@cloudgrid-io/mcp 0.8.2 → 0.9.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cloudgrid-io/mcp",
-  "version": "0.8.2",
+  "version": "0.9.1",
   "description": "MCP server for CloudGrid. Three editions: a local stdio server (full toolset), a hosted web server (light, CLI-free toolset), and a public docs server (search_cloudgrid_documentation) over MCP Streamable HTTP.",
   "type": "module",
   "bin": {
@@ -18,6 +18,9 @@
     "smoke": "node test/smoke.mjs",
     "test:plug-wire": "node test/plug-wire.test.mjs",
     "test:error-reporting": "node test/error-reporting.test.mjs",
+    "test:source": "node test/source-fetch.test.mjs",
+    "test:app-with-data": "node test/app-with-data.test.mjs",
+    "test:content": "node test/content-handling.test.mjs",
     "test:self-healing": "node test/self-healing.test.mjs",
     "test:grid-picker": "node test/grid-picker.test.mjs",
     "test:drift-guard": "node test/drift-guard.mjs",

package/src/corpus/examples/app-with-data/index.md

@@ -0,0 +1,251 @@
+# Example: app-with-data — "Team Task Board"
+
+A filled reference imitating the `app-with-data` template: a persistent team
+task board. Same stack (Next.js App Router + the `mongodb` driver, grid-shared
+Mongo via `process.env.MONGODB_URL`), slightly richer than the bare todo
+template — tasks have an `assignee` and a `status` (todo / doing / done), and
+the API supports updating status via PATCH.
+
+Data persists in the grid-shared Mongo, so the whole team sees the same board
+across sessions and refresh.
+
+**Same three proven rules as the template:** (1) app code lives under
+**`services/web/`** (the service name, NOT the repo root — `path:` is the URL
+mount); (2) `MONGODB_URL` is read **lazily inside the `getDb` getter**, never at
+module top level (a top-level read fails `next build`); (3) the datastore is
+declared with **`requires: [mongodb]`, not `needs:`** — the deployer only
+injects `MONGODB_URL` from `requires:`.
+
+## cloudgrid.yaml
+
+```yaml
+# NOTE: use `requires:` (NOT `needs:`). The deployer only injects MONGODB_URL
+# from `requires:`; `needs:` builds fine but injects NO DB connection (500s).
+name: team-task-board
+services:
+  web:
+    type: nextjs
+    path: /
+requires:
+  - mongodb
+```
+
+## services/web/package.json
+
+```json
+{
+  "name": "team-task-board",
+  "version": "0.1.0",
+  "private": true,
+  "scripts": { "dev": "next dev", "build": "next build", "start": "next start" },
+  "dependencies": {
+    "next": "^15.1.0",
+    "react": "^19.0.0",
+    "react-dom": "^19.0.0",
+    "mongodb": "^6.12.0"
+  }
+}
+```
+
+## services/web/lib/db.js
+
+```js
+// Cached Mongo client. MONGODB_URL is injected by the grid (dev + runtime).
+// Resolve it LAZILY inside the getter — a top-level read fails `next build`.
+import { MongoClient } from "mongodb";
+
+function clientPromise() {
+  const uri = process.env.MONGODB_URL;
+  if (!uri) {
+    throw new Error(
+      "MONGODB_URL is not set. The grid injects it — run `grid dev` locally or " +
+        "deploy with `grid plug`. Do not set it by hand.",
+    );
+  }
+  if (!globalThis.__mongoClientPromise) {
+    globalThis.__mongoClientPromise = new MongoClient(uri).connect();
+  }
+  return globalThis.__mongoClientPromise;
+}
+
+export async function getDb() {
+  return (await clientPromise()).db();
+}
+```
+
+## services/web/app/api/tasks/route.js
+
+```js
+import { NextResponse } from "next/server";
+import { ObjectId } from "mongodb";
+import { getDb } from "../../../lib/db.js";
+
+export const dynamic = "force-dynamic";
+
+const STATUSES = ["todo", "doing", "done"];
+
+async function tasks() {
+  return (await getDb()).collection("tasks");
+}
+
+// GET /api/tasks — list the board.
+export async function GET() {
+  const col = await tasks();
+  const items = await col.find({}).sort({ createdAt: -1 }).toArray();
+  return NextResponse.json(
+    items.map((t) => ({
+      id: t._id.toString(),
+      title: t.title,
+      assignee: t.assignee || "",
+      status: t.status || "todo",
+    })),
+  );
+}
+
+// POST /api/tasks — add a task. Body: { title, assignee }.
+export async function POST(request) {
+  const body = await request.json().catch(() => ({}));
+  const title = typeof body.title === "string" ? body.title.trim() : "";
+  if (!title) return NextResponse.json({ error: "title is required" }, { status: 400 });
+  const doc = {
+    title,
+    assignee: typeof body.assignee === "string" ? body.assignee.trim() : "",
+    status: "todo",
+    createdAt: new Date(),
+  };
+  const col = await tasks();
+  const res = await col.insertOne(doc);
+  return NextResponse.json({ id: res.insertedId.toString(), ...doc }, { status: 201 });
+}
+
+// PATCH /api/tasks — move a task. Body: { id, status }.
+export async function PATCH(request) {
+  const body = await request.json().catch(() => ({}));
+  const { id, status } = body;
+  if (!id || !ObjectId.isValid(id) || !STATUSES.includes(status)) {
+    return NextResponse.json({ error: "valid id and status required" }, { status: 400 });
+  }
+  const col = await tasks();
+  await col.updateOne({ _id: new ObjectId(id) }, { $set: { status } });
+  return NextResponse.json({ ok: true });
+}
+
+// DELETE /api/tasks?id=<id>
+export async function DELETE(request) {
+  const id = new URL(request.url).searchParams.get("id");
+  if (!id || !ObjectId.isValid(id)) {
+    return NextResponse.json({ error: "valid id is required" }, { status: 400 });
+  }
+  const col = await tasks();
+  await col.deleteOne({ _id: new ObjectId(id) });
+  return NextResponse.json({ ok: true });
+}
+```
+
+## services/web/app/page.js
+
+```js
+import { getDb } from "../lib/db.js";
+import Board from "./board.js";
+
+export const dynamic = "force-dynamic";
+
+async function listTasks() {
+  const items = await (await getDb())
+    .collection("tasks")
+    .find({})
+    .sort({ createdAt: -1 })
+    .toArray();
+  return items.map((t) => ({
+    id: t._id.toString(),
+    title: t.title,
+    assignee: t.assignee || "",
+    status: t.status || "todo",
+  }));
+}
+
+export default async function Page() {
+  const tasks = await listTasks();
+  return (
+    <main>
+      <h1>Team Task Board</h1>
+      <p className="hint">Shared across the team — persisted in grid Mongo.</p>
+      <Board initialTasks={tasks} />
+    </main>
+  );
+}
+```
+
+## services/web/app/board.js
+
+```js
+"use client";
+import { useState } from "react";
+
+const COLUMNS = ["todo", "doing", "done"];
+const LABELS = { todo: "To do", doing: "Doing", done: "Done" };
+
+export default function Board({ initialTasks }) {
+  const [tasks, setTasks] = useState(initialTasks);
+  const [title, setTitle] = useState("");
+  const [assignee, setAssignee] = useState("");
+
+  async function add(e) {
+    e.preventDefault();
+    if (!title.trim()) return;
+    const res = await fetch("/api/tasks", {
+      method: "POST",
+      headers: { "content-type": "application/json" },
+      body: JSON.stringify({ title, assignee }),
+    });
+    if (res.ok) { setTasks((p) => [await res.json(), ...p]); setTitle(""); setAssignee(""); }
+  }
+
+  async function move(id, status) {
+    const res = await fetch("/api/tasks", {
+      method: "PATCH",
+      headers: { "content-type": "application/json" },
+      body: JSON.stringify({ id, status }),
+    });
+    if (res.ok) setTasks((p) => p.map((t) => (t.id === id ? { ...t, status } : t)));
+  }
+
+  return (
+    <div>
+      <form onSubmit={add} className="row">
+        <input value={title} onChange={(e) => setTitle(e.target.value)} placeholder="Task title…" />
+        <input value={assignee} onChange={(e) => setAssignee(e.target.value)} placeholder="Assignee" />
+        <button type="submit">Add</button>
+      </form>
+      <div className="board">
+        {COLUMNS.map((col) => (
+          <section key={col}>
+            <h2>{LABELS[col]}</h2>
+            {tasks.filter((t) => t.status === col).map((t) => (
+              <article key={t.id}>
+                <strong>{t.title}</strong>
+                {t.assignee && <em> · {t.assignee}</em>}
+                <div className="moves">
+                  {COLUMNS.filter((c) => c !== col).map((c) => (
+                    <button key={c} onClick={() => move(t.id, c)}>→ {LABELS[c]}</button>
+                  ))}
+                </div>
+              </article>
+            ))}
+          </section>
+        ))}
+      </div>
+    </div>
+  );
+}
+```
+
+## Notes
+
+- Deploy the same way as the template: `grid dev` locally, `grid plug` to deploy
+  (async — poll status to a live URL). Re-plug the same entity to keep one URL.
+- The only store this needs is Mongo (`requires: [mongodb]` — not `needs:`; the
+  deployer only injects `MONGODB_URL` from `requires:`). Add `redis: private`
+  only for caching/sessions/pubsub you actually use.
+- All app code lives under `services/web/`; the connection is read lazily inside
+  `getDb`, never at module top level.

package/src/corpus/templates/app-with-data/README.md

@@ -0,0 +1,70 @@
+# app-with-data template — persistent Next.js + Mongo app
+
+A minimal but real, deployable to-do app. Data lives in the grid-shared MongoDB,
+so it survives refresh and is shared across users/sessions — unlike a static
+page whose state is in memory only.
+
+## How the grid gives you a database
+
+You do **not** provision a database or set a connection string. In
+`cloudgrid.yaml` you declare `requires: [mongodb]`, and the grid:
+
+- provisions shared Mongo for the app, and
+- injects the connection string as the **`MONGODB_URL`** environment variable —
+  at dev-time (`grid dev`) and at runtime (after `grid plug`).
+
+The app reads it via `process.env.MONGODB_URL` in `services/web/lib/db.js` —
+**lazily, inside the `getDb` getter, never at module top level** (a top-level
+read fails `next build`, which imports the module for route analysis before the
+grid injects the var). Never hardcode a connection string; never commit a
+secret. (If you also declare `redis: private`, the grid injects `REDIS_URL` the
+same way.)
+
+> **Use `requires:` (NOT `needs:`).** The CLI warns `requires:` is deprecated,
+> but the deployer currently only injects `MONGODB_URL` from `requires:` —
+> migrating to `needs:` builds fine but injects NO DB connection (every request
+> 500s). Keep `requires:` until CloudGrid's deployer honors `needs:`.
+
+## Service layout
+
+App code lives under **`services/web/`**, not the template root. `path:` in
+`cloudgrid.yaml` is the URL mount, not the filesystem path — the service named
+`web` means the CLI looks for `services/web/`. Files at the root fail with
+`Error: Service directory not found: …/services/web`.
+
+## Run locally
+
+```bash
+npm install
+grid dev          # runs Next.js with MONGODB_URL injected against dev Mongo
+```
+
+## Deploy
+
+```bash
+grid plug         # builds + deploys the folder (async — poll status until live)
+```
+
+A runtime deploy is asynchronous: `plug` returns `status: building`; poll status
+until the app is live, then use the returned live URL. Re-plug the same entity
+to update the same URL.
+
+## File tree
+
+```
+cloudgrid.yaml                        # name + services.web (nextjs) + requires: [mongodb]
+services/web/package.json             # next, react, react-dom, mongodb driver only
+services/web/lib/db.js                # lazy Mongo client from process.env.MONGODB_URL
+services/web/app/layout.js            # root layout + inline CSS
+services/web/app/page.js              # server component: reads todos from Mongo
+services/web/app/todo-form.js         # client form: POST/DELETE via the API
+services/web/app/api/todos/route.js   # GET (list) / POST (add) / DELETE (remove)
+```
+
+## Adapt it
+
+- Rename the `todos` collection in `services/web/app/api/todos/route.js` and
+  `services/web/app/page.js` (e.g. `submissions`, `tasks`, `entries`).
+- Change the document fields (add owners, timestamps, statuses).
+- Add more routes/collections as the app grows.
+- Add `redis: private` to `requires` only if you actually need Redis.

package/src/corpus/templates/app-with-data/cloudgrid.yaml

@@ -0,0 +1,15 @@
+# Rename this app. The grid injects MONGODB_URL (and REDIS_URL if you add a cache)
+# as environment variables at runtime — do NOT set them yourself, and never commit
+# a connection string or secret.
+#
+# NOTE: use `requires:` (NOT `needs:`). The CLI warns that `requires:` is deprecated,
+# but the deployer currently only injects MONGODB_URL from `requires:` — migrating to
+# `needs:` builds fine but injects NO database connection (every request 500s).
+# Keep `requires:` until CloudGrid's deployer honors `needs:`.
+name: my-app
+services:
+  web:
+    type: nextjs
+    path: /
+requires:
+  - mongodb

package/src/corpus/templates/app-with-data/index.md

@@ -0,0 +1,261 @@
+# Template: app-with-data (persistent Next.js + Mongo)
+
+A minimal but real, deployable to-do app. Data lives in the grid-shared MongoDB,
+so it survives refresh and is shared across sessions — unlike a static page.
+
+**Key rules (all proven by a real end-to-end deploy):**
+
+1. **Service code MUST live under `services/<name>/`, not the repo/template
+   root.** `path:` in `cloudgrid.yaml` is the URL mount, NOT the filesystem path.
+   The service named `web` → the CLI looks for `services/web/`. App files at the
+   root fail with `Error: Service directory not found: …/services/web`.
+2. **Read `MONGODB_URL` LAZILY (inside the getter), never at module top level.**
+   The grid injects the DB connection string as the `MONGODB_URL` environment
+   variable at dev-time and runtime; the app reads `process.env.MONGODB_URL`
+   inside `getDb`. A top-level `const uri = process.env.MONGODB_URL; if (!uri)
+   throw` fails `next build` (the module is imported for route analysis before
+   the grid injects the var). Never hardcode a connection string; never commit a
+   secret.
+3. **Declare the datastore with `requires: [mongodb]` — NOT `needs:`.** The CLI
+   warns `requires:` is deprecated, but the deployer only injects `MONGODB_URL`
+   from `requires:`; `needs:` builds fine but injects NO DB connection (every
+   request 500s). Keep `requires:` until the deployer honors `needs:`.
+
+Write these files into the scaffolded app folder — the app code goes under
+`services/web/` — adapt the collection/fields to the user's app, then `grid dev`
+(local) / `grid plug` (deploy, async — poll to a live URL).
+
+## File tree
+
+```
+cloudgrid.yaml                          # name + services.web (nextjs) + requires: [mongodb]
+services/web/package.json               # next, react, react-dom, mongodb driver only
+services/web/lib/db.js                  # lazy Mongo client from process.env.MONGODB_URL
+services/web/app/layout.js              # root layout + inline CSS
+services/web/app/page.js                # server component: reads todos from Mongo
+services/web/app/todo-form.js           # client form: POST/DELETE via the API
+services/web/app/api/todos/route.js     # GET (list) / POST (add) / DELETE (remove)
+```
+
+## cloudgrid.yaml
+
+```yaml
+# Rename this app. The grid injects MONGODB_URL (and REDIS_URL if you add a cache)
+# as environment variables at runtime — do NOT set them yourself, and never commit
+# a connection string or secret.
+#
+# NOTE: use `requires:` (NOT `needs:`). The CLI warns that `requires:` is deprecated,
+# but the deployer currently only injects MONGODB_URL from `requires:` — migrating to
+# `needs:` builds fine but injects NO database connection (every request 500s).
+# Keep `requires:` until CloudGrid's deployer honors `needs:`.
+name: my-app
+services:
+  web:
+    type: nextjs
+    path: /
+requires:
+  - mongodb
+```
+
+## services/web/package.json
+
+```json
+{
+  "name": "my-app",
+  "version": "0.1.0",
+  "private": true,
+  "scripts": {
+    "dev": "next dev",
+    "build": "next build",
+    "start": "next start"
+  },
+  "dependencies": {
+    "next": "^15.1.0",
+    "react": "^19.0.0",
+    "react-dom": "^19.0.0",
+    "mongodb": "^6.12.0"
+  }
+}
+```
+
+## services/web/lib/db.js
+
+```js
+// Cached MongoDB client for the App Router.
+//
+// The grid injects the connection string as the MONGODB_URL environment variable
+// at runtime (after `grid plug`) and under `grid dev` locally. Never hardcode a
+// connection string here and never commit a secret.
+//
+// The env var and client are resolved LAZILY (inside getDb), never at module top
+// level — otherwise `next build` throws when it imports this module for route
+// analysis, before the grid injects MONGODB_URL.
+import { MongoClient } from "mongodb";
+
+function clientPromise() {
+  const uri = process.env.MONGODB_URL;
+  if (!uri) {
+    throw new Error(
+      "MONGODB_URL is not set. The grid injects it automatically — run this app " +
+        "with `grid dev` locally, or deploy it with `grid plug` (the grid injects " +
+        "MONGODB_URL at runtime). Do not set it by hand.",
+    );
+  }
+  if (!globalThis.__mongoClientPromise) {
+    globalThis.__mongoClientPromise = new MongoClient(uri).connect();
+  }
+  return globalThis.__mongoClientPromise;
+}
+
+export async function getDb() {
+  const client = await clientPromise();
+  // The default DB comes from the MONGODB_URL path segment the grid injects.
+  return client.db();
+}
+```
+
+## services/web/app/layout.js
+
+```js
+export const metadata = {
+  title: "Todos",
+  description: "A persistent todo app on CloudGrid, backed by grid-shared Mongo.",
+};
+
+const css = `
+  :root { color-scheme: light dark; }
+  body { margin: 0; font-family: system-ui, sans-serif; }
+  main { max-width: 40rem; margin: 3rem auto; padding: 0 1.25rem; }
+  .row { display: flex; gap: .5rem; margin-bottom: 1rem; }
+  input { flex: 1; padding: .5rem .75rem; border: 1px solid #8886; border-radius: .5rem; }
+  button { padding: .5rem .9rem; border: 1px solid #8886; border-radius: .5rem; cursor: pointer; }
+  ul { list-style: none; padding: 0; margin: 0; }
+  li { display: flex; justify-content: space-between; padding: .6rem 0; border-bottom: 1px solid #8883; }
+`;
+
+export default function RootLayout({ children }) {
+  return (
+    <html lang="en">
+      <head><style dangerouslySetInnerHTML={{ __html: css }} /></head>
+      <body>{children}</body>
+    </html>
+  );
+}
+```
+
+## services/web/app/page.js
+
+```js
+import { getDb } from "../lib/db.js";
+import TodoForm from "./todo-form.js";
+
+export const dynamic = "force-dynamic";
+
+async function listTodos() {
+  const db = await getDb();
+  const items = await db.collection("todos").find({}).sort({ createdAt: -1 }).toArray();
+  return items.map((t) => ({ id: t._id.toString(), text: t.text, done: !!t.done }));
+}
+
+export default async function Page() {
+  const todos = await listTodos();
+  return (
+    <main>
+      <h1>Todos</h1>
+      <p className="hint">Persisted in the grid-shared Mongo — survives refresh.</p>
+      <TodoForm initialTodos={todos} />
+    </main>
+  );
+}
+```
+
+## services/web/app/todo-form.js
+
+```js
+"use client";
+import { useState } from "react";
+
+export default function TodoForm({ initialTodos }) {
+  const [todos, setTodos] = useState(initialTodos);
+  const [text, setText] = useState("");
+
+  async function add(e) {
+    e.preventDefault();
+    const value = text.trim();
+    if (!value) return;
+    const res = await fetch("/api/todos", {
+      method: "POST",
+      headers: { "content-type": "application/json" },
+      body: JSON.stringify({ text: value }),
+    });
+    if (res.ok) { setTodos((p) => [await res.json(), ...p]); setText(""); }
+  }
+
+  async function remove(id) {
+    const res = await fetch(`/api/todos?id=${encodeURIComponent(id)}`, { method: "DELETE" });
+    if (res.ok) setTodos((p) => p.filter((t) => t.id !== id));
+  }
+
+  return (
+    <div>
+      <form onSubmit={add} className="row">
+        <input value={text} onChange={(e) => setText(e.target.value)} placeholder="Add a todo…" />
+        <button type="submit">Add</button>
+      </form>
+      <ul>
+        {todos.map((t) => (
+          <li key={t.id}>
+            <span>{t.text}</span>
+            <button type="button" onClick={() => remove(t.id)}>Delete</button>
+          </li>
+        ))}
+      </ul>
+    </div>
+  );
+}
+```
+
+## services/web/app/api/todos/route.js
+
+```js
+import { NextResponse } from "next/server";
+import { ObjectId } from "mongodb";
+import { getDb } from "../../../lib/db.js";
+
+export const dynamic = "force-dynamic";
+
+async function todos() {
+  const db = await getDb();
+  return db.collection("todos");
+}
+
+export async function GET() {
+  const col = await todos();
+  const items = await col.find({}).sort({ createdAt: -1 }).toArray();
+  return NextResponse.json(items.map((t) => ({ id: t._id.toString(), text: t.text, done: !!t.done })));
+}
+
+export async function POST(request) {
+  const body = await request.json().catch(() => ({}));
+  const text = typeof body.text === "string" ? body.text.trim() : "";
+  if (!text) return NextResponse.json({ error: "text is required" }, { status: 400 });
+  const col = await todos();
+  const res = await col.insertOne({ text, done: false, createdAt: new Date() });
+  return NextResponse.json({ id: res.insertedId.toString(), text, done: false }, { status: 201 });
+}
+
+export async function DELETE(request) {
+  const id = new URL(request.url).searchParams.get("id");
+  if (!id || !ObjectId.isValid(id)) return NextResponse.json({ error: "valid id is required" }, { status: 400 });
+  const col = await todos();
+  await col.deleteOne({ _id: new ObjectId(id) });
+  return NextResponse.json({ ok: true });
+}
+```
+
+## Adapt it
+
+- Rename the `todos` collection to your data (`submissions`, `tasks`, `entries`).
+- Change the document fields; add owners/timestamps/statuses.
+- Add `redis: private` to `requires` only if you actually need Redis.
+- Run `grid dev` to test locally, `grid plug` to deploy (async — poll to live).

package/src/corpus/templates/app-with-data/services/web/app/api/todos/route.js

@@ -0,0 +1,48 @@
+// App Router route handler for the `todos` collection.
+// GET  -> list todos, POST -> add a todo, DELETE -> remove a todo by id.
+//
+// To adapt this app, rename the collection and change the fields to match your
+// own data (e.g. a `submissions` or `tasks` collection).
+import { NextResponse } from "next/server";
+import { ObjectId } from "mongodb";
+import { getDb } from "../../../lib/db.js";
+
+// Never cache — always read/write live data.
+export const dynamic = "force-dynamic";
+
+async function todos() {
+  const db = await getDb();
+  return db.collection("todos");
+}
+
+// GET /api/todos — list all todos, newest first.
+export async function GET() {
+  const col = await todos();
+  const items = await col.find({}).sort({ createdAt: -1 }).toArray();
+  return NextResponse.json(
+    items.map((t) => ({ id: t._id.toString(), text: t.text, done: !!t.done })),
+  );
+}
+
+// POST /api/todos — add a todo. Body: { text: string }.
+export async function POST(request) {
+  const body = await request.json().catch(() => ({}));
+  const text = typeof body.text === "string" ? body.text.trim() : "";
+  if (!text) {
+    return NextResponse.json({ error: "text is required" }, { status: 400 });
+  }
+  const col = await todos();
+  const res = await col.insertOne({ text, done: false, createdAt: new Date() });
+  return NextResponse.json({ id: res.insertedId.toString(), text, done: false }, { status: 201 });
+}
+
+// DELETE /api/todos?id=<id> — remove a todo.
+export async function DELETE(request) {
+  const id = new URL(request.url).searchParams.get("id");
+  if (!id || !ObjectId.isValid(id)) {
+    return NextResponse.json({ error: "valid id is required" }, { status: 400 });
+  }
+  const col = await todos();
+  await col.deleteOne({ _id: new ObjectId(id) });
+  return NextResponse.json({ ok: true });
+}