belt 0.3.40 → 0.3.42

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 848174ed726800ea7e2a60b16a43714e558bf8adae32017a195a4ef0982cff11
-  data.tar.gz: 3d71874ef9d72422b72059e768de032b07caeb9b719bfaaf307d5d4d634b48ee
+  metadata.gz: a46f69166308a770107e86d0ccee9499a62e60858ebf000c74990183670eacfc
+  data.tar.gz: 988f5e06c5b6f03fb42be923ea9864e9a9bdbf2f12bc4d8bd963c82066eaa9fe
 SHA512:
-  metadata.gz: f431f7d645a3e94cdbf799f0d6fdd44a817491fd991da85b3bce7df95e760359638b1eeb528b39f3dc33edc51a324f4d0a4627152e0e4c025749020b3549ab91
-  data.tar.gz: 59fc7c275194d8ac49c4f69a0eb0109dcdf516eb1f6f597d5c7a9a5f0e16046d2d0dd6c88920c94c58735e643a0e231b3ce331fa919a7bc1d240c91ecb710c2f
+  metadata.gz: 6f614e8b43dfbe1a6431b0ae8f8a04f3bd92a33f305afd4c75d5a84252a45714b9462fbbbdc63d6978a873da674da053581f7a7afb521f011a06badcd6bc5913
+  data.tar.gz: 766f648f1bc4b795698f605f729682ab44baf7e27fa66dd8ff73e6c618cd1bba21cd8ae15c75cdff9d8c1b6e9a98b84f5be4b1bd828d7e16c0efcc0071ef9a77

data/CHANGELOG.md

@@ -1,5 +1,34 @@
 # Changelog
 
+## 0.3.41
+
+### Bug Fix
+
+- **Fix API Gateway sibling path parameter conflict**: When a resource has nested
+  resources (a block), member routes (show, update, destroy) now use `{param_name}`
+  (e.g., `{project_id}`) instead of `{id}` to match the nested routes. This prevents
+  API Gateway from rejecting routes due to sibling path segments having different
+  parameter names.
+
+  Without nested resources (no block):
+  ```
+  GET  /posts/{id}
+  PUT  /posts/{id}
+  DELETE /posts/{id}
+  ```
+
+  With nested resources:
+  ```
+  GET  /projects/{project_id}
+  PUT  /projects/{project_id}
+  DELETE /projects/{project_id}
+  GET  /projects/{project_id}/epics
+  GET  /projects/{project_id}/epics/{id}
+  ```
+
+  This fixes the error: "Unable to create resource at path '...': A sibling ({id})
+  of this resource already has a variable path part".
+
 ## 0.3.40
 
 ### Breaking Change

data/lib/belt/cli/apex_dns_sync.rb

@@ -0,0 +1,334 @@
+# frozen_string_literal: true
+
+require 'json'
+require 'open3'
+require_relative 'environment_config'
+
+module Belt
+  module CLI
+    # Syncs DNS records for apex (prod) environments to the root zone.
+    #
+    # Problem: When prod uses the apex domain (example.com), it creates a Route53
+    # zone and A records. But the registrar's NS records point to the ROOT zone
+    # (infrastructure/dns), not the prod zone. So the prod zone's records are
+    # invisible to the internet.
+    #
+    # Solution: After deploying prod, copy the A alias records (CloudFront, API
+    # Gateway) to the root zone, and ensure ACM validation CNAMEs are there too.
+    class ApexDnsSync
+      DNS_DIR = 'infrastructure/dns'
+
+      def initialize(env, infra_dir:, quiet: false)
+        @env = env
+        @infra_dir = infra_dir
+        @quiet = quiet
+        @project_root = find_project_root
+        @env_config = EnvironmentConfig.load(env, infra_dir: infra_dir)
+        @dns_config = dns_dir_exists? ? load_dns_config : nil
+      end
+
+      # Check if this environment needs apex DNS sync.
+      # Returns true if:
+      # 1. This is a prod environment (app_domain == domain, no env prefix)
+      # 2. DNS root zone exists (infrastructure/dns)
+      # 3. Domain is configured
+      def needs_sync?
+        return false unless dns_dir_exists?
+        return false unless apex_environment?
+
+        true
+      end
+
+      # Run the sync: copy prod's DNS records to the root zone.
+      def run
+        return unless needs_sync?
+
+        puts '━━━ apex DNS sync ━━━' unless @quiet
+
+        # Get prod's DNS targets (CloudFront, API Gateway)
+        targets = fetch_prod_targets
+        if targets.empty? || targets[:domain].nil?
+          puts '  ⚠ Could not read DNS targets from prod — skipping sync' unless @quiet
+          return
+        end
+
+        # Get root zone ID
+        root_zone_id = fetch_root_zone_id
+        unless root_zone_id
+          puts '  ⚠ Could not read root zone ID — skipping sync' unless @quiet
+          return
+        end
+
+        # Sync ACM validation first (cert must validate before CloudFront works)
+        sync_acm_validation(root_zone_id, targets[:domain])
+
+        # Sync A alias records
+        sync_alias_records(root_zone_id, targets)
+
+        puts '  ✓ Apex DNS synced to root zone' unless @quiet
+      end
+
+      private
+
+      def dns_dir_exists?
+        dns_path = File.join(@project_root, DNS_DIR)
+        Dir.exist?(dns_path) && File.exist?(File.join(dns_path, 'terraform.tfvars'))
+      end
+
+      def dns_dir_path
+        File.join(@project_root, DNS_DIR)
+      end
+
+      def find_project_root
+        dir = @infra_dir
+        while dir != '/'
+          return dir if File.exist?(File.join(dir, 'Gemfile')) ||
+                        File.exist?(File.join(dir, 'belt.rb'))
+
+          dir = File.dirname(dir)
+        end
+        File.dirname(@infra_dir)
+      end
+
+      def load_dns_config
+        EnvironmentConfig.load('dns', infra_dir: File.join(@project_root, 'infrastructure'))
+      rescue StandardError
+        nil
+      end
+
+      def apex_environment?
+        # Check tfvars to see if this is a prod environment
+        env_dir = File.join(@infra_dir, @env)
+        return false unless Dir.exist?(env_dir)
+
+        tfvars_path = File.join(env_dir, 'terraform.tfvars')
+        return false unless File.exist?(tfvars_path)
+
+        content = File.read(tfvars_path)
+        domain_match = content.match(/^\s*domain\s*=\s*"([^"]+)"/)
+        env_match = content.match(/^\s*environment\s*=\s*"([^"]+)"/)
+        parent_match = content.match(/^\s*parent_environment\s*=\s*"([^"]+)"/)
+
+        return false unless domain_match
+
+        # Not apex if it's a nested environment
+        parent = parent_match ? parent_match[1] : ''
+        return false unless parent.empty?
+
+        # Apex if environment is "prod" (convention)
+        env_name = env_match ? env_match[1] : @env
+        env_name == 'prod'
+      end
+
+      def fetch_prod_targets
+        env_dir = File.join(@infra_dir, @env)
+        targets = {}
+
+        Dir.chdir(env_dir) do
+          env = aws_env_for(@env_config)
+
+          # Get terraform outputs
+          output, status = Open3.capture2e(env, 'terraform', 'output', '-json')
+          return targets unless status.success?
+
+          data = parse_json(output) || {}
+          extract_cloudfront_target(data, targets)
+          extract_api_gateway_target(data, targets)
+          extract_domain(targets)
+        end
+
+        targets
+      end
+
+      def extract_cloudfront_target(data, targets)
+        cf_domain = data.dig('cloudfront_domain_name', 'value')
+        return unless cf_domain
+
+        cf_zone = data.dig('cloudfront_hosted_zone_id', 'value')
+        targets[:cloudfront] = {
+          domain_name: cf_domain,
+          hosted_zone_id: cf_zone || 'Z2FDTNDATAQYW2' # CloudFront's fixed zone ID
+        }
+      end
+
+      def extract_api_gateway_target(data, targets)
+        apigw_domain = data.dig('api_gateway_domain_name', 'value')
+        apigw_zone = data.dig('api_gateway_hosted_zone_id', 'value')
+        return unless apigw_domain && !apigw_domain.empty? && apigw_zone && !apigw_zone.empty?
+
+        targets[:api_gateway] = {
+          domain_name: apigw_domain,
+          hosted_zone_id: apigw_zone
+        }
+      end
+
+      def extract_domain(targets)
+        tfvars_path = 'terraform.tfvars'
+        return unless File.exist?(tfvars_path)
+
+        match = File.read(tfvars_path).match(/^\s*domain\s*=\s*"([^"]+)"/)
+        targets[:domain] = match[1] if match
+      end
+
+      def fetch_root_zone_id
+        return nil unless dns_dir_exists?
+
+        Dir.chdir(dns_dir_path) do
+          env = aws_env_for(@dns_config)
+
+          output, status = Open3.capture2e(env, 'terraform', 'output', '-json', 'root_zone_id')
+          return nil unless status.success?
+
+          begin
+            JSON.parse(output)
+          rescue JSON::ParserError
+            nil
+          end
+        end
+      end
+
+      def sync_alias_records(root_zone_id, targets)
+        return unless targets[:domain] && targets[:cloudfront]
+
+        domain = targets[:domain]
+        cf = targets[:cloudfront]
+        apigw = targets[:api_gateway]
+
+        # Build change batch for alias records
+        changes = []
+
+        # Apex domain → CloudFront
+        changes << alias_change('UPSERT', domain, cf[:domain_name], cf[:hosted_zone_id])
+
+        # www → CloudFront
+        changes << alias_change('UPSERT', "www.#{domain}", cf[:domain_name], cf[:hosted_zone_id])
+
+        # api → API Gateway (if configured)
+        if apigw && apigw[:domain_name] && apigw[:hosted_zone_id]
+          changes << alias_change('UPSERT', "api.#{domain}", apigw[:domain_name], apigw[:hosted_zone_id])
+        end
+
+        change_batch = {
+          Comment: 'Belt apex DNS sync',
+          Changes: changes
+        }
+
+        # Apply via Route53 API
+        env = aws_env_for(@dns_config)
+        _, status = Open3.capture2e(
+          env,
+          'aws', 'route53', 'change-resource-record-sets',
+          '--hosted-zone-id', root_zone_id,
+          '--change-batch', JSON.generate(change_batch)
+        )
+
+        if status.success?
+          records = [domain, "www.#{domain}"]
+          records << "api.#{domain}" if apigw
+          puts "    ✓ A records: #{records.join(', ')}" unless @quiet
+        else
+          puts '    ⚠ Failed to sync A records to root zone' unless @quiet
+        end
+      end
+
+      def sync_acm_validation(root_zone_id, _domain)
+        env_dir = File.join(@infra_dir, @env)
+
+        Dir.chdir(env_dir) do
+          env = aws_env_for(@env_config)
+
+          # Get ACM certificate from state
+          output, status = Open3.capture2e(
+            env,
+            'terraform', 'state', 'show', '-json', 'module.app.aws_acm_certificate.app[0]'
+          )
+          return unless status.success?
+
+          cert_data = parse_json(output)
+          return unless cert_data
+
+          cert_status = cert_data.dig('values', 'status')
+
+          # Skip if already issued
+          if cert_status == 'ISSUED'
+            puts '    ✓ ACM certificate already issued' unless @quiet
+            return
+          end
+
+          # Get validation options
+          validation_options = cert_data.dig('values', 'domain_validation_options') || []
+          return if validation_options.empty?
+
+          changes = build_validation_changes(validation_options)
+          upsert_validation_cnames(root_zone_id, changes)
+        end
+      end
+
+      def build_validation_changes(validation_options)
+        changes = validation_options.map do |opt|
+          {
+            Action: 'UPSERT',
+            ResourceRecordSet: {
+              Name: opt['resource_record_name'],
+              Type: 'CNAME',
+              TTL: 300,
+              ResourceRecords: [{ Value: opt['resource_record_value'] }]
+            }
+          }
+        end
+
+        # Dedupe by name (ACM uses same CNAME for base and wildcard)
+        changes.uniq! { |c| c[:ResourceRecordSet][:Name] }
+        changes
+      end
+
+      def upsert_validation_cnames(root_zone_id, changes)
+        change_batch = {
+          Comment: 'Belt ACM validation sync',
+          Changes: changes
+        }
+
+        dns_env = aws_env_for(@dns_config)
+        _, status = Open3.capture2e(
+          dns_env,
+          'aws', 'route53', 'change-resource-record-sets',
+          '--hosted-zone-id', root_zone_id,
+          '--change-batch', JSON.generate(change_batch)
+        )
+
+        if status.success?
+          puts '    ✓ ACM validation CNAME synced (cert pending)' unless @quiet
+        else
+          puts '    ⚠ Failed to sync ACM validation CNAME' unless @quiet
+        end
+      end
+
+      def alias_change(action, name, target_domain, target_zone_id)
+        {
+          Action: action,
+          ResourceRecordSet: {
+            Name: name,
+            Type: 'A',
+            AliasTarget: {
+              DNSName: target_domain,
+              HostedZoneId: target_zone_id,
+              EvaluateTargetHealth: false
+            }
+          }
+        }
+      end
+
+      def aws_env_for(config)
+        env = {}
+        env['AWS_PROFILE'] = config.aws_profile if config&.aws_profile?
+        env
+      end
+
+      def parse_json(output)
+        JSON.parse(output)
+      rescue JSON::ParserError
+        nil
+      end
+    end
+  end
+end

data/lib/belt/cli/deploy_command.rb

@@ -14,6 +14,7 @@ require_relative 'zip_artifact_builder'
 require_relative 'nested_environment'
 require_relative 'cognito_sharer'
 require_relative 'dynamo_copier'
+require_relative 'apex_dns_sync'
 
 module Belt
   module CLI
@@ -173,6 +174,9 @@ module Belt
           run_apply
         end
 
+        # Sync apex DNS records to root zone (if this is a prod/apex environment)
+        run_apex_dns_sync
+
         puts "\n✅ Deployed #{@env} successfully!"
         print_outputs(env_dir)
 
@@ -733,6 +737,14 @@ module Belt
         FileUtils.rm_f('tfplan')
       end
 
+      def run_apex_dns_sync
+        sync = ApexDnsSync.new(@env, infra_dir: @infra_dir)
+        return unless sync.needs_sync?
+
+        puts ''
+        sync.run
+      end
+
       def run_nested_env_hooks
         nested = NestedEnvironment.for(@env, infra_dir: @infra_dir)
         return unless nested

data/lib/belt/cli/dns_command.rb

@@ -29,6 +29,8 @@ module Belt
           new.remove_environment(args)
         when 'show', 'list'
           new.show(args)
+        when 'doctor'
+          new.doctor(args)
         when '--help', '-h', 'help'
           puts help
         else
@@ -47,6 +49,7 @@ module Belt
             add <env>           Add an environment's NS records to dns/terraform.tfvars
             remove <env>        Remove an environment's NS records from dns/terraform.tfvars
             show                Show root zone name servers (for registrar configuration)
+            doctor              Diagnose DNS configuration across all environments
             help                Show this help
 
           Options for generate:
@@ -60,6 +63,7 @@ module Belt
             belt dns add staging            # Add staging's NS records to tfvars
             belt dns remove staging         # Remove staging's NS delegation
             belt dns show                   # Show root name servers to configure at registrar
+            belt dns doctor                 # Check DNS health for all environments
 
           The dns directory manages your root domain and delegates subdomains to
           per-environment hosted zones. Each environment (dev, staging, prod) gets
@@ -343,8 +347,334 @@ module Belt
         end
       end
 
+      # --- Doctor ---
+      # Diagnose DNS configuration across all environments
+      def doctor(args)
+        require 'open3'
+        require_relative 'terraform_command'
+
+        # Parse --env flag for filtering to a specific environment
+        env_filter = nil
+        if args.include?('--env')
+          idx = args.index('--env')
+          env_filter = args[idx + 1]
+        end
+
+        # Read domain from dns/terraform.tfvars
+        domain = read_domain_from_dns_tfvars
+        unless domain
+          puts 'Could not determine domain.'
+          puts "\nEnsure infrastructure/dns/terraform.tfvars has:"
+          puts '  domain = "example.com"'
+          exit 1
+        end
+
+        puts "DNS Health: #{domain}"
+        puts '═' * 64
+        puts ''
+
+        # Check root zone
+        if Dir.exist?(DNS_DIR)
+          check_root_zone(domain)
+        else
+          puts 'Root Zone (infrastructure/dns)'
+          puts '────────────────────────────────────────'
+          puts '  ⚠ Not configured'
+          puts '    Run: belt dns generate'
+          puts ''
+        end
+
+        # Check each environment
+        environments = if env_filter
+                         [env_filter]
+                       else
+                         TerraformCommand.list_environments
+                       end
+
+        environments.each do |env_name|
+          check_environment(env_name, domain)
+        end
+      end
+
       private
 
+      def parse_json(output)
+        JSON.parse(output)
+      rescue JSON::ParserError
+        nil
+      end
+
+      def check_root_zone(domain)
+        puts 'Root Zone (shared account)'
+        puts '────────────────────────────────────────'
+
+        dns_config = load_dns_config
+        env = {}
+        env['AWS_PROFILE'] = dns_config.aws_profile if dns_config.aws_profile?
+
+        outputs = Dir.chdir(DNS_DIR) do
+          output, status = Open3.capture2e(env, 'terraform', 'output', '-json')
+          unless status.success?
+            puts '  ⚠ Cannot read terraform state'
+            puts '    Run: belt dns deploy'
+            return
+          end
+
+          parse_json(output)
+        end
+
+        unless outputs
+          puts '  ⚠ Failed to parse terraform outputs'
+          return
+        end
+
+        zone_id = outputs.dig('root_zone_id', 'value')
+        name_servers = outputs.dig('root_name_servers', 'value') || []
+        delegated = outputs.dig('delegated_environments', 'value') || []
+
+        if zone_id
+          if zone_exists_in_aws?(zone_id, env)
+            puts "  ✓ Zone ID: #{zone_id}"
+          else
+            puts "  ✗ Zone #{zone_id} not found in AWS (state stale?)"
+          end
+        else
+          puts '  ⚠ Zone not created yet'
+        end
+
+        if name_servers.any?
+          puts "  ✓ NS records configured (#{name_servers.length} servers)"
+
+          # Check if registrar NS matches (via DNS lookup)
+          actual_ns = lookup_ns_records(domain)
+          if actual_ns.sort == name_servers.sort
+            puts '  ✓ Registrar NS records match'
+          elsif actual_ns.any?
+            puts '  ⚠ Registrar NS records differ from root zone'
+            puts "    Expected: #{name_servers.first}..."
+            puts "    Got:      #{actual_ns.first}..."
+          else
+            puts '  ⚠ Could not verify registrar NS records (DNS lookup failed)'
+          end
+        else
+          puts '  ⚠ No NS records found'
+        end
+
+        if delegated.any?
+          puts "  ✓ Delegated: #{delegated.join(', ')}"
+        else
+          puts '  ⚠ No environments delegated'
+        end
+
+        # Check for apex records (should exist if prod is deployed)
+        check_root_zone_apex_records(zone_id, domain, env) if zone_id
+
+        puts ''
+      end
+
+      def check_root_zone_apex_records(zone_id, domain, env)
+        # List records in root zone to see if apex A records exist
+        output, status = Open3.capture2e(
+          env,
+          'aws', 'route53', 'list-resource-record-sets',
+          '--hosted-zone-id', zone_id,
+          '--query', "ResourceRecordSets[?Type=='A'].Name",
+          '--output', 'json'
+        )
+        return unless status.success?
+
+        records = begin
+          JSON.parse(output)
+        rescue JSON::ParserError
+          []
+        end
+
+        apex_exists = records.any? { |r| r.chomp('.') == domain }
+        www_exists = records.any? { |r| r.chomp('.') == "www.#{domain}" }
+        api_exists = records.any? { |r| r.chomp('.') == "api.#{domain}" }
+
+        if apex_exists && www_exists && api_exists
+          puts "  ✓ Apex A records present (#{domain}, www, api)"
+        elsif apex_exists || www_exists || api_exists
+          missing = []
+          missing << domain unless apex_exists
+          missing << "www.#{domain}" unless www_exists
+          missing << "api.#{domain}" unless api_exists
+          puts "  ⚠ Some apex A records missing: #{missing.join(', ')}"
+        else
+          puts '  ⚠ No apex A records (prod not synced? run: belt deploy prod)'
+        end
+      end
+
+      def check_environment(env_name, domain)
+        env_dir = "infrastructure/#{env_name}"
+        return unless Dir.exist?(env_dir)
+
+        # Determine expected domain for this env
+        tfvars_path = File.join(env_dir, 'terraform.tfvars')
+        env_domain = nil
+        is_prod = env_name == 'prod'
+
+        if File.exist?(tfvars_path)
+          content = File.read(tfvars_path)
+          domain_match = content.match(/^\s*domain\s*=\s*"([^"]+)"/)
+          env_match = content.match(/^\s*environment\s*=\s*"([^"]+)"/)
+          parent_match = content.match(/^\s*parent_environment\s*=\s*"([^"]+)"/)
+
+          configured_domain = domain_match ? domain_match[1] : nil
+          actual_env = env_match ? env_match[1] : env_name
+          parent = parent_match ? parent_match[1] : nil
+          is_prod = actual_env == 'prod'
+          is_nested = parent && !parent.empty?
+
+          if configured_domain
+            env_domain = if is_nested
+                           "#{actual_env}.#{parent}.#{configured_domain}"
+                         elsif is_prod
+                           configured_domain
+                         else
+                           "#{actual_env}.#{configured_domain}"
+                         end
+          end
+        end
+
+        label = if is_prod
+                  "#{env_name} (#{env_domain || domain}) [apex]"
+                else
+                  "#{env_name} (#{env_domain || "#{env_name}.#{domain}"})"
+                end
+        puts label
+        puts '────────────────────────────────────────'
+
+        env_config = begin
+          EnvironmentConfig.load(env_name)
+        rescue StandardError
+          nil
+        end
+
+        unless env_config
+          puts '  ⚠ No belt.rb config found'
+          puts ''
+          return
+        end
+
+        env = {}
+        env['AWS_PROFILE'] = env_config.aws_profile if env_config.aws_profile?
+
+        # Check terraform state
+        Dir.chdir(env_dir) do
+          output, status = Open3.capture2e(env, 'terraform', 'output', '-json')
+          unless status.success?
+            puts '  ⚠ Cannot read terraform state (not deployed?)'
+            puts ''
+            return
+          end
+
+          outputs = parse_json(output)
+          unless outputs
+            puts '  ⚠ Failed to parse terraform outputs'
+            puts ''
+            return
+          end
+
+          report_environment_status(outputs, env_name, env_dir, env, domain, env_domain, is_prod)
+        end
+
+        puts ''
+      end
+
+      def report_environment_status(outputs, env_name, env_dir, env, domain, env_domain, is_prod)
+        # Zone info
+        name_servers = outputs.dig('name_servers', 'value') || []
+        if name_servers.any?
+          puts "  ✓ Zone deployed (#{name_servers.length} NS records)"
+        else
+          puts '  ⚠ No hosted zone found'
+        end
+
+        # Check ACM certificate
+        check_acm_cert(env_dir, env)
+
+        # Check delegation in root zone (for non-apex envs)
+        check_delegation(env_name, domain, name_servers) unless is_prod
+
+        # For apex (prod), check if DNS resolves
+        check_dns_resolution(env_domain) if is_prod && env_domain
+      end
+
+      def check_acm_cert(_env_dir, aws_env)
+        # Try to get cert status from state
+        output, status = Open3.capture2e(
+          aws_env,
+          'terraform', 'state', 'show', '-json', 'module.app.aws_acm_certificate.app[0]'
+        )
+        return unless status.success?
+
+        cert_data = parse_json(output)
+        return unless cert_data
+
+        cert_domain = cert_data.dig('values', 'domain_name')
+        cert_status = cert_data.dig('values', 'status')
+
+        case cert_status
+        when 'ISSUED'
+          puts "  ✓ ACM certificate: ISSUED (#{cert_domain})"
+        when 'PENDING_VALIDATION'
+          puts "  ⚠ ACM certificate: PENDING_VALIDATION (#{cert_domain})"
+          puts '    Validation CNAME may need to be in root zone for apex domains'
+        else
+          puts "  ⚠ ACM certificate: #{cert_status || 'unknown'}"
+        end
+      end
+
+      def check_delegation(env_name, _domain, _expected_ns)
+        return unless Dir.exist?(DNS_DIR)
+
+        dns_config = load_dns_config
+        env = {}
+        env['AWS_PROFILE'] = dns_config.aws_profile if dns_config.aws_profile?
+
+        # Read tfvars to check if this env is delegated
+        tfvars_path = "#{DNS_DIR}/terraform.tfvars"
+        return unless File.exist?(tfvars_path)
+
+        content = File.read(tfvars_path)
+        if content.include?("#{env_name} =")
+          puts '  ✓ NS delegation configured in root zone'
+        else
+          puts '  ⚠ NS delegation not configured in root zone'
+          puts "    Run: belt dns add #{env_name}"
+        end
+      end
+
+      def check_dns_resolution(domain)
+        # Try to resolve the domain
+        output, status = Open3.capture2e('dig', '+short', domain)
+        if status.success? && output.strip.length.positive?
+          ips = output.strip.split("\n")
+          puts "  ✓ DNS resolves: #{ips.first}"
+        else
+          puts "  ⚠ DNS does not resolve for #{domain}"
+          puts '    Apex A records may be missing from root zone'
+        end
+      end
+
+      def read_domain_from_dns_tfvars
+        tfvars_path = "#{DNS_DIR}/terraform.tfvars"
+        return nil unless File.exist?(tfvars_path)
+
+        content = File.read(tfvars_path)
+        match = content.match(/^\s*domain\s*=\s*"([^"]+)"/)
+        match ? match[1] : nil
+      end
+
+      def lookup_ns_records(domain)
+        output, status = Open3.capture2e('dig', '+short', 'NS', domain)
+        return [] unless status.success?
+
+        output.strip.split("\n").map { |ns| ns.chomp('.') }.sort
+      end
+
       def templates
         {
           'main.tf.erb' => 'main.tf',

data/lib/belt/route_dsl.rb

@@ -416,9 +416,12 @@ module Belt
       resource_options = options.merge(route_type: :resources)
       actions = determine_actions(options)
 
-      add_resource_routes(resource_name, param_name, resource_options, actions)
+      # When there are nested resources, use {param_name} for member routes to avoid
+      # API Gateway sibling path parameter conflicts. Without nested resources, use {id}.
+      has_nested = block_given?
+      add_resource_routes(resource_name, param_name, resource_options, actions, use_param_name: has_nested)
 
-      return unless block_given?
+      return unless has_nested
 
       collection_prefix = "/#{resource_name}"
       member_prefix = "/#{resource_name}/{#{param_name}}"
@@ -497,8 +500,11 @@ module Belt
       options.merge(tables: [resource_name.to_sym])
     end
 
-    def add_resource_routes(resource_name, _param_name, resource_options, actions)
-      # Member routes (show/update/destroy) use {id}, not {singular_id} — Rails convention
+    def add_resource_routes(resource_name, param_name, resource_options, actions, use_param_name: false)
+      # Member routes (show/update/destroy) use {id} by default (Rails convention).
+      # When nested resources exist (use_param_name: true), use {param_name} instead
+      # to avoid API Gateway sibling path parameter conflicts.
+      member_param = use_param_name ? param_name : 'id'
       if actions.include?(:index)
         add_route(:get, "/#{resource_name}",
                   resolve_request_model_for(resource_options, :index))
@@ -508,16 +514,16 @@ module Belt
                   resolve_request_model_for(resource_options, :create))
       end
       if actions.include?(:show)
-        add_route(:get, "/#{resource_name}/{id}",
+        add_route(:get, "/#{resource_name}/{#{member_param}}",
                   resolve_request_model_for(resource_options, :show))
       end
       if actions.include?(:update)
-        add_route(:put, "/#{resource_name}/{id}",
+        add_route(:put, "/#{resource_name}/{#{member_param}}",
                   resolve_request_model_for(resource_options, :update))
       end
       return unless actions.include?(:destroy)
 
-      add_route(:delete, "/#{resource_name}/{id}", resolve_request_model_for(resource_options, :destroy))
+      add_route(:delete, "/#{resource_name}/{#{member_param}}", resolve_request_model_for(resource_options, :destroy))
     end
 
     def resolve_request_model_for(options, action)
@@ -799,8 +805,11 @@ module Belt
         end
       end
 
-      def add_scoped_resource_routes(resource_name, _param_name, resource_options, actions)
-        # Member routes (show/update/destroy) use {id}, not {singular_id} — Rails convention
+      def add_scoped_resource_routes(resource_name, param_name, resource_options, actions, use_param_name: false)
+        # Member routes (show/update/destroy) use {id} by default (Rails convention).
+        # When nested resources exist (use_param_name: true), use {param_name} instead
+        # to avoid API Gateway sibling path parameter conflicts.
+        member_param = use_param_name ? param_name : 'id'
         if actions.include?(:index)
           @gateway.send(:add_route, :get, build_path("/#{resource_name}"),
                         resolve_request_model_for(resource_options, :index))
@@ -810,16 +819,16 @@ module Belt
                         resolve_request_model_for(resource_options, :create))
         end
         if actions.include?(:show)
-          @gateway.send(:add_route, :get, build_path("/#{resource_name}/{id}"),
+          @gateway.send(:add_route, :get, build_path("/#{resource_name}/{#{member_param}}"),
                         resolve_request_model_for(resource_options, :show))
         end
         if actions.include?(:update)
-          @gateway.send(:add_route, :put, build_path("/#{resource_name}/{id}"),
+          @gateway.send(:add_route, :put, build_path("/#{resource_name}/{#{member_param}}"),
                         resolve_request_model_for(resource_options, :update))
         end
         return unless actions.include?(:destroy)
 
-        @gateway.send(:add_route, :delete, build_path("/#{resource_name}/{id}"),
+        @gateway.send(:add_route, :delete, build_path("/#{resource_name}/{#{member_param}}"),
                       resolve_request_model_for(resource_options, :destroy))
       end
 
@@ -842,7 +851,10 @@ module Belt
         resource_options = options.merge(route_type: :resources, controller: controller)
         actions = determine_scoped_actions(options)
 
-        add_scoped_resource_routes(resource_name, param_name, resource_options, actions)
+        # When there are nested resources, use {param_name} for member routes to avoid
+        # API Gateway sibling path parameter conflicts. Without nested resources, use {id}.
+        has_nested = !block.nil?
+        add_scoped_resource_routes(resource_name, param_name, resource_options, actions, use_param_name: has_nested)
         build_nested_resource_block(resource_name, param_name, options, controller, &block) if block
       end
 

data/lib/belt/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Belt
-  VERSION = '0.3.40'
+  VERSION = '0.3.42'
 end

data/lib/templates/module/outputs.tf.erb

@@ -22,3 +22,31 @@ output "name_servers" {
   description = "NS records to configure at your registrar (standalone envs only)"
   value       = local.dns_enabled && !local.is_nested ? aws_route53_zone.app[0].name_servers : []
 }
+
+# --- Apex DNS sync outputs ---
+# These enable `belt deploy prod` to sync records to the root zone.
+
+output "cloudfront_domain_name" {
+  description = "CloudFront distribution domain name (for DNS alias)"
+  value       = aws_cloudfront_distribution.frontend.domain_name
+}
+
+output "cloudfront_hosted_zone_id" {
+  description = "CloudFront hosted zone ID (always Z2FDTNDATAQYW2)"
+  value       = aws_cloudfront_distribution.frontend.hosted_zone_id
+}
+
+output "api_gateway_domain_name" {
+  description = "API Gateway custom domain regional domain name"
+  value       = local.dns_enabled ? aws_api_gateway_domain_name.api[0].regional_domain_name : ""
+}
+
+output "api_gateway_hosted_zone_id" {
+  description = "API Gateway custom domain hosted zone ID"
+  value       = local.dns_enabled ? aws_api_gateway_domain_name.api[0].regional_zone_id : ""
+}
+
+output "is_apex_environment" {
+  description = "True if this is an apex (prod) environment using the bare domain"
+  value       = local.dns_enabled && !local.is_nested && var.environment == "prod"
+}

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: belt
 version: !ruby/object:Gem::Version
-  version: 0.3.40
+  version: 0.3.42
 platform: ruby
 authors:
 - Stowzilla
@@ -103,6 +103,7 @@ files:
 - lib/belt/assets/belt-default.jpg
 - lib/belt/assets/welcome.css
 - lib/belt/cli.rb
+- lib/belt/cli/apex_dns_sync.rb
 - lib/belt/cli/app_detection.rb
 - lib/belt/cli/auth_command.rb
 - lib/belt/cli/backup_config.rb