@cloudgrid-io/mcp 0.13.0 → 0.14.0

package/src/corpus/templates/membership-site/AGENTS.md

@@ -0,0 +1,160 @@
+# AGENTS.md — membership-site (BLUEPRINT)
+
+This is a **blueprint**, not runnable code. It tells an agent how to build a
+paid membership site correctly on CloudGrid: a Next.js app with auth, Stripe
+subscription checkout, gated content routes that check membership status, and
+Mongo for persistence. Read this whole file, then build the app under
+`services/web/` following the structure below. Do not skip the CloudGrid wiring
+rules — they are what make it deploy.
+
+The proven persistent shape is `app-with-data` (Next.js + Mongo). This blueprint
+extends it with auth + Stripe. Fetch that template for the Mongo lazy-client and
+App-Router API pattern: `gridctl_fetch("template", "app-with-data")`.
+
+## 1. File tree
+
+Build exactly this layout. **App code MUST live under `services/web/`** — the
+service is named `web`, so the CLI looks for `services/web/`. `path: /` in
+`cloudgrid.yaml` is the URL mount, NOT the filesystem path. Files at the repo
+root fail with `Error: Service directory not found: …/services/web`.
+
+```
+cloudgrid.yaml                                 # name + services.web (nextjs) + needs:{database:true} + vault: (Stripe/auth secrets)
+services/web/package.json                      # next, react, react-dom, mongodb, stripe, + auth SDK (e.g. @clerk/nextjs)
+services/web/middleware.js                     # auth middleware: protects /members/* — redirects anon to sign-in
+services/web/lib/db.js                         # lazy Mongo client from DATABASE_MONGODB_URL (legacy MONGODB_URL fallback)
+services/web/lib/stripe.js                     # lazy Stripe client from process.env.STRIPE_KEY (never top-level)
+services/web/lib/membership.js                 # getMembership(userId): read status from the memberships collection
+services/web/app/layout.js                     # root layout (+ auth provider wrapper if the SDK needs one)
+services/web/app/page.js                       # public marketing / paywall landing page + "Subscribe" CTA
+services/web/app/members/layout.js             # gate: server-side check membership status; redirect non-members to /pricing
+services/web/app/members/page.js               # gated subscriber content (only active members reach it)
+services/web/app/pricing/page.js               # plans + "Subscribe" button → POST /api/checkout
+services/web/app/api/checkout/route.js         # POST: create a Stripe Checkout Session (mode: subscription) → return url
+services/web/app/api/webhook/route.js          # POST: Stripe webhook — upsert membership status on subscription events
+services/web/app/api/me/route.js               # GET: current user's membership status (for client components)
+```
+
+## 2. Mongo collections + fields
+
+The grid provisions Mongo from `needs: { database: true }`. Use two collections:
+
+**`users`** — mirror of the auth provider's user (only if you store profile data
+locally; many auth SDKs own the identity, so this may be optional).
+- `_id` (ObjectId)
+- `authId` (string) — the auth provider's user id (Clerk/Auth0 `sub`)
+- `email` (string)
+- `createdAt` (Date)
+
+**`memberships`** — the source of truth for who is a paying member. Gating reads
+this, and the Stripe webhook writes it.
+- `_id` (ObjectId)
+- `authId` (string, indexed) — links to the signed-in user
+- `stripeCustomerId` (string)
+- `stripeSubscriptionId` (string)
+- `plan` (string) — e.g. `"monthly"`, `"annual"`
+- `status` (string) — `"active" | "trialing" | "past_due" | "canceled"`
+- `currentPeriodEnd` (Date) — when access lapses if not renewed
+- `updatedAt` (Date)
+
+A user is a member when a `memberships` doc for their `authId` has
+`status ∈ {active, trialing}` and `currentPeriodEnd` is in the future.
+
+## 3. How CloudGrid injects everything (the wiring that matters)
+
+- **Mongo** — declared by `needs: { database: true }`. The deployer provisions
+  shared Mongo and injects the connection string as **`DATABASE_MONGODB_URL`**
+  (plus the legacy **`MONGODB_URL`** alias) at runtime and under `grid dev`.
+  Read `process.env.DATABASE_MONGODB_URL || process.env.MONGODB_URL` **LAZILY,
+  inside the getter** in `lib/db.js` — never at module top level, or `next build`
+  fails when it imports the module for route analysis before the grid injects
+  the var. Never hardcode a connection string. Never set `needs:` and `requires:`
+  together — `requires:` is the deprecated v1 alias.
+- **Secrets (Stripe + auth) → env vars via the `vault:` block.** In
+  `cloudgrid.yaml` the `vault:` block maps each env var to a vault item key:
+  ```yaml
+  vault:
+    STRIPE_KEY: stripe-live-key
+    STRIPE_WEBHOOK_SECRET: stripe-webhook-secret
+    AUTH_PROVIDER_KEY: auth-provider-key
+  ```
+  Set the vault items ONCE with `gridctl_secrets` (or `grid secrets set`), then
+  the deployer injects each as the named env var (`process.env.STRIPE_KEY`, etc.)
+  at runtime and under `grid dev`. Do NOT commit keys; do NOT set them in
+  `services.web.env` (that block is for non-secret config only). Read them
+  lazily inside `lib/stripe.js` and the auth setup — same rule as the DB.
+- **Public auth keys** — SDKs like Clerk also need a *publishable* key on the
+  client (`NEXT_PUBLIC_...`). Publishable keys are not secret; put them in the
+  non-secret `services.web.env` block (or as a build-time env) rather than the
+  vault.
+- **AI (optional)** — if you add AI features, declare `needs: { ai: true }` and
+  call the gateway at `process.env.AI_GATEWAY_URL` via `@cloudgrid-io/ai`. Not
+  required for this blueprint.
+
+## 4. Wiring auth + payments
+
+**Auth (provider SDK, e.g. Clerk or Auth0).**
+1. Add the SDK to `services/web/package.json` (e.g. `@clerk/nextjs`).
+2. Server key from the vault (`process.env.AUTH_PROVIDER_KEY`); publishable key
+   from `services.web.env` as `NEXT_PUBLIC_...`.
+3. Wrap the app in the provider in `app/layout.js`.
+4. `services/web/middleware.js` protects `/members/*` (and `/api/checkout`) —
+   the SDK's middleware redirects unauthenticated users to sign-in. Auth answers
+   "who are you"; it does NOT answer "have you paid" — that is the membership
+   check below.
+
+**Payments (Stripe subscriptions).**
+1. Add `stripe` to `package.json`. Build a lazy Stripe client in `lib/stripe.js`
+   reading `process.env.STRIPE_KEY` inside the getter.
+2. **Checkout** — `app/api/checkout/route.js` (POST): require an authenticated
+   user (from the auth SDK), create a Stripe Checkout Session with
+   `mode: "subscription"` and your price id, set `success_url` /`cancel_url`,
+   stash `authId` in the session `metadata`, return `session.url`. The pricing
+   page's Subscribe button POSTs here and redirects the browser to the returned
+   URL.
+3. **Webhook** — `app/api/webhook/route.js` (POST): the source of truth for
+   membership. Verify the signature with `process.env.STRIPE_WEBHOOK_SECRET`
+   (read the RAW request body — do not JSON-parse before verifying). On
+   `checkout.session.completed`, `customer.subscription.updated`, and
+   `customer.subscription.deleted`, upsert the `memberships` doc keyed by
+   `authId` with the new `status` / `currentPeriodEnd`. Register this route's
+   public URL as the webhook endpoint in the Stripe dashboard after deploy.
+
+**Gating (the membership check).**
+- `lib/membership.js` exports `getMembership(authId)` → reads the `memberships`
+  collection and returns whether the user is active.
+- `app/members/layout.js` is a server component: get the signed-in `authId`,
+  call `getMembership`, and if not active `redirect("/pricing")`. Every route
+  under `/members/*` is gated by this layout — content only renders for paying
+  members. Do the check server-side; never gate purely on the client.
+
+## 5. Deploy steps
+
+1. `gridctl_login_status` → `gridctl_login` if needed. Respect the grid picker
+   (ask which grid if the user has more than one).
+2. `gridctl_init` an app `<name>` FIRST — it creates the entity, writes
+   `.cloudgrid/link.json`, and a `cloudgrid.yaml` with empty `services: {}`.
+   `plug` needs a linked directory.
+3. Write the app under `services/web/` and set `cloudgrid.yaml` to the active
+   shape: `name` + `services.web{type: nextjs, path: /}` + `needs:{database:true}`
+   + the `vault:` block.
+4. Set the secrets: `gridctl_secrets` for `stripe-live-key`,
+   `stripe-webhook-secret`, `auth-provider-key` (the vault item keys the
+   `vault:` block maps from). Non-secret config (publishable auth key, price id)
+   → `gridctl_env` / `services.web.env`. Do NOT set `DATABASE_MONGODB_URL`
+   yourself — the grid injects it.
+5. `gridctl_plug` to deploy. A runtime deploy is **ASYNC** — the first response
+   is `status: building`, not a live URL. Poll `gridctl_status` (or the returned
+   poll_url) until live; surface a liveness signal while it builds, never a bare
+   silent wait.
+6. Once live, add the `/api/webhook` URL as the Stripe webhook endpoint and copy
+   the signing secret into the `stripe-webhook-secret` vault item, then re-plug.
+   Return the live app URL (not the build/log link).
+
+## 6. Edition note
+
+A membership site is a built + deployed runtime container, so it requires the
+**local edition** (Claude Desktop / Claude Code) or the CLI. The **hosted**
+edition (Claude Web / hosted MCP) is inline-only and can only publish static
+pages — it CANNOT build this app. On hosted, say so plainly and offer a static
+paywall-landing page (via `gridctl_drop`) instead, then stop the runtime path.

package/src/corpus/templates/membership-site/README.md

@@ -0,0 +1,18 @@
+# membership-site template — BLUEPRINT
+
+A paid membership / subscriber-content site: a Next.js app with user auth,
+Stripe subscription checkout, gated routes that check membership status, and
+grid-shared Mongo for persistence. This is a **blueprint** — it ships the
+`cloudgrid.yaml` and a structure guide (`AGENTS.md`), not finished app code. Read
+`AGENTS.md` for the file tree, Mongo collections, and the CloudGrid wiring
+(Mongo via `needs:{database:true}` → `DATABASE_MONGODB_URL`; Stripe/auth secrets
+via the `vault:` block → env vars), then build the app under `services/web/`
+following it, adapt the plans/content/fields to the user, and deploy (async —
+poll to a live URL). It requires the local edition.
+
+- `cloudgrid.yaml` — active: `name` + `services.web{type: nextjs, path: /}` +
+  `needs:{database:true}` + `vault:` (Stripe + auth secrets → env vars).
+- `AGENTS.md` — the structure guide: file tree, collections, CloudGrid injection,
+  auth + Stripe wiring, deploy steps, edition note.
+
+**blueprint: structure + cloudgrid.yaml, adapt and build.**

package/src/corpus/templates/membership-site/cloudgrid.yaml

@@ -0,0 +1,236 @@
+# ============================================================================
+# cloudgrid.yaml — Complete Example
+# ============================================================================
+#
+# This file shows EVERY field the platform supports, with comments explaining
+# each one. It is a reference — no real project would use all of these at once.
+#
+# STANDARD: every CloudGrid template ships its cloudgrid.yaml in THIS full form.
+# Uncomment ONLY the fields the archetype needs (always: name + services; plus
+# needs: for runtime apps). Leave everything else commented. Comments are
+# ignored by the parser, so the file deploys to exactly the active fields.
+#
+# Only two fields are required: name and services. Everything else is optional.
+# Full docs: docs/cloudgrid-yaml-reference.md
+# ============================================================================
+
+
+# ─── IDENTITY ───────────────────────────────────────────────────────────────
+
+# Entity slug (REQUIRED). 2-42 chars, lowercase alphanumeric + hyphens.
+# Must start and end with a letter or digit.
+# Becomes part of your public URL: <name>-<4hex>.<org>.cloudgrid.io
+name: membership-site
+
+# One-line summary. Max 280 chars. If omitted, Grid Brain auto-generates one.
+# description: Order processing API for the e-commerce platform
+
+# Single emoji or short text shown as the entity icon. Max 64 chars.
+# icon: "📦"
+
+# Entity type: 'app' (default) or 'agent'. An agent is an app with an agent: block.
+# kind: app
+
+
+# ─── NETWORKING ─────────────────────────────────────────────────────────────
+
+# Whether this entity serves public HTTP traffic.
+# true = public URL + Ingress (default). false = internal only.
+# expose: true
+
+# Additional domain names this entity serves on (the platform URL is always active).
+# custom_domains:
+#   - orders.example.com
+#   - shop.example.com
+
+
+# ─── HEALTH PROBE (entity-level override) ──────────────────────────────────
+
+# Override the default health check for the entire entity.
+# probe:
+#   path: /healthz               # HTTP path to probe (default: /).
+#   expected: "<500"             # '<500' (default), '200', '2xx'.
+
+
+# ─── DEPLOY NOTIFICATIONS ──────────────────────────────────────────────────
+
+# Slack notification to the org's default channel on deploy failure.
+# true = notify (default), false = silent.
+# notify: true
+
+
+# ─── SCALING ────────────────────────────────────────────────────────────────
+
+# Replica scaling intent.
+#   'auto'  — platform decides from the grid tier (default).
+#   'alert' — single-replica, emit a SPOF warning at plug time.
+#   1-10    — explicit replica count, clamped to the grid max.
+# scale: auto
+
+
+# ─── INFRASTRUCTURE NEEDS ──────────────────────────────────────────────────
+#
+# Declare infrastructure; the platform provisions it and injects connection
+# details as env vars. Nine needs: database, cache, kv, queue, pubsub, vector,
+# object_storage, disk, ai. Simplest form is `true`.
+#
+# needs:
+#   # database — MongoDB. Injects DATABASE_MONGODB_URL (+ legacy MONGODB_URL).
+#   #   true | pool | dedicated | { tier: external, secret: MY_DB }
+#   database: true
+#   # cache — Redis, LRU eviction (derived data). Injects CACHE_REDIS_URL (+ REDIS_URL).
+#   #   true | redis | { engine: external, secret: MY_REDIS_URL }
+#   cache: true
+#   # kv — Redis, no eviction (durable: flags, idempotency). Injects KV_REDIS_URL.
+#   kv: true
+#   # queue — Redis job-queue substrate (BullMQ). Injects QUEUE_REDIS_URL.
+#   queue: true
+#   # pubsub — Redis broadcast pub/sub. Injects PUBSUB_REDIS_URL.
+#   pubsub: true
+#   # vector — pgvector on Postgres. Injects VECTOR_PGVECTOR_URL (+ PGVECTOR_URL).
+#   #   true | pgvector | { engine: pgvector, dim: 1536 }
+#   vector: pgvector
+#   # object_storage — GCS bucket. Injects OBJECT_STORAGE_GCS_BUCKET, _GCS_REGION.
+#   #   true | { size: 10Gi }
+#   object_storage: true
+#   # disk — persistent FS mount (PVC). Injects DISK_PATH. Pins to 1 replica.
+#   #   true | { size: 1Gi, mount: /var/data }  (forbidden: /proc /sys /dev)
+#   disk: true
+#   # ai — AI Gateway via @cloudgrid-io/ai. Injects AI_GATEWAY_URL. true | false.
+#   ai: true
+
+
+# ─── INTER-ENTITY COMMUNICATION ────────────────────────────────────────────
+
+# Entities this app calls (outbound). Service-account token injected per pair.
+# calls:
+#   - org:atomic/billing-api
+
+# Inbound caller policy — who can call YOUR entity.
+# callers:
+#   policy: auto                 # 'auto' | 'manual' (default).
+#   scope: org                   # 'org' (default) | 'space' | 'explicit'.
+#   fallback: deny               # 'deny' (default) | 'warn'.
+#   # allowed_apps:              # required only when scope: explicit
+#   #   - org:atomic/frontend
+
+
+# ─── VAULT ──────────────────────────────────────────────────────────────────
+
+# Map org vault items to env vars. Keys UPPER_SNAKE_CASE; values = vault item keys.
+# Auth + Stripe subscriptions need secrets injected as env vars — this is the
+# CloudGrid-correct way. Set the vault items once (grid secrets set), then the
+# deployer injects each as the named env var at runtime and under `grid dev`.
+vault:
+  STRIPE_KEY: stripe-live-key                  # Stripe secret key (server-side checkout + subscription mgmt)
+  STRIPE_WEBHOOK_SECRET: stripe-webhook-secret # verifies Stripe webhook signatures
+  AUTH_PROVIDER_KEY: auth-provider-key         # auth SDK server key (e.g. Clerk secret / Auth0 client secret)
+
+
+# ─── CONNECTORS AND HOOKS ──────────────────────────────────────────────────
+
+# connectors:
+#   - id: team-slack
+#     target: org                # 'system' | 'org'.
+#     channel: "#deploys"
+# hooks:
+#   - on: deploy.failed          # release.published | deploy.failed | feedback.received | entity.created
+#     via: team-slack
+#     template: "Deploy failed for {entity_name}: {error}"
+#     channel: "#alerts"
+# triggers:
+#   - from: team-slack
+#     event: message
+#     channel: "#support"
+#     route: /webhooks/slack
+
+
+# ─── LOCAL DEVELOPMENT ──────────────────────────────────────────────────────
+
+# Config for `grid dev`. Redact fields in dev data snapshots.
+# dev:
+#   snapshot:
+#     mask:
+#       - users.email
+#       - users.phone
+
+
+# ─── AGENT METADATA ────────────────────────────────────────────────────────
+
+# An agent is an app with kind: agent (above) and an agent: block.
+# agent:
+#   purpose: Sync customer data from external CRM every night
+#   schedule: "0 2 * * *"
+#   trigger: webhook
+
+
+# ─── PRIVATE RESOURCE AUTO-DEPENDENCIES ────────────────────────────────────
+
+# When true (default), private resources are auto-injected as depends_on.
+# auto_depends_on_private_requires: true
+
+
+# ─── SERVICES (REQUIRED) ───────────────────────────────────────────────────
+#
+# At least one service is required. Key = service name (slug rules).
+# Types: node, nextjs, python, static, cron.
+#
+services:
+  web:
+    # type (REQUIRED): node | nextjs | python | static | cron
+    type: nextjs
+    # HTTP route: '/' | '/api' | false (internal) | omitted (=false + warning).
+    # Only one service per entity can claim '/'.
+    path: /
+    # Container port (default 8080; read process.env.PORT). Not for cron.
+    # port: 3000
+    # nextjs only: base_image: distroless (default) | alpine
+    # base_image: distroless
+    # node only: lang: javascript (default) | typescript
+    # lang: typescript
+    # Custom source location (default services/<name>/). '.' = project root.
+    # source:
+    #   path: src/worker
+    # Health probe: false/omitted (TCP) | true (/health) | "/path" | {path,expected}
+    # health:
+    #   path: /api/health
+    #   expected: "200"
+    # Static runtime env vars (strings). Reserved: PORT, APP_NAME, SERVICE_NAME,
+    # NODE_ENV, MONGODB_URL, REDIS_URL, AI_GATEWAY_URL, N8N_WEBHOOK_URL, CLOUDGRID_*.
+    # env:
+    #   LOG_LEVEL: info
+    # Sibling services/private resources that must be Ready first (no cron, no cycles).
+    # depends_on:
+    #   - worker
+    # Per-service needs override (merges with app-level needs).
+    # needs:
+    #   queue: true
+    # Static-only build step:
+    # build:
+    #   command: npm run build
+    #   output: dist
+    #   env:
+    #     VITE_API_URL: https://api.example.com
+    # node_version: "22"          # static build step: '18'|'20'|'22'|'24' (quoted)
+    # Cron-only: schedule (REQUIRED), timezone (UTC|EST|PST), run (job | https URL)
+    # schedule: "0 9 * * 1"
+    # timezone: UTC
+    # run: job
+    # Verbose per-service persistence (prefer needs.disk):
+    # persist:
+    #   - name: scratch
+    #     path: /tmp/scratch
+    #     size: 500Mi
+
+
+needs:
+  database: true
+
+
+# ============================================================================
+# NOTES
+# - NOT here: org:/entity_id: (→ .cloudgrid/link.json), secrets (→ grid secrets set),
+#   Dockerfile (platform generates from services.*.type).
+# - Deploy: grid plug   |   Local with grid resources: grid dev
+# - Full reference: docs/cloudgrid-yaml-reference.md  |  CLI: docs/cli-reference.md
+# ============================================================================

package/src/corpus/templates/membership-site/index.md

@@ -0,0 +1,66 @@
+# Template: membership-site (BLUEPRINT — Next.js + auth + Stripe + Mongo)
+
+A paid membership / subscriber-content site. **Blueprint, not finished code**:
+it ships the `cloudgrid.yaml` and a structure guide (`AGENTS.md`) so an agent
+can build it correctly on CloudGrid — a Next.js app with user auth, Stripe
+subscription checkout, gated `/members/*` routes that check membership status,
+and grid-shared Mongo. Read `AGENTS.md`, build the app under `services/web/`,
+adapt plans/content/fields, then deploy (async — poll to a live URL). Local
+edition only.
+
+**Fetch the bundle:**
+- `gridctl_fetch("template", "membership-site")` — this blueprint (`cloudgrid.yaml` + `AGENTS.md`).
+- `gridctl_fetch("template", "app-with-data")` — the proven Next.js + Mongo shape to extend (lazy db client, App-Router API).
+
+**Key rules:**
+
+1. **Blueprint — read `AGENTS.md` first.** It has the file tree, Mongo
+   collections (`users`, `memberships`), CloudGrid injection table, and the
+   auth + Stripe wiring. Build following it; do not invent structure.
+2. **App code MUST live under `services/web/`.** `path: /` is the URL mount, NOT
+   the filesystem path. Root files fail with `Service directory not found`.
+3. **Mongo via `needs:{database:true}`** → the grid injects
+   `DATABASE_MONGODB_URL` (legacy `MONGODB_URL` fallback). Read it LAZILY inside
+   the getter, never at module top level (top-level read fails `next build`).
+4. **Secrets via the `vault:` block** → env vars. `STRIPE_KEY`,
+   `STRIPE_WEBHOOK_SECRET`, `AUTH_PROVIDER_KEY` map to vault items; set them with
+   `gridctl_secrets`, and the deployer injects them at runtime. Read lazily; do
+   not commit keys or put secrets in `services.web.env`.
+5. **Gate server-side.** Auth answers "who are you"; the `memberships`
+   collection answers "have you paid". `app/members/layout.js` checks membership
+   status server-side and redirects non-members to `/pricing`. The Stripe
+   webhook (`/api/webhook`) is the source of truth that writes membership status.
+6. **Never set `needs:` and `requires:` together** — `requires:` is the
+   deprecated v1 alias.
+
+## cloudgrid.yaml (active fields)
+
+```yaml
+# On disk this file is the full-annotated reference (templates/_cloudgrid.yaml.reference) with EVERY
+# field present as a comment; only the fields below are uncommented, so it
+# deploys to exactly these active fields.
+name: membership-site
+services:
+  web:
+    type: nextjs
+    path: /
+needs:
+  database: true
+vault:
+  STRIPE_KEY: stripe-live-key
+  STRIPE_WEBHOOK_SECRET: stripe-webhook-secret
+  AUTH_PROVIDER_KEY: auth-provider-key
+```
+
+> **Capability:** `needs: { database: true }` → the deployer provisions Mongo and
+> injects `DATABASE_MONGODB_URL` (+ legacy `MONGODB_URL`). The `vault:` block maps
+> Stripe/auth secrets to env vars — the CloudGrid-correct way to inject
+> credentials. `requires:` is the deprecated v1 alias; don't mix it with `needs:`.
+> See the capability-map for the full injection table.
+
+## Deploy (async, local edition)
+
+`gridctl_init` first (creates the entity + link.json), write the app under
+`services/web/`, set the vault secrets with `gridctl_secrets`, `gridctl_plug`
+(async — poll `gridctl_status` to a live URL), then register the `/api/webhook`
+URL in Stripe and re-plug. Re-plug the same entity to update the same URL.

package/src/corpus/templates/monitoring-dashboard/README.md

@@ -0,0 +1,84 @@
+# monitoring-dashboard template — service health board (Next.js + Mongo)
+
+A real, deployable monitoring dashboard: a status grid of your services plus a
+recent-history table, all backed by grid-shared MongoDB. A **check** is a health
+sample — `{ service, status (up/degraded/down), latencyMs, at }`. You POST checks
+and the board derives the current status (latest check per service) and shows the
+rolling history. Data survives refresh and is shared across users/sessions —
+unlike a static page whose state is in memory only.
+
+## How the grid gives you a database
+
+You do **not** provision a database or set a connection string. In
+`cloudgrid.yaml` you declare `needs: { database: true }`, and the grid:
+
+- provisions shared Mongo for the app, and
+- injects the connection string as the **`DATABASE_MONGODB_URL`** environment
+  variable (plus the legacy `MONGODB_URL` alias) — at dev-time (`grid dev`) and
+  at runtime (after `grid plug`).
+
+The app reads it via `process.env.DATABASE_MONGODB_URL` (with a legacy
+`process.env.MONGODB_URL` fallback) in `services/web/lib/db.js` — **lazily,
+inside the `getDb` getter, never at module top level** (a top-level read fails
+`next build`, which imports the module for route analysis before the grid injects
+the var). Never hardcode a connection string; never commit a secret.
+
+> **Declare `needs: { database: true }` (the canonical shape).** The deployer
+> provisions Mongo and injects `DATABASE_MONGODB_URL` (plus the legacy
+> `MONGODB_URL` alias). `requires:` is the deprecated v1 alias — don't author new
+> yaml with it, and never set `needs:` and `requires:` together (the validator
+> rejects the combination).
+
+## Service layout
+
+App code lives under **`services/web/`**, not the template root. `path:` in
+`cloudgrid.yaml` is the URL mount, not the filesystem path — the service named
+`web` means the CLI looks for `services/web/`. Files at the root fail with
+`Error: Service directory not found: …/services/web`.
+
+## The domain
+
+- Collection: **`checks`**. Document: `{ service, status, latencyMs, at }`.
+- `status` is one of `up`, `degraded`, `down` (validated server-side).
+- `latencyMs` is an optional non-negative number.
+- `at` is a server-set `Date`.
+- **Status grid** = the latest check per service (derived on the server, and
+  recomputed on the client after each POST).
+- **History** = the most recent 200 checks, newest first.
+
+## Run locally
+
+```bash
+npm install
+grid dev          # runs Next.js with DATABASE_MONGODB_URL injected against dev Mongo
+```
+
+## Deploy
+
+```bash
+grid plug         # builds + deploys the folder (async — poll status until live)
+```
+
+A runtime deploy is asynchronous: `plug` returns `status: building`; poll status
+until the app is live, then use the returned live URL. Re-plug the same entity
+to update the same URL.
+
+## File tree
+
+```
+cloudgrid.yaml                          # name + services.web (nextjs) + needs: { database: true }
+services/web/package.json               # next, react, react-dom, mongodb driver only
+services/web/lib/db.js                  # lazy Mongo client from DATABASE_MONGODB_URL (legacy MONGODB_URL fallback)
+services/web/app/layout.js              # root layout + inline CSS
+services/web/app/page.js                # server component: reads checks, derives status grid
+services/web/app/check-form.js          # client form + status grid + history table
+services/web/app/api/checks/route.js    # GET (list) / POST (record) / DELETE (remove)
+```
+
+## Adapt it
+
+- Rename the `checks` collection in `services/web/app/api/checks/route.js` and
+  `services/web/app/page.js` (e.g. `pings`, `incidents`, `samples`).
+- Change the document fields (add `region`, `endpoint`, `httpStatus`).
+- Add an uptime percentage or a sparkline from the history.
+- Add `cache: true` to `needs:` only if you actually need Redis.