected execution path. Distinguish a confirmed cause from a hypothesis, and explain the proposed fix and verification before editing. Report unavailable reproduction honestly.
+- For a discussion, explain options, tradeoffs and a recommendation without changing files. For mixed requests, keep the discussion portion read-only and implement only the requested work.
+
+Before scaffolding a new app, establish the database engine and driver (or an explicit no-database choice) and whether authentication is needed. Ask missing choices together before writing files. Reuse supplied choices and existing project decisions; do not restart onboarding for an unrelated bug or small change. If requested auth needs persistence but the user chose no database, explain and resolve that conflict before scaffolding. Use supported create/add options; do not invent database/auth creation flags or change headless defaults.
+
+Recommend optional modules only when they solve a concrete part of this task: for example, realtime for live order status or a bucket for uploads. Explain the benefit and ask for a selection when the capability was not requested. For an explicitly requested capability, resolve only missing provider/configuration decisions. Check installed CLI help and declarations for support; explain unavailable options before editing. A plan is not another permission gate for work already authorized.
+
+Default to backend work. Do not introduce frontend pages, app.js, assets.css or demo interfaces unless requested. Preserve existing frontend files, explicitly selected fullstack functionality and the framework Inspector. For users and orders, define separate resource endpoints with explicit input/output contracts, validation and applicable authorization; avoid a public table dispatcher controlled by an entity parameter. Internal tables and infrastructure services need no public endpoint. Preserve intentional protocol handlers such as the Better Auth mount and shared internal helpers.
+
 ## Source placement
 
 New projects place every generic, database, and auth boundary at `src/services/<name>/service.ts`. Keep its functions, events, tasks, jobs, tools, agents, channels, schemas, resources, helpers, and assets under that service. Routes live at `src/routes`; configuration support and environment contracts live at `src/platform`. Application descriptors use plain TypeScript and supported public APIs; Effect imports are not required.
@@ -45,4 +59,6 @@ Read only the reference relevant to the requested change. These examples describ
 
 ## Verify the result
 
-Review the CLI's created and updated files, warnings, and next steps. Run `bun run check`, `bun run typecheck`, and focused tests after editing. For HTTP work, exercise the route itself; a direct function test does not cover request mapping. Database and auth work also needs the reported environment and migration steps before runtime verification.
+Review the CLI's created and updated files, warnings, next steps and final diff. Run focused checks after logical changes. Before completion, run applicable check, typecheck, build, unit/integration tests and existing relevant end-to-end coverage. Inspect package.json for actual script names. For HTTP work, test the route's status/body, valid and invalid input, and denied and allowed access where relevant; a direct function test does not cover request mapping or the complete flow. Replay the original bug through the boundary that failed. Backend/API tests do not require an unsolicited frontend.
+
+Database/auth changes also need explicit environment setup and migration steps from [the data reference](references/data-apis.md), followed by persistence/session/authorization verification. Stop all test-owned servers and clients. Report what changed, exact verification performed, and every failed, skipped or blocked check with its effect on confidence. Written code or passing unit tests alone is not fully verified delivery when affected runtime behavior remains untested.

package/dist/templates/default/v1/minimal/.agents/skills/relkit/references/cli.md

@@ -24,6 +24,13 @@ These examples use the local binary through `bun run relkit`. The installed CLI'
 
 Database `--dialect` and auth `--database-dialect` also accept `postgresql` and `mysql`. Auth's `--base-path` changes the default `/api/auth` mount. The CLI adds dependencies and an environment example as needed, but it does not apply database migrations or populate secrets. Follow the scaffold's reported next steps after reviewing the schema and environment values.
 
+Run `bun run db:generate`, review tracked SQL/metadata under the database service's
+`migrations` directory, then explicitly run `bun run db:migrate`. The latter uses
+installed `relkit db migrate`, defaulting to root `drizzle.config.ts`; select another
+with `bun run relkit db migrate --config <path>`. Configuration owns the target,
+history and supported log settings; relative paths use the app root. No copied
+runner is needed. See [database tooling](data-apis.md) for environment and failure behavior.
+
 ## Other add kinds
 
 Run `bun run relkit add <kind> --help` for each kind's flags and requirements:

package/dist/templates/default/v1/minimal/.agents/skills/relkit/references/data-apis.md

@@ -30,6 +30,22 @@ export default defineDrizzleService({
 
 Open the native connection in the `client({ env })` factory and close it with `dispose` when needed. Discovery does not run the factory. Generate and review migrations with the installed Drizzle tooling; service creation does not create tables or apply migrations. After `bun run check`, generated context declarations provide typed `context.database`.
 
+## Version and apply migration source
+
+New grouped scaffolds configure `src/services/database/migrations` beside the database service and schema. Keep SQL and required Drizzle metadata in Git, outside ignored `.relkit/`. One shared database has one ordered history, including authentication tables; do not create separate histories for business services. Existing flat apps retain their selected database service directory.
+
+Set the required environment in the application root's `.env` or shell, then run:
+
+```sh
+bun run db:generate
+# Review the generated SQL and metadata before applying them.
+bun run db:migrate
+```
+
+`db:generate` uses the installed Drizzle Kit. `db:migrate` invokes installed RELKIT tooling, `relkit db migrate`, without copying a runner into the app. Root `drizzle.config.ts` explicitly owns dialect, schema, migration output, connection and supported log options. To select another config, use `bun run relkit db migrate --config configs/database.ts`; relative output/database paths still use the application root. Keep delegated PostgreSQL/MySQL config deterministic because Kit loads it again. Existing shell variables take precedence over Bun's normal dotenv loading; `.env.example` is documentation only.
+
+Migration applies pending SQL only when explicitly invoked; scaffolding and service startup do not apply it, generate secrets or open the database. SQLite uses the Bun-native driver. PostgreSQL/MySQL delegate to the app's installed Kit under Bun. Missing/empty/incompatible history requires generation or a compatible ORM/Kit pair, not a reset or fallback directory. Review failures before another manual run: SQL is not automatically retried, and dialect-specific partial DDL is not guaranteed to roll back. Keep the generated dependency patch and registration while required by the installed release.
+
 ## `defineBetterAuthService`
 
 ```ts

package/dist/templates/default/v1/minimal/.agents/skills/relkit/references/domain-apis.md

@@ -31,6 +31,8 @@ export default defineService({ functions: { greet } });
 
 The service also accepts `events`, `tasks`, and `jobs` maps. Its members appear directly as `service.greet`; there is no `service.functions.greet` namespace. Membership makes a function available across domains, but does not create an HTTP route or grant authorization.
 
+Each `service.ts` constructs and exports exactly one runtime service value. Keep ordinary helpers and error descriptors inside their owning domain; expose callable operations through the service's `functions` map. Do not re-export helpers or descriptors from a specialized database or auth `service.ts`.
+
 Within a domain, import a sibling function directly. Across domains and from routes, import the other domain's `service.ts`. Invoke a function descriptor with `await service.greet.invoke(input)`; do not call its handler directly. Leave an internal function out of the service map. Tools, agents, caches, buckets, and event-only functions are not service members.
 
 ## `defineEvent` and `defineEventFunction`
@@ -89,4 +91,21 @@ export default defineError({
 });
 ```
 
-Declare only expected failures callers should handle on a function. Use the route layer for HTTP-specific request mapping and middleware.
+Declare only expected failures callers should handle on a function. Return each declared error through the public `fail` helper so it appears in the inferred handler result; throwing a declared error from an ordinary helper does not satisfy that contract. Use the route layer for HTTP-specific request mapping and middleware.
+
+```ts
+import { defineFunction, fail } from "@relkit/app/functions";
+import { z } from "@relkit/app/schema";
+import AuthenticationRequired from "../errors/authentication-required.error.js";
+
+export default defineFunction({
+  input: z.object({}),
+  output: z.object({ id: z.string() }),
+  errors: [AuthenticationRequired],
+  handler: async (_input, context) => {
+    const session = await context.auth.getSession();
+    if (session === null) return fail(AuthenticationRequired, {});
+    return { id: session.user.id };
+  },
+});
+```

package/dist/templates/default/v1/minimal/gitignore

@@ -2,9 +2,6 @@ node_modules/
 .env
 .env.*
 !.env.example
-.relkit/generated/
-.relkit/build/
-.relkit/state/
-.relkit/observability/
+.relkit/
 coverage/
 dist/

package/dist/templates/default/v1/minimal/package.json

@@ -15,13 +15,13 @@
     "graph": "relkit graph print"
   },
   "dependencies": {
-    "@relkit/app": "0.7.6",
+    "@relkit/app": "0.7.8",
     "effect": "4.0.1"
   },
   "devDependencies": {
     "@types/bun": "1.3.10",
-    "@relkit/cli": "0.7.6",
-    "@relkit/testing": "0.7.6",
+    "@relkit/cli": "0.7.8",
+    "@relkit/testing": "0.7.8",
     "typescript": "5.9.3"
   }
 }

package/dist/templates/default/v1/minimal/tsconfig.json

@@ -19,7 +19,7 @@
     "skipLibCheck": true,
     "forceConsistentCasingInFileNames": true
   },
-  "files": [".relkit/generated/route-module-checks.ts"],
+  "files": [".relkit/generated/route-module-checks.ts", ".relkit/generated/context-registry.d.ts"],
   "include": ["src/**/*.ts", "tests/**/*.ts", "relkit.config.ts"],
   "exclude": ["node_modules", ".relkit"]
 }

package/dist/templates/default/v1/tasks/.agents/skills/relkit/SKILL.md

@@ -7,6 +7,20 @@ description: Build or extend a RELKIT CLI-generated application using its instal
 
 Run commands from the generated application's root, where `relkit.config.ts` and `package.json` live. Use `bun run relkit` to invoke the project's installed CLI. Check `bun run relkit <command> --help` before relying on an option, especially after a dependency upgrade.
 
+## Understand the requested work
+
+Infer the intent from the request; do not ask the user to classify it.
+
+- For a feature, establish the problem, scope, expected behavior and acceptance criteria. Explain a short implementation and verification plan before editing, then proceed with the authorized work.
+- For a bug, establish expected versus actual behavior, attempt reproduction, and trace the affected execution path. Distinguish a confirmed cause from a hypothesis, and explain the proposed fix and verification before editing. Report unavailable reproduction honestly.
+- For a discussion, explain options, tradeoffs and a recommendation without changing files. For mixed requests, keep the discussion portion read-only and implement only the requested work.
+
+Before scaffolding a new app, establish the database engine and driver (or an explicit no-database choice) and whether authentication is needed. Ask missing choices together before writing files. Reuse supplied choices and existing project decisions; do not restart onboarding for an unrelated bug or small change. If requested auth needs persistence but the user chose no database, explain and resolve that conflict before scaffolding. Use supported create/add options; do not invent database/auth creation flags or change headless defaults.
+
+Recommend optional modules only when they solve a concrete part of this task: for example, realtime for live order status or a bucket for uploads. Explain the benefit and ask for a selection when the capability was not requested. For an explicitly requested capability, resolve only missing provider/configuration decisions. Check installed CLI help and declarations for support; explain unavailable options before editing. A plan is not another permission gate for work already authorized.
+
+Default to backend work. Do not introduce frontend pages, app.js, assets.css or demo interfaces unless requested. Preserve existing frontend files, explicitly selected fullstack functionality and the framework Inspector. For users and orders, define separate resource endpoints with explicit input/output contracts, validation and applicable authorization; avoid a public table dispatcher controlled by an entity parameter. Internal tables and infrastructure services need no public endpoint. Preserve intentional protocol handlers such as the Better Auth mount and shared internal helpers.
+
 ## Source placement
 
 New projects place every generic, database, and auth boundary at `src/services/<name>/service.ts`. Keep its functions, events, tasks, jobs, tools, agents, channels, schemas, resources, helpers, and assets under that service. Routes live at `src/routes`; configuration support and environment contracts live at `src/platform`. Application descriptors use plain TypeScript and supported public APIs; Effect imports are not required.
@@ -45,4 +59,6 @@ Read only the reference relevant to the requested change. These examples describ
 
 ## Verify the result
 
-Review the CLI's created and updated files, warnings, and next steps. Run `bun run check`, `bun run typecheck`, and focused tests after editing. For HTTP work, exercise the route itself; a direct function test does not cover request mapping. Database and auth work also needs the reported environment and migration steps before runtime verification.
+Review the CLI's created and updated files, warnings, next steps and final diff. Run focused checks after logical changes. Before completion, run applicable check, typecheck, build, unit/integration tests and existing relevant end-to-end coverage. Inspect package.json for actual script names. For HTTP work, test the route's status/body, valid and invalid input, and denied and allowed access where relevant; a direct function test does not cover request mapping or the complete flow. Replay the original bug through the boundary that failed. Backend/API tests do not require an unsolicited frontend.
+
+Database/auth changes also need explicit environment setup and migration steps from [the data reference](references/data-apis.md), followed by persistence/session/authorization verification. Stop all test-owned servers and clients. Report what changed, exact verification performed, and every failed, skipped or blocked check with its effect on confidence. Written code or passing unit tests alone is not fully verified delivery when affected runtime behavior remains untested.

package/dist/templates/default/v1/tasks/.agents/skills/relkit/references/cli.md

@@ -24,6 +24,13 @@ These examples use the local binary through `bun run relkit`. The installed CLI'
 
 Database `--dialect` and auth `--database-dialect` also accept `postgresql` and `mysql`. Auth's `--base-path` changes the default `/api/auth` mount. The CLI adds dependencies and an environment example as needed, but it does not apply database migrations or populate secrets. Follow the scaffold's reported next steps after reviewing the schema and environment values.
 
+Run `bun run db:generate`, review tracked SQL/metadata under the database service's
+`migrations` directory, then explicitly run `bun run db:migrate`. The latter uses
+installed `relkit db migrate`, defaulting to root `drizzle.config.ts`; select another
+with `bun run relkit db migrate --config <path>`. Configuration owns the target,
+history and supported log settings; relative paths use the app root. No copied
+runner is needed. See [database tooling](data-apis.md) for environment and failure behavior.
+
 ## Other add kinds
 
 Run `bun run relkit add <kind> --help` for each kind's flags and requirements:

package/dist/templates/default/v1/tasks/.agents/skills/relkit/references/data-apis.md

@@ -30,6 +30,22 @@ export default defineDrizzleService({
 
 Open the native connection in the `client({ env })` factory and close it with `dispose` when needed. Discovery does not run the factory. Generate and review migrations with the installed Drizzle tooling; service creation does not create tables or apply migrations. After `bun run check`, generated context declarations provide typed `context.database`.
 
+## Version and apply migration source
+
+New grouped scaffolds configure `src/services/database/migrations` beside the database service and schema. Keep SQL and required Drizzle metadata in Git, outside ignored `.relkit/`. One shared database has one ordered history, including authentication tables; do not create separate histories for business services. Existing flat apps retain their selected database service directory.
+
+Set the required environment in the application root's `.env` or shell, then run:
+
+```sh
+bun run db:generate
+# Review the generated SQL and metadata before applying them.
+bun run db:migrate
+```
+
+`db:generate` uses the installed Drizzle Kit. `db:migrate` invokes installed RELKIT tooling, `relkit db migrate`, without copying a runner into the app. Root `drizzle.config.ts` explicitly owns dialect, schema, migration output, connection and supported log options. To select another config, use `bun run relkit db migrate --config configs/database.ts`; relative output/database paths still use the application root. Keep delegated PostgreSQL/MySQL config deterministic because Kit loads it again. Existing shell variables take precedence over Bun's normal dotenv loading; `.env.example` is documentation only.
+
+Migration applies pending SQL only when explicitly invoked; scaffolding and service startup do not apply it, generate secrets or open the database. SQLite uses the Bun-native driver. PostgreSQL/MySQL delegate to the app's installed Kit under Bun. Missing/empty/incompatible history requires generation or a compatible ORM/Kit pair, not a reset or fallback directory. Review failures before another manual run: SQL is not automatically retried, and dialect-specific partial DDL is not guaranteed to roll back. Keep the generated dependency patch and registration while required by the installed release.
+
 ## `defineBetterAuthService`
 
 ```ts

package/dist/templates/default/v1/tasks/.agents/skills/relkit/references/domain-apis.md

@@ -31,6 +31,8 @@ export default defineService({ functions: { greet } });
 
 The service also accepts `events`, `tasks`, and `jobs` maps. Its members appear directly as `service.greet`; there is no `service.functions.greet` namespace. Membership makes a function available across domains, but does not create an HTTP route or grant authorization.
 
+Each `service.ts` constructs and exports exactly one runtime service value. Keep ordinary helpers and error descriptors inside their owning domain; expose callable operations through the service's `functions` map. Do not re-export helpers or descriptors from a specialized database or auth `service.ts`.
+
 Within a domain, import a sibling function directly. Across domains and from routes, import the other domain's `service.ts`. Invoke a function descriptor with `await service.greet.invoke(input)`; do not call its handler directly. Leave an internal function out of the service map. Tools, agents, caches, buckets, and event-only functions are not service members.
 
 ## `defineEvent` and `defineEventFunction`
@@ -89,4 +91,21 @@ export default defineError({
 });
 ```
 
-Declare only expected failures callers should handle on a function. Use the route layer for HTTP-specific request mapping and middleware.
+Declare only expected failures callers should handle on a function. Return each declared error through the public `fail` helper so it appears in the inferred handler result; throwing a declared error from an ordinary helper does not satisfy that contract. Use the route layer for HTTP-specific request mapping and middleware.
+
+```ts
+import { defineFunction, fail } from "@relkit/app/functions";
+import { z } from "@relkit/app/schema";
+import AuthenticationRequired from "../errors/authentication-required.error.js";
+
+export default defineFunction({
+  input: z.object({}),
+  output: z.object({ id: z.string() }),
+  errors: [AuthenticationRequired],
+  handler: async (_input, context) => {
+    const session = await context.auth.getSession();
+    if (session === null) return fail(AuthenticationRequired, {});
+    return { id: session.user.id };
+  },
+});
+```

package/dist/templates/default/v1/tasks/gitignore

@@ -2,9 +2,6 @@ node_modules/
 .env
 .env.*
 !.env.example
-.relkit/generated/
-.relkit/build/
-.relkit/state/
-.relkit/observability/
+.relkit/
 coverage/
 dist/

package/dist/templates/default/v1/tasks/package.json

@@ -13,13 +13,13 @@
     "jobs:trigger": "relkit jobs trigger --job exportOrders --input-file examples/export-orders.json --operation-id example-trigger"
   },
   "dependencies": {
-    "@relkit/app": "0.7.6",
+    "@relkit/app": "0.7.8",
     "effect": "4.0.1"
   },
   "devDependencies": {
     "@types/bun": "1.3.10",
-    "@relkit/cli": "0.7.6",
-    "@relkit/testing": "0.7.6",
+    "@relkit/cli": "0.7.8",
+    "@relkit/testing": "0.7.8",
     "typescript": "5.9.3"
   }
 }

package/dist/templates/default/v1/tasks/tsconfig.json

@@ -13,6 +13,6 @@
     "baseUrl": ".",
     "paths": { "@app/*": ["src/*"] }
   },
-  "files": [".relkit/generated/route-module-checks.ts"],
+  "files": [".relkit/generated/route-module-checks.ts", ".relkit/generated/context-registry.d.ts"],
   "include": ["src", "tests", "examples"]
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "create-relkit",
-  "version": "0.7.6",
+  "version": "0.7.8",
   "description": "Create a RELKIT application from a supported project template.",
   "license": "MIT",
   "repository": {
@@ -44,10 +44,10 @@
   },
   "dependencies": {
     "@clack/prompts": "1.7.0",
-    "@relkit/compiler": "0.7.6",
+    "@relkit/compiler": "0.7.8",
     "typescript": "5.9.3",
     "effect": "4.0.1",
-    "@relkit/contracts": "0.7.6"
+    "@relkit/contracts": "0.7.8"
   },
   "devDependencies": {
     "@effect/vitest": "4.0.1",