@cloudgrid-io/mcp 0.13.0 → 0.14.0

package/src/corpus/templates/billing-dashboard/AGENTS.md

@@ -0,0 +1,199 @@
+# AGENTS.md — billing-dashboard (blueprint)
+
+This is a **blueprint**, not runnable app code. It tells an agent exactly how to
+build a working SaaS billing dashboard on CloudGrid: a Next.js app that shows
+customers, invoices, and charges, meters usage, renders a revenue view, and wires
+**Stripe** for real payments (checkout + a signature-verified webhook). Data lives
+in the grid-shared Mongo. Read this whole file, then write the files under
+`services/web/` following the tree and wiring rules below.
+
+The proven shape to imitate is `app-with-data` (Next.js App Router + `mongodb`
+driver, lazy DB getter, app under `services/web/`). This blueprint adds the
+billing collections, a Stripe client, checkout + webhook + usage-sync routes, and
+a revenue dashboard view.
+
+## 1. File tree
+
+App code MUST live under `services/web/` — `path: /` in `cloudgrid.yaml` is the
+URL mount, NOT the filesystem path. A service named `web` means the CLI looks for
+`services/web/`; files at the project root fail with
+`Error: Service directory not found: …/services/web`.
+
+```
+cloudgrid.yaml                                  # name + services.web (nextjs) + needs:{database:true} + vault:{STRIPE_KEY}
+services/web/package.json                       # next, react, react-dom, mongodb, stripe
+services/web/lib/db.js                           # lazy Mongo client from DATABASE_MONGODB_URL (legacy MONGODB_URL fallback)
+services/web/lib/stripe.js                       # lazy Stripe client from process.env.STRIPE_KEY (injected by the vault: block)
+services/web/lib/money.js                        # money helpers (all amounts are integer cents; format for display only)
+services/web/app/layout.js                       # root layout + inline CSS (dashboard chrome / nav)
+services/web/app/page.js                         # revenue overview: MRR, outstanding, recent invoices (server component)
+services/web/app/customers/page.js               # customers list (server component, reads the customers collection)
+services/web/app/customers/[id]/page.js          # customer detail: their invoices, charges, usage
+services/web/app/invoices/page.js                # invoices list + status filter
+services/web/app/invoices/invoice-actions.js     # "use client": create invoice, send/collect via Stripe Checkout
+services/web/app/api/customers/route.js          # GET (list) / POST (create) — mirror to a Stripe Customer
+services/web/app/api/invoices/route.js           # GET (list) / POST (create draft invoice with line items)
+services/web/app/api/checkout/route.js           # POST: create a Stripe Checkout Session to collect an invoice
+services/web/app/api/usage/route.js              # POST: record a metered-usage event for a customer/meter
+services/web/app/api/webhook/route.js            # POST: Stripe webhook — verify signature, mark invoices paid, record charges
+```
+
+## 2. Mongo collections + fields
+
+The grid provisions one Mongo database (`needs: { database: true }`). Store **all
+money as integer cents** — never floats. Suggested collections:
+
+**`customers`**
+- `_id`               — ObjectId
+- `name`              — string
+- `email`             — string (unique per org)
+- `stripeCustomerId`  — string (the `cus_…` id from Stripe; link, don't duplicate)
+- `plan`              — string (e.g. `"free"`, `"pro"`, `"enterprise"`) — optional
+- `createdAt`         — Date
+
+**`invoices`**
+- `_id`               — ObjectId
+- `customerId`        — ObjectId ref → `customers`
+- `number`            — string (human invoice number, e.g. `"INV-1042"`)
+- `lineItems`         — array of `{ description, quantity, unitAmountCents }`
+- `amountDueCents`    — integer (sum of line items; authoritative on the server)
+- `currency`          — string, e.g. `"usd"`
+- `status`            — string: `"draft"` → `"open"` → `"paid"` / `"void"` (set to
+                        `paid` ONLY by the webhook)
+- `stripeSessionId`   — string (Checkout Session id used to collect it; idempotency key)
+- `dueDate`           — Date
+- `createdAt`         — Date
+
+**`charges`**
+- `_id`               — ObjectId
+- `customerId`        — ObjectId ref → `customers`
+- `invoiceId`         — ObjectId ref → `invoices` (nullable for one-off charges)
+- `amountCents`       — integer (authoritative total from the verified Stripe event)
+- `currency`          — string
+- `stripePaymentId`   — string (`pi_…` / `ch_…`; unique — idempotency)
+- `status`            — string: `"succeeded"` / `"refunded"`
+- `createdAt`         — Date
+
+**`usage_events`** (metering → revenue)
+- `_id`               — ObjectId
+- `customerId`        — ObjectId ref → `customers`
+- `meter`             — string (e.g. `"api_calls"`, `"seats"`, `"gb_egress"`)
+- `quantity`          — number
+- `ts`                — Date (event time; aggregate per billing period)
+
+Derive the revenue view by aggregating: **MRR / period revenue** from `charges`
+with `status: "succeeded"`, **outstanding** from `invoices` with `status: "open"`,
+and **usage** rolled up from `usage_events` per `customerId` + `meter` for the
+current period. Never trust amounts sent by the browser — the checkout route
+builds line items from the server-side `invoices` doc, and the webhook records the
+total from the verified Stripe event.
+
+## 3. How CloudGrid injects things (do NOT hardcode any of this)
+
+- **Mongo:** declare `needs: { database: true }`. The platform provisions Mongo
+  and injects the connection string as **`DATABASE_MONGODB_URL`** (plus the legacy
+  **`MONGODB_URL`** alias) at dev-time (`grid dev`) and at runtime (after
+  `grid plug`). Read it as `process.env.DATABASE_MONGODB_URL || process.env.MONGODB_URL`
+  **lazily inside a getter**, never at module top level — a top-level read fails
+  `next build`, which imports the module for route analysis before the grid injects
+  the var. Never hardcode a connection string; never commit a secret.
+- **Stripe secret:** put it in the vault, not in code. The `vault:` block in
+  `cloudgrid.yaml` maps the vault item `stripe-live-key` to the env var
+  **`STRIPE_KEY`**. Set the vault item once with `grid secrets set stripe-live-key`
+  (paste the `sk_live_…` / `sk_test_…` key); the platform injects it as
+  `process.env.STRIPE_KEY`. Read it lazily in `services/web/lib/stripe.js`.
+- **Stripe webhook signing secret:** the `whsec_…` value Stripe gives you for the
+  webhook endpoint. Add it to the vault and map it in the `vault:` block, e.g.
+  `STRIPE_WEBHOOK_SECRET: stripe-webhook-secret`, then verify events with
+  `stripe.webhooks.constructEvent(rawBody, sig, process.env.STRIPE_WEBHOOK_SECRET)`.
+- **Public base URL:** Stripe Checkout needs absolute `success_url` / `cancel_url`.
+  Derive them from the incoming request (`new URL(request.url).origin`) rather than
+  hardcoding the live host, so it works in `grid dev` and after `grid plug`.
+- **Secrets via vault → env vars, non-secret config via env:** any provider key
+  (Stripe, an auth provider, an email sender) goes in the vault and is mapped in
+  `vault:`; non-secret flags (log level, default currency) can be plain
+  `services.web.env` entries or `grid env`.
+- **AI (only if you add it, e.g. an AI usage-forecast):** declare
+  `needs: { ai: true }` and the platform injects **`AI_GATEWAY_URL`**; call it via
+  `@cloudgrid-io/ai`. Not required for a billing dashboard.
+
+## 4. Wiring payments (Stripe) — and optional auth
+
+**Create-invoice + checkout (`app/api/invoices/route.js`, `app/api/checkout/route.js`):**
+1. Create a `draft` invoice server-side from `lineItems`; compute
+   `amountDueCents` as the sum of `quantity * unitAmountCents` — never trust a
+   total sent by the browser.
+2. To collect it, `POST /api/checkout` with the `invoiceId`. Load the invoice from
+   Mongo, build Stripe `line_items` with `price_data` from the stored line items
+   (`unit_amount: unitAmountCents`, `currency`).
+3. `stripe.checkout.sessions.create({ mode: "payment", customer: <stripeCustomerId>,
+   line_items, metadata: { invoiceId }, success_url: origin +
+   "/invoices?paid={CHECKOUT_SESSION_ID}", cancel_url: origin + "/invoices" })`.
+4. Save `stripeSessionId` on the invoice, set `status: "open"`, return
+   `{ url: session.url }`; the client redirects to it.
+
+**Webhook (`app/api/webhook/route.js`):**
+1. Read the **raw** body — in the App Router use `await request.text()`, do NOT
+   `request.json()`; signature verification needs the exact bytes.
+2. Verify with `stripe.webhooks.constructEvent(rawBody,
+   request.headers.get("stripe-signature"), process.env.STRIPE_WEBHOOK_SECRET)`.
+3. On `checkout.session.completed`: find the invoice by `metadata.invoiceId` (or
+   `stripeSessionId`), set `status: "paid"`, and insert a `charges` doc with the
+   authoritative `amountCents = event.data.object.amount_total` and the payment id
+   — upsert by `stripePaymentId` so retries are idempotent.
+4. On `charge.refunded`: mark the matching `charges` doc `refunded`.
+5. Return `200` fast; return `400` if verification fails. Register the endpoint URL
+   (`<live-url>/api/webhook`) in the Stripe dashboard and copy its `whsec_…` secret
+   into the vault.
+
+**Usage metering (`app/api/usage/route.js`):** `POST { customerId, meter, quantity }`
+inserts a `usage_events` doc. Aggregate per period for the revenue view (and, if you
+use Stripe metered prices, forward the quantity with
+`stripe.billing.meterEvents.create(...)`).
+
+**Optional auth (protect the dashboard / per-customer portal):** add a provider SDK
+(Clerk, Auth0, or NextAuth). Put its keys in the vault and map them in the `vault:`
+block, e.g. `AUTH_PROVIDER_KEY: clerk-secret-key` (plus any publishable key), read
+them from `process.env`, and gate the dashboard pages behind the provider's
+middleware. A billing dashboard is internal/admin, so add auth before exposing it
+publicly.
+
+## 5. Deploy steps
+
+1. `grid init` an app `<name>` (creates the entity + `.cloudgrid/link.json`, writes
+   a `cloudgrid.yaml` with empty `services: {}`). Run this FIRST — `plug` needs a
+   linked directory.
+2. Write the app under `services/web/` and set `cloudgrid.yaml` to the shape in this
+   template (name + `services.web` nextjs + `needs: { database: true }` + the
+   `vault: { STRIPE_KEY: stripe-live-key }` block).
+3. `grid secrets set stripe-live-key` (and `stripe-webhook-secret` once you map it)
+   so the vault items the `vault:` block references exist. Do NOT set
+   `DATABASE_MONGODB_URL` yourself — the grid injects it.
+4. (Optional) `grid dev` to run locally against the injected Mongo + your Stripe
+   test key before deploying.
+5. `grid plug` to build + deploy. A runtime deploy is **async**: `plug` returns
+   `status: building`. Poll `grid status` until the entity is live; surface a
+   liveness signal, never a bare silent wait. Only then return the live app URL.
+6. Register `<live-url>/api/webhook` in the Stripe dashboard, copy its `whsec_…`
+   into the vault, and re-`grid plug` the SAME entity (same URL) if you changed the
+   `vault:` mapping.
+
+## 6. Edition note
+
+This is a **runtime app** (a built + deployed container), so it needs the **local
+edition** (Claude Desktop / Claude Code) or the CloudGrid CLI. The hosted edition
+(Claude Web / hosted MCP) is inline-only and can publish only static pages — it
+cannot build this dashboard. If you are on hosted, offer a static revenue-view
+mockup instead and stop the runtime path.
+
+## 7. Self-check before you call it done
+
+- App code is under `services/web/`, not the root.
+- DB and Stripe clients are read LAZILY inside getters, never at module top level.
+- All money is stored as integer cents; the revenue view aggregates from `charges`
+  / `invoices` / `usage_events` server-side.
+- Invoice totals are computed server-side; the webhook records the Stripe total and
+  reads the RAW request body to verify the signature.
+- `cloudgrid.yaml` active fields are exactly: `name`, `services.web {type:nextjs,
+  path:/}`, `needs: { database: true }`, and the `vault:` block for `STRIPE_KEY`.
+- No secret or connection string is committed anywhere.

package/src/corpus/templates/billing-dashboard/README.md

@@ -0,0 +1,18 @@
+# billing-dashboard template — SaaS billing blueprint (Next.js + Mongo + Stripe)
+
+A **blueprint** for a real SaaS billing dashboard on CloudGrid: a Next.js app that
+tracks `customers`, `invoices`, `charges`, and `usage_events` in the grid-shared
+Mongo, meters usage, renders a revenue view (MRR / outstanding / recent invoices),
+and wires **Stripe** the CloudGrid-correct way — checkout to collect invoices and a
+signature-verified webhook that marks them paid and records charges. It is the same
+proven `services/web/` + lazy-Mongo shape as `app-with-data`, plus payments. It
+exists because "build a billing / invoicing dashboard" needs a database *and* a
+payment provider wired correctly (Mongo via `needs`, the Stripe key via the
+`vault:` block → `STRIPE_KEY`), and getting that wiring right is the hard part.
+
+**This is a blueprint: structure + `cloudgrid.yaml`, adapt and build — not finished
+app code.** Read `AGENTS.md` for the file tree, the Mongo collections/fields, how
+the grid injects Mongo (`DATABASE_MONGODB_URL`) and the Stripe secret (`vault:` →
+`STRIPE_KEY`), the checkout + webhook + usage wiring, and the deploy steps — then
+build the app under `services/web/`, adapting the collections and UI to the user's
+billing model.

package/src/corpus/templates/billing-dashboard/cloudgrid.yaml

@@ -0,0 +1,235 @@
+# ============================================================================
+# cloudgrid.yaml — Complete Example
+# ============================================================================
+#
+# This file shows EVERY field the platform supports, with comments explaining
+# each one. It is a reference — no real project would use all of these at once.
+#
+# STANDARD: every CloudGrid template ships its cloudgrid.yaml in THIS full form.
+# Uncomment ONLY the fields the archetype needs (always: name + services; plus
+# needs: for runtime apps). Leave everything else commented. Comments are
+# ignored by the parser, so the file deploys to exactly the active fields.
+#
+# Only two fields are required: name and services. Everything else is optional.
+# Full docs: docs/cloudgrid-yaml-reference.md
+# ============================================================================
+
+
+# ─── IDENTITY ───────────────────────────────────────────────────────────────
+
+# Entity slug (REQUIRED). 2-42 chars, lowercase alphanumeric + hyphens.
+# Must start and end with a letter or digit.
+# Becomes part of your public URL: <name>-<4hex>.<org>.cloudgrid.io
+name: billing-dashboard
+
+# One-line summary. Max 280 chars. If omitted, Grid Brain auto-generates one.
+# description: Order processing API for the e-commerce platform
+
+# Single emoji or short text shown as the entity icon. Max 64 chars.
+# icon: "📦"
+
+# Entity type: 'app' (default) or 'agent'. An agent is an app with an agent: block.
+# kind: app
+
+
+# ─── NETWORKING ─────────────────────────────────────────────────────────────
+
+# Whether this entity serves public HTTP traffic.
+# true = public URL + Ingress (default). false = internal only.
+# expose: true
+
+# Additional domain names this entity serves on (the platform URL is always active).
+# custom_domains:
+#   - orders.example.com
+#   - shop.example.com
+
+
+# ─── HEALTH PROBE (entity-level override) ──────────────────────────────────
+
+# Override the default health check for the entire entity.
+# probe:
+#   path: /healthz               # HTTP path to probe (default: /).
+#   expected: "<500"             # '<500' (default), '200', '2xx'.
+
+
+# ─── DEPLOY NOTIFICATIONS ──────────────────────────────────────────────────
+
+# Slack notification to the org's default channel on deploy failure.
+# true = notify (default), false = silent.
+# notify: true
+
+
+# ─── SCALING ────────────────────────────────────────────────────────────────
+
+# Replica scaling intent.
+#   'auto'  — platform decides from the grid tier (default).
+#   'alert' — single-replica, emit a SPOF warning at plug time.
+#   1-10    — explicit replica count, clamped to the grid max.
+# scale: auto
+
+
+# ─── INFRASTRUCTURE NEEDS ──────────────────────────────────────────────────
+#
+# Declare infrastructure; the platform provisions it and injects connection
+# details as env vars. Nine needs: database, cache, kv, queue, pubsub, vector,
+# object_storage, disk, ai. Simplest form is `true`.
+#
+# needs:
+#   # database — MongoDB. Injects DATABASE_MONGODB_URL (+ legacy MONGODB_URL).
+#   #   true | pool | dedicated | { tier: external, secret: MY_DB }
+#   database: true
+#   # cache — Redis, LRU eviction (derived data). Injects CACHE_REDIS_URL (+ REDIS_URL).
+#   #   true | redis | { engine: external, secret: MY_REDIS_URL }
+#   cache: true
+#   # kv — Redis, no eviction (durable: flags, idempotency). Injects KV_REDIS_URL.
+#   kv: true
+#   # queue — Redis job-queue substrate (BullMQ). Injects QUEUE_REDIS_URL.
+#   queue: true
+#   # pubsub — Redis broadcast pub/sub. Injects PUBSUB_REDIS_URL.
+#   pubsub: true
+#   # vector — pgvector on Postgres. Injects VECTOR_PGVECTOR_URL (+ PGVECTOR_URL).
+#   #   true | pgvector | { engine: pgvector, dim: 1536 }
+#   vector: pgvector
+#   # object_storage — GCS bucket. Injects OBJECT_STORAGE_GCS_BUCKET, _GCS_REGION.
+#   #   true | { size: 10Gi }
+#   object_storage: true
+#   # disk — persistent FS mount (PVC). Injects DISK_PATH. Pins to 1 replica.
+#   #   true | { size: 1Gi, mount: /var/data }  (forbidden: /proc /sys /dev)
+#   disk: true
+#   # ai — AI Gateway via @cloudgrid-io/ai. Injects AI_GATEWAY_URL. true | false.
+#   ai: true
+
+
+# ─── INTER-ENTITY COMMUNICATION ────────────────────────────────────────────
+
+# Entities this app calls (outbound). Service-account token injected per pair.
+# calls:
+#   - org:atomic/billing-api
+
+# Inbound caller policy — who can call YOUR entity.
+# callers:
+#   policy: auto                 # 'auto' | 'manual' (default).
+#   scope: org                   # 'org' (default) | 'space' | 'explicit'.
+#   fallback: deny               # 'deny' (default) | 'warn'.
+#   # allowed_apps:              # required only when scope: explicit
+#   #   - org:atomic/frontend
+
+
+# ─── VAULT ──────────────────────────────────────────────────────────────────
+
+# Map org vault items to env vars. Keys UPPER_SNAKE_CASE; values = vault item keys.
+# Stripe secret key for the checkout + webhook + invoice/usage-sync routes. Set
+# the vault item once (`grid secrets set stripe-live-key`); the platform injects
+# it as STRIPE_KEY. Add STRIPE_WEBHOOK_SECRET the same way to verify webhooks.
+vault:
+  STRIPE_KEY: stripe-live-key
+#   STRIPE_WEBHOOK_SECRET: stripe-webhook-secret
+
+
+# ─── CONNECTORS AND HOOKS ──────────────────────────────────────────────────
+
+# connectors:
+#   - id: team-slack
+#     target: org                # 'system' | 'org'.
+#     channel: "#deploys"
+# hooks:
+#   - on: deploy.failed          # release.published | deploy.failed | feedback.received | entity.created
+#     via: team-slack
+#     template: "Deploy failed for {entity_name}: {error}"
+#     channel: "#alerts"
+# triggers:
+#   - from: team-slack
+#     event: message
+#     channel: "#support"
+#     route: /webhooks/slack
+
+
+# ─── LOCAL DEVELOPMENT ──────────────────────────────────────────────────────
+
+# Config for `grid dev`. Redact fields in dev data snapshots.
+# dev:
+#   snapshot:
+#     mask:
+#       - users.email
+#       - users.phone
+
+
+# ─── AGENT METADATA ────────────────────────────────────────────────────────
+
+# An agent is an app with kind: agent (above) and an agent: block.
+# agent:
+#   purpose: Sync customer data from external CRM every night
+#   schedule: "0 2 * * *"
+#   trigger: webhook
+
+
+# ─── PRIVATE RESOURCE AUTO-DEPENDENCIES ────────────────────────────────────
+
+# When true (default), private resources are auto-injected as depends_on.
+# auto_depends_on_private_requires: true
+
+
+# ─── SERVICES (REQUIRED) ───────────────────────────────────────────────────
+#
+# At least one service is required. Key = service name (slug rules).
+# Types: node, nextjs, python, static, cron.
+#
+services:
+  web:
+    # type (REQUIRED): node | nextjs | python | static | cron
+    type: nextjs
+    # HTTP route: '/' | '/api' | false (internal) | omitted (=false + warning).
+    # Only one service per entity can claim '/'.
+    path: /
+    # Container port (default 8080; read process.env.PORT). Not for cron.
+    # port: 3000
+    # nextjs only: base_image: distroless (default) | alpine
+    # base_image: distroless
+    # node only: lang: javascript (default) | typescript
+    # lang: typescript
+    # Custom source location (default services/<name>/). '.' = project root.
+    # source:
+    #   path: src/worker
+    # Health probe: false/omitted (TCP) | true (/health) | "/path" | {path,expected}
+    # health:
+    #   path: /api/health
+    #   expected: "200"
+    # Static runtime env vars (strings). Reserved: PORT, APP_NAME, SERVICE_NAME,
+    # NODE_ENV, MONGODB_URL, REDIS_URL, AI_GATEWAY_URL, N8N_WEBHOOK_URL, CLOUDGRID_*.
+    # env:
+    #   LOG_LEVEL: info
+    # Sibling services/private resources that must be Ready first (no cron, no cycles).
+    # depends_on:
+    #   - worker
+    # Per-service needs override (merges with app-level needs).
+    # needs:
+    #   queue: true
+    # Static-only build step:
+    # build:
+    #   command: npm run build
+    #   output: dist
+    #   env:
+    #     VITE_API_URL: https://api.example.com
+    # node_version: "22"          # static build step: '18'|'20'|'22'|'24' (quoted)
+    # Cron-only: schedule (REQUIRED), timezone (UTC|EST|PST), run (job | https URL)
+    # schedule: "0 9 * * 1"
+    # timezone: UTC
+    # run: job
+    # Verbose per-service persistence (prefer needs.disk):
+    # persist:
+    #   - name: scratch
+    #     path: /tmp/scratch
+    #     size: 500Mi
+
+
+needs:
+  database: true
+
+
+# ============================================================================
+# NOTES
+# - NOT here: org:/entity_id: (→ .cloudgrid/link.json), secrets (→ grid secrets set),
+#   Dockerfile (platform generates from services.*.type).
+# - Deploy: grid plug   |   Local with grid resources: grid dev
+# - Full reference: docs/cloudgrid-yaml-reference.md  |  CLI: docs/cli-reference.md
+# ============================================================================

package/src/corpus/templates/billing-dashboard/index.md

@@ -0,0 +1,87 @@
+# Template: billing-dashboard (blueprint — Next.js + Mongo + Stripe)
+
+A **blueprint** for a real SaaS billing dashboard on CloudGrid: a Next.js app with
+`customers`, `invoices`, `charges`, and `usage_events` in the grid-shared Mongo,
+usage metering, a revenue view (MRR / outstanding / recent invoices), Stripe
+Checkout to collect invoices, and a signature-verified Stripe webhook. This is
+**structure + `cloudgrid.yaml`, not finished app code** — fetch `AGENTS.md` for the
+full build guide, then write the app under `services/web/` and adapt it to the
+user's billing model.
+
+**Key rules (same proven shape as `app-with-data`, plus payments):**
+
+1. **App code MUST live under `services/web/`, not the root.** `path: /` in
+   `cloudgrid.yaml` is the URL mount, NOT the filesystem path. Files at the root
+   fail with `Error: Service directory not found: …/services/web`.
+2. **Read the Mongo connection string LAZILY (inside a getter), never at module
+   top level.** The grid injects it as `DATABASE_MONGODB_URL` (legacy `MONGODB_URL`
+   alias) at dev-time and runtime; a top-level read fails `next build`. Never
+   hardcode it; never commit a secret.
+3. **Declare the datastore with `needs: { database: true }`** — the canonical
+   shape. `requires:` is the deprecated v1 alias; never set `needs:` and `requires:`
+   together (the validator rejects it).
+4. **The Stripe secret comes from the vault, not code.** The `vault:` block maps the
+   vault item `stripe-live-key` → env var `STRIPE_KEY`. Set it with
+   `grid secrets set stripe-live-key`; read `process.env.STRIPE_KEY` lazily.
+5. **Store money as integer cents and trust server-side amounts only.** Compute
+   invoice totals server-side; the webhook records the authoritative total from the
+   verified Stripe event and reads the RAW request body for signature verification.
+
+## File tree
+
+```
+cloudgrid.yaml                                  # name + services.web (nextjs) + needs:{database:true} + vault:{STRIPE_KEY}
+services/web/package.json                       # next, react, react-dom, mongodb, stripe
+services/web/lib/db.js                          # lazy Mongo client (DATABASE_MONGODB_URL / MONGODB_URL)
+services/web/lib/stripe.js                      # lazy Stripe client (process.env.STRIPE_KEY)
+services/web/lib/money.js                       # money helpers (integer cents)
+services/web/app/page.js                        # revenue overview (MRR / outstanding / recent invoices)
+services/web/app/customers/page.js              # customers list + [id] detail
+services/web/app/invoices/page.js               # invoices list + status filter
+services/web/app/api/customers/route.js         # GET/POST customers (mirror to Stripe Customer)
+services/web/app/api/invoices/route.js          # GET/POST invoices (draft with line items)
+services/web/app/api/checkout/route.js          # POST: Stripe Checkout Session to collect an invoice
+services/web/app/api/usage/route.js             # POST: record a metered-usage event
+services/web/app/api/webhook/route.js           # POST: verify signature, mark invoices paid, record charges
+```
+
+## cloudgrid.yaml
+
+```yaml
+# On disk this file is the full-annotated reference (templates/_cloudgrid.yaml.reference) with EVERY
+# field present as a comment; only the fields below are uncommented, so it
+# deploys to exactly these active fields.
+name: billing-dashboard
+vault:
+  STRIPE_KEY: stripe-live-key
+services:
+  web:
+    type: nextjs
+    path: /
+needs:
+  database: true
+```
+
+> **Capability:** `needs: { database: true }` → the deployer provisions Mongo and
+> injects `DATABASE_MONGODB_URL` (+ legacy `MONGODB_URL`). The `vault:` block maps
+> the org vault item `stripe-live-key` to `STRIPE_KEY` at runtime. See the
+> capability-map for the full injection table.
+
+## Mongo collections
+
+- **`customers`** — `name`, `email`, `stripeCustomerId` (`cus_…`), `plan`, `createdAt`.
+- **`invoices`** — `customerId`, `number`, `lineItems[]`, `amountDueCents` (integer
+  cents), `currency`, `status` (`draft` → `open` → `paid`/`void`, set to `paid` ONLY
+  by the webhook), `stripeSessionId`, `dueDate`, `createdAt`.
+- **`charges`** — `customerId`, `invoiceId`, `amountCents`, `currency`,
+  `stripePaymentId` (unique, idempotency), `status` (`succeeded`/`refunded`), `createdAt`.
+- **`usage_events`** — `customerId`, `meter`, `quantity`, `ts` (aggregate per period
+  for the revenue view).
+
+## Build it
+
+Fetch `gridctl_fetch("template", "billing-dashboard")` and read **`AGENTS.md`** — it
+has the checkout + webhook + usage wiring, the vault/secret setup, and the deploy
+steps (`grid init` → write under `services/web/` → `grid secrets set` → `grid plug`,
+async → poll to a live URL → register the webhook endpoint in Stripe). Adapt the
+collections, fields, and UI to the user's billing model.

package/src/corpus/templates/blog-cms/README.md

@@ -0,0 +1,94 @@
+# blog-cms template — persistent Next.js + Mongo blog / CMS
+
+A minimal but real, deployable blog / content site. Posts live in the
+grid-shared MongoDB, so they survive refresh and are shared across
+users/sessions — unlike a static page whose state is in memory only.
+
+It is the proven `app-with-data` shape adapted to a `posts` domain: a public
+post list, a single-post page, and an admin screen to create and delete posts.
+
+## Domain
+
+A `posts` collection with these fields:
+
+| field       | type      | notes                                   |
+|-------------|-----------|-----------------------------------------|
+| `title`     | string    | required                                |
+| `slug`      | string    | URL key; derived from title if blank    |
+| `body`      | string    | required; post content                  |
+| `tags`      | string[]  | optional                                |
+| `published` | boolean   | drafts (`false`) stay off the public list |
+| `createdAt` | Date      | set on create                           |
+
+Pages:
+
+- `/` — public list of **published** posts (server component).
+- `/posts/[slug]` — a single published post (server component).
+- `/admin` — create / delete posts, drafts included (server list + client form).
+
+## How the grid gives you a database
+
+You do **not** provision a database or set a connection string. In
+`cloudgrid.yaml` you declare `needs: { database: true }`, and the grid:
+
+- provisions shared Mongo for the app, and
+- injects the connection string as the **`DATABASE_MONGODB_URL`** environment
+  variable (plus the legacy `MONGODB_URL` alias) — at dev-time (`grid dev`) and
+  at runtime (after `grid plug`).
+
+The app reads it via `process.env.DATABASE_MONGODB_URL` (with a legacy
+`process.env.MONGODB_URL` fallback) in `services/web/lib/db.js` — **lazily,
+inside the `getDb` getter, never at module top level** (a top-level read fails
+`next build`, which imports the module for route analysis before the grid injects
+the var). Never hardcode a connection string; never commit a secret.
+
+> **Declare `needs: { database: true }` (the canonical shape).** The deployer
+> provisions Mongo and injects `DATABASE_MONGODB_URL` (plus the legacy
+> `MONGODB_URL` alias). `requires:` is the deprecated v1 alias — don't author new
+> yaml with it, and never set `needs:` and `requires:` together (the validator
+> rejects the combination).
+
+## Service layout
+
+App code lives under **`services/web/`**, not the template root. `path:` in
+`cloudgrid.yaml` is the URL mount, not the filesystem path — the service named
+`web` means the CLI looks for `services/web/`. Files at the root fail with
+`Error: Service directory not found: …/services/web`.
+
+## Run locally
+
+```bash
+npm install
+grid dev          # runs Next.js with DATABASE_MONGODB_URL injected against dev Mongo
+```
+
+## Deploy
+
+```bash
+grid plug         # builds + deploys the folder (async — poll status until live)
+```
+
+A runtime deploy is asynchronous: `plug` returns `status: building`; poll status
+until the app is live, then use the returned live URL. Re-plug the same entity
+to update the same URL.
+
+## File tree
+
+```
+cloudgrid.yaml                              # name + services.web (nextjs) + needs: { database: true }
+services/web/package.json                   # next, react, react-dom, mongodb driver only
+services/web/lib/db.js                      # lazy Mongo client from DATABASE_MONGODB_URL (legacy MONGODB_URL fallback)
+services/web/app/layout.js                  # root layout + inline CSS
+services/web/app/page.js                    # server component: public list of published posts
+services/web/app/posts/[slug]/page.js       # server component: single published post
+services/web/app/admin/page.js              # server component: admin list (drafts + published)
+services/web/app/admin/admin-editor.js      # client form: create/delete via the API
+services/web/app/api/posts/route.js         # GET (list) / POST (create) / DELETE (remove)
+```
+
+## Adapt it
+
+- Rename the `posts` collection (e.g. `articles`, `pages`, `entries`).
+- Change the document fields (add author, updatedAt, cover image).
+- Add an edit/PATCH route, categories, or pagination as the site grows.
+- Add `cache: true` to `needs:` only if you actually need Redis.