create-agent-rig 0.9.1 → 0.10.0

package/templates/agent-os/universal/.claude/hooks/guard-web-boundary.mjs

@@ -1,68 +0,0 @@
-// PreToolUse hook: the web app is a consumer of the domain, not the backend.
-// `apps/web` may import the pure core and shared utilities — never the storage
-// layer (`…/db`) and never the services. Enforced at the tool layer, same as
-// core purity: best-effort text scan, failing safe toward a false block.
-//
-// Contract (Claude Code and Codex): JSON on stdin; exit 0 = allow, exit 2 = block, and
-// stderr is shown to the agent as the reason.
-// Generator-owned coverage for the neutral bounded-inspection refusal lives upstream in
-// codex.test.ts (absent in a generated rig) › "$guard blocks with a neutral,
-// actionable size-limit refusal" — a downstream edit requires a local replacement test.
-import { editFragments } from './lib/edit-input.mjs';
-import { readHookInput } from './lib/hook-input.mjs';
-
-const WEB_PATH = /(^|\/)apps\/web\//;
-const CODE_FILE = /\.(ts|tsx|js|jsx|mjs|cjs)$/;
-
-// Workspace package names arrive rewritten to the project scope, so match the
-// package *suffix* under any scope: @<anything>/db, @<anything>/api, …
-const FORBIDDEN_WORKSPACE = /^@[^/]+\/(db|api|worker)$/;
-const FORBIDDEN_RELATIVE = /(^|\/)(packages\/db|services)(\/|$)/;
-
-function main() {
-  const input = readHookInput();
-  if (input === null) return 0; // unparseable payload: not ours to judge
-  const violations = [];
-  const importRe =
-    /(?:\bfrom\s*|\bimport\s*\(\s*|\brequire\s*\(\s*|^\s*import\s+)['"]([^'"]+)['"]/gm;
-  const fragments = editFragments(input);
-  const blocked = fragments.find(
-    ({ inspectionRefusal, appliesToAll }) => appliesToAll && inspectionRefusal,
-  );
-  const globalRefusal = blocked?.inspectionRefusal;
-  if (globalRefusal) {
-    process.stderr.write(
-      `BLOCKED — cannot safely inspect this edit: ${globalRefusal}\n` +
-        // The remedy has to match the refusal: splitting cannot change a
-        // container shape, and a fixed line sent the agent into a retry loop
-        // on the one path it could not retry out of.
-        `${blocked.remedy ?? 'Split it into a smaller patch and retry.'}\n`,
-    );
-    return 2;
-  }
-
-  for (const { filePath, fragment, inspectionRefusal } of fragments) {
-    if (!WEB_PATH.test(filePath) || !CODE_FILE.test(filePath)) continue;
-    if (inspectionRefusal) {
-      violations.push(`cannot safely inspect this move — ${inspectionRefusal}`);
-      continue;
-    }
-    for (const match of fragment.matchAll(importRe)) {
-      const spec = match[1];
-      if (FORBIDDEN_WORKSPACE.test(spec) || FORBIDDEN_RELATIVE.test(spec)) {
-        violations.push(spec);
-      }
-    }
-  }
-  if (violations.length === 0) return 0;
-
-  process.stderr.write(
-    `BLOCKED — apps/web imports the domain (core, shared), never the backend:\n` +
-      violations.map((v) => `  - "${v}" crosses the web boundary`).join('\n') +
-      `\nThe web talks to services over HTTP only; storage stays behind the API ` +
-      `(see .claude/rules/architecture.md).\n`,
-  );
-  return 2;
-}
-
-process.exit(main());

package/templates/agent-os/universal/.claude/rules/architecture.md

@@ -1,81 +0,0 @@
-# Architecture — layers and boundaries
-
-The layout is the same in every target; only the adapters at the edges change.
-
-## Layers
-
-| Layer | Location | May depend on | Never contains |
-| --- | --- | --- | --- |
-| **core** | `packages/core/` | nothing (plus its schema library) | I/O, clock, randomness, environment, SDKs |
-| **shared** | `packages/shared/` | nothing external of note | domain logic |
-| **db** | `packages/db/` | core, shared | HTTP handling, business decisions |
-| **services** | `services/*` | core, db, shared | direct SDK/storage access |
-| **web** | `apps/web/` | core, shared | db, services, any storage or backend SDK |
-
-Dependency direction is one-way: `services → (core, db, shared)`, `db → (core, shared)`,
-`core → nothing`. A dependency pointing the other way is a defect, not a style choice.
-
-## The web boundary is mechanical too
-
-`apps/web` is a consumer of the domain, not the backend: it imports the pure
-core (schemas, domain functions — the same validation the server trusts) and
-shared utilities, and talks to services **over HTTP only**. It never imports
-the storage layer or a service module — the `guard-web-boundary` hook refuses
-such an edit at the tool layer, exactly like core purity. The payoff is that
-one shared domain function validates on both sides of the wire: client-side
-for instant feedback, server-side for trust.
-
-**The web layer's test contract** (so "TDD, without exception" is read
-correctly here): its tests are the **shared-validation suite** — the same core
-function must accept/reject identically on both sides — plus the production
-build and typecheck. Component-level testing (DOM rendering, interaction
-frameworks) is deliberately out of scope; do **not** introduce a component
-testing apparatus unless real work in this project shows the need. New web
-*logic* still starts with a failing test — put the logic in a plain module
-(like `lib/validate`) and test it directly.
-
-## The request path is fixed
-
-Every operation travels the same route, with no shortcuts:
-
-```
-payload → handler → usecase → model
-```
-
-- **Handlers** translate transport into schema-validated, typed input and back.
-  Nothing else.
-- **The usecase layer is mandatory.** Every business operation has exactly one
-  usecase function. Handlers never call models or SDKs directly — even for a
-  "trivial" read. The uniformity is the point: it is what makes the codebase
-  predictable for both humans and agents.
-- **Usecases receive their dependencies** (models, publishers, clock, id
-  generation) as arguments, and invoke the core's pure domain functions
-  themselves. That is what keeps the core pure and the tests fast.
-- A dedicated *service* layer between usecase and model is **deliberately
-  absent** from the minimal skeleton: today a usecase is one domain function
-  plus one model call. Introduce a service only when a usecase outgrows that —
-  and then state it in this file, so the chain stays written down in one place.
-
-## The core is pure — and the rule is mechanical
-
-`packages/core/src/` contains domain logic only: pure functions and schemas.
-No I/O, no clock, no randomness, no environment, no SDK. Values like "now" and
-"a new id" enter as arguments from the usecase layer.
-
-This is not a convention you are trusted to follow; the
-`guard-core-purity` hook refuses the edit at the tool layer. If the hook blocks
-you, the answer is to move the impure part out — never to look for a way around
-the hook.
-
-Precision about the claim, so it is never overstated: the guard is a
-**best-effort text scan of each edit fragment before it lands** — an `Edit`
-shows the hook its new text, not the whole resulting file. It stops the normal
-path cold; a determined evasion is caught by the layers behind it (review and
-tests), not by the hook. A rulebook that sells enforcement must describe its
-enforcement exactly.
-
-## Storage has exactly one owner
-
-`packages/db/` is the only place that touches the storage SDK/driver. Every
-other external SDK likewise gets exactly one owning module. If you need a second
-place, you actually need a function exported from the first place.

package/templates/skeleton/aws-serverless/.github/workflows/ci.yml

@@ -1,28 +0,0 @@
-name: CI
-
-# The default token is read-only for this job: CI needs nothing else, and a
-# workflow that can write is a workflow a compromised dependency can write with.
-permissions:
-  contents: read
-
-on:
-  push:
-  pull_request:
-
-jobs:
-  ci:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - uses: pnpm/action-setup@v4
-        with:
-          version: 11
-      - uses: actions/setup-node@v4
-        with:
-          node-version: 22
-          cache: pnpm
-      - run: pnpm install --frozen-lockfile
-      - run: pnpm lint
-      - run: pnpm typecheck
-      - run: pnpm test
-      - run: pnpm synth

package/templates/skeleton/aws-serverless/.github/workflows/deploy.yml

@@ -1,90 +0,0 @@
-name: Deploy (dev)
-
-# DEV deployment only. Production is a HUMAN step (see README) — the Never tier
-# (.claude/rules/autonomy.md) forbids an agent from triggering a production
-# deploy, so no production path exists in this workflow at all.
-on:
-  push:
-    branches: [main, master]
-  workflow_dispatch:
-
-permissions:
-  # OIDC: assume a short-lived federated role. No long-lived keys in secrets —
-  # a starter multiplies whatever it ships, so it ships zero static credentials.
-  id-token: write
-  contents: read
-
-jobs:
-  deploy:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-
-      # Degrade cleanly: with no configured role this SKIPS with a message and
-      # the job stays green — never a red X on a fresh project with no cloud
-      # account. Enabling deployment is "add the AWS_DEPLOY_ROLE_ARN secret",
-      # not "edit this file".
-      - id: guard
-        env:
-          ROLE: ${{ secrets.AWS_DEPLOY_ROLE_ARN }}
-        run: |
-          if [ -z "$ROLE" ]; then
-            echo "deploy skipped: no credentials configured — see README (Deploy)."
-            echo "skip=true" >> "$GITHUB_OUTPUT"
-          fi
-
-      - if: steps.guard.outputs.skip != 'true'
-        uses: pnpm/action-setup@v4
-      - if: steps.guard.outputs.skip != 'true'
-        uses: actions/setup-node@v4
-        with:
-          node-version: 22
-          cache: pnpm
-      - if: steps.guard.outputs.skip != 'true'
-        run: pnpm install --frozen-lockfile
-      - if: steps.guard.outputs.skip != 'true'
-        run: pnpm build:web
-        env:
-          NEXT_PUBLIC_API_URL: ${{ vars.API_URL }}
-
-      - if: steps.guard.outputs.skip != 'true'
-        uses: aws-actions/configure-aws-credentials@v4
-        with:
-          role-to-assume: ${{ secrets.AWS_DEPLOY_ROLE_ARN }}
-          aws-region: ${{ vars.AWS_REGION || '__REGION__' }}
-
-      # `--require-approval never` is deliberate and dev-only: this workflow has
-      # no production path at all (see the header), so the approval prompt would
-      # only ever block an unattended dev deploy on a change nobody is watching.
-      - if: steps.guard.outputs.skip != 'true'
-        run: >
-          pnpm --filter @app/infra exec cdk deploy AppStack WebStack
-          --require-approval never --outputs-file cdk-outputs.json
-
-      # The bundle is built above and the bucket is created by the deploy — but
-      # nothing puts one into the other, so without this step CloudFront keeps
-      # serving whatever was uploaded by hand, last time somebody remembered.
-      # `web-stack.ts` deliberately does not use BucketDeployment (synth must
-      # never depend on `next build` having run), which is why the upload lives
-      # here rather than in the stack.
-      - if: steps.guard.outputs.skip != 'true'
-        name: Upload the web bundle and invalidate the edge cache
-        run: |
-          # `jq -r` prints the string "null" and exits 0 for a missing key, and
-          # GitHub's shell is `bash -e` with no `-u` and no pipefail — so a
-          # renamed stack or a half-finished deploy would sync the bundle into
-          # `s3://null`, a real bucket in a global namespace someone else owns,
-          # and issue --delete against it. `-e` makes jq exit non-zero instead.
-          set -euo pipefail
-          BUCKET=$(jq -er '.WebStack.WebBucketName' infra/cdk-outputs.json)
-          DISTRIBUTION=$(jq -er '.WebStack.WebDistributionId' infra/cdk-outputs.json)
-          # An existing-but-empty bundle syncs zero objects, and --delete then
-          # empties the live site with a green checkmark.
-          [ -n "$(ls -A apps/web/out 2>/dev/null)" ] || {
-            echo "apps/web/out is empty — refusing to sync"; exit 1;
-          }
-          # --delete makes the bucket the bundle's territory alone: anything not
-          # in this build is removed from it.
-          aws s3 sync apps/web/out "s3://$BUCKET" --delete
-          aws cloudfront create-invalidation \
-            --distribution-id "$DISTRIBUTION" --paths '/*'

package/templates/skeleton/aws-serverless/README.md

@@ -1,181 +0,0 @@
-# __PROJECT_NAME__
-
-A serverless notes service generated by `create-agent-rig`, target
-`aws-serverless`. It is deliberately the **smallest project that proves the
-architecture** — one HTTP route, one queue consumer — with every layer visible
-and every gate wired. This project is yours: **delete what you don't need.**
-
-## Layout
-
-```
-packages/core/     pure domain: zod schemas + createNote()  (no I/O — hook-enforced)
-packages/shared/   logger, loadEnv(zod), typed errors
-packages/db/       NoteModel — the only code touching the DynamoDB SDK
-services/api/      POST /notes + GET /notes: payload → handler → usecase → model
-services/worker/   note.created consumer (batchSize 1 → DLQ after 3 strikes)
-apps/web/          static Next export; validates with the SAME core schema the
-                   server trusts (imports core+shared only — hook-enforced)
-infra/             CDK stacks: table, queue+DLQ+alarm, three lambdas, HTTP API,
-                   and S3+CloudFront for the web bundle
-.claude/           the agent operating system: rules, gates, blocking hooks
-```
-
-The agent-facing map is `CLAUDE.md`; the rules live in `.claude/rules/`.
-
-## Run it
-
-```sh
-pnpm install
-pnpm test        # every layer, core exhaustively
-pnpm lint
-pnpm typecheck
-pnpm build:web   # static Next export → apps/web/out
-pnpm synth       # CloudFormation synth (no AWS credentials needed)
-pnpm check       # all of the above
-```
-
-## Deploy it
-
-### Dev — automated, on push (OIDC, no static keys)
-
-`.github/workflows/deploy.yml` runs a **dev** deploy on every push to the
-default branch. It ships with **no credentials**, so on a fresh repo it skips
-cleanly with a message — never a red X. To enable it, you *add a secret*, you
-do not edit the workflow:
-
-1. In AWS, create an IAM role your repo can assume via GitHub's OIDC provider
-   (`token.actions.githubusercontent.com`) — a short-lived federated role, no
-   long-lived access keys anywhere. Beyond what `cdk deploy` needs, the
-   workflow uploads the bundle itself, so the role also needs
-   **`s3:ListBucket`, `s3:PutObject`, `s3:DeleteObject`** on the web bucket and
-   **`cloudfront:CreateInvalidation`** on the distribution. A role scoped only
-   to CDK's bootstrap roles gets through the deploy and fails on the upload —
-   after both stacks are already up.
-2. Add its ARN as the repository secret **`AWS_DEPLOY_ROLE_ARN`**, and set the
-   repo variable **`API_URL`** to the deployed API's URL (the `ApiUrl` output
-   of a first deploy). It becomes `NEXT_PUBLIC_API_URL`, which Next **inlines
-   into the bundle at build time** — unset, the site calls `/notes` on its own
-   CloudFront domain, where nothing answers. `AWS_REGION` is genuinely
-   optional. The first deploy is therefore two passes: deploy, read `ApiUrl`
-   from the job's `cdk deploy` Outputs, set the variable, then re-run the
-   workflow (push, or **Run workflow** — it is `workflow_dispatch`-enabled).
-
-The workflow then assumes the role, builds the web bundle, runs
-`cdk deploy AppStack WebStack --outputs-file`, then **uploads `apps/web/out` to
-the web bucket (`aws s3 sync --delete`) and invalidates the CloudFront cache**,
-reading both destinations from the stack outputs. You do not sync anything by
-hand on this path. The site is served from S3 + CloudFront (the `WebUrl`
-output).
-
-### Local / manual
-
-```sh
-# needs AWS credentials; region comes from your profile (generator default: __REGION__)
-cd infra
-npx cdk bootstrap   # first time per account/region
-npx cdk deploy AppStack WebStack --outputs-file cdk-outputs.json
-# --delete makes the bucket the bundle's territory alone, so a stale or missing
-# `out/` would empty the live site — or restore last month's. The workflow
-# builds two steps before its sync; by hand, build here.
-# Read the outputs into variables FIRST. `jq -er` exits non-zero on a missing
-# key, but a command substitution inside an assignment or an argument throws
-# that status away — which is how a stale outputs file becomes a bundle built
-# against `null` and an `aws s3 sync … s3://null --delete`.
-API=$(jq -er '.AppStack.ApiUrl' cdk-outputs.json) || { echo "no ApiUrl"; exit 1; }
-BUCKET=$(jq -er '.WebStack.WebBucketName' cdk-outputs.json) || { echo "no WebBucketName"; exit 1; }
-DIST=$(jq -er '.WebStack.WebDistributionId' cdk-outputs.json) || { echo "no WebDistributionId"; exit 1; }
-
-# NEXT_PUBLIC_API_URL is inlined at build time: without it the bundle calls its
-# own CloudFront domain instead of the API, and the sync below makes that live.
-(cd .. && NEXT_PUBLIC_API_URL="$API" pnpm build:web)
-[ -f ../apps/web/out/index.html ] || { echo "no web bundle — build failed"; exit 1; }
-aws s3 sync ../apps/web/out "s3://$BUCKET" --delete
-# a synced bucket whose distribution still serves the old objects has not
-# deployed — invalidate, or you are looking at the previous build
-aws cloudfront create-invalidation --paths '/*' --distribution-id "$DIST"
-```
-
-### Production — a human step, on purpose
-
-There is **no production deploy in this repo**, by design: the agent operating
-system's Never tier forbids an agent from triggering a production deploy, so
-shipping an automated prod path would contradict the rules on day one.
-Promote to production yourself — a separate account/role, a reviewed change,
-your own approval — reusing the dev workflow's OIDC pattern.
-
-## Verify runtime health (CI-green ≠ runtime-healthy)
-
-After every deploy:
-
-```sh
-# From the deploy's outputs file — run this from `infra/`, where the manual
-# section leaves you. Deployed through CI instead? That file is written on the
-# runner and never lands here: take both values from the job's `cdk deploy`
-# Outputs, or re-run `cdk deploy … --outputs-file cdk-outputs.json` locally.
-API_URL=$(jq -er '.AppStack.ApiUrl' cdk-outputs.json)
-WEB_URL=$(jq -er '.WebStack.WebUrl' cdk-outputs.json)
-
-curl -s -X POST "$API_URL/notes" \
-  -H 'content-type: application/json' \
-  -d '{"title":"smoke test","tags":["deploy"]}'
-# expect: HTTP 201 with { "note": { … } }
-```
-
-**That checks the API, not the site.** The two fail independently: a bundle
-built without `NEXT_PUBLIC_API_URL` calls its own CloudFront domain, and a
-misnamed origin is refused by the browser — neither is visible to a `curl` that
-sends no `Origin` header. So also open the `WebUrl` output, create a note in
-the form, and reload:
-
-```sh
-curl -s -I "$WEB_URL" | head -1                      # the bundle is served
-
-# API Gateway answers a preflight 204 whether or not the origin matched, so the
-# status code proves nothing here. The browser gates on the echoed header —
-# that is what to look for. `content-type` is sent because the real call uses
-# it, and a non-safelisted header is what makes `allowHeaders` matter.
-curl -s -X OPTIONS "$API_URL/notes" -D - -o /dev/null \
-  -H "Origin: $WEB_URL" \
-  -H 'access-control-request-method: POST' \
-  -H 'access-control-request-headers: content-type' \
-  | grep -i '^access-control-allow-origin:'
-# expect: a line echoing $WEB_URL. No line = the browser will refuse the call,
-# whatever the status code said.
-```
-
-Then confirm the pipeline: the worker logs `note.created processed`, and the
-**DLQ alarm stays quiet**. If the smoke test regresses: `npx cdk deploy` the
-previous revision (or `git revert` and redeploy) **first**, diagnose second.
-
-## Boundaries (the short version)
-
-- Every request follows `payload → handler → usecase → model`. The usecase
-  layer is mandatory even when it looks like ceremony.
-- `packages/core` is pure — the `guard-core-purity` hook refuses I/O, clock,
-  randomness, and environment access at the tool layer.
-- `packages/db` is the only module that touches the storage SDK.
-- A failing queue message is poison: it throws, SQS retries ×3, the DLQ alarm
-  fires. Never wrap the worker in a broad catch.
-- **Creating a note is a dual write, and it is not atomic.** `create-note`
-  puts to DynamoDB and then publishes to SQS. If the publish fails, the note
-  is stored and its event never happened — the worker never runs, and nothing
-  compensates; the caller gets a 500 for a note that exists. That is a
-  deliberate simplification for a starter. When it starts to matter, the two
-  ways out are an **outbox** (write the event alongside the note, relay it
-  afterwards) or DynamoDB Streams feeding the worker, which deletes the second
-  write instead of coordinating it.
-- **CORS names who may call the API, and that half is wired for you.**
-  `bin/app.ts` builds `WebStack` first and passes its CloudFront origin to
-  `AppStack`, so the API allows the deployed site without you configuring it.
-  The other half is not automatic: the bundle has to know where the API *is*,
-  and that is `NEXT_PUBLIC_API_URL` above. For a custom domain or a second
-  origin, deploy with `-c allowedOrigins=https://app.example.com` (comma-
-  separated for several) — the entrypoint prefers the flag over the wired
-  default, and the cross-stack export disappears with it. An `allowedOrigins`
-  that parses to nothing, or an entry no browser could send, is refused at
-  synth rather than deployed as an API nobody can call. `*` is not the default
-  and never will be, but the flag does take it: you get a warning naming the
-  consequence, not a refusal, because the alternative is people editing the
-  stack.
-
-See `.claude/rules/architecture.md` for the full rules.

package/templates/skeleton/aws-serverless/apps/web/next.config.mjs

@@ -1,17 +0,0 @@
-/** @type {import('next').NextConfig} */
-const nextConfig = {
-  // Static export: one build, no second runtime — the API server (or a CDN)
-  // serves the bundle. See README for how this target serves it.
-  output: 'export',
-  // The core ships as TypeScript source; Next transpiles it for the browser.
-  transpilePackages: ['@app/core'],
-  // The core uses NodeNext-style relative imports ("./note.js" resolving to
-  // note.ts). Turbopack cannot map that, so the build runs webpack (see the
-  // build script) with the standard extension alias.
-  webpack: (config) => {
-    config.resolve.extensionAlias = { '.js': ['.ts', '.tsx', '.js'] };
-    return config;
-  },
-};
-
-export default nextConfig;

package/templates/skeleton/aws-serverless/apps/web/package.json

@@ -1,19 +0,0 @@
-{
-  "name": "@app/web",
-  "version": "0.1.0",
-  "private": true,
-  "scripts": {
-    "dev": "next dev --port 3001 --webpack",
-    "build": "next build --webpack"
-  },
-  "dependencies": {
-    "@app/core": "workspace:*",
-    "next": "^16.2.11",
-    "react": "^19.2.8",
-    "react-dom": "^19.2.8"
-  },
-  "devDependencies": {
-    "@types/react": "^19.2.17",
-    "@types/react-dom": "^19.2.3"
-  }
-}

package/templates/skeleton/aws-serverless/apps/web/src/app/layout.tsx

@@ -1,17 +0,0 @@
-import type { ReactNode } from 'react';
-
-// Deliberately unstyled: a starter's frontend is scaffolding, not a product.
-// Polish belongs in the mechanism (the shared validation, the boundary hook),
-// not in the pixels — replace all of this freely.
-export const metadata = {
-  title: '__PROJECT_NAME__',
-  description: 'Notes — generated by create-agent-rig',
-};
-
-export default function RootLayout({ children }: { children: ReactNode }) {
-  return (
-    <html lang="en">
-      <body>{children}</body>
-    </html>
-  );
-}

package/templates/skeleton/aws-serverless/apps/web/src/app/page.tsx

@@ -1,96 +0,0 @@
-'use client';
-// One page, one point: the SAME domain schema validates here (instant
-// feedback) and on the server (trust). See src/lib/validate.ts.
-import { useCallback, useEffect, useState } from 'react';
-import type { Note } from '@app/core';
-import { createNote, listNotes } from '../lib/api';
-import { validateNewNote } from '../lib/validate';
-
-export default function NotesPage() {
-  const [title, setTitle] = useState('');
-  const [tags, setTags] = useState('');
-  const [issues, setIssues] = useState<string[]>([]);
-  const [notes, setNotes] = useState<Note[]>([]);
-  const [status, setStatus] = useState<string>('');
-
-  const refresh = useCallback(async () => {
-    try {
-      setNotes(await listNotes());
-      setStatus('');
-    } catch (error) {
-      setStatus(`could not load notes: ${String(error)}`);
-    }
-  }, []);
-
-  useEffect(() => {
-    void refresh();
-  }, [refresh]);
-
-  async function onSubmit(event: React.FormEvent) {
-    event.preventDefault();
-    const input = {
-      title,
-      tags: tags
-        .split(',')
-        .map((tag) => tag.trim())
-        .filter(Boolean),
-    };
-    // Client-side: the same core schema the server will apply again.
-    const verdict = validateNewNote(input);
-    setIssues(verdict.issues);
-    if (!verdict.ok) return;
-    try {
-      await createNote(input);
-      setTitle('');
-      setTags('');
-      await refresh();
-    } catch (error) {
-      setIssues([String(error)]);
-    }
-  }
-
-  return (
-    <main>
-      <h1>Notes</h1>
-      <p>
-        The form validates with the <em>same</em> core function the server
-        trusts — one schema, both sides of the wire.
-      </p>
-
-      <form onSubmit={onSubmit}>
-        <label>
-          Title{' '}
-          <input
-            name="title"
-            value={title}
-            onChange={(event) => setTitle(event.target.value)}
-          />
-        </label>{' '}
-        <label>
-          Tags (comma-separated){' '}
-          <input name="tags" value={tags} onChange={(event) => setTags(event.target.value)} />
-        </label>{' '}
-        <button type="submit">Create</button>
-      </form>
-
-      {issues.length > 0 && (
-        <ul role="alert">
-          {issues.map((issue) => (
-            <li key={issue}>{issue}</li>
-          ))}
-        </ul>
-      )}
-      {status && <p role="status">{status}</p>}
-
-      <h2>Existing</h2>
-      <ul>
-        {notes.map((note) => (
-          <li key={note.id}>
-            <strong>{note.title}</strong> <code>{note.slug}</code>{' '}
-            <small>{note.tags.join(', ')}</small>
-          </li>
-        ))}
-      </ul>
-    </main>
-  );
-}

package/templates/skeleton/aws-serverless/apps/web/src/lib/api.ts

@@ -1,36 +0,0 @@
-// The web talks to the backend over HTTP only — never by importing it
-// (the guard-web-boundary hook refuses such imports at the tool layer).
-import type { Note } from '@app/core';
-
-// In THIS target the API is never same-origin: the bundle is served from
-// CloudFront and the API is API Gateway, so `NEXT_PUBLIC_API_URL` has to be set
-// at build time — Next inlines it, and an unset one leaves the empty string
-// here, which sends every call to whatever is serving this page.
-//
-// The `?? ''` is a fallback to nothing, not to a working default: there is no
-// dev proxy in this project, so `pnpm --filter @app/web dev` needs the variable
-// too. It exists only so a missing value is a relative URL rather than the
-// string "undefined" in a request path.
-const base = process.env.NEXT_PUBLIC_API_URL ?? '';
-
-export async function createNote(input: { title: string; tags: string[] }): Promise<Note> {
-  const response = await fetch(`${base}/notes`, {
-    method: 'POST',
-    headers: { 'content-type': 'application/json' },
-    body: JSON.stringify(input),
-  });
-  const body = (await response.json()) as { note?: Note; error?: string; issues?: string[] };
-  if (!response.ok || !body.note) {
-    throw new Error(body.issues?.join('; ') ?? body.error ?? `HTTP ${response.status}`);
-  }
-  return body.note;
-}
-
-export async function listNotes(): Promise<Note[]> {
-  const response = await fetch(`${base}/notes`);
-  const body = (await response.json()) as { notes?: Note[]; error?: string };
-  if (!response.ok || !body.notes) {
-    throw new Error(body.error ?? `HTTP ${response.status}`);
-  }
-  return body.notes;
-}

package/templates/skeleton/aws-serverless/apps/web/src/lib/validate.ts

@@ -1,23 +0,0 @@
-// The load-bearing import of this whole app: the browser validates with the
-// SAME schema the server trusts. Client-side for instant feedback,
-// server-side for trust — one function, two sides of the wire. This is what
-// core purity buys: `@app/core` has no I/O, so it runs anywhere.
-import { NewNoteSchema } from '@app/core';
-
-export interface ValidationResult {
-  ok: boolean;
-  issues: string[];
-}
-
-export function validateNewNote(input: unknown): ValidationResult {
-  const parsed = NewNoteSchema.safeParse(input);
-  if (parsed.success) {
-    return { ok: true, issues: [] };
-  }
-  return {
-    ok: false,
-    issues: parsed.error.issues.map(
-      (issue) => `${issue.path.join('.') || 'input'}: ${issue.message}`,
-    ),
-  };
-}