belt 0.2.19 → 0.2.20

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 7f706cafa79246d178c2aee6bfb05536bcb5f03111a24f13624e769ef7d9916a
-  data.tar.gz: a99d09c6d472d4826acf78dee6a4fded952c8745071b63c6ea4f54dbfd6b0aef
+  metadata.gz: 983c166381b409ee19c2a23c1439be35180892299af76570097d206dea1ba1a4
+  data.tar.gz: f7888dca2b10805bed099da525b968b90e511c1b8381990ba85ab80dc23a9263
 SHA512:
-  metadata.gz: 2009deb03f2f725c4e960e73abf7745b8a9fdd5899ea76178b3942f21c504fe76338912ba57f05b913db3a18494f635c508e4696a3c347e40ddcb973e4c61541
-  data.tar.gz: b84417ce5814e266715b5dc54b4a965261f8011fee552f9f594c82137751565ff29b20f17444b2be986abfd79c02059b935ae5aa97fcbdbbfdcc79ffafa0421b
+  metadata.gz: 253f76decf02f960c12011b95570b04213c33800eecfaf70415071f8a2792cae2480a71251cc0ec1b565b837b1c9229f6522c6452124f63560334c6cb6b838d4
+  data.tar.gz: 5393e1c8cdef68b50dee5bca41a299d02560ecc9e65718e8ed45e2cb09b5ffabaf74eefc11b47e59f35fd7b78b602b866db7028eae82246e0da76b14910eca53

data/lib/belt/cli/auth_command.rb

@@ -101,14 +101,48 @@ module Belt
         write_cognito_tf
         write_cognito_outputs_tf
         patch_main_tf
+        patch_env_outputs
         generate_frontend_auth if frontend?
 
         puts "\n✓ Auth generated!"
+        print_next_steps
+      end
+
+      def print_next_steps
         puts "\nNext steps:"
-        puts '  1. Review infrastructure/modules/app/cognito.tf'
-        puts '  2. Customize password policy, MFA, or Lambda triggers as needed'
-        puts '  3. Run `belt apply <env>` to deploy'
-        puts '  4. Create your account: aws cognito-idp admin-create-user ...' unless @signup
+        puts '  1. Add auth: :cognito to your routes namespace:'
+        puts ''
+        puts '       namespace :api, auth: :cognito do'
+        puts '         # your resources...'
+        puts '       end'
+        puts ''
+        if frontend?
+          puts '  2. Wire auth into your frontend/src/App.jsx:'
+          puts ''
+          puts "       import Login from './pages/auth/Login'"
+          puts "       import ProtectedRoute from './components/ProtectedRoute'"
+          puts ''
+          puts '       // Add login route:'
+          puts '       <Route path="/login" element={<Login onLogin={() => window.location.href = \'/\'} />} />'
+          puts ''
+          puts '       // Wrap protected routes:'
+          puts '       <Route path="/*" element={<ProtectedRoute><YourApp /></ProtectedRoute>} />'
+          puts ''
+          puts '  3. Deploy: belt deploy'
+          print_create_user_step(4) unless @signup
+        else
+          puts '  2. Deploy: belt deploy'
+          print_create_user_step(3) unless @signup
+        end
+      end
+
+      def print_create_user_step(step_num)
+        puts "  #{step_num}. Create your account:"
+        puts '       aws cognito-idp admin-create-user \\'
+        puts '         --user-pool-id <pool-id-from-terraform-output> \\'
+        puts '         --username your@email.com \\'
+        puts '         --temporary-password TempPass123 \\'
+        puts '         --message-action SUPPRESS'
       end
 
       def remove
@@ -167,6 +201,7 @@ module Belt
         pages_dir = 'frontend/src/pages/auth'
         FileUtils.mkdir_p(pages_dir)
         copy_frontend_file(frontend_template_dir, 'Login.jsx', File.join(pages_dir, 'Login.jsx'))
+        copy_frontend_file(frontend_template_dir, 'auth.css', File.join(pages_dir, 'auth.css'))
         if @signup
           # Generate auth pages
           copy_frontend_file(frontend_template_dir, 'SignUp.jsx', File.join(pages_dir, 'SignUp.jsx'))
@@ -244,6 +279,42 @@ module Belt
         insert_cognito_into_resource(content, main_tf, arn_value)
       end
 
+      def patch_env_outputs
+        env_dirs = Dir.glob('infrastructure/*/outputs.tf')
+                      .reject { |f| f.include?('modules') }
+
+        env_dirs.each do |outputs_file|
+          content = File.read(outputs_file)
+
+          next if content.include?('cognito_user_pool_id')
+
+          cognito_outputs = @pools.map do |pool|
+            suffix = pool[:suffix]
+            <<~HCL
+
+              output "cognito_user_pool_id#{suffix}" {
+                description = "Cognito User Pool ID#{pool[:label]}"
+                value       = module.app.cognito_user_pool_id#{suffix}
+              }
+
+              output "cognito_client_id#{suffix}" {
+                description = "Cognito User Pool Client ID#{pool[:label]}"
+                value       = module.app.cognito_client_id#{suffix}
+              }
+
+              output "cognito_region" {
+                description = "AWS region for Cognito"
+                value       = var.aws_region
+              }
+            HCL
+          end.join
+
+          File.write(outputs_file, content + cognito_outputs)
+          env_name = File.basename(File.dirname(outputs_file))
+          puts "  update  #{outputs_file} (added cognito outputs for #{env_name})"
+        end
+      end
+
       def build_arn_value(arns)
         if arns.length == 1
           "[#{arns.first}]"

data/lib/belt/cli/console_command.rb

@@ -1,6 +1,7 @@
 # frozen_string_literal: true
 
 require 'optparse'
+require 'stringio'
 require_relative 'environment_config'
 
 module Belt
@@ -59,7 +60,10 @@ module Belt
         boot_app
         puts banner
         ARGV.clear
-        require 'irb'
+        suppress_warnings do
+          require 'irb'
+          require 'rdoc'
+        end
         IRB.start
       end
 
@@ -72,7 +76,7 @@ module Belt
       end
 
       def boot_app
-        require 'bundler/setup'
+        suppress_warnings { require 'bundler/setup' }
 
         environment_file = File.join(Belt.root, 'lambda', 'config', 'environment.rb')
         if File.exist?(environment_file)
@@ -132,6 +136,17 @@ module Belt
           result.inspect
         end
       end
+
+      def suppress_warnings
+        original_verbose = $VERBOSE
+        $VERBOSE = nil
+        original_stderr = $stderr
+        $stderr = StringIO.new
+        yield
+      ensure
+        $stderr = original_stderr
+        $VERBOSE = original_verbose
+      end
     end
   end
 end

data/lib/belt/cli/deploy_command.rb

@@ -145,6 +145,7 @@ module Belt
 
       def run
         validate!
+        run_preflight_checks!
         env_dir = File.join(@infra_dir, @env)
 
         load_and_apply_env_config!
@@ -263,6 +264,14 @@ module Belt
               "Create it with: belt generate environment #{@env}"
       end
 
+      def run_preflight_checks!
+        require_relative 'doctor_command'
+        doctor = DoctorCommand.new(preflight: true)
+        return if doctor.run
+
+        abort 'Deploy blocked. Fix the issues above, then try again.'
+      end
+
       def validate_aws!
         stdout, status = Open3.capture2('aws', 'sts', 'get-caller-identity', '--output', 'json')
         unless status.success?

data/lib/belt/cli/destroy_command.rb

@@ -10,7 +10,7 @@ require_relative '../inflector'
 module Belt
   module CLI
     class DestroyCommand
-      GENERATORS = %w[scaffold resource model controller environment frontend views auth].freeze
+      GENERATORS = %w[scaffold resource model controller environment frontend views index auth].freeze
 
       include AppDetection
 
@@ -61,6 +61,8 @@ module Belt
             exit 1
           end
           new(generator, name, args.map { |a| parse_field(a) }).destroy
+        when 'index'
+          Belt::CLI::IndexCommand.run(['remove'] + args)
         else
           name = args.shift
           if name.nil? || name.empty?

data/lib/belt/cli/doctor_command.rb

@@ -2,6 +2,7 @@
 
 require 'json'
 require 'open3'
+require_relative '../../belt/inflector'
 
 module Belt
   module CLI
@@ -17,13 +18,14 @@ module Belt
 
       def self.run(args)
         verbose = args.include?('--verbose') || args.include?('-v')
+        preflight = args.include?('--preflight')
 
         if args.include?('--help') || args.include?('-h')
           puts usage
           exit 0
         end
 
-        new(verbose: verbose).run
+        new(verbose: verbose, preflight: preflight).run
       end
 
       def self.usage
@@ -33,24 +35,50 @@ module Belt
           Check system dependencies and AWS configuration for Belt.
 
           Options:
-            -v, --verbose    Show detailed output for each check
-            -h, --help       Show this help
+            -v, --verbose      Show detailed output for each check
+            --preflight        Run only deploy-critical checks (indexes, credentials)
+            -h, --help         Show this help
         USAGE
       end
 
-      def initialize(verbose: false)
+      def initialize(verbose: false, preflight: false)
         @verbose = verbose
+        @preflight = preflight
         @issues = []
         @warnings = []
       end
 
-      def run
+      def run # rubocop:disable Naming/PredicateMethod
+        if @preflight
+          run_preflight
+        else
+          run_full
+        end
+
+        @issues.empty?
+      end
+
+      # Returns true if all preflight checks pass, false otherwise.
+      def run_preflight
+        check_aws_identity_quiet
+        check_table_indexes
+        check_cognito_auth
+        return if @issues.empty?
+
+        puts "\nPreflight checks failed:\n"
+        @issues.each { |i| puts "  ✗ #{i}" }
+        puts ''
+      end
+
+      def run_full
         puts "Belt Doctor\n"
         puts "Checking your system for Belt prerequisites...\n\n"
 
         check_tools
         check_aws_credentials
         check_aws_identity
+        check_table_indexes
+        check_cognito_auth
 
         puts ''
         print_summary
@@ -132,28 +160,144 @@ module Belt
           print_ok('Authentication', "account #{account}")
           puts "         ARN: #{arn}" if @verbose
         else
-          error = output.strip
-          if error.include?('ExpiredToken') || error.include?('expired')
-            print_fail('Authentication', 'credentials expired')
-            puts '         Run: aws sso login'
-            @issues << 'AWS credentials are expired — run `aws sso login`'
-          elsif error.include?('InvalidClientTokenId') || error.include?('SignatureDoesNotMatch')
-            print_fail('Authentication', 'invalid credentials')
-            puts '         Your access key or secret is incorrect.'
-            puts '         Run: aws configure'
-            @issues << 'AWS credentials are invalid'
-          elsif error.include?('Could not connect') || error.include?('Unable to locate credentials')
-            print_fail('Authentication', 'unable to authenticate')
-            puts '         Run: aws configure sso    # or set AWS_PROFILE'
-            @issues << 'Unable to authenticate with AWS'
+          handle_aws_identity_error(output.strip)
+        end
+      end
+
+      def check_aws_identity_quiet
+        _, status = Open3.capture2e('aws', 'sts', 'get-caller-identity')
+        return if status.success?
+
+        @issues << 'AWS credentials invalid or expired — run `aws sso login`'
+      end
+
+      def handle_aws_identity_error(error)
+        if error.include?('ExpiredToken') || error.include?('expired')
+          print_fail('Authentication', 'credentials expired')
+          puts '         Run: aws sso login'
+          @issues << 'AWS credentials are expired — run `aws sso login`'
+        elsif error.include?('InvalidClientTokenId') || error.include?('SignatureDoesNotMatch')
+          print_fail('Authentication', 'invalid credentials')
+          puts '         Your access key or secret is incorrect.'
+          puts '         Run: aws configure'
+          @issues << 'AWS credentials are invalid'
+        elsif error.include?('Could not connect') || error.include?('Unable to locate credentials')
+          print_fail('Authentication', 'unable to authenticate')
+          puts '         Run: aws configure sso    # or set AWS_PROFILE'
+          @issues << 'Unable to authenticate with AWS'
+        else
+          print_fail('Authentication', 'failed')
+          puts "         #{error.lines.first&.strip}" if error.length.positive?
+          @issues << 'AWS authentication failed'
+        end
+      end
+
+      def check_table_indexes
+        return unless Belt.root?
+
+        models_dir = File.join(Belt.root, 'lambda/models')
+        dynamodb_tf = File.join(Belt.root, 'infrastructure/modules/app/dynamodb.tf')
+
+        return unless Dir.exist?(models_dir)
+
+        puts ''
+        puts '── Tables & Indexes ──'
+
+        unless File.exist?(dynamodb_tf)
+          print_warn('dynamodb.tf', 'not found — run `belt setup tables` to generate')
+          @warnings << 'dynamodb.tf not generated — run `belt setup tables`'
+          return
+        end
+
+        tf_content = File.read(dynamodb_tf)
+        model_files = Dir.glob(File.join(models_dir, '*.rb'))
+                         .reject { |f| File.basename(f) == 'application_record.rb' }
+
+        model_files.each do |file|
+          check_model_indexes(file, tf_content)
+        end
+      end
+
+      def check_model_indexes(file, tf_content)
+        content = File.read(file)
+        class_match = content.match(/^class\s+(\w+)\s*<\s*ApplicationRecord/)
+        return unless class_match
+
+        model_name = Belt::Inflector.underscore(class_match[1])
+        table_name = Belt::Inflector.pluralize(model_name)
+
+        # Check if table exists in dynamodb.tf
+        unless tf_content.include?("resource \"aws_dynamodb_table\" \"#{table_name}\"")
+          print_fail(table_name, 'table not in dynamodb.tf')
+          @issues << "Table '#{table_name}' missing from dynamodb.tf — run `belt setup tables`"
+          return
+        end
+
+        # Extract expected indexes from belongs_to
+        expected_indexes = extract_expected_indexes(content)
+        return if expected_indexes.empty?
+
+        # Check each expected index exists in the TF file
+        # Scope check to this table's resource block
+        table_block = tf_content[/resource "aws_dynamodb_table" "#{table_name}" \{.*?^\}/m]
+        return unless table_block
+
+        missing = []
+        expected_indexes.each do |idx|
+          if table_block.include?("name            = \"#{idx[:name]}\"")
+            print_ok(table_name, idx[:name]) if @verbose
           else
-            print_fail('Authentication', 'failed')
-            puts "         #{error.lines.first&.strip}" if error.length.positive?
-            @issues << 'AWS authentication failed'
+            missing << idx
+          end
+        end
+
+        if missing.empty?
+          print_ok(table_name, "#{expected_indexes.size} index#{'es' if expected_indexes.size > 1} configured")
+        else
+          missing.each do |idx|
+            print_fail(table_name, "missing #{idx[:name]} (required by belongs_to :#{idx[:association]})")
+            @issues << "Table '#{table_name}' missing index '#{idx[:name]}' " \
+                       '— run `belt setup tables` then `belt deploy`'
           end
         end
       end
 
+      def extract_expected_indexes(content)
+        indexes = []
+        content.lines.reject { |line| line.strip.start_with?('#') }.join
+               .scan(/belongs_to\s+:(\w+)/) do |match|
+          association_name = match[0]
+          indexes << {
+            name: "#{Belt::Inflector.classify(association_name)}Index",
+            association: association_name
+          }
+        end
+        indexes
+      end
+
+      def check_cognito_auth
+        return unless Belt.root?
+
+        routes_file = Belt.routes_file
+        return unless routes_file
+
+        content = File.read(routes_file)
+
+        # Check if any routes use auth: :cognito
+        uses_cognito = content.include?('auth: :cognito')
+        return unless uses_cognito
+
+        # Check if cognito.tf exists
+        cognito_tf = File.join(Belt.root, 'infrastructure/modules/app/cognito.tf')
+        return if File.exist?(cognito_tf)
+
+        puts ''
+        puts '── Authentication ──'
+        print_warn('Cognito', 'routes use auth: :cognito but no cognito.tf found')
+        puts '         Run: belt generate auth'
+        @warnings << 'Routes use auth: :cognito but no Cognito pool is configured — run `belt generate auth`'
+      end
+
       def print_summary
         if @issues.empty? && @warnings.empty?
           puts '✓ All checks passed — you\'re ready to belt!'

data/lib/belt/cli/generate_command.rb

@@ -15,7 +15,8 @@ module Belt
   module CLI
     class GenerateCommand
       TEMPLATE_DIR = File.expand_path('../../templates/generate', __dir__)
-      GENERATORS = %w[scaffold resource model controller environment frontend views auth].freeze
+
+      GENERATORS = %w[scaffold resource model controller environment frontend views index auth].freeze
 
       include AppDetection
 
@@ -127,6 +128,8 @@ module Belt
 
         return Belt::CLI::ViewsCommand.run(args) if generator == 'views'
 
+        return Belt::CLI::IndexCommand.run(['add'] + args) if generator == 'index'
+
         return Belt::CLI::AuthCommand.run(args) if generator == 'auth'
 
         name = args.shift
@@ -290,7 +293,9 @@ module Belt
         when 'model'
           check_model_collision! unless @force
           generate_model_standalone
-        when 'controller' then generate_controller
+        when 'controller'
+          generate_controller
+          inject_routes
         end
       end
 
@@ -351,18 +356,6 @@ module Belt
         inject_parent_associations
         sync_tables
         generate_views_if_frontend
-        puts "\n✓ Scaffold '#{@singular_name}' generated!"
-        puts "\nFiles created/updated:"
-        puts "  lambda/models/#{@singular_name}.rb"
-        puts "  lambda/controllers/#{@app_name}/#{@resource_name}_controller.rb"
-        puts "  #{find_routes_file_path || 'config/routes.rb'} (updated)"
-        puts "  #{find_contracts_file_path || 'config/contracts.rb'} (updated)"
-        puts "  lambda/lib/routes/#{@app_name}_routes.rb (updated)"
-        puts "  frontend/src/pages/#{@resource_name}/ (views)" if Dir.exist?('frontend/src')
-        @references.each do |ref|
-          parent_model_path = "lambda/models/#{ref[:referenced_model]}.rb"
-          puts "  #{parent_model_path} (updated — added has_many)" if File.exist?(parent_model_path)
-        end
       end
 
       def generate_model_standalone
@@ -386,25 +379,26 @@ module Belt
 
       def inject_routes
         routes_file = find_routes_file_path
-        return unless routes_file && File.exist?(routes_file)
 
-        content = File.read(routes_file)
-        tables_arg = @fields.any? ? ", tables: [:#{@resource_name}]" : ''
+        if routes_file && File.exist?(routes_file)
+          content = File.read(routes_file)
+          tables_arg = @fields.any? ? ", tables: [:#{@resource_name}]" : ''
 
-        # If this resource has a reference to a parent that already has routes, nest it
-        parent_ref = @references.find do |ref|
-          parent_resource = Belt::Inflector.pluralize(ref[:referenced_model])
-          content.match?(/resources :#{Regexp.escape(parent_resource)}\b/)
-        end
+          # If this resource has a reference to a parent that already has routes, nest it
+          parent_ref = @references.find do |ref|
+            parent_resource = Belt::Inflector.pluralize(ref[:referenced_model])
+            content.match?(/resources :#{Regexp.escape(parent_resource)}\b/)
+          end
 
-        if parent_ref
-          inject_nested_route(content, routes_file, parent_ref, tables_arg)
+          if parent_ref
+            inject_nested_route(content, routes_file, parent_ref, tables_arg)
+          else
+            inject_top_level_route(content, routes_file, tables_arg)
+          end
         else
-          inject_top_level_route(content, routes_file, tables_arg)
+          # Legacy projects without config/routes.rb — update the manifest directly
+          inject_route_manifest
         end
-
-        # Also update route manifest
-        inject_route_manifest
       end
 
       def inject_nested_route(content, routes_file, parent_ref, tables_arg)
@@ -596,8 +590,7 @@ module Belt
           next unless File.exist?(parent_model_path)
 
           content = File.read(parent_model_path)
-          has_many_line = "  has_many :#{@resource_name}, foreign_key: '#{ref[:referenced_model]}_id', " \
-                          "index: '#{Belt::Inflector.classify(ref[:referenced_model])}Index'"
+          has_many_line = "  has_many :#{@resource_name}"
 
           next if content.include?("has_many :#{@resource_name}")
 
@@ -632,7 +625,7 @@ module Belt
         return unless Dir.exist?('frontend/src')
         return if @skip_views
 
-        Belt::CLI::ViewsCommand.new(@name, @fields, force: @force).generate
+        Belt::CLI::ViewsCommand.new(@name, @fields, force: @force, quiet: true).generate
       end
     end
   end

data/lib/belt/cli/index_command.rb

@@ -0,0 +1,192 @@
+# frozen_string_literal: true
+
+require_relative 'tables_command'
+require_relative '../inflector'
+
+module Belt
+  module CLI
+    class IndexCommand
+      MODULE_DIR = 'infrastructure/modules/app'
+      DYNAMODB_TF = File.join(MODULE_DIR, 'dynamodb.tf')
+
+      def self.run(args)
+        action = args.shift
+
+        case action
+        when 'add', nil
+          add(args)
+        when 'remove', 'rm'
+          remove(args)
+        when '--help', '-h'
+          puts usage
+        else
+          # Treat first arg as table name if no subcommand
+          add([action] + args)
+        end
+      end
+
+      def self.usage
+        <<~USAGE
+          Usage: belt generate index <table> <IndexName> --partition-key <key> [--sort-key <key>]
+                 belt destroy index <table> <IndexName>
+
+          Add or remove a Global Secondary Index (GSI) from dynamodb.tf.
+
+          Examples:
+            belt generate index messages ConversationIndex --partition-key conversation_id
+            belt generate index messages RecentByUserIndex --partition-key user_id --sort-key created_at
+            belt destroy index messages ConversationIndex
+
+          Note: After modifying indexes, run `belt deploy` to apply changes to AWS.
+                Adding a GSI to an existing table takes ~5-10 minutes (AWS limitation).
+        USAGE
+      end
+
+      def self.add(args)
+        table, index_name, partition_key, sort_key = parse_add_args(args)
+        new(table, index_name, partition_key: partition_key, sort_key: sort_key).add
+      end
+
+      def self.remove(args)
+        table = args.shift
+        index_name = args.shift
+
+        if table.nil? || index_name.nil?
+          abort "Usage: belt destroy index <table> <IndexName>\n\n" \
+                'Example: belt destroy index messages ConversationIndex'
+        end
+
+        new(table, index_name).remove
+      end
+
+      def self.parse_add_args(args)
+        table = args.shift
+        index_name = args.shift
+        partition_key = nil
+        sort_key = nil
+
+        i = 0
+        while i < args.length
+          case args[i]
+          when '--partition-key', '-p'
+            i += 1
+            partition_key = args[i]
+          when '--sort-key', '-s'
+            i += 1
+            sort_key = args[i]
+          end
+          i += 1
+        end
+
+        if table.nil? || index_name.nil? || partition_key.nil?
+          abort "Usage: belt generate index <table> <IndexName> --partition-key <key> [--sort-key <key>]\n\n" \
+                'Example: belt generate index messages ConversationIndex --partition-key conversation_id'
+        end
+
+        [table, index_name, partition_key, sort_key]
+      end
+
+      def initialize(table, index_name, partition_key: nil, sort_key: nil)
+        @table = table
+        @index_name = index_name
+        @partition_key = partition_key
+        @sort_key = sort_key
+      end
+
+      def add
+        validate_tf_exists!
+
+        content = File.read(DYNAMODB_TF)
+        table_resource = "aws_dynamodb_table\" \"#{@table}\""
+
+        unless content.include?(table_resource)
+          abort "Error: Table '#{@table}' not found in #{DYNAMODB_TF}.\n" \
+                'Run `belt setup tables` first to generate the table.'
+        end
+
+        if content.include?("name            = \"#{@index_name}\"")
+          puts "  skip    #{@index_name} (already exists on #{@table})"
+          return
+        end
+
+        dynamo_pk = Belt::Inflector.camelize_lower(@partition_key)
+        dynamo_sk = @sort_key ? Belt::Inflector.camelize_lower(@sort_key) : nil
+
+        # Build the GSI block
+        gsi_block = build_gsi_block(dynamo_pk, dynamo_sk)
+
+        # Build attribute blocks for new keys
+        attr_blocks = build_attribute_blocks(content, dynamo_pk, dynamo_sk)
+
+        # Insert into the table resource
+        insert_gsi(content, gsi_block, attr_blocks)
+
+        puts "  create  #{@index_name} on #{@table} (partition: #{dynamo_pk}#{", sort: #{dynamo_sk}" if dynamo_sk})"
+        puts "\n  Run `belt deploy` to apply. Adding a GSI to an existing table takes ~5-10 min."
+      end
+
+      def remove
+        validate_tf_exists!
+
+        content = File.read(DYNAMODB_TF)
+
+        unless content.include?("name            = \"#{@index_name}\"")
+          abort "Error: Index '#{@index_name}' not found in #{DYNAMODB_TF}."
+        end
+
+        # Remove the GSI block
+        content.sub!(/\n\s*global_secondary_index \{\n\s*name\s*=\s*"#{Regexp.escape(@index_name)}".*?\n\s*\}/m, '')
+
+        File.write(DYNAMODB_TF, content)
+        puts "  remove  #{@index_name} from #{@table}"
+        puts "\n  Run `belt deploy` to apply."
+      end
+
+      private
+
+      def validate_tf_exists!
+        return if File.exist?(DYNAMODB_TF)
+
+        abort "Error: #{DYNAMODB_TF} not found.\nRun `belt setup tables` first."
+      end
+
+      def build_gsi_block(dynamo_pk, dynamo_sk)
+        lines = []
+        lines << '  global_secondary_index {'
+        lines << "    name            = \"#{@index_name}\""
+        lines << "    hash_key        = \"#{dynamo_pk}\""
+        lines << "    range_key       = \"#{dynamo_sk}\"" if dynamo_sk
+        lines << '    projection_type = "ALL"'
+        lines << '  }'
+        lines.join("\n")
+      end
+
+      def build_attribute_blocks(content, dynamo_pk, dynamo_sk)
+        blocks = []
+        [dynamo_pk, dynamo_sk].compact.each do |key|
+          next if content.include?("name = \"#{key}\"")
+
+          blocks << "\n  attribute {\n    name = \"#{key}\"\n    type = \"S\"\n  }"
+        end
+        blocks.join
+      end
+
+      def insert_gsi(content, gsi_block, attr_blocks)
+        # Find the table's resource block and insert before point_in_time_recovery
+        table_pattern = /resource "aws_dynamodb_table" "#{Regexp.escape(@table)}" \{.*?point_in_time_recovery/m
+
+        content.sub!(table_pattern) do |match|
+          # Insert attributes after last existing attribute block
+          unless attr_blocks.empty?
+            match.sub!(/(  attribute \{.*?\n  \})(?!.*attribute)/m) { |attr_match| "#{attr_match}#{attr_blocks}" }
+          end
+
+          # Insert GSI before point_in_time_recovery
+          match.sub('point_in_time_recovery', "#{gsi_block}\n\n  point_in_time_recovery")
+        end
+
+        File.write(DYNAMODB_TF, content)
+      end
+    end
+  end
+end

data/lib/belt/cli/lambda_config_command.rb

@@ -34,7 +34,7 @@ module Belt
       SUPPORTED_KEYS = %w[
         timeout memory_size env_vars env_keys
         s3_buckets dynamodb_tables sns_triggers sqs_triggers
-        reserved_concurrency ephemeral_storage
+        reserved_concurrency ephemeral_storage iam_policy_arns
       ].freeze
 
       def self.run(args)
@@ -112,6 +112,7 @@ module Belt
             sqs_triggers         SQS queue triggers
             reserved_concurrency Reserved concurrency limit
             ephemeral_storage    Ephemeral storage in MB (512-10240)
+            iam_policy_arns      Additional IAM policy ARNs (supports ref())
         HELP
       end
 

data/lib/belt/cli/routes_command/route_inference.rb

@@ -14,9 +14,10 @@ module Belt
           non_param = segments.reject { |s| s.start_with?(':', '{') }
           return gateway.name if non_param.empty?
 
-          # Nested resources (/posts/{id}/comments) and scoped resources (/admin/users):
-          # join non-param segments → posts/comments, admin/users
-          return non_param.map { |s| s.gsub('-', '_') }.join('/') if route.resource? && non_param.length > 1
+          # Nested resources (/posts/{id}/comments): use the last non-param segment
+          # as the controller name (matches Rails — nesting affects URL, not controller lookup).
+          # Scoped resources (/admin/users) still use the full path when controller is explicitly set.
+          return non_param.last.gsub('-', '_') if route.resource? && non_param.length > 1
 
           # For non-resource routes with a single segment (e.g., post '/signup' in :onboarding),
           # the segment is the action name, not the controller. Use the gateway name as controller.

data/lib/belt/cli/routes_command.rb

@@ -250,18 +250,8 @@ module Belt
       def output_concise(routes)
         return puts('No routes defined.') if routes.empty?
 
-        multi_gateway = routes.map { |r| r[:gateway] }.uniq.length > 1
         verb_w = [routes.map { |r| r[:verb].length }.max, 6].max
         path_w = [routes.map { |r| r[:path].length }.max, 4].max
-
-        if multi_gateway
-          output_concise_multi_gateway(routes, verb_w, path_w)
-        else
-          output_concise_single_gateway(routes, verb_w, path_w)
-        end
-      end
-
-      def output_concise_multi_gateway(routes, verb_w, path_w)
         gw_w = [routes.map { |r| r[:gateway].to_s.length }.max, 7].max
         lam_w = [routes.map { |r| r[:lambda].length }.max, 6].max
 
@@ -278,15 +268,6 @@ module Belt
         end
       end
 
-      def output_concise_single_gateway(routes, verb_w, path_w)
-        puts "#{'VERB'.ljust(verb_w)}  #{'PATH'.ljust(path_w)}  CONTROLLER#ACTION"
-        puts '-' * (verb_w + path_w + 30)
-
-        routes.each do |r|
-          puts "#{r[:verb].ljust(verb_w)}  #{r[:path].ljust(path_w)}  #{r[:controller]}##{r[:action]}"
-        end
-      end
-
       def route_specificity(path, verb)
         segments = path.split('/').reject(&:empty?)
         param_count = segments.count { |s| s.start_with?('{') }

data/lib/belt/cli/views_command.rb

@@ -75,10 +75,11 @@ module Belt
         end
       end
 
-      def initialize(name, fields, force: false)
+      def initialize(name, fields, force: false, quiet: false)
         @name = name.downcase.gsub(/[^a-z0-9_]/, '_')
         @fields = fields
         @force = force
+        @quiet = quiet
         @overwrite_all = false
         @singular_name = Belt::Inflector.singularize(@name)
         @resource_name = Belt::Inflector.pluralize(@singular_name)
@@ -103,14 +104,7 @@ module Belt
 
         inject_routes
 
-        puts "\n✓ Views for '#{@singular_name}' generated!"
-        puts "\nFiles created:"
-        puts "  #{pages_dir}/#{@plural_class_name}Index.jsx"
-        puts "  #{pages_dir}/#{@class_name}Show.jsx"
-        puts "  #{pages_dir}/#{@class_name}New.jsx"
-        puts "  #{pages_dir}/#{@class_name}Edit.jsx"
-        puts "  #{pages_dir}/#{@class_name}Form.jsx"
-        puts '  frontend/src/App.jsx (updated)'
+        puts "\n✓ Views for '#{@singular_name}' generated!" unless @quiet
       end
 
       private

data/lib/belt/cli.rb

@@ -6,6 +6,7 @@ require_relative 'cli/env_resolver'
 require_relative 'cli/new_command'
 require_relative 'cli/generate_command'
 require_relative 'cli/destroy_command'
+require_relative 'cli/index_command'
 require_relative 'cli/frontend_command'
 require_relative 'cli/frontend_setup_command'
 require_relative 'cli/frontend_deploy_command'

data/lib/belt/inflector.rb

@@ -42,6 +42,14 @@ module Belt
       word.to_s.split('_').map(&:capitalize).join
     end
 
+    # "conversation_id" → "conversationId"
+    def camelize_lower(word)
+      parts = word.to_s.split('_')
+      return word if parts.empty?
+
+      parts.first + parts[1..].map(&:capitalize).join
+    end
+
     # "BlogPost" → "blog_post"
     def underscore(word)
       word.to_s

data/lib/belt/route_dsl.rb

@@ -65,8 +65,9 @@ module Belt
       resource_name = name.to_s
       singular = @gateway.send(:singularize, resource_name)
       param_name = options[:param] || "#{singular}_id"
+      # Auto-add this resource's table before merging inherited tables
+      options = options.merge(tables: [resource_name.to_sym]) unless options.key?(:tables)
       options = merge_inherited_options(options)
-      options = @gateway.send(:auto_infer_tables, resource_name, options)
       resource_options = options.merge(route_type: :resources)
       actions = @gateway.send(:determine_actions, options)
 

data/lib/belt/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Belt
-  VERSION = '0.2.19'
+  VERSION = '0.2.20'
 end

data/lib/templates/generate/auth/frontend/ConfirmEmail.jsx

@@ -1,5 +1,5 @@
 import { useState } from 'react'
-import { confirmSignUp } from '../lib/auth'
+import { confirmSignUp } from '../../lib/auth'
 
 export default function ConfirmEmail() {
   const params = new URLSearchParams(window.location.search)

data/lib/templates/generate/auth/frontend/Login.jsx

@@ -1,5 +1,6 @@
 import { useState } from 'react'
-import { signIn, completeNewPassword } from '../lib/auth'
+import { signIn, completeNewPassword } from '../../lib/auth'
+import './auth.css'
 
 export default function Login({ onLogin }) {
   const [email, setEmail] = useState('')
@@ -72,9 +73,6 @@ export default function Login({ onLogin }) {
         <button type="submit" disabled={loading}>
           {loading ? 'Signing in...' : 'Sign In'}
         </button>
-        <p className="auth-link">
-          Don't have an account? <a href="/signup">Sign up</a>
-        </p>
       </form>
     </div>
   )

data/lib/templates/generate/auth/frontend/SignUp.jsx

@@ -1,5 +1,5 @@
 import { useState } from 'react'
-import { signUp } from '../lib/auth'
+import { signUp } from '../../lib/auth'
 
 export default function SignUp() {
   const [email, setEmail] = useState('')

data/lib/templates/generate/auth/frontend/auth.css

@@ -0,0 +1,157 @@
+.auth-page {
+  --auth-bg: #f6f8fa;
+  --auth-card-bg: #ffffff;
+  --auth-border: #d0d7de;
+  --auth-text: #1f2328;
+  --auth-muted: #656d76;
+  --auth-input-bg: #f6f8fa;
+  --auth-btn: #2da44e;
+  --auth-btn-hover: #2c974b;
+  --auth-btn-disabled-bg: #94d3a2;
+  --auth-btn-disabled-text: #fff;
+  --auth-error-bg: rgba(248, 81, 73, 0.08);
+  --auth-error-border: rgba(248, 81, 73, 0.4);
+  --auth-error-text: #cf222e;
+  --auth-link: #0969da;
+  --auth-focus: #0969da;
+}
+
+@media (prefers-color-scheme: dark) {
+  .auth-page {
+    --auth-bg: #0d1117;
+    --auth-card-bg: #161b22;
+    --auth-border: #30363d;
+    --auth-text: #e6edf3;
+    --auth-muted: #8b949e;
+    --auth-input-bg: #0d1117;
+    --auth-btn: #238636;
+    --auth-btn-hover: #2ea043;
+    --auth-btn-disabled-bg: #21262d;
+    --auth-btn-disabled-text: #484f58;
+    --auth-error-bg: rgba(248, 81, 73, 0.1);
+    --auth-error-border: rgba(248, 81, 73, 0.4);
+    --auth-error-text: #f85149;
+    --auth-link: #58a6ff;
+    --auth-focus: #58a6ff;
+  }
+}
+
+.auth-page {
+  min-height: 100vh;
+  display: flex;
+  align-items: center;
+  justify-content: center;
+  background: var(--auth-bg);
+  padding: 1rem;
+}
+
+.auth-form {
+  background: var(--auth-card-bg);
+  border: 1px solid var(--auth-border);
+  border-radius: 12px;
+  padding: 2.5rem;
+  width: 100%;
+  max-width: 380px;
+  box-shadow: 0 4px 16px rgba(0, 0, 0, 0.1);
+}
+
+.auth-form h2 {
+  color: var(--auth-text);
+  font-size: 1.5rem;
+  margin: 0 0 0.5rem;
+  text-align: center;
+}
+
+.auth-form p {
+  color: var(--auth-muted);
+  font-size: 0.85rem;
+  text-align: center;
+  margin: 0 0 1.5rem;
+}
+
+.auth-form input {
+  display: block;
+  width: 100%;
+  padding: 0.75rem 1rem;
+  margin-bottom: 0.75rem;
+  background: var(--auth-input-bg);
+  border: 1px solid var(--auth-border);
+  border-radius: 8px;
+  color: var(--auth-text);
+  font-size: 0.9rem;
+  outline: none;
+  transition: border-color 0.2s;
+  box-sizing: border-box;
+}
+
+.auth-form input:focus {
+  border-color: var(--auth-focus);
+}
+
+.auth-form input::placeholder {
+  color: var(--auth-muted);
+}
+
+.auth-form button {
+  display: block;
+  width: 100%;
+  padding: 0.75rem;
+  margin-top: 0.5rem;
+  background: var(--auth-btn);
+  border: none;
+  border-radius: 8px;
+  color: #fff;
+  font-size: 0.9rem;
+  font-weight: 600;
+  cursor: pointer;
+  transition: background 0.2s;
+}
+
+.auth-form button:hover {
+  background: var(--auth-btn-hover);
+}
+
+.auth-form button:disabled {
+  background: var(--auth-btn-disabled-bg);
+  color: var(--auth-btn-disabled-text);
+  cursor: not-allowed;
+}
+
+.auth-error {
+  background: var(--auth-error-bg);
+  border: 1px solid var(--auth-error-border);
+  border-radius: 8px;
+  color: var(--auth-error-text);
+  padding: 0.6rem 0.75rem;
+  font-size: 0.8rem;
+  margin-bottom: 1rem;
+  text-align: center;
+}
+
+.auth-link {
+  color: var(--auth-muted);
+  font-size: 0.8rem;
+  text-align: center;
+  margin-top: 1.25rem !important;
+}
+
+.auth-link a {
+  color: var(--auth-link);
+  text-decoration: none;
+}
+
+.auth-link a:hover {
+  text-decoration: underline;
+}
+
+.auth-btn {
+  display: inline-block;
+  padding: 0.6rem 1.5rem;
+  background: var(--auth-btn);
+  border-radius: 8px;
+  color: #fff;
+  text-decoration: none;
+  font-weight: 600;
+  font-size: 0.85rem;
+  margin-top: 1rem;
+}

data/lib/templates/generate/model.rb.erb

@@ -4,13 +4,11 @@ class <%= @class_name %> < ApplicationRecord
 <% @references.each do |ref| -%>
   belongs_to :<%= ref[:referenced_model] %>
 <% end -%>
-<% if @references.any? && (@regular_fields.any? || @references.any?) -%>
+<% if @references.any? && @regular_fields.any? -%>
 
 <% end -%>
-<% @references.each do |ref| -%>
-  attr_accessor :<%= ref[:referenced_model] %>_id
-<% end -%>
-<% @regular_fields.each do |field| -%>
-  attr_accessor :<%= field[:name] %>
+<% all_accessors = @regular_fields.map { |f| ":#{f[:name]}" } -%>
+<% if all_accessors.any? -%>
+  attr_accessor <%= all_accessors.join(', ') %>
 <% end -%>
 end

data/lib/templates/new_app/config/lambda/api.yml.erb

@@ -5,6 +5,7 @@
 #   timeout           Lambda timeout in seconds (default: 30)
 #   memory_size       Lambda memory in MB (default: 256)
 #   env_vars          Environment variables (static values or ref() for Terraform values)
+#   iam_policy_arns   Additional IAM policy ARNs to attach (supports ref())
 #   dynamodb_tables   DynamoDB table access (by name — ARNs built by convention)
 #   s3_buckets        S3 bucket access declarations
 #   sns_triggers      SNS topic triggers

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: belt
 version: !ruby/object:Gem::Version
-  version: 0.2.19
+  version: 0.2.20
 platform: ruby
 authors:
 - Stowzilla
@@ -43,6 +43,20 @@ dependencies:
     - - ">="
       - !ruby/object:Gem::Version
         version: '7.0'
+- !ruby/object:Gem::Dependency
+  name: irb
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '1.0'
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '1.0'
 - !ruby/object:Gem::Dependency
   name: lambda_loadout
   requirement: !ruby/object:Gem::Requirement
@@ -57,6 +71,20 @@ dependencies:
     - - "~>"
       - !ruby/object:Gem::Version
         version: '0.0'
+- !ruby/object:Gem::Dependency
+  name: rdoc
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '6.0'
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '6.0'
 description: Belt provides a collection of lightweight utilities for Ruby applications.
 email:
 - andy@stowzilla.com
@@ -95,6 +123,7 @@ files:
 - lib/belt/cli/frontend_setup_command.rb
 - lib/belt/cli/generate_command.rb
 - lib/belt/cli/generator_registry.rb
+- lib/belt/cli/index_command.rb
 - lib/belt/cli/lambda_config_command.rb
 - lib/belt/cli/logs_command.rb
 - lib/belt/cli/new_command.rb
@@ -149,6 +178,7 @@ files:
 - lib/templates/generate/auth/frontend/ProtectedRoute.jsx
 - lib/templates/generate/auth/frontend/SignUp.jsx
 - lib/templates/generate/auth/frontend/apiClient.js
+- lib/templates/generate/auth/frontend/auth.css
 - lib/templates/generate/auth/frontend/auth.js
 - lib/templates/generate/controller.rb.erb
 - lib/templates/generate/model.rb.erb