@dewtech/dare-cli 2.17.0 → 3.1.0

package/templates/stacks/go-stdlib/internal/middleware/rate_limit.go

@@ -0,0 +1,81 @@
+package middleware
+
+import (
+	"encoding/json"
+	"net"
+	"net/http"
+	"strings"
+	"sync"
+	"time"
+
+	"golang.org/x/time/rate"
+)
+
+// RateLimit is a token-bucket-per-IP middleware. Idle entries are pruned
+// every 5 minutes to keep memory bounded.
+func RateLimit(perSec, burst int) Middleware {
+	type bucket struct {
+		limiter *rate.Limiter
+		seen    time.Time
+	}
+	var (
+		mu      sync.Mutex
+		buckets = make(map[string]*bucket)
+	)
+
+	go func() {
+		t := time.NewTicker(5 * time.Minute)
+		defer t.Stop()
+		for now := range t.C {
+			mu.Lock()
+			for ip, b := range buckets {
+				if now.Sub(b.seen) > 10*time.Minute {
+					delete(buckets, ip)
+				}
+			}
+			mu.Unlock()
+		}
+	}()
+
+	return func(next http.Handler) http.Handler {
+		return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+			ip := clientIP(r)
+			mu.Lock()
+			b, ok := buckets[ip]
+			if !ok {
+				b = &bucket{limiter: rate.NewLimiter(rate.Limit(perSec), burst)}
+				buckets[ip] = b
+			}
+			b.seen = time.Now()
+			mu.Unlock()
+
+			if !b.limiter.Allow() {
+				w.Header().Set("Content-Type", "application/json; charset=utf-8")
+				w.WriteHeader(http.StatusTooManyRequests)
+				_ = json.NewEncoder(w).Encode(map[string]any{
+					"type":   "urn:problem:TooManyRequests",
+					"title":  http.StatusText(http.StatusTooManyRequests),
+					"status": http.StatusTooManyRequests,
+					"detail": "rate limit exceeded",
+				})
+				return
+			}
+			next.ServeHTTP(w, r)
+		})
+	}
+}
+
+func clientIP(r *http.Request) string {
+	if xff := r.Header.Get("X-Forwarded-For"); xff != "" {
+		// First IP in chain.
+		if i := strings.Index(xff, ","); i >= 0 {
+			return strings.TrimSpace(xff[:i])
+		}
+		return strings.TrimSpace(xff)
+	}
+	host, _, err := net.SplitHostPort(r.RemoteAddr)
+	if err != nil {
+		return r.RemoteAddr
+	}
+	return host
+}

package/templates/stacks/go-stdlib/internal/model/user.go

@@ -0,0 +1,17 @@
+// Package model — domain entities.
+package model
+
+import (
+	"time"
+
+	"github.com/google/uuid"
+)
+
+type User struct {
+	ID        uuid.UUID `json:"id"`
+	Email     string    `json:"email"`
+	Password  string    `json:"-"`
+	Role      string    `json:"role"`
+	CreatedAt time.Time `json:"createdAt"`
+	UpdatedAt time.Time `json:"updatedAt"`
+}

package/templates/stacks/go-stdlib/internal/repository/users_repository.go.tpl

@@ -0,0 +1,75 @@
+// Package repository — the only layer with SQL strings. Production setups can
+// swap in sqlc-generated code from db/queries/users.sql.
+package repository
+
+import (
+	"context"
+	"errors"
+
+	"github.com/google/uuid"
+	"github.com/jackc/pgx/v5"
+	"github.com/jackc/pgx/v5/pgxpool"
+
+	"{{moduleName}}/internal/model"
+)
+
+type UsersRepository struct {
+	pool *pgxpool.Pool
+}
+
+func NewUsersRepository(pool *pgxpool.Pool) *UsersRepository {
+	return &UsersRepository{pool: pool}
+}
+
+func (r *UsersRepository) FindByEmail(ctx context.Context, email string) (*model.User, error) {
+	row := r.pool.QueryRow(ctx,
+		`SELECT id, email, password, role, created_at, updated_at FROM users WHERE email = $1`, email)
+	u := &model.User{}
+	if err := row.Scan(&u.ID, &u.Email, &u.Password, &u.Role, &u.CreatedAt, &u.UpdatedAt); err != nil {
+		if errors.Is(err, pgx.ErrNoRows) {
+			return nil, nil
+		}
+		return nil, err
+	}
+	return u, nil
+}
+
+func (r *UsersRepository) Page(ctx context.Context, offset, limit int64) ([]*model.User, error) {
+	rows, err := r.pool.Query(ctx,
+		`SELECT id, email, password, role, created_at, updated_at
+		 FROM users ORDER BY created_at DESC LIMIT $1 OFFSET $2`, limit, offset)
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close()
+
+	var out []*model.User
+	for rows.Next() {
+		u := &model.User{}
+		if err := rows.Scan(&u.ID, &u.Email, &u.Password, &u.Role, &u.CreatedAt, &u.UpdatedAt); err != nil {
+			return nil, err
+		}
+		out = append(out, u)
+	}
+	return out, rows.Err()
+}
+
+func (r *UsersRepository) Count(ctx context.Context) (int64, error) {
+	var total int64
+	err := r.pool.QueryRow(ctx, `SELECT COUNT(*) FROM users`).Scan(&total)
+	return total, err
+}
+
+func (r *UsersRepository) Create(ctx context.Context, email, passwordHash, role string) (*model.User, error) {
+	u := &model.User{}
+	err := r.pool.QueryRow(ctx,
+		`INSERT INTO users (id, email, password, role)
+		 VALUES ($1, $2, $3, $4)
+		 RETURNING id, email, password, role, created_at, updated_at`,
+		uuid.New(), email, passwordHash, role,
+	).Scan(&u.ID, &u.Email, &u.Password, &u.Role, &u.CreatedAt, &u.UpdatedAt)
+	if err != nil {
+		return nil, err
+	}
+	return u, nil
+}

package/templates/stacks/go-stdlib/internal/service/auth_service.go.tpl

@@ -0,0 +1,55 @@
+// Package service — business logic.
+package service
+
+import (
+	"context"
+	"errors"
+	"strings"
+	"time"
+
+	"github.com/golang-jwt/jwt/v5"
+	"golang.org/x/crypto/bcrypt"
+
+	"{{moduleName}}/internal/config"
+	"{{moduleName}}/internal/repository"
+)
+
+var ErrInvalidCredentials = errors.New("invalid credentials")
+
+type AuthService struct {
+	repo *repository.UsersRepository
+	cfg  *config.Config
+}
+
+func NewAuthService(r *repository.UsersRepository, cfg *config.Config) *AuthService {
+	return &AuthService{repo: r, cfg: cfg}
+}
+
+func (s *AuthService) Login(ctx context.Context, email, password string) (string, int64, error) {
+	email = strings.TrimSpace(strings.ToLower(email))
+	user, err := s.repo.FindByEmail(ctx, email)
+	if err != nil {
+		return "", 0, err
+	}
+	if user == nil {
+		return "", 0, ErrInvalidCredentials
+	}
+	if err := bcrypt.CompareHashAndPassword([]byte(user.Password), []byte(password)); err != nil {
+		return "", 0, ErrInvalidCredentials
+	}
+
+	expHours := s.cfg.JWTExpHours
+	expiresAt := time.Now().Add(time.Duration(expHours) * time.Hour)
+	claims := jwt.MapClaims{
+		"sub":   user.ID.String(),
+		"email": user.Email,
+		"role":  user.Role,
+		"exp":   expiresAt.Unix(),
+	}
+	token := jwt.NewWithClaims(jwt.SigningMethodHS256, claims)
+	signed, err := token.SignedString([]byte(s.cfg.JWTSecret))
+	if err != nil {
+		return "", 0, err
+	}
+	return signed, int64(expHours) * 3600, nil
+}

package/templates/stacks/go-stdlib/internal/service/users_service.go.tpl

@@ -0,0 +1,53 @@
+package service
+
+import (
+	"context"
+	"errors"
+	"strings"
+
+	"golang.org/x/crypto/bcrypt"
+
+	"{{moduleName}}/internal/config"
+	"{{moduleName}}/internal/model"
+	"{{moduleName}}/internal/repository"
+)
+
+var ErrEmailExists = errors.New("email already in use")
+
+type UsersService struct {
+	repo *repository.UsersRepository
+	cfg  *config.Config
+}
+
+func NewUsersService(r *repository.UsersRepository, cfg *config.Config) *UsersService {
+	return &UsersService{repo: r, cfg: cfg}
+}
+
+func (s *UsersService) Page(ctx context.Context, page, limit int) ([]*model.User, int64, error) {
+	offset := int64((page - 1) * limit)
+	items, err := s.repo.Page(ctx, offset, int64(limit))
+	if err != nil {
+		return nil, 0, err
+	}
+	total, err := s.repo.Count(ctx)
+	if err != nil {
+		return nil, 0, err
+	}
+	return items, total, nil
+}
+
+func (s *UsersService) Create(ctx context.Context, email, password, role string) (*model.User, error) {
+	email = strings.TrimSpace(strings.ToLower(email))
+	existing, err := s.repo.FindByEmail(ctx, email)
+	if err != nil {
+		return nil, err
+	}
+	if existing != nil {
+		return nil, ErrEmailExists
+	}
+	hash, err := bcrypt.GenerateFromPassword([]byte(password), s.cfg.BcryptCost)
+	if err != nil {
+		return nil, err
+	}
+	return s.repo.Create(ctx, email, string(hash), role)
+}

package/templates/stacks/go-stdlib/llms.txt.tpl

@@ -0,0 +1,60 @@
+# {{projectName}}
+
+DARE-shaped Go API on **net/http stdlib** (no framework). Layered Design.
+
+## Setup
+
+```bash
+cp .env.example .env
+docker compose up -d postgres
+go mod tidy
+sqlc generate
+go run ./cmd/server
+```
+
+## Commands
+
+- `go run ./cmd/server` — dev server (port 8000)
+- `go test ./...` — tests
+- `golangci-lint run` — lint
+- `govulncheck ./...` — vuln scan
+- `sqlc generate` — regenerate type-safe DB code from db/queries/*.sql
+
+## Endpoints
+
+| Method | Path | Auth | Description |
+|---|---|---|---|
+| POST | `/auth/login` | none | Exchange email+password for JWT |
+| GET | `/auth/me` | Bearer | Current user |
+| GET | `/users` | Bearer | List (query: page, limit) |
+| POST | `/users` | Bearer (admin) | Create user |
+| GET | `/ws` | upgrade | WebSocket echo |
+| GET | `/openapi.json` | none | OpenAPI document |
+
+## Layered Design
+
+- `internal/handler/` — HTTP layer (net/http handlers)
+- `internal/service/` — business logic
+- `internal/repository/` — pgx queries (sqlc-compatible)
+- `internal/model/` — domain structs
+- `internal/middleware/` — JWT + rate limit + CORS + chain helper
+- `internal/llm/` — provider abstraction
+- `internal/httpx/` — JSON helpers (encode/decode)
+
+Handlers never call pgx directly.
+
+## Why net/http stdlib?
+
+Go 1.22 added method+pattern routing to `http.ServeMux`:
+`mux.HandleFunc("POST /auth/login", h.Login)`. That covers 80% of what
+Gin / Echo / Chi were used for, with zero deps. Frameworks only buy
+nicer middleware DX and a slightly faster path tree — both replaceable
+with the helpers in `internal/middleware/`.
+
+## Env vars
+
+See `.env.example`. Required: `DATABASE_URL`, `JWT_SECRET`.
+
+## DARE skills
+
+See `.dare/skills.yml`.

package/templates/stacks/go-stdlib/openapi.json.tpl

@@ -0,0 +1,46 @@
+{
+  "openapi": "3.0.3",
+  "info": {
+    "title": "{{projectName}}",
+    "version": "0.1.0",
+    "description": "DARE-shaped Go API on net/http stdlib."
+  },
+  "paths": {
+    "/auth/login": {
+      "post": {
+        "summary": "Exchange email+password for JWT",
+        "responses": { "200": { "description": "JWT issued" }, "401": { "description": "Invalid credentials" } }
+      }
+    },
+    "/auth/me": {
+      "get": {
+        "summary": "Current user",
+        "security": [{ "bearer": [] }],
+        "responses": { "200": { "description": "User" }, "401": { "description": "Unauthorized" } }
+      }
+    },
+    "/users": {
+      "get": {
+        "summary": "List users",
+        "security": [{ "bearer": [] }],
+        "responses": { "200": { "description": "Page of users" } }
+      },
+      "post": {
+        "summary": "Create user (admin)",
+        "security": [{ "bearer": [] }],
+        "responses": { "201": { "description": "Created" }, "403": { "description": "Forbidden" } }
+      }
+    },
+    "/ws": {
+      "get": {
+        "summary": "WebSocket echo",
+        "responses": { "101": { "description": "Switching Protocols" } }
+      }
+    }
+  },
+  "components": {
+    "securitySchemes": {
+      "bearer": { "type": "http", "scheme": "bearer", "bearerFormat": "JWT" }
+    }
+  }
+}

package/templates/stacks/go-stdlib/sqlc.yaml

@@ -0,0 +1,14 @@
+version: "2"
+sql:
+  - engine: "postgresql"
+    queries: "db/queries"
+    schema: "db/migrations"
+    gen:
+      go:
+        package: "sqlcgen"
+        out: "internal/repository/sqlcgen"
+        sql_package: "pgx/v5"
+        emit_json_tags: true
+        emit_prepared_queries: false
+        emit_interface: false
+        emit_exact_table_names: false

package/templates/stacks/go-stdlib/tests/smoke_test.go.tpl

@@ -0,0 +1,45 @@
+// Smoke tests — exercise pure helpers without a DB.
+package tests
+
+import (
+	"net/http"
+	"net/http/httptest"
+	"os"
+	"testing"
+
+	"github.com/stretchr/testify/require"
+
+	"{{moduleName}}/internal/config"
+	"{{moduleName}}/internal/middleware"
+)
+
+func TestConfigFromEnvDefaultsAreSane(t *testing.T) {
+	t.Setenv("DATABASE_URL", "postgres://u:p@localhost:5432/x?sslmode=disable")
+	os.Unsetenv("APP_PORT")
+	cfg, err := config.FromEnv()
+	require.NoError(t, err)
+	require.Equal(t, 8000, cfg.AppPort)
+	require.GreaterOrEqual(t, cfg.RateLimitBurst, cfg.RateLimitPerSec)
+}
+
+func TestRateLimitBlocksAfterBurst(t *testing.T) {
+	mw := middleware.RateLimit(1, 2)
+	h := mw(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
+		w.WriteHeader(http.StatusOK)
+	}))
+
+	// First 2 (burst) should pass.
+	for i := 0; i < 2; i++ {
+		rec := httptest.NewRecorder()
+		req := httptest.NewRequest(http.MethodGet, "/", nil)
+		req.RemoteAddr = "10.0.0.1:1234"
+		h.ServeHTTP(rec, req)
+		require.Equal(t, http.StatusOK, rec.Code)
+	}
+	// 3rd should be 429.
+	rec := httptest.NewRecorder()
+	req := httptest.NewRequest(http.MethodGet, "/", nil)
+	req.RemoteAddr = "10.0.0.1:1234"
+	h.ServeHTTP(rec, req)
+	require.Equal(t, http.StatusTooManyRequests, rec.Code)
+}

package/templates/stacks/mcp-go/.dare/skills.yml

@@ -0,0 +1,8 @@
+version: 1
+skills:
+  - id: skill-mcp-server
+    source: skill-mcp-server
+    description: MCP server patterns (tools, prompts, transports)
+  - id: dare-ax
+    source: dare-ax
+    description: Agent eXperience invariants (llms.txt, OpenAPI, --json --list-tools, rate limit)

package/templates/stacks/mcp-go/.env.example

@@ -0,0 +1,14 @@
+# MCP transport — overrides --transport flag if set
+# Valid: stdio | sse | http
+MCP_TRANSPORT=stdio
+
+# HTTP/SSE transport bind (ignored on stdio)
+MCP_HOST=0.0.0.0
+MCP_PORT=3001
+
+# Logging
+LOG_LEVEL=info
+
+# LLM provider (optional)
+LLM_PROVIDER=dummy
+# OPENAI_API_KEY=

package/templates/stacks/mcp-go/.github/workflows/dare-ci.yml

@@ -0,0 +1,42 @@
+name: DARE CI
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+
+jobs:
+  audit:
+    name: govulncheck
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-go@v5
+        with:
+          go-version: "1.22"
+      - run: go install golang.org/x/vuln/cmd/govulncheck@latest
+      - run: govulncheck ./...
+
+  lint:
+    name: golangci-lint
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-go@v5
+        with:
+          go-version: "1.22"
+      - uses: golangci/golangci-lint-action@v6
+        with:
+          version: v1.61
+
+  test:
+    name: go test
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-go@v5
+        with:
+          go-version: "1.22"
+      - run: go mod download
+      - run: go test ./...

package/templates/stacks/mcp-go/README.md.tpl

@@ -0,0 +1,50 @@
+# {{projectName}}
+
+DARE-shaped MCP server in Go using `mark3labs/mcp-go`.
+Default transport: **{{defaultTransport}}**.
+
+> ⚠️ **Beta.** `mark3labs/mcp-go` is the community Go SDK. Migrate to an
+> official Anthropic Go SDK if/when one ships.
+
+## Setup
+
+```bash
+cp .env.example .env
+go mod tidy
+go run ./cmd/server          # uses {{defaultTransport}} transport by default
+```
+
+## Test with MCP Inspector
+
+```bash
+npx @modelcontextprotocol/inspector go run ./cmd/server
+```
+
+## Tools
+
+- `echo` — returns its input. Canonical smoke test.
+
+## Prompts
+
+- `summarize` — placeholder prompt template taking a `text` argument.
+
+## Transports
+
+Pick at runtime via `--transport stdio|sse|http` or `MCP_TRANSPORT`:
+
+| Transport | When to use |
+|---|---|
+| `stdio` (default) | Local CLI agents |
+| `sse`             | Web clients via SSE |
+| `http`            | Streamable HTTP |
+
+## Commands
+
+- `go run ./cmd/server` — start server
+- `go test ./...` — tests
+- `golangci-lint run` — lint
+- `govulncheck ./...` — vuln scan
+
+## DARE Method
+
+See `.dare/skills.yml` and `llms.txt`.

package/templates/stacks/mcp-go/cmd/server/main.go.tpl

@@ -0,0 +1,62 @@
+// {{projectName}} — MCP server entrypoint.
+package main
+
+import (
+	"encoding/json"
+	"flag"
+	"fmt"
+	"os"
+
+	"github.com/joho/godotenv"
+
+	"{{moduleName}}/internal/server"
+	"{{moduleName}}/internal/transports"
+)
+
+func main() {
+	_ = godotenv.Load()
+
+	defaultTransport := os.Getenv("MCP_TRANSPORT")
+	if defaultTransport == "" {
+		defaultTransport = "{{defaultTransport}}"
+	}
+
+	transport := flag.String("transport", defaultTransport, "stdio | sse | http")
+	jsonOut := flag.Bool("json", false, "emit JSON output (use with --list-tools)")
+	listTools := flag.Bool("list-tools", false, "list registered tools as JSON and exit")
+	flag.Parse()
+
+	// --json --list-tools short-circuits before starting any transport (M-03).
+	if *listTools && *jsonOut {
+		out, _ := json.MarshalIndent(server.InventoryJSON(), "", "  ")
+		fmt.Println(string(out))
+		return
+	}
+
+	host := envOr("MCP_HOST", "0.0.0.0")
+	port := envOr("MCP_PORT", "3001")
+
+	var err error
+	switch *transport {
+	case "stdio":
+		err = transports.RunStdio()
+	case "sse":
+		err = transports.RunSSE(host, port)
+	case "http":
+		err = transports.RunHTTP(host, port)
+	default:
+		fmt.Fprintf(os.Stderr, "invalid transport %q (valid: stdio, sse, http)\n", *transport)
+		os.Exit(1)
+	}
+	if err != nil {
+		fmt.Fprintf(os.Stderr, "[mcp] fatal: %v\n", err)
+		os.Exit(1)
+	}
+}
+
+func envOr(key, def string) string {
+	if v := os.Getenv(key); v != "" {
+		return v
+	}
+	return def
+}

package/templates/stacks/mcp-go/gitignore

@@ -0,0 +1,6 @@
+/bin/
+/vendor/
+.env
+.env.local
+*.log
+.DS_Store

package/templates/stacks/mcp-go/go.mod.tpl

@@ -0,0 +1,9 @@
+module {{moduleName}}
+
+go 1.23
+
+require (
+	github.com/mark3labs/mcp-go v0.54.1
+	github.com/joho/godotenv v1.5.1
+	github.com/stretchr/testify v1.9.0
+)

package/templates/stacks/mcp-go/internal/prompts/summarize.go

@@ -0,0 +1,9 @@
+// Package prompts holds pure prompt builders.
+package prompts
+
+import "fmt"
+
+// Summarize returns the user-message body for a summarize prompt.
+func Summarize(text string) string {
+	return fmt.Sprintf("Summarize the following text in 1-2 sentences.\n\n%s", text)
+}