Update to Inngest

{
  "description": "Use when analyzing an existing TypeScript or JavaScript codebase to decide where and how to introduce Inngest. Covers repository discovery, framework and package detection, finding durability gaps in HTTP handlers, webhooks, cron jobs, queues, long-running jobs, AI agents, Agent Evals, polling loops, eval loops, and side-effect-heavy code, then producing and implementing an incremental integration plan.",
  "included_files": [],
  "name": "inngest-brownfield-audit",
  "skill_md_contents": "---\nname: inngest-brownfield-audit\ndescription: Use when analyzing an existing TypeScript or JavaScript codebase to decide where and how to introduce Inngest. Covers repository discovery, framework and package detection, finding durability gaps in HTTP handlers, webhooks, cron jobs, queues, long-running jobs, AI agents, Agent Evals, polling loops, eval loops, and side-effect-heavy code, then producing and implementing an incremental integration plan.\n---\n\n# Inngest Brownfield Audit\n\nUse this skill when the user asks Codex to inspect an existing codebase, add\nInngest \"where it makes sense\", migrate fragile background work, or find\ndurability gaps before making changes.\n\nThis is an agent-first workflow. Do the audit from evidence in the repo, name\nthe specific files and call sites that drove each conclusion, and make small\nintegration moves that preserve current behavior.\n\n## When to Trigger\n\nUse this skill for requests like:\n\n- \"Audit this repo for Inngest opportunities\"\n- \"Add Inngest to this codebase\"\n- \"Make our webhooks / cron jobs / background tasks reliable\"\n- \"Find places where work can be lost on deploy or process crash\"\n- \"Replace fragile polling, delayed jobs, or fire-and-forget promises\"\n- \"Make this AI workflow / agent durable\"\n\nIf the user is starting from scratch instead of a brownfield repo, use\n`inngest-setup`, `inngest-durable-functions`, `inngest-events`,\n`inngest-steps`, and, for AI workflows, the agent patterns in this skill. Use\n`inngest-agent-evals` when the request includes scoring, sessions, experiments,\ndeferred scorers, Insights, or outcome-based evaluation.\n\n## Audit Loop\n\n1. **Map the project shape.**\n   - Read `package.json`, workspace files, app/router structure, server entry\n     points, deployment config, and test scripts.\n   - Identify framework: Next.js App Router, Next.js Pages Router, Express,\n     Hono, Fastify, Remix, SvelteKit, Astro, NestJS, worker-only service, or\n     other.\n   - Detect package manager and TypeScript conventions before adding files.\n\n2. **Find existing Inngest usage.**\n   - Search for `inngest`, `createFunction`, `serve(`, `/api/inngest`,\n     `INNGEST_`, `step.run`, `step.sleep`, `step.waitForEvent`,\n     `step.sendEvent`, `step.invoke`, `step.ai`, `inngest.send`, and\n     `@inngest/realtime`.\n   - If Inngest exists, inspect version, client config, serve endpoint,\n     registered functions, event naming, env vars, and v3/v4 API shape before\n     changing anything.\n\n3. **Find durability gaps.**\n   - Search for fire-and-forget work: `void someAsync()`, un-awaited promises,\n     `.then(` chains, `setTimeout`, `setInterval`, detached jobs after HTTP\n     response, and background work in route handlers.\n   - Search for cron and schedulers: `cron`, `node-cron`, `agenda`, `bull`,\n     `bullmq`, `bee-queue`, `qstash`, `sqs`, `temporal`, `trigger.dev`,\n     deployment cron config, and scheduled API routes.\n   - Search for webhooks and at-least-once producers: Stripe, Clerk, GitHub,\n     Slack, Shopify, HubSpot, Linear, Svix, and generic `webhook`.\n   - Search for long-running work: PDF generation, exports, video/image\n     processing, embeddings, bulk email, imports, ETL, sync jobs, polling loops,\n     retries, and external API calls.\n   - Search for AI agent shapes: tool loops, LLM calls, streaming tokens,\n     human approval, multi-step reasoning, vector search, eval loops, scoring,\n     experiment assignment, user-feedback signals, and provider calls that need\n     rate limits or retry-safe state.\n\n4. **Classify each candidate.**\n   - **P0:** user-visible loss, duplicate charge/email/action, timeout, missed\n     webhook, or crash-prone workflow.\n   - **P1:** fragile but recoverable background work, manual retry burden,\n     noisy 429s, or poor observability.\n   - **P2:** cleanup, ergonomics, or future migration opportunity.\n   - For each candidate, record: file, current trigger, side effects,\n     idempotency key, failure mode, recommended Inngest primitive, migration\n     size, and confidence.\n\n5. **Choose the smallest safe integration.**\n   - Prefer one vertical slice over a wide rewrite.\n   - Keep existing domain functions and data models where possible.\n   - Add an Inngest client and serve endpoint only once.\n   - Move side effects into `step.run` one boundary at a time.\n   - Make event IDs and database writes idempotent before adding retries.\n   - Add tests around existing behavior and the new event/function boundary.\n\n## Useful Discovery Commands\n\nRun commands that fit the repo. Prefer `rg`; keep output focused.\n\n```bash\nrg -n \"inngest|createFunction|step\\\\.|serve\\\\(|/api/inngest|INNGEST_\" .\nrg -n \"setTimeout|setInterval|Promise\\\\.all|void [a-zA-Z0-9_]+\\\\(|\\\\.then\\\\(\" .\nrg -n \"cron|node-cron|schedule|bull|bullmq|bee-queue|agenda|qstash|sqs\" .\nrg -n \"webhook|stripe|svix|clerk|github|shopify|slack|hubspot|linear\" .\nrg -n \"retry|backoff|poll|status|timeout|429|rate limit|rate-limit\" .\nrg -n \"openai|anthropic|ai\\\\.|generateText|streamText|tool|agent|embedding\" .\n```\n\nWhen the repo is large, narrow searches to app source directories and exclude\ngenerated/vendor folders.\n\n## Brownfield Decision Matrix\n\n| Existing shape | Inngest fit | Primary primitives |\n|---|---|---|\n| HTTP handler does slow side effects before responding | Emit event, return fast | `inngest.send`, event trigger, `step.run` |\n| Webhook must acknowledge quickly but process reliably | Verify signature, emit idempotent event | Event ID, `step.run`, retries |\n| Cron job loses progress midway | Cron-triggered durable function | Cron trigger, page-level `step.run`, flow control |\n| Polling loop waits for external async work | Durable wait or durable poll | `step.waitForEvent`, `step.sleep`, `step.run` |\n| Large fan-out exceeds request/serverless limits | Split orchestration and item work | `step.sendEvent`, per-item function, concurrency |\n| External API hits 429s | Move limits to function config | `throttle`, `rateLimit`, `concurrency` |\n| Human review can take days | Persist the wait in Inngest | `step.waitForEvent`, timeout, realtime |\n| AI agent/tool loop needs retry-safe progress | One step per tool/model boundary | `step.ai`, `step.run`, `step.sleep`, realtime |\n| AI workflow needs production evals | Attach outcome signals to durable runs | `meta.sessions`, `step.score`, `createScorer`, `defer`, `group.experiment` |\n| Existing queue only hides fragile work | Replace queue boundary gradually | Event trigger, idempotency, function-level retries |\n\n## Integration Plan Format\n\nBefore editing, summarize findings in this compact shape:\n\n```text\nInngest audit:\n- Existing Inngest: none / partial / healthy / risky\n- Framework: <framework and evidence>\n- Best first slice: <file + workflow>\n- Why: <loss/timeout/retry/idempotency failure>\n- Proposed primitives: <event, steps, flow control, waits, realtime>\n- Idempotency key: <source of truth>\n- Files likely touched: <short list>\n- Tests/checks: <commands or focused cases>\n```\n\nThen implement unless the user asked for audit-only.\n\n## Existing Inngest Checklist\n\nIf Inngest is already present, verify:\n\n- A single shared client is exported from a stable module.\n- The app `id` is a stable slug and is not derived from deploy-specific data.\n- v4 local development uses `INNGEST_DEV=1`; production uses\n  `INNGEST_SIGNING_KEY`.\n- Serve endpoint path is discoverable, usually `/api/inngest`.\n- The serve handler registers all functions that should sync.\n- Side effects and non-deterministic work are inside steps.\n- Step IDs are stable and descriptive.\n- Event names follow `domain/noun.verb`.\n- Events that may be replayed use deterministic IDs.\n- Webhook handlers verify signatures before emitting events.\n- Flow control is configured where external APIs have limits.\n- Realtime uses v4 native `inngest/realtime`, not the v3\n  `@inngest/realtime` package.\n\n## Durable Agent Patterns\n\nUse Inngest when an AI or agent workflow needs durable progress across model\ncalls, tool calls, waits, approvals, or streaming UI updates.\n\nGood candidates:\n\n- Multi-step agent that calls tools or external APIs.\n- LLM workflow that may exceed one HTTP request lifetime.\n- Human-in-the-loop review, approval, correction, or escalation.\n- Agent that must pause for an external event or scheduled follow-up.\n- Bulk AI work that needs provider-level rate limits and cost protection.\n- User-visible agent progress that should stream from durable execution.\n\nRecommended shape:\n\n1. HTTP/UI request stores the user intent and emits an event with a stable\n   `id`.\n2. Inngest function loads state inside `step.run`.\n3. Each model call, tool call, vector search, and external side effect lives in\n   its own `step.ai` or `step.run` boundary.\n4. Human pauses use `step.waitForEvent` or `step.waitForSignal` with a timeout.\n5. Progress updates use `step.realtime.publish` between steps, or\n   `inngest.realtime.publish` inside an existing `step.run`.\n6. Provider rate limits use `concurrency`, `throttle`, or `rateLimit`, not\n   ad hoc in-process throttlers.\n\nAvoid:\n\n- Keeping agent state only in memory.\n- Retrying whole agent loops after a single tool failure.\n- Charging for repeated successful model calls because the result was not\n  memoized.\n- Using `setTimeout` or a cron poller for follow-ups and approvals.\n- Streaming progress from a process-local WebSocket server when the workflow\n  itself is durable elsewhere.\n\n## Implementation Guardrails\n\n- Do not replace working queues, crons, or webhooks blindly. First preserve\n  behavior with a thin Inngest slice.\n- Do not create duplicate clients or serve endpoints if the repo already has\n  them.\n- Do not put database writes, API calls, random IDs, timestamps, or LLM calls\n  outside steps in the new function.\n- Do not hide missing idempotency behind retries. Retries require idempotent\n  side effects.\n- Do not hardcode secrets or dev-mode flags in source.\n- Do not leave the app unable to sync: register new functions with the serve\n  endpoint and run available type/tests.\n\n## Verification\n\nPick checks that prove the integration path:\n\n- Typecheck/build/lint the touched app.\n- Run existing tests around the migrated handler or workflow.\n- Add focused tests for \"handler emits event and returns fast\" and \"function\n  calls the same domain operations in step boundaries\" where the repo supports\n  it.\n- If local runtime is available, start the app and Inngest dev server, confirm\n  the function syncs, then send a sample event.\n- If only static checks are available, explicitly state that runtime sync was\n  not verified.\n"
}