create-agent-rig 0.9.1 → 0.10.0

package/templates/skeleton/aws-serverless/infra/test/allowed-origins.test.ts

@@ -1,301 +0,0 @@
-import { readFileSync } from 'node:fs';
-import path from 'node:path';
-import { fileURLToPath } from 'node:url';
-import { Annotations as CdkAnnotations, App } from 'aws-cdk-lib';
-import { Annotations, Match } from 'aws-cdk-lib/assertions';
-import { describe, expect, it } from 'vitest';
-import {
-  AppStack,
-  type AppStackProps,
-  nothingGiven,
-  resolveAllowedOrigins,
-} from '../lib/app-stack.js';
-
-// Who may call the API is a security decision with exactly two safe outcomes:
-// the right origins, or a refusal loud enough that somebody fixes it. An empty
-// allow-list is neither — it synthesises, deploys, and blocks every call.
-//
-// Resolving that list is a pure function of (props, context), so it is tested
-// as one. The previous shape of this file built a whole AppStack per case —
-// twelve synths, each bundling three Lambdas with esbuild — which cost ~9.3s
-// and left the generated project's `beforeAll` hooks racing vitest's 10s
-// default hookTimeout on a saturated CPU. Only the CDK-level behaviour below
-// (the wildcard annotation) needs a stack, and it builds one per case.
-
-const resolved = (given: { props?: string[]; context?: unknown } = {}): string[] =>
-  resolveAllowedOrigins(given.props, given.context);
-
-const thrownBy = (run: () => unknown): unknown => {
-  try {
-    run();
-  } catch (error) {
-    return error;
-  }
-  return undefined;
-};
-
-const workspaceRoot = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..', '..');
-
-/**
- * The port `apps/web` is actually started on, read from the script that starts it.
- *
- * The localhost default in `app-stack.ts` is a restated copy of a number owned
- * by another file, and a restated constant drifts: it shipped `:3000` while the
- * only dev server in this repository has always been launched with
- * `--port 3001`, so the default named an origin nothing here ever sends —
- * configured-looking, and working for nobody. Reading the source of truth is
- * what stops that happening a second time.
- *
- * The read is deliberately loud. A `dev` script this cannot parse fails the
- * suite rather than falling back to a port of its own, because a correspondence
- * test that quietly supplies both sides of the correspondence checks nothing.
- */
-const webDevServerPort = (): string => {
-  const manifest = path.join(workspaceRoot, 'apps', 'web', 'package.json');
-  const scripts = (JSON.parse(readFileSync(manifest, 'utf8')) as { scripts?: Record<string, string> })
-    .scripts;
-  const dev = scripts?.dev;
-  expect(dev, 'apps/web/package.json has no dev script to take the origin port from').toBeTypeOf(
-    'string',
-  );
-  const port = /--port[=\s]+(\d+)/.exec(dev as string)?.[1];
-  expect(
-    port,
-    `the dev script ${JSON.stringify(dev)} names no --port, so nothing pins the default to it`,
-  ).toBeTypeOf('string');
-  return port as string;
-};
-
-/** Every refusal must name the flag that carried the bad value, and be an Error. */
-const refusalFrom = (run: () => unknown): Error => {
-  const error = thrownBy(run);
-  expect(error, 'the value was accepted instead of refused').toBeInstanceOf(Error);
-  expect(
-    (error as Error).message,
-    'the message must name the flag that was wrong',
-  ).toMatch(/allowedOrigins/);
-  return error as Error;
-};
-
-describe('choosing the allowed origins', () => {
-  it('falls back to localhost only when nothing at all was given', () => {
-    expect(resolved()).toEqual(['http://localhost:3001']);
-  });
-
-  it('defaults to the port the web dev server is actually started on', () => {
-    // The correspondence, not a second copy of the number. `apps/web` owns the
-    // port; a default that restates it is only correct until somebody changes
-    // one of the two, which is exactly how it came to name :3000.
-    expect(resolved()).toEqual([`http://localhost:${webDevServerPort()}`]);
-  });
-
-  it('prefers the origins passed in props over the localhost default', () => {
-    expect(resolved({ props: ['https://app.example.com'] })).toEqual(['https://app.example.com']);
-  });
-
-  it('prefers the origins passed in props over a context value', () => {
-    // Both are "given"; props are the programmatic wiring and win. `bin/app.ts`
-    // depends on this ordering being decided in one place.
-    expect(
-      resolved({ props: ['https://app.example.com'], context: 'https://ctx.example.com' }),
-    ).toEqual(['https://app.example.com']);
-  });
-
-  it('reads a comma-separated -c allowedOrigins as one origin each, trimmed', () => {
-    expect(resolved({ context: ' https://a.example.com , https://b.example.com ' })).toEqual([
-      'https://a.example.com',
-      'https://b.example.com',
-    ]);
-  });
-
-  it('treats a null context as nothing given, exactly as bin/app.ts does', () => {
-    // A JSON `null` is writable in `cdk.json`, `cdk.context.json` or
-    // `CDK_CONTEXT_JSON`. If the two files disagree about it, the entrypoint
-    // drops the wired CloudFront origin while the stack falls back to a
-    // localhost no deploy is served from — green synth, blocked browser.
-    expect(nothingGiven(null)).toBe(true);
-    expect(nothingGiven(undefined)).toBe(true);
-    expect(resolved({ context: null })).toEqual(['http://localhost:3001']);
-  });
-});
-
-describe('an allow-list that names nobody is a broken deploy, not a default', () => {
-  it('refuses a context value that parses to no origin at all', () => {
-    // `-c allowedOrigins=" , , "` is a typo, and an empty allow-list means
-    // every browser call fails — whose only obvious repair is putting `*` back.
-    refusalFrom(() => resolved({ context: ' , , ' }));
-  });
-
-  it('refuses an explicitly empty allowedOrigins prop for the same reason', () => {
-    // `?? DEFAULT` does not catch `[]` — an empty array is not nullish, so it
-    // travels all the way to CorsConfiguration.
-    refusalFrom(() => resolved({ props: [] }));
-  });
-
-  it('refuses a non-string context value instead of crashing inside the stack', () => {
-    // `cdk.json` holds JSON, so `"allowedOrigins": ["https://a"]` is a natural
-    // thing to write. Chosen behaviour: REFUSE it and name the flag — one code
-    // path for "the flag was given something unusable", rather than quietly
-    // widening what the stack accepts.
-    const error = refusalFrom(() => resolved({ context: ['https://a.example.com'] }));
-    expect(error.message, 'a TypeError from .split is a crash, not a refusal').not.toMatch(
-      /is not a function/,
-    );
-  });
-});
-
-// A browser's `Origin` header is always `scheme://host[:port]` — so an entry
-// without a scheme cannot match one, ever, and the failure surfaces in a
-// browser console days later, far from the flag that caused it.
-describe('an origin no browser could ever send is refused at synth', () => {
-  it.each([
-    // The likeliest operator typo: the host as it appears in the address bar.
-    ['a host with the scheme left off', 'app.example.com'],
-    // `-c allowedOrigins=null` is a string; the JSON null this branch also
-    // handles goes through a different path entirely.
-    ['the literal string null', 'null'],
-    // A quoting artifact from a shell or a CI variable: non-empty after trim,
-    // and meaningless as an origin.
-    ['a quoting artifact left over from the shell', '" "'],
-  ])('refuses %s and names the flag that carried it', (_case, value) => {
-    refusalFrom(() => resolved({ context: value }));
-  });
-
-  it('refuses the same shapes when they arrive through props', () => {
-    // Two entry points, one standard: a prop is not a trusted channel just
-    // because it is typed `string[]`.
-    refusalFrom(() => resolved({ props: ['app.example.com'] }));
-  });
-
-  it('accepts the origins a browser can actually send', () => {
-    // The refusal above must stay narrow: a real deploy origin and the local
-    // dev one are the two shapes this project is built around. The second is
-    // spelled as THIS project's dev origin on purpose — an arbitrary port would
-    // prove the same thing about the parser while quietly reading as "the dev
-    // origin" to the next person, which is the confusion that produced the
-    // :3000 default in the first place.
-    expect(resolved({ context: 'https://a.example.com' })).toEqual(['https://a.example.com']);
-    expect(resolved({ context: 'http://localhost:3001' })).toEqual(['http://localhost:3001']);
-  });
-});
-
-// An entry that synthesises but can never equal a browser's `Origin` header is
-// the same failure as a typo, only quieter: CORS compares the header to the
-// allow-list byte for byte. The near-misses below all survive `new URL()`, so
-// nothing downstream objects — the API just refuses every call.
-describe('an origin is stored the way a browser would actually send it', () => {
-  it.each([
-    // Copying the site's root URL out of the address bar adds the slash. This
-    // is the likeliest of the five by a wide margin.
-    ['a trailing slash', 'https://app.example.com/', 'https://app.example.com'],
-    ['an uppercase scheme', 'HTTPS://app.example.com', 'https://app.example.com'],
-    ['a path left on the end', 'https://app.example.com/notes', 'https://app.example.com'],
-    // A browser resolves an IDN to punycode before it builds the header, so
-    // the unicode spelling never appears on the wire.
-    ['a unicode host', 'https://héllo.example.com', 'https://xn--hllo-bpa.example.com'],
-    // Also strips a credential that has no business in a synthesised template.
-    ['userinfo', 'https://user:secret@app.example.com', 'https://app.example.com'],
-    // Browsers omit the default port; a literal `:443` never matches.
-    ['a redundant default port', 'https://app.example.com:443/', 'https://app.example.com'],
-  ])('normalises %s to what the Origin header carries', (_case, given, expected) => {
-    expect(resolved({ context: given }), 'through -c allowedOrigins').toEqual([expected]);
-    expect(resolved({ props: [given] }), 'and through props, identically').toEqual([expected]);
-  });
-
-  it('keeps a non-default port, which a browser does send', () => {
-    expect(resolved({ context: 'https://app.example.com:8443/' })).toEqual([
-      'https://app.example.com:8443',
-    ]);
-  });
-
-  it('trims a props entry the way it trims a context entry', () => {
-    // The context branch trims before checking; the props branch never did, so
-    // a stray space from a shell array reached CorsConfiguration intact.
-    expect(resolved({ props: [' https://a.example.com ', 'https://b.example.com\t'] })).toEqual([
-      'https://a.example.com',
-      'https://b.example.com',
-    ]);
-  });
-
-  it('never stores the literal string null, whatever it was handed', () => {
-    // `URL.origin` is the string "null" for every opaque scheme. An allow-list
-    // entry of `null` matches the `Origin: null` a sandboxed iframe sends —
-    // granting exactly the caller nobody meant to grant.
-    for (const value of ['null', 'file:///tmp/x', 'data:text/html,x']) {
-      expect(thrownBy(() => resolved({ context: value })), value).toBeInstanceOf(Error);
-    }
-  });
-});
-
-// These are real `Origin` header values — a Chrome extension, and the two
-// WebView schemes Capacitor and Ionic use on device. Refusing them is a
-// DECISION, recorded here rather than left to be rediscovered: the http(s)
-// check is what makes the scheme-less typo above catchable, the refusal is
-// loud and names the flag, and an app that genuinely serves a WebView client
-// widens `checkedOrigin` in one place. Changing this must change this test.
-describe('a non-http(s) origin is refused, and that is a decision on record', () => {
-  it.each([
-    ['a browser extension', 'chrome-extension://abcdefghijklmnopabcdefghijklmnop'],
-    ['a Capacitor WebView', 'capacitor://localhost'],
-    ['an Ionic WebView', 'ionic://localhost'],
-    ['a blob URL whose inner origin looks real', 'blob:https://example.com/uuid'],
-  ])('refuses %s, saying which schemes it does take', (_case, value) => {
-    const error = refusalFrom(() => resolved({ context: value }));
-    expect(error.message, 'the refusal must say what it would have accepted').toMatch(/http/);
-  });
-});
-
-// `*` is a decision, not a defect: an operator who types it into a flag has
-// chosen it, and refusing outright would push people to edit the stack instead
-// — a worse outcome, invisible to this test file. So it is accepted AND it is
-// loud.
-describe('a wildcard allow-list is honoured, but never silently', () => {
-  const namesTheWildcardRisk = Match.stringLikeRegexp('allowedOrigins');
-  /** Acknowledgeable warnings need a stable id; changing it is a breaking change. */
-  const wildcardWarningId = '@app/allowed-origins:wildcard';
-
-  it('keeps the wildcard the operator asked for', () => {
-    expect(resolved({ context: '*' })).toEqual(['*']);
-    expect(resolved({ props: ['*'] })).toEqual(['*']);
-  });
-
-  it('keeps a wildcard hidden among real origins, rather than dropping it', () => {
-    // `https://a.example.com,*` reads like an allow-list; the `*` makes every
-    // other entry decorative, which is exactly why it must not slip past.
-    expect(resolved({ context: 'https://a.example.com,*' })).toEqual([
-      'https://a.example.com',
-      '*',
-    ]);
-  });
-
-  // Everything below builds a real AppStack — three esbuild bundles and a synth
-  // apiece. One stack per case, and nothing in a `beforeAll`: the generated
-  // project's vitest config raises `testTimeout`, not `hookTimeout`, so a hook
-  // that synthesises is a 10s fuse on a loaded machine.
-  const stackWith = (options: { context?: Record<string, unknown>; props?: AppStackProps }) =>
-    new AppStack(new App({ context: options.context }), 'TestStack', options.props);
-
-  it('warns about a wildcard from -c allowedOrigins, acknowledgeably', () => {
-    // "Honoured, but loud" only holds if the operator can then proceed. A bare
-    // `addWarning` cannot be acknowledged, so `cdk synth --strict` — the flag
-    // CI reaches for — turns a deliberate `*` into a hard failure with no way
-    // past it short of editing the stack: the outcome this design refuses.
-    // Emission and acknowledgeability are one behaviour and share one stack;
-    // a second one costs another three esbuild bundles.
-    const stack = stackWith({ context: { allowedOrigins: '*' } });
-    Annotations.fromStack(stack).hasWarning('*', namesTheWildcardRisk);
-
-    CdkAnnotations.of(stack).acknowledgeWarning(wildcardWarningId);
-
-    Annotations.fromStack(stack).hasNoWarning('*', namesTheWildcardRisk);
-  });
-
-  it('warns just the same when the wildcard arrives through props', () => {
-    // `bin/app.ts` passes props, so this is the path a composed app takes —
-    // and it was the untested half: a wildcard wired in code warned nobody.
-    Annotations.fromStack(stackWith({ props: { allowedOrigins: ['*'] } })).hasWarning(
-      '*',
-      namesTheWildcardRisk,
-    );
-  });
-});

package/templates/skeleton/aws-serverless/infra/test/app-composition.test.ts

@@ -1,137 +0,0 @@
-import type { App, Stack } from 'aws-cdk-lib';
-import { Template } from 'aws-cdk-lib/assertions';
-import { describe, expect, it } from 'vitest';
-import { resolveAllowedOrigins } from '../lib/app-stack.js';
-
-// `bin/app.ts` is what every `cdk deploy` and every CI run actually builds, so
-// the CORS allow-list has to be correct THERE — a stack that can be handed the
-// right origin, by an entrypoint that hands it none, ships an app whose own
-// browser calls are blocked. The README's `curl` health check sends no `Origin`
-// header, so nothing downstream notices.
-//
-// The composition is exercised through the entrypoint rather than rebuilt here:
-// a test that re-wires the stacks itself passes just as happily while
-// `bin/app.ts` stays broken.
-
-const originsOfComposedApp = async (): Promise<unknown[]> => {
-  const { createApp } = (await import('../bin/app.js')) as { createApp: () => App };
-  const app = createApp();
-  const template = Template.fromStack(app.node.findChild('AppStack') as Stack);
-  const apis = template.findResources('AWS::ApiGatewayV2::Api');
-  return Object.values(apis).flatMap(
-    (api) =>
-      (api.Properties as { CorsConfiguration?: { AllowOrigins?: unknown[] } }).CorsConfiguration
-        ?.AllowOrigins ?? [],
-  );
-};
-
-/**
- * `createApp()` builds its own `App`, so `new App({ context })` is not a seam
- * here. CDK's own is: the CLI passes `-c key=value` to a synth through
- * `CDK_CONTEXT_JSON`, which the `App` constructor reads — so setting it around
- * one `createApp()` call reproduces `cdk deploy -c allowedOrigins=…` exactly,
- * without the test knowing anything about how the stacks are wired.
- *
- * `process.env` is process-global, so this seam is not concurrency-safe: an
- * `it.concurrent` in this file would have one case's context leak into
- * another's synth. Keep these cases sequential.
- */
-const withCdkContext = async <T>(context: Record<string, unknown>, run: () => Promise<T>) => {
-  const previous = process.env.CDK_CONTEXT_JSON;
-  process.env.CDK_CONTEXT_JSON = JSON.stringify(context);
-  try {
-    return await run();
-  } finally {
-    if (previous === undefined) delete process.env.CDK_CONTEXT_JSON;
-    else process.env.CDK_CONTEXT_JSON = previous;
-  }
-};
-
-/**
- * The default composition is synthesised once and shared — but deliberately
- * NOT from `beforeAll`. This project's `vitest.config.ts` raises `testTimeout`
- * for exactly this cost and leaves `hookTimeout` at vitest's 10s default, so
- * work put in a hook runs on a fuse a quarter the length of the one the config
- * meant to give it. Synthesising here bundles three Lambdas with esbuild while
- * sibling workers do the same; that contention is what made this suite fail
- * intermittently with `Hook timed out in 10000ms`.
- */
-let defaultComposition: Promise<unknown[]> | undefined;
-const defaultComposedOrigins = (): Promise<unknown[]> =>
-  (defaultComposition ??= originsOfComposedApp());
-
-/** What CDK emits for a cross-stack reference: a Join around an ImportValue. */
-const referencesTheWebDistribution = (origin: unknown): boolean => {
-  if (typeof origin === 'string') return false; // a hard-coded origin, whatever it says
-  const rendered = JSON.stringify(origin);
-  return /Fn::ImportValue/.test(rendered) && /WebStack/.test(rendered);
-};
-
-describe('the deployed app allows the origin it is actually served from', () => {
-  it('takes its allowed origin from the web distribution, not from a localhost no deploy uses', async () => {
-    // `distributionDomainName` is a synth-time token; CDK resolves it across
-    // stacks as an `Fn::ImportValue`, and `AllowOrigins` accepts it. So the
-    // entrypoint has no excuse to leave the two stacks unwired.
-    const appStackOrigins = await defaultComposedOrigins();
-    expect(appStackOrigins.length).toBeGreaterThan(0);
-    expect(appStackOrigins.some(referencesTheWebDistribution)).toBe(true);
-  });
-
-  it('still names who may call it: no wildcard reaches the composed app', async () => {
-    const appStackOrigins = await defaultComposedOrigins();
-    expect(appStackOrigins).not.toContain('*');
-    expect(JSON.stringify(appStackOrigins)).not.toContain('"*"');
-  });
-
-  it('carries the https scheme, without which no browser Origin header can match', async () => {
-    const appStackOrigins = await defaultComposedOrigins();
-    const distributionOrigin = appStackOrigins.find(referencesTheWebDistribution);
-    expect(JSON.stringify(distributionOrigin)).toContain('https://');
-  });
-});
-
-// The README and `AppStackProps.allowedOrigins` both advertise
-// `-c allowedOrigins=https://…` as the way to point the API at a custom domain.
-// It once did not work: the entrypoint passed `allowedOrigins` unconditionally
-// and props win, so the flag was discarded on synth with no error and no
-// warning — a green deploy, a CORS-blocked browser, and `allowOrigins: ['*']`
-// as the obvious repair for a hurried reader. That is the regression the rest
-// of this file exists to prevent, arriving through a different door, which is
-// why the door is pinned here.
-describe('the documented -c escape hatch reaches the composed app', () => {
-  it('serves the origin the flag names instead of discarding it for the CloudFront import', async () => {
-    const origins = await withCdkContext({ allowedOrigins: 'https://custom.example.com' }, () =>
-      originsOfComposedApp(),
-    );
-
-    expect(origins).toContain('https://custom.example.com');
-    expect(
-      origins.some(referencesTheWebDistribution),
-      'a custom domain that still allows only the CloudFront import is a blocked browser',
-    ).toBe(false);
-  });
-});
-
-// Two files read the same context key, and they once disagreed by one value:
-// the entrypoint asked `override === undefined` while `resolveAllowedOrigins`
-// treated `undefined` OR `null` as "nothing given". A `null` — writable in
-// `cdk.json`, `cdk.context.json` or `CDK_CONTEXT_JSON`, though never producible
-// by the `-c` flag — landed in the gap, and the entrypoint dropped the wired
-// origin as if an override existed while the stack fell back to a localhost no
-// deploy is served from. Green synth, blocked browser: this branch's whole
-// failure class. One predicate now, imported; this pins that it stays one.
-describe('a context that names no origin is not an override', () => {
-  it('keeps the wired CloudFront origin when allowedOrigins is present but null', async () => {
-    const origins = await withCdkContext({ allowedOrigins: null }, () => originsOfComposedApp());
-
-    expect(
-      origins.some(referencesTheWebDistribution),
-      'a null context must compose exactly like no context at all',
-    ).toBe(true);
-    // Asked of the resolver rather than spelled out: a literal copy of the
-    // localhost default passes vacuously the moment the default changes — it
-    // then forbids an origin nothing could have produced, and the leak this
-    // line exists to catch walks straight through.
-    expect(origins).not.toContain(resolveAllowedOrigins(undefined, undefined)[0]);
-  });
-});

package/templates/skeleton/aws-serverless/infra/test/app-stack.test.ts

@@ -1,120 +0,0 @@
-import { App } from 'aws-cdk-lib';
-import { Match, Template } from 'aws-cdk-lib/assertions';
-import { describe, expect, it } from 'vitest';
-import { AppStack } from '../lib/app-stack.js';
-
-// `Template.fromStack` bundles the Lambda entries with esbuild — slow-ish, so
-// it runs once and is shared. Deliberately not in `beforeAll`: this project's
-// `vitest.config.ts` raises `testTimeout` for exactly this cost and leaves
-// `hookTimeout` at vitest's 10s default, so the same work in a hook runs on a
-// much shorter fuse — and it is contended, because sibling workers are
-// bundling too.
-let synthesised: Template | undefined;
-const template = (): Template =>
-  (synthesised ??= Template.fromStack(new AppStack(new App(), 'TestStack')));
-
-describe('storage', () => {
-  it('creates the single table with pk/sk and on-demand billing', () => {
-    template().hasResourceProperties('AWS::DynamoDB::Table', {
-      KeySchema: [
-        { AttributeName: 'pk', KeyType: 'HASH' },
-        { AttributeName: 'sk', KeyType: 'RANGE' },
-      ],
-      BillingMode: 'PAY_PER_REQUEST',
-    });
-    template().resourceCountIs('AWS::DynamoDB::Table', 1);
-  });
-});
-
-describe('queue discipline', () => {
-  it('wires the DLQ with maxReceiveCount 3', () => {
-    template().hasResourceProperties('AWS::SQS::Queue', {
-      RedrivePolicy: Match.objectLike({ maxReceiveCount: 3 }),
-    });
-  });
-
-  it('alarms as soon as one message reaches the DLQ', () => {
-    template().hasResourceProperties('AWS::CloudWatch::Alarm', {
-      MetricName: 'ApproximateNumberOfMessagesVisible',
-      Threshold: 1,
-      EvaluationPeriods: 1,
-      ComparisonOperator: 'GreaterThanOrEqualToThreshold',
-    });
-  });
-
-  it('feeds the worker one message at a time', () => {
-    template().hasResourceProperties('AWS::Lambda::EventSourceMapping', {
-      BatchSize: 1,
-    });
-  });
-});
-
-describe('functions and routes', () => {
-  it('deploys exactly the create, list and worker functions — one purpose each', () => {
-    template().resourceCountIs('AWS::Lambda::Function', 3);
-  });
-
-  it('passes table and queue to the api via environment', () => {
-    template().hasResourceProperties('AWS::Lambda::Function', {
-      Environment: {
-        Variables: Match.objectLike({
-          TABLE_NAME: Match.anyValue(),
-          QUEUE_URL: Match.anyValue(),
-        }),
-      },
-    });
-  });
-
-  it('exposes exactly two routes: POST /notes and GET /notes', () => {
-    template().hasResourceProperties('AWS::ApiGatewayV2::Route', {
-      RouteKey: 'POST /notes',
-    });
-    template().hasResourceProperties('AWS::ApiGatewayV2::Route', {
-      RouteKey: 'GET /notes',
-    });
-    template().resourceCountIs('AWS::ApiGatewayV2::Route', 2);
-  });
-
-  it('allows the browser origin in: CORS is configured', () => {
-    template().hasResourceProperties('AWS::ApiGatewayV2::Api', {
-      CorsConfiguration: Match.objectLike({
-        AllowMethods: Match.arrayWith(['GET', 'POST']),
-      }),
-    });
-  });
-
-  it('never allows every origin: the api names who may call it', () => {
-    const apis = template().findResources('AWS::ApiGatewayV2::Api');
-    const origins = Object.values(apis).flatMap(
-      (api) =>
-        (api.Properties as { CorsConfiguration?: { AllowOrigins?: unknown[] } }).CorsConfiguration
-          ?.AllowOrigins ?? [],
-    );
-
-    // A starter multiplies whatever it ships: `*` here becomes the default of
-    // every project generated from it. The web bundle has a known origin.
-    expect(origins.length).toBeGreaterThan(0);
-    expect(origins).not.toContain('*');
-  });
-});
-
-describe('least-privilege IAM', () => {
-  it('grants writes to the creator, reads to the lister, queue send — nothing broad', () => {
-    const policies = template().findResources('AWS::IAM::Policy');
-    const statements = Object.values(policies).flatMap(
-      (policy) =>
-        (policy.Properties as { PolicyDocument: { Statement: Array<Record<string, unknown>> } })
-          .PolicyDocument.Statement,
-    );
-    const actions = statements.flatMap((s) =>
-      Array.isArray(s.Action) ? (s.Action as string[]) : [s.Action as string],
-    );
-
-    expect(actions).toContain('dynamodb:PutItem');
-    expect(actions).toContain('dynamodb:Scan'); // the list function reads
-    expect(actions).toContain('sqs:SendMessage');
-    // Least privilege: nothing broad.
-    expect(actions).not.toContain('dynamodb:*');
-    expect(actions.some((a) => a === '*')).toBe(false);
-  });
-});

package/templates/skeleton/aws-serverless/infra/test/web-stack.test.ts

@@ -1,44 +0,0 @@
-import { App } from 'aws-cdk-lib';
-import { Match, Template } from 'aws-cdk-lib/assertions';
-import { describe, it } from 'vitest';
-import { WebStack } from '../lib/web-stack.js';
-
-// The web stack is stateless serving only: a private bucket behind CloudFront.
-// The bundle itself is synced by the deploy step (see README) — synth stays
-// independent of `next build`.
-//
-// Synthesised lazily rather than in a `beforeAll`, like its neighbours in this
-// directory: `vitest.config.ts` raises `testTimeout` and leaves `hookTimeout`
-// at 10 s, so a hook is the one place in the suite running on a short fuse.
-// This stack bundles no Lambda and takes ~370 ms — the reason to do it anyway
-// is that the next person copies whatever shape is here.
-let cached: Template | undefined;
-const template = () => (cached ??= Template.fromStack(new WebStack(new App(), 'TestWebStack')));
-
-describe('web serving stack', () => {
-  it('keeps the bucket fully private', () => {
-    template().hasResourceProperties('AWS::S3::Bucket', {
-      PublicAccessBlockConfiguration: Match.objectLike({
-        BlockPublicAcls: true,
-        BlockPublicPolicy: true,
-        IgnorePublicAcls: true,
-        RestrictPublicBuckets: true,
-      }),
-    });
-  });
-
-  it('serves through CloudFront with origin access control', () => {
-    template().resourceCountIs('AWS::CloudFront::Distribution', 1);
-    template().resourceCountIs('AWS::CloudFront::OriginAccessControl', 1);
-    template().hasResourceProperties('AWS::CloudFront::Distribution', {
-      DistributionConfig: Match.objectLike({
-        DefaultRootObject: 'index.html',
-      }),
-    });
-  });
-
-  it('exports the distribution domain and bucket name for the deploy step', () => {
-    template().hasOutput('WebBucketName', {});
-    template().hasOutput('WebUrl', {});
-  });
-});

package/templates/skeleton/aws-serverless/package.json

@@ -1,30 +0,0 @@
-{
-  "name": "@app/root",
-  "version": "0.1.0",
-  "private": true,
-  "type": "module",
-  "engines": {
-    "node": ">=20"
-  },
-  "scripts": {
-    "test": "vitest run",
-    "lint": "eslint .",
-    "typecheck": "tsc -p tsconfig.json && tsc -p apps/web/tsconfig.json",
-    "build:web": "pnpm --filter @app/web build",
-    "synth": "pnpm --filter @app/infra synth",
-    "deploy": "pnpm --filter @app/infra deploy",
-    "check": "pnpm lint && pnpm typecheck && pnpm test && pnpm build:web && pnpm synth"
-  },
-  "devDependencies": {
-    "@eslint/js": "^10.0.1",
-    "@types/aws-lambda": "^8.10.162",
-    "@types/node": "^26.1.1",
-    "esbuild": "^0.28.1",
-    "eslint": "^10.7.0",
-    "globals": "^17.7.0",
-    "tsx": "^4.23.1",
-    "typescript": "^6.0.3",
-    "typescript-eslint": "^8.65.0",
-    "vitest": "^4.1.10"
-  }
-}

package/templates/skeleton/aws-serverless/packages/core/package.json

@@ -1,11 +0,0 @@
-{
-  "name": "@app/core",
-  "version": "0.1.0",
-  "private": true,
-  "type": "module",
-  "main": "src/index.ts",
-  "types": "src/index.ts",
-  "dependencies": {
-    "zod": "^4.4.3"
-  }
-}

package/templates/skeleton/aws-serverless/packages/core/src/events.ts

@@ -1,14 +0,0 @@
-// Domain event vocabulary. The schema is the contract between the API (producer)
-// and the worker (consumer) — both sides validate against it.
-import { z } from 'zod';
-import { NoteSchema, type Note } from './note.js';
-
-export const NoteCreatedEventSchema = z.object({
-  type: z.literal('note.created'),
-  note: NoteSchema,
-});
-export type NoteCreatedEvent = z.infer<typeof NoteCreatedEventSchema>;
-
-export function makeNoteCreatedEvent(note: Note): NoteCreatedEvent {
-  return { type: 'note.created', note };
-}