belt 0.2.10 → 0.2.12

data/lib/belt/cli.rb

@@ -18,10 +18,12 @@ require_relative 'cli/backup_config'
 require_relative 'cli/backup_runner'
 require_relative 'cli/server_command'
 require_relative 'cli/routes_command'
+require_relative 'cli/contracts_command'
 require_relative 'cli/lambda_config_command'
 require_relative 'cli/tasks_command'
 require_relative 'cli/console_command'
 require_relative 'cli/doctor_command'
+require_relative 'cli/plugin_command'
 
 module Belt
   module CLI
@@ -30,11 +32,13 @@ module Belt
       %w[generate g] => Belt::CLI::GenerateCommand,
       %w[destroy d] => Belt::CLI::DestroyCommand,
       'routes' => Belt::CLI::RoutesCommand,
+      'contracts' => Belt::CLI::ContractsCommand,
       'lambda-config' => Belt::CLI::LambdaConfigCommand,
       %w[console c] => Belt::CLI::ConsoleCommand,
       %w[tasks --tasks -T] => Belt::CLI::TasksCommand,
       'setup' => Belt::CLI::SetupCommand,
       'doctor' => Belt::CLI::DoctorCommand,
+      'plugin' => Belt::CLI::PluginCommand,
       'deploy' => Belt::CLI::DeployCommand,
       'frontend' => Belt::CLI::FrontendEnvCommand,
       %w[server s] => Belt::CLI::ServerCommand,
@@ -107,6 +111,7 @@ module Belt
           deploy frontend <env>                       Build and deploy frontend to AWS
           frontend env <env>                          Write frontend/.env from terraform outputs
           routes [-g PATTERN] [-f json]               Show route definitions
+          contracts [-g PATTERN] [-f json]            Show API request/response contracts
           lambda-config [-e ENV] [-f json|terraform]  Show merged lambda configuration
 
           console                                     Start an interactive console (IRB)
@@ -117,6 +122,7 @@ module Belt
           setup tables <env>                          Generate DynamoDB tables from schema
           setup frontend <env>                        Generate S3 + CloudFront infrastructure
           doctor                                      Check system dependencies and AWS config
+          plugin new <name>                           Scaffold a new Belt plugin gem
           init [environment] <env>                    terraform init for environment
           plan [environment] <env>                    terraform plan for environment
           apply [environment] <env>                   terraform apply for environment
@@ -149,6 +155,7 @@ module Belt
           belt apply wups
           belt tasks                    # list all rake tasks
           belt lambda:build_layer       # run a rake task directly
+          belt plugin new messaging     # scaffold a belt-messaging style plugin gem
       USAGE
     end
   end

data/lib/belt/helpers/cors_origin.rb

@@ -3,10 +3,16 @@
 module Belt
   module Helpers
     module CorsOrigin
+      # Maximum length for an Origin header to prevent ReDoS or memory abuse.
+      MAX_ORIGIN_LENGTH = 253
+
       def self.resolve_origin(request_origin)
         allowed = allowed_origins
         return nil if allowed.empty?
-        return request_origin if request_origin && matches_allowed?(request_origin, allowed)
+
+        if request_origin && valid_origin?(request_origin) && matches_allowed?(request_origin, allowed)
+          return request_origin
+        end
 
         # Don't return a wildcard pattern as a literal origin — use '*' instead
         first = allowed.first
@@ -18,7 +24,7 @@ module Belt
 
         allowed.any? do |pattern|
           if pattern.include?('*')
-            regex = Regexp.new("\\A#{Regexp.escape(pattern).gsub('\*', '[^.]+')}\\z")
+            regex = Regexp.new("\\A#{Regexp.escape(pattern).gsub('\*', '[a-z0-9\\-]+')}\\z")
             regex.match?(origin)
           else
             pattern == origin
@@ -26,6 +32,17 @@ module Belt
         end
       end
 
+      # Validate that the origin looks like a legitimate URL scheme+host.
+      # Rejects origins with path components, whitespace, or unexpected characters.
+      def self.valid_origin?(origin)
+        return false if origin.nil? || origin.empty?
+        return false if origin.length > MAX_ORIGIN_LENGTH
+        return false unless origin.match?(%r{\A https?://[a-z0-9\-.:]+\z}ix)
+
+        # Reject origins with user-info, paths, queries, or fragments
+        !origin.include?('@') && !origin.include?('?') && !origin.include?('#')
+      end
+
       def self.origin_from_event(event)
         return nil unless event.is_a?(Hash)
 

data/lib/belt/helpers/response.rb

@@ -7,6 +7,10 @@ require_relative '../http_status'
 module Belt
   module Helpers
     module Response
+      # Maximum request body size (10 MB). Bodies larger than this are rejected
+      # to prevent memory exhaustion attacks on Lambda functions.
+      MAX_REQUEST_BODY_SIZE = 10 * 1024 * 1024
+
       def cors_headers(event = nil)
         event = @event if event.nil? && instance_variable_defined?(:@event)
         origin = CorsOrigin.resolve_origin(CorsOrigin.origin_from_event(event))
@@ -15,7 +19,9 @@ module Belt
           'Access-Control-Allow-Headers' => allow_headers,
           'Access-Control-Allow-Methods' => 'GET,POST,PUT,DELETE,PATCH,OPTIONS',
           'Access-Control-Max-Age' => '300',
-          'Content-Type' => 'application/json'
+          'Content-Type' => 'application/json',
+          'X-Content-Type-Options' => 'nosniff',
+          'Vary' => 'Origin'
         }
         headers['Access-Control-Allow-Origin'] = origin if origin
         headers
@@ -38,7 +44,12 @@ module Belt
       def html_response(html, status_code = 200)
         event = @event if instance_variable_defined?(:@event)
         origin = CorsOrigin.resolve_origin(CorsOrigin.origin_from_event(event))
-        headers = { 'Content-Type' => 'text/html; charset=utf-8' }
+        headers = {
+          'Content-Type' => 'text/html; charset=utf-8',
+          'X-Content-Type-Options' => 'nosniff',
+          'X-Frame-Options' => 'DENY',
+          'Referrer-Policy' => 'strict-origin-when-cross-origin'
+        }
         headers['Access-Control-Allow-Origin'] = origin if origin
         { statusCode: resolve_status(status_code), headers: headers, body: html }
       end

data/lib/belt/lambda_handler.rb

@@ -76,11 +76,8 @@ module Belt
 
         return { statusCode: 200, headers: cors_headers(event), body: '{}' } if event['httpMethod'] == 'OPTIONS'
 
-        begin
-          body = JSON.parse(event['body'] || '{}')
-        rescue JSON::ParserError
-          return error_response('Invalid JSON in request body')
-        end
+        body = parse_request_body(event)
+        return body if body.is_a?(Hash) && body[:statusCode]
 
         begin
           result = execute(path: event['path'], body: body, event: event)
@@ -107,6 +104,18 @@ module Belt
 
     private
 
+    def parse_request_body(event)
+      raw_body = event['body'] || '{}'
+
+      if raw_body.bytesize > Belt::Helpers::Response::MAX_REQUEST_BODY_SIZE
+        return error_response('Request body too large', 413)
+      end
+
+      JSON.parse(raw_body)
+    rescue JSON::ParserError
+      error_response('Invalid JSON in request body', 400)
+    end
+
     def init_observability(context:)
       service_name = ENV['ACTION'] || context.function_name.split('-').last
 

data/lib/belt/root.rb

@@ -9,24 +9,32 @@ module Belt
     @root = path
   end
 
-  # Resolves the path to routes.tf.rb, checking config/ first then infrastructure/ (legacy).
+  # Resolves the path to routes.rb, checking config/ first then legacy paths.
   def self.routes_file
     candidates = [
+      File.join(root, 'config/routes.rb'),
       File.join(root, 'config/routes.tf.rb'),
       File.join(root, 'infrastructure/routes.tf.rb')
     ]
     candidates.find { |f| File.exist?(f) }
   end
 
-  # Resolves the path to schema.tf.rb, checking config/ first then infrastructure/ (legacy).
-  def self.schema_file
+  # Resolves the path to contracts.rb, checking config/ first then legacy paths.
+  def self.contracts_file
     candidates = [
+      File.join(root, 'config/contracts.rb'),
+      File.join(root, 'config/contracts.tf.rb'),
       File.join(root, 'config/schema.tf.rb'),
       File.join(root, 'infrastructure/schema.tf.rb')
     ]
     candidates.find { |f| File.exist?(f) }
   end
 
+  # Legacy alias for backward compatibility
+  def self.schema_file
+    contracts_file
+  end
+
   # Resolves the lambda config directory.
   def self.lambda_config_dir
     File.join(root, 'config/lambda')
@@ -35,6 +43,7 @@ module Belt
   def self.detect_root
     dir = Dir.pwd
     loop do
+      return dir if File.exist?(File.join(dir, 'config/routes.rb'))
       return dir if File.exist?(File.join(dir, 'config/routes.tf.rb'))
       return dir if File.exist?(File.join(dir, 'infrastructure/routes.tf.rb'))
 

data/lib/belt/route_dsl.rb

@@ -5,7 +5,7 @@ require_relative 'inflector'
 module Belt
   # DSL for defining API Gateway routes.
   # Ported from terraform-provider-conveyor-belt/scripts/lib/route_dsl.rb
-  # so that `belt routes` can parse routes.tf.rb without external dependencies.
+  # so that `belt routes` can parse routes.rb without external dependencies.
 
   class Route
     attr_reader :method, :path, :auth, :lambda, :cors, :tables, :route_type,
@@ -518,7 +518,7 @@ module Belt
     end
   end
 
-  # SchemaBuilder captures request and response model definitions from schema.tf.rb
+  # SchemaBuilder captures request and response model definitions from contracts.rb
   class SchemaBuilder
     SUPPORTED_TYPES = %i[string number integer boolean array object map list].freeze
 

data/lib/belt/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Belt
-  VERSION = '0.2.10'
+  VERSION = '0.2.12'
 end

data/lib/templates/environment/backend.tf.erb

@@ -1,7 +1,6 @@
 terraform {
   backend "s3" {
-    # Resolved to belt-terraform-state-<account-id> by `belt setup state` / `belt new`
-    bucket  = "belt-terraform-state"
+    bucket  = "<%= @state_bucket %>"
     key     = "<%= s3_safe_name(@app_name) %>/<%= @env_name %>/terraform.tfstate"
     region  = "us-east-1"
     encrypt = true

data/lib/templates/frontend_infra/frontend.tf.erb

@@ -9,7 +9,8 @@ resource "random_string" "frontend_suffix" {
 
 # S3 bucket for frontend static assets
 resource "aws_s3_bucket" "frontend" {
-  bucket = "<%= s3_safe_name(@app_name) %>-frontend-${var.environment}-${random_string.frontend_suffix.result}"
+  bucket        = "<%= s3_safe_name(@app_name) %>-frontend-${var.environment}-${random_string.frontend_suffix.result}"
+  force_destroy = true
 
   lifecycle {
     ignore_changes = [bucket]

data/lib/templates/module/frontend.tf.erb

@@ -9,7 +9,8 @@ resource "random_string" "frontend_suffix" {
 
 # S3 bucket for frontend static assets
 resource "aws_s3_bucket" "frontend" {
-  bucket = "${var.app_name}-frontend-${var.environment}-${random_string.frontend_suffix.result}"
+  bucket        = "${var.app_name}-frontend-${var.environment}-${random_string.frontend_suffix.result}"
+  force_destroy = true
 
   lifecycle {
     ignore_changes = [bucket]

data/lib/templates/module/main.tf.erb

@@ -22,7 +22,7 @@ resource "conveyor_belt" "main" {
   provider = conveyor-belt
 
   # path.module is infrastructure/modules/app — climb three levels to project root
-  source            = "${path.module}/../../../config/routes.tf.rb"
+  source            = "${path.module}/../../../config/routes.rb"
   app_name          = var.app_name
   lambda_source_dir = "${path.module}/../../../lambda"
   lambda_shared_dirs = ["controllers", "helpers", "lib", "models", "views"]

data/lib/templates/new_app/AGENTS.md.erb

@@ -6,7 +6,7 @@ This file explains the project structure, tooling, and conventions for AI agents
 
 - **Belt** — CLI and runtime framework (like Rails for serverless). Provides Lambda handler, action router, controller base class, and CLI tooling.
 - **ActiveItem** — ActiveRecord-like ORM for DynamoDB. Models inherit from `ActiveItem::Base`.
-- **Conveyor Belt** — Terraform provider that reads a Ruby DSL (`routes.tf.rb`) and creates API Gateway + Lambda + IAM infrastructure.
+- **Conveyor Belt** — Terraform provider that reads a Ruby DSL (`routes.rb`) and creates API Gateway + Lambda + IAM infrastructure.
 - **Lambda Loadout** — Lambda cold-start optimizer (auto-required by Belt).
 
 ## Project Structure
@@ -23,8 +23,8 @@ This file explains the project structure, tooling, and conventions for AI agents
 │   ├── lib/routes/                     # Route manifests (auto-generated)
 │   └── Gemfile                         # Lambda-specific dependencies
 ├── config/
-│   ├── routes.tf.rb                    # API routes (Conveyor Belt DSL)
-│   ├── schema.tf.rb                    # Model schema definitions
+│   ├── routes.rb                       # API routes (Conveyor Belt DSL)
+│   ├── contracts.rb                    # API request/response contracts
 │   └── lambda/                         # Per-lambda config (like database.yml)
 │       └── api.yml                     # Lambda timeout, memory, env vars
 ├── infrastructure/
@@ -53,7 +53,7 @@ belt output <env>                                      # terraform output
 
 ## How Routing Works
 
-1. `config/routes.tf.rb` defines routes using a DSL:
+1. `config/routes.rb` defines routes using a DSL:
    ```ruby
    Belt.application.routes.draw do
      namespace :<%= @app_name %> do

data/lib/templates/new_app/README.md.erb

@@ -6,8 +6,8 @@ A serverless application built with [Belt](https://github.com/stowzilla/belt) an
 
 ```
 ├── config/
-│   ├── routes.tf.rb        # API route definitions
-│   ├── schema.tf.rb        # Model schema definitions
+│   ├── routes.rb           # API route definitions
+│   ├── contracts.rb        # API request/response contracts
 │   └── lambda/             # Per-lambda config (timeout, memory, env vars)
 │       └── api.yml
 ├── infrastructure/         # Terraform environments

data/lib/templates/plugin/AGENTS.md.erb

@@ -0,0 +1,135 @@
+# AGENTS.md — <%= gem_name %>
+
+This file is for AI agents (and humans) working **on this Belt plugin gem**, not on a host Belt app.
+
+Host apps get their own `AGENTS.md` from `belt new`. Core belt docs live in the [belt](https://github.com/stowzilla/belt) repo (`README.md` + root `AGENTS.md`).
+
+## What this gem is
+
+**<%= gem_name %>** is a Belt plugin: optional capability that installs into Belt apps via the generator API.
+
+- **Runtime API** lives in the gem (`<%= constant_path %>`) — apps require the gem and call it directly
+- **Generator** copies only what the host app must own (Terraform, Lambda entrypoints, optional overrides)
+- After the gem is in an app's Gemfile, `belt generate <%= plugin_name %>` / `belt destroy <%= plugin_name %>` work automatically
+
+## Stack
+
+| Piece | Role |
+|-------|------|
+| **belt** | Host framework + CLI; discovers this generator via `GeneratorRegistry` |
+| **<%= gem_name %>** (this repo) | Plugin runtime + `belt generate <%= plugin_name %>` |
+| Host Belt app | Where Terraform / Lambda config land after generation |
+
+## Layout
+
+```
+<%= gem_name %>/
+├── <%= gem_name %>.gemspec
+├── lib/
+│   ├── <%= gem_name %>.rb              # require entrypoint
+│   └── belt/
+│       ├── <%= underscored %>.rb       # <%= constant_path %> API
+│       ├── <%= underscored %>/
+│       │   ├── configuration.rb
+│       │   ├── version.rb
+│       │   └── templates/              # ERB used by the generator
+│       └── generators/
+│           └── <%= underscored %>_generator.rb   # ← auto-discovered
+├── spec/
+├── README.md
+└── AGENTS.md                           # This file
+```
+
+**Do not rename** `lib/belt/generators/<%= underscored %>_generator.rb` or the class
+`Belt::Generators::<%= generator_class %>` — discovery depends on that path and name.
+
+## Generator contract
+
+Implemented in `lib/belt/generators/<%= underscored %>_generator.rb`:
+
+| Method | Required? | Purpose |
+|--------|-----------|---------|
+| `.run(args)` | **Yes** | Install into the current Belt app |
+| `.destroy(args)` | Recommended | Tear down what generate created |
+| `.description` | Recommended | One-liner for `belt generate --help` |
+
+Class must live in `Belt::Generators` and be named `<%= generator_class %>`.
+
+Reference implementations (copy structure, don't invent a parallel one):
+
+- `belt-messaging` — SMS via AWS End User Messaging
+- `belt-pay` — Stripe payments & subscriptions
+
+## Generator checklist
+
+When fleshing out the generator, typically install:
+
+1. **Terraform module** → `infrastructure/modules/<%= plugin_name %>/` (`main.tf`, `variables.tf`, `outputs.tf`)
+2. **Lambda config** → `config/lambda/<%= plugin_name %>.yml` (timeout, memory, env, triggers)
+3. **Lambda entrypoint** → `lambda/<%= plugin_name %>.rb` using `Belt::LambdaHandler`
+4. **Routes / schema** → inject into `config/routes.rb` or `config/contracts.rb` when needed
+5. **Optional overrides** → `--controllers` (or similar) for app-local subclasses — keep defaults in the gem
+6. **Destroy path** → `belt destroy <%= plugin_name %>` removes generated artifacts
+7. **Help** → `.description` plus `--help` / `-h` explaining files and next steps
+
+**Principle:** runtime stays in the gem; generators copy only host-owned infra and optional overrides (same idea as `rails g devise:views`).
+
+## Local development
+
+```bash
+bundle install
+bundle exec rspec
+```
+
+Wire into a Belt app while iterating:
+
+```ruby
+# In the app Gemfile
+gem "<%= gem_name %>", path: "../<%= gem_name %>"
+```
+
+```bash
+cd /path/to/belt-app
+bundle install
+belt generate --help          # should list "<%= plugin_name %>" under Gem Generators
+belt generate <%= plugin_name %>
+belt destroy <%= plugin_name %>
+```
+
+`belt deploy` vendors `path:` gems into `vendor/cache` so Lambda packaging works without publishing.
+
+## Configuration pattern
+
+```ruby
+<%= constant_path %>.configure do |config|
+  # config.option = value
+end
+```
+
+Extend `lib/belt/<%= underscored %>/configuration.rb` and document options in README.
+
+## Conventions
+
+1. Follow patterns from `belt-messaging` / `belt-pay` before inventing new structure
+2. Keep the generator idempotent where practical; support `--force` for overwrites
+3. Specs under `spec/` for configuration and any non-trivial generator logic
+4. User-facing changes → `CHANGELOG.md`
+5. Never commit secrets, API keys, or real AWS account IDs
+6. Prefer gem defaults + optional generate flags over dumping all code into the app
+
+## Where to look first
+
+| Task | Start here |
+|------|------------|
+| Runtime API | `lib/belt/<%= underscored %>.rb`, `lib/belt/<%= underscored %>/` |
+| What gets installed into apps | `lib/belt/generators/<%= underscored %>_generator.rb` |
+| Generator ERB templates | `lib/belt/<%= underscored %>/templates/` |
+| Version / gemspec | `lib/belt/<%= underscored %>/version.rb`, `<%= gem_name %>.gemspec` |
+| How belt discovers this | belt gem: `Belt::CLI::GeneratorRegistry` |
+
+## Do not
+
+- Move the generator file out of `lib/belt/generators/*_generator.rb`
+- Require a manual initializer in the host app for registration — discovery is automatic
+- Put host-app deploy runbooks here — those belong in the app's `AGENTS.md`
+- Duplicate large runtime classes into generated app files unless the user opts in (e.g. `--controllers`)

data/lib/templates/plugin/CHANGELOG.md.erb

@@ -0,0 +1,5 @@
+# Changelog
+
+## 0.0.1
+
+- Initial scaffold generated by `belt plugin new <%= plugin_name %>`

data/lib/templates/plugin/Gemfile.erb

@@ -0,0 +1,11 @@
+# frozen_string_literal: true
+
+source 'https://rubygems.org'
+
+gemspec
+
+group :development, :test do
+  gem 'rake', '~> 13.0'
+  gem 'rspec', '~> 3.0'
+  gem 'rubocop', '~> 1.0', require: false
+end

data/lib/templates/plugin/LICENSE.erb

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) <%= Time.now.year %>
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

data/lib/templates/plugin/README.md.erb

@@ -0,0 +1,63 @@
+# <%= gem_name %>
+
+<%= summary %>.
+
+A [Belt](https://github.com/stowzilla/belt) plugin. Add the gem to a Belt app, then run the generator to install infrastructure and app wiring.
+
+## Installation
+
+Add to your Belt app's Gemfile:
+
+```ruby
+gem '<%= gem_name %>'
+# Or during development:
+# gem '<%= gem_name %>', path: '../<%= gem_name %>'
+```
+
+Then:
+
+```bash
+bundle install
+belt generate <%= plugin_name %>
+```
+
+## What You Get
+
+### From the gem (no generation needed)
+
+```ruby
+# Configure
+<%= constant_path %>.configure do |config|
+  # config.option = value
+end
+```
+
+### From the generator (`belt g <%= plugin_name %>`)
+
+Edit `lib/belt/generators/<%= underscored %>_generator.rb` and templates under
+`lib/belt/<%= underscored %>/templates/` to define what gets installed into apps.
+
+Typical plugin generators create some combination of:
+
+- **Terraform module** — `infrastructure/modules/<%= plugin_name %>/`
+- **Lambda entry point** — `lambda/<%= plugin_name %>.rb`
+- **Lambda config** — `config/lambda/<%= plugin_name %>.yml`
+- **Route / schema injection** — updates to `config/routes.rb` / `config/contracts.rb`
+- **Optional controller overrides** — `belt g <%= plugin_name %> --controllers`
+
+## Development
+
+```bash
+bundle install
+bundle exec rspec
+```
+
+## Removing
+
+```bash
+belt destroy <%= plugin_name %>
+```
+
+## License
+
+MIT

data/lib/templates/plugin/Rakefile.erb

@@ -0,0 +1,7 @@
+# frozen_string_literal: true
+
+require 'rspec/core/rake_task'
+
+RSpec::Core::RakeTask.new(:spec)
+
+task default: :spec

data/lib/templates/plugin/gemspec.erb

@@ -0,0 +1,26 @@
+# frozen_string_literal: true
+
+require_relative 'lib/belt/<%= underscored %>/version'
+
+Gem::Specification.new do |spec|
+  spec.name          = '<%= gem_name %>'
+  spec.version       = <%= constant_path %>::VERSION
+  spec.authors       = ['Your Name']
+  spec.email         = ['you@example.com']
+
+  spec.summary       = '<%= summary %>'
+  spec.description   = '<%= summary %>. A Belt plugin gem — add to a Belt app Gemfile, then run `belt generate <%= plugin_name %>`.'
+  spec.homepage      = 'https://github.com/example/<%= gem_name %>'
+  spec.license       = 'MIT'
+  spec.required_ruby_version = '>= 3.3'
+
+  spec.metadata['homepage_uri'] = spec.homepage
+  spec.metadata['source_code_uri'] = spec.homepage
+  spec.metadata['changelog_uri'] = "#{spec.homepage}/blob/main/CHANGELOG.md"
+  spec.metadata['rubygems_mfa_required'] = 'true'
+
+  spec.files = Dir['lib/**/*', 'LICENSE', 'README.md', 'CHANGELOG.md']
+  spec.require_paths = ['lib']
+
+  spec.add_dependency 'belt', '~> 0.2'
+end

data/lib/templates/plugin/gitignore.erb

@@ -0,0 +1,11 @@
+/.bundle/
+/.yardoc
+/_yardoc/
+/coverage/
+/doc/
+/pkg/
+/spec/reports/
+/tmp/
+*.gem
+Gemfile.lock
+.rspec_status