@parlor/scaffold 0.0.0-stage → 0.1.0

package/dist/package-manager.js

@@ -0,0 +1,118 @@
+import { spawn } from "node:child_process";
+import { existsSync } from "node:fs";
+import { readFile } from "node:fs/promises";
+import { join } from "node:path";
+export const PACKAGE_MANAGERS = ["npm", "pnpm", "yarn", "bun"];
+/** Dependencies whose install scripts a Parlor project needs; pnpm 10+ blocks them unless approved. */
+export const BUILD_SCRIPT_DEPENDENCIES = ["esbuild"];
+/**
+ * `npm_config_user_agent` looks like `pnpm/11.21.0 npm/? node/v24.19.0 darwin arm64`; every
+ * package manager sets it for the scripts and `create` initializers it runs.
+ */
+export function fromUserAgent(userAgent) {
+    const [name, version] = userAgent?.split(" ")[0]?.split("/") ?? [];
+    if (!isPackageManagerName(name))
+        return undefined;
+    return { name, version: version && version !== "?" ? version : undefined };
+}
+function isPackageManagerName(name) {
+    return PACKAGE_MANAGERS.includes(name);
+}
+const LOCKFILES = [
+    ["pnpm-lock.yaml", "pnpm"],
+    ["bun.lock", "bun"],
+    ["bun.lockb", "bun"],
+    ["yarn.lock", "yarn"],
+    ["package-lock.json", "npm"],
+];
+function fromPackageManagerField(field) {
+    if (typeof field !== "string")
+        return undefined;
+    const [name, rest = ""] = field.split("@");
+    if (!isPackageManagerName(name))
+        return undefined;
+    return { name, version: rest.split("+")[0] || undefined };
+}
+export async function detectProjectPackageManager(rootDir, env = process.env) {
+    const invoking = fromUserAgent(env.npm_config_user_agent);
+    if (invoking)
+        return invoking;
+    const manifest = await readFile(join(rootDir, "package.json"), "utf8").then((text) => JSON.parse(text), () => undefined);
+    const declared = fromPackageManagerField(manifest?.packageManager);
+    if (declared)
+        return declared;
+    const lockfile = LOCKFILES.find(([file]) => existsSync(join(rootDir, file)));
+    return { name: lockfile?.[1] ?? "npm", version: undefined };
+}
+export function commandsFor({ name }) {
+    const addVerb = name === "npm" ? "install" : "add";
+    const devFlag = name === "npm" ? "--save-dev" : name === "bun" ? "--dev" : "-D";
+    return {
+        install: { bin: name, args: ["install"] },
+        add: (packages, { dev }) => ({
+            bin: name,
+            args: [addVerb, ...(dev ? [devFlag] : []), ...packages],
+        }),
+        run: (script) => name === "pnpm" || name === "yarn" ? `${name} ${script}` : `${name} run ${script}`,
+        exec: (bin, args) => formatCommand(execCommand({ name, version: undefined }, bin, args)),
+    };
+}
+/** The runnable form of `commandsFor(manager).exec`. */
+export function execCommand({ name }, bin, args) {
+    const runner = { npm: "npx", pnpm: "pnpm", yarn: "yarn", bun: "bunx" }[name];
+    return { bin: runner, args: [bin, ...args] };
+}
+export function formatCommand(command) {
+    return [command.bin, ...command.args].join(" ");
+}
+/** Yarn must not use Plug'n'Play: the CLI resolves its tools from `node_modules`. */
+export function packageManagerFiles(manager) {
+    if (manager.name === "pnpm") {
+        const builds = usesOnlyBuiltDependencies(manager.version)
+            ? `onlyBuiltDependencies:\n${BUILD_SCRIPT_DEPENDENCIES.map((name) => `  - ${name}\n`).join("")}`
+            : `allowBuilds:\n${BUILD_SCRIPT_DEPENDENCIES.map((name) => `  ${name}: true\n`).join("")}`;
+        return new Map([["pnpm-workspace.yaml", builds]]);
+    }
+    if (manager.name === "yarn")
+        return new Map([[".yarnrc.yml", "nodeLinker: node-modules\n"]]);
+    return new Map();
+}
+/** pnpm 10.0 to 10.25; an unknown version gets the current form, as create-next-app does. */
+function usesOnlyBuiltDependencies(version) {
+    const [major, minor] = (version ?? "").split(".").map(Number);
+    return major === 10 && minor !== undefined && minor < 26;
+}
+export function packageManagerField(manager) {
+    if (manager.name === "npm" || !manager.version)
+        return undefined;
+    return `${manager.name}@${manager.version}`;
+}
+/** `NODE_ENV=development`, because pnpm skips devDependencies in production. */
+export async function runInstall(rootDir, command, log) {
+    const child = spawn(command.bin, command.args, {
+        cwd: rootDir,
+        env: { ...process.env, NODE_ENV: "development" },
+        stdio: ["inherit", "inherit", "pipe"],
+    });
+    let stderr = "";
+    child.stderr.on("data", (chunk) => {
+        process.stderr.write(chunk);
+        stderr += chunk.toString("utf8");
+    });
+    const exitCode = await new Promise((resolve) => {
+        child.once("error", () => resolve(null));
+        child.once("close", resolve);
+    });
+    if (exitCode === 0)
+        return { kind: "installed" };
+    const ignored = IGNORED_BUILDS.exec(stderr);
+    if (ignored) {
+        const packages = (ignored[1] ?? "").split(",").map((entry) => entry.trim());
+        const hint = "Run pnpm approve-builds to allow them.";
+        log(`pnpm skipped the build scripts of ${packages.join(", ")}. ${hint}`);
+        return { kind: "ignored-builds", packages, hint };
+    }
+    return { kind: "failed", command: formatCommand(command), exitCode };
+}
+const IGNORED_BUILDS = /ERR_PNPM_IGNORED_BUILDS\]?\s*Ignored build scripts:\s*([^\n]+?)\.?\s*$/m;
+//# sourceMappingURL=package-manager.js.map

package/dist/package-manager.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"package-manager.js","sourceRoot":"","sources":["../src/package-manager.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAC3C,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,CAAU,CAAC;AAoBxE,uGAAuG;AACvG,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,SAAS,CAAU,CAAC;AAE9D;;;GAGG;AACH,MAAM,UAAU,aAAa,CAAC,SAA6B;IACzD,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,SAAS,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;IACnE,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC;QAAE,OAAO,SAAS,CAAC;IAClD,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,IAAI,OAAO,KAAK,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC;AAC7E,CAAC;AAED,SAAS,oBAAoB,CAAC,IAAwB;IACpD,OAAO,gBAAgB,CAAC,QAAQ,CAAC,IAA0B,CAAC,CAAC;AAC/D,CAAC;AAED,MAAM,SAAS,GAAyD;IACtE,CAAC,gBAAgB,EAAE,MAAM,CAAC;IAC1B,CAAC,UAAU,EAAE,KAAK,CAAC;IACnB,CAAC,WAAW,EAAE,KAAK,CAAC;IACpB,CAAC,WAAW,EAAE,MAAM,CAAC;IACrB,CAAC,mBAAmB,EAAE,KAAK,CAAC;CAC7B,CAAC;AAEF,SAAS,uBAAuB,CAAC,KAAc;IAC7C,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC;IAChD,MAAM,CAAC,IAAI,EAAE,IAAI,GAAG,EAAE,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC3C,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC;QAAE,OAAO,SAAS,CAAC;IAClD,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,SAAS,EAAE,CAAC;AAC5D,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAC/C,OAAe,EACf,GAAG,GAAsB,OAAO,CAAC,GAAG;IAEpC,MAAM,QAAQ,GAAG,aAAa,CAAC,GAAG,CAAC,qBAAqB,CAAC,CAAC;IAC1D,IAAI,QAAQ;QAAE,OAAO,QAAQ,CAAC;IAC9B,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,OAAO,EAAE,cAAc,CAAC,EAAE,MAAM,CAAC,CAAC,IAAI,CACzE,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAiC,EAC1D,GAAG,EAAE,CAAC,SAAS,CAChB,CAAC;IACF,MAAM,QAAQ,GAAG,uBAAuB,CAAC,QAAQ,EAAE,cAAc,CAAC,CAAC;IACnE,IAAI,QAAQ;QAAE,OAAO,QAAQ,CAAC;IAC9B,MAAM,QAAQ,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;IAC7E,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC;AAC9D,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,EAAE,IAAI,EAAkB;IAClD,MAAM,OAAO,GAAG,IAAI,KAAK,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC;IACnD,MAAM,OAAO,GAAG,IAAI,KAAK,KAAK,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,IAAI,KAAK,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC;IAChF,OAAO;QACL,OAAO,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,SAAS,CAAC,EAAE;QACzC,GAAG,EAAE,CAAC,QAAQ,EAAE,EAAE,GAAG,EAAE,EAAE,EAAE,CAAC,CAAC;YAC3B,GAAG,EAAE,IAAI;YACT,IAAI,EAAE,CAAC,OAAO,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,GAAG,QAAQ,CAAC;SACxD,CAAC;QACF,GAAG,EAAE,CAAC,MAAM,EAAE,EAAE,CACd,IAAI,KAAK,MAAM,IAAI,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,GAAG,IAAI,IAAI,MAAM,EAAE,CAAC,CAAC,CAAC,GAAG,IAAI,QAAQ,MAAM,EAAE;QACpF,IAAI,EAAE,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,CAClB,aAAa,CAAC,WAAW,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;KACtE,CAAC;AACJ,CAAC;AAED,wDAAwD;AACxD,MAAM,UAAU,WAAW,CACzB,EAAE,IAAI,EAAkB,EACxB,GAAW,EACX,IAAuB;IAEvB,MAAM,MAAM,GAAG,EAAE,GAAG,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC,IAAI,CAAC,CAAC;IAC7E,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,EAAE,CAAC;AAC/C,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,OAAgB;IAC5C,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAClD,CAAC;AAED,qFAAqF;AACrF,MAAM,UAAU,mBAAmB,CACjC,OAAuB;IAEvB,IAAI,OAAO,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;QAC5B,MAAM,MAAM,GAAG,yBAAyB,CAAC,OAAO,CAAC,OAAO,CAAC;YACvD,CAAC,CAAC,2BAA2B,yBAAyB,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,IAAI,IAAI,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE;YAChG,CAAC,CAAC,iBAAiB,yBAAyB,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,KAAK,IAAI,UAAU,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC;QAC7F,OAAO,IAAI,GAAG,CAAC,CAAC,CAAC,qBAAqB,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC;IACpD,CAAC;IACD,IAAI,OAAO,CAAC,IAAI,KAAK,MAAM;QACzB,OAAO,IAAI,GAAG,CAAC,CAAC,CAAC,aAAa,EAAE,4BAA4B,CAAC,CAAC,CAAC,CAAC;IAClE,OAAO,IAAI,GAAG,EAAE,CAAC;AACnB,CAAC;AAED,6FAA6F;AAC7F,SAAS,yBAAyB,CAAC,OAA2B;IAC5D,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAC9D,OAAO,KAAK,KAAK,EAAE,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,GAAG,EAAE,CAAC;AAC3D,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,OAAuB;IACzD,IAAI,OAAO,CAAC,IAAI,KAAK,KAAK,IAAI,CAAC,OAAO,CAAC,OAAO;QAAE,OAAO,SAAS,CAAC;IACjE,OAAO,GAAG,OAAO,CAAC,IAAI,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;AAC9C,CAAC;AAgBD,gFAAgF;AAChF,MAAM,CAAC,KAAK,UAAU,UAAU,CAC9B,OAAe,EACf,OAAgB,EAChB,GAA2B;IAE3B,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,EAAE,OAAO,CAAC,IAAI,EAAE;QAC7C,GAAG,EAAE,OAAO;QACZ,GAAG,EAAE,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,QAAQ,EAAE,aAAa,EAAE;QAChD,KAAK,EAAE,CAAC,SAAS,EAAE,SAAS,EAAE,MAAM,CAAC;KACtC,CAAC,CAAC;IACH,IAAI,MAAM,GAAG,EAAE,CAAC;IAChB,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;QACxC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAC5B,MAAM,IAAI,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IACnC,CAAC,CAAC,CAAC;IACH,MAAM,QAAQ,GAAG,MAAM,IAAI,OAAO,CAAgB,CAAC,OAAO,EAAE,EAAE;QAC5D,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;QACzC,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAC/B,CAAC,CAAC,CAAC;IACH,IAAI,QAAQ,KAAK,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC;IACjD,MAAM,OAAO,GAAG,cAAc,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAC5C,IAAI,OAAO,EAAE,CAAC;QACZ,MAAM,QAAQ,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;QAC5E,MAAM,IAAI,GAAG,wCAAwC,CAAC;QACtD,GAAG,CAAC,qCAAqC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC;QACzE,OAAO,EAAE,IAAI,EAAE,gBAAgB,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;IACpD,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,aAAa,CAAC,OAAO,CAAC,EAAE,QAAQ,EAAE,CAAC;AACvE,CAAC;AAED,MAAM,cAAc,GAClB,yEAAyE,CAAC"}

package/dist/version.d.ts

@@ -0,0 +1,6 @@
+/** `@parlor/*` and `create-parlor` release in lockstep, so a project pins every framework package to this. */
+export declare const FRAMEWORK_VERSION: string;
+/** The same folder from `src/` in the repo and from `dist/` when published. */
+export declare const TEMPLATES_DIR: string;
+export declare const DOCS_URL = "https://cychien.github.io/parlor";
+//# sourceMappingURL=version.d.ts.map

package/dist/version.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"version.d.ts","sourceRoot":"","sources":["../src/version.ts"],"names":[],"mappings":"AAKA,8GAA8G;AAC9G,eAAO,MAAM,iBAAiB,EAAE,MAEvB,CAAC;AAEV,+EAA+E;AAC/E,eAAO,MAAM,aAAa,EAAE,MAE3B,CAAC;AAEF,eAAO,MAAM,QAAQ,qCAAqC,CAAC"}

package/dist/version.js

@@ -0,0 +1,9 @@
+import { createRequire } from "node:module";
+import { fileURLToPath } from "node:url";
+const require = createRequire(import.meta.url);
+/** `@parlor/*` and `create-parlor` release in lockstep, so a project pins every framework package to this. */
+export const FRAMEWORK_VERSION = require("../package.json").version;
+/** The same folder from `src/` in the repo and from `dist/` when published. */
+export const TEMPLATES_DIR = fileURLToPath(new URL("../templates/", import.meta.url));
+export const DOCS_URL = "https://cychien.github.io/parlor";
+//# sourceMappingURL=version.js.map

package/dist/version.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"version.js","sourceRoot":"","sources":["../src/version.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAEzC,MAAM,OAAO,GAAG,aAAa,CAAC,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC;AAE/C,8GAA8G;AAC9G,MAAM,CAAC,MAAM,iBAAiB,GAC5B,OAAO,CAAC,iBAAiB,CAC1B,CAAC,OAAO,CAAC;AAEV,+EAA+E;AAC/E,MAAM,CAAC,MAAM,aAAa,GAAW,aAAa,CAChD,IAAI,GAAG,CAAC,eAAe,EAAE,OAAO,IAAI,CAAC,GAAG,CAAC,CAC1C,CAAC;AAEF,MAAM,CAAC,MAAM,QAAQ,GAAG,kCAAkC,CAAC"}

package/package.json

@@ -1,6 +1,49 @@
 {
   "name": "@parlor/scaffold",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
+  "version": "0.1.0",
+  "description": "What create-parlor and parlor add share: the templates, the add-on model, the syntax-tree edit engine, package manager detection, install and git",
+  "homepage": "https://cychien.github.io/parlor",
+  "bugs": "https://github.com/cychien/parlor/issues",
+  "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/cychien/parlor.git",
+    "directory": "packages/scaffold"
+  },
+  "files": [
+    "dist",
+    "templates/default",
+    "templates/auth",
+    "!templates/*/node_modules",
+    "!templates/*/.parlor"
+  ],
+  "type": "module",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js"
+    },
+    "./package.json": "./package.json"
+  },
+  "dependencies": {
+    "@babel/parser": "^7.29.9"
+  },
+  "devDependencies": {
+    "@babel/types": "^7.29.8",
+    "@types/node": "^24.14.0",
+    "tsx": "^4.23.15",
+    "typescript": "^7.0.2",
+    "vitest": "^5.0.3",
+    "@parlor/config": "0.1.0"
+  },
+  "engines": {
+    "node": ">=24"
+  },
+  "scripts": {
+    "build": "tsc -p tsconfig.json",
+    "typecheck": "tsc -p tsconfig.json --noEmit && tsc -p tsconfig.spec.json --noEmit",
+    "test": "vitest run",
+    "catalog": "tsx scripts/write-catalog.ts",
+    "fixtures": "tsx scripts/write-fixtures.ts"
+  }
 }

package/templates/auth/auth.ts

@@ -0,0 +1,20 @@
+import { betterAuthProvider, parlorAuth } from "@parlor/auth";
+import type { DatabaseHandle } from "@parlor/data";
+import { betterAuth } from "better-auth";
+import { drizzleAdapter } from "better-auth/adapters/drizzle";
+
+import * as schema from "./schema/index.js";
+
+export function createAuth(database: DatabaseHandle) {
+  const options = parlorAuth({
+    appName: process.env.PARLOR_APP_NAME ?? "Parlor App",
+    signInPage: "/sign-in",
+    emailAndPassword: { enabled: true },
+  });
+  return betterAuthProvider({
+    instance: betterAuth({
+      ...options,
+      database: drizzleAdapter(database.db, { provider: "pg", schema }),
+    }),
+  });
+}

package/templates/auth/schema/auth.ts

@@ -0,0 +1 @@
+export * from "@parlor/auth/schema";

package/templates/auth/src/auth/client.ts

@@ -0,0 +1,3 @@
+import { createAuthClient } from "@parlor/auth/client";
+
+export const auth = createAuthClient();

package/templates/auth/src/auth/sign-in-gate.tsx

@@ -0,0 +1,17 @@
+import { useSession } from "@parlor/client/react";
+import { Navigate, Outlet, useLocation } from "@tanstack/react-router";
+import type { ReactNode } from "react";
+
+export const SIGN_IN_PATH = "/sign-in";
+
+/** Wraps the root layout: the sign-in page renders bare, everything else needs a session. */
+export function withSignIn(Layout: () => ReactNode): () => ReactNode {
+  return function SignedIn() {
+    const session = useSession();
+    const { pathname } = useLocation();
+    if (pathname === SIGN_IN_PATH) return <Outlet />;
+    if (session.status === "loading") return null;
+    if (session.status === "signed-out") return <Navigate to={SIGN_IN_PATH} replace />;
+    return <Layout />;
+  };
+}

package/templates/auth/src/auth/sign-out-button.tsx

@@ -0,0 +1,17 @@
+import { useSession } from "@parlor/client/react";
+
+import { auth } from "./client.js";
+
+export function SignOutButton() {
+  const session = useSession();
+  if (session.status !== "signed-in") return null;
+  return (
+    <button
+      type="button"
+      onClick={() => void auth.signOut()}
+      className="rounded-md px-3 py-1.5 text-sm text-zinc-600 hover:bg-zinc-100"
+    >
+      Sign out
+    </button>
+  );
+}

package/templates/auth/src/routes/link.tsx

@@ -0,0 +1,92 @@
+import { useLinkDevice, useSession } from "@parlor/client/react";
+import { createFileRoute, Link } from "@tanstack/react-router";
+import { useEffect, useState } from "react";
+
+export const Route = createFileRoute("/link")({
+  staticData: {
+    description:
+      "Link a new device to the user's agents: the page a linked phone opens from the new device's QR code.",
+  },
+  component: LinkDevice,
+});
+
+const BUTTON =
+  "rounded-md border border-zinc-300 px-3 py-1.5 text-sm enabled:hover:bg-zinc-100";
+const PRIMARY = "rounded-md bg-zinc-900 px-3 py-1.5 text-sm font-medium text-white";
+
+/** The device id and commitment the QR put in the fragment, which never reaches a server. */
+function scanned():
+  | { readonly deviceId: string; readonly commitment: string }
+  | undefined {
+  const fragment = new URLSearchParams(window.location.hash.slice(1));
+  const deviceId = fragment.get("d");
+  const commitment = fragment.get("c");
+  return deviceId && commitment ? { deviceId, commitment } : undefined;
+}
+
+function LinkDevice() {
+  const { available, state, check, confirm } = useLinkDevice();
+  const session = useSession();
+  const [target] = useState(scanned);
+  useEffect(() => {
+    if (available && target) void check(target);
+  }, [available, target, check]);
+  const account = session.status === "signed-in" ? session.user.email : "your account";
+
+  return (
+    <section aria-label="Link a device" className="space-y-4">
+      <h1 className="text-2xl font-semibold tracking-tight">Link a device</h1>
+      {!target ? (
+        <p>This link is missing the new device's code. Scan its QR code again.</p>
+      ) : !available ? (
+        <p>Linking needs sign-in on this device.</p>
+      ) : state.step === "confirm" ? (
+        <>
+          <p className="text-lg">Link {state.device.name}?</p>
+          <p className="text-zinc-600">
+            It will be able to send requests to the agents on your computer, signed in as{" "}
+            {account}. Only link a device you have with you.
+          </p>
+          <div className="flex gap-2">
+            <Link to="/" className={BUTTON}>
+              Cancel
+            </Link>
+            <button type="button" onClick={() => void confirm()} className={PRIMARY}>
+              Link with Face ID or Touch ID
+            </button>
+          </div>
+        </>
+      ) : state.step === "linking" ? (
+        <p className="text-zinc-600">Confirm with Face ID or Touch ID…</p>
+      ) : state.step === "linked" ? (
+        <>
+          <p className="text-lg">{state.name} is linked</p>
+          <p className="text-zinc-600">It can use your agents now.</p>
+          <Link to="/" className={PRIMARY}>
+            Done
+          </Link>
+        </>
+      ) : state.step === "on-computer" ? (
+        <>
+          <p>
+            This browser cannot confirm with Face ID or Touch ID. On your computer, run:
+          </p>
+          <code className="block rounded bg-zinc-100 p-2 text-sm wrap-anywhere">
+            {state.command}
+          </code>
+        </>
+      ) : state.step === "error" ? (
+        <>
+          <p role="alert" className="text-red-600">
+            {state.message}
+          </p>
+          <button type="button" onClick={() => void check(target)} className={BUTTON}>
+            Try again
+          </button>
+        </>
+      ) : (
+        <p className="text-zinc-600">Checking the new device…</p>
+      )}
+    </section>
+  );
+}

package/templates/auth/src/routes/sign-in.tsx

@@ -0,0 +1,117 @@
+import { AuthClientError } from "@parlor/auth/client";
+import { useSession } from "@parlor/client/react";
+import { createFileRoute, Navigate, useNavigate } from "@tanstack/react-router";
+import { type FormEvent, useId, useState } from "react";
+
+import { auth } from "../auth/client.js";
+
+export const Route = createFileRoute("/sign-in")({
+  staticData: {
+    description: "Sign in, or create an account, with an email and a password.",
+  },
+  component: SignIn,
+});
+
+/** An MCP client's authorization comes back here with a signed query to resume after sign-in. */
+const resumesAuthorization = () => new URLSearchParams(window.location.search).has("sig");
+
+const FIELD =
+  "w-full rounded-md border border-zinc-300 bg-white px-3 py-2 focus:border-zinc-900 focus:outline-none";
+
+function SignIn() {
+  const session = useSession();
+  const navigate = useNavigate();
+  const errorId = useId();
+  const [signingUp, setSigningUp] = useState(false);
+  const [error, setError] = useState("");
+  const [busy, setBusy] = useState(false);
+
+  if (session.status === "anonymous") return <Navigate to="/" />;
+  if (session.status === "signed-in" && !resumesAuthorization())
+    return <Navigate to="/" />;
+
+  const submit = async (event: FormEvent<HTMLFormElement>) => {
+    event.preventDefault();
+    const form = new FormData(event.currentTarget);
+    const email = String(form.get("email")).trim();
+    const password = String(form.get("password"));
+    setBusy(true);
+    setError("");
+    try {
+      if (signingUp) {
+        await auth.signUp({ name: String(form.get("name")).trim(), email, password });
+      } else {
+        await auth.signIn({ email, password });
+      }
+      if (!resumesAuthorization()) await navigate({ to: "/" });
+    } catch (failure) {
+      setError(
+        failure instanceof AuthClientError ? failure.message : "Something went wrong.",
+      );
+    } finally {
+      setBusy(false);
+    }
+  };
+
+  return (
+    <main className="mx-auto mt-24 max-w-sm space-y-6 px-6">
+      <h1 className="text-2xl font-semibold tracking-tight">
+        {signingUp ? "Create your account" : "Sign in"}
+      </h1>
+      <form
+        onSubmit={(event) => void submit(event)}
+        aria-describedby={error ? errorId : undefined}
+        className="space-y-3"
+      >
+        {signingUp ? (
+          <input
+            name="name"
+            aria-label="Name"
+            placeholder="Name"
+            autoComplete="name"
+            required
+            className={FIELD}
+          />
+        ) : null}
+        <input
+          name="email"
+          type="email"
+          aria-label="Email"
+          placeholder="Email"
+          autoComplete="email"
+          required
+          className={FIELD}
+        />
+        <input
+          name="password"
+          type="password"
+          aria-label="Password"
+          placeholder="Password"
+          autoComplete={signingUp ? "new-password" : "current-password"}
+          minLength={8}
+          required
+          className={FIELD}
+        />
+        {error ? (
+          <p id={errorId} role="alert" className="text-sm text-red-600">
+            {error}
+          </p>
+        ) : null}
+        <button
+          type="submit"
+          disabled={busy}
+          className="w-full rounded-md bg-zinc-900 px-4 py-2 font-medium text-white disabled:opacity-50"
+        >
+          {signingUp ? "Create account" : "Sign in"}
+        </button>
+      </form>
+      <button
+        type="button"
+        onClick={() => setSigningUp(!signingUp)}
+        className="text-sm text-zinc-600 underline"
+      >
+        {signingUp ? "I have an account" : "Create an account"}
+      </button>
+    </main>
+  );
+}

package/templates/default/_gitignore

@@ -0,0 +1,7 @@
+node_modules
+.parlor
+*.log
+.env
+.env.*
+!.env.example
+.DS_Store

package/templates/default/actions/index.ts

@@ -0,0 +1,58 @@
+import { ActionError, defineAction } from "@parlor/core";
+import { createRegistry } from "@parlor/core/registry";
+import { and, asc, eq } from "drizzle-orm";
+import { z } from "zod";
+
+import { todos } from "../schema/index.js";
+
+const mine = (id: string, scope: string) => and(eq(todos.id, id), eq(todos.scope, scope));
+
+export const registry = createRegistry({
+  listTodos: defineAction({
+    description: "List the todos, oldest first.",
+    input: z.object({}),
+    reads: [todos],
+    run: (_, { db, scope }) =>
+      db.select().from(todos).where(eq(todos.scope, scope)).orderBy(asc(todos.createdAt)),
+  }),
+  addTodo: defineAction({
+    description: "Add a todo.",
+    input: z.object({
+      title: z.string().trim().min(1).describe("What needs to be done"),
+    }),
+    writes: [todos],
+    run: async ({ title }, { db, scope }) => {
+      const [todo] = await db
+        .insert(todos)
+        .values({ id: crypto.randomUUID(), scope, title })
+        .returning();
+      return todo;
+    },
+  }),
+  toggleTodo: defineAction({
+    description: "Mark a todo done, or not done again.",
+    input: z.object({ id: z.string() }),
+    writes: [todos],
+    run: async ({ id }, { db, scope }) => {
+      const [current] = await db.select().from(todos).where(mine(id, scope));
+      if (!current) throw new ActionError("not_found", `No todo ${id}`);
+      const [todo] = await db
+        .update(todos)
+        .set({ done: !current.done })
+        .where(mine(id, scope))
+        .returning();
+      return todo;
+    },
+  }),
+  deleteTodo: defineAction({
+    description: "Delete a todo.",
+    input: z.object({ id: z.string() }),
+    writes: [todos],
+    confirm: true,
+    run: async ({ id }, { db, scope }) => {
+      const [todo] = await db.delete(todos).where(mine(id, scope)).returning();
+      if (!todo) throw new ActionError("not_found", `No todo ${id}`);
+      return todo;
+    },
+  }),
+});

package/templates/default/actions/todos.spec.ts

@@ -0,0 +1,38 @@
+import { fileURLToPath } from "node:url";
+
+import { createActionClient } from "@parlor/client";
+import type { ActionsOf } from "@parlor/core/registry";
+import { createDatabase } from "@parlor/data";
+import { createServer } from "@parlor/server";
+import { afterEach, expect, test } from "vitest";
+
+import { registry } from "./index.js";
+
+const servers: { close(): Promise<void> }[] = [];
+
+afterEach(async () => {
+  await Promise.all(servers.splice(0).map((server) => server.close()));
+});
+
+async function startApp() {
+  const database = await createDatabase({
+    dataDir: "memory://",
+    migrationsFolder: fileURLToPath(new URL("../migrations", import.meta.url)),
+  });
+  const server = createServer({ actions: registry, database });
+  servers.push(server);
+  return createActionClient<ActionsOf<typeof registry>>({
+    baseUrl: "http://app.test",
+    fetch: (input, init) => server.fetch(new Request(input, init)),
+  });
+}
+
+test("a todo added through its action is in the list, not done", async () => {
+  const app = await startApp();
+
+  await app.call("addTodo", { title: "Buy milk" });
+
+  expect(await app.call("listTodos", {})).toMatchObject([
+    { title: "Buy milk", done: false },
+  ]);
+});

package/templates/default/index.html

@@ -0,0 +1,13 @@
+<!doctype html>
+<html lang="en">
+  <head>
+    <meta charset="UTF-8" />
+    <meta name="viewport" content="width=device-width, initial-scale=1.0" />
+    <link rel="icon" href="data:," />
+    <link rel="stylesheet" href="/src/app.css" />
+  </head>
+  <body>
+    <div id="root"></div>
+    <script type="module" src="/src/main.tsx"></script>
+  </body>
+</html>

package/templates/default/migrations/0000_init.sql

@@ -0,0 +1,9 @@
+CREATE TABLE "todos" (
+	"id" text PRIMARY KEY NOT NULL,
+	"scope" text DEFAULT 'default' NOT NULL,
+	"title" text NOT NULL,
+	"done" boolean DEFAULT false NOT NULL,
+	"created_at" timestamp with time zone DEFAULT now() NOT NULL
+);
+--> statement-breakpoint
+CREATE INDEX "todos_scope_created_at_idx" ON "todos" USING btree ("scope","created_at");