Your first endpoint.

1Lay out your project

project/
├── providers/
│   └── main.md                # database provider (PostgreSQL by default)
├── pipelines/
│   └── login-guard.md         # reusable request pipeline
├── migrations/main/
│   └── 0001-create-users.md   # database migration (4-digit sequence)
├── models/user/
│   ├── user.md                # model definition
│   └── methods/sign-token.md  # model method
└── api/users/
    ├── _definition.md         # shared settings for the “users” API
    └── v1/
        ├── _version.md        # settings for version v1
        └── login/login.md     # entry point: POST /users/v1/login

Compiled .lock.md files appear next to each source file; they are omitted here.

All names are kebab-case (a-z0-9-). Files that start with _ are reserved and never routed.

2Describe a feature in plain language

A feature file says what the endpoint does. Optional headings help the compiler: purpose, input, output, approach, errors and permissions.

# login

Public endpoint. Uses POST.

## Input
- email
- password

## Approach
Run the login-guard pipeline, then call user.sign-token and return the tokens.

## Errors
- Wrong email or password returns 401.

3Compile, review, deploy

1. The compiler writes login.lock.md next to your source, with fixed sections such as ## Route, ## Access, ## Request, ## Steps and ## Errors. Never edit locks by hand.
2. An owner or maintainer confirms the lock in the PR review; the validator highlights every security item.
3. On deploy, confirmed locks become a signed manifest and the endpoint is served serverless.

Next, read the docs for the full lock format, validation rules and examples.