belt 0.2.10 → 0.2.11

data/lib/belt/cli/plugin_command.rb

@@ -0,0 +1,221 @@
+# frozen_string_literal: true
+
+require 'fileutils'
+require 'erb'
+
+module Belt
+  module CLI
+    # Scaffold a new Belt plugin gem (similar to `rails plugin new`).
+    #
+    # Usage:
+    #   belt plugin new messaging
+    #   belt plugin new belt-pay --path ~/code
+    #
+    # Creates a gem that registers with Belt's GeneratorRegistry via:
+    #   lib/belt/generators/<name>_generator.rb
+    class PluginCommand
+      TEMPLATE_DIR = File.expand_path('../../templates/plugin', __dir__)
+
+      def self.run(args)
+        subcommand = args.shift
+
+        case subcommand
+        when 'new'
+          new(args).generate
+        when nil, '--help', '-h', 'help'
+          print_help
+        else
+          puts "Unknown plugin subcommand: #{subcommand}"
+          puts ''
+          print_help
+          exit 1
+        end
+      end
+
+      def self.print_help
+        puts <<~HELP
+          Manage Belt plugin gems.
+
+          Usage:
+            belt plugin new <name> [options]
+
+          Arguments:
+            name                    Plugin name (e.g. messaging, pay, or belt-messaging)
+
+          Options:
+            --path DIR              Parent directory for the gem (default: current directory)
+            --summary TEXT          Short gem summary for the gemspec
+            --force                 Overwrite files if the directory already exists
+            -h, --help              Show this help
+
+          Examples:
+            belt plugin new messaging
+            belt plugin new pay --path ~/Code
+            belt plugin new belt-notifications --summary "Push notifications for Belt apps"
+
+          What you get:
+            A standalone gem (belt-<name>) with:
+              - Module under Belt::<Name>
+              - Generator at lib/belt/generators/<name>_generator.rb
+              - Configuration stub, version, RSpec, README, AGENTS.md
+              - Hooked into `belt generate <name>` / `belt destroy <name>` once
+                the gem is in an app's Gemfile
+
+          Reference plugins:
+            belt-messaging  — SMS via AWS End User Messaging
+            belt-pay        — Stripe payments and subscriptions
+
+          See the Belt README (Plugins / Contributing) and AGENTS.md for the full guide.
+        HELP
+      end
+
+      def initialize(args)
+        @raw_name = nil
+        @path = Dir.pwd
+        @summary = nil
+        @force = false
+
+        i = 0
+        while i < args.length
+          arg = args[i]
+          case arg
+          when '--path'
+            i += 1
+            @path = args[i] || Dir.pwd
+          when /^--path=/
+            @path = arg.split('=', 2).last
+          when '--summary'
+            i += 1
+            @summary = args[i]
+          when /^--summary=/
+            @summary = arg.split('=', 2).last
+          when '--force'
+            @force = true
+          when '--help', '-h'
+            self.class.print_help
+            exit 0
+          else
+            if arg.start_with?('-')
+              puts "Unknown option: #{arg}"
+              exit 1
+            end
+            @raw_name ||= arg
+          end
+          i += 1
+        end
+      end
+
+      def generate
+        if @raw_name.nil? || @raw_name.strip.empty?
+          puts 'Usage: belt plugin new <name> [options]'
+          puts "Run 'belt plugin --help' for more information."
+          exit 1
+        end
+
+        normalize_names!
+
+        if Dir.exist?(@gem_dir) && !@force
+          puts "✗ Directory already exists: #{@gem_dir}"
+          puts '  Use --force to overwrite, or choose a different name/path.'
+          exit 1
+        end
+
+        FileUtils.mkdir_p(@gem_dir)
+        write_files
+        print_success
+      end
+
+      private
+
+      def normalize_names!
+        # Accept "messaging", "belt-messaging", "Belt::Messaging"
+        name = @raw_name.to_s.strip
+        name = name.sub(/\ABelt::/i, '')
+        name = name.gsub('::', '-')
+        name = name.sub(/\Abelt[-_]/i, '')
+        name = name.gsub(/[^a-z0-9_-]/i, '_').downcase.tr('_', '-')
+        name = name.gsub(/-+/, '-').gsub(/\A-|-\z/, '')
+
+        if name.empty?
+          puts "✗ Invalid plugin name: #{@raw_name.inspect}"
+          exit 1
+        end
+
+        @plugin_name = name # messaging
+        @gem_name = "belt-#{name}" # belt-messaging
+        @module_name = name.split('-').map(&:capitalize).join # Messaging
+        @constant_path = "Belt::#{@module_name}" # Belt::Messaging
+        @generator_class = "#{@module_name}Generator"
+        @summary ||= "#{@module_name} plugin for Belt applications"
+        @gem_dir = File.expand_path(File.join(@path, @gem_name))
+      end
+
+      def write_files
+        files.each do |relative, content|
+          full = File.join(@gem_dir, relative)
+          FileUtils.mkdir_p(File.dirname(full))
+          File.write(full, content)
+          puts "  create  #{File.join(@gem_name, relative)}"
+        end
+      end
+
+      def files
+        gen = "lib/belt/generators/#{@plugin_name.tr('-', '_')}_generator.rb"
+        {
+          "#{@gem_name}.gemspec" => render('gemspec.erb'),
+          'Gemfile' => render('Gemfile.erb'),
+          'Rakefile' => render('Rakefile.erb'),
+          'README.md' => render('README.md.erb'),
+          'AGENTS.md' => render('AGENTS.md.erb'),
+          'CHANGELOG.md' => render('CHANGELOG.md.erb'),
+          'LICENSE' => render('LICENSE.erb'),
+          '.gitignore' => render('gitignore.erb'),
+          '.rspec' => render('rspec.erb'),
+          "lib/#{@gem_name}.rb" => render('lib/entry.rb.erb'),
+          "lib/belt/#{@plugin_name.tr('-', '_')}.rb" => render('lib/belt/module.rb.erb'),
+          "lib/belt/#{@plugin_name.tr('-', '_')}/version.rb" => render('lib/belt/module/version.rb.erb'),
+          "lib/belt/#{@plugin_name.tr('-', '_')}/configuration.rb" => render('lib/belt/module/configuration.rb.erb'),
+          gen => render('lib/belt/generators/generator.rb.erb'),
+          "lib/belt/#{@plugin_name.tr('-', '_')}/templates/.gitkeep" => '',
+          'spec/spec_helper.rb' => render('spec/spec_helper.rb.erb'),
+          "spec/belt/#{@plugin_name.tr('-', '_')}/configuration_spec.rb" => render('spec/configuration_spec.rb.erb')
+        }
+      end
+
+      def render(template_name)
+        path = File.join(TEMPLATE_DIR, template_name)
+        raise "Missing plugin template: #{path}" unless File.exist?(path)
+
+        erb = ERB.new(File.read(path), trim_mode: '-')
+        # Expose locals used in templates
+        gem_name = @gem_name
+        plugin_name = @plugin_name
+        module_name = @module_name
+        constant_path = @constant_path
+        generator_class = @generator_class
+        summary = @summary
+        underscored = @plugin_name.tr('-', '_')
+        erb.result(binding)
+      end
+
+      def print_success
+        puts ''
+        puts "✓ Created plugin gem #{@gem_name}"
+        puts ''
+        puts 'Next steps:'
+        puts "  1. cd #{@gem_dir}"
+        puts '  2. bundle install'
+        puts '  3. Implement your library under lib/belt/'
+        puts "  4. Flesh out lib/belt/generators/#{@plugin_name.tr('-', '_')}_generator.rb"
+        puts '     (templates go in lib/belt/<name>/templates/)'
+        puts '  5. In a Belt app Gemfile:'
+        puts "       gem \"#{@gem_name}\", path: \"#{@gem_dir}\""
+        puts '  6. bundle install && belt generate --help'
+        puts "     → should list \"#{@plugin_name}\" under Gem Generators"
+        puts "  7. belt generate #{@plugin_name}"
+        puts ''
+        puts 'Reference implementations: belt-messaging, belt-pay'
+      end
+    end
+  end
+end

data/lib/belt/cli.rb

@@ -22,6 +22,7 @@ require_relative 'cli/lambda_config_command'
 require_relative 'cli/tasks_command'
 require_relative 'cli/console_command'
 require_relative 'cli/doctor_command'
+require_relative 'cli/plugin_command'
 
 module Belt
   module CLI
@@ -35,6 +36,7 @@ module Belt
       %w[tasks --tasks -T] => Belt::CLI::TasksCommand,
       'setup' => Belt::CLI::SetupCommand,
       'doctor' => Belt::CLI::DoctorCommand,
+      'plugin' => Belt::CLI::PluginCommand,
       'deploy' => Belt::CLI::DeployCommand,
       'frontend' => Belt::CLI::FrontendEnvCommand,
       %w[server s] => Belt::CLI::ServerCommand,
@@ -117,6 +119,7 @@ module Belt
           setup tables <env>                          Generate DynamoDB tables from schema
           setup frontend <env>                        Generate S3 + CloudFront infrastructure
           doctor                                      Check system dependencies and AWS config
+          plugin new <name>                           Scaffold a new Belt plugin gem
           init [environment] <env>                    terraform init for environment
           plan [environment] <env>                    terraform plan for environment
           apply [environment] <env>                   terraform apply for environment
@@ -149,6 +152,7 @@ module Belt
           belt apply wups
           belt tasks                    # list all rake tasks
           belt lambda:build_layer       # run a rake task directly
+          belt plugin new messaging     # scaffold a belt-messaging style plugin gem
       USAGE
     end
   end

data/lib/belt/helpers/cors_origin.rb

@@ -3,10 +3,16 @@
 module Belt
   module Helpers
     module CorsOrigin
+      # Maximum length for an Origin header to prevent ReDoS or memory abuse.
+      MAX_ORIGIN_LENGTH = 253
+
       def self.resolve_origin(request_origin)
         allowed = allowed_origins
         return nil if allowed.empty?
-        return request_origin if request_origin && matches_allowed?(request_origin, allowed)
+
+        if request_origin && valid_origin?(request_origin) && matches_allowed?(request_origin, allowed)
+          return request_origin
+        end
 
         # Don't return a wildcard pattern as a literal origin — use '*' instead
         first = allowed.first
@@ -18,7 +24,7 @@ module Belt
 
         allowed.any? do |pattern|
           if pattern.include?('*')
-            regex = Regexp.new("\\A#{Regexp.escape(pattern).gsub('\*', '[^.]+')}\\z")
+            regex = Regexp.new("\\A#{Regexp.escape(pattern).gsub('\*', '[a-z0-9\\-]+')}\\z")
             regex.match?(origin)
           else
             pattern == origin
@@ -26,6 +32,17 @@ module Belt
         end
       end
 
+      # Validate that the origin looks like a legitimate URL scheme+host.
+      # Rejects origins with path components, whitespace, or unexpected characters.
+      def self.valid_origin?(origin)
+        return false if origin.nil? || origin.empty?
+        return false if origin.length > MAX_ORIGIN_LENGTH
+        return false unless origin.match?(%r{\A https?://[a-z0-9\-.:]+\z}ix)
+
+        # Reject origins with user-info, paths, queries, or fragments
+        !origin.include?('@') && !origin.include?('?') && !origin.include?('#')
+      end
+
       def self.origin_from_event(event)
         return nil unless event.is_a?(Hash)
 

data/lib/belt/helpers/response.rb

@@ -7,6 +7,10 @@ require_relative '../http_status'
 module Belt
   module Helpers
     module Response
+      # Maximum request body size (10 MB). Bodies larger than this are rejected
+      # to prevent memory exhaustion attacks on Lambda functions.
+      MAX_REQUEST_BODY_SIZE = 10 * 1024 * 1024
+
       def cors_headers(event = nil)
         event = @event if event.nil? && instance_variable_defined?(:@event)
         origin = CorsOrigin.resolve_origin(CorsOrigin.origin_from_event(event))
@@ -15,7 +19,9 @@ module Belt
           'Access-Control-Allow-Headers' => allow_headers,
           'Access-Control-Allow-Methods' => 'GET,POST,PUT,DELETE,PATCH,OPTIONS',
           'Access-Control-Max-Age' => '300',
-          'Content-Type' => 'application/json'
+          'Content-Type' => 'application/json',
+          'X-Content-Type-Options' => 'nosniff',
+          'Vary' => 'Origin'
         }
         headers['Access-Control-Allow-Origin'] = origin if origin
         headers
@@ -38,7 +44,12 @@ module Belt
       def html_response(html, status_code = 200)
         event = @event if instance_variable_defined?(:@event)
         origin = CorsOrigin.resolve_origin(CorsOrigin.origin_from_event(event))
-        headers = { 'Content-Type' => 'text/html; charset=utf-8' }
+        headers = {
+          'Content-Type' => 'text/html; charset=utf-8',
+          'X-Content-Type-Options' => 'nosniff',
+          'X-Frame-Options' => 'DENY',
+          'Referrer-Policy' => 'strict-origin-when-cross-origin'
+        }
         headers['Access-Control-Allow-Origin'] = origin if origin
         { statusCode: resolve_status(status_code), headers: headers, body: html }
       end

data/lib/belt/lambda_handler.rb

@@ -76,11 +76,8 @@ module Belt
 
         return { statusCode: 200, headers: cors_headers(event), body: '{}' } if event['httpMethod'] == 'OPTIONS'
 
-        begin
-          body = JSON.parse(event['body'] || '{}')
-        rescue JSON::ParserError
-          return error_response('Invalid JSON in request body')
-        end
+        body = parse_request_body(event)
+        return body if body.is_a?(Hash) && body[:statusCode]
 
         begin
           result = execute(path: event['path'], body: body, event: event)
@@ -107,6 +104,18 @@ module Belt
 
     private
 
+    def parse_request_body(event)
+      raw_body = event['body'] || '{}'
+
+      if raw_body.bytesize > Belt::Helpers::Response::MAX_REQUEST_BODY_SIZE
+        return error_response('Request body too large', 413)
+      end
+
+      JSON.parse(raw_body)
+    rescue JSON::ParserError
+      error_response('Invalid JSON in request body', 400)
+    end
+
     def init_observability(context:)
       service_name = ENV['ACTION'] || context.function_name.split('-').last
 

data/lib/belt/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Belt
-  VERSION = '0.2.10'
+  VERSION = '0.2.11'
 end

data/lib/templates/environment/backend.tf.erb

@@ -1,7 +1,6 @@
 terraform {
   backend "s3" {
-    # Resolved to belt-terraform-state-<account-id> by `belt setup state` / `belt new`
-    bucket  = "belt-terraform-state"
+    bucket  = "<%= @state_bucket %>"
     key     = "<%= s3_safe_name(@app_name) %>/<%= @env_name %>/terraform.tfstate"
     region  = "us-east-1"
     encrypt = true

data/lib/templates/plugin/AGENTS.md.erb

@@ -0,0 +1,135 @@
+# AGENTS.md — <%= gem_name %>
+
+This file is for AI agents (and humans) working **on this Belt plugin gem**, not on a host Belt app.
+
+Host apps get their own `AGENTS.md` from `belt new`. Core belt docs live in the [belt](https://github.com/stowzilla/belt) repo (`README.md` + root `AGENTS.md`).
+
+## What this gem is
+
+**<%= gem_name %>** is a Belt plugin: optional capability that installs into Belt apps via the generator API.
+
+- **Runtime API** lives in the gem (`<%= constant_path %>`) — apps require the gem and call it directly
+- **Generator** copies only what the host app must own (Terraform, Lambda entrypoints, optional overrides)
+- After the gem is in an app's Gemfile, `belt generate <%= plugin_name %>` / `belt destroy <%= plugin_name %>` work automatically
+
+## Stack
+
+| Piece | Role |
+|-------|------|
+| **belt** | Host framework + CLI; discovers this generator via `GeneratorRegistry` |
+| **<%= gem_name %>** (this repo) | Plugin runtime + `belt generate <%= plugin_name %>` |
+| Host Belt app | Where Terraform / Lambda config land after generation |
+
+## Layout
+
+```
+<%= gem_name %>/
+├── <%= gem_name %>.gemspec
+├── lib/
+│   ├── <%= gem_name %>.rb              # require entrypoint
+│   └── belt/
+│       ├── <%= underscored %>.rb       # <%= constant_path %> API
+│       ├── <%= underscored %>/
+│       │   ├── configuration.rb
+│       │   ├── version.rb
+│       │   └── templates/              # ERB used by the generator
+│       └── generators/
+│           └── <%= underscored %>_generator.rb   # ← auto-discovered
+├── spec/
+├── README.md
+└── AGENTS.md                           # This file
+```
+
+**Do not rename** `lib/belt/generators/<%= underscored %>_generator.rb` or the class
+`Belt::Generators::<%= generator_class %>` — discovery depends on that path and name.
+
+## Generator contract
+
+Implemented in `lib/belt/generators/<%= underscored %>_generator.rb`:
+
+| Method | Required? | Purpose |
+|--------|-----------|---------|
+| `.run(args)` | **Yes** | Install into the current Belt app |
+| `.destroy(args)` | Recommended | Tear down what generate created |
+| `.description` | Recommended | One-liner for `belt generate --help` |
+
+Class must live in `Belt::Generators` and be named `<%= generator_class %>`.
+
+Reference implementations (copy structure, don't invent a parallel one):
+
+- `belt-messaging` — SMS via AWS End User Messaging
+- `belt-pay` — Stripe payments & subscriptions
+
+## Generator checklist
+
+When fleshing out the generator, typically install:
+
+1. **Terraform module** → `infrastructure/modules/<%= plugin_name %>/` (`main.tf`, `variables.tf`, `outputs.tf`)
+2. **Lambda config** → `config/lambda/<%= plugin_name %>.yml` (timeout, memory, env, triggers)
+3. **Lambda entrypoint** → `lambda/<%= plugin_name %>.rb` using `Belt::LambdaHandler`
+4. **Routes / schema** → inject into `config/routes.tf.rb` or schema files when needed
+5. **Optional overrides** → `--controllers` (or similar) for app-local subclasses — keep defaults in the gem
+6. **Destroy path** → `belt destroy <%= plugin_name %>` removes generated artifacts
+7. **Help** → `.description` plus `--help` / `-h` explaining files and next steps
+
+**Principle:** runtime stays in the gem; generators copy only host-owned infra and optional overrides (same idea as `rails g devise:views`).
+
+## Local development
+
+```bash
+bundle install
+bundle exec rspec
+```
+
+Wire into a Belt app while iterating:
+
+```ruby
+# In the app Gemfile
+gem "<%= gem_name %>", path: "../<%= gem_name %>"
+```
+
+```bash
+cd /path/to/belt-app
+bundle install
+belt generate --help          # should list "<%= plugin_name %>" under Gem Generators
+belt generate <%= plugin_name %>
+belt destroy <%= plugin_name %>
+```
+
+`belt deploy` vendors `path:` gems into `vendor/cache` so Lambda packaging works without publishing.
+
+## Configuration pattern
+
+```ruby
+<%= constant_path %>.configure do |config|
+  # config.option = value
+end
+```
+
+Extend `lib/belt/<%= underscored %>/configuration.rb` and document options in README.
+
+## Conventions
+
+1. Follow patterns from `belt-messaging` / `belt-pay` before inventing new structure
+2. Keep the generator idempotent where practical; support `--force` for overwrites
+3. Specs under `spec/` for configuration and any non-trivial generator logic
+4. User-facing changes → `CHANGELOG.md`
+5. Never commit secrets, API keys, or real AWS account IDs
+6. Prefer gem defaults + optional generate flags over dumping all code into the app
+
+## Where to look first
+
+| Task | Start here |
+|------|------------|
+| Runtime API | `lib/belt/<%= underscored %>.rb`, `lib/belt/<%= underscored %>/` |
+| What gets installed into apps | `lib/belt/generators/<%= underscored %>_generator.rb` |
+| Generator ERB templates | `lib/belt/<%= underscored %>/templates/` |
+| Version / gemspec | `lib/belt/<%= underscored %>/version.rb`, `<%= gem_name %>.gemspec` |
+| How belt discovers this | belt gem: `Belt::CLI::GeneratorRegistry` |
+
+## Do not
+
+- Move the generator file out of `lib/belt/generators/*_generator.rb`
+- Require a manual initializer in the host app for registration — discovery is automatic
+- Put host-app deploy runbooks here — those belong in the app's `AGENTS.md`
+- Duplicate large runtime classes into generated app files unless the user opts in (e.g. `--controllers`)

data/lib/templates/plugin/CHANGELOG.md.erb

@@ -0,0 +1,5 @@
+# Changelog
+
+## 0.0.1
+
+- Initial scaffold generated by `belt plugin new <%= plugin_name %>`

data/lib/templates/plugin/Gemfile.erb

@@ -0,0 +1,11 @@
+# frozen_string_literal: true
+
+source 'https://rubygems.org'
+
+gemspec
+
+group :development, :test do
+  gem 'rake', '~> 13.0'
+  gem 'rspec', '~> 3.0'
+  gem 'rubocop', '~> 1.0', require: false
+end

data/lib/templates/plugin/LICENSE.erb

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) <%= Time.now.year %>
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

data/lib/templates/plugin/README.md.erb

@@ -0,0 +1,63 @@
+# <%= gem_name %>
+
+<%= summary %>.
+
+A [Belt](https://github.com/stowzilla/belt) plugin. Add the gem to a Belt app, then run the generator to install infrastructure and app wiring.
+
+## Installation
+
+Add to your Belt app's Gemfile:
+
+```ruby
+gem '<%= gem_name %>'
+# Or during development:
+# gem '<%= gem_name %>', path: '../<%= gem_name %>'
+```
+
+Then:
+
+```bash
+bundle install
+belt generate <%= plugin_name %>
+```
+
+## What You Get
+
+### From the gem (no generation needed)
+
+```ruby
+# Configure
+<%= constant_path %>.configure do |config|
+  # config.option = value
+end
+```
+
+### From the generator (`belt g <%= plugin_name %>`)
+
+Edit `lib/belt/generators/<%= underscored %>_generator.rb` and templates under
+`lib/belt/<%= underscored %>/templates/` to define what gets installed into apps.
+
+Typical plugin generators create some combination of:
+
+- **Terraform module** — `infrastructure/modules/<%= plugin_name %>/`
+- **Lambda entry point** — `lambda/<%= plugin_name %>.rb`
+- **Lambda config** — `config/lambda/<%= plugin_name %>.yml`
+- **Route / schema injection** — updates to `routes.tf.rb` / `schema.tf.rb`
+- **Optional controller overrides** — `belt g <%= plugin_name %> --controllers`
+
+## Development
+
+```bash
+bundle install
+bundle exec rspec
+```
+
+## Removing
+
+```bash
+belt destroy <%= plugin_name %>
+```
+
+## License
+
+MIT

data/lib/templates/plugin/Rakefile.erb

@@ -0,0 +1,7 @@
+# frozen_string_literal: true
+
+require 'rspec/core/rake_task'
+
+RSpec::Core::RakeTask.new(:spec)
+
+task default: :spec

data/lib/templates/plugin/gemspec.erb

@@ -0,0 +1,26 @@
+# frozen_string_literal: true
+
+require_relative 'lib/belt/<%= underscored %>/version'
+
+Gem::Specification.new do |spec|
+  spec.name          = '<%= gem_name %>'
+  spec.version       = <%= constant_path %>::VERSION
+  spec.authors       = ['Your Name']
+  spec.email         = ['you@example.com']
+
+  spec.summary       = '<%= summary %>'
+  spec.description   = '<%= summary %>. A Belt plugin gem — add to a Belt app Gemfile, then run `belt generate <%= plugin_name %>`.'
+  spec.homepage      = 'https://github.com/example/<%= gem_name %>'
+  spec.license       = 'MIT'
+  spec.required_ruby_version = '>= 3.3'
+
+  spec.metadata['homepage_uri'] = spec.homepage
+  spec.metadata['source_code_uri'] = spec.homepage
+  spec.metadata['changelog_uri'] = "#{spec.homepage}/blob/main/CHANGELOG.md"
+  spec.metadata['rubygems_mfa_required'] = 'true'
+
+  spec.files = Dir['lib/**/*', 'LICENSE', 'README.md', 'CHANGELOG.md']
+  spec.require_paths = ['lib']
+
+  spec.add_dependency 'belt', '~> 0.2'
+end

data/lib/templates/plugin/gitignore.erb

@@ -0,0 +1,11 @@
+/.bundle/
+/.yardoc
+/_yardoc/
+/coverage/
+/doc/
+/pkg/
+/spec/reports/
+/tmp/
+*.gem
+Gemfile.lock
+.rspec_status