@cloudgrid-io/mcp 0.13.0 → 0.15.0

package/src/corpus/templates/lms/AGENTS.md

@@ -0,0 +1,193 @@
+# AGENTS.md — lms (blueprint)
+
+This is a **blueprint**, not runnable app code. It is the structure guide an agent
+follows to build a learning management system (LMS) on CloudGrid: a training
+platform where instructors publish courses (organized into modules and lessons),
+students enroll and work through them, and instructors grade submissions and track
+progress. Role-based auth (instructor vs. student) is the spine of the whole app.
+
+The `cloudgrid.yaml` in this directory is complete and correct — copy it as-is.
+Everything below tells you WHAT to build under `services/web/` and HOW CloudGrid
+wires it together. Build the app following this; do not expect the code to exist.
+
+---
+
+## 1. File tree (build this under `services/web/`)
+
+App code MUST live under `services/<service-name>/`. The service is named `web`,
+so the CLI looks in `services/web/`. `path: /` in `cloudgrid.yaml` is the URL
+mount, NOT the filesystem path. Files at the project root fail with
+`Error: Service directory not found: …/services/web`.
+
+```
+cloudgrid.yaml                                    # this dir — name + vault + services.web(nextjs) + needs:{database:true}
+services/web/package.json                         # next, react, react-dom, mongodb, + auth SDK (e.g. @clerk/nextjs)
+services/web/middleware.js                        # auth middleware — protects /dashboard, /learn/*, /teach/* ; publishes session
+services/web/lib/db.js                            # LAZY Mongo client from DATABASE_MONGODB_URL (legacy MONGODB_URL fallback)
+services/web/lib/auth.js                          # helpers: getUserId(), getRole() from the auth provider session; requireRole()
+services/web/lib/enrollment.js                    # server guard: isEnrolled(userId, courseId); computeProgress(userId, courseId)
+services/web/app/layout.js                        # root layout + auth provider wrapper + inline CSS
+services/web/app/page.js                          # course catalog (server component: lists published courses from Mongo)
+services/web/app/courses/[slug]/page.js           # course detail + module/lesson outline; "Enroll" vs "Continue"
+services/web/app/learn/[courseSlug]/[lessonId]/page.js  # lesson player — GATED: redirect unless enrolled (student)
+services/web/app/dashboard/page.js                # student dashboard: enrolled courses + progress bars + grades
+services/web/app/teach/page.js                    # instructor dashboard — GATED to role=instructor: courses + submissions to grade
+services/web/app/api/courses/route.js             # GET list (public: published) / POST create (instructor only)
+services/web/app/api/modules/route.js             # GET modules+lessons for a course / POST add (instructor only)
+services/web/app/api/enrollments/route.js         # GET my enrollments / POST enroll student in a course
+services/web/app/api/progress/route.js            # POST mark-lesson-complete (upsert) ; GET course progress %
+services/web/app/api/submissions/route.js         # POST student submits assignment/quiz ; GET a student's submissions
+services/web/app/api/grades/route.js              # POST instructor grades a submission (score + feedback) ; GET a student's grades
+```
+
+Keep it a real Next.js App Router app (`next@^15`, `react@^19`). Only add
+dependencies you use: `mongodb` and one auth SDK (add `stripe` only if you sell
+paid courses — see §4).
+
+---
+
+## 2. Mongo collections + fields
+
+The grid provisions a shared MongoDB (`needs: { database: true }`). Suggested
+collections (adapt names/fields freely):
+
+- **`users`** — `{ _id, authId, name, email, role: "instructor" | "student",
+  createdAt }`. Mirrors the auth-provider user; `role` drives every gate. Upsert
+  on first login keyed by `authId`.
+- **`courses`** — `{ _id, slug, title, description, instructorId, published: bool,
+  createdAt }`. One document per course. `instructorId` = the owning instructor.
+- **`modules`** — `{ _id, courseId, title, order }`. A course is organized into
+  ordered modules (chapters/units).
+- **`lessons`** — `{ _id, moduleId, courseId, title, order, content, videoUrl,
+  isFreePreview: bool }`. Ordered lessons inside a module.
+- **`assignments`** — `{ _id, courseId, lessonId, title, prompt, maxScore }`.
+  A gradable task attached to a lesson (assignment or quiz).
+- **`enrollments`** — `{ _id, userId, courseId, enrolledAt }`. The access grant —
+  the lesson player and submission APIs check for it.
+- **`progress`** — `{ _id, userId, courseId, lessonId, completedAt }`. One doc per
+  student per completed lesson. Course progress % = `completed lessons / total lessons`.
+- **`submissions`** — `{ _id, userId, assignmentId, courseId, answer, submittedAt }`.
+  A student's work turned in for an assignment.
+- **`grades`** — `{ _id, submissionId, userId, assignmentId, courseId, score,
+  feedback, gradedBy, gradedAt }`. The instructor's grade for a submission.
+
+Add indexes: `users.authId` (unique), `courses.slug` (unique),
+`modules.courseId+order`, `lessons.moduleId+order`,
+`enrollments.userId+courseId` (unique), `progress.userId+lessonId` (unique),
+`submissions.userId+assignmentId` (unique).
+
+Two access rules the whole platform hinges on — **enforce both on the server**
+(in the page + API route), never only in the UI:
+- **A lesson is viewable if** `isFreePreview` OR an `enrollments` doc exists for
+  `(userId, courseId)`.
+- **Only `role: instructor`** may create courses/modules/lessons/assignments and
+  post grades. A student may only submit work and read their own grades/progress.
+
+---
+
+## 3. How CloudGrid injects everything
+
+You never provision infra or set connection strings by hand. Declared needs and
+vault items are injected as environment variables at `grid dev` (local) and at
+runtime (after `grid plug`).
+
+- **Mongo** — `needs: { database: true }` → the grid injects
+  **`DATABASE_MONGODB_URL`** (plus the legacy **`MONGODB_URL`** alias). Read
+  `process.env.DATABASE_MONGODB_URL || process.env.MONGODB_URL` **lazily inside a
+  getter** in `lib/db.js`. A top-level read (`const uri = process.env…; if (!uri)
+  throw`) breaks `next build`, which imports the module for route analysis before
+  the grid injects the var. Never hardcode a URI; never commit a secret.
+- **Secrets via the `vault:` block** — the block maps org vault items to env vars:
+  `AUTH_PROVIDER_KEY` ← `auth-provider-key` (the server-side auth secret that lets
+  you verify sessions and roles). Set each vault item ONCE with
+  `grid secrets set <item>` (e.g. `grid secrets set auth-provider-key`); the
+  platform injects it as the named env var. Read it lazily too (inside the auth
+  client getter in `lib/auth.js`), not at module top level. If you add paid
+  courses, map `STRIPE_KEY`/`STRIPE_WEBHOOK_SECRET` the same way.
+- **AI (optional — auto-grading / quiz generation / a study tutor)** — add
+  `needs: { ai: true }` → the grid injects **`AI_GATEWAY_URL`**; call it via
+  `@cloudgrid-io/ai`. Not enabled in this blueprint; add the need if you want it.
+
+Reserved env var names you must NOT set yourself: `PORT`, `NODE_ENV`,
+`DATABASE_MONGODB_URL`/`MONGODB_URL`, `AI_GATEWAY_URL`, `CLOUDGRID_*`.
+
+---
+
+## 4. Wiring auth (roles) + optional payments
+
+### Auth + roles (provider SDK) — the core of the LMS
+Use a hosted auth provider SDK (e.g. Clerk or Auth0) rather than rolling your own.
+Role-based access (instructor vs. student) is what separates an LMS from a plain
+content site, so wire it first.
+
+1. Add the SDK to `package.json` (e.g. `@clerk/nextjs`).
+2. Wrap `app/layout.js` in the provider; add `middleware.js` to protect
+   `/dashboard`, `/learn/*` (any signed-in user) and `/teach/*` (instructors only).
+3. The **publishable** key is a non-secret client env var → set it with
+   `grid env` (e.g. `grid env NEXT_PUBLIC_CLERK_PUBLISHABLE_KEY=…`). The **secret**
+   server key comes from the vault → `AUTH_PROVIDER_KEY` (mapped in `cloudgrid.yaml`),
+   read lazily in `lib/auth.js`.
+4. `lib/auth.js` exposes `getUserId()` and `getRole()` reading the provider's
+   server session, plus `requireRole("instructor")` that throws/redirects for
+   students. Every instructor-only API route (`/api/courses` POST,
+   `/api/modules` POST, `/api/grades` POST) calls `requireRole("instructor")`
+   server-side. Store the role on the `users` doc and/or in the provider's
+   user metadata; upsert the `users` doc on first login keyed by `authId`.
+
+### Grading flow (the LMS-specific loop)
+1. A student POSTs to `/api/submissions` (guarded by `isEnrolled`) to turn in an
+   assignment answer → one `submissions` doc per `(userId, assignmentId)`.
+2. The instructor sees ungraded submissions on `/teach`, and POSTs to
+   `/api/grades` (guarded by `requireRole("instructor")`) with `score` + `feedback`
+   → a `grades` doc referencing the `submissionId`. Never let a client set its own
+   score; derive `gradedBy` from the server session.
+3. The student reads their grades on `/dashboard` via `/api/grades` GET, scoped to
+   `getUserId()` so students only ever see their own grades.
+
+### Payments (Stripe) — OPTIONAL, only for paid courses
+If courses are sold rather than freely enrollable, add `stripe` to `package.json`
+and a `vault:` mapping for `STRIPE_KEY` + `STRIPE_WEBHOOK_SECRET`:
+1. `lib/stripe.js` builds the Stripe client lazily from `process.env.STRIPE_KEY`.
+2. **Checkout route** `app/api/checkout/route.js`: POST with a `courseId`, read the
+   course price server-side, create a Stripe Checkout Session (`payment` mode) with
+   `client_reference_id = userId` and `metadata.courseId`, return `session.url`.
+   Never trust a price sent from the client.
+3. **Webhook route** `app/api/webhooks/stripe/route.js`: verify the signature with
+   `STRIPE_WEBHOOK_SECRET` (`stripe.webhooks.constructEvent(rawBody, sig, secret)`
+   — read the RAW body, do not JSON-parse first). On `checkout.session.completed`,
+   upsert an `enrollments` doc. This webhook — not the checkout redirect — grants
+   access. Register the webhook URL (`https://<live-url>/api/webhooks/stripe`) in
+   the Stripe dashboard after the first deploy, then set `stripe-webhook-secret`.
+
+---
+
+## 5. Deploy steps
+
+A runtime deploy is **asynchronous** and requires the **local edition** (§6).
+
+1. **`grid init`** an app named `lms`. `init` creates the entity +
+   `.cloudgrid/link.json` and writes a `cloudgrid.yaml` with an empty
+   `services: {}`. Run it FIRST — `plug` needs a linked directory.
+2. **Fill** — replace the generated `cloudgrid.yaml` with the one in this template
+   (name + vault + `services.web` nextjs + `needs: { database: true }`), and write
+   the app under `services/web/` per the tree above.
+3. **Set secrets** — `grid secrets set auth-provider-key` (and, if selling courses,
+   `grid secrets set stripe-live-key` + `grid secrets set stripe-webhook-secret`).
+   Set non-secret client config with `grid env` (e.g. the auth publishable key).
+   Do NOT set the DB vars — the grid injects them.
+4. **`grid plug`** — builds + deploys `services/web/`. The first response is
+   `status: building`, NOT a live URL. Poll `grid status` (or the returned
+   poll_url) until it is live; surface a liveness signal while it builds, never a
+   bare silent wait. Only then return the live app URL.
+5. **Iterate** — re-plug the SAME entity so it updates the same URL. (If you added
+   Stripe, wire the webhook to the live URL first — §4.)
+
+---
+
+## 6. Edition note
+
+An LMS is a built + deployed **runtime** container. It requires the **local
+edition** (Claude Desktop / Claude Code) or the CLI. On the **hosted** edition
+(Claude Web / hosted MCP) you cannot build a runtime app — hosted is inline-only
+and can only publish static pages. If you are on hosted, say so plainly and stop
+the runtime path (a static course *landing* page is the only thing hosted can ship).

package/src/corpus/templates/lms/README.md

@@ -0,0 +1,27 @@
+# lms template — blueprint (structure + cloudgrid.yaml)
+
+A learning management system / training platform: instructors publish courses
+organized into modules and lessons, students enroll and progress through them,
+and instructors grade submissions and track each student's progress — a
+persistent Next.js + Mongo app with role-based (instructor/student) auth. This is
+a **blueprint**: it ships the correct `cloudgrid.yaml` and an `AGENTS.md`
+structure guide (file tree, Mongo collections, CloudGrid env/vault wiring, the
+auth-role + grading flow, deploy steps), not runnable app code. Adapt the
+structure and build the app under `services/web/`.
+
+## What's here
+
+- **`cloudgrid.yaml`** — full-annotated reference with only the active fields
+  uncommented: `name`, a `vault:` block (`AUTH_PROVIDER_KEY`), `services.web`
+  (type: nextjs, path: /), and `needs: { database: true }`. Copy it as-is.
+- **`AGENTS.md`** — the structure guide. Read it before building: it is the
+  CloudGrid-specific spec for the file tree, collections, secret injection, the
+  instructor/student role gates + grading loop, and the async runtime deploy.
+
+## Blueprint: structure + cloudgrid.yaml, adapt and build
+
+Read `AGENTS.md`, then build the app following it — put the code under
+`services/web/`, read `DATABASE_MONGODB_URL` (legacy `MONGODB_URL` fallback) and
+the vault-injected `AUTH_PROVIDER_KEY` lazily inside getters, enforce the
+instructor/student role gates on the server, declare `needs: { database: true }`,
+and deploy with `grid plug` (async — poll to a live URL; local edition only).

package/src/corpus/templates/lms/cloudgrid.yaml

@@ -0,0 +1,237 @@
+# ============================================================================
+# cloudgrid.yaml — Complete Example
+# ============================================================================
+#
+# This file shows EVERY field the platform supports, with comments explaining
+# each one. It is a reference — no real project would use all of these at once.
+#
+# STANDARD: every CloudGrid template ships its cloudgrid.yaml in THIS full form.
+# Uncomment ONLY the fields the archetype needs (always: name + services; plus
+# needs: for runtime apps). Leave everything else commented. Comments are
+# ignored by the parser, so the file deploys to exactly the active fields.
+#
+# Only two fields are required: name and services. Everything else is optional.
+# Full docs: docs/cloudgrid-yaml-reference.md
+# ============================================================================
+
+
+# ─── IDENTITY ───────────────────────────────────────────────────────────────
+
+# Entity slug (REQUIRED). 2-42 chars, lowercase alphanumeric + hyphens.
+# Must start and end with a letter or digit.
+# Becomes part of your public URL: <name>-<4hex>.<org>.cloudgrid.io
+name: lms
+
+# One-line summary. Max 280 chars. If omitted, Grid Brain auto-generates one.
+# description: Order processing API for the e-commerce platform
+
+# Single emoji or short text shown as the entity icon. Max 64 chars.
+# icon: "📦"
+
+# Entity type: 'app' (default) or 'agent'. An agent is an app with an agent: block.
+# kind: app
+
+
+# ─── NETWORKING ─────────────────────────────────────────────────────────────
+
+# Whether this entity serves public HTTP traffic.
+# true = public URL + Ingress (default). false = internal only.
+# expose: true
+
+# Additional domain names this entity serves on (the platform URL is always active).
+# custom_domains:
+#   - orders.example.com
+#   - shop.example.com
+
+
+# ─── HEALTH PROBE (entity-level override) ──────────────────────────────────
+
+# Override the default health check for the entire entity.
+# probe:
+#   path: /healthz               # HTTP path to probe (default: /).
+#   expected: "<500"             # '<500' (default), '200', '2xx'.
+
+
+# ─── DEPLOY NOTIFICATIONS ──────────────────────────────────────────────────
+
+# Slack notification to the org's default channel on deploy failure.
+# true = notify (default), false = silent.
+# notify: true
+
+
+# ─── SCALING ────────────────────────────────────────────────────────────────
+
+# Replica scaling intent.
+#   'auto'  — platform decides from the grid tier (default).
+#   'alert' — single-replica, emit a SPOF warning at plug time.
+#   1-10    — explicit replica count, clamped to the grid max.
+# scale: auto
+
+
+# ─── INFRASTRUCTURE NEEDS ──────────────────────────────────────────────────
+#
+# Declare infrastructure; the platform provisions it and injects connection
+# details as env vars. Nine needs: database, cache, kv, queue, pubsub, vector,
+# object_storage, disk, ai. Simplest form is `true`.
+#
+# needs:
+#   # database — MongoDB. Injects DATABASE_MONGODB_URL (+ legacy MONGODB_URL).
+#   #   true | pool | dedicated | { tier: external, secret: MY_DB }
+#   database: true
+#   # cache — Redis, LRU eviction (derived data). Injects CACHE_REDIS_URL (+ REDIS_URL).
+#   #   true | redis | { engine: external, secret: MY_REDIS_URL }
+#   cache: true
+#   # kv — Redis, no eviction (durable: flags, idempotency). Injects KV_REDIS_URL.
+#   kv: true
+#   # queue — Redis job-queue substrate (BullMQ). Injects QUEUE_REDIS_URL.
+#   queue: true
+#   # pubsub — Redis broadcast pub/sub. Injects PUBSUB_REDIS_URL.
+#   pubsub: true
+#   # vector — pgvector on Postgres. Injects VECTOR_PGVECTOR_URL (+ PGVECTOR_URL).
+#   #   true | pgvector | { engine: pgvector, dim: 1536 }
+#   vector: pgvector
+#   # object_storage — GCS bucket. Injects OBJECT_STORAGE_GCS_BUCKET, _GCS_REGION.
+#   #   true | { size: 10Gi }
+#   object_storage: true
+#   # disk — persistent FS mount (PVC). Injects DISK_PATH. Pins to 1 replica.
+#   #   true | { size: 1Gi, mount: /var/data }  (forbidden: /proc /sys /dev)
+#   disk: true
+#   # ai — AI Gateway via @cloudgrid-io/ai. Injects AI_GATEWAY_URL. true | false.
+#   ai: true
+
+
+# ─── INTER-ENTITY COMMUNICATION ────────────────────────────────────────────
+
+# Entities this app calls (outbound). Service-account token injected per pair.
+# calls:
+#   - org:atomic/billing-api
+
+# Inbound caller policy — who can call YOUR entity.
+# callers:
+#   policy: auto                 # 'auto' | 'manual' (default).
+#   scope: org                   # 'org' (default) | 'space' | 'explicit'.
+#   fallback: deny               # 'deny' (default) | 'warn'.
+#   # allowed_apps:              # required only when scope: explicit
+#   #   - org:atomic/frontend
+
+
+# ─── VAULT ──────────────────────────────────────────────────────────────────
+
+# Map org vault items to env vars. Keys UPPER_SNAKE_CASE; values = vault item keys.
+# AUTH_PROVIDER_KEY is the server-side secret for your auth provider (Clerk/Auth0),
+# used to enforce the instructor/student roles that gate the LMS. Set the vault
+# item once (`grid secrets set auth-provider-key`) and the platform injects it as
+# AUTH_PROVIDER_KEY. Read it lazily inside lib/auth.js, never at module top level.
+# (Optional: if you sell paid courses, also map STRIPE_KEY / STRIPE_WEBHOOK_SECRET
+# for the checkout + webhook routes — set stripe-live-key / stripe-webhook-secret.)
+vault:
+  AUTH_PROVIDER_KEY: auth-provider-key
+
+
+# ─── CONNECTORS AND HOOKS ──────────────────────────────────────────────────
+
+# connectors:
+#   - id: team-slack
+#     target: org                # 'system' | 'org'.
+#     channel: "#deploys"
+# hooks:
+#   - on: deploy.failed          # release.published | deploy.failed | feedback.received | entity.created
+#     via: team-slack
+#     template: "Deploy failed for {entity_name}: {error}"
+#     channel: "#alerts"
+# triggers:
+#   - from: team-slack
+#     event: message
+#     channel: "#support"
+#     route: /webhooks/slack
+
+
+# ─── LOCAL DEVELOPMENT ──────────────────────────────────────────────────────
+
+# Config for `grid dev`. Redact fields in dev data snapshots.
+# dev:
+#   snapshot:
+#     mask:
+#       - users.email
+#       - users.phone
+
+
+# ─── AGENT METADATA ────────────────────────────────────────────────────────
+
+# An agent is an app with kind: agent (above) and an agent: block.
+# agent:
+#   purpose: Sync customer data from external CRM every night
+#   schedule: "0 2 * * *"
+#   trigger: webhook
+
+
+# ─── PRIVATE RESOURCE AUTO-DEPENDENCIES ────────────────────────────────────
+
+# When true (default), private resources are auto-injected as depends_on.
+# auto_depends_on_private_requires: true
+
+
+# ─── SERVICES (REQUIRED) ───────────────────────────────────────────────────
+#
+# At least one service is required. Key = service name (slug rules).
+# Types: node, nextjs, python, static, cron.
+#
+services:
+  web:
+    # type (REQUIRED): node | nextjs | python | static | cron
+    type: nextjs
+    # HTTP route: '/' | '/api' | false (internal) | omitted (=false + warning).
+    # Only one service per entity can claim '/'.
+    path: /
+    # Container port (default 8080; read process.env.PORT). Not for cron.
+    # port: 3000
+    # nextjs only: base_image: distroless (default) | alpine
+    # base_image: distroless
+    # node only: lang: javascript (default) | typescript
+    # lang: typescript
+    # Custom source location (default services/<name>/). '.' = project root.
+    # source:
+    #   path: src/worker
+    # Health probe: false/omitted (TCP) | true (/health) | "/path" | {path,expected}
+    # health:
+    #   path: /api/health
+    #   expected: "200"
+    # Static runtime env vars (strings). Reserved: PORT, APP_NAME, SERVICE_NAME,
+    # NODE_ENV, MONGODB_URL, REDIS_URL, AI_GATEWAY_URL, N8N_WEBHOOK_URL, CLOUDGRID_*.
+    # env:
+    #   LOG_LEVEL: info
+    # Sibling services/private resources that must be Ready first (no cron, no cycles).
+    # depends_on:
+    #   - worker
+    # Per-service needs override (merges with app-level needs).
+    # needs:
+    #   queue: true
+    # Static-only build step:
+    # build:
+    #   command: npm run build
+    #   output: dist
+    #   env:
+    #     VITE_API_URL: https://api.example.com
+    # node_version: "22"          # static build step: '18'|'20'|'22'|'24' (quoted)
+    # Cron-only: schedule (REQUIRED), timezone (UTC|EST|PST), run (job | https URL)
+    # schedule: "0 9 * * 1"
+    # timezone: UTC
+    # run: job
+    # Verbose per-service persistence (prefer needs.disk):
+    # persist:
+    #   - name: scratch
+    #     path: /tmp/scratch
+    #     size: 500Mi
+
+
+needs:
+  database: true
+
+
+# ============================================================================
+# NOTES
+# - NOT here: org:/entity_id: (→ .cloudgrid/link.json), secrets (→ grid secrets set),
+#   Dockerfile (platform generates from services.*.type).
+# - Deploy: grid plug   |   Local with grid resources: grid dev
+# - Full reference: docs/cloudgrid-yaml-reference.md  |  CLI: docs/cli-reference.md
+# ============================================================================

package/src/corpus/templates/lms/index.md

@@ -0,0 +1,79 @@
+# Template: lms (blueprint — Next.js + Mongo + role-based auth)
+
+A learning management system / training platform: instructors publish courses
+(organized into modules and lessons), students enroll and work through them, and
+instructors grade submissions and track per-student progress. Persistent
+Next.js + Mongo app with role-based (instructor/student) auth.
+
+**This is a blueprint, not app code.** It ships the correct `cloudgrid.yaml` and
+an `AGENTS.md` structure guide. Read `AGENTS.md`, then build the app under
+`services/web/` following it. Fetch the guide with
+`gridctl_fetch("template", "lms")`.
+
+**Key rules:**
+
+1. **Service code MUST live under `services/web/`**, not the repo/template root.
+   `path: /` in `cloudgrid.yaml` is the URL mount, NOT the filesystem path.
+2. **Read injected vars LAZILY (inside getters), never at module top level.** The
+   grid injects `DATABASE_MONGODB_URL` (legacy `MONGODB_URL` fallback) from
+   `needs: { database: true }`, and `AUTH_PROVIDER_KEY` from the `vault:` block. A
+   top-level read fails `next build`.
+3. **Declare the datastore with `needs: { database: true }`** — the canonical
+   shape. `requires:` is the deprecated v1 alias; never set `needs:` and
+   `requires:` together (the validator rejects the combination).
+4. **Secrets via the `vault:` block** — set the vault item once with
+   `grid secrets set auth-provider-key`; the platform injects it as
+   `AUTH_PROVIDER_KEY`. The auth publishable (non-secret) key is a `grid env` var,
+   not a vault item.
+5. **Role gates are the spine** — instructor vs. student is enforced on the
+   server (page + API route), not just in the UI. Only instructors create
+   courses/lessons and post grades; students submit work and read their own grades.
+6. **Runtime deploy is async, local edition only.** `grid plug` returns
+   `status: building`; poll to a live URL.
+
+## Domain (Mongo collections)
+
+- `users` (authId, role: instructor|student) — mirrors the auth user; role drives every gate
+- `courses` (slug, title, instructorId, published) — one per course
+- `modules` (courseId, order) — ordered units within a course
+- `lessons` (moduleId, courseId, order, content, isFreePreview) — ordered lessons
+- `assignments` (courseId, lessonId, prompt, maxScore) — gradable tasks
+- `enrollments` (userId, courseId) — access grant checked by the lesson player
+- `progress` (userId, courseId, lessonId, completedAt) — per-lesson completion
+- `submissions` (userId, assignmentId, answer) — student work turned in
+- `grades` (submissionId, userId, score, feedback, gradedBy) — instructor's grade
+
+Access rules (enforce server-side): a lesson is viewable if `isFreePreview` OR an
+`enrollments` doc exists for `(userId, courseId)`; only `role: instructor` may
+create content and post grades.
+
+## cloudgrid.yaml
+
+```yaml
+# On disk this file is the full-annotated reference (templates/_cloudgrid.yaml.reference) with EVERY
+# field present as a comment; only the fields below are uncommented, so it
+# deploys to exactly these active fields.
+name: lms
+vault:
+  AUTH_PROVIDER_KEY: auth-provider-key
+services:
+  web:
+    type: nextjs
+    path: /
+needs:
+  database: true
+```
+
+> **Capability:** `needs: { database: true }` → the deployer provisions Mongo and
+> injects `DATABASE_MONGODB_URL` (+ legacy `MONGODB_URL`). The `vault:` block maps
+> the org secret `auth-provider-key` to `AUTH_PROVIDER_KEY` for the role-based auth
+> gates. (Add `STRIPE_KEY`/`STRIPE_WEBHOOK_SECRET` only if you sell paid courses.)
+> See the capability-map for the full injection table.
+
+## Build it
+
+Read `AGENTS.md` for the full file tree, collection fields, env/vault wiring, the
+instructor/student role gates + grading loop, and deploy steps. Then scaffold
+(`grid init`), write the app under `services/web/`, set secrets
+(`grid secrets set auth-provider-key`), and `grid plug` (async — poll to a live
+URL). Re-plug the same entity to iterate.