belt 0.2.9 → 0.2.11

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 37cf283dc30b43f875f8600eb4b00e46b5782f374d3be306d0c5adaec7e9024a
-  data.tar.gz: 1153f552cef87426f91afcf28647065017b77a09bdd9347241366ed9cc455b76
+  metadata.gz: 43ae84461595be08ca6caada3afd148ccfa0db94bfc2e2bd864a9b466d41f087
+  data.tar.gz: 1f33826b8c7a7b068458db8ca38aa9910079e16f04c3c5c727550f084ed85075
 SHA512:
-  metadata.gz: 4cafc0f29e0148e74950e9fe0898e74632f2563980f60ffece7bfbb58ec7187ec30f928a0958dff9d9832fe79b21e8a87e512f26c4cddfa58c1f243776cea5eb
-  data.tar.gz: 7850fc8e4c5921646c25f77f67fdfcae663e148ec597b514b095b637733b0e55f34182e8c64ea52f2294ed687b3a24f7b6a56462b30df07811a01ffae23da952
+  metadata.gz: 81532edca53a084bdd6aabf5e7027fd1653ec0fc4c592b0bdb60374283c7c59512a2217405d3a19f32a975bcbcbbebdf9f9a97d952a25b1567e05af8e2cb879d
+  data.tar.gz: d5ff609d6526f8cc59964df6da091a43150eca9d1c6f625dee27b070db0c56bd90ef58ef11c42f57e27259f169c477a4c1c548f9ca0f4c4f916c8bea540763bb

data/CHANGELOG.md

@@ -1,5 +1,124 @@
 # Changelog
 
+## Unreleased
+
+## 0.2.11
+
+### Security hardening
+
+- **CORS origin validation**: format validation (scheme required, no paths/queries/fragments), length limit (253 chars) to prevent ReDoS, restrict wildcard matching to valid subdomain chars `[a-z0-9-]`.
+- **Security headers** on all responses: `X-Content-Type-Options: nosniff`, `Vary: Origin`; HTML responses also get `X-Frame-Options: DENY` and `Referrer-Policy: strict-origin-when-cross-origin`.
+- **Path traversal protection** in `ActionRouter`: strict regex for controller names, reject `..` sequences / absolute paths / backslashes, `realpath` validation in `resolve_from_paths`.
+- **Request body size limit** (10 MB): returns 413 for oversized bodies; proper 400 for invalid JSON.
+
+### Safe `belt destroy environment`
+
+Previously `belt destroy environment <name>` immediately deleted the infrastructure directory with no checks — leaving orphaned AWS resources.
+
+Now the command:
+1. Checks if Terraform state exists (local `.terraform` dir or remote state)
+2. If state found, prompts user to run `terraform destroy` first
+3. Requires explicit confirmation before deleting files
+4. Supports `--force` (skip prompts) and `--skip-terraform` flags
+
+### Environment generator state bucket fix
+
+The environment generator was writing `belt-terraform-state` as the backend bucket name, missing the account-ID suffix. Now resolves via sibling `backend.tf`, STS `get-caller-identity`, or placeholder (for later `belt setup state` patch).
+
+### Contributing & plugins
+
+- README: **Plugins** and **Contributing** sections — how to contribute to belt, how plugins register via `GeneratorRegistry`, layout used by `belt-messaging` / `belt-pay`, generator checklist for humans and agents.
+- **`belt plugin new <name>`** — scaffold a new plugin gem (gemspec, `Belt::<Name>` module, generator stub, RSpec, README, AGENTS.md), similar to `rails plugin new`.
+- **`AGENTS.md`** at the belt gem root — agent-oriented map of core layout, CLI, and the plugin/GeneratorRegistry contract (complements README).
+- Plugin scaffold includes **`AGENTS.md`** so new plugins match the agent guidance pattern already used by `belt new` apps.
+
+## 0.2.10
+
+### Quiet `belt new` (with optional verbose)
+
+`belt new` prints a short phase summary by default (skeleton, environments, frontend,
+bundle, state bucket) instead of every path plus AWS/npm noise.
+
+Use `-v` / `--verbose` for Rails-style per-file `create` lines when you want the
+inventory. Nested generators skip their own next-steps banners; the final success
+block still owns next steps. State-bucket setup stays non-interactive either way.
+
+### State bucket naming (global uniqueness)
+
+S3 bucket names are a **global** namespace across all AWS accounts. The previous default
+`belt-terraform-state` only works for the first account that creates it — everyone else
+hits "owned by a different AWS account".
+
+**Fix:** shared bucket is still one-per-account (all apps share it), but the name is now:
+
+```
+belt-terraform-state-<account_id>
+```
+
+- Still one bucket for all belt apps in an account (state key: `<app>/<env>/terraform.tfstate`)
+- `--bucket` still overrides when you want a custom name
+- `belt setup state` rewrites `backend.tf` with the resolved name
+- Existing installs that already own `belt-terraform-state` can keep using `--bucket belt-terraform-state`
+
+### Implicit responses (Rails-style assigns)
+
+Controllers can set instance variables and skip the explicit `success_response` call:
+
+```ruby
+def index
+  @posts = Post.all
+end
+
+def show
+  @post = Post.find(params[:id])
+end
+```
+
+Belt auto-builds `success_response({ posts: [...] })` / `{ post: {...} }` from assigns set
+during the action. Serialization:
+
+- Models → `to_h` (ActiveItem already defines this)
+- `ActiveItem::Relation` / Enumerable → map each record via `to_h`
+- Nested hashes/arrays recurse
+
+Explicit `success_response` / `error_response` / `html_response` / `render` / `head` still win
+when returned. Rescue handlers still use `error_response`.
+
+### Default format (`:json` / `:html`)
+
+```ruby
+# App-wide (lambda/config/environment.rb)
+Belt.configure do |c|
+  c.default_format = :json   # default — API first
+end
+
+# Per-controller override (inherits down the chain)
+class PagesController < ApplicationController
+  self.default_format = :html
+end
+```
+
+| `default_format` | Implicit response (no explicit helper) |
+|---|---|
+| `:json` (default) | `success_response` from assigns |
+| `:html` | `render` template `views/<controller>/<action>.html.erb` (missing → `TemplateNotFound`) |
+
+### Symbol status codes, `head`, `response_status`
+
+```ruby
+success_response({ post: post.to_h }, :created)   # 201
+error_response("Nope", :unprocessable_entity)     # 422
+head :no_content                                  # 204 empty body
+head :created                                     # 201 empty body
+
+def create
+  @post = Post.create!(...)
+  response_status :created   # 201 + implicit assigns body
+end
+```
+
+Bare integers still work. Symbols match the Rack/Rails names (`:created`, `:not_found`, …).
+
 ## 0.3.0
 
 ### Pre-Deploy Backups

data/README.md

@@ -71,24 +71,31 @@ require "belt"
 class PostsController < BeltController::Base
   before_action :authenticate!
 
+  # Implicit response: assigns become the JSON body
+  # → { "posts": [ { "id": "...", "title": "..." }, ... ] }
   def index
-    posts = Post.where(user_id: current_user_id, index: "UserIndex")
-    success_response(posts.map(&:attributes))
+    @posts = Post.where(user_id: current_user_id, index: "UserIndex")
   end
 
   def show
-    post = Post.find(params["id"])
-    success_response(post.attributes)
+    @post = Post.find(params["id"])
   end
 
+  # Implicit body + non-200 status
   def create
     attrs = params.require(:post).permit(:title, :body).to_h
-    post = Post.create!(attrs.merge(user_id: current_user_id))
-    success_response(post.attributes, 201)
+    @post = Post.create!(attrs.merge(user_id: current_user_id))
+    response_status :created
+  end
+
+  def destroy
+    Post.find(params["id"]).destroy
+    head :no_content
   end
 end
 ```
 
+
 ### 4. Lambda entry point
 
 Use `Belt::LambdaHandler` to get automatic observability, CORS preflight handling, and error wrapping:
@@ -199,9 +206,42 @@ end
 
 ```ruby
 success_response({ id: "123", name: "Example" })       # 200 JSON with CORS
-success_response({ id: "123" }, 201)                    # 201 Created
-error_response("Not found", 404)                        # 404 JSON error
+success_response({ id: "123" }, :created)               # 201 Created (symbol or int)
+error_response("Not found", :not_found)                 # 404 JSON error
+error_response("Nope", :unprocessable_entity)           # 422
 html_response("<h1>Hello</h1>")                         # 200 HTML with CORS
+head :no_content                                        # 204 empty body
+head :created                                           # 201 empty body
+```
+
+### Default format (API vs HTML)
+
+```ruby
+# App-wide — typically in lambda/config/environment.rb
+Belt.configure do |config|
+  config.default_format = :json   # default
+end
+
+# Per-controller override
+class PagesController < ApplicationController
+  self.default_format = :html
+end
+```
+
+- **`:json`** (default): action assigns → `success_response({ posts: [...] })`
+- **`:html`**: action assigns stay on the controller; Belt implicitly `render`s
+  `views/<controller>/<action>.html.erb`. Missing template raises `Belt::TemplateNotFound`
+  (no silent JSON fallback).
+- Explicit helpers always win: `success_response`, `error_response`, `html_response`,
+  `render`, `head`.
+
+### Non-200 with implicit assigns
+
+```ruby
+def create
+  @post = Post.create!(...)
+  response_status :created   # → 201 + { post: {...} }
+end
 ```
 
 ## Controller Discovery
@@ -535,6 +575,175 @@ These are set via Terraform variables in each environment's `terraform.tfvars`.
 
 The backup phase reads table names from Terraform outputs. On a brand-new environment that has never been deployed, there are no outputs yet — Belt will warn and skip the backup phase gracefully. After the first successful deploy, backups run normally on subsequent deploys.
 
+## Plugins
+
+Belt is designed to stay lean. Optional capabilities ship as **separate gems** that plug into the CLI and runtime the same way Rails engines and generators do.
+
+### Official / example plugins
+
+| Gem | Purpose | Status |
+|-----|---------|--------|
+| [`belt-messaging`](https://github.com/stowzilla/belt-messaging) | Two-way SMS via AWS End User Messaging (Pinpoint) | Early (not production-hardened) |
+| [`belt-pay`](https://github.com/stowzilla/belt-pay) | Stripe payments & subscriptions | Early (not production-hardened) |
+
+Install a plugin in a Belt app:
+
+```ruby
+# Gemfile
+gem "belt-messaging"
+# gem "belt-pay"
+```
+
+```bash
+bundle install
+belt generate messaging   # or: belt g pay
+belt generate --help      # lists built-ins + gem generators
+```
+
+### How plugins register
+
+No central registry file, no initializer hook. Belt discovers generators by scanning loaded gems:
+
+1. Gem is in the app `Gemfile` and bundled
+2. Gem ships a file at `lib/belt/generators/<name>_generator.rb`
+3. Class lives in `Belt::Generators`, named `<Name>Generator`
+4. Implements `.run(args)` (required), `.destroy(args)` and `.description` (optional)
+
+That is the whole contract. After `bundle install`, `belt generate <name>` and `belt destroy <name>` just work.
+
+See `Belt::CLI::GeneratorRegistry` and the CHANGELOG entry for **0.1.13 Generator Extension API**.
+
+### Plugin layout (canonical)
+
+```
+belt-messaging/
+├── belt-messaging.gemspec
+├── lib/
+│   ├── belt-messaging.rb              # require entrypoint
+│   └── belt/
+│       ├── messaging.rb               # Belt::Messaging API
+│       ├── messaging/
+│       │   ├── configuration.rb
+│       │   ├── version.rb
+│       │   ├── controllers/           # default controllers (optional)
+│       │   └── templates/             # ERB templates for the generator
+│       │       ├── terraform/
+│       │       ├── lambda/
+│       │       ├── config/
+│       │       └── controllers/
+│       └── generators/
+│           └── messaging_generator.rb # ← auto-discovered
+└── spec/
+```
+
+**Runtime code stays in the gem.** Generators copy only what the host app must own (Terraform modules, Lambda entrypoints, optional controller overrides). Prefer gem defaults + `belt g <plugin> --controllers` over dumping everything into the app (same idea as `rails g devise:views`).
+
+### Creating a new plugin
+
+Scaffold a ready-to-fill gem (Rails-style `plugin new`):
+
+```bash
+belt plugin new notifications
+# → ./belt-notifications/
+
+belt plugin new pay --path ~/Code --summary "Stripe payments for Belt"
+# → ~/Code/belt-pay/
+```
+
+Then:
+
+```bash
+cd belt-notifications
+bundle install
+# implement lib/belt/notifications/* and the generator
+```
+
+Point a Belt app at it while developing:
+
+```ruby
+# In the app Gemfile
+gem "belt-notifications", path: "../belt-notifications"
+```
+
+```bash
+bundle install
+belt generate notifications
+```
+
+When packaging Lambdas, `belt deploy` vendors path gems into `vendor/cache` so conveyor-belt can package them.
+
+### Generator checklist (for humans and agents)
+
+A solid plugin generator typically:
+
+1. **Terraform module** → `infrastructure/modules/<name>/` (`main.tf`, `variables.tf`, `outputs.tf`)
+2. **Lambda config** → `config/lambda/<name>.yml` (timeout, memory, env, triggers)
+3. **Lambda entrypoint** → `lambda/<name>.rb` using `Belt::LambdaHandler`
+4. **Routes / schema** → inject into `config/routes.tf.rb` or `infrastructure/schema.tf.rb` when needed
+5. **Optional overrides** → `--controllers` flag for app-local subclasses
+6. **Destroy path** → `belt destroy <name>` removes what generate created
+7. **Help text** → `.description` + `--help` explaining what was installed and next steps
+
+Copy from `belt-messaging` or `belt-pay` rather than inventing a new structure.
+
+## Contributing
+
+Bug reports and pull requests are welcome on [GitHub](https://github.com/stowzilla/belt).
+
+### Development setup
+
+```bash
+git clone https://github.com/stowzilla/belt.git
+cd belt
+bundle install
+bundle exec rspec
+bundle exec rubocop
+```
+
+### Guidelines
+
+1. **Branch from `master`** — open a PR against `master`
+2. **Keep changes focused** — one concern per PR when practical
+3. **Follow existing patterns** — look at neighboring files and `lib/belt/cli/` before inventing new ones
+4. **Tests + lint** — run `bundle exec rspec` and `bundle exec rubocop` before opening (or updating) a PR. CI requires both (plus `bundler-audit`); failing checks block merge on `master`
+5. **Changelog** — note user-facing changes in `CHANGELOG.md` under the next version / Unreleased
+6. **No secrets** — never commit AWS keys, tokens, or real account IDs
+
+### Project layout (for contributors)
+
+| Path | What lives there |
+|------|------------------|
+| `lib/belt.rb` | Public require entry |
+| `lib/belt/` | Framework core (controller, router, handler, observability) |
+| `lib/belt/cli/` | CLI commands (`new`, `generate`, `deploy`, `plugin`, …) |
+| `lib/belt_controller/` | `BeltController::Base` |
+| `lib/templates/` | ERB templates for `belt new`, generators, plugin scaffold |
+| `exe/belt` | CLI executable |
+| `spec/` | RSpec suite |
+| `AGENTS.md` | Agent-oriented map of this gem (layout, CLI, plugin contract) |
+
+AI / coding agents: start with **[AGENTS.md](AGENTS.md)**. Belt apps and plugins scaffolded by the CLI get their own `AGENTS.md` as well (`belt new`, `belt plugin new`).
+
+### Local gem development against an app
+
+```ruby
+# In a Belt app's Gemfile
+gem "belt", path: "../belt"
+```
+
+`belt deploy` detects `path:` gems and materializes them into `vendor/cache` for Lambda packaging so you can iterate without publishing a gem for every try.
+
+### Contributing a plugin
+
+Plugins are separate repositories (not vendored into this repo). To add a new first-class capability:
+
+1. `belt plugin new <name>` (or copy `belt-messaging` / `belt-pay`)
+2. Implement the runtime API + generator contract above
+3. Document install steps in the plugin README (`gem …` → `belt generate …`)
+4. Open a PR on the plugin repo; optionally link it from this README's plugin table
+
+Questions about plugin design or core changes: open a GitHub issue or discuss in the project Discord.
+
 ## License
 
 MIT

data/lib/belt/action_router.rb

@@ -102,15 +102,35 @@ module Belt
     end
 
     def dispatch_to_controller(route_info, event, body)
-      controller_class = resolve_controller(route_info[:controller])
+      controller_name = route_info[:controller]
+
+      # Prevent path traversal — controller names must be simple identifiers or single-level nested
+      unless valid_controller_name?(controller_name)
+        Belt::Observability::Logger.instance&.warn('Invalid controller name', controller: controller_name)
+        return error_response('Not found', 404, event)
+      end
+
+      controller_class = resolve_controller(controller_name)
       controller = controller_class.new(event: event, body: body)
 
-      controller_name = controller_class.name.split('::').last.gsub('Controller', '')
-      Belt::Observability::Logger.instance&.info("Processing by #{controller_name}##{route_info[:action]}")
+      class_label = controller_class.name.split('::').last.gsub('Controller', '')
+      Belt::Observability::Logger.instance&.info("Processing by #{class_label}##{route_info[:action]}")
 
       controller.dispatch(route_info[:action].to_sym)
     end
 
+    # Validate controller names to prevent path traversal.
+    # Allows: "posts", "admin/posts" (single nesting level, no dots or special chars)
+    def valid_controller_name?(name)
+      return false if name.nil? || name.empty?
+      return false if name.include?('..')
+      return false if name.start_with?('/') || name.end_with?('/')
+      return false if name.include?('\\')
+
+      # Allow only lowercase letters, digits, underscores, and a single forward slash for nesting
+      name.match?(%r{\A[a-z][a-z0-9_]*(/[a-z][a-z0-9_]*)?\z})
+    end
+
     def resolve_controller(controller_name)
       # Try namespace module first (app's own controllers)
       begin
@@ -137,10 +157,18 @@ module Belt
     def resolve_from_paths(controller_name)
       if controller_name.include?('/')
       end
-      file_name = "#{controller_name}_controller.rb"
+      file_name = "#{controller_name.gsub('/', '_')}_controller.rb"
 
       Belt.all_controller_paths.each do |path|
         full_path = File.join(path, file_name)
+
+        # Ensure resolved path stays within the allowed controller directory
+        begin
+          resolved = File.realpath(full_path)
+        rescue Errno::ENOENT, Errno::EACCES
+          next
+        end
+        next unless resolved.start_with?(File.realpath(path))
         next unless File.exist?(full_path)
 
         require full_path
@@ -165,7 +193,7 @@ module Belt
     def error_response(message, status_code, event = nil)
       origin = Belt::Helpers::CorsOrigin.resolve_origin(Belt::Helpers::CorsOrigin.origin_from_event(event))
       headers = {
-        'Access-Control-Allow-Headers' => 'Content-Type,X-Amz-Date,Authorization,X-Api-Key,X-Amz-Security-Token',
+        'Access-Control-Allow-Headers' => 'Content-Type,Accept,X-Amz-Date,Authorization,X-Api-Key,X-Amz-Security-Token',
         'Access-Control-Allow-Methods' => 'GET,POST,PUT,DELETE,PATCH,OPTIONS',
         'Content-Type' => 'application/json'
       }

data/lib/belt/assets/welcome.css

@@ -1,82 +1,136 @@
 * { margin: 0; padding: 0; box-sizing: border-box; }
+html, body {
+  height: 100%;
+}
 body {
   font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, sans-serif;
-  background: #f8f9fa;
+  background: #0b1220;
   color: #2d3748;
   min-height: 100vh;
+  overflow: hidden;
 }
 
-/* Hero section — full width background image */
+/* Hero fills the viewport — all content lives in the overlay (no scroll) */
 .hero {
   position: relative;
   width: 100%;
+  height: 100vh;
   overflow: hidden;
 }
 .hero-bg {
   width: 100%;
-  height: auto;
+  height: 100%;
+  object-fit: cover;
+  /* Pin the logo / sky — crop hills at the bottom if the viewport is short */
+  object-position: top center;
   display: block;
 }
 .overlay {
   position: absolute;
-  top: 35%;
+  top: 50%;
   left: 50%;
   transform: translate(-50%, -50%);
-  padding: 2rem 3rem;
-  background: rgba(255, 255, 255, 0.50);
-  backdrop-filter: blur(6px);
-  -webkit-backdrop-filter: blur(6px);
-  border-radius: 12px;
+  padding: 1.35rem 1.6rem 1.25rem;
+  background: rgba(255, 255, 255, 0.55);
+  backdrop-filter: blur(8px);
+  -webkit-backdrop-filter: blur(8px);
+  border-radius: 14px;
   text-align: center;
-  max-width: 600px;
-  width: 90%;
-  box-shadow: 0 4px 20px rgba(0, 0, 0, 0.1);
+  max-width: 560px;
+  width: min(92vw, 560px);
+  max-height: min(92vh, 620px);
+  overflow: auto;
+  box-shadow: 0 8px 32px rgba(0, 0, 0, 0.18);
 }
 .overlay h1 {
-  font-size: 2.2rem;
+  font-size: 1.85rem;
   font-weight: 700;
   color: #2d3748;
-  margin-bottom: 0.4rem;
+  margin-bottom: 0.3rem;
+  line-height: 1.2;
 }
 .overlay .subtitle {
-  font-size: 1.1rem;
+  font-size: 0.95rem;
   color: #4a5568;
+  line-height: 1.4;
 }
 
-/* Content below the hero */
-.container {
-  max-width: 700px;
-  margin: 0 auto;
-  padding: 2rem;
-}
+/* Stack + next steps sit inside the white card */
 .stack-check {
   display: flex;
   align-items: center;
   justify-content: center;
-  gap: 0.75rem;
-  margin-bottom: 2rem;
+  gap: 0.4rem;
+  margin: 1rem 0 0.85rem;
   flex-wrap: wrap;
 }
 .check-item {
   display: flex;
   align-items: center;
-  gap: 0.4rem;
-  padding: 0.5rem 1rem;
+  gap: 0.35rem;
+  padding: 0.35rem 0.7rem;
   border-radius: 8px;
   font-weight: 500;
+  font-size: 0.88rem;
 }
 .check-pass {
-  background: rgba(39, 174, 96, 0.1);
-  border: 1px solid rgba(39, 174, 96, 0.3);
+  background: rgba(39, 174, 96, 0.12);
+  border: 1px solid rgba(39, 174, 96, 0.35);
   color: #1e8449;
 }
+/* Optional / empty DynamoDB — not an error, just not in use yet */
+.check-neutral {
+  background: rgba(113, 128, 150, 0.1);
+  border: 1px solid rgba(113, 128, 150, 0.28);
+  color: #4a5568;
+}
 .check-warn {
   background: rgba(243, 156, 18, 0.1);
   border: 1px solid rgba(243, 156, 18, 0.3);
   color: #d68910;
 }
-.icon { font-size: 1.1rem; }
-.arrow { color: #718096; font-size: 1.2rem; }
+.icon { font-size: 1rem; }
+.arrow { color: #718096; font-size: 1.05rem; }
+
+.next-steps {
+  text-align: left;
+  border-top: 1px solid rgba(45, 55, 72, 0.12);
+  padding-top: 0.75rem;
+  margin-top: 0.15rem;
+}
+.next-steps h2 {
+  font-size: 0.92rem;
+  margin-bottom: 0.45rem;
+  color: #2d3748;
+  text-align: left;
+}
+.next-steps ol {
+  padding-left: 1.2rem;
+  margin: 0;
+}
+.next-steps li {
+  margin-bottom: 0.4rem;
+  color: #4a5568;
+  line-height: 1.4;
+  font-size: 0.88rem;
+}
+.next-steps li:last-child { margin-bottom: 0; }
+.next-steps code,
+.info code {
+  background: rgba(99, 45, 145, 0.1);
+  padding: 0.12rem 0.35rem;
+  border-radius: 4px;
+  color: #632d91;
+  font-size: 0.78rem;
+  word-break: break-word;
+}
+
+/* Legacy blocks (local server welcome, older layouts) */
+.container {
+  max-width: 700px;
+  margin: 0 auto;
+  padding: 2rem;
+}
 .info {
   background: #ffffff;
   border: 1px solid #e2e8f0;
@@ -87,26 +141,44 @@ body {
 .info p { margin-bottom: 0.5rem; color: #4a5568; }
 .info p:last-child { margin-bottom: 0; }
 .info strong { color: #2d3748; }
-.info code {
-  background: rgba(99, 45, 145, 0.08);
-  padding: 0.15rem 0.4rem;
+.dynamodb-hint {
+  text-align: center;
+  margin: 0.5rem 0;
+  color: #4a5568;
+  font-size: 0.9rem;
+  line-height: 1.45;
+}
+.dynamodb-hint code {
+  background: rgba(99, 45, 145, 0.1);
+  padding: 0.12rem 0.35rem;
   border-radius: 4px;
   color: #632d91;
-  font-size: 0.85rem;
+  font-size: 0.8rem;
+  word-break: break-word;
 }
-.next-steps {
-  background: #ffffff;
-  border: 1px solid #e2e8f0;
-  border-radius: 12px;
-  padding: 1.5rem;
+.footer-note {
+  margin-top: 0.75rem;
+  padding-top: 0.65rem;
+  border-top: 1px solid rgba(45, 55, 72, 0.1);
+  font-size: 0.78rem;
+  color: #718096;
+  text-align: center;
 }
-.next-steps h2 { font-size: 1.1rem; margin-bottom: 1rem; color: #2d3748; }
-.next-steps ol { padding-left: 1.5rem; }
-.next-steps li { margin-bottom: 0.6rem; color: #4a5568; line-height: 1.5; }
-.next-steps code {
-  background: rgba(99, 45, 145, 0.08);
-  padding: 0.15rem 0.4rem;
-  border-radius: 4px;
-  color: #632d91;
-  font-size: 0.85rem;
+.footer-note code {
+  background: rgba(45, 55, 72, 0.06);
+  padding: 0.08rem 0.3rem;
+  border-radius: 3px;
+  color: #4a5568;
+}
+
+/* Tiny viewports: shrink type a bit so everything still fits */
+@media (max-height: 640px) {
+  .overlay {
+    padding: 1rem 1.15rem;
+  }
+  .overlay h1 { font-size: 1.5rem; }
+  .overlay .subtitle { font-size: 0.88rem; }
+  .stack-check { margin: 0.7rem 0 0.55rem; }
+  .check-item { padding: 0.28rem 0.55rem; font-size: 0.8rem; }
+  .next-steps li { font-size: 0.82rem; }
 }