@cloudgrid-io/mcp 0.13.0 → 0.14.0

package/src/corpus/templates/docs-site/cloudgrid.yaml

@@ -1,10 +1,228 @@
-# static — deploys as an inspiration (instant, works on hosted) via gridctl_drop;
-# this yaml is only for plugging it as an OWNED static runtime (async, local
-# edition only). To publish the page, prefer gridctl_drop, not grid plug.
+# ============================================================================
+# cloudgrid.yaml — Complete Example
+# ============================================================================
 #
-# needs: {}  # none — static, no infrastructure
+# This file shows EVERY field the platform supports, with comments explaining
+# each one. It is a reference — no real project would use all of these at once.
+#
+# STANDARD: every CloudGrid template ships its cloudgrid.yaml in THIS full form.
+# Uncomment ONLY the fields the archetype needs (always: name + services; plus
+# needs: for runtime apps). Leave everything else commented. Comments are
+# ignored by the parser, so the file deploys to exactly the active fields.
+#
+# Only two fields are required: name and services. Everything else is optional.
+# Full docs: docs/cloudgrid-yaml-reference.md
+# ============================================================================
+
+
+# ─── IDENTITY ───────────────────────────────────────────────────────────────
+
+# Entity slug (REQUIRED). 2-42 chars, lowercase alphanumeric + hyphens.
+# Must start and end with a letter or digit.
+# Becomes part of your public URL: <name>-<4hex>.<org>.cloudgrid.io
 name: docs-site
+
+# One-line summary. Max 280 chars. If omitted, Grid Brain auto-generates one.
+# description: Order processing API for the e-commerce platform
+
+# Single emoji or short text shown as the entity icon. Max 64 chars.
+# icon: "📦"
+
+# Entity type: 'app' (default) or 'agent'. An agent is an app with an agent: block.
+# kind: app
+
+
+# ─── NETWORKING ─────────────────────────────────────────────────────────────
+
+# Whether this entity serves public HTTP traffic.
+# true = public URL + Ingress (default). false = internal only.
+# expose: true
+
+# Additional domain names this entity serves on (the platform URL is always active).
+# custom_domains:
+#   - orders.example.com
+#   - shop.example.com
+
+
+# ─── HEALTH PROBE (entity-level override) ──────────────────────────────────
+
+# Override the default health check for the entire entity.
+# probe:
+#   path: /healthz               # HTTP path to probe (default: /).
+#   expected: "<500"             # '<500' (default), '200', '2xx'.
+
+
+# ─── DEPLOY NOTIFICATIONS ──────────────────────────────────────────────────
+
+# Slack notification to the org's default channel on deploy failure.
+# true = notify (default), false = silent.
+# notify: true
+
+
+# ─── SCALING ────────────────────────────────────────────────────────────────
+
+# Replica scaling intent.
+#   'auto'  — platform decides from the grid tier (default).
+#   'alert' — single-replica, emit a SPOF warning at plug time.
+#   1-10    — explicit replica count, clamped to the grid max.
+# scale: auto
+
+
+# ─── INFRASTRUCTURE NEEDS ──────────────────────────────────────────────────
+#
+# Declare infrastructure; the platform provisions it and injects connection
+# details as env vars. Nine needs: database, cache, kv, queue, pubsub, vector,
+# object_storage, disk, ai. Simplest form is `true`.
+#
+# needs:
+#   # database — MongoDB. Injects DATABASE_MONGODB_URL (+ legacy MONGODB_URL).
+#   #   true | pool | dedicated | { tier: external, secret: MY_DB }
+#   database: true
+#   # cache — Redis, LRU eviction (derived data). Injects CACHE_REDIS_URL (+ REDIS_URL).
+#   #   true | redis | { engine: external, secret: MY_REDIS_URL }
+#   cache: true
+#   # kv — Redis, no eviction (durable: flags, idempotency). Injects KV_REDIS_URL.
+#   kv: true
+#   # queue — Redis job-queue substrate (BullMQ). Injects QUEUE_REDIS_URL.
+#   queue: true
+#   # pubsub — Redis broadcast pub/sub. Injects PUBSUB_REDIS_URL.
+#   pubsub: true
+#   # vector — pgvector on Postgres. Injects VECTOR_PGVECTOR_URL (+ PGVECTOR_URL).
+#   #   true | pgvector | { engine: pgvector, dim: 1536 }
+#   vector: pgvector
+#   # object_storage — GCS bucket. Injects OBJECT_STORAGE_GCS_BUCKET, _GCS_REGION.
+#   #   true | { size: 10Gi }
+#   object_storage: true
+#   # disk — persistent FS mount (PVC). Injects DISK_PATH. Pins to 1 replica.
+#   #   true | { size: 1Gi, mount: /var/data }  (forbidden: /proc /sys /dev)
+#   disk: true
+#   # ai — AI Gateway via @cloudgrid-io/ai. Injects AI_GATEWAY_URL. true | false.
+#   ai: true
+
+
+# ─── INTER-ENTITY COMMUNICATION ────────────────────────────────────────────
+
+# Entities this app calls (outbound). Service-account token injected per pair.
+# calls:
+#   - org:atomic/billing-api
+
+# Inbound caller policy — who can call YOUR entity.
+# callers:
+#   policy: auto                 # 'auto' | 'manual' (default).
+#   scope: org                   # 'org' (default) | 'space' | 'explicit'.
+#   fallback: deny               # 'deny' (default) | 'warn'.
+#   # allowed_apps:              # required only when scope: explicit
+#   #   - org:atomic/frontend
+
+
+# ─── VAULT ──────────────────────────────────────────────────────────────────
+
+# Map org vault items to env vars. Keys UPPER_SNAKE_CASE; values = vault item keys.
+# vault:
+#   STRIPE_KEY: stripe-live-key
+#   SENDGRID_API_KEY: sendgrid-key
+
+
+# ─── CONNECTORS AND HOOKS ──────────────────────────────────────────────────
+
+# connectors:
+#   - id: team-slack
+#     target: org                # 'system' | 'org'.
+#     channel: "#deploys"
+# hooks:
+#   - on: deploy.failed          # release.published | deploy.failed | feedback.received | entity.created
+#     via: team-slack
+#     template: "Deploy failed for {entity_name}: {error}"
+#     channel: "#alerts"
+# triggers:
+#   - from: team-slack
+#     event: message
+#     channel: "#support"
+#     route: /webhooks/slack
+
+
+# ─── LOCAL DEVELOPMENT ──────────────────────────────────────────────────────
+
+# Config for `grid dev`. Redact fields in dev data snapshots.
+# dev:
+#   snapshot:
+#     mask:
+#       - users.email
+#       - users.phone
+
+
+# ─── AGENT METADATA ────────────────────────────────────────────────────────
+
+# An agent is an app with kind: agent (above) and an agent: block.
+# agent:
+#   purpose: Sync customer data from external CRM every night
+#   schedule: "0 2 * * *"
+#   trigger: webhook
+
+
+# ─── PRIVATE RESOURCE AUTO-DEPENDENCIES ────────────────────────────────────
+
+# When true (default), private resources are auto-injected as depends_on.
+# auto_depends_on_private_requires: true
+
+
+# ─── SERVICES (REQUIRED) ───────────────────────────────────────────────────
+#
+# At least one service is required. Key = service name (slug rules).
+# Types: node, nextjs, python, static, cron.
+#
 services:
   web:
+    # type (REQUIRED): node | nextjs | python | static | cron
     type: static
+    # HTTP route: '/' | '/api' | false (internal) | omitted (=false + warning).
+    # Only one service per entity can claim '/'.
     path: /
+    # Container port (default 8080; read process.env.PORT). Not for cron.
+    # port: 3000
+    # nextjs only: base_image: distroless (default) | alpine
+    # base_image: distroless
+    # node only: lang: javascript (default) | typescript
+    # lang: typescript
+    # Custom source location (default services/<name>/). '.' = project root.
+    # source:
+    #   path: src/worker
+    # Health probe: false/omitted (TCP) | true (/health) | "/path" | {path,expected}
+    # health:
+    #   path: /api/health
+    #   expected: "200"
+    # Static runtime env vars (strings). Reserved: PORT, APP_NAME, SERVICE_NAME,
+    # NODE_ENV, MONGODB_URL, REDIS_URL, AI_GATEWAY_URL, N8N_WEBHOOK_URL, CLOUDGRID_*.
+    # env:
+    #   LOG_LEVEL: info
+    # Sibling services/private resources that must be Ready first (no cron, no cycles).
+    # depends_on:
+    #   - worker
+    # Per-service needs override (merges with app-level needs).
+    # needs:
+    #   queue: true
+    # Static-only build step:
+    # build:
+    #   command: npm run build
+    #   output: dist
+    #   env:
+    #     VITE_API_URL: https://api.example.com
+    # node_version: "22"          # static build step: '18'|'20'|'22'|'24' (quoted)
+    # Cron-only: schedule (REQUIRED), timezone (UTC|EST|PST), run (job | https URL)
+    # schedule: "0 9 * * 1"
+    # timezone: UTC
+    # run: job
+    # Verbose per-service persistence (prefer needs.disk):
+    # persist:
+    #   - name: scratch
+    #     path: /tmp/scratch
+    #     size: 500Mi
+
+
+# ============================================================================
+# NOTES
+# - NOT here: org:/entity_id: (→ .cloudgrid/link.json), secrets (→ grid secrets set),
+#   Dockerfile (platform generates from services.*.type).
+# - Deploy: grid plug   |   Local with grid resources: grid dev
+# - Full reference: docs/cloudgrid-yaml-reference.md  |  CLI: docs/cli-reference.md
+# ============================================================================

package/src/corpus/templates/docs-site/index.md

@@ -17,11 +17,9 @@ The fillable HTML is the real template — fetch it with
 ## cloudgrid.yaml (reference only)
 
 ```yaml
-# static — deploys as an inspiration (instant, works on hosted) via gridctl_drop;
-# this yaml is only for plugging it as an OWNED static runtime (async, local
-# edition only). To publish the page, prefer gridctl_drop, not grid plug.
-#
-# needs: {}  # none — static, no infrastructure
+# On disk this file is the full-annotated reference (templates/_cloudgrid.yaml.reference) with EVERY
+# field present as a comment; only the fields below are uncommented, so it
+# deploys to exactly these active fields.
 name: docs-site
 services:
   web:

package/src/corpus/templates/erp/AGENTS.md

@@ -0,0 +1,116 @@
+# AGENTS.md — erp blueprint (structure guide)
+
+This is a **blueprint**, not runnable app code. It is large and multi-module:
+inventory + orders + finance + HR, plus auth/RBAC. Do NOT expect a `page.js` to
+copy — read this guide, then **build** the app under `services/web/` following
+the tree, the collections, and the CloudGrid wiring below. It is one Next.js
+service (App Router) that hosts every module as its own API-route group and UI
+section, backed by the grid-shared Mongo. Keep it a single `web` service unless
+a module genuinely needs to scale independently (only then split into a second
+service and wire it with `calls:` / `callers:`).
+
+## 1. File tree (build this under `services/web/`)
+
+Service code MUST live under `services/web/` — `path: /` in `cloudgrid.yaml` is
+the URL mount, NOT the filesystem path. Files at the repo root fail with
+`Error: Service directory not found: …/services/web`.
+
+```
+cloudgrid.yaml                                 # name + services.web (nextjs) + needs:{database:true} + vault:
+services/web/package.json                      # next, react, react-dom, mongodb, + auth SDK (@clerk/nextjs) + stripe
+services/web/middleware.js                     # auth gate (Clerk/Auth0) — protects all /(dashboard) + /api routes
+services/web/lib/db.js                          # lazy Mongo client from DATABASE_MONGODB_URL (legacy MONGODB_URL fallback)
+services/web/lib/auth.js                         # session + role helpers: currentUser(), requireRole('finance'|'hr'|...)
+services/web/lib/stripe.js                       # lazy Stripe client from process.env.STRIPE_KEY (vault-injected)
+services/web/app/layout.js                       # root layout + nav across modules
+services/web/app/(dashboard)/page.js             # home / KPIs (server component)
+services/web/app/(dashboard)/inventory/page.js   # inventory UI (items, stock)
+services/web/app/(dashboard)/orders/page.js      # orders UI (order + line items)
+services/web/app/(dashboard)/finance/page.js     # finance UI (invoices, payments)
+services/web/app/(dashboard)/hr/page.js          # HR UI (employees, departments)
+services/web/app/api/inventory/route.js          # GET/POST/PATCH/DELETE on `items`
+services/web/app/api/orders/route.js             # GET/POST/PATCH on `orders` (decrements stock)
+services/web/app/api/finance/invoices/route.js   # GET/POST on `invoices`; POST → Stripe checkout
+services/web/app/api/finance/webhook/route.js    # Stripe webhook → mark invoice paid, record payment
+services/web/app/api/hr/route.js                 # GET/POST/PATCH/DELETE on `employees`
+```
+
+Each module = one API-route group + one collection + one UI page. Add modules by
+repeating the pattern; do not cram unrelated domains into one route file.
+
+## 2. Mongo collections (one Mongo, many collections)
+
+The grid provisions ONE Mongo database (from `needs: { database: true }`). Model
+each module as a collection in that same DB — no per-module database.
+
+- **items** (inventory): `{ sku, name, qty, reorderLevel, unitCost, updatedAt }`
+- **orders**: `{ customer, lines: [{ sku, qty, unitPrice }], status: 'draft'|'placed'|'fulfilled', total, createdAt }` — placing an order decrements matching `items.qty`.
+- **invoices** (finance): `{ orderId, amount, currency, status: 'open'|'paid', stripeSessionId, createdAt, paidAt }`
+- **payments** (finance): `{ invoiceId, amount, stripePaymentIntent, receivedAt }`
+- **employees** (hr): `{ name, email, department, title, role, startDate }` where `role` is the RBAC role (`admin`|`finance`|`hr`|`ops`).
+
+Add indexes as the data grows (e.g. `items.sku` unique, `orders.status`).
+
+## 3. How CloudGrid injects things (do NOT set these by hand)
+
+- **Database (Mongo):** declared as `needs: { database: true }`. The deployer
+  provisions Mongo and injects the connection string as `DATABASE_MONGODB_URL`
+  (plus the legacy `MONGODB_URL` alias) at `grid dev` time and at runtime. Read
+  `process.env.DATABASE_MONGODB_URL || process.env.MONGODB_URL` **lazily inside a
+  getter** (`lib/db.js`), never at module top level — a top-level read fails
+  `next build` because Next imports the module for route analysis before the grid
+  injects the var. Never hardcode a connection string.
+- **Secrets (auth + Stripe):** the `vault:` block in `cloudgrid.yaml` maps org
+  vault items → env vars. `AUTH_PROVIDER_KEY: auth-provider-secret` and
+  `STRIPE_KEY: stripe-live-key` become `process.env.AUTH_PROVIDER_KEY` and
+  `process.env.STRIPE_KEY` at runtime. Put the real values in the org vault; the
+  yaml only names the mapping. (One-off non-vault secrets can also go via
+  `grid secrets set`; non-secret config via `grid env`.) Never commit a key.
+- **AI (optional):** if a module uses AI (e.g. demand forecasting), add
+  `ai: true` under `needs:` — the grid injects `AI_GATEWAY_URL`, called via
+  `@cloudgrid-io/ai`. Not enabled by default in this blueprint.
+
+## 4. Wiring auth + RBAC and payments
+
+**Auth / RBAC (provider SDK, keys from vault):**
+- Use a hosted provider SDK — Clerk (`@clerk/nextjs`) or Auth0. The backend API
+  key comes from `process.env.AUTH_PROVIDER_KEY` (vault-injected); publishable
+  front-end keys go via `grid env`.
+- `services/web/middleware.js` gates the `(dashboard)` group and all `/api`
+  routes — unauthenticated requests redirect to sign-in.
+- `lib/auth.js` exposes `currentUser()` and `requireRole(role)`. Store each
+  user's role on the `employees` document (or provider metadata) and enforce per
+  module: finance routes require `finance`|`admin`, HR routes require `hr`|`admin`.
+
+**Payments (Stripe, finance module):**
+- `lib/stripe.js` builds a lazy Stripe client from `process.env.STRIPE_KEY`
+  (vault-injected) — same lazy-getter rule as the DB.
+- `POST /api/finance/invoices` creates the invoice doc and a Stripe Checkout
+  Session; store `stripeSessionId` on the invoice.
+- `POST /api/finance/webhook` verifies the Stripe signature, then on
+  `checkout.session.completed` marks the invoice `paid` and inserts a `payments`
+  record. Register this route's public URL as the webhook endpoint in Stripe.
+
+## 5. Deploy (runtime, async)
+
+1. `grid init` an app `<name>` — creates the entity + `.cloudgrid/link.json` and
+   a `cloudgrid.yaml` with empty `services: {}`. Run init FIRST (plug needs a
+   linked dir).
+2. Fill `cloudgrid.yaml` to this blueprint's shape (services.web nextjs + path:/,
+   `needs: { database: true }`, and the `vault:` mappings), and build the app under
+   `services/web/`.
+3. Put real secret values in the org vault so the `vault:` mappings resolve; set
+   any publishable/front-end config via `grid env`.
+4. `grid plug` to deploy. A runtime deploy is **async** — the first response is
+   `status: building`, not a live URL. Poll `grid status` (or the returned
+   poll_url) until live; surface a liveness signal while it builds; then return
+   the live app URL (not the build/log link). Re-plug the SAME entity to update
+   the same URL.
+5. Optionally `grid dev` first to run locally against the injected dev Mongo.
+
+## 6. Edition note
+
+A runtime app is a built + deployed container, so it requires the **local
+edition** (Claude Code / Claude Desktop) or the CLI. The hosted edition (Claude
+Web / hosted MCP) is inline-only and can only publish static pages — it cannot
+build this ERP. Edition-gate before starting the runtime path.

package/src/corpus/templates/erp/README.md

@@ -0,0 +1,17 @@
+# erp template — enterprise resource planning blueprint
+
+A **blueprint** for a multi-module ERP: inventory + orders + finance + HR in one
+Next.js App-Router service, backed by grid-shared Mongo, with auth/RBAC (Clerk or
+Auth0) and Stripe billing. It exists because an ERP is too large and
+domain-specific to ship as ready-to-run code — this template gives you the
+CloudGrid-correct skeleton (the file tree, the Mongo collections per module, and
+how the grid injects the database, vault secrets, and AI) so you build the actual
+app on solid rails instead of guessing at the platform wiring.
+
+> **blueprint: structure + cloudgrid.yaml, adapt and build.** There is no app
+> code here to copy. Read [`AGENTS.md`](./AGENTS.md) for the full structure guide
+> (file tree, collections, env/vault/deploy wiring), copy the `cloudgrid.yaml`
+> (active fields: `name` + `services.web` nextjs at `path: /` + `needs:
+> { database: true }` + a `vault:` block for auth/Stripe keys), then build the
+> app under `services/web/` following the guide. Deploy is runtime + async
+> (`grid init` → fill → `grid plug` → poll to live); local edition only.

package/src/corpus/templates/erp/cloudgrid.yaml

@@ -0,0 +1,235 @@
+# ============================================================================
+# cloudgrid.yaml — Complete Example
+# ============================================================================
+#
+# This file shows EVERY field the platform supports, with comments explaining
+# each one. It is a reference — no real project would use all of these at once.
+#
+# STANDARD: every CloudGrid template ships its cloudgrid.yaml in THIS full form.
+# Uncomment ONLY the fields the archetype needs (always: name + services; plus
+# needs: for runtime apps). Leave everything else commented. Comments are
+# ignored by the parser, so the file deploys to exactly the active fields.
+#
+# Only two fields are required: name and services. Everything else is optional.
+# Full docs: docs/cloudgrid-yaml-reference.md
+# ============================================================================
+
+
+# ─── IDENTITY ───────────────────────────────────────────────────────────────
+
+# Entity slug (REQUIRED). 2-42 chars, lowercase alphanumeric + hyphens.
+# Must start and end with a letter or digit.
+# Becomes part of your public URL: <name>-<4hex>.<org>.cloudgrid.io
+name: my-erp
+
+# One-line summary. Max 280 chars. If omitted, Grid Brain auto-generates one.
+# description: Order processing API for the e-commerce platform
+
+# Single emoji or short text shown as the entity icon. Max 64 chars.
+# icon: "📦"
+
+# Entity type: 'app' (default) or 'agent'. An agent is an app with an agent: block.
+# kind: app
+
+
+# ─── NETWORKING ─────────────────────────────────────────────────────────────
+
+# Whether this entity serves public HTTP traffic.
+# true = public URL + Ingress (default). false = internal only.
+# expose: true
+
+# Additional domain names this entity serves on (the platform URL is always active).
+# custom_domains:
+#   - orders.example.com
+#   - shop.example.com
+
+
+# ─── HEALTH PROBE (entity-level override) ──────────────────────────────────
+
+# Override the default health check for the entire entity.
+# probe:
+#   path: /healthz               # HTTP path to probe (default: /).
+#   expected: "<500"             # '<500' (default), '200', '2xx'.
+
+
+# ─── DEPLOY NOTIFICATIONS ──────────────────────────────────────────────────
+
+# Slack notification to the org's default channel on deploy failure.
+# true = notify (default), false = silent.
+# notify: true
+
+
+# ─── SCALING ────────────────────────────────────────────────────────────────
+
+# Replica scaling intent.
+#   'auto'  — platform decides from the grid tier (default).
+#   'alert' — single-replica, emit a SPOF warning at plug time.
+#   1-10    — explicit replica count, clamped to the grid max.
+# scale: auto
+
+
+# ─── INFRASTRUCTURE NEEDS ──────────────────────────────────────────────────
+#
+# Declare infrastructure; the platform provisions it and injects connection
+# details as env vars. Nine needs: database, cache, kv, queue, pubsub, vector,
+# object_storage, disk, ai. Simplest form is `true`.
+#
+# needs:
+#   # database — MongoDB. Injects DATABASE_MONGODB_URL (+ legacy MONGODB_URL).
+#   #   true | pool | dedicated | { tier: external, secret: MY_DB }
+#   database: true
+#   # cache — Redis, LRU eviction (derived data). Injects CACHE_REDIS_URL (+ REDIS_URL).
+#   #   true | redis | { engine: external, secret: MY_REDIS_URL }
+#   cache: true
+#   # kv — Redis, no eviction (durable: flags, idempotency). Injects KV_REDIS_URL.
+#   kv: true
+#   # queue — Redis job-queue substrate (BullMQ). Injects QUEUE_REDIS_URL.
+#   queue: true
+#   # pubsub — Redis broadcast pub/sub. Injects PUBSUB_REDIS_URL.
+#   pubsub: true
+#   # vector — pgvector on Postgres. Injects VECTOR_PGVECTOR_URL (+ PGVECTOR_URL).
+#   #   true | pgvector | { engine: pgvector, dim: 1536 }
+#   vector: pgvector
+#   # object_storage — GCS bucket. Injects OBJECT_STORAGE_GCS_BUCKET, _GCS_REGION.
+#   #   true | { size: 10Gi }
+#   object_storage: true
+#   # disk — persistent FS mount (PVC). Injects DISK_PATH. Pins to 1 replica.
+#   #   true | { size: 1Gi, mount: /var/data }  (forbidden: /proc /sys /dev)
+#   disk: true
+#   # ai — AI Gateway via @cloudgrid-io/ai. Injects AI_GATEWAY_URL. true | false.
+#   ai: true
+
+
+# ─── INTER-ENTITY COMMUNICATION ────────────────────────────────────────────
+
+# Entities this app calls (outbound). Service-account token injected per pair.
+# calls:
+#   - org:atomic/billing-api
+
+# Inbound caller policy — who can call YOUR entity.
+# callers:
+#   policy: auto                 # 'auto' | 'manual' (default).
+#   scope: org                   # 'org' (default) | 'space' | 'explicit'.
+#   fallback: deny               # 'deny' (default) | 'warn'.
+#   # allowed_apps:              # required only when scope: explicit
+#   #   - org:atomic/frontend
+
+
+# ─── VAULT ──────────────────────────────────────────────────────────────────
+
+# Map org vault items to env vars. Keys UPPER_SNAKE_CASE; values = vault item keys.
+# ERP needs auth (RBAC) + billing secrets. These map org vault items → env vars
+# the app reads at runtime. Add your provider's real vault item keys.
+vault:
+  AUTH_PROVIDER_KEY: auth-provider-secret   # Clerk/Auth0 backend API key (RBAC)
+  STRIPE_KEY: stripe-live-key               # Stripe secret key (billing/finance module)
+#   SENDGRID_API_KEY: sendgrid-key
+
+
+# ─── CONNECTORS AND HOOKS ──────────────────────────────────────────────────
+
+# connectors:
+#   - id: team-slack
+#     target: org                # 'system' | 'org'.
+#     channel: "#deploys"
+# hooks:
+#   - on: deploy.failed          # release.published | deploy.failed | feedback.received | entity.created
+#     via: team-slack
+#     template: "Deploy failed for {entity_name}: {error}"
+#     channel: "#alerts"
+# triggers:
+#   - from: team-slack
+#     event: message
+#     channel: "#support"
+#     route: /webhooks/slack
+
+
+# ─── LOCAL DEVELOPMENT ──────────────────────────────────────────────────────
+
+# Config for `grid dev`. Redact fields in dev data snapshots.
+# dev:
+#   snapshot:
+#     mask:
+#       - users.email
+#       - users.phone
+
+
+# ─── AGENT METADATA ────────────────────────────────────────────────────────
+
+# An agent is an app with kind: agent (above) and an agent: block.
+# agent:
+#   purpose: Sync customer data from external CRM every night
+#   schedule: "0 2 * * *"
+#   trigger: webhook
+
+
+# ─── PRIVATE RESOURCE AUTO-DEPENDENCIES ────────────────────────────────────
+
+# When true (default), private resources are auto-injected as depends_on.
+# auto_depends_on_private_requires: true
+
+
+# ─── SERVICES (REQUIRED) ───────────────────────────────────────────────────
+#
+# At least one service is required. Key = service name (slug rules).
+# Types: node, nextjs, python, static, cron.
+#
+services:
+  web:
+    # type (REQUIRED): node | nextjs | python | static | cron
+    type: nextjs
+    # HTTP route: '/' | '/api' | false (internal) | omitted (=false + warning).
+    # Only one service per entity can claim '/'.
+    path: /
+    # Container port (default 8080; read process.env.PORT). Not for cron.
+    # port: 3000
+    # nextjs only: base_image: distroless (default) | alpine
+    # base_image: distroless
+    # node only: lang: javascript (default) | typescript
+    # lang: typescript
+    # Custom source location (default services/<name>/). '.' = project root.
+    # source:
+    #   path: src/worker
+    # Health probe: false/omitted (TCP) | true (/health) | "/path" | {path,expected}
+    # health:
+    #   path: /api/health
+    #   expected: "200"
+    # Static runtime env vars (strings). Reserved: PORT, APP_NAME, SERVICE_NAME,
+    # NODE_ENV, MONGODB_URL, REDIS_URL, AI_GATEWAY_URL, N8N_WEBHOOK_URL, CLOUDGRID_*.
+    # env:
+    #   LOG_LEVEL: info
+    # Sibling services/private resources that must be Ready first (no cron, no cycles).
+    # depends_on:
+    #   - worker
+    # Per-service needs override (merges with app-level needs).
+    # needs:
+    #   queue: true
+    # Static-only build step:
+    # build:
+    #   command: npm run build
+    #   output: dist
+    #   env:
+    #     VITE_API_URL: https://api.example.com
+    # node_version: "22"          # static build step: '18'|'20'|'22'|'24' (quoted)
+    # Cron-only: schedule (REQUIRED), timezone (UTC|EST|PST), run (job | https URL)
+    # schedule: "0 9 * * 1"
+    # timezone: UTC
+    # run: job
+    # Verbose per-service persistence (prefer needs.disk):
+    # persist:
+    #   - name: scratch
+    #     path: /tmp/scratch
+    #     size: 500Mi
+
+
+needs:
+  database: true
+
+
+# ============================================================================
+# NOTES
+# - NOT here: org:/entity_id: (→ .cloudgrid/link.json), secrets (→ grid secrets set),
+#   Dockerfile (platform generates from services.*.type).
+# - Deploy: grid plug   |   Local with grid resources: grid dev
+# - Full reference: docs/cloudgrid-yaml-reference.md  |  CLI: docs/cli-reference.md
+# ============================================================================