@cloudgrid-io/mcp 0.13.0 → 0.14.0

package/src/corpus/templates/blog-cms/services/web/app/admin/admin-editor.js

@@ -0,0 +1,133 @@
+"use client";
+
+// Client editor: renders the admin list and posts create/delete to /api/posts.
+import { useState } from "react";
+
+export default function AdminEditor({ initialPosts }) {
+  const [posts, setPosts] = useState(initialPosts);
+  const [title, setTitle] = useState("");
+  const [slug, setSlug] = useState("");
+  const [body, setBody] = useState("");
+  const [tags, setTags] = useState("");
+  const [published, setPublished] = useState(true);
+  const [busy, setBusy] = useState(false);
+  const [error, setError] = useState("");
+
+  async function create(e) {
+    e.preventDefault();
+    setError("");
+    if (!title.trim() || !body.trim()) {
+      setError("Title and body are required.");
+      return;
+    }
+    setBusy(true);
+    const res = await fetch("/api/posts", {
+      method: "POST",
+      headers: { "content-type": "application/json" },
+      body: JSON.stringify({
+        title: title.trim(),
+        slug: slug.trim(),
+        body: body.trim(),
+        tags: tags
+          .split(",")
+          .map((t) => t.trim())
+          .filter(Boolean),
+        published,
+      }),
+    });
+    if (res.ok) {
+      const post = await res.json();
+      setPosts((prev) => [post, ...prev]);
+      setTitle("");
+      setSlug("");
+      setBody("");
+      setTags("");
+      setPublished(true);
+    } else {
+      const err = await res.json().catch(() => ({}));
+      setError(err.error || "Failed to create post.");
+    }
+    setBusy(false);
+  }
+
+  async function remove(id) {
+    setBusy(true);
+    const res = await fetch(`/api/posts?id=${encodeURIComponent(id)}`, {
+      method: "DELETE",
+    });
+    if (res.ok) setPosts((prev) => prev.filter((p) => p.id !== id));
+    setBusy(false);
+  }
+
+  return (
+    <div>
+      <form onSubmit={create} className="admin">
+        <label>
+          Title
+          <input
+            value={title}
+            onChange={(e) => setTitle(e.target.value)}
+            placeholder="Post title"
+          />
+        </label>
+        <label>
+          Slug (optional — derived from title if blank)
+          <input
+            value={slug}
+            onChange={(e) => setSlug(e.target.value)}
+            placeholder="my-post"
+          />
+        </label>
+        <label>
+          Body
+          <textarea
+            value={body}
+            onChange={(e) => setBody(e.target.value)}
+            placeholder="Write your post…"
+          />
+        </label>
+        <label>
+          Tags (comma-separated)
+          <input
+            value={tags}
+            onChange={(e) => setTags(e.target.value)}
+            placeholder="news, updates"
+          />
+        </label>
+        <div className="checkbox">
+          <input
+            id="published"
+            type="checkbox"
+            checked={published}
+            onChange={(e) => setPublished(e.target.checked)}
+          />
+          <label htmlFor="published" style={{ display: "inline" }}>
+            Published
+          </label>
+        </div>
+        {error && <p className="draft">{error}</p>}
+        <div>
+          <button type="submit" disabled={busy}>
+            Create post
+          </button>
+        </div>
+      </form>
+
+      {posts.length === 0 && <p className="empty">No posts yet.</p>}
+      {posts.map((p) => (
+        <article key={p.id}>
+          <h2>
+            {p.title}
+            {!p.published && <span className="draft">draft</span>}
+          </h2>
+          <p className="meta">/{p.slug}</p>
+          <div className="row-actions">
+            <button type="button" onClick={() => remove(p.id)} disabled={busy}>
+              Delete
+            </button>
+          </div>
+        </article>
+      ))}
+    </div>
+  );
+}

package/src/corpus/templates/blog-cms/services/web/app/admin/page.js

@@ -0,0 +1,33 @@
+// Admin page: a server component reads ALL posts (drafts + published) from Mongo
+// and hands them to the client editor, which creates/deletes via the API route.
+import Link from "next/link";
+import { getDb } from "../../lib/db.js";
+import AdminEditor from "./admin-editor.js";
+
+export const dynamic = "force-dynamic";
+
+async function listAll() {
+  const db = await getDb();
+  const items = await db.collection("posts").find({}).sort({ createdAt: -1 }).toArray();
+  return items.map((p) => ({
+    id: p._id.toString(),
+    title: p.title,
+    slug: p.slug,
+    published: !!p.published,
+    tags: Array.isArray(p.tags) ? p.tags : [],
+  }));
+}
+
+export default async function AdminPage() {
+  const posts = await listAll();
+  return (
+    <main>
+      <h1>Admin</h1>
+      <p className="hint">Create and delete posts. Drafts stay off the public list.</p>
+      <nav>
+        <Link href="/">← View blog</Link>
+      </nav>
+      <AdminEditor initialPosts={posts} />
+    </main>
+  );
+}

package/src/corpus/templates/blog-cms/services/web/app/api/posts/route.js

@@ -0,0 +1,84 @@
+// App Router route handler for the `posts` collection.
+// GET  -> list posts, POST -> create a post, DELETE -> remove a post by id.
+//
+// To adapt this app, rename the collection and change the fields to match your
+// own data (e.g. an `articles` or `pages` collection).
+import { NextResponse } from "next/server";
+import { ObjectId } from "mongodb";
+import { getDb } from "../../../lib/db.js";
+
+// Never cache — always read/write live data.
+export const dynamic = "force-dynamic";
+
+async function posts() {
+  const db = await getDb();
+  return db.collection("posts");
+}
+
+function slugify(input) {
+  return String(input)
+    .toLowerCase()
+    .trim()
+    .replace(/[^a-z0-9]+/g, "-")
+    .replace(/^-+|-+$/g, "");
+}
+
+function serialize(p) {
+  return {
+    id: p._id.toString(),
+    title: p.title,
+    slug: p.slug,
+    body: p.body,
+    tags: Array.isArray(p.tags) ? p.tags : [],
+    published: !!p.published,
+    createdAt: p.createdAt ? new Date(p.createdAt).toISOString() : null,
+  };
+}
+
+// GET /api/posts — list all posts, newest first.
+export async function GET() {
+  const col = await posts();
+  const items = await col.find({}).sort({ createdAt: -1 }).toArray();
+  return NextResponse.json(items.map(serialize));
+}
+
+// POST /api/posts — create a post.
+// Body: { title, body, slug?, tags?: string[], published?: boolean }.
+export async function POST(request) {
+  const data = await request.json().catch(() => ({}));
+  const title = typeof data.title === "string" ? data.title.trim() : "";
+  const body = typeof data.body === "string" ? data.body.trim() : "";
+  if (!title || !body) {
+    return NextResponse.json({ error: "title and body are required" }, { status: 400 });
+  }
+  const slug =
+    (typeof data.slug === "string" && data.slug.trim() && slugify(data.slug)) ||
+    slugify(title);
+  if (!slug) {
+    return NextResponse.json({ error: "could not derive a slug" }, { status: 400 });
+  }
+  const tags = Array.isArray(data.tags)
+    ? data.tags.map((t) => String(t).trim()).filter(Boolean)
+    : [];
+  const published = data.published !== false;
+
+  const col = await posts();
+  const existing = await col.findOne({ slug });
+  if (existing) {
+    return NextResponse.json({ error: "slug already exists" }, { status: 409 });
+  }
+  const doc = { title, slug, body, tags, published, createdAt: new Date() };
+  const res = await col.insertOne(doc);
+  return NextResponse.json(serialize({ _id: res.insertedId, ...doc }), { status: 201 });
+}
+
+// DELETE /api/posts?id=<id> — remove a post.
+export async function DELETE(request) {
+  const id = new URL(request.url).searchParams.get("id");
+  if (!id || !ObjectId.isValid(id)) {
+    return NextResponse.json({ error: "valid id is required" }, { status: 400 });
+  }
+  const col = await posts();
+  await col.deleteOne({ _id: new ObjectId(id) });
+  return NextResponse.json({ ok: true });
+}

package/src/corpus/templates/blog-cms/services/web/app/layout.js

@@ -0,0 +1,47 @@
+// Root layout + plain inline CSS (no external CDNs, fonts, or stylesheets).
+export const metadata = {
+  title: "Blog",
+  description: "A persistent blog / CMS on CloudGrid, backed by grid-shared Mongo.",
+};
+
+const css = `
+  :root { color-scheme: light dark; }
+  * { box-sizing: border-box; }
+  body { margin: 0; font-family: system-ui, -apple-system, sans-serif; line-height: 1.6; }
+  main { max-width: 44rem; margin: 3rem auto; padding: 0 1.25rem; }
+  a { color: inherit; }
+  h1 { margin: 0 0 .25rem; }
+  h1 a { text-decoration: none; }
+  .hint { margin: 0 0 2rem; opacity: .7; font-size: .9rem; }
+  nav { margin: 0 0 2rem; font-size: .9rem; }
+  nav a { margin-right: 1rem; }
+  article { padding: 1.25rem 0; border-bottom: 1px solid #8883; }
+  article h2 { margin: 0 0 .25rem; font-size: 1.25rem; }
+  article h2 a { text-decoration: none; }
+  .meta { font-size: .8rem; opacity: .65; margin: 0 0 .5rem; }
+  .tags { font-size: .75rem; opacity: .7; }
+  .tag { display: inline-block; padding: .1rem .5rem; margin-right: .3rem; border: 1px solid #8886; border-radius: 1rem; }
+  .draft { font-size: .7rem; text-transform: uppercase; letter-spacing: .05em; color: #b45; margin-left: .5rem; }
+  .empty { opacity: .6; }
+  .post-body { white-space: pre-wrap; }
+  form.admin { display: grid; gap: .6rem; margin: 1rem 0 2rem; padding: 1.25rem; border: 1px solid #8886; border-radius: .75rem; }
+  label { display: grid; gap: .25rem; font-size: .85rem; }
+  input, textarea { width: 100%; padding: .5rem .75rem; border: 1px solid #8886; border-radius: .5rem; font: inherit; background: transparent; color: inherit; }
+  textarea { min-height: 8rem; resize: vertical; }
+  .checkbox { display: flex; align-items: center; gap: .5rem; }
+  .checkbox input { width: auto; }
+  button { padding: .5rem .9rem; border: 1px solid #8886; border-radius: .5rem; background: #6663; font: inherit; cursor: pointer; color: inherit; }
+  button:disabled { opacity: .5; cursor: default; }
+  .row-actions button { font-size: .8rem; }
+`;
+
+export default function RootLayout({ children }) {
+  return (
+    <html lang="en">
+      <head>
+        <style dangerouslySetInnerHTML={{ __html: css }} />
+      </head>
+      <body>{children}</body>
+    </html>
+  );
+}

package/src/corpus/templates/blog-cms/services/web/app/page.js

@@ -0,0 +1,56 @@
+// Home page: a server component reads published posts straight from Mongo and
+// renders the post list. Data persists across refresh and across users because
+// it lives in the grid-shared Mongo, not in memory.
+import Link from "next/link";
+import { getDb } from "../lib/db.js";
+
+export const dynamic = "force-dynamic";
+
+async function listPublished() {
+  const db = await getDb();
+  const items = await db
+    .collection("posts")
+    .find({ published: true })
+    .sort({ createdAt: -1 })
+    .toArray();
+  return items.map((p) => ({
+    id: p._id.toString(),
+    title: p.title,
+    slug: p.slug,
+    tags: Array.isArray(p.tags) ? p.tags : [],
+    createdAt: p.createdAt ? new Date(p.createdAt).toISOString() : null,
+  }));
+}
+
+export default async function Page() {
+  const posts = await listPublished();
+  return (
+    <main>
+      <h1>Blog</h1>
+      <p className="hint">Persisted in the grid-shared Mongo — survives refresh.</p>
+      <nav>
+        <Link href="/admin">Admin</Link>
+      </nav>
+      {posts.length === 0 && <p className="empty">No published posts yet.</p>}
+      {posts.map((p) => (
+        <article key={p.id}>
+          <h2>
+            <Link href={`/posts/${encodeURIComponent(p.slug)}`}>{p.title}</Link>
+          </h2>
+          {p.createdAt && (
+            <p className="meta">{new Date(p.createdAt).toLocaleDateString()}</p>
+          )}
+          {p.tags.length > 0 && (
+            <p className="tags">
+              {p.tags.map((t) => (
+                <span key={t} className="tag">
+                  {t}
+                </span>
+              ))}
+            </p>
+          )}
+        </article>
+      ))}
+    </main>
+  );
+}

package/src/corpus/templates/blog-cms/services/web/app/posts/[slug]/page.js

@@ -0,0 +1,45 @@
+// Single-post page: a server component reads one published post by its slug.
+import Link from "next/link";
+import { notFound } from "next/navigation";
+import { getDb } from "../../../lib/db.js";
+
+export const dynamic = "force-dynamic";
+
+async function getPost(slug) {
+  const db = await getDb();
+  const p = await db.collection("posts").findOne({ slug, published: true });
+  if (!p) return null;
+  return {
+    title: p.title,
+    body: p.body,
+    tags: Array.isArray(p.tags) ? p.tags : [],
+    createdAt: p.createdAt ? new Date(p.createdAt).toISOString() : null,
+  };
+}
+
+export default async function PostPage({ params }) {
+  const { slug } = await params;
+  const post = await getPost(slug);
+  if (!post) notFound();
+  return (
+    <main>
+      <nav>
+        <Link href="/">← All posts</Link>
+      </nav>
+      <h1>{post.title}</h1>
+      {post.createdAt && (
+        <p className="meta">{new Date(post.createdAt).toLocaleDateString()}</p>
+      )}
+      {post.tags.length > 0 && (
+        <p className="tags">
+          {post.tags.map((t) => (
+            <span key={t} className="tag">
+              {t}
+            </span>
+          ))}
+        </p>
+      )}
+      <div className="post-body">{post.body}</div>
+    </main>
+  );
+}

package/src/corpus/templates/blog-cms/services/web/lib/db.js

@@ -0,0 +1,32 @@
+// Cached MongoDB client for the App Router.
+//
+// The grid injects the connection string as the DATABASE_MONGODB_URL environment
+// variable (plus the legacy MONGODB_URL alias) at dev-time (`grid dev`) and
+// runtime (after `grid plug`). Read the canonical var first, fall back to the
+// legacy alias. Never hardcode a connection string here and never commit a secret.
+//
+// The env var and client are resolved LAZILY (inside getDb), never at module top
+// level — otherwise `next build` throws when it imports this module for route
+// analysis, before the grid injects the var.
+import { MongoClient } from "mongodb";
+
+function clientPromise() {
+  const uri = process.env.DATABASE_MONGODB_URL || process.env.MONGODB_URL;
+  if (!uri) {
+    throw new Error(
+      "DATABASE_MONGODB_URL is not set. The grid injects it automatically — run " +
+        "this app with `grid dev` locally, or deploy it with `grid plug` (the grid " +
+        "injects the DB connection string at runtime). Do not set it by hand.",
+    );
+  }
+  if (!globalThis.__mongoClientPromise) {
+    globalThis.__mongoClientPromise = new MongoClient(uri).connect();
+  }
+  return globalThis.__mongoClientPromise;
+}
+
+export async function getDb() {
+  const client = await clientPromise();
+  // The default DB comes from the connection-string path segment the grid injects.
+  return client.db();
+}

package/src/corpus/templates/blog-cms/services/web/package.json

@@ -0,0 +1,16 @@
+{
+  "name": "blog-cms",
+  "version": "0.1.0",
+  "private": true,
+  "scripts": {
+    "dev": "next dev",
+    "build": "next build",
+    "start": "next start"
+  },
+  "dependencies": {
+    "next": "^15.1.0",
+    "react": "^19.0.0",
+    "react-dom": "^19.0.0",
+    "mongodb": "^6.12.0"
+  }
+}

package/src/corpus/templates/booking-system/AGENTS.md

@@ -0,0 +1,189 @@
+# AGENTS.md — booking-system (BLUEPRINT)
+
+A structure guide for building an appointment / reservation booking system on
+CloudGrid. This is a **blueprint**, not runnable app code: it tells you the exact
+file tree, data model, and CloudGrid wiring to build so it deploys correctly.
+Build the app yourself following this guide — do not expect prewritten routes.
+
+The proven runtime shape is the same as `app-with-data` (Next.js + Mongo under
+`services/web/`); this blueprint layers booking domain logic, Stripe payments,
+an auth provider, and a reminder cron on top.
+
+---
+
+## 1. File tree
+
+App code MUST live under `services/<name>/` — `path:` in `cloudgrid.yaml` is the
+URL mount, NOT the filesystem path. The service named `web` → the CLI looks for
+`services/web/`. Files at the repo root fail with
+`Error: Service directory not found: …/services/web`.
+
+```
+cloudgrid.yaml                                  # name + services.web (nextjs) + needs:{database:true} + vault:
+AGENTS.md                                       # this guide
+services/web/package.json                       # next, react, react-dom, mongodb, stripe, auth provider SDK
+services/web/lib/db.js                          # lazy Mongo client from DATABASE_MONGODB_URL (legacy MONGODB_URL fallback)
+services/web/lib/availability.js                # slot generation + double-booking check (core booking logic)
+services/web/lib/stripe.js                      # lazy Stripe client from process.env.STRIPE_KEY (vault-injected)
+services/web/lib/auth.js                        # auth-provider server helpers (session, current user) from AUTH_PROVIDER_KEY
+services/web/app/layout.js                      # root layout + inline CSS
+services/web/app/page.js                        # server component: services list + open slots for a chosen day
+services/web/app/book/[serviceId]/page.js       # booking flow for one service (pick slot → checkout)
+services/web/app/booking-form.js                # client component: slot picker → POST /api/bookings
+services/web/app/api/services/route.js          # GET list bookable services; POST admin-create (auth-gated)
+services/web/app/api/availability/route.js      # GET open slots for { serviceId, date } (reads availability.js)
+services/web/app/api/bookings/route.js          # GET my bookings; POST create (holds slot, starts Stripe checkout)
+services/web/app/api/bookings/[id]/route.js     # GET one; PATCH reschedule/cancel; DELETE cancel
+services/web/app/api/webhooks/stripe/route.js   # POST Stripe webhook: on checkout.session.completed → confirm booking
+#
+# ── CRON (intended shape, NOT yet deployable — see §7 + platform issue #1543) ──
+# services/reminders/package.json                # mongodb (+ email/SMS SDK)
+# services/reminders/index.js                     # batch job: find bookings due a reminder, send, mark reminded
+```
+
+---
+
+## 2. MongoDB collections + fields
+
+The grid provisions shared Mongo from `needs: { database: true }`. Suggested
+collections (all `_id` is a Mongo ObjectId; store dates as real `Date`s, in UTC):
+
+**`services`** — the bookable offerings.
+- `name` (string) — e.g. "60-min consultation"
+- `durationMinutes` (number) — slot length
+- `priceCents` (number) — amount charged at checkout (0 = free, skip Stripe)
+- `active` (boolean) — hidden from booking UI when false
+- `ownerId` (string) — auth-provider user id of the provider/staff
+- `createdAt` (Date)
+
+**`availabilityRules`** — recurring weekly windows a service can be booked in.
+- `serviceId` (ObjectId → services)
+- `weekday` (0–6, Sun–Sat)
+- `startMinute` / `endMinute` (minutes from local midnight, in `timezone`)
+- `timezone` (IANA string, e.g. "America/New_York")
+
+**`bookings`** — a reserved slot. This is the source of truth for double-booking.
+- `serviceId` (ObjectId → services)
+- `customerId` (string) — auth-provider user id, or null for guest
+- `customerEmail` (string) — for the reminder + confirmation
+- `startAt` / `endAt` (Date, UTC) — the exact reserved window
+- `status` (string) — `pending` (slot held, awaiting payment) → `confirmed`
+  (paid / free) → `cancelled` | `completed`
+- `stripeSessionId` (string, nullable) — links to the Checkout session
+- `reminderSentAt` (Date, nullable) — set by the reminder cron; prevents dupes
+- `createdAt` (Date)
+
+**Double-booking guard:** a slot is free only if no `bookings` doc for that
+`serviceId` overlaps `[startAt, endAt)` with `status in {pending, confirmed}`.
+Enforce it at write time — do the overlap query and the `insertOne` guarded by a
+**unique index** on `{ serviceId: 1, startAt: 1 }` so two concurrent requests
+cannot both take the same slot (the loser gets a duplicate-key error → return
+409). `availability.js` generates candidate slots from `availabilityRules` and
+subtracts the taken `bookings`.
+
+---
+
+## 3. How CloudGrid injects things
+
+You do NOT provision infra or set connection strings/secrets by hand. Declared in
+`cloudgrid.yaml`, the platform injects env vars at `grid dev` and after `grid plug`:
+
+- **Database (`needs: { database: true }`)** → `DATABASE_MONGODB_URL` (plus the
+  legacy `MONGODB_URL` alias). Read it **lazily inside a getter**, never at module
+  top level — a top-level read fails `next build`, which imports the module for
+  route analysis before the grid injects the var:
+  ```js
+  // services/web/lib/db.js
+  const uri = process.env.DATABASE_MONGODB_URL || process.env.MONGODB_URL;
+  ```
+- **Secrets (`vault:` block)** → each mapped item becomes the named env var:
+  `STRIPE_KEY`, `STRIPE_WEBHOOK_SECRET`, `AUTH_PROVIDER_KEY`. Add the underlying
+  vault items with `grid secrets set <item> <value>` (or the vault UI) BEFORE
+  plug, so resolution succeeds. Never hardcode a key; never commit `.env`.
+- **AI (`needs: { ai: true }`, if you add it)** → `AI_GATEWAY_URL`, used via
+  `@cloudgrid-io/ai`. Not required for a basic booking system.
+
+Read every injected var lazily (inside getters), same rule as the DB.
+
+---
+
+## 4. Wiring auth + payments
+
+**Auth (provider SDK — Clerk / Auth0 / similar).** Put the secret key in the
+`vault:` block as `AUTH_PROVIDER_KEY` and read it lazily in
+`services/web/lib/auth.js`. Use the provider's Next.js middleware/server helpers
+to gate: booking creation (attach `customerId`), "my bookings", and admin service
+management. Public browse of services + open slots can stay unauthenticated.
+Guest booking is allowed if you capture `customerEmail` and leave `customerId`
+null. Store only the provider's user id in Mongo — never mirror passwords.
+
+**Payments (Stripe).** Put the live key in `vault:` as `STRIPE_KEY` and the
+webhook signing secret as `STRIPE_WEBHOOK_SECRET`; read both lazily in
+`services/web/lib/stripe.js`. Flow:
+1. `POST /api/bookings` — validate the slot is still free, insert the booking as
+   `status: "pending"` (holding it via the unique index), then create a Stripe
+   **Checkout Session** for `priceCents`, store `stripeSessionId` on the booking,
+   and return the session URL for the client to redirect to. (If `priceCents` is
+   0, skip Stripe and mark `confirmed` immediately.)
+2. `POST /api/webhooks/stripe` — verify the signature with
+   `STRIPE_WEBHOOK_SECRET`, and on `checkout.session.completed` flip the matching
+   booking to `status: "confirmed"`. This webhook — not the browser redirect — is
+   the source of truth for payment. Expire/cancel stale `pending` bookings so a
+   held slot is released if checkout is abandoned (a job for the reminder cron, or
+   an on-read sweep).
+
+---
+
+## 5. Deploy steps
+
+1. `grid init` — scaffolds the entity + `.cloudgrid/link.json`; writes a
+   `cloudgrid.yaml` with an empty `services: {}`. Run this FIRST (plug needs a
+   linked directory).
+2. Fill it in: build the files under `services/web/` and set `cloudgrid.yaml` to
+   this template's shape (`services.web` nextjs + `needs: { database: true }` +
+   the `vault:` block).
+3. `grid secrets set stripe-live-key <sk_live_…>` and the other vault items, so
+   the `vault:` mappings resolve at deploy.
+4. (Optional) `grid dev` — runs Next.js locally with `DATABASE_MONGODB_URL` and
+   the vault env vars injected against dev resources. Good for testing the slot
+   logic before shipping.
+5. `grid plug` — builds + deploys. A runtime deploy is **async**: the first
+   response is `status: "building"`, not a live URL. Poll `grid status` (or the
+   returned poll_url) until live; surface a liveness signal while it builds, never
+   a bare silent wait. Return the live app URL only once it is up.
+6. Iterate by re-plugging the SAME entity — it updates the same URL.
+
+---
+
+## 6. Edition note
+
+This is a built + deployed container (runtime app), so it requires the **local
+edition** (Claude Desktop / Claude Code) or the CLI. The **hosted edition**
+(Claude Web / hosted MCP) is inline/static-only and CANNOT build a runtime app —
+on hosted, the most you can ship is a static preview page, not the real booking
+backend.
+
+---
+
+## 7. Reminder cron — intended shape, NOT yet deployable (platform issue #1543)
+
+The design calls for a scheduled job that sends appointment reminders (e.g. email
+/ SMS 24h and 1h before `startAt`) and sweeps abandoned `pending` bookings.
+
+**Intended shape** (mirrors the commented `reminders:` service in
+`cloudgrid.yaml`):
+- A second service `services/reminders/` of `type: cron`, `run: job` (batch, no
+  HTTP), on a `schedule` like `*/15 * * * *`.
+- On each run: connect to Mongo via the same `DATABASE_MONGODB_URL`; find
+  `confirmed` bookings whose `startAt` is within a reminder window and
+  `reminderSentAt` is null; send via an email/SMS provider (key from `vault:`);
+  set `reminderSentAt`. Also cancel `pending` bookings older than the hold
+  timeout to free the slot.
+
+**Status: PENDING.** cron-service deploy is currently blocked by **platform issue
+#1543** — `grid plug` will reject a `type: cron` service until it lands. Keep the
+`reminders:` service COMMENTED in `cloudgrid.yaml` and ship the `web` service
+alone for now. Until #1543 is fixed, run reminders as a stopgap: an on-read sweep
+inside `GET /api/bookings`, or an external scheduler hitting a protected
+`POST /api/cron/reminders` route on the web service. Swap to the real cron
+service once the issue is resolved.

package/src/corpus/templates/booking-system/README.md

@@ -0,0 +1,17 @@
+# booking-system template — appointment / reservation booking (BLUEPRINT)
+
+A blueprint for a persistent booking system on CloudGrid: a Next.js app under
+`services/web/` backed by grid-shared Mongo (`services`, `availabilityRules`,
+`bookings` collections) with slot-availability logic, Stripe checkout for paid
+appointments, an auth provider for accounts, and a reminder cron for scheduled
+notifications. It exists because reservations must survive refresh and be shared
+across sessions — a runtime app, not a static page — and because the payment +
+scheduling wiring is CloudGrid-specific (vault-injected secrets, injected
+`DATABASE_MONGODB_URL`, a cron service).
+
+> **This is a blueprint: structure + cloudgrid.yaml, adapt and build.** It ships
+> the annotated `cloudgrid.yaml` and `AGENTS.md` (file tree, data model, and
+> CloudGrid wiring) — NOT prewritten app code. Read `AGENTS.md`, then build the
+> app under `services/web/` following it. Note: the reminder **cron service is
+> not yet deployable** (platform issue #1543) — see `AGENTS.md` §7 for the
+> intended shape and the stopgap.