@cloudgrid-io/mcp 0.13.0 → 0.15.0

package/src/corpus/templates/api-dashboard/README.md

@@ -0,0 +1,84 @@
+# api-dashboard template — Next.js + Mongo API request monitor
+
+A minimal but real, deployable API usage dashboard. Every request is logged to
+the grid-shared MongoDB, so the log and its derived metrics survive refresh and
+are shared across users/sessions — unlike a static page whose state is in memory.
+
+The domain is a `requests` collection with `{ endpoint, status (number),
+ms (number), at }`. The page shows a **metrics header** (request count, average
+latency, error rate), a **record form**, and a **recent-requests table** with
+per-row delete.
+
+## How the grid gives you a database
+
+You do **not** provision a database or set a connection string. In
+`cloudgrid.yaml` you declare `needs: { database: true }`, and the grid:
+
+- provisions shared Mongo for the app, and
+- injects the connection string as the **`DATABASE_MONGODB_URL`** environment
+  variable (plus the legacy `MONGODB_URL` alias) — at dev-time (`grid dev`) and
+  at runtime (after `grid plug`).
+
+The app reads it via `process.env.DATABASE_MONGODB_URL` (with a legacy
+`process.env.MONGODB_URL` fallback) in `services/web/lib/db.js` — **lazily,
+inside the `getDb` getter, never at module top level** (a top-level read fails
+`next build`, which imports the module for route analysis before the grid injects
+the var). Never hardcode a connection string; never commit a secret.
+
+> **Declare `needs: { database: true }` (the canonical shape).** The deployer
+> provisions Mongo and injects `DATABASE_MONGODB_URL` (plus the legacy
+> `MONGODB_URL` alias). `requires:` is the deprecated v1 alias — don't author new
+> yaml with it, and never set `needs:` and `requires:` together (the validator
+> rejects the combination).
+
+## Service layout
+
+App code lives under **`services/web/`**, not the template root. `path:` in
+`cloudgrid.yaml` is the URL mount, not the filesystem path — the service named
+`web` means the CLI looks for `services/web/`. Files at the root fail with
+`Error: Service directory not found: …/services/web`.
+
+## Run locally
+
+```bash
+npm install
+grid dev          # runs Next.js with DATABASE_MONGODB_URL injected against dev Mongo
+```
+
+## Deploy
+
+```bash
+grid plug         # builds + deploys the folder (async — poll status until live)
+```
+
+A runtime deploy is asynchronous: `plug` returns `status: building`; poll status
+until the app is live, then use the returned live URL. Re-plug the same entity
+to update the same URL.
+
+## File tree
+
+```
+cloudgrid.yaml                          # name + services.web (nextjs) + needs: { database: true }
+services/web/package.json               # next, react, react-dom, mongodb driver only
+services/web/lib/db.js                  # lazy Mongo client from DATABASE_MONGODB_URL (legacy MONGODB_URL fallback)
+services/web/app/layout.js              # root layout + inline CSS
+services/web/app/page.js                # server component: reads requests + renders dashboard
+services/web/app/dashboard.js           # client: metrics header + record form + recent table
+services/web/app/api/requests/route.js  # GET (list) / POST (record) / DELETE (remove)
+```
+
+## The metrics
+
+Metrics are derived in the client from the current request log:
+
+- **count** — number of logged requests.
+- **avg ms** — mean of the `ms` field, rounded.
+- **error rate** — share of requests with `status >= 400`, as a percentage.
+
+## Adapt it
+
+- Rename the `requests` collection in `services/web/app/api/requests/route.js`
+  and `services/web/app/page.js` (e.g. `events`, `calls`, `hits`).
+- Change the document fields (add method, region, user, response size).
+- Add more routes/collections, or add filtering/aggregation to the metrics.
+- Add `cache: true` to `needs:` only if you actually need Redis.

package/src/corpus/templates/api-dashboard/cloudgrid.yaml

@@ -0,0 +1,233 @@
+# ============================================================================
+# cloudgrid.yaml — Complete Example
+# ============================================================================
+#
+# This file shows EVERY field the platform supports, with comments explaining
+# each one. It is a reference — no real project would use all of these at once.
+#
+# STANDARD: every CloudGrid template ships its cloudgrid.yaml in THIS full form.
+# Uncomment ONLY the fields the archetype needs (always: name + services; plus
+# needs: for runtime apps). Leave everything else commented. Comments are
+# ignored by the parser, so the file deploys to exactly the active fields.
+#
+# Only two fields are required: name and services. Everything else is optional.
+# Full docs: docs/cloudgrid-yaml-reference.md
+# ============================================================================
+
+
+# ─── IDENTITY ───────────────────────────────────────────────────────────────
+
+# Entity slug (REQUIRED). 2-42 chars, lowercase alphanumeric + hyphens.
+# Must start and end with a letter or digit.
+# Becomes part of your public URL: <name>-<4hex>.<org>.cloudgrid.io
+name: my-api-dashboard
+
+# One-line summary. Max 280 chars. If omitted, Grid Brain auto-generates one.
+# description: Order processing API for the e-commerce platform
+
+# Single emoji or short text shown as the entity icon. Max 64 chars.
+# icon: "📦"
+
+# Entity type: 'app' (default) or 'agent'. An agent is an app with an agent: block.
+# kind: app
+
+
+# ─── NETWORKING ─────────────────────────────────────────────────────────────
+
+# Whether this entity serves public HTTP traffic.
+# true = public URL + Ingress (default). false = internal only.
+# expose: true
+
+# Additional domain names this entity serves on (the platform URL is always active).
+# custom_domains:
+#   - orders.example.com
+#   - shop.example.com
+
+
+# ─── HEALTH PROBE (entity-level override) ──────────────────────────────────
+
+# Override the default health check for the entire entity.
+# probe:
+#   path: /healthz               # HTTP path to probe (default: /).
+#   expected: "<500"             # '<500' (default), '200', '2xx'.
+
+
+# ─── DEPLOY NOTIFICATIONS ──────────────────────────────────────────────────
+
+# Slack notification to the org's default channel on deploy failure.
+# true = notify (default), false = silent.
+# notify: true
+
+
+# ─── SCALING ────────────────────────────────────────────────────────────────
+
+# Replica scaling intent.
+#   'auto'  — platform decides from the grid tier (default).
+#   'alert' — single-replica, emit a SPOF warning at plug time.
+#   1-10    — explicit replica count, clamped to the grid max.
+# scale: auto
+
+
+# ─── INFRASTRUCTURE NEEDS ──────────────────────────────────────────────────
+#
+# Declare infrastructure; the platform provisions it and injects connection
+# details as env vars. Nine needs: database, cache, kv, queue, pubsub, vector,
+# object_storage, disk, ai. Simplest form is `true`.
+#
+# needs:
+#   # database — MongoDB. Injects DATABASE_MONGODB_URL (+ legacy MONGODB_URL).
+#   #   true | pool | dedicated | { tier: external, secret: MY_DB }
+#   database: true
+#   # cache — Redis, LRU eviction (derived data). Injects CACHE_REDIS_URL (+ REDIS_URL).
+#   #   true | redis | { engine: external, secret: MY_REDIS_URL }
+#   cache: true
+#   # kv — Redis, no eviction (durable: flags, idempotency). Injects KV_REDIS_URL.
+#   kv: true
+#   # queue — Redis job-queue substrate (BullMQ). Injects QUEUE_REDIS_URL.
+#   queue: true
+#   # pubsub — Redis broadcast pub/sub. Injects PUBSUB_REDIS_URL.
+#   pubsub: true
+#   # vector — pgvector on Postgres. Injects VECTOR_PGVECTOR_URL (+ PGVECTOR_URL).
+#   #   true | pgvector | { engine: pgvector, dim: 1536 }
+#   vector: pgvector
+#   # object_storage — GCS bucket. Injects OBJECT_STORAGE_GCS_BUCKET, _GCS_REGION.
+#   #   true | { size: 10Gi }
+#   object_storage: true
+#   # disk — persistent FS mount (PVC). Injects DISK_PATH. Pins to 1 replica.
+#   #   true | { size: 1Gi, mount: /var/data }  (forbidden: /proc /sys /dev)
+#   disk: true
+#   # ai — AI Gateway via @cloudgrid-io/ai. Injects AI_GATEWAY_URL. true | false.
+#   ai: true
+
+
+# ─── INTER-ENTITY COMMUNICATION ────────────────────────────────────────────
+
+# Entities this app calls (outbound). Service-account token injected per pair.
+# calls:
+#   - org:atomic/billing-api
+
+# Inbound caller policy — who can call YOUR entity.
+# callers:
+#   policy: auto                 # 'auto' | 'manual' (default).
+#   scope: org                   # 'org' (default) | 'space' | 'explicit'.
+#   fallback: deny               # 'deny' (default) | 'warn'.
+#   # allowed_apps:              # required only when scope: explicit
+#   #   - org:atomic/frontend
+
+
+# ─── VAULT ──────────────────────────────────────────────────────────────────
+
+# Map org vault items to env vars. Keys UPPER_SNAKE_CASE; values = vault item keys.
+# vault:
+#   STRIPE_KEY: stripe-live-key
+#   SENDGRID_API_KEY: sendgrid-key
+
+
+# ─── CONNECTORS AND HOOKS ──────────────────────────────────────────────────
+
+# connectors:
+#   - id: team-slack
+#     target: org                # 'system' | 'org'.
+#     channel: "#deploys"
+# hooks:
+#   - on: deploy.failed          # release.published | deploy.failed | feedback.received | entity.created
+#     via: team-slack
+#     template: "Deploy failed for {entity_name}: {error}"
+#     channel: "#alerts"
+# triggers:
+#   - from: team-slack
+#     event: message
+#     channel: "#support"
+#     route: /webhooks/slack
+
+
+# ─── LOCAL DEVELOPMENT ──────────────────────────────────────────────────────
+
+# Config for `grid dev`. Redact fields in dev data snapshots.
+# dev:
+#   snapshot:
+#     mask:
+#       - users.email
+#       - users.phone
+
+
+# ─── AGENT METADATA ────────────────────────────────────────────────────────
+
+# An agent is an app with kind: agent (above) and an agent: block.
+# agent:
+#   purpose: Sync customer data from external CRM every night
+#   schedule: "0 2 * * *"
+#   trigger: webhook
+
+
+# ─── PRIVATE RESOURCE AUTO-DEPENDENCIES ────────────────────────────────────
+
+# When true (default), private resources are auto-injected as depends_on.
+# auto_depends_on_private_requires: true
+
+
+# ─── SERVICES (REQUIRED) ───────────────────────────────────────────────────
+#
+# At least one service is required. Key = service name (slug rules).
+# Types: node, nextjs, python, static, cron.
+#
+services:
+  web:
+    # type (REQUIRED): node | nextjs | python | static | cron
+    type: nextjs
+    # HTTP route: '/' | '/api' | false (internal) | omitted (=false + warning).
+    # Only one service per entity can claim '/'.
+    path: /
+    # Container port (default 8080; read process.env.PORT). Not for cron.
+    # port: 3000
+    # nextjs only: base_image: distroless (default) | alpine
+    # base_image: distroless
+    # node only: lang: javascript (default) | typescript
+    # lang: typescript
+    # Custom source location (default services/<name>/). '.' = project root.
+    # source:
+    #   path: src/worker
+    # Health probe: false/omitted (TCP) | true (/health) | "/path" | {path,expected}
+    # health:
+    #   path: /api/health
+    #   expected: "200"
+    # Static runtime env vars (strings). Reserved: PORT, APP_NAME, SERVICE_NAME,
+    # NODE_ENV, MONGODB_URL, REDIS_URL, AI_GATEWAY_URL, N8N_WEBHOOK_URL, CLOUDGRID_*.
+    # env:
+    #   LOG_LEVEL: info
+    # Sibling services/private resources that must be Ready first (no cron, no cycles).
+    # depends_on:
+    #   - worker
+    # Per-service needs override (merges with app-level needs).
+    # needs:
+    #   queue: true
+    # Static-only build step:
+    # build:
+    #   command: npm run build
+    #   output: dist
+    #   env:
+    #     VITE_API_URL: https://api.example.com
+    # node_version: "22"          # static build step: '18'|'20'|'22'|'24' (quoted)
+    # Cron-only: schedule (REQUIRED), timezone (UTC|EST|PST), run (job | https URL)
+    # schedule: "0 9 * * 1"
+    # timezone: UTC
+    # run: job
+    # Verbose per-service persistence (prefer needs.disk):
+    # persist:
+    #   - name: scratch
+    #     path: /tmp/scratch
+    #     size: 500Mi
+
+
+
+needs:
+  database: true
+
+
+# ============================================================================
+# NOTES
+# - NOT here: org:/entity_id: (→ .cloudgrid/link.json), secrets (→ grid secrets set),
+#   Dockerfile (platform generates from services.*.type).
+# - Deploy: grid plug   |   Local with grid resources: grid dev
+# - Full reference: docs/cloudgrid-yaml-reference.md  |  CLI: docs/cli-reference.md
+# ============================================================================

package/src/corpus/templates/api-dashboard/index.md

@@ -0,0 +1,310 @@
+# Template: api-dashboard (Next.js + Mongo API request monitor)
+
+A minimal but real, deployable API usage dashboard. Every request is logged to
+the grid-shared MongoDB, so the log and derived metrics survive refresh and are
+shared across sessions — unlike a static page.
+
+The domain is a `requests` collection with `{ endpoint, status (number),
+ms (number), at }`. The page renders a **metrics header** (count, avg ms, error
+rate), a **record form**, and a **recent-requests table** with per-row delete.
+
+**Key rules (all proven by a real end-to-end deploy):**
+
+1. **Service code MUST live under `services/<name>/`, not the repo/template
+   root.** `path:` in `cloudgrid.yaml` is the URL mount, NOT the filesystem path.
+   The service named `web` → the CLI looks for `services/web/`. App files at the
+   root fail with `Error: Service directory not found: …/services/web`.
+2. **Read the DB connection string LAZILY (inside the getter), never at module
+   top level.** The grid injects it as the `DATABASE_MONGODB_URL` environment
+   variable (plus the legacy `MONGODB_URL` alias) at dev-time and runtime; the
+   app reads `process.env.DATABASE_MONGODB_URL || process.env.MONGODB_URL` inside
+   `getDb`. A top-level `const uri = process.env.DATABASE_MONGODB_URL; if (!uri)
+   throw` fails `next build` (the module is imported for route analysis before
+   the grid injects the var). Never hardcode a connection string; never commit a
+   secret.
+3. **Declare the datastore with `needs: { database: true }`.** This is the
+   canonical shape — the deployer provisions Mongo and injects
+   `DATABASE_MONGODB_URL` (plus the legacy `MONGODB_URL` alias). `requires:` is
+   the deprecated v1 alias; don't author new yaml with it, and never set `needs:`
+   and `requires:` together (the validator rejects the combination).
+
+Write these files into the scaffolded app folder — the app code goes under
+`services/web/` — adapt the collection/fields to the user's app, then `grid dev`
+(local) / `grid plug` (deploy, async — poll to a live URL).
+
+## File tree
+
+```
+cloudgrid.yaml                          # name + services.web (nextjs) + needs: { database: true }
+services/web/package.json               # next, react, react-dom, mongodb driver only
+services/web/lib/db.js                  # lazy Mongo client from DATABASE_MONGODB_URL (legacy MONGODB_URL fallback)
+services/web/app/layout.js              # root layout + inline CSS
+services/web/app/page.js                # server component: reads requests + renders dashboard
+services/web/app/dashboard.js           # client: metrics header + record form + recent table
+services/web/app/api/requests/route.js  # GET (list) / POST (record) / DELETE (remove)
+```
+
+## cloudgrid.yaml
+
+```yaml
+# On disk this file is the full-annotated reference (templates/_cloudgrid.yaml.reference) with EVERY
+# field present as a comment; only the fields below are uncommented, so it
+# deploys to exactly these active fields.
+name: my-api-dashboard
+services:
+  web:
+    type: nextjs
+    path: /
+needs:
+  database: true
+```
+
+> **Capability:** this template's need is `database: true`. The deployer
+> provisions Mongo and injects `DATABASE_MONGODB_URL` (plus the legacy
+> `MONGODB_URL` alias), so an app reading either var works. `requires:` is the
+> deprecated v1 alias — don't mix it with `needs:` (the validator rejects the
+> combination). See the capability-map for the full injection table.
+
+## services/web/package.json
+
+```json
+{
+  "name": "my-app",
+  "version": "0.1.0",
+  "private": true,
+  "scripts": {
+    "dev": "next dev",
+    "build": "next build",
+    "start": "next start"
+  },
+  "dependencies": {
+    "next": "^15.1.0",
+    "react": "^19.0.0",
+    "react-dom": "^19.0.0",
+    "mongodb": "^6.12.0"
+  }
+}
+```
+
+## services/web/lib/db.js
+
+```js
+// Cached MongoDB client for the App Router. The grid injects the connection
+// string as DATABASE_MONGODB_URL (plus the legacy MONGODB_URL alias) at dev-time
+// and runtime. Resolve it LAZILY (inside getDb), never at module top level —
+// otherwise `next build` throws when it imports this module for route analysis.
+import { MongoClient } from "mongodb";
+
+function clientPromise() {
+  const uri = process.env.DATABASE_MONGODB_URL || process.env.MONGODB_URL;
+  if (!uri) {
+    throw new Error(
+      "DATABASE_MONGODB_URL is not set. The grid injects it automatically — run " +
+        "this app with `grid dev` locally, or deploy it with `grid plug`. Do not set it by hand.",
+    );
+  }
+  if (!globalThis.__mongoClientPromise) {
+    globalThis.__mongoClientPromise = new MongoClient(uri).connect();
+  }
+  return globalThis.__mongoClientPromise;
+}
+
+export async function getDb() {
+  const client = await clientPromise();
+  return client.db();
+}
+```
+
+## services/web/app/layout.js
+
+```js
+export const metadata = {
+  title: "API Dashboard",
+  description: "Monitor API requests on CloudGrid, backed by grid-shared Mongo.",
+};
+
+const css = `
+  :root { color-scheme: light dark; }
+  body { margin: 0; font-family: system-ui, sans-serif; }
+  main { max-width: 56rem; margin: 3rem auto; padding: 0 1.25rem; }
+  .metrics { display: grid; grid-template-columns: repeat(3, 1fr); gap: .75rem; margin-bottom: 1.75rem; }
+  .metric { border: 1px solid #8883; border-radius: .6rem; padding: .9rem 1rem; }
+  .metric .label { font-size: .75rem; text-transform: uppercase; opacity: .6; }
+  .metric .value { font-size: 1.6rem; font-weight: 600; margin-top: .2rem; }
+  .row { display: flex; flex-wrap: wrap; gap: .5rem; margin-bottom: 1.5rem; }
+  input, select { padding: .5rem .75rem; border: 1px solid #8886; border-radius: .5rem; }
+  button { padding: .5rem .9rem; border: 1px solid #8886; border-radius: .5rem; cursor: pointer; }
+  .table-wrap { overflow-x: auto; }
+  table { border-collapse: collapse; width: 100%; font-size: .9rem; }
+  th, td { text-align: left; padding: .55rem .6rem; border-bottom: 1px solid #8883; white-space: nowrap; }
+  .status-ok { color: #2a9d4a; } .status-err { color: #d1453b; }
+`;
+
+export default function RootLayout({ children }) {
+  return (
+    <html lang="en">
+      <head><style dangerouslySetInnerHTML={{ __html: css }} /></head>
+      <body>{children}</body>
+    </html>
+  );
+}
+```
+
+## services/web/app/page.js
+
+```js
+import { getDb } from "../lib/db.js";
+import Dashboard from "./dashboard.js";
+
+export const dynamic = "force-dynamic";
+
+async function listRequests() {
+  const db = await getDb();
+  const items = await db.collection("requests").find({}).sort({ at: -1 }).limit(50).toArray();
+  return items.map((r) => ({
+    id: r._id.toString(), endpoint: r.endpoint, status: r.status, ms: r.ms,
+    at: r.at instanceof Date ? r.at.toISOString() : r.at,
+  }));
+}
+
+export default async function Page() {
+  const requests = await listRequests();
+  return (
+    <main>
+      <h1>API Dashboard</h1>
+      <p className="hint">Live request log persisted in grid-shared Mongo — survives refresh.</p>
+      <Dashboard initialRequests={requests} />
+    </main>
+  );
+}
+```
+
+## services/web/app/dashboard.js
+
+```js
+"use client";
+import { useState } from "react";
+
+function computeMetrics(requests) {
+  const count = requests.length;
+  if (count === 0) return { count: 0, avgMs: 0, errorRate: 0 };
+  const totalMs = requests.reduce((s, r) => s + (Number(r.ms) || 0), 0);
+  const errors = requests.filter((r) => Number(r.status) >= 400).length;
+  return { count, avgMs: Math.round(totalMs / count), errorRate: Math.round((errors / count) * 1000) / 10 };
+}
+
+export default function Dashboard({ initialRequests }) {
+  const [requests, setRequests] = useState(initialRequests);
+  const [endpoint, setEndpoint] = useState("");
+  const [status, setStatus] = useState("200");
+  const [ms, setMs] = useState("");
+  const metrics = computeMetrics(requests);
+
+  async function record(e) {
+    e.preventDefault();
+    const path = endpoint.trim();
+    if (!path) return;
+    const res = await fetch("/api/requests", {
+      method: "POST", headers: { "content-type": "application/json" },
+      body: JSON.stringify({ endpoint: path, status: Number(status), ms: Number(ms) || 0 }),
+    });
+    if (res.ok) { setRequests((p) => [await res.json(), ...p].slice(0, 50)); setEndpoint(""); setMs(""); }
+  }
+
+  async function remove(id) {
+    const res = await fetch(`/api/requests?id=${encodeURIComponent(id)}`, { method: "DELETE" });
+    if (res.ok) setRequests((p) => p.filter((r) => r.id !== id));
+  }
+
+  return (
+    <div>
+      <div className="metrics">
+        <div className="metric"><div className="label">Requests</div><div className="value">{metrics.count}</div></div>
+        <div className="metric"><div className="label">Avg latency</div><div className="value">{metrics.avgMs} ms</div></div>
+        <div className="metric"><div className="label">Error rate</div><div className="value">{metrics.errorRate}%</div></div>
+      </div>
+      <form onSubmit={record} className="row">
+        <input className="endpoint" value={endpoint} onChange={(e) => setEndpoint(e.target.value)} placeholder="/api/endpoint" />
+        <select value={status} onChange={(e) => setStatus(e.target.value)}>
+          <option>200</option><option>400</option><option>404</option><option>500</option>
+        </select>
+        <input type="number" min="0" value={ms} onChange={(e) => setMs(e.target.value)} placeholder="ms" />
+        <button type="submit">Record</button>
+      </form>
+      <div className="table-wrap">
+        <table>
+          <thead><tr><th>Endpoint</th><th>Status</th><th>Latency</th><th>When</th><th></th></tr></thead>
+          <tbody>
+            {requests.map((r) => (
+              <tr key={r.id}>
+                <td>{r.endpoint}</td>
+                <td className={Number(r.status) >= 400 ? "status-err" : "status-ok"}>{r.status}</td>
+                <td>{r.ms} ms</td>
+                <td>{new Date(r.at).toLocaleString()}</td>
+                <td><button type="button" onClick={() => remove(r.id)}>Delete</button></td>
+              </tr>
+            ))}
+          </tbody>
+        </table>
+      </div>
+    </div>
+  );
+}
+```
+
+## services/web/app/api/requests/route.js
+
+```js
+import { NextResponse } from "next/server";
+import { ObjectId } from "mongodb";
+import { getDb } from "../../../lib/db.js";
+
+export const dynamic = "force-dynamic";
+
+async function requests() {
+  const db = await getDb();
+  return db.collection("requests");
+}
+
+function serialize(r) {
+  return {
+    id: r._id.toString(), endpoint: r.endpoint, status: r.status, ms: r.ms,
+    at: r.at instanceof Date ? r.at.toISOString() : r.at,
+  };
+}
+
+export async function GET() {
+  const col = await requests();
+  const items = await col.find({}).sort({ at: -1 }).limit(50).toArray();
+  return NextResponse.json(items.map(serialize));
+}
+
+export async function POST(request) {
+  const body = await request.json().catch(() => ({}));
+  const endpoint = typeof body.endpoint === "string" ? body.endpoint.trim() : "";
+  if (!endpoint) return NextResponse.json({ error: "endpoint is required" }, { status: 400 });
+  const status = Number.isFinite(Number(body.status)) ? Number(body.status) : 200;
+  const ms = Number.isFinite(Number(body.ms)) ? Math.max(0, Number(body.ms)) : 0;
+  const at = new Date();
+  const col = await requests();
+  const res = await col.insertOne({ endpoint, status, ms, at });
+  return NextResponse.json({ id: res.insertedId.toString(), endpoint, status, ms, at: at.toISOString() }, { status: 201 });
+}
+
+export async function DELETE(request) {
+  const id = new URL(request.url).searchParams.get("id");
+  if (!id || !ObjectId.isValid(id)) return NextResponse.json({ error: "valid id is required" }, { status: 400 });
+  const col = await requests();
+  await col.deleteOne({ _id: new ObjectId(id) });
+  return NextResponse.json({ ok: true });
+}
+```
+
+## Adapt it
+
+- Rename the `requests` collection to your data (`events`, `calls`, `hits`).
+- Change the document fields; add method/region/user/response size.
+- Add filtering or time-window aggregation to the metrics.
+- Add `cache: true` to `needs:` only if you actually need Redis.
+- Run `grid dev` to test locally, `grid plug` to deploy (async — poll to live).
+```

package/src/corpus/templates/api-dashboard/services/web/app/api/requests/route.js

@@ -0,0 +1,62 @@
+// App Router route handler for the `requests` collection (API request log).
+// GET  -> list recent requests, POST -> record a request, DELETE -> remove one.
+//
+// To adapt this app, rename the collection and change the fields to match your
+// own data (e.g. an `events` or `calls` collection).
+import { NextResponse } from "next/server";
+import { ObjectId } from "mongodb";
+import { getDb } from "../../../lib/db.js";
+
+// Never cache — always read/write live data.
+export const dynamic = "force-dynamic";
+
+async function requests() {
+  const db = await getDb();
+  return db.collection("requests");
+}
+
+function serialize(r) {
+  return {
+    id: r._id.toString(),
+    endpoint: r.endpoint,
+    status: r.status,
+    ms: r.ms,
+    at: r.at instanceof Date ? r.at.toISOString() : r.at,
+  };
+}
+
+// GET /api/requests — list recent requests, newest first.
+export async function GET() {
+  const col = await requests();
+  const items = await col.find({}).sort({ at: -1 }).limit(50).toArray();
+  return NextResponse.json(items.map(serialize));
+}
+
+// POST /api/requests — record a request. Body: { endpoint, status, ms }.
+export async function POST(request) {
+  const body = await request.json().catch(() => ({}));
+  const endpoint = typeof body.endpoint === "string" ? body.endpoint.trim() : "";
+  if (!endpoint) {
+    return NextResponse.json({ error: "endpoint is required" }, { status: 400 });
+  }
+  const status = Number.isFinite(Number(body.status)) ? Number(body.status) : 200;
+  const ms = Number.isFinite(Number(body.ms)) ? Math.max(0, Number(body.ms)) : 0;
+  const at = new Date();
+  const col = await requests();
+  const res = await col.insertOne({ endpoint, status, ms, at });
+  return NextResponse.json(
+    { id: res.insertedId.toString(), endpoint, status, ms, at: at.toISOString() },
+    { status: 201 },
+  );
+}
+
+// DELETE /api/requests?id=<id> — remove a request.
+export async function DELETE(request) {
+  const id = new URL(request.url).searchParams.get("id");
+  if (!id || !ObjectId.isValid(id)) {
+    return NextResponse.json({ error: "valid id is required" }, { status: 400 });
+  }
+  const col = await requests();
+  await col.deleteOne({ _id: new ObjectId(id) });
+  return NextResponse.json({ ok: true });
+}