@pylonsync/create-pylon 0.11.0 → 0.11.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pylonsync/create-pylon",
-  "version": "0.11.0",
+  "version": "0.11.1",
   "description": "Scaffold a new Pylon app — realtime backend + web/mobile/expo frontends in one command. Run via `npm create @pylonsync/pylon@latest`.",
   "publishConfig": {
     "access": "public"

package/templates/_root/AGENTS.md

@@ -75,9 +75,39 @@ this pass before the user has to ask.
 | Call a function | `pylon fn <name> key=value` |
 | Health snapshot | `pylon status` |
 | Build for prod | `pylon build` |
+| Wire in Stack0 Analytics or Feedback | `pylon add analytics --site-key <KEY>` \| `pylon add feedback` |
 | Deploy (Pylon Cloud by default) | `pylon deploy` |
 | Look up an error code | `pylon explain <CODE>` |
 
 `--json` works on every command for machine-readable output. Prefer one-shot/agent-safe flags (`pylon logs --limit N`, not a blocking `--follow`).
 
+## Stack0 Analytics and Feedback
+
+Neither is a package you install. Both are hosted apps you point at over HTTP, and neither is wired into this template — run `pylon add` when the product needs one.
+
+**Analytics** — `pylon add analytics --site-key <KEY>`. Do NOT hand-write this: the relay is boilerplate whose every mistake is silent.
+
+- The relay is a FUNCTION, not a route. `/api/fn/*` is Pylon's own namespace, so `app/api/fn/ingestEvent/route.ts` is never matched, and there is no `next.config.js` here to rewrite in. Copying the Next.js recipe gets you a file that is never called.
+- It must be an `action` (only actions get `ctx.request`) and it must forward `ctx.request.rawBody`, not `args` — the beacon carries fields the arg list does not declare.
+- Skipping the relay and pointing the tag straight at the Analytics host does not error either: its CORS allowlist refuses the browser's preflight, which looks exactly like nobody visiting the site.
+- `stack0Analytics()` is a browser global and Pylon renders on the server. Call it from an event handler or effect, never during a render.
+
+**Feedback** — one tag in `app/layout.tsx`; `pylon add feedback` prints it. Reading a public board takes no credential (`POST /api/fn/portalView { slug }`); writing on someone's behalf takes a guest session (`POST /api/auth/guest`, then a bearer token), not an API key. There is no API key and no MCP server in Feedback.
+
+Full API for both: https://www.stack0.dev/docs/sdk/analytics and /docs/sdk/feedback
+
+## Declare the env you cannot run without
+
+`requiredEnv` in `buildManifest({...})` makes `pylon deploy` refuse to ship when the project is missing a secret:
+
+```ts
+import { requireEnv } from "@pylonsync/sdk";
+
+requiredEnv: [
+  requireEnv("SITE_URL", "this app's public origin; baked into every absolute link it serves"),
+],
+```
+
+Declare the variables whose absence is SILENT — a public origin, a webhook secret, an API base URL. A missing database URL crashes on the first query and someone notices in a minute. A missing public origin gets baked into a script tag, served to a customer's website, and errors nowhere.
+
 For full signatures, env vars, the complete CLI, and SSR/client/server-primitive details: **https://docs.pylonsync.com/llms-full.txt**.

package/templates/expo/mobile/apps/expo/README.md

@@ -13,7 +13,7 @@ app/(tabs)/index           the Notes list (free cap enforced server-side)
 app/(tabs)/settings        account, subscription, legal, delete account
 src/session.tsx            boot + state machine
 src/purchases.ts           RevenueCat wrapper, safe in Expo Go
-src/entitlements.ts        usePro() from the synced RcEntitlement rows
+src/entitlements.ts        usePro() from the synced rows of either store
 src/analytics.ts           funnel events; wire to your SDK in one place
 src/links.ts               privacy / terms / support URLs, served by apps/api
 STORE.md                   the submission checklist

package/templates/expo/mobile/apps/expo/package.json

@@ -1,56 +1,57 @@
 {
-  "name": "@__APP_NAME_KEBAB__/expo",
-  "version": "1.0.0",
-  "private": true,
-  "main": "expo-router/entry",
-  "scripts": {
-    "start": "expo start",
-    "dev": "expo start",
-    "ios": "expo run:ios",
-    "android": "expo run:android",
-    "web": "expo start --web",
-    "check": "tsc --noEmit",
-    "build:dev": "eas build --profile development --platform ios",
-    "build:preview": "eas build --profile preview --platform all",
-    "build:prod": "eas build --profile production --platform all",
-    "submit:ios": "eas submit --platform ios --latest",
-    "submit:android": "eas submit --platform android --latest",
-    "check:bundle": "expo export --platform ios --platform android --output-dir .expo-export"
-  },
-  "dependencies": {
-    "@pylonsync/react": "^__PYLON_VERSION__",
-    "@pylonsync/react-native": "^__PYLON_VERSION__",
-    "@pylonsync/revenuecat": "^__PYLON_VERSION__",
-    "@pylonsync/sdk": "^__PYLON_VERSION__",
-    "@pylonsync/sync": "^__PYLON_VERSION__",
-    "@react-native-async-storage/async-storage": "2.2.0",
-    "@react-native-community/netinfo": "12.0.1",
-    "@react-native-google-signin/google-signin": "^16.1.5",
-    "expo": "~57.0.20",
-    "expo-apple-authentication": "~57.0.1",
-    "expo-build-properties": "~57.0.17",
-    "expo-constants": "~57.0.17",
-    "expo-haptics": "~57.0.2",
-    "expo-linking": "~57.0.9",
-    "expo-router": "~57.0.19",
-    "expo-splash-screen": "~57.0.8",
-    "expo-status-bar": "~57.0.1",
-    "expo-web-browser": "~57.0.2",
-    "react": "19.2.3",
-    "react-dom": "19.2.3",
-    "react-native": "0.86.3",
-    "react-native-gesture-handler": "~2.32.0",
-    "react-native-purchases": "^10.9.0",
-    "react-native-reanimated": "4.5.1",
-    "react-native-safe-area-context": "~5.7.0",
-    "react-native-screens": "~4.26.0",
-    "react-native-web": "~0.21.0",
-    "react-native-worklets": "0.10.1"
-  },
-  "devDependencies": {
-    "@babel/core": "^7.29.0",
-    "@types/react": "~19.2.4",
-    "babel-preset-expo": "~57.0.10",
-    "typescript": "~6.0.3"
-  }
+	"name": "@__APP_NAME_KEBAB__/expo",
+	"version": "1.0.0",
+	"private": true,
+	"main": "expo-router/entry",
+	"scripts": {
+		"start": "expo start",
+		"dev": "expo start",
+		"ios": "expo run:ios",
+		"android": "expo run:android",
+		"web": "expo start --web",
+		"check": "tsc --noEmit",
+		"build:dev": "eas build --profile development --platform ios",
+		"build:preview": "eas build --profile preview --platform all",
+		"build:prod": "eas build --profile production --platform all",
+		"submit:ios": "eas submit --platform ios --latest",
+		"submit:android": "eas submit --platform android --latest",
+		"check:bundle": "expo export --platform ios --platform android --output-dir .expo-export"
+	},
+	"dependencies": {
+		"@pylonsync/react": "^__PYLON_VERSION__",
+		"@pylonsync/react-native": "^__PYLON_VERSION__",
+		"@pylonsync/revenuecat": "^__PYLON_VERSION__",
+		"@pylonsync/sdk": "^__PYLON_VERSION__",
+		"@pylonsync/stripe": "^__PYLON_VERSION__",
+		"@pylonsync/sync": "^__PYLON_VERSION__",
+		"@react-native-async-storage/async-storage": "2.2.0",
+		"@react-native-community/netinfo": "12.0.1",
+		"@react-native-google-signin/google-signin": "^16.1.5",
+		"expo": "~57.0.20",
+		"expo-apple-authentication": "~57.0.1",
+		"expo-build-properties": "~57.0.17",
+		"expo-constants": "~57.0.17",
+		"expo-haptics": "~57.0.2",
+		"expo-linking": "~57.0.9",
+		"expo-router": "~57.0.19",
+		"expo-splash-screen": "~57.0.8",
+		"expo-status-bar": "~57.0.1",
+		"expo-web-browser": "~57.0.2",
+		"react": "19.2.3",
+		"react-dom": "19.2.3",
+		"react-native": "0.86.3",
+		"react-native-gesture-handler": "~2.32.0",
+		"react-native-purchases": "^10.9.0",
+		"react-native-reanimated": "4.5.1",
+		"react-native-safe-area-context": "~5.7.0",
+		"react-native-screens": "~4.26.0",
+		"react-native-web": "~0.21.0",
+		"react-native-worklets": "0.10.1"
+	},
+	"devDependencies": {
+		"@babel/core": "^7.29.0",
+		"@types/react": "~19.2.4",
+		"babel-preset-expo": "~57.0.10",
+		"typescript": "~6.0.3"
+	}
 }

package/templates/expo/mobile/apps/expo/src/entitlements.ts

@@ -1,16 +1,34 @@
 import { db } from "@pylonsync/react-native";
 import { hasEntitlement, type RcEntitlementRow } from "@pylonsync/revenuecat/client";
+import {
+  hasStripeSubscription,
+  type StripeSubscriptionRow,
+} from "@pylonsync/stripe/entitlement";
 
 export const PRO = "pro";
 
 /**
- * Live Pro status from the synced RcEntitlement rows. Updates the moment
- * the server writes the row after a purchase, on every device.
+ * Live Pro status, from whichever store the subscriber actually paid.
  *
- * `@pylonsync/revenuecat/client` is the browser/React Native entry of the
- * plugin. The package root is server code and must not be imported here.
+ * Both are read, because a subscriber has exactly one of them: a purchase in
+ * the App Store or Play Store arrives as an RcEntitlement row, and one made
+ * on the website arrives as a StripeSubscription row. Reading only the first
+ * is how someone subscribes on the web and finds the app still locked — and
+ * cross-platform access is the reason to run both in the first place.
+ *
+ * An app using only one of the two plugins simply has no rows of the other
+ * kind, and the query costs nothing.
+ *
+ * Both plugin entry points here are the browser/React Native ones. The
+ * package roots are server code and must not be imported from the app.
  */
 export function usePro(): { pro: boolean; loading: boolean } {
-  const { data, loading } = db.useQuery<RcEntitlementRow>("RcEntitlement", {});
-  return { pro: hasEntitlement(data ?? [], PRO), loading };
+  const rc = db.useQuery<RcEntitlementRow>("RcEntitlement", {});
+  const stripe = db.useQuery<StripeSubscriptionRow>("StripeSubscription", {});
+
+  // Access as soon as either source says so; still loading only while both
+  // are outstanding, so a subscriber is not shown a paywall mid-boot.
+  const pro =
+    hasEntitlement(rc.data ?? [], PRO) || hasStripeSubscription(stripe.data ?? []);
+  return { pro, loading: rc.loading && stripe.loading };
 }

package/templates/agency/app/not-found.tsx

@@ -1,44 +0,0 @@
-import React from "react";
-import { Link, type NotFoundProps } from "@pylonsync/react";
-import { Button } from "@/components/ui/button";
-
-// `app/not-found.tsx` → rendered at HTTP 404 for any unmatched URL, and when a
-// page calls `response.notFound()`.
-//
-// Give it real links. This boundary is also what an agent reads when it guesses
-// a URL wrong: a markdown request for a missing page renders THIS file as
-// markdown at 404, so the links below are how it finds its way back.
-export default function NotFound(_props: NotFoundProps) {
-  return (
-    <div className="mx-auto flex min-h-[60vh] max-w-lg flex-col justify-center gap-6 px-4">
-      <section>
-        <h1 className="text-2xl font-semibold tracking-tight">Page not found</h1>
-        <p className="mt-2 text-muted-foreground">
-          That URL does not exist. Try one of these:
-        </p>
-      </section>
-      <ul className="space-y-2 text-sm">
-        <li>
-          <Link className="underline underline-offset-4" href="/">
-            Home
-          </Link>
-        </li>
-        <li>
-          <a className="underline underline-offset-4" href="/sitemap.xml">
-            Sitemap
-          </a>
-        </li>
-        <li>
-          <a className="underline underline-offset-4" href="/llms.txt">
-            llms.txt
-          </a>
-        </li>
-      </ul>
-      <div>
-        <Button asChild>
-          <Link href="/">Back to home</Link>
-        </Button>
-      </div>
-    </div>
-  );
-}

package/templates/ai-chat/app/not-found.tsx

@@ -1,44 +0,0 @@
-import React from "react";
-import { Link, type NotFoundProps } from "@pylonsync/react";
-import { Button } from "@/components/ui/button";
-
-// `app/not-found.tsx` → rendered at HTTP 404 for any unmatched URL, and when a
-// page calls `response.notFound()`.
-//
-// Give it real links. This boundary is also what an agent reads when it guesses
-// a URL wrong: a markdown request for a missing page renders THIS file as
-// markdown at 404, so the links below are how it finds its way back.
-export default function NotFound(_props: NotFoundProps) {
-  return (
-    <div className="mx-auto flex min-h-[60vh] max-w-lg flex-col justify-center gap-6 px-4">
-      <section>
-        <h1 className="text-2xl font-semibold tracking-tight">Page not found</h1>
-        <p className="mt-2 text-muted-foreground">
-          That URL does not exist. Try one of these:
-        </p>
-      </section>
-      <ul className="space-y-2 text-sm">
-        <li>
-          <Link className="underline underline-offset-4" href="/">
-            Home
-          </Link>
-        </li>
-        <li>
-          <a className="underline underline-offset-4" href="/sitemap.xml">
-            Sitemap
-          </a>
-        </li>
-        <li>
-          <a className="underline underline-offset-4" href="/llms.txt">
-            llms.txt
-          </a>
-        </li>
-      </ul>
-      <div>
-        <Button asChild>
-          <Link href="/">Back to home</Link>
-        </Button>
-      </div>
-    </div>
-  );
-}

package/templates/ai-studio/app/not-found.tsx

@@ -1,44 +0,0 @@
-import React from "react";
-import { Link, type NotFoundProps } from "@pylonsync/react";
-import { Button } from "@/components/ui/button";
-
-// `app/not-found.tsx` → rendered at HTTP 404 for any unmatched URL, and when a
-// page calls `response.notFound()`.
-//
-// Give it real links. This boundary is also what an agent reads when it guesses
-// a URL wrong: a markdown request for a missing page renders THIS file as
-// markdown at 404, so the links below are how it finds its way back.
-export default function NotFound(_props: NotFoundProps) {
-  return (
-    <div className="mx-auto flex min-h-[60vh] max-w-lg flex-col justify-center gap-6 px-4">
-      <section>
-        <h1 className="text-2xl font-semibold tracking-tight">Page not found</h1>
-        <p className="mt-2 text-muted-foreground">
-          That URL does not exist. Try one of these:
-        </p>
-      </section>
-      <ul className="space-y-2 text-sm">
-        <li>
-          <Link className="underline underline-offset-4" href="/">
-            Home
-          </Link>
-        </li>
-        <li>
-          <a className="underline underline-offset-4" href="/sitemap.xml">
-            Sitemap
-          </a>
-        </li>
-        <li>
-          <a className="underline underline-offset-4" href="/llms.txt">
-            llms.txt
-          </a>
-        </li>
-      </ul>
-      <div>
-        <Button asChild>
-          <Link href="/">Back to home</Link>
-        </Button>
-      </div>
-    </div>
-  );
-}

package/templates/creator/app/not-found.tsx

@@ -1,44 +0,0 @@
-import React from "react";
-import { Link, type NotFoundProps } from "@pylonsync/react";
-import { Button } from "@/components/ui/button";
-
-// `app/not-found.tsx` → rendered at HTTP 404 for any unmatched URL, and when a
-// page calls `response.notFound()`.
-//
-// Give it real links. This boundary is also what an agent reads when it guesses
-// a URL wrong: a markdown request for a missing page renders THIS file as
-// markdown at 404, so the links below are how it finds its way back.
-export default function NotFound(_props: NotFoundProps) {
-  return (
-    <div className="mx-auto flex min-h-[60vh] max-w-lg flex-col justify-center gap-6 px-4">
-      <section>
-        <h1 className="text-2xl font-semibold tracking-tight">Page not found</h1>
-        <p className="mt-2 text-muted-foreground">
-          That URL does not exist. Try one of these:
-        </p>
-      </section>
-      <ul className="space-y-2 text-sm">
-        <li>
-          <Link className="underline underline-offset-4" href="/">
-            Home
-          </Link>
-        </li>
-        <li>
-          <a className="underline underline-offset-4" href="/sitemap.xml">
-            Sitemap
-          </a>
-        </li>
-        <li>
-          <a className="underline underline-offset-4" href="/llms.txt">
-            llms.txt
-          </a>
-        </li>
-      </ul>
-      <div>
-        <Button asChild>
-          <Link href="/">Back to home</Link>
-        </Button>
-      </div>
-    </div>
-  );
-}

package/templates/directory/app/not-found.tsx

@@ -1,44 +0,0 @@
-import React from "react";
-import { Link, type NotFoundProps } from "@pylonsync/react";
-import { Button } from "@/components/ui/button";
-
-// `app/not-found.tsx` → rendered at HTTP 404 for any unmatched URL, and when a
-// page calls `response.notFound()`.
-//
-// Give it real links. This boundary is also what an agent reads when it guesses
-// a URL wrong: a markdown request for a missing page renders THIS file as
-// markdown at 404, so the links below are how it finds its way back.
-export default function NotFound(_props: NotFoundProps) {
-  return (
-    <div className="mx-auto flex min-h-[60vh] max-w-lg flex-col justify-center gap-6 px-4">
-      <section>
-        <h1 className="text-2xl font-semibold tracking-tight">Page not found</h1>
-        <p className="mt-2 text-muted-foreground">
-          That URL does not exist. Try one of these:
-        </p>
-      </section>
-      <ul className="space-y-2 text-sm">
-        <li>
-          <Link className="underline underline-offset-4" href="/">
-            Home
-          </Link>
-        </li>
-        <li>
-          <a className="underline underline-offset-4" href="/sitemap.xml">
-            Sitemap
-          </a>
-        </li>
-        <li>
-          <a className="underline underline-offset-4" href="/llms.txt">
-            llms.txt
-          </a>
-        </li>
-      </ul>
-      <div>
-        <Button asChild>
-          <Link href="/">Back to home</Link>
-        </Button>
-      </div>
-    </div>
-  );
-}

package/templates/local-service/app/not-found.tsx

@@ -1,44 +0,0 @@
-import React from "react";
-import { Link, type NotFoundProps } from "@pylonsync/react";
-import { Button } from "@/components/ui/button";
-
-// `app/not-found.tsx` → rendered at HTTP 404 for any unmatched URL, and when a
-// page calls `response.notFound()`.
-//
-// Give it real links. This boundary is also what an agent reads when it guesses
-// a URL wrong: a markdown request for a missing page renders THIS file as
-// markdown at 404, so the links below are how it finds its way back.
-export default function NotFound(_props: NotFoundProps) {
-  return (
-    <div className="mx-auto flex min-h-[60vh] max-w-lg flex-col justify-center gap-6 px-4">
-      <section>
-        <h1 className="text-2xl font-semibold tracking-tight">Page not found</h1>
-        <p className="mt-2 text-muted-foreground">
-          That URL does not exist. Try one of these:
-        </p>
-      </section>
-      <ul className="space-y-2 text-sm">
-        <li>
-          <Link className="underline underline-offset-4" href="/">
-            Home
-          </Link>
-        </li>
-        <li>
-          <a className="underline underline-offset-4" href="/sitemap.xml">
-            Sitemap
-          </a>
-        </li>
-        <li>
-          <a className="underline underline-offset-4" href="/llms.txt">
-            llms.txt
-          </a>
-        </li>
-      </ul>
-      <div>
-        <Button asChild>
-          <Link href="/">Back to home</Link>
-        </Button>
-      </div>
-    </div>
-  );
-}

package/templates/restaurant/app/not-found.tsx

@@ -1,44 +0,0 @@
-import React from "react";
-import { Link, type NotFoundProps } from "@pylonsync/react";
-import { Button } from "@/components/ui/button";
-
-// `app/not-found.tsx` → rendered at HTTP 404 for any unmatched URL, and when a
-// page calls `response.notFound()`.
-//
-// Give it real links. This boundary is also what an agent reads when it guesses
-// a URL wrong: a markdown request for a missing page renders THIS file as
-// markdown at 404, so the links below are how it finds its way back.
-export default function NotFound(_props: NotFoundProps) {
-  return (
-    <div className="mx-auto flex min-h-[60vh] max-w-lg flex-col justify-center gap-6 px-4">
-      <section>
-        <h1 className="text-2xl font-semibold tracking-tight">Page not found</h1>
-        <p className="mt-2 text-muted-foreground">
-          That URL does not exist. Try one of these:
-        </p>
-      </section>
-      <ul className="space-y-2 text-sm">
-        <li>
-          <Link className="underline underline-offset-4" href="/">
-            Home
-          </Link>
-        </li>
-        <li>
-          <a className="underline underline-offset-4" href="/sitemap.xml">
-            Sitemap
-          </a>
-        </li>
-        <li>
-          <a className="underline underline-offset-4" href="/llms.txt">
-            llms.txt
-          </a>
-        </li>
-      </ul>
-      <div>
-        <Button asChild>
-          <Link href="/">Back to home</Link>
-        </Button>
-      </div>
-    </div>
-  );
-}

package/templates/shop/app/not-found.tsx

@@ -1,44 +0,0 @@
-import React from "react";
-import { Link, type NotFoundProps } from "@pylonsync/react";
-import { Button } from "@/components/ui/button";
-
-// `app/not-found.tsx` → rendered at HTTP 404 for any unmatched URL, and when a
-// page calls `response.notFound()`.
-//
-// Give it real links. This boundary is also what an agent reads when it guesses
-// a URL wrong: a markdown request for a missing page renders THIS file as
-// markdown at 404, so the links below are how it finds its way back.
-export default function NotFound(_props: NotFoundProps) {
-  return (
-    <div className="mx-auto flex min-h-[60vh] max-w-lg flex-col justify-center gap-6 px-4">
-      <section>
-        <h1 className="text-2xl font-semibold tracking-tight">Page not found</h1>
-        <p className="mt-2 text-muted-foreground">
-          That URL does not exist. Try one of these:
-        </p>
-      </section>
-      <ul className="space-y-2 text-sm">
-        <li>
-          <Link className="underline underline-offset-4" href="/">
-            Home
-          </Link>
-        </li>
-        <li>
-          <a className="underline underline-offset-4" href="/sitemap.xml">
-            Sitemap
-          </a>
-        </li>
-        <li>
-          <a className="underline underline-offset-4" href="/llms.txt">
-            llms.txt
-          </a>
-        </li>
-      </ul>
-      <div>
-        <Button asChild>
-          <Link href="/">Back to home</Link>
-        </Button>
-      </div>
-    </div>
-  );
-}

package/templates/waitlist/app/not-found.tsx

@@ -1,44 +0,0 @@
-import React from "react";
-import { Link, type NotFoundProps } from "@pylonsync/react";
-import { Button } from "@/components/ui/button";
-
-// `app/not-found.tsx` → rendered at HTTP 404 for any unmatched URL, and when a
-// page calls `response.notFound()`.
-//
-// Give it real links. This boundary is also what an agent reads when it guesses
-// a URL wrong: a markdown request for a missing page renders THIS file as
-// markdown at 404, so the links below are how it finds its way back.
-export default function NotFound(_props: NotFoundProps) {
-  return (
-    <div className="mx-auto flex min-h-[60vh] max-w-lg flex-col justify-center gap-6 px-4">
-      <section>
-        <h1 className="text-2xl font-semibold tracking-tight">Page not found</h1>
-        <p className="mt-2 text-muted-foreground">
-          That URL does not exist. Try one of these:
-        </p>
-      </section>
-      <ul className="space-y-2 text-sm">
-        <li>
-          <Link className="underline underline-offset-4" href="/">
-            Home
-          </Link>
-        </li>
-        <li>
-          <a className="underline underline-offset-4" href="/sitemap.xml">
-            Sitemap
-          </a>
-        </li>
-        <li>
-          <a className="underline underline-offset-4" href="/llms.txt">
-            llms.txt
-          </a>
-        </li>
-      </ul>
-      <div>
-        <Button asChild>
-          <Link href="/">Back to home</Link>
-        </Button>
-      </div>
-    </div>
-  );
-}