@cloudgrid-io/mcp 0.13.0 → 0.14.0

package/src/corpus/templates/internal-tools-portal/AGENTS.md

@@ -0,0 +1,201 @@
+# AGENTS.md — internal-tools-portal (blueprint / structure guide)
+
+This is a **blueprint**, not filled app code. It tells you how to build a
+persistent internal tools portal / admin tools hub / back-office portal correctly
+**on CloudGrid**: a Next.js app under `services/web/`, backed by the grid-shared
+MongoDB, gated by staff-only auth via a provider SDK (Clerk or Auth0) whose keys
+come from the org **vault**, with role-based access control (RBAC) where **each
+internal tool is its own route** under a shared authenticated shell.
+
+Read this whole file, then build the app following it. Do not invent a different
+service layout — the CLI looks for code under `services/web/`.
+
+---
+
+## 1. File tree
+
+App code MUST live under `services/web/` — `path:` in `cloudgrid.yaml` is the URL
+mount, NOT the filesystem path. The service named `web` → the CLI looks for
+`services/web/`. Files at the repo root fail with
+`Error: Service directory not found: …/services/web`.
+
+```
+cloudgrid.yaml                                # name + services.web (nextjs) + needs:{database:true} + vault: auth keys
+services/web/package.json                     # next, react, react-dom, mongodb + auth SDK (@clerk/nextjs or @auth0/nextjs-auth0)
+services/web/middleware.js                    # auth middleware — protect ALL routes except /sign-in, /sign-up, public assets
+services/web/lib/db.js                        # lazy Mongo client from DATABASE_MONGODB_URL (legacy MONGODB_URL fallback)
+services/web/lib/auth.js                      # current-user helper: resolve session → { userId, email, roles[] }; requireRole(role)
+services/web/lib/tools.js                     # the tool registry: id, label, path, requiredRole — drives the hub grid + gating
+services/web/app/layout.js                    # root layout, wraps children in the auth provider (<ClerkProvider> / Auth0 provider)
+services/web/app/page.js                      # server component: the hub — cards for each tool the signed-in staffer may open
+services/web/app/tools/[tool]/page.js         # server component: a single tool surface, role-gated by lib/tools.js + requireRole
+services/web/app/admin/users/page.js          # server component: admin-only — manage staff + role assignments
+services/web/app/api/me/route.js              # GET current staff profile { email, roles } for the client shell
+services/web/app/api/tools/[tool]/route.js    # per-tool data API: GET/POST/etc., re-checks the tool's requiredRole server-side
+services/web/app/api/staff/route.js           # GET list / POST invite (admin); assign roles
+services/web/app/api/staff/[id]/route.js      # PATCH roles / deactivate (admin only)
+services/web/app/api/audit/route.js           # GET audit log (admin); every tool mutation appends an entry
+```
+
+Sign-in / sign-up pages depend on the provider: Clerk gives you catch-all routes
+(`app/sign-in/[[...sign-in]]/page.js`), Auth0 uses its hosted login + a
+`app/api/auth/[auth0]/route.js` handler. Follow the chosen provider's Next.js
+App-Router quickstart for those exact files.
+
+**Each tool is a route.** Add a new internal tool by (a) adding an entry to
+`lib/tools.js` with its `requiredRole`, and (b) creating its page under
+`app/tools/<id>/` (or a dedicated `app/<id>/` route) plus any data API under
+`app/api/tools/<id>/`. The hub (`app/page.js`) renders only the tools the current
+staffer's roles allow, and each tool + its API re-checks the role server-side.
+
+---
+
+## 2. Mongo collections + fields
+
+Three collections in the grid-shared Mongo. Keyed to the auth provider's stable
+user id so the identity and the staff record line up.
+
+**`staff`** — one document per staff member (the RBAC source of truth).
+| field         | type     | notes                                                       |
+|---------------|----------|-------------------------------------------------------------|
+| `_id`         | ObjectId | Mongo id                                                    |
+| `authUserId`  | string   | provider user id (Clerk `userId` / Auth0 `sub`) — unique    |
+| `email`       | string   | from the auth session                                       |
+| `name`        | string   | display name                                                |
+| `roles`       | string[] | e.g. `["support"]`, `["ops","admin"]` — drives tool access  |
+| `active`      | boolean  | deactivated staff keep no access even if the SSO account lives |
+| `createdAt`   | Date     |                                                             |
+| `lastSeenAt`  | Date     |                                                             |
+
+**`toolData`** — generic per-tool records (adapt/split per real tool; one
+collection with a `tool` discriminator keeps the blueprint compact).
+| field       | type     | notes                                                        |
+|-------------|----------|--------------------------------------------------------------|
+| `_id`       | ObjectId | Mongo id                                                     |
+| `tool`      | string   | tool id from `lib/tools.js` (e.g. `"feature-flags"`)         |
+| `key`       | string   | record key within the tool                                   |
+| `value`     | mixed    | the tool's payload                                           |
+| `updatedBy` | string   | `authUserId` of the last editor                              |
+| `updatedAt` | Date     |                                                              |
+
+**`auditLog`** — append-only record of who did what (internal tools need a trail).
+| field        | type     | notes                                                   |
+|--------------|----------|---------------------------------------------------------|
+| `_id`        | ObjectId | Mongo id                                                |
+| `actor`      | string   | `authUserId`                                            |
+| `actorEmail` | string   | denormalized for readable logs                          |
+| `tool`       | string   | tool id                                                 |
+| `action`     | string   | e.g. `"update"`, `"delete"`, `"role.grant"`             |
+| `target`     | string   | record key / affected staff id                          |
+| `at`         | Date     |                                                         |
+
+RBAC flow: a staffer signs in via the provider → `middleware.js` blocks
+unauthenticated requests → `lib/auth.js` looks up the `staff` doc by `authUserId`,
+returns `{ userId, email, roles }` (and denies inactive staff). The hub shows only
+tools whose `requiredRole` is in the staffer's `roles`; every tool page + API
+re-checks `requireRole` server-side. Mutations append to `auditLog`. Seed the
+first `admin` by inserting a `staff` doc with `roles: ["admin"]`; admins manage
+everyone else via `app/admin/users`.
+
+---
+
+## 3. How CloudGrid injects things
+
+You do **not** provision infrastructure or set connection strings/secrets by
+hand. Declare them in `cloudgrid.yaml`; the deployer injects env vars at
+dev-time (`grid dev`) and runtime (after `grid plug`).
+
+- **Database (Mongo):** `needs: { database: true }` → the grid injects
+  **`DATABASE_MONGODB_URL`** (plus the legacy **`MONGODB_URL`** alias). Read
+  `process.env.DATABASE_MONGODB_URL || process.env.MONGODB_URL` **lazily inside a
+  getter** in `services/web/lib/db.js` — never at module top level, or
+  `next build` fails (the module is imported for route analysis before the grid
+  injects the var). Never hardcode a connection string.
+- **Auth secrets (vault):** the `vault:` block maps org vault items → env vars.
+  This blueprint maps:
+  ```yaml
+  vault:
+    AUTH_PROVIDER_SECRET_KEY: auth-provider-secret-key
+    AUTH_PROVIDER_PUBLISHABLE_KEY: auth-provider-publishable-key
+  ```
+  So `process.env.AUTH_PROVIDER_SECRET_KEY` /
+  `process.env.AUTH_PROVIDER_PUBLISHABLE_KEY` are available at build+runtime.
+  You must first create those items in the org vault (see step 5). Rename the
+  keys to the provider's expected names if you prefer to read the SDK's native
+  env vars directly (e.g. `CLERK_SECRET_KEY` /
+  `NEXT_PUBLIC_CLERK_PUBLISHABLE_KEY`, or `AUTH0_SECRET` / `AUTH0_CLIENT_ID` /
+  `AUTH0_CLIENT_SECRET`) — just keep the `vault:` map keys and the code in sync.
+  A tool that talks to a third-party API (Stripe, SendGrid, an internal service
+  token) adds one more `vault:` line per secret, e.g. `STRIPE_KEY: stripe-live-key`.
+- **AI (optional):** if a tool needs an LLM (draft copy, summarize a record), add
+  `needs: { ai: true }` and the grid injects **`AI_GATEWAY_URL`** for use with
+  `@cloudgrid-io/ai`. Not required for the core portal.
+
+Non-secret config (log level, feature toggles) → `services.web.env` in the yaml,
+or `grid env`. Actual secrets → the vault (never `env:`, never committed).
+
+---
+
+## 4. Wiring staff-only auth + RBAC
+
+Pick one provider and follow its Next.js App-Router quickstart. The CloudGrid
+specifics:
+
+1. **Keys from the vault, not the SDK dashboard's `.env`.** Store the provider's
+   secret + publishable keys as org vault items; the `vault:` block injects them
+   as env vars. Do not commit local env files (`.env`).
+2. **Provider in the layout.** Wrap `app/layout.js` children in the provider
+   component (`<ClerkProvider>` or the Auth0 provider).
+3. **Middleware gate (staff-only).** `services/web/middleware.js` protects EVERY
+   route except the sign-in/sign-up pages and public assets. There is no public
+   surface — an internal portal is entirely behind auth. Unauthenticated requests
+   redirect to sign-in. (For extra lockdown, restrict sign-ups to your corporate
+   domain / an invite allowlist in the provider config.)
+4. **Roles live on the `staff` record, in Mongo — not on the client.** `lib/auth.js`
+   reads the session, looks up the `staff` doc by `authUserId`, and returns
+   `{ userId, email, roles }`, denying inactive staff. `lib/tools.js` maps each
+   tool id → its `requiredRole`.
+5. **Server-side role checks on every tool + mutation.** In `app/tools/[tool]/page.js`
+   and each `app/api/tools/[tool]/route.js`, re-resolve the staffer server-side
+   and `requireRole(tool.requiredRole)` before rendering data or performing the
+   action; reject with 403 otherwise. The hub hiding a card is UX only — never
+   the security boundary. Append every mutation to `auditLog`.
+
+If a tool needs payments (e.g. an internal refund console), add Stripe the same
+way: map `STRIPE_KEY: stripe-live-key` in `vault:`, add `app/api/checkout/route.js`
+(or a refund route) and a `app/api/webhooks/stripe/route.js` webhook route reading
+`process.env.STRIPE_KEY`. The webhook route must be excluded from the auth
+middleware (Stripe calls it unauthenticated; verify the Stripe signature instead).
+
+---
+
+## 5. Deploy steps
+
+A runtime deploy is **async** and needs the **local edition** (see below).
+
+1. **`grid init`** an app named `internal-tools-portal` — creates the entity +
+   `.cloudgrid/link.json` and a `cloudgrid.yaml` with an empty `services: {}`.
+   Run `init` FIRST (`plug` needs a linked directory).
+2. **Fill** the code under `services/web/` and set `cloudgrid.yaml` to the active
+   shape: `name` + `services.web { type: nextjs, path: / }` + `needs:
+   { database: true }` + the `vault:` auth-key map.
+3. **Create the vault items** the `vault:` block references (the auth provider's
+   secret + publishable keys, plus any per-tool API secrets). `grid secrets` /
+   vault UI — never commit them.
+4. **(Optional) `grid dev`** to run locally against the injected dev Mongo + the
+   injected vault env vars before deploying.
+5. **`grid plug`** to build + deploy the folder. The first response is
+   `status: building`, NOT a live URL — **poll `grid status`** (or the returned
+   poll URL) until the entity is live, surfacing a liveness signal while it
+   builds. Only then return the live app URL. Re-plug the SAME entity to update
+   the same URL.
+
+---
+
+## 6. Edition note
+
+This is a persistent, built-and-deployed runtime app (Next.js container + Mongo +
+auth). It requires the **local edition** (Claude Desktop / Claude Code) or the
+CLI. The **hosted edition** (Claude Web / hosted MCP) is inline-only and can only
+publish static pages — it cannot build this runtime app. On hosted, stop the
+runtime path and offer a static mock instead.

package/src/corpus/templates/internal-tools-portal/README.md

@@ -0,0 +1,17 @@
+# internal-tools-portal template — blueprint (structure + cloudgrid.yaml)
+
+A persistent internal tools portal / admin tools hub / back-office portal: a
+Next.js app on CloudGrid backed by the grid-shared MongoDB, with staff-only auth
+via a provider SDK (Clerk or Auth0) whose keys come from the org vault, role-based
+access control (RBAC), and **each internal tool as its own route** under a shared
+authenticated shell (`staff` + `toolData` + `auditLog` collections). It is a
+persistent runtime app because staff records, tool data, and the audit trail must
+survive refresh and be shared across the team — not a static page.
+
+**This is a blueprint: structure + cloudgrid.yaml, not filled app code.** Read
+`AGENTS.md` for the full structure guide — the `services/web/` file tree, the
+Mongo collections, how CloudGrid injects the DB (`DATABASE_MONGODB_URL`) and the
+vault-backed auth keys, how to wire staff-only auth + RBAC (roles on the `staff`
+record, server-side checks per tool, the tool registry in `lib/tools.js`), and the
+`grid init → fill → grid plug → poll` deploy flow — then adapt it and build the app
+following it.

package/src/corpus/templates/internal-tools-portal/cloudgrid.yaml

@@ -0,0 +1,237 @@
+# ============================================================================
+# cloudgrid.yaml — Complete Example
+# ============================================================================
+#
+# This file shows EVERY field the platform supports, with comments explaining
+# each one. It is a reference — no real project would use all of these at once.
+#
+# STANDARD: every CloudGrid template ships its cloudgrid.yaml in THIS full form.
+# Uncomment ONLY the fields the archetype needs (always: name + services; plus
+# needs: for runtime apps). Leave everything else commented. Comments are
+# ignored by the parser, so the file deploys to exactly the active fields.
+#
+# Only two fields are required: name and services. Everything else is optional.
+# Full docs: docs/cloudgrid-yaml-reference.md
+# ============================================================================
+
+
+# ─── IDENTITY ───────────────────────────────────────────────────────────────
+
+# Entity slug (REQUIRED). 2-42 chars, lowercase alphanumeric + hyphens.
+# Must start and end with a letter or digit.
+# Becomes part of your public URL: <name>-<4hex>.<org>.cloudgrid.io
+name: internal-tools-portal
+
+# One-line summary. Max 280 chars. If omitted, Grid Brain auto-generates one.
+# description: Order processing API for the e-commerce platform
+
+# Single emoji or short text shown as the entity icon. Max 64 chars.
+# icon: "📦"
+
+# Entity type: 'app' (default) or 'agent'. An agent is an app with an agent: block.
+# kind: app
+
+
+# ─── NETWORKING ─────────────────────────────────────────────────────────────
+
+# Whether this entity serves public HTTP traffic.
+# true = public URL + Ingress (default). false = internal only.
+# expose: true
+
+# Additional domain names this entity serves on (the platform URL is always active).
+# custom_domains:
+#   - orders.example.com
+#   - shop.example.com
+
+
+# ─── HEALTH PROBE (entity-level override) ──────────────────────────────────
+
+# Override the default health check for the entire entity.
+# probe:
+#   path: /healthz               # HTTP path to probe (default: /).
+#   expected: "<500"             # '<500' (default), '200', '2xx'.
+
+
+# ─── DEPLOY NOTIFICATIONS ──────────────────────────────────────────────────
+
+# Slack notification to the org's default channel on deploy failure.
+# true = notify (default), false = silent.
+# notify: true
+
+
+# ─── SCALING ────────────────────────────────────────────────────────────────
+
+# Replica scaling intent.
+#   'auto'  — platform decides from the grid tier (default).
+#   'alert' — single-replica, emit a SPOF warning at plug time.
+#   1-10    — explicit replica count, clamped to the grid max.
+# scale: auto
+
+
+# ─── INFRASTRUCTURE NEEDS ──────────────────────────────────────────────────
+#
+# Declare infrastructure; the platform provisions it and injects connection
+# details as env vars. Nine needs: database, cache, kv, queue, pubsub, vector,
+# object_storage, disk, ai. Simplest form is `true`.
+#
+# needs:
+#   # database — MongoDB. Injects DATABASE_MONGODB_URL (+ legacy MONGODB_URL).
+#   #   true | pool | dedicated | { tier: external, secret: MY_DB }
+#   database: true
+#   # cache — Redis, LRU eviction (derived data). Injects CACHE_REDIS_URL (+ REDIS_URL).
+#   #   true | redis | { engine: external, secret: MY_REDIS_URL }
+#   cache: true
+#   # kv — Redis, no eviction (durable: flags, idempotency). Injects KV_REDIS_URL.
+#   kv: true
+#   # queue — Redis job-queue substrate (BullMQ). Injects QUEUE_REDIS_URL.
+#   queue: true
+#   # pubsub — Redis broadcast pub/sub. Injects PUBSUB_REDIS_URL.
+#   pubsub: true
+#   # vector — pgvector on Postgres. Injects VECTOR_PGVECTOR_URL (+ PGVECTOR_URL).
+#   #   true | pgvector | { engine: pgvector, dim: 1536 }
+#   vector: pgvector
+#   # object_storage — GCS bucket. Injects OBJECT_STORAGE_GCS_BUCKET, _GCS_REGION.
+#   #   true | { size: 10Gi }
+#   object_storage: true
+#   # disk — persistent FS mount (PVC). Injects DISK_PATH. Pins to 1 replica.
+#   #   true | { size: 1Gi, mount: /var/data }  (forbidden: /proc /sys /dev)
+#   disk: true
+#   # ai — AI Gateway via @cloudgrid-io/ai. Injects AI_GATEWAY_URL. true | false.
+#   ai: true
+
+
+# ─── INTER-ENTITY COMMUNICATION ────────────────────────────────────────────
+
+# Entities this app calls (outbound). Service-account token injected per pair.
+# calls:
+#   - org:atomic/billing-api
+
+# Inbound caller policy — who can call YOUR entity.
+# callers:
+#   policy: auto                 # 'auto' | 'manual' (default).
+#   scope: org                   # 'org' (default) | 'space' | 'explicit'.
+#   fallback: deny               # 'deny' (default) | 'warn'.
+#   # allowed_apps:              # required only when scope: explicit
+#   #   - org:atomic/frontend
+
+
+# ─── VAULT ──────────────────────────────────────────────────────────────────
+
+# Map org vault items to env vars. Keys UPPER_SNAKE_CASE; values = vault item keys.
+# The internal-tools portal gates every tool behind staff-only auth via a
+# provider SDK (Clerk or Auth0). Store the provider's secret + publishable keys
+# as org vault items and map them to env vars here — never hardcode them or
+# commit them. The deployer injects these as env vars at build-time and runtime.
+vault:
+  AUTH_PROVIDER_SECRET_KEY: auth-provider-secret-key
+  AUTH_PROVIDER_PUBLISHABLE_KEY: auth-provider-publishable-key
+
+
+# ─── CONNECTORS AND HOOKS ──────────────────────────────────────────────────
+
+# connectors:
+#   - id: team-slack
+#     target: org                # 'system' | 'org'.
+#     channel: "#deploys"
+# hooks:
+#   - on: deploy.failed          # release.published | deploy.failed | feedback.received | entity.created
+#     via: team-slack
+#     template: "Deploy failed for {entity_name}: {error}"
+#     channel: "#alerts"
+# triggers:
+#   - from: team-slack
+#     event: message
+#     channel: "#support"
+#     route: /webhooks/slack
+
+
+# ─── LOCAL DEVELOPMENT ──────────────────────────────────────────────────────
+
+# Config for `grid dev`. Redact fields in dev data snapshots.
+# dev:
+#   snapshot:
+#     mask:
+#       - users.email
+#       - users.phone
+
+
+# ─── AGENT METADATA ────────────────────────────────────────────────────────
+
+# An agent is an app with kind: agent (above) and an agent: block.
+# agent:
+#   purpose: Sync customer data from external CRM every night
+#   schedule: "0 2 * * *"
+#   trigger: webhook
+
+
+# ─── PRIVATE RESOURCE AUTO-DEPENDENCIES ────────────────────────────────────
+
+# When true (default), private resources are auto-injected as depends_on.
+# auto_depends_on_private_requires: true
+
+
+# ─── SERVICES (REQUIRED) ───────────────────────────────────────────────────
+#
+# At least one service is required. Key = service name (slug rules).
+# Types: node, nextjs, python, static, cron.
+#
+services:
+  web:
+    # type (REQUIRED): node | nextjs | python | static | cron
+    type: nextjs
+    # HTTP route: '/' | '/api' | false (internal) | omitted (=false + warning).
+    # Only one service per entity can claim '/'.
+    path: /
+    # Container port (default 8080; read process.env.PORT). Not for cron.
+    # port: 3000
+    # nextjs only: base_image: distroless (default) | alpine
+    # base_image: distroless
+    # node only: lang: javascript (default) | typescript
+    # lang: typescript
+    # Custom source location (default services/<name>/). '.' = project root.
+    # source:
+    #   path: src/worker
+    # Health probe: false/omitted (TCP) | true (/health) | "/path" | {path,expected}
+    # health:
+    #   path: /api/health
+    #   expected: "200"
+    # Static runtime env vars (strings). Reserved: PORT, APP_NAME, SERVICE_NAME,
+    # NODE_ENV, MONGODB_URL, REDIS_URL, AI_GATEWAY_URL, N8N_WEBHOOK_URL, CLOUDGRID_*.
+    # env:
+    #   LOG_LEVEL: info
+    # Sibling services/private resources that must be Ready first (no cron, no cycles).
+    # depends_on:
+    #   - worker
+    # Per-service needs override (merges with app-level needs).
+    # needs:
+    #   queue: true
+    # Static-only build step:
+    # build:
+    #   command: npm run build
+    #   output: dist
+    #   env:
+    #     VITE_API_URL: https://api.example.com
+    # node_version: "22"          # static build step: '18'|'20'|'22'|'24' (quoted)
+    # Cron-only: schedule (REQUIRED), timezone (UTC|EST|PST), run (job | https URL)
+    # schedule: "0 9 * * 1"
+    # timezone: UTC
+    # run: job
+    # Verbose per-service persistence (prefer needs.disk):
+    # persist:
+    #   - name: scratch
+    #     path: /tmp/scratch
+    #     size: 500Mi
+
+
+
+needs:
+  database: true
+
+
+# ============================================================================
+# NOTES
+# - NOT here: org:/entity_id: (→ .cloudgrid/link.json), secrets (→ grid secrets set),
+#   Dockerfile (platform generates from services.*.type).
+# - Deploy: grid plug   |   Local with grid resources: grid dev
+# - Full reference: docs/cloudgrid-yaml-reference.md  |  CLI: docs/cli-reference.md
+# ============================================================================

package/src/corpus/templates/internal-tools-portal/index.md

@@ -0,0 +1,62 @@
+# Template: internal-tools-portal (blueprint — persistent Next.js + Mongo + auth)
+
+A **blueprint** for an internal tools portal / admin tools hub / back-office
+portal: a persistent Next.js app on CloudGrid backed by the grid-shared MongoDB,
+with staff-only auth via a provider SDK (Clerk or Auth0) whose keys come from the
+org vault, role-based access control (RBAC), and **each internal tool as its own
+route** under a shared authenticated shell. This ships the **structure +
+cloudgrid.yaml**, NOT filled app code — read `AGENTS.md` and build the app
+following it.
+
+**Key rules:**
+
+1. **This is a blueprint.** Fetch it, read `AGENTS.md` (file tree, Mongo
+   collections, CloudGrid wiring, RBAC, deploy flow), then build the app under
+   `services/web/`. There is no ready-made app code to copy.
+2. **Service code MUST live under `services/<name>/`, not the repo root.**
+   `path:` in `cloudgrid.yaml` is the URL mount, NOT the filesystem path. The
+   service named `web` → the CLI looks for `services/web/`.
+3. **Declare the datastore with `needs: { database: true }`** — the deployer
+   provisions Mongo and injects `DATABASE_MONGODB_URL` (plus the legacy
+   `MONGODB_URL` alias). Read it lazily inside a getter, never at module top
+   level (a top-level read fails `next build`). `requires:` is the deprecated v1
+   alias; never set `needs:` and `requires:` together.
+4. **Auth secrets come from the `vault:` block, not committed env files.** The
+   yaml maps the provider's secret + publishable keys → env vars
+   (`AUTH_PROVIDER_SECRET_KEY`, `AUTH_PROVIDER_PUBLISHABLE_KEY`); the deployer
+   injects them at build + runtime. Create the vault items first.
+5. **Every tool is a route, gated server-side.** A tool registry (`lib/tools.js`)
+   maps tool id → `requiredRole`; roles live on the `staff` Mongo record. The hub
+   hides cards as UX, but each tool page + API re-checks the role server-side —
+   the hidden card is never the security boundary.
+
+Runtime app → **local edition only**, async deploy (poll to a live URL).
+
+## Fetch bundle
+
+Fetch this blueprint with `gridctl_fetch("template", "internal-tools-portal")`. It
+returns `cloudgrid.yaml`, `AGENTS.md` (the structure guide), and this README — no
+app code. Follow `AGENTS.md` to build, then `grid init → fill → grid plug → poll`.
+
+## cloudgrid.yaml
+
+```yaml
+# On disk this file is the full-annotated reference (templates/_cloudgrid.yaml.reference) with EVERY
+# field present as a comment; only the fields below are uncommented, so it
+# deploys to exactly these active fields.
+name: internal-tools-portal
+services:
+  web:
+    type: nextjs
+    path: /
+vault:
+  AUTH_PROVIDER_SECRET_KEY: auth-provider-secret-key
+  AUTH_PROVIDER_PUBLISHABLE_KEY: auth-provider-publishable-key
+needs:
+  database: true
+```
+
+> **Capability:** `needs: { database: true }` → the deployer provisions Mongo and
+> injects `DATABASE_MONGODB_URL` (plus the legacy `MONGODB_URL` alias). The
+> `vault:` block injects the auth provider's keys as env vars. `requires:` is the
+> deprecated v1 alias — don't mix it with `needs:`.

package/src/corpus/templates/inventory/README.md

@@ -0,0 +1,71 @@
+# inventory template — persistent Next.js + Mongo inventory / stock tracker
+
+A real, deployable inventory / stock tracker. Inventory live in the grid-shared MongoDB, so they
+survive refresh and are shared across users/sessions. Same proven shape as
+`app-with-data`, adapted to an `items` domain (sku, name, qty, location, reorder_at) with a table view, per-row quantity adjustments, and a low-stock flag.
+
+## How the grid gives you a database
+
+You do **not** provision a database or set a connection string. In
+`cloudgrid.yaml` you declare `needs: { database: true }`, and the grid:
+
+- provisions shared Mongo for the app, and
+- injects the connection string as the **`DATABASE_MONGODB_URL`** environment
+  variable (plus the legacy `MONGODB_URL` alias) — at dev-time (`grid dev`) and
+  at runtime (after `grid plug`).
+
+The app reads it via `process.env.DATABASE_MONGODB_URL` (with a legacy
+`process.env.MONGODB_URL` fallback) in `services/web/lib/db.js` — **lazily,
+inside the `getDb` getter, never at module top level** (a top-level read fails
+`next build`, which imports the module for route analysis before the grid injects
+the var). Never hardcode a connection string; never commit a secret.
+
+> **Declare `needs: { database: true }` (the canonical shape).** The deployer
+> provisions Mongo and injects `DATABASE_MONGODB_URL` (plus the legacy
+> `MONGODB_URL` alias). `requires:` is the deprecated v1 alias — don't author new
+> yaml with it, and never set `needs:` and `requires:` together (the validator
+> rejects the combination).
+
+## Service layout
+
+App code lives under **`services/web/`**, not the template root. `path:` in
+`cloudgrid.yaml` is the URL mount, not the filesystem path — the service named
+`web` means the CLI looks for `services/web/`. Files at the root fail with
+`Error: Service directory not found: …/services/web`.
+
+## Run locally
+
+```bash
+npm install
+grid dev          # runs Next.js with DATABASE_MONGODB_URL injected against dev Mongo
+```
+
+## Deploy
+
+```bash
+grid plug         # builds + deploys the folder (async — poll status until live)
+```
+
+A runtime deploy is asynchronous: `plug` returns `status: building`; poll status
+until the app is live, then use the returned live URL. Re-plug the same entity
+to update the same URL.
+
+## File tree
+
+```
+cloudgrid.yaml                             # full-annotated reference; active: name + services.web (nextjs) + needs: { database: true }
+services/web/package.json                  # next, react, react-dom, mongodb driver only
+services/web/lib/db.js                     # lazy Mongo client from DATABASE_MONGODB_URL (legacy MONGODB_URL fallback)
+services/web/app/layout.js                 # root layout + inline CSS
+services/web/app/page.js                   # server component: reads items from Mongo
+services/web/app/inventory-manager.js      # client table: POST / PATCH (adjust qty) / DELETE via the API
+services/web/app/api/items/route.js                 # GET (list) / POST (add) / PATCH (adjust qty) / DELETE (remove)
+```
+
+## Adapt it
+
+- Rename the `items` collection in `services/web/app/api/items/route.js`
+  and `services/web/app/page.js` (e.g. `parts`, `assets`).
+- Change the document fields (units, suppliers, cost, reorder thresholds, timestamps).
+- Add more routes/collections as the app grows.
+- Add `cache: true` to `needs:` only if you actually need Redis.