@phila/cli 0.0.1

package/dist/templates/webapp-lambda-dynamo-node/apps/api/index.ts

@@ -0,0 +1,109 @@
+// ABOUTME: Lambda API handler with DynamoDB database connection
+// ABOUTME: Uses philaroute for routing with DynamoDB DocumentClient
+
+/**
+ * HTTP routing using @phila/philaroute
+ * @see https://github.com/CityOfPhiladelphia/philaroute
+ *
+ * DynamoDB integration using AWS SDK v3 DocumentClient
+ */
+
+import type { APIGWV1Payload } from '@phila/philaroute/dist/types';
+import type { RestAccumulator } from '@phila/philaroute/dist/types';
+import { Router, http, validate } from '@phila/philaroute';
+import { DynamoDBClient } from '@aws-sdk/client-dynamodb';
+import {
+  DynamoDBDocumentClient,
+  GetCommand,
+  PutCommand,
+  DeleteCommand,
+} from '@aws-sdk/lib-dynamodb';
+
+const client = new DynamoDBClient({});
+const docClient = DynamoDBDocumentClient.from(client);
+
+const TABLE_NAME = process.env.TABLE_NAME!;
+
+const router = Router({
+  cors: {
+    'Access-Control-Allow-Origin': '*',
+    'Access-Control-Allow-Method': 'GET,POST,PUT,DELETE,OPTIONS',
+    'Access-Control-Allow-Headers': 'Content-Type,Authorization',
+  },
+});
+
+const health = {
+  check: async (acc: RestAccumulator) => {
+    acc.data.status = 'healthy';
+    acc.data.timestamp = new Date().toISOString();
+    return acc;
+  },
+};
+
+const items = {
+  get: async (acc: RestAccumulator) => {
+    const id = acc.data.valid.parameters.id;
+    const result = await docClient.send(
+      new GetCommand({
+        TableName: TABLE_NAME,
+        Key: { pk: id },
+      })
+    );
+
+    validate.assert(result.Item, 'Item not found', 404);
+
+    acc.data.item = result.Item;
+    return acc;
+  },
+
+  create: async (acc: RestAccumulator) => {
+    const body = acc.data.valid.body;
+    const item = {
+      pk: body.id,
+      ...body,
+      createdAt: new Date().toISOString(),
+      updatedAt: new Date().toISOString(),
+    };
+
+    await docClient.send(
+      new PutCommand({
+        TableName: TABLE_NAME,
+        Item: item,
+      })
+    );
+
+    acc.data.message = 'Item created';
+    acc.data.item = item;
+    return acc;
+  },
+
+  delete: async (acc: RestAccumulator) => {
+    const id = acc.data.valid.parameters.id;
+
+    await docClient.send(
+      new DeleteCommand({
+        TableName: TABLE_NAME,
+        Key: { pk: id },
+      })
+    );
+
+    acc.data.message = 'Item deleted';
+    return acc;
+  },
+};
+
+// Route definitions
+// The router automatically responds with 200 and acc.data as body.
+// Use http.response({ statusCode }) only when overriding (e.g., 201 for POST).
+
+router.path('/health').get([health.check]);
+
+router.path('/items/:id').get([validate.parameters(['id']), items.get]);
+
+router
+  .path('/items')
+  .post([validate.body({ id: 'string' }), items.create, http.response({ statusCode: 201 })]);
+
+router.path('/items/:id').delete([validate.parameters(['id']), items.delete]);
+
+export const handler = async (event: APIGWV1Payload) => router.routeToPath(event);

package/dist/templates/webapp-lambda-dynamo-node/apps/api/package.json

@@ -0,0 +1,19 @@
+{
+  "name": "api",
+  "version": "1.0.0",
+  "description": "Lambda API handler with DynamoDB",
+  "private": true,
+  "scripts": {
+    "build": "tsc",
+    "watch": "tsc -w"
+  },
+  "dependencies": {
+    "@phila/philaroute": "^1.0.12",
+    "@aws-sdk/client-dynamodb": "^3.0.0",
+    "@aws-sdk/lib-dynamodb": "^3.0.0",
+    "@types/aws-lambda": "^8.10.0"
+  },
+  "devDependencies": {
+    "typescript": "^5.3.0"
+  }
+}

package/dist/templates/webapp-lambda-dynamo-node/apps/api/tsconfig.json

@@ -0,0 +1,8 @@
+{
+  "extends": "../../tsconfig.json",
+  "compilerOptions": {
+    "outDir": "dist",
+    "rootDir": "."
+  },
+  "include": ["*.ts"]
+}

package/dist/templates/webapp-lambda-dynamo-node/cdk/app.ts.tmpl

@@ -0,0 +1,65 @@
+#!/usr/bin/env node
+import 'source-map-support/register';
+import { App, Aspects, Stack } from 'aws-cdk-lib';
+import { AwsSolutionsChecks, NIST80053R5Checks } from 'cdk-nag';
+import { StaticSite, LambdaDynamoApi, Confidentiality, Environment } from '@phila/constructs';
+
+const app = new App();
+
+// Environment is determined by CDK context
+const environment = app.node.tryGetContext('environment') as Environment;
+
+if (!environment) {
+  throw new Error('Environment must be specified via context. Use: cdk deploy -c environment=dev');
+}
+
+// Read compliance frameworks from context
+const compliance = app.node.tryGetContext('compliance');
+const complianceFrameworks = compliance ? compliance.split(',') : [];
+
+// Application context with governance metadata
+const context = {
+  appName: '{{appName}}',
+  environment,
+  department: '{{department}}',
+  team: '{{team}}',
+  contact: '{{contact}}',
+  compliance: complianceFrameworks,
+  confidentiality: Confidentiality.{{CONFIDENTIALITY}},
+};
+
+// Stack name follows pattern: {appName}-{environment}
+const stack = new Stack(app, '{{appName}}-' + environment, {
+  env: {
+    account: process.env.CDK_DEFAULT_ACCOUNT,
+    region: process.env.CDK_DEFAULT_REGION || 'us-east-1',
+  },
+  stackName: '{{appName}}-' + environment,
+});
+
+// Create the StaticSite construct for the Nuxt frontend
+new StaticSite(stack, '{{appName}}Site', {
+  ...context,
+  assetDir: '../frontend/dist',
+});
+
+// Create the LambdaDynamoApi construct for the API backend with DynamoDB
+new LambdaDynamoApi(stack, '{{appName}}Api', {
+  ...context,
+  apiId: 'api',
+  runtime: 'nodejs20',
+  handler: 'index.handler',
+  codeDir: '../apps/api',
+  // DynamoDB table configuration
+  partitionKey: { name: 'pk', type: 'S' },
+  // Uncomment for composite key (partition + sort):
+  // sortKey: { name: 'sk', type: 'S' },
+  // Uncomment to enable DynamoDB streams:
+  // enableStream: true,
+});
+
+// Apply compliance checks
+Aspects.of(app).add(new NIST80053R5Checks({ verbose: true }));
+Aspects.of(app).add(new AwsSolutionsChecks({ verbose: true }));
+
+app.synth();

package/dist/templates/webapp-lambda-dynamo-node/cdk/cdk.json

@@ -0,0 +1,68 @@
+{
+  "app": "npx ts-node --prefer-ts-exts app.ts",
+  "watch": {
+    "include": ["**"],
+    "exclude": [
+      "README.md",
+      "cdk*.json",
+      "**/*.d.ts",
+      "**/*.js",
+      "tsconfig.json",
+      "package*.json",
+      "yarn.lock",
+      "node_modules",
+      "test"
+    ]
+  },
+  "context": {
+    "@aws-cdk/aws-lambda:recognizeLayerVersion": true,
+    "@aws-cdk/core:checkSecretUsage": true,
+    "@aws-cdk/core:target-partitions": ["aws", "aws-cn"],
+    "@aws-cdk-containers/ecs-service-extensions:enableDefaultLogDriver": true,
+    "@aws-cdk/aws-ec2:uniqueImdsv2TemplateName": true,
+    "@aws-cdk/aws-ecs:arnFormatIncludesClusterName": true,
+    "@aws-cdk/aws-iam:minimizePolicies": true,
+    "@aws-cdk/core:validateSnapshotRemovalPolicy": true,
+    "@aws-cdk/aws-codepipeline:crossAccountKeyAliasStackSafeResourceName": true,
+    "@aws-cdk/aws-s3:createDefaultLoggingPolicy": true,
+    "@aws-cdk/aws-sns-subscriptions:restrictSqsDescryption": true,
+    "@aws-cdk/aws-apigateway:disableCloudWatchRole": false,
+    "@aws-cdk/core:enablePartitionLiterals": true,
+    "@aws-cdk/aws-events:eventsTargetQueueSameAccount": true,
+    "@aws-cdk/aws-iam:standardizedServicePrincipals": true,
+    "@aws-cdk/aws-ecs:disableExplicitDeploymentControllerForCircuitBreaker": true,
+    "@aws-cdk/aws-iam:importedRoleStackSafeDefaultPolicyName": true,
+    "@aws-cdk/aws-s3:serverAccessLogsUseBucketPolicy": true,
+    "@aws-cdk/aws-route53-patters:useCertificate": true,
+    "@aws-cdk/customresources:installLatestAwsSdkDefault": false,
+    "@aws-cdk/aws-rds:databaseProxyUniqueResourceName": true,
+    "@aws-cdk/aws-codedeploy:removeAlarmsFromDeploymentGroup": true,
+    "@aws-cdk/aws-apigateway:authorizerChangeDeploymentLogicalId": true,
+    "@aws-cdk/aws-ec2:launchTemplateDefaultUserData": true,
+    "@aws-cdk/aws-secretsmanager:useAttachedSecretResourcePolicyForSecretTargetAttachments": true,
+    "@aws-cdk/aws-redshift:columnId": true,
+    "@aws-cdk/aws-stepfunctions-tasks:enableEmrServicePolicyV2": true,
+    "@aws-cdk/aws-ec2:restrictDefaultSecurityGroup": true,
+    "@aws-cdk/aws-apigateway:requestValidatorUniqueId": true,
+    "@aws-cdk/aws-kms:aliasNameRef": true,
+    "@aws-cdk/aws-autoscaling:generateLaunchTemplateInsteadOfLaunchConfig": true,
+    "@aws-cdk/core:includePrefixInUniqueNameGeneration": true,
+    "@aws-cdk/aws-efs:denyAnonymousAccess": true,
+    "@aws-cdk/aws-opensearchservice:enableOpensearchMultiAzWithStandby": true,
+    "@aws-cdk/aws-lambda-nodejs:useLatestRuntimeVersion": true,
+    "@aws-cdk/aws-efs:mountTargetOrderInsensitiveLogicalId": true,
+    "@aws-cdk/aws-rds:auroraClusterChangeScopeOfInstanceParameterGroupWithEachParameters": true,
+    "@aws-cdk/aws-appsync:useArnForSourceApiAssociationIdentifier": true,
+    "@aws-cdk/aws-rds:preventRenderingDeprecatedCredentials": true,
+    "@aws-cdk/aws-codepipeline-actions:useNewDefaultBranchForCodeCommitSource": true,
+    "@aws-cdk/aws-cloudwatch-actions:changeLambdaPermissionLogicalIdForLambdaAction": true,
+    "@aws-cdk/aws-codepipeline:crossAccountKeysDefaultValueToFalse": true,
+    "@aws-cdk/aws-codepipeline:defaultPipelineTypeToV2": true,
+    "@aws-cdk/aws-kms:reduceCrossAccountRegionPolicyScope": true,
+    "@aws-cdk/aws-eks:nodegroupNameAttribute": true,
+    "@aws-cdk/aws-ec2:ebsDefaultGp3Volume": true,
+    "@aws-cdk/aws-ecs:removeDefaultDeploymentAlarm": true,
+    "@aws-cdk/custom-resources:logApiResponseDataPropertyTrueDefault": false,
+    "@aws-cdk/aws-s3:keepNotificationInImportedBucket": false
+  }
+}

package/dist/templates/webapp-lambda-dynamo-node/cdk/tsconfig.json

@@ -0,0 +1,9 @@
+{
+  "extends": "../tsconfig.json",
+  "compilerOptions": {
+    "outDir": "dist",
+    "rootDir": "."
+  },
+  "include": ["*.ts"],
+  "exclude": ["node_modules", "cdk.out"]
+}

package/dist/templates/webapp-lambda-dynamo-node/package.json.tmpl

@@ -0,0 +1,24 @@
+{
+  "name": "{{appName}}",
+  "version": "1.0.0",
+  "description": "Web application with Nuxt frontend and Lambda API backend",
+  "private": true,
+  "scripts": {
+    "build": "npm run build --workspaces",
+    "build:frontend": "cd frontend && npm run build",
+    "build:api": "cd apps/api && npm run build",
+    "dev": "cd frontend && npm run dev",
+    "test": "npm test --workspaces --if-present",
+    "synth": "cd cdk && cdk synth",
+    "deploy": "cd cdk && cdk deploy",
+    "diff": "cd cdk && cdk diff"
+  },
+  "workspaces": [
+    "cdk",
+    "apps/*",
+    "frontend"
+  ],
+  "devDependencies": {
+    "typescript": "^5.3.0"
+  }
+}

package/dist/templates/webapp-lambda-dynamo-node/tsconfig.json

@@ -0,0 +1,27 @@
+{
+  "compilerOptions": {
+    "target": "ES2020",
+    "module": "commonjs",
+    "lib": ["ES2020"],
+    "declaration": true,
+    "strict": true,
+    "noImplicitAny": true,
+    "strictNullChecks": true,
+    "noImplicitThis": true,
+    "alwaysStrict": true,
+    "noUnusedLocals": false,
+    "noUnusedParameters": false,
+    "noImplicitReturns": true,
+    "noFallthroughCasesInSwitch": false,
+    "inlineSourceMap": true,
+    "inlineSources": true,
+    "experimentalDecorators": true,
+    "strictPropertyInitialization": false,
+    "typeRoots": ["./node_modules/@types"],
+    "skipLibCheck": true,
+    "esModuleInterop": true,
+    "forceConsistentCasingInFileNames": true,
+    "resolveJsonModule": true
+  },
+  "exclude": ["node_modules", "cdk.out", "frontend"]
+}

package/dist/templates/webapp-lambda-node/README.md.tmpl

@@ -0,0 +1,179 @@
+# {{appName}}
+
+Web application with Nuxt SSG frontend and Lambda API backend using Philadelphia constructs.
+
+Generated on {{timestamp}}
+
+## Architecture
+
+![Architecture Diagram](https://github.com/CityOfPhiladelphia/phila-ctl/blob/main/packages/constructs/docs/diagrams/webapp-lambda.drawio)
+
+View the [architecture diagram](https://github.com/CityOfPhiladelphia/phila-ctl/blob/main/packages/constructs/docs/diagrams/webapp-lambda.drawio) in draw.io or VS Code with the Draw.io extension.
+
+## Quick Start
+
+### Prerequisites
+
+- Node.js 20+
+- AWS CLI configured with SSO
+- AWS profile named `phila-{{appName}}`
+
+### Setup
+
+```bash
+# Install dependencies
+npm install
+
+# Build all packages
+npm run build
+```
+
+### Development
+
+```bash
+# Run frontend dev server
+npm run dev
+
+# Build frontend for production
+npm run build:frontend
+
+# Build API
+npm run build:api
+```
+
+### Deployment
+
+```bash
+# Configure AWS profile
+export AWS_PROFILE=phila-{{appName}}
+
+# Deploy to dev environment
+city deploy dev
+
+# Deploy to test environment
+city deploy test
+
+# Deploy to production (requires confirmation)
+city deploy prod
+```
+
+### Shipping Updates
+
+```bash
+# Ship frontend changes to S3/CloudFront
+city ship dev --web
+
+# Ship API changes to Lambda
+city ship dev --lambda api
+```
+
+## Project Structure
+
+```
+.
+├── cdk/                    # CDK infrastructure code
+│   └── app.ts              # Main CDK application
+├── frontend/               # Nuxt 3 SSG frontend
+│   ├── pages/              # File-based routing
+│   ├── app.vue             # Root component
+│   └── nuxt.config.ts      # Nuxt configuration
+├── apps/                   # Backend code
+│   └── api/                # Lambda API handler
+│       └── index.ts        # API routes
+└── city.config.json        # City CLI configuration
+```
+
+## Frontend
+
+The frontend uses [Nuxt 3](https://nuxt.com) with Static Site Generation (SSG):
+
+- Pre-renders to static HTML for S3/CloudFront
+- File-based routing in `pages/` directory
+- TypeScript support enabled
+
+### Adding Pages
+
+Create Vue files in `frontend/pages/`:
+
+```vue
+<!-- frontend/pages/about.vue -->
+<template>
+  <div>
+    <h1>About</h1>
+  </div>
+</template>
+```
+
+This automatically creates a route at `/about`.
+
+## API
+
+The API uses [@phila/philaroute](https://www.npmjs.com/package/@phila/philaroute) for HTTP routing.
+
+### Adding Endpoints
+
+Edit `apps/api/index.ts`:
+
+```typescript
+const users = router.path('/users');
+users.get([
+  async (acc) => ({
+    ...acc,
+    response: {
+      statusCode: 200,
+      body: { users: [] },
+    },
+  }),
+]);
+```
+
+### Environment Variables
+
+Lambda functions automatically receive:
+- `APP_NAME` - Application name ({{appName}})
+- `ENVIRONMENT` - Current environment (dev/test/prod)
+
+## Resources Created
+
+This application creates:
+
+**Frontend:**
+- **S3 Bucket** - Static asset storage
+- **CloudFront Distribution** - CDN with HTTPS
+- **Origin Access Control** - Secure S3 access
+
+**API:**
+- **API Gateway REST API** - HTTP endpoint
+- **Lambda Function** - Serverless compute
+- **VPC Security Group** - Network security
+- **IAM Role** - Permissions for Lambda execution
+
+**Shared:**
+- **SSM Parameters** - Resource discovery
+- **CloudWatch Logs** - Application logs
+- **KMS Keys** - Encryption
+
+## URLs
+
+After deployment, URLs are available via:
+
+```bash
+# Frontend URL
+city config list --env dev | grep cloudfront
+
+# API URL
+city config list --env dev | grep api
+```
+
+## Adding a Database
+
+To add a database, use one of these templates instead:
+- `webapp-lambda-dynamo-node` - For DynamoDB
+- `webapp-lambda-postgres-node` - For PostgreSQL
+
+## Support
+
+For issues or questions:
+- [Philadelphia Infrastructure Library Documentation](https://github.com/CityOfPhiladelphia/phila-ctl)
+- [philaroute Documentation](https://www.npmjs.com/package/@phila/philaroute)
+- [Nuxt Documentation](https://nuxt.com/docs)

package/dist/templates/webapp-lambda-node/apps/api/index.ts

@@ -0,0 +1,100 @@
+// ABOUTME: Lambda API handler using philaroute HTTP router
+// ABOUTME: Provides REST endpoint scaffolding for web application backend
+
+/**
+ * HTTP routing using @phila/philaroute
+ * @see https://github.com/CityOfPhiladelphia/philaroute
+ *
+ * Database connections (when needed):
+ *
+ * PostgreSQL using @phila/db-postgres
+ * @see https://github.com/CityOfPhiladelphia/db-postgres
+ *
+ *   import { getPool } from '@phila/db-postgres';
+ *
+ *   const items = {
+ *     list: async (acc: RestAccumulator) => {
+ *       const pool = await getPool();
+ *       const result = await pool.query('SELECT * FROM items');
+ *       acc.data.items = result.rows;
+ *       return acc;
+ *     }
+ *   };
+ *
+ * Oracle using @phila/db-oracle
+ * @see https://github.com/CityOfPhiladelphia/db-oracle
+ *
+ *   import { getConnection } from '@phila/db-oracle';
+ *
+ *   const items = {
+ *     list: async (acc: RestAccumulator) => {
+ *       const conn = await getConnection();
+ *       const result = await conn.execute('SELECT * FROM items');
+ *       acc.data.items = result.rows;
+ *       return acc;
+ *     }
+ *   };
+ *
+ * Environment variables (DB_SECRET_ARN, DB_NAME) are set automatically
+ * by the CDK construct when a database is attached to the stack.
+ */
+
+import type { APIGWV1Payload } from '@phila/philaroute/dist/types';
+import type { RestAccumulator } from '@phila/philaroute/dist/types';
+import { Router, http, validate } from '@phila/philaroute';
+
+const router = Router({
+  cors: {
+    'Access-Control-Allow-Origin': '*',
+    'Access-Control-Allow-Method': 'GET,POST,PUT,DELETE,OPTIONS',
+    'Access-Control-Allow-Headers': 'Content-Type,Authorization',
+  },
+});
+
+const health = {
+  check: async (acc: RestAccumulator) => {
+    acc.data.status = 'healthy';
+    acc.data.timestamp = new Date().toISOString();
+    return acc;
+  },
+};
+
+const hello = {
+  greet: async (acc: RestAccumulator) => {
+    acc.data.message = `Hello, ${acc.data.valid.parameters.name}!`;
+    acc.data.appName = process.env.APP_NAME;
+    acc.data.environment = process.env.ENVIRONMENT;
+    acc.data.timestamp = new Date().toISOString();
+    return acc;
+  },
+};
+
+const items = {
+  create: async (acc: RestAccumulator) => {
+    acc.data.item = { id: '123', ...acc.data.valid.body };
+    acc.data.message = 'Item created';
+    return acc;
+  },
+  get: async (acc: RestAccumulator) => {
+    const { id } = acc.data.valid.parameters;
+    acc.data.id = id;
+    acc.data.message = `Retrieved item ${id}`;
+    return acc;
+  },
+};
+
+// Route definitions
+// The router automatically responds with 200 and acc.data as body.
+// Use http.response({ statusCode }) only when overriding (e.g., 201 for POST).
+
+router.path('/health').get([health.check]);
+
+router.path('/hello').get([validate.parameters(['name']), hello.greet]);
+
+router
+  .path('/items')
+  .post([validate.body({ name: 'string' }), items.create, http.response({ statusCode: 201 })]);
+
+router.path('/items/:id').get([validate.parameters(['id']), items.get]);
+
+export const handler = async (event: APIGWV1Payload) => router.routeToPath(event);

package/dist/templates/webapp-lambda-node/apps/api/package.json

@@ -0,0 +1,17 @@
+{
+  "name": "api",
+  "version": "1.0.0",
+  "description": "Lambda API handler",
+  "private": true,
+  "scripts": {
+    "build": "tsc",
+    "watch": "tsc -w"
+  },
+  "dependencies": {
+    "@phila/philaroute": "^1.0.12",
+    "@types/aws-lambda": "^8.10.0"
+  },
+  "devDependencies": {
+    "typescript": "^5.3.0"
+  }
+}

package/dist/templates/webapp-lambda-node/apps/api/tsconfig.json

@@ -0,0 +1,8 @@
+{
+  "extends": "../../tsconfig.json",
+  "compilerOptions": {
+    "outDir": "dist",
+    "rootDir": "."
+  },
+  "include": ["*.ts"]
+}