create-agent-rig 0.9.1 → 0.10.0

package/templates/skeleton/aws-serverless/apps/web/test/shared-validation.test.ts

@@ -1,38 +0,0 @@
-// THE load-bearing test of the frontend (web brief §5): the browser-side
-// validator and the server-side schema must be the same decision procedure.
-// No jsdom, no rendering — the boundary is the point, not the pixels.
-import { InvalidNoteError, NewNoteSchema, createNote } from '@app/core';
-import { describe, expect, it } from 'vitest';
-import { validateNewNote } from '../src/lib/validate';
-
-const identity = { id: 'n1', createdAt: '2024-01-01T00:00:00.000Z' };
-
-const CASES: Array<{ name: string; input: unknown }> = [
-  { name: 'valid minimal', input: { title: 'Hello' } },
-  { name: 'valid with tags', input: { title: 'Hello', tags: ['a', 'b'] } },
-  { name: 'empty title', input: { title: '' } },
-  { name: 'whitespace title', input: { title: '   ' } },
-  { name: 'title too long', input: { title: 'x'.repeat(201) } },
-  { name: 'too many tags', input: { title: 'T', tags: Array.from({ length: 11 }, (_, i) => `${i}`) } },
-  { name: 'empty tag', input: { title: 'T', tags: [''] } },
-  { name: 'wrong types', input: { title: 42 } },
-  { name: 'not an object', input: 'nope' },
-];
-
-describe('one schema, both sides of the wire', () => {
-  for (const { name, input } of CASES) {
-    it(`web and core agree on: ${name}`, () => {
-      const webVerdict = validateNewNote(input);
-      const coreVerdict = NewNoteSchema.safeParse(input);
-      expect(webVerdict.ok).toBe(coreVerdict.success);
-
-      // …and the domain function (used by the API usecase) agrees with both.
-      if (coreVerdict.success) {
-        expect(() => createNote(input, identity)).not.toThrow();
-      } else {
-        expect(() => createNote(input, identity)).toThrow(InvalidNoteError);
-        expect(webVerdict.issues.length).toBeGreaterThan(0);
-      }
-    });
-  }
-});

package/templates/skeleton/aws-serverless/apps/web/tsconfig.json

@@ -1,14 +0,0 @@
-{
-  "extends": "../../tsconfig.base.json",
-  "compilerOptions": {
-    "module": "esnext",
-    "moduleResolution": "bundler",
-    "jsx": "preserve",
-    "lib": ["dom", "dom.iterable", "es2022"],
-    "noEmit": true,
-    "allowJs": true,
-    "plugins": [{ "name": "next" }]
-  },
-  "include": ["src/**/*.ts", "src/**/*.tsx", "test/**/*.ts"],
-  "exclude": ["node_modules", "out", ".next"]
-}

package/templates/skeleton/aws-serverless/eslint.config.mjs

@@ -1,20 +0,0 @@
-import eslint from '@eslint/js';
-import globals from 'globals';
-import tseslint from 'typescript-eslint';
-
-export default tseslint.config(
-  {
-    ignores: [
-      '**/node_modules/**',
-      '**/dist/**',
-      '**/cdk.out/**',
-      '**/coverage/**',
-      '**/.next/**',
-      '**/out/**',
-      '**/next-env.d.ts',
-    ],
-  },
-  eslint.configs.recommended,
-  ...tseslint.configs.recommended,
-  { languageOptions: { globals: globals.node } },
-);

package/templates/skeleton/aws-serverless/gitignore

@@ -1,56 +0,0 @@
-node_modules/
-dist/
-coverage/
-cdk.out/
-# what `cdk deploy --outputs-file` writes: bucket names, distribution ids,
-# endpoints. Harmless today, and the file that accumulates the ones that are not.
-cdk-outputs.json
-*.tsbuildinfo
-.DS_Store
-.next/
-out/
-next-env.d.ts
-.claude/worktrees/
-# per-checkout queue state: the tier the last close recorded. The queue CONFIG
-# is composed and tracked; this is runtime state and must never be committed.
-.claude/queue.state.json
-# per-checkout board selector (`queue/index.mjs board <name>`); the boards are in the config
-.claude/queue.board
-# gate rounds, one count per branch
-.claude/gate-rounds.json
-# per-run machine trace (.claude/scripts/run-journal.mjs): forensics that churn
-# on every gate and collide across concurrent sessions. Unlike a committed
-# evidence directory, this one is per-run and stays out of the repository.
-.claude/runs/
-
-# secrets — never commit these
-*.env
-.env
-.env.*
-!.env.example
-.envrc
-.npmrc
-.netrc
-.pgpass
-id_rsa
-id_ed25519
-*.pem
-*.key
-*.p12
-*.pfx
-*.keystore
-*.jks
-*.secret
-*.secrets
-*.token
-*.tokens
-*.password
-*.passwords
-*.credential
-*.credentials
-*.apikey
-*.apikeys
-*.passwd
-*.creds
-*.jwt
-*.bearer

package/templates/skeleton/aws-serverless/infra/bin/app.ts

@@ -1,79 +0,0 @@
-import { realpathSync } from 'node:fs';
-import { fileURLToPath } from 'node:url';
-import { App } from 'aws-cdk-lib';
-import { AppStack, nothingGiven } from '../lib/app-stack.js';
-import { WebStack } from '../lib/web-stack.js';
-
-/**
- * The composition, as a function so a test can synthesise the same wiring the
- * CLI gets. A test that re-wires the stacks itself would pass while this file
- * stayed broken, which is the one failure worth catching here.
- */
-export function createApp(): App {
-  const app = new App();
-
-  // Region-agnostic by default; `cdk deploy` uses your CLI profile. Pin it here
-  // when the project settles (the generator's default region is __REGION__).
-  const env = { region: process.env.CDK_DEFAULT_REGION };
-
-  // The web stack first: the API has to allow the origin the browser loads the
-  // app from, and that origin is a CloudFront domain this stack owns. Passing
-  // it makes CORS correct on the first deploy instead of after someone
-  // discovers the app is blocked and reaches for `*`.
-  //
-  // The price, so it is not discovered later: this is a cross-stack export, so
-  // WebStack is deploy-ordered before AppStack and cannot be torn down while
-  // AppStack still imports it — CDK warns about the reference strength on
-  // synth. Pass `allowedOrigins` explicitly (a custom domain, several origins)
-  // and the export disappears with it.
-  const web = new WebStack(app, 'WebStack', {
-    description: 'Static web serving for __PROJECT_NAME__ (generated by create-agent-rig)',
-    env,
-  });
-
-  // `-c allowedOrigins=…` wins over the wired default — a custom domain is a
-  // deliberate act, and props short-circuit the context inside AppStack, so
-  // passing them unconditionally would accept the flag and ignore it. Omitting
-  // the prop hands the flag to AppStack's own validation instead of dropping
-  // it: an unusable value is refused at synth rather than deployed.
-  // `nothingGiven` is imported rather than restated: this file and the stack
-  // both decide whether the operator supplied an origin, and two spellings of
-  // that question is how `"allowedOrigins": null` in cdk.json comes to mean
-  // "they chose one" here and "use the default" there — a green synth whose
-  // deployed API allows only localhost.
-  const override = app.node.tryGetContext('allowedOrigins');
-
-  new AppStack(app, 'AppStack', {
-    description: 'API + worker for __PROJECT_NAME__ (generated by create-agent-rig)',
-    env,
-    ...(nothingGiven(override) ? { allowedOrigins: [web.origin] } : {}),
-  });
-
-  return app;
-}
-
-/**
- * Only when the CDK CLI runs this file. A test importing `createApp` would
- * otherwise build a second composition — and re-bundle three Lambdas — for an
- * App nobody looks at.
- *
- * Both sides go through realpath: ESM resolves `import.meta.url` through
- * symlinks while `process.argv[1]` keeps the path as typed, so a checkout
- * behind a link (a macOS temp dir, a symlinked home) would fail a plain
- * comparison and synthesise an empty app.
- */
-function invokedDirectly(): boolean {
-  if (!process.argv[1]) return false;
-  const real = (p: string) => {
-    try {
-      return realpathSync(p);
-    } catch {
-      return p;
-    }
-  };
-  return real(fileURLToPath(import.meta.url)) === real(process.argv[1]);
-}
-
-if (invokedDirectly()) {
-  createApp();
-}

package/templates/skeleton/aws-serverless/infra/cdk.json

@@ -1,3 +0,0 @@
-{
-  "app": "npx tsx bin/app.ts"
-}

package/templates/skeleton/aws-serverless/infra/lib/app-stack.ts

@@ -1,248 +0,0 @@
-import path from 'node:path';
-import { fileURLToPath } from 'node:url';
-import {
-  Annotations,
-  CfnOutput,
-  Duration,
-  RemovalPolicy,
-  Stack,
-  Token,
-  type StackProps,
-} from 'aws-cdk-lib';
-import { CorsHttpMethod, HttpApi, HttpMethod } from 'aws-cdk-lib/aws-apigatewayv2';
-import { HttpLambdaIntegration } from 'aws-cdk-lib/aws-apigatewayv2-integrations';
-import { ComparisonOperator, TreatMissingData } from 'aws-cdk-lib/aws-cloudwatch';
-import { AttributeType, BillingMode, Table } from 'aws-cdk-lib/aws-dynamodb';
-import { Runtime } from 'aws-cdk-lib/aws-lambda';
-import { SqsEventSource } from 'aws-cdk-lib/aws-lambda-event-sources';
-import { NodejsFunction } from 'aws-cdk-lib/aws-lambda-nodejs';
-import { Queue } from 'aws-cdk-lib/aws-sqs';
-import type { Construct } from 'constructs';
-
-const here = path.dirname(fileURLToPath(import.meta.url));
-const workspaceRoot = path.resolve(here, '..', '..');
-
-export interface AppStackProps extends StackProps {
-  /**
-   * Browser origins allowed to call the API.
-   *
-   * `bin/app.ts` passes the CloudFront origin from `WebStack`, so a deployed
-   * app works without configuring anything. Pass this (or
-   * `-c allowedOrigins=https://…`, comma-separated, which the entrypoint
-   * prefers when given) for a custom domain, a staging origin, or several.
-   */
-  allowedOrigins?: string[];
-}
-
-/**
- * Local dev only: a real origin is a deliberate act, not a default.
- *
- * The port belongs to `apps/web`'s `dev` script — that is the source of truth,
- * and a test reads it from there rather than restating it. A default naming a
- * port nothing serves is worse than no default: it looks configured.
- */
-const DEFAULT_ALLOWED_ORIGINS = ['http://localhost:3001'];
-
-/**
- * Props win, then `-c allowedOrigins=a,b`, then the local default.
- *
- * Anything given but unusable — an empty list, a context value that trims away
- * to nothing, a value that is not a string — throws rather than falling back.
- * The failure this prevents is silent: an API synthesised with an empty
- * allow-list blocks every browser call, and the symptom appears far from the
- * flag that caused it.
- *
- * Exported for the tests, and only for them — nothing else imports it. The
- * alternative was a case per branch built on its own `AppStack`, which cost a
- * full synth and three Lambda bundles each and put the generated project's
- * suite over its hook timeout.
- */
-export function resolveAllowedOrigins(fromProps: string[] | undefined, fromContext: unknown): string[] {
-  if (fromProps !== undefined) {
-    if (fromProps.length === 0) {
-      throw new Error('allowedOrigins was given as an empty list — name an origin, or omit it');
-    }
-    return fromProps.map(checkedOrigin);
-  }
-  if (nothingGiven(fromContext)) return DEFAULT_ALLOWED_ORIGINS;
-  if (typeof fromContext !== 'string') {
-    throw new Error(
-      `allowedOrigins must be a comma-separated string, got ${typeof fromContext} — ` +
-        'use -c allowedOrigins=https://example.com',
-    );
-  }
-  const origins = fromContext
-    .split(',')
-    .map((origin) => origin.trim())
-    .filter(Boolean);
-  if (origins.length === 0) {
-    throw new Error(`allowedOrigins parsed to no origin at all from ${JSON.stringify(fromContext)}`);
-  }
-  return origins.map(checkedOrigin);
-}
-
-/**
- * Whether the caller supplied nothing. Exported because `bin/app.ts` decides
- * the same question about the same value, and two spellings of "nothing given"
- * is how a `null` in `cdk.json` ends up meaning "the operator chose an origin"
- * in one file and "use the default" in the other.
- */
-export function nothingGiven(contextValue: unknown): boolean {
-  return contextValue === undefined || contextValue === null;
-}
-
-/**
- * An origin a browser could actually send: `*`, or a scheme plus a host.
- *
- * The check exists because the near-misses synthesise green and fail in the
- * browser, far from the flag that caused them — `app.example.com` with the
- * scheme left off is the likeliest of them, since an `Origin` header always
- * carries one.
- */
-function checkedOrigin(origin: string): string {
-  if (origin === '*') return origin;
-  // A cross-stack origin is a token here and a domain only at deploy time —
-  // there is nothing to parse yet, and refusing it would refuse the wiring
-  // this stack ships with.
-  if (Token.isUnresolved(origin)) return origin;
-  let parsed: URL;
-  try {
-    parsed = new URL(origin);
-  } catch {
-    throw new Error(
-      `allowedOrigins entry ${JSON.stringify(origin)} is not an origin — ` +
-        'a browser sends scheme://host[:port], as in https://app.example.com',
-    );
-  }
-  if (parsed.protocol !== 'http:' && parsed.protocol !== 'https:') {
-    throw new Error(`allowedOrigins entry ${JSON.stringify(origin)} is not an http(s) origin`);
-  }
-  // The NORMALISED form, not what was typed: a trailing slash, an uppercase
-  // scheme, a path, a unicode host or a redundant :443 all synthesise green and
-  // then match no Origin header a browser sends.
-  return parsed.origin;
-}
-
-export class AppStack extends Stack {
-  constructor(scope: Construct, id: string, props?: AppStackProps) {
-    super(scope, id, props);
-
-    const allowedOrigins = resolveAllowedOrigins(
-      props?.allowedOrigins,
-      this.node.tryGetContext('allowedOrigins'),
-    );
-
-    // `*` is honoured — an operator who typed it into a flag has chosen it, and
-    // refusing would push them to edit this stack instead, which is worse. It
-    // does not get to be quiet about it: the whole point of not shipping the
-    // wildcard is that reaching for it should be a visible act.
-    if (allowedOrigins.includes('*')) {
-      // V2 because it can be acknowledged: `addWarning` hard-blocks
-      // `cdk synth --strict`, which would turn "loud" into "refused" for an
-      // operator who chose the wildcard deliberately.
-      Annotations.of(this).addWarningV2(
-        '@app/allowed-origins:wildcard',
-        'allowedOrigins includes "*": every site may call this API from a browser. ' +
-          'Name the origins instead unless this is a throwaway environment.',
-      );
-    }
-
-    // --- storage: one single-table DynamoDB table --------------------------
-    const table = new Table(this, 'NotesTable', {
-      partitionKey: { name: 'pk', type: AttributeType.STRING },
-      sortKey: { name: 'sk', type: AttributeType.STRING },
-      billingMode: BillingMode.PAY_PER_REQUEST,
-      // Skeleton default: destroyable. Flip to RETAIN before storing real data.
-      removalPolicy: RemovalPolicy.DESTROY,
-    });
-
-    // --- queue with DLQ + alarm -------------------------------------------
-    const deadLetterQueue = new Queue(this, 'NotesDlq', {
-      retentionPeriod: Duration.days(14),
-    });
-    const queue = new Queue(this, 'NotesQueue', {
-      visibilityTimeout: Duration.seconds(30),
-      deadLetterQueue: { queue: deadLetterQueue, maxReceiveCount: 3 },
-    });
-    deadLetterQueue
-      .metricApproximateNumberOfMessagesVisible({ period: Duration.minutes(1) })
-      .createAlarm(this, 'DlqNotEmptyAlarm', {
-        alarmDescription: 'A message reached the DLQ — a consumer is failing.',
-        threshold: 1,
-        evaluationPeriods: 1,
-        comparisonOperator: ComparisonOperator.GREATER_THAN_OR_EQUAL_TO_THRESHOLD,
-        treatMissingData: TreatMissingData.NOT_BREACHING,
-      });
-
-    // --- functions ---------------------------------------------------------
-    const bundling = { sourceMap: false } as const;
-    const apiFunction = new NodejsFunction(this, 'CreateNoteFunction', {
-      entry: path.join(workspaceRoot, 'services', 'api', 'src', 'main.ts'),
-      handler: 'handler',
-      runtime: Runtime.NODEJS_22_X,
-      memorySize: 256,
-      timeout: Duration.seconds(10),
-      depsLockFilePath: path.join(workspaceRoot, 'pnpm-lock.yaml'),
-      bundling,
-      environment: {
-        TABLE_NAME: table.tableName,
-        QUEUE_URL: queue.queueUrl,
-      },
-    });
-
-    const listFunction = new NodejsFunction(this, 'ListNotesFunction', {
-      entry: path.join(workspaceRoot, 'services', 'api', 'src', 'list-main.ts'),
-      handler: 'handler',
-      runtime: Runtime.NODEJS_22_X,
-      memorySize: 256,
-      timeout: Duration.seconds(10),
-      depsLockFilePath: path.join(workspaceRoot, 'pnpm-lock.yaml'),
-      bundling,
-      environment: {
-        TABLE_NAME: table.tableName,
-      },
-    });
-
-    const workerFunction = new NodejsFunction(this, 'NoteCreatedWorker', {
-      entry: path.join(workspaceRoot, 'services', 'worker', 'src', 'main.ts'),
-      handler: 'handler',
-      runtime: Runtime.NODEJS_22_X,
-      memorySize: 256,
-      timeout: Duration.seconds(10),
-      depsLockFilePath: path.join(workspaceRoot, 'pnpm-lock.yaml'),
-      bundling,
-    });
-    workerFunction.addEventSource(new SqsEventSource(queue, { batchSize: 1 }));
-
-    // --- least-privilege grants: exactly what each function does ----------
-    table.grantWriteData(apiFunction); // the creator only puts
-    queue.grantSendMessages(apiFunction); // and publishes
-    table.grantReadData(listFunction); // the lister only reads
-
-    // --- the HTTP routes ---------------------------------------------------
-    // CORS: the web bundle is served from another origin (CloudFront), so the
-    // API has to name who may call it. `*` is not that name — a starter
-    // multiplies whatever it ships, and a wildcard here becomes the default of
-    // every project generated from it.
-    const httpApi = new HttpApi(this, 'NotesApi', {
-      corsPreflight: {
-        allowOrigins: allowedOrigins,
-        allowMethods: [CorsHttpMethod.GET, CorsHttpMethod.POST],
-        allowHeaders: ['content-type'],
-      },
-    });
-    httpApi.addRoutes({
-      path: '/notes',
-      methods: [HttpMethod.POST],
-      integration: new HttpLambdaIntegration('CreateNoteIntegration', apiFunction),
-    });
-    httpApi.addRoutes({
-      path: '/notes',
-      methods: [HttpMethod.GET],
-      integration: new HttpLambdaIntegration('ListNotesIntegration', listFunction),
-    });
-
-    new CfnOutput(this, 'ApiUrl', { value: httpApi.apiEndpoint });
-    new CfnOutput(this, 'DlqUrl', { value: deadLetterQueue.queueUrl });
-  }
-}

package/templates/skeleton/aws-serverless/infra/lib/web-stack.ts

@@ -1,45 +0,0 @@
-// Stateless serving for the static web export: a private S3 bucket behind
-// CloudFront. Deliberately no BucketDeployment construct — synth must never
-// depend on `next build` having run. The bundle ships via `aws s3 sync`
-// (see README), keeping the stack small and the dependency one-way.
-import { CfnOutput, RemovalPolicy, Stack, type StackProps } from 'aws-cdk-lib';
-import { Distribution, ViewerProtocolPolicy } from 'aws-cdk-lib/aws-cloudfront';
-import { S3BucketOrigin } from 'aws-cdk-lib/aws-cloudfront-origins';
-import { BlockPublicAccess, Bucket } from 'aws-cdk-lib/aws-s3';
-import type { Construct } from 'constructs';
-
-export class WebStack extends Stack {
-  /**
-   * Where the browser loads the app from — and therefore the origin the API
-   * has to allow. A synth-time token: CDK resolves it across stacks as an
-   * `Fn::ImportValue`, so `AppStack` can name it without either stack having
-   * been deployed yet.
-   */
-  public readonly origin: string;
-
-  constructor(scope: Construct, id: string, props?: StackProps) {
-    super(scope, id, props);
-
-    const bucket = new Bucket(this, 'WebBucket', {
-      blockPublicAccess: BlockPublicAccess.BLOCK_ALL,
-      // Skeleton default: destroyable. Flip to RETAIN before real traffic.
-      removalPolicy: RemovalPolicy.DESTROY,
-    });
-
-    const distribution = new Distribution(this, 'WebDistribution', {
-      defaultBehavior: {
-        origin: S3BucketOrigin.withOriginAccessControl(bucket),
-        viewerProtocolPolicy: ViewerProtocolPolicy.REDIRECT_TO_HTTPS,
-      },
-      defaultRootObject: 'index.html',
-    });
-
-    this.origin = `https://${distribution.domainName}`;
-
-    new CfnOutput(this, 'WebBucketName', { value: bucket.bucketName });
-    new CfnOutput(this, 'WebUrl', { value: this.origin });
-    // The upload step needs this to invalidate the edge cache: a synced bucket
-    // whose distribution still serves the old objects has not deployed.
-    new CfnOutput(this, 'WebDistributionId', { value: distribution.distributionId });
-  }
-}

package/templates/skeleton/aws-serverless/infra/package.json

@@ -1,18 +0,0 @@
-{
-  "name": "@app/infra",
-  "version": "0.1.0",
-  "private": true,
-  "type": "module",
-  "scripts": {
-    "synth": "cdk synth --quiet",
-    "deploy": "cdk deploy",
-    "destroy": "cdk destroy"
-  },
-  "dependencies": {
-    "aws-cdk-lib": "^2.261.0",
-    "constructs": "^10.7.1"
-  },
-  "devDependencies": {
-    "aws-cdk": "^2.1132.0"
-  }
-}