belt 0.2.9 → 0.2.10

data/lib/belt/cli/path_gem_materializer.rb

@@ -0,0 +1,141 @@
+# frozen_string_literal: true
+
+require 'fileutils'
+require 'open3'
+require 'rubygems/package'
+
+module Belt
+  module CLI
+    # Turns Gemfile `path:` gems into real `.gem` files in vendor/cache and
+    # rewrites the Gemfile/lock so Docker `bundle install` produces a normal
+    # gem install (with specifications/). Required for Lambda bare `require`
+    # without bundler/setup.
+    #
+    # Only mutates files under +build_dir+ — never the app's real Gemfile.
+    class PathGemMaterializer
+      PathSource = Struct.new(:remote, :gems, keyword_init: true)
+      PathGem = Struct.new(:name, :version, keyword_init: true)
+
+      def self.materialize!(build_dir, project_root:)
+        new(build_dir, project_root: project_root).materialize!
+      end
+
+      def initialize(build_dir, project_root:)
+        @build_dir = build_dir
+        @project_root = project_root
+        @gemfile = File.join(build_dir, 'Gemfile')
+        @lockfile = File.join(build_dir, 'Gemfile.lock')
+      end
+
+      # @return [Array<String>] names of gems materialized (empty if none)
+      def materialize!
+        return [] unless File.exist?(@gemfile) && File.exist?(@lockfile)
+
+        sources = parse_path_sources(File.read(@lockfile))
+        return [] if sources.empty?
+
+        cache_dir = File.join(@build_dir, 'vendor', 'cache')
+        FileUtils.mkdir_p(cache_dir)
+
+        materialized = []
+        sources.each do |source|
+          source_path = resolve_remote(source.remote)
+          abort "✗ path gem source missing: #{source.remote} (resolved #{source_path})" unless Dir.exist?(source_path)
+
+          source.gems.each do |gem|
+            gem_file = build_gem(source_path, gem)
+            dest = File.join(cache_dir, File.basename(gem_file))
+            FileUtils.cp(gem_file, dest)
+            FileUtils.rm_f(gem_file)
+            rewrite_gemfile_path_to_version!(gem.name, gem.version)
+            materialized << gem.name
+          end
+        end
+
+        return [] if materialized.empty?
+
+        relock!(materialized)
+        materialized
+      end
+
+      private
+
+      def parse_path_sources(lockfile_content)
+        sources = []
+        lockfile_content.scan(/^PATH\n  remote: (.+)\n  specs:\n((?:    .+\n)*)/) do |remote, specs_block|
+          gems = []
+          specs_block.each_line do |line|
+            next unless line.match?(/^    \S/)
+            next if line.start_with?('      ') # dependency lines are deeper
+
+            match = line.match(/^    (\S+)\s+\(([^)]+)\)/)
+            gems << PathGem.new(name: match[1], version: match[2]) if match
+          end
+          sources << PathSource.new(remote: remote.strip, gems: gems) if gems.any?
+        end
+        sources
+      end
+
+      def resolve_remote(remote)
+        return remote if remote.start_with?('/')
+
+        File.expand_path(remote, @project_root)
+      end
+
+      def build_gem(source_path, gem)
+        gemspec = find_gemspec(source_path, gem.name)
+        abort "✗ No gemspec for path gem #{gem.name} under #{source_path}" unless gemspec
+
+        Dir.chdir(source_path) do
+          spec = Gem::Specification.load(File.basename(gemspec))
+          abort "✗ Failed to load #{gemspec}" unless spec
+
+          if spec.version.to_s != gem.version
+            abort "✗ path gem #{gem.name} version mismatch: gemspec #{spec.version}, lock #{gem.version}"
+          end
+
+          # Gem::Package.build writes the .gem into cwd
+          built = Gem::Package.build(spec)
+          File.expand_path(built)
+        end
+      end
+
+      def find_gemspec(source_path, gem_name)
+        preferred = File.join(source_path, "#{gem_name}.gemspec")
+        return preferred if File.exist?(preferred)
+
+        Dir.glob(File.join(source_path, '*.gemspec')).first
+      end
+
+      def rewrite_gemfile_path_to_version!(name, version)
+        content = File.read(@gemfile)
+        new_content = content.lines.map { |line| convert_path_line(line, name, version) }.join
+        abort "✗ Could not rewrite path: for gem #{name.inspect} in build Gemfile" if new_content == content
+        File.write(@gemfile, new_content)
+      end
+
+      # Converts `gem 'name', path: '...'` (and variants with other kwargs) into
+      # a version-pinned line. Leaves non-matching lines alone.
+      def convert_path_line(line, name, version)
+        return line unless line.match?(/gem\s+(['"])#{Regexp.escape(name)}\1/)
+        return line unless line.match?(/\bpath:\s*/)
+
+        quote = line[/gem\s+(['"])/, 1] || "'"
+        cleaned = line.sub(/,?\s*path:\s*['"][^'"]+['"]/, '')
+        cleaned.sub(/gem\s+(['"])#{Regexp.escape(name)}\1/) do
+          "gem #{quote}#{name}#{quote}, #{quote}#{version}#{quote}"
+        end
+      end
+
+      def relock!(gem_names)
+        Dir.chdir(@build_dir) do
+          # vendor/cache has the built .gem — Bundler resolves the unpublished version
+          output, status = Open3.capture2e('bundle', 'lock', '--update', *gem_names)
+          return if status.success?
+
+          abort "✗ Failed to re-lock after materializing path gems (#{gem_names.join(', ')}):\n#{output}"
+        end
+      end
+    end
+  end
+end

data/lib/belt/cli/setup_command.rb

@@ -38,11 +38,12 @@ module Belt
         end
       end
 
-      def initialize(args = [])
+      def initialize(args = [], quiet: false)
         @app_name = detect_app_name
         @env_name = nil
         @custom_bucket = nil
         @select_mode = false
+        @quiet = quiet
 
         parse_args(args)
 
@@ -67,7 +68,7 @@ module Belt
         @bucket_name = interactive_bucket_selection if @select_mode
         setup_or_verify_bucket
         apply_lifecycle(@bucket_name)
-        puts '  ensure  lifecycle rules (90-day noncurrent expiration)'
+        say '  ensure  lifecycle rules (90-day noncurrent expiration)'
         update_backend_config
         print_success_message
       end
@@ -81,12 +82,12 @@ module Belt
       end
 
       def verify_existing_bucket
-        puts "Found existing bucket: #{@bucket_name}"
+        say "Found existing bucket: #{@bucket_name}"
         audit = audit_bucket_security(@bucket_name)
-        print_security_audit(audit)
+        print_security_audit(audit) unless @quiet
 
         if audit.values.all?
-          puts "\n✓ Bucket '#{@bucket_name}' passes all security checks"
+          say "\n✓ Bucket '#{@bucket_name}' passes all security checks"
         else
           prompt_and_harden(audit)
         end
@@ -94,6 +95,12 @@ module Belt
 
       def prompt_and_harden(audit)
         puts "\n⚠ Bucket '#{@bucket_name}' has security issues."
+        # Auto-harden during belt new (quiet); interactive otherwise
+        if @quiet
+          harden_bucket(@bucket_name, audit)
+          return
+        end
+
         print "\nApply security hardening? [Y/n] "
         response = $stdin.gets&.strip&.downcase
         if response.nil? || response.empty? || response == 'y'
@@ -105,13 +112,15 @@ module Belt
       end
 
       def create_new_bucket
-        puts "Creating state bucket: #{@bucket_name} (#{@region})"
+        say "Creating state bucket: #{@bucket_name} (#{@region})"
         create_bucket(@bucket_name)
-        puts "  create  s3://#{@bucket_name}"
+        say "  create  s3://#{@bucket_name}"
         harden_bucket(@bucket_name, {})
       end
 
       def print_success_message
+        return if @quiet
+
         puts "\n✓ State bucket '#{@bucket_name}' is ready!"
         if @env_name
           puts "\n  cd infrastructure/#{@env_name} && terraform init"
@@ -120,6 +129,9 @@ module Belt
         end
       end
 
+      # Expose for quiet callers (e.g. belt new) that print their own summary
+      attr_reader :bucket_name
+
       private
 
       def parse_args(args)
@@ -138,8 +150,15 @@ module Belt
         end
       end
 
+      # One shared state bucket per AWS account (all belt apps use it).
+      # Account ID keeps the name globally unique — S3 names are a global namespace.
+      # Pattern: belt-terraform-state-<account_id>
       def resolve_bucket_name
-        @custom_bucket || 'belt-terraform-state'
+        return @custom_bucket if @custom_bucket
+        return "belt-terraform-state-#{@aws_account_id}" if @aws_account_id
+
+        # Placeholder until credentials are available (belt setup state re-resolves)
+        'belt-terraform-state'
       end
 
       # --- Interactive selection ---
@@ -238,9 +257,11 @@ module Belt
       end
 
       def run!(*args)
-        return if system(*args)
+        output, status = Open3.capture2e(*args)
+        return if status.success?
 
         puts "\n✗ Command failed: #{args.shelljoin}"
+        puts output.strip unless output.strip.empty?
         exit 1
       end
 
@@ -249,6 +270,10 @@ module Belt
         status.success? ? output : nil
       end
 
+      def say(message)
+        puts message unless @quiet
+      end
+
       # --- Backend config ---
 
       def update_backend_config
@@ -268,7 +293,7 @@ module Belt
           updated = content.gsub(/bucket\s*=\s*"[^"]+"/, "bucket  = \"#{@bucket_name}\"")
           if updated != content
             File.write(backend_file, updated)
-            puts "  update  #{backend_file} → bucket = \"#{@bucket_name}\""
+            say "  update  #{backend_file} → bucket = \"#{@bucket_name}\""
           end
         end
       end

data/lib/belt/cli.rb

@@ -21,6 +21,7 @@ require_relative 'cli/routes_command'
 require_relative 'cli/lambda_config_command'
 require_relative 'cli/tasks_command'
 require_relative 'cli/console_command'
+require_relative 'cli/doctor_command'
 
 module Belt
   module CLI
@@ -33,6 +34,7 @@ module Belt
       %w[console c] => Belt::CLI::ConsoleCommand,
       %w[tasks --tasks -T] => Belt::CLI::TasksCommand,
       'setup' => Belt::CLI::SetupCommand,
+      'doctor' => Belt::CLI::DoctorCommand,
       'deploy' => Belt::CLI::DeployCommand,
       'frontend' => Belt::CLI::FrontendEnvCommand,
       %w[server s] => Belt::CLI::ServerCommand,
@@ -114,6 +116,7 @@ module Belt
           setup state                                 Create/select S3 state bucket
           setup tables <env>                          Generate DynamoDB tables from schema
           setup frontend <env>                        Generate S3 + CloudFront infrastructure
+          doctor                                      Check system dependencies and AWS config
           init [environment] <env>                    terraform init for environment
           plan [environment] <env>                    terraform plan for environment
           apply [environment] <env>                   terraform apply for environment
@@ -133,6 +136,7 @@ module Belt
 
         Examples:
           belt new blog --frontend react
+          belt new blog --frontend react -v   # list every created file
           belt generate scaffold post title:string content:text status:string
           belt destroy scaffold post
           belt generate frontend react

data/lib/belt/configuration.rb

@@ -0,0 +1,30 @@
+# frozen_string_literal: true
+
+module Belt
+  # Runtime configuration for Belt apps (set in lambda/config/environment.rb).
+  #
+  #   Belt.configure do |config|
+  #     config.default_format = :json  # or :html
+  #   end
+  #
+  # Note: infrastructure/<env>/belt.rb uses a separate sandboxed DSL for CLI
+  # deploy/backup settings — it does not share this object.
+  class Configuration
+    VALID_FORMATS = %i[json html].freeze
+
+    def initialize
+      @default_format = :json
+    end
+
+    attr_reader :default_format
+
+    def default_format=(value)
+      format = value.to_sym
+      unless VALID_FORMATS.include?(format)
+        raise ArgumentError, "default_format must be :json or :html (got #{value.inspect})"
+      end
+
+      @default_format = format
+    end
+  end
+end

data/lib/belt/controllers/welcome_controller.rb

@@ -6,23 +6,90 @@ module Belt
   # Gem-embedded welcome controller that serves the default "it works!" page.
   # Resolved via the ActionRouter's Belt:: namespace fallback when no app-defined
   # WelcomeController exists. Gets replaced once the user defines their own root route.
+  #
+  # Dual format:
+  #   - Browser / no Accept preference → HTML hero + stack check
+  #   - Accept: application/json (SPA / apiClient) → JSON payload for the React shell
+  #
+  # The hero image (lib/belt/assets/belt-default.jpg) is the single source of truth —
+  # HTML embeds it, and JSON returns the same bytes as a data URI so the SPA matches.
   class WelcomeController < BeltController::Base
     skip_before_action :authenticate!
 
     ASSETS_DIR = File.expand_path('../assets', __dir__)
+    # Scaffold gives model + controller + routes + schema (not model-only).
+    SCAFFOLD_HINT_CMD = 'belt generate scaffold Post title content:text'
 
     def show
       @title = ENV.fetch('WELCOME_TITLE', 'Welcome to Belt')
       @subtitle = ENV.fetch('WELCOME_SUBTITLE', 'API Gateway → Lambda → DynamoDB — all connected.')
-      @css = welcome_css
-      @background_image = background_image_base64
       @dynamodb_connected = dynamodb_connected?
+      @scaffold_hint_cmd = SCAFFOLD_HINT_CMD
+
+      return success_response(welcome_payload) if wants_json?
 
+      @css = welcome_css
+      @background_image = background_image_base64
       render
     end
 
     private
 
+    def welcome_payload
+      {
+        title: @title,
+        subtitle: @subtitle,
+        # Same gem asset as the HTML welcome page — edit belt-default.jpg once.
+        background_image: "data:image/jpeg;base64,#{background_image_base64}",
+        stack: {
+          api_gateway: true,
+          lambda: true,
+          dynamodb: @dynamodb_connected
+        },
+        # One tip only (was duplicated as dynamodb_hint + first next_step).
+        next_steps: [
+          "Scaffold a resource: #{SCAFFOLD_HINT_CMD}",
+          'Deploy: belt deploy',
+          'This page will be replaced once you define your own root route.'
+        ]
+      }
+    end
+
+    # SPA apiClient and fetch(..., { headers: { Accept: "application/json" } })
+    def wants_json?
+      return true if params['format'].to_s == 'json'
+
+      accept = header_value('Accept') || header_value('accept') || ''
+      return false if accept.empty?
+
+      # Prefer JSON when it's listed and not beaten by an explicit HTML preference
+      json_q = accept_quality(accept, 'application/json')
+      html_q = accept_quality(accept, 'text/html')
+      json_q.positive? && json_q >= html_q
+    end
+
+    def header_value(name)
+      headers = event.is_a?(Hash) ? event['headers'] : nil
+      return nil unless headers.is_a?(Hash)
+
+      headers[name] || headers[name.downcase] || headers[name.split('-').map(&:capitalize).join('-')]
+    end
+
+    def accept_quality(accept, media_type)
+      accept.split(',').each do |part|
+        type, *params = part.strip.split(';').map(&:strip)
+        # Exact type only — do not treat */* as JSON (curl/browsers send that by default)
+        next unless type == media_type
+
+        q = 1.0
+        params.each do |p|
+          q = p.split('=', 2).last.to_f if p.start_with?('q=')
+        end
+        return q
+      end
+      0.0
+    end
+
     def dynamodb_connected?
       return false unless defined?(Aws::DynamoDB::Client)
 

data/lib/belt/helpers/response.rb

@@ -2,6 +2,7 @@
 
 require_relative 'error_logging'
 require_relative 'cors_origin'
+require_relative '../http_status'
 
 module Belt
   module Helpers
@@ -9,8 +10,9 @@ module Belt
       def cors_headers(event = nil)
         event = @event if event.nil? && instance_variable_defined?(:@event)
         origin = CorsOrigin.resolve_origin(CorsOrigin.origin_from_event(event))
+        allow_headers = 'Content-Type,Accept,X-Amz-Date,Authorization,X-Api-Key,X-Amz-Security-Token'
         headers = {
-          'Access-Control-Allow-Headers' => 'Content-Type,X-Amz-Date,Authorization,X-Api-Key,X-Amz-Security-Token',
+          'Access-Control-Allow-Headers' => allow_headers,
           'Access-Control-Allow-Methods' => 'GET,POST,PUT,DELETE,PATCH,OPTIONS',
           'Access-Control-Max-Age' => '300',
           'Content-Type' => 'application/json'
@@ -19,16 +21,18 @@ module Belt
         headers
       end
 
+      # JSON success. Status accepts Integer or Symbol (:created, :ok, …).
       def success_response(body, status_code = 200)
-        { statusCode: status_code, headers: cors_headers, body: JSON.generate(body) }
+        { statusCode: resolve_status(status_code), headers: cors_headers, body: JSON.generate(body) }
       end
 
+      # JSON error. Status accepts Integer or Symbol (:unprocessable_entity, :not_found, …).
       def error_response(message, status_code = 400, error_details = nil)
         body = { error: message }
         if error_details
           body[:details] = error_details.is_a?(Hash) ? error_details : { message: error_details.to_s }
         end
-        { statusCode: status_code, headers: cors_headers, body: JSON.generate(body) }
+        { statusCode: resolve_status(status_code), headers: cors_headers, body: JSON.generate(body) }
       end
 
       def html_response(html, status_code = 200)
@@ -36,7 +40,30 @@ module Belt
         origin = CorsOrigin.resolve_origin(CorsOrigin.origin_from_event(event))
         headers = { 'Content-Type' => 'text/html; charset=utf-8' }
         headers['Access-Control-Allow-Origin'] = origin if origin
-        { statusCode: status_code, headers: headers, body: html }
+        { statusCode: resolve_status(status_code), headers: headers, body: html }
+      end
+
+      # Empty-body response (Rails-style). Useful for destroy / create-without-body.
+      #
+      #   head :created      # 201, empty body
+      #   head :no_content   # 204
+      #   head 201
+      #
+      def head(status = :no_content)
+        { statusCode: resolve_status(status), headers: cors_headers, body: '' }
+      end
+
+      # Set the status used by implicit assigns / HTML render (when you don't
+      # call success_response / render yourself).
+      #
+      #   def create
+      #     @post = Post.create!(...)
+      #     response_status :created
+      #   end
+      #   # → 201 + { post: {...} }
+      #
+      def response_status(status)
+        @__response_status = resolve_status(status)
       end
 
       def handle_error_and_respond(error, message, context = {}, status_code = 500)
@@ -56,6 +83,10 @@ module Belt
 
       private
 
+      def resolve_status(status)
+        Belt::HttpStatus.resolve(status)
+      end
+
       def verbose_errors_enabled?
         env = ENV['ENVIRONMENT']&.downcase || ''
         env.start_with?('dev') || env == 'local' || env == 'test'

data/lib/belt/http_status.rb

@@ -0,0 +1,89 @@
+# frozen_string_literal: true
+
+module Belt
+  # Rails/Rack-style symbolic HTTP status codes.
+  # Mirrors the common subset of Rack::Utils::SYMBOL_TO_STATUS_CODE so apps
+  # can write `head :created` / `success_response(body, :created)` without
+  # taking a rack dependency.
+  module HttpStatus
+    SYMBOL_TO_STATUS_CODE = {
+      continue: 100,
+      switching_protocols: 101,
+      processing: 102,
+      ok: 200,
+      created: 201,
+      accepted: 202,
+      non_authoritative_information: 203,
+      no_content: 204,
+      reset_content: 205,
+      partial_content: 206,
+      multi_status: 207,
+      already_reported: 208,
+      im_used: 226,
+      multiple_choices: 300,
+      moved_permanently: 301,
+      found: 302,
+      see_other: 303,
+      not_modified: 304,
+      use_proxy: 305,
+      temporary_redirect: 307,
+      permanent_redirect: 308,
+      bad_request: 400,
+      unauthorized: 401,
+      payment_required: 402,
+      forbidden: 403,
+      not_found: 404,
+      method_not_allowed: 405,
+      not_acceptable: 406,
+      proxy_authentication_required: 407,
+      request_timeout: 408,
+      conflict: 409,
+      gone: 410,
+      length_required: 411,
+      precondition_failed: 412,
+      payload_too_large: 413,
+      uri_too_long: 414,
+      unsupported_media_type: 415,
+      range_not_satisfiable: 416,
+      expectation_failed: 417,
+      unprocessable_entity: 422,
+      locked: 423,
+      failed_dependency: 424,
+      upgrade_required: 426,
+      precondition_required: 428,
+      too_many_requests: 429,
+      request_header_fields_too_large: 431,
+      unavailable_for_legal_reasons: 451,
+      internal_server_error: 500,
+      not_implemented: 501,
+      bad_gateway: 502,
+      service_unavailable: 503,
+      gateway_timeout: 504,
+      http_version_not_supported: 505,
+      variant_also_negotiates: 506,
+      insufficient_storage: 507,
+      loop_detected: 508,
+      not_extended: 510,
+      network_authentication_required: 511
+    }.freeze
+
+    module_function
+
+    # Resolve a status to an integer code.
+    # Accepts Integer (200), String ("201"), or Symbol (:created).
+    def resolve(status)
+      case status
+      when Integer
+        status
+      when String
+        Integer(status)
+      when Symbol
+        SYMBOL_TO_STATUS_CODE.fetch(status) do
+          raise ArgumentError, "Unknown HTTP status symbol: #{status.inspect}"
+        end
+      else
+        raise ArgumentError, "status must be Integer, String, or Symbol (got #{status.class})"
+      end
+    end
+  end
+end

data/lib/belt/rendering.rb

@@ -54,6 +54,7 @@ module Belt
     #   render layout: false           — skip layout (default: no layout)
     #
     def render(options = {})
+      # Status may be Integer or Symbol (:created, :ok, …)
       status = options.fetch(:status, 200)
 
       html = if options.key?(:inline)

data/lib/belt/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Belt
-  VERSION = '0.2.9'
+  VERSION = '0.2.10'
 end

data/lib/belt/views/welcome/show.html.erb

@@ -12,39 +12,39 @@
     <div class="overlay">
       <h1><%= h(@title) %></h1>
       <p class="subtitle"><%= h(@subtitle) %></p>
-    </div>
-  </div>
-  <div class="container">
-    <div class="stack-check">
-      <div class="check-item check-pass">
-        <span class="icon">✓</span>
-        <span>API Gateway</span>
-      </div>
-      <div class="arrow">→</div>
-      <div class="check-item check-pass">
-        <span class="icon">✓</span>
-        <span>Lambda</span>
+
+      <div class="stack-check">
+        <div class="check-item check-pass">
+          <span class="icon">✓</span>
+          <span>API Gateway</span>
+        </div>
+        <div class="arrow">→</div>
+        <div class="check-item check-pass">
+          <span class="icon">✓</span>
+          <span>Lambda</span>
+        </div>
+        <div class="arrow">→</div>
+        <%- if @dynamodb_connected -%>
+        <div class="check-item check-pass">
+          <span class="icon">✓</span>
+          <span>DynamoDB</span>
+        </div>
+        <%- else -%>
+        <div class="check-item check-neutral">
+          <span class="icon">○</span>
+          <span>DynamoDB</span>
+        </div>
+        <%- end -%>
       </div>
-      <div class="arrow">→</div>
-      <%- if @dynamodb_connected -%>
-      <div class="check-item check-pass">
-        <span class="icon">✓</span>
-        <span>DynamoDB</span>
+
+      <div class="next-steps">
+        <h2>Next Steps</h2>
+        <ol>
+          <li>Scaffold a resource: <code><%= h(@scaffold_hint_cmd) %></code></li>
+          <li>Deploy: <code>belt deploy</code></li>
+          <li>This page will be replaced once you define your own root route.</li>
+        </ol>
       </div>
-      <%- else -%>
-      <div class="check-item check-warn">
-        <span class="icon">⚠</span>
-        <span>DynamoDB</span>
-      </div>
-      <%- end -%>
-    </div>
-    <div class="next-steps">
-      <h2>Next Steps</h2>
-      <ol>
-        <li>Generate a resource: <code>belt g resource post title:string body:text</code></li>
-        <li>Deploy: <code>belt deploy</code></li>
-        <li>This page will be replaced once you define your own root route.</li>
-      </ol>
     </div>
   </div>
 </body>