@pylonsync/create-pylon 0.19.0 → 0.20.0

package/templates/backend/consumer/apps/api/functions/createPost.ts

@@ -1,48 +1,31 @@
 import { mutation, v } from "@pylonsync/functions";
+import { CAPTION_MAX, isImageUrl, requireProfile } from "../lib/social";
 
 /**
- * Post something. Resolves the caller's Profile, then writes a Post
- * with `authorId = profile.id`. Returns the inserted row + author
- * card so the client can render it without a follow-up read.
+ * Publish a photo. The client uploads the file first (`/api/files/init`
+ * with visibility "public", so every viewer can load it) and sends the
+ * file URL here with the caption.
  */
 export default mutation({
-	args: { body: v.string() },
-	async handler(ctx, args: { body: string }) {
-		if (!ctx.auth.userId) {
-			throw ctx.error("UNAUTHENTICATED", "log in first");
+	args: { imageUrl: v.string(), caption: v.optional(v.string()) },
+	async handler(ctx, args: { imageUrl: string; caption?: string }) {
+		const profile = await requireProfile(ctx, ctx.auth.userId);
+		const imageUrl = args.imageUrl.trim();
+		if (!isImageUrl(imageUrl)) {
+			throw ctx.error("INVALID_IMAGE", "Upload the photo again.");
 		}
-		const body = args.body.trim();
-		if (!body) throw ctx.error("EMPTY_BODY", "post body cannot be empty");
-		if (body.length > 1000) {
-			throw ctx.error("TOO_LONG", "post body capped at 1000 chars");
+		const caption = (args.caption ?? "").trim();
+		if (caption.length > CAPTION_MAX) {
+			throw ctx.error("CAPTION_TOO_LONG", `Use at most ${CAPTION_MAX} characters.`);
 		}
-		const profiles = (await ctx.db.query("Profile", {
-			userId: ctx.auth.userId,
-		})) as any[];
-		if (profiles.length === 0) {
-			throw ctx.error(
-				"NO_PROFILE",
-				"create a profile first via upsertProfile",
-			);
-		}
-		const profile = profiles[0];
-		const id = await ctx.db.insert("Post", {
+		// The Post policy refuses client writes. This function is the checked
+		// write path, so it writes past the policy.
+		const id = await ctx.db.unsafe.insert("Post", {
 			authorId: profile.id,
-			body,
+			imageUrl,
+			caption: caption || null,
 			createdAt: new Date().toISOString(),
 		});
-		const post = (await ctx.db.get("Post", id)) as any;
-		return {
-			id: post.id,
-			body: post.body,
-			createdAt: post.createdAt,
-			author: {
-				id: profile.id,
-				handle: profile.handle,
-				displayName: profile.displayName,
-			},
-			likeCount: 0,
-			likedByMe: false,
-		};
+		return { id };
 	},
 });

package/templates/backend/consumer/apps/api/functions/deletePost.ts

@@ -1,21 +1,23 @@
 import { mutation, v } from "@pylonsync/functions";
+import { requireProfile } from "../lib/social";
 
-/**
- * Delete a Post and any associated Likes. Post policy already gates
- * deletes to the author's Profile, so a non-author can't reach the
- * actual delete call — but we double-check so a future policy
- * loosening doesn't accidentally orphan Like rows.
- */
+/** Delete one of the caller's posts with its likes and comments. */
 export default mutation({
 	args: { id: v.id("Post") },
 	async handler(ctx, args: { id: string }) {
-		const snapshot = (await ctx.db.get("Post", args.id)) as any;
-		if (!snapshot) throw ctx.error("NOT_FOUND", "post not found");
-		const likes = (await ctx.db.query("Like", { postId: args.id })) as any[];
-		for (const like of likes) {
-			await ctx.db.delete("Like", like.id);
+		const profile = await requireProfile(ctx, ctx.auth.userId);
+		const post = await ctx.db.get("Post", args.id);
+		if (!post) throw ctx.error("NOT_FOUND", "This post no longer exists.");
+		if (post.authorId !== profile.id) {
+			throw ctx.error("FORBIDDEN", "You can only delete your own posts.");
 		}
-		await ctx.db.delete("Post", args.id);
-		return snapshot;
+		for (const like of await ctx.db.query("Like", { postId: args.id })) {
+			await ctx.db.unsafe.delete("Like", String(like.id));
+		}
+		for (const comment of await ctx.db.query("Comment", { postId: args.id })) {
+			await ctx.db.unsafe.delete("Comment", String(comment.id));
+		}
+		await ctx.db.unsafe.delete("Post", args.id);
+		return { id: args.id };
 	},
 });

package/templates/backend/consumer/apps/api/functions/myProfile.ts

@@ -1,17 +1,14 @@
 import { query } from "@pylonsync/functions";
+import { findProfile } from "../lib/social";
 
 /**
- * Resolve the caller's own Profile (or null if they haven't created
- * one yet). Used by the client to decide whether to show the
- * profile-setup screen on first launch.
+ * The caller's Profile, or null when they have not made one yet. The
+ * clients call this after sign-in to decide between the profile setup
+ * screen and the feed.
  */
 export default query({
 	args: {},
 	async handler(ctx) {
-		if (!ctx.auth.userId) return null;
-		const rows = (await ctx.db.query("Profile", {
-			userId: ctx.auth.userId,
-		})) as any[];
-		return rows[0] ?? null;
+		return await findProfile(ctx, ctx.auth.userId);
 	},
 });

package/templates/backend/consumer/apps/api/functions/seedDemo.ts

@@ -0,0 +1,95 @@
+import { mutation } from "@pylonsync/functions";
+import {
+	SEED_COMMENTS,
+	SEED_PEOPLE,
+	SEED_POSTS,
+	photoPath,
+	seedFollows,
+	seedLikers,
+} from "../lib/seed";
+
+/**
+ * Write the demo people, posts, likes, comments, and follows once. The
+ * clients call this on launch. It returns at once when the demo data
+ * exists, and a lock keeps two first launches from seeding twice.
+ *
+ * Public so the first launch can seed before anyone signs in. It writes
+ * only the fixed data in lib/seed.ts. When you launch, delete this function,
+ * lib/seed.ts, public/images, the reserved-handle check in upsertProfile.ts,
+ * and the client calls to `seedDemo`.
+ */
+export default mutation<Record<string, never>, { seeded: boolean }>({
+	auth: "public",
+	args: {},
+	async handler(ctx) {
+		// The first demo account's email marks a seeded database. Check before
+		// the lock so launches after the first skip it, then again under it.
+		const marker = { email: `${SEED_PEOPLE[0].handle}@demo.invalid`, $limit: 1 };
+		if ((await ctx.db.unsafe.query("User", marker)).length > 0) return { seeded: false };
+		await ctx.db.advisoryLock("consumer_seed_demo");
+		if ((await ctx.db.unsafe.query("User", marker)).length > 0) return { seeded: false };
+
+		const now = Date.now();
+		const hoursAgo = (h: number) => new Date(now - h * 3_600_000).toISOString();
+
+		const profileIds = new Map<string, string>();
+		for (const person of SEED_PEOPLE) {
+			// A demo account has no password, so nobody can sign in as it.
+			const userId = await ctx.db.unsafe.insert("User", {
+				email: `${person.handle}@demo.invalid`,
+				displayName: person.displayName,
+				createdAt: hoursAgo(24 * 60),
+			});
+			const profileId = await ctx.db.unsafe.insert("Profile", {
+				userId,
+				handle: person.handle,
+				displayName: person.displayName,
+				bio: person.bio,
+				createdAt: hoursAgo(24 * 60),
+			});
+			profileIds.set(person.handle, profileId);
+		}
+
+		const postIds = new Map<string, string>();
+		const postAges = new Map<string, number>();
+		for (const post of SEED_POSTS) {
+			const id = await ctx.db.unsafe.insert("Post", {
+				authorId: profileIds.get(post.author),
+				imageUrl: photoPath(post.photo),
+				caption: post.caption,
+				createdAt: hoursAgo(post.age),
+			});
+			postIds.set(post.photo, id);
+			postAges.set(post.photo, post.age);
+			for (const [i, liker] of seedLikers(post.photo).entries()) {
+				if (liker === post.author) continue;
+				await ctx.db.unsafe.insert("Like", {
+					postId: id,
+					profileId: profileIds.get(liker),
+					createdAt: hoursAgo(Math.max(post.age - 0.2 * (i + 1), 0.05)),
+				});
+			}
+		}
+
+		for (const comment of SEED_COMMENTS) {
+			const postId = postIds.get(comment.photo);
+			const age = postAges.get(comment.photo);
+			if (!postId || age === undefined) continue;
+			await ctx.db.unsafe.insert("Comment", {
+				postId,
+				profileId: profileIds.get(comment.author),
+				text: comment.text,
+				createdAt: hoursAgo(Math.max(age - comment.after, 0.05)),
+			});
+		}
+
+		for (const [follower, following] of seedFollows()) {
+			await ctx.db.unsafe.insert("Follow", {
+				followerId: profileIds.get(follower),
+				followingId: profileIds.get(following),
+				createdAt: hoursAgo(24 * 30),
+			});
+		}
+		return { seeded: true };
+	},
+});

package/templates/backend/consumer/apps/api/functions/setFollow.ts

@@ -0,0 +1,36 @@
+import { mutation, v } from "@pylonsync/functions";
+import { requireProfile } from "../lib/social";
+
+/**
+ * Follow or unfollow a profile as the caller. Idempotent, like setLike.
+ */
+export default mutation({
+	args: { profileId: v.id("Profile"), following: v.boolean() },
+	async handler(ctx, args: { profileId: string; following: boolean }) {
+		const me = await requireProfile(ctx, ctx.auth.userId);
+		if (me.id === args.profileId) {
+			throw ctx.error("SELF_FOLLOW", "You cannot follow yourself.");
+		}
+		const target = await ctx.db.get("Profile", args.profileId);
+		if (!target) throw ctx.error("NOT_FOUND", "This profile no longer exists.");
+
+		await ctx.db.advisoryLock(`follow:${me.id}:${args.profileId}`);
+		const existing = await ctx.db.query("Follow", {
+			followerId: me.id,
+			followingId: args.profileId,
+		});
+		if (args.following && existing.length === 0) {
+			await ctx.db.unsafe.insert("Follow", {
+				followerId: me.id,
+				followingId: args.profileId,
+				createdAt: new Date().toISOString(),
+			});
+		}
+		if (!args.following) {
+			for (const row of existing) {
+				await ctx.db.unsafe.delete("Follow", String(row.id));
+			}
+		}
+		return { following: args.following };
+	},
+});

package/templates/backend/consumer/apps/api/functions/setLike.ts

@@ -0,0 +1,36 @@
+import { mutation, v } from "@pylonsync/functions";
+import { requireProfile } from "../lib/social";
+
+/**
+ * Like or unlike a post as the caller. Idempotent: `liked: true` twice
+ * leaves one like, so taps that reach the server out of order still end
+ * in the state of the last tap. Returns the post's like count.
+ */
+export default mutation({
+	args: { postId: v.id("Post"), liked: v.boolean() },
+	async handler(ctx, args: { postId: string; liked: boolean }) {
+		const profile = await requireProfile(ctx, ctx.auth.userId);
+		const post = await ctx.db.get("Post", args.postId);
+		if (!post) throw ctx.error("NOT_FOUND", "This post no longer exists.");
+
+		await ctx.db.advisoryLock(`like:${profile.id}:${args.postId}`);
+		const existing = await ctx.db.query("Like", {
+			postId: args.postId,
+			profileId: profile.id,
+		});
+		if (args.liked && existing.length === 0) {
+			await ctx.db.unsafe.insert("Like", {
+				postId: args.postId,
+				profileId: profile.id,
+				createdAt: new Date().toISOString(),
+			});
+		}
+		if (!args.liked) {
+			for (const like of existing) {
+				await ctx.db.unsafe.delete("Like", String(like.id));
+			}
+		}
+		const likes = await ctx.db.query("Like", { postId: args.postId });
+		return { liked: args.liked, likeCount: likes.length };
+	},
+});

package/templates/backend/consumer/apps/api/functions/upsertProfile.ts

@@ -1,70 +1,76 @@
 import { mutation, v } from "@pylonsync/functions";
+import { SEED_PEOPLE } from "../lib/seed";
+import { BIO_MAX, HANDLE_PATTERN, findProfile, isImageUrl } from "../lib/social";
 
 /**
- * Create-or-update the caller's Profile. Handle is unique (case-
- * insensitive); we lowercase + check before inserting. On update
- * we don't re-check the handle if it didn't change.
+ * Create or update the caller's Profile. Handles are lowercase and unique.
+ * `avatarUrl` is optional; an empty string clears it.
  */
 export default mutation({
 	args: {
 		handle: v.string(),
 		displayName: v.string(),
 		bio: v.string(),
+		avatarUrl: v.optional(v.string()),
 	},
 	async handler(
 		ctx,
-		args: { handle: string; displayName: string; bio: string },
+		args: { handle: string; displayName: string; bio: string; avatarUrl?: string },
 	) {
-		if (!ctx.auth.userId) {
-			throw ctx.error("UNAUTHENTICATED", "log in first");
-		}
+		const userId = ctx.auth.userId;
 		const handle = args.handle.trim().toLowerCase();
-		if (!/^[a-z0-9_]{2,20}$/.test(handle)) {
+		if (!HANDLE_PATTERN.test(handle)) {
 			throw ctx.error(
 				"INVALID_HANDLE",
-				"handle must be 2–20 chars: lowercase letters, digits, underscore",
+				"Use 2 to 24 characters: lowercase letters, digits, periods, and underscores.",
 			);
 		}
+		// The demo people in lib/seed.ts own these handles, even before the
+		// seed runs. Delete this check with lib/seed.ts.
+		if (SEED_PEOPLE.some((p) => p.handle === handle)) {
+			throw ctx.error("HANDLE_TAKEN", `@${handle} is taken.`);
+		}
 		const displayName = args.displayName.trim();
-		if (!displayName) {
-			throw ctx.error("EMPTY_NAME", "displayName cannot be empty");
+		if (!displayName) throw ctx.error("EMPTY_NAME", "Enter your name.");
+		if (displayName.length > 40) {
+			throw ctx.error("NAME_TOO_LONG", "Use at most 40 characters for your name.");
+		}
+		const bio = args.bio.trim();
+		if (bio.length > BIO_MAX) {
+			throw ctx.error("BIO_TOO_LONG", `Use at most ${BIO_MAX} characters for your bio.`);
+		}
+		const avatarUrl = args.avatarUrl?.trim();
+		if (avatarUrl && !isImageUrl(avatarUrl)) {
+			throw ctx.error("INVALID_IMAGE", "Upload the photo again.");
 		}
 
-		const existing = (await ctx.db.query("Profile", {
-			userId: ctx.auth.userId,
-		})) as any[];
+		// Two devices saving at once must not create two profiles.
+		await ctx.db.advisoryLock(`profile:${userId}`);
+		const existing = await findProfile(ctx, userId);
+		const [taken] = await ctx.db.query("Profile", { handle, $limit: 1 });
+		if (taken && taken.id !== existing?.id) {
+			throw ctx.error("HANDLE_TAKEN", `@${handle} is taken.`);
+		}
 
-		if (existing.length === 0) {
-			// New profile — handle must be unique
-			const dup = (await ctx.db.query("Profile", { handle })) as any[];
-			if (dup.length > 0) {
-				throw ctx.error("HANDLE_TAKEN", `@${handle} is taken`);
-			}
-			const id = await ctx.db.insert("Profile", {
-				userId: ctx.auth.userId,
+		// The Profile policy refuses client writes. This function is the
+		// checked write path, so it writes past the policy.
+		if (!existing) {
+			const id = await ctx.db.unsafe.insert("Profile", {
+				userId,
 				handle,
 				displayName,
-				bio: args.bio.trim() || null,
+				bio: bio || null,
+				avatarUrl: avatarUrl || null,
 				createdAt: new Date().toISOString(),
 			});
 			return await ctx.db.get("Profile", id);
 		}
-
-		const profile = existing[0];
-		// Update — re-check handle uniqueness only if changing
-		if (profile.handle !== handle) {
-			const dup = ((await ctx.db.query("Profile", { handle })) as any[]).filter(
-				(p) => p.id !== profile.id,
-			);
-			if (dup.length > 0) {
-				throw ctx.error("HANDLE_TAKEN", `@${handle} is taken`);
-			}
-		}
-		await ctx.db.update("Profile", profile.id, {
+		await ctx.db.unsafe.update("Profile", existing.id, {
 			handle,
 			displayName,
-			bio: args.bio.trim() || null,
+			bio: bio || null,
+			...(args.avatarUrl !== undefined ? { avatarUrl: avatarUrl || null } : {}),
 		});
-		return await ctx.db.get("Profile", profile.id);
+		return await ctx.db.get("Profile", existing.id);
 	},
 });

package/templates/backend/consumer/apps/api/lib/seed.ts

@@ -0,0 +1,89 @@
+// Demo data for a new app: eight people who post, follow each other, like,
+// and comment, so the first launch opens on a feed with content in it.
+//
+// Photos live in public/images/posts and the server serves them at
+// /images/posts/... Demo people have no avatar photo, so the clients draw
+// their initial. Demo accounts have no password, so nobody can sign in as
+// them. functions/seedDemo.ts writes this data once.
+
+export interface SeedPerson {
+	handle: string;
+	displayName: string;
+	bio: string;
+}
+
+export interface SeedPost {
+	/** File name under public/images/posts, without `.jpg`. */
+	photo: string;
+	author: string;
+	caption: string;
+	/** Hours before the seed runs. */
+	age: number;
+}
+
+export interface SeedComment {
+	photo: string;
+	author: string;
+	text: string;
+	/** Hours after the post. */
+	after: number;
+}
+
+export const SEED_PEOPLE: SeedPerson[] = [
+	{ handle: "maya.rivera", displayName: "Maya Rivera", bio: "Travel photographer. Currently in Lisbon." },
+	{ handle: "jordan.eats", displayName: "Jordan Brooks", bio: "Cooking at home, eating out, writing it all down." },
+	{ handle: "priya.home", displayName: "Priya Shah", bio: "Interior designer. Small rooms, good light." },
+	{ handle: "kenji.mori", displayName: "Kenji Mori", bio: "Architecture and night walks. Tokyo." },
+	{ handle: "elena.runs", displayName: "Elena Berg", bio: "Trail runner. Mountains most weekends." },
+	{ handle: "sam.and.juno", displayName: "Sam Whitaker", bio: "Juno is the golden one." },
+	{ handle: "amara.o", displayName: "Amara Okafor", bio: "Coffee, markets, and early mornings." },
+	{ handle: "leo.haddad", displayName: "Leo Haddad", bio: "Road trips and sunsets. Film when I can." },
+];
+
+export const SEED_POSTS: SeedPost[] = [
+	{ photo: "lisbon", author: "maya.rivera", caption: "Tram 28 at golden hour. Waited twenty minutes for this one and it was worth it.", age: 1.5 },
+	{ photo: "coffee", author: "amara.o", caption: "Flat white and a croissant before the market opens.", age: 3 },
+	{ photo: "dog", author: "sam.and.juno", caption: "Juno found the tall grass again.", age: 5 },
+	{ photo: "run", author: "elena.runs", caption: "Sunrise on the ridge. 18 km, 900 m up, legs gone.", age: 8 },
+	{ photo: "ramen", author: "jordan.eats", caption: "Tonkotsu from the new place on 5th. Broth cooked for 14 hours and you can tell.", age: 11 },
+	{ photo: "arch", author: "kenji.mori", caption: "Curves and shadows. The museum extension at noon.", age: 14 },
+	{ photo: "sunset", author: "leo.haddad", caption: "Big Sur, last light. 30 second exposure.", age: 20 },
+];
+
+export const SEED_COMMENTS: SeedComment[] = [
+	{ photo: "lisbon", author: "leo.haddad", text: "The light on those tiles. Which street is this?", after: 0.3 },
+	{ photo: "lisbon", author: "maya.rivera", text: "Rua da Conceição, just before it turns up to the cathedral.", after: 0.6 },
+	{ photo: "lisbon", author: "amara.o", text: "Adding this to the list for May.", after: 0.9 },
+	{ photo: "coffee", author: "jordan.eats", text: "That rosetta is perfect.", after: 0.5 },
+	{ photo: "coffee", author: "priya.home", text: "Where is this? I need that table.", after: 1 },
+	{ photo: "dog", author: "elena.runs", text: "Juno looks so happy.", after: 0.4 },
+	{ photo: "dog", author: "amara.o", text: "Best dog on this app.", after: 1.2 },
+	{ photo: "run", author: "kenji.mori", text: "Incredible view. How early did you start?", after: 1 },
+	{ photo: "run", author: "elena.runs", text: "Headlamps on at 4:30.", after: 1.5 },
+	{ photo: "ramen", author: "maya.rivera", text: "Going this week.", after: 2 },
+	{ photo: "arch", author: "priya.home", text: "Those shadows are unreal.", after: 1 },
+	{ photo: "sunset", author: "sam.and.juno", text: "Colors like this make me want to drive up the coast tonight.", after: 2 },
+];
+
+/** Which demo people like which photo. Deterministic, so every seed looks the same. */
+export function seedLikers(photo: string): string[] {
+	const people = SEED_PEOPLE.map((p) => p.handle);
+	let hash = 0;
+	for (const ch of photo) hash = (hash * 31 + ch.charCodeAt(0)) >>> 0;
+	return people.filter((_, i) => ((hash >> i) & 3) !== 0);
+}
+
+/** Everyone follows everyone else, except a few pairs. */
+export function seedFollows(): Array<[string, string]> {
+	const out: Array<[string, string]> = [];
+	for (const a of SEED_PEOPLE) {
+		for (const b of SEED_PEOPLE) {
+			if (a.handle === b.handle) continue;
+			if ((a.handle.length + b.handle.length) % 5 === 0) continue;
+			out.push([a.handle, b.handle]);
+		}
+	}
+	return out;
+}
+
+export const photoPath = (photo: string) => `/images/posts/${photo}.jpg`;

package/templates/backend/consumer/apps/api/lib/social.ts

@@ -0,0 +1,50 @@
+import type { MutationCtx, QueryCtx } from "@pylonsync/functions";
+
+// Shared checks for the functions in functions/.
+
+export const CAPTION_MAX = 2200;
+export const COMMENT_MAX = 500;
+export const BIO_MAX = 150;
+export const HANDLE_PATTERN = /^[a-z0-9._]{2,24}$/;
+
+/**
+ * A post or avatar image must be a demo photo served from public/images or
+ * a file uploaded to this server (`/api/files/<id>`). Anything else is
+ * refused, so a client cannot point the feed at an arbitrary host.
+ */
+export function isImageUrl(url: string): boolean {
+	if (url.includes("..") || url.includes("//")) return false;
+	return /^\/images\/[a-z0-9/_.-]+\.(jpg|jpeg|png|webp)$/i.test(url) ||
+		/^\/api\/files\/[A-Za-z0-9_.-]+$/.test(url);
+}
+
+/** The caller's Profile row, or null when they have not made one yet. */
+export async function findProfile(
+	ctx: Pick<QueryCtx, "db"> | Pick<MutationCtx, "db">,
+	userId: string,
+): Promise<ProfileRow | null> {
+	const rows = await ctx.db.query("Profile", { userId, $limit: 1 });
+	return (rows[0] as unknown as ProfileRow | undefined) ?? null;
+}
+
+/** The caller's Profile row. Throws NO_PROFILE when there is none. */
+export async function requireProfile(
+	ctx: Pick<MutationCtx, "db" | "error">,
+	userId: string,
+): Promise<ProfileRow> {
+	const profile = await findProfile(ctx, userId);
+	if (!profile) {
+		throw ctx.error("NO_PROFILE", "Create your profile first.");
+	}
+	return profile;
+}
+
+export interface ProfileRow {
+	id: string;
+	userId: string;
+	handle: string;
+	displayName: string;
+	bio?: string | null;
+	avatarUrl?: string | null;
+	createdAt: string;
+}

package/templates/backend/consumer/apps/api/package.json

@@ -6,15 +6,21 @@
   "scripts": {
     "dev": "pylon dev",
     "build": "pylon build",
+    "check": "tsc --noEmit",
     "schema:push": "pylon schema push --sqlite .pylon/dev.db",
     "schema:inspect": "pylon schema inspect --sqlite .pylon/dev.db"
   },
   "dependencies": {
     "@pylonsync/sdk": "^__PYLON_VERSION__",
-    "@pylonsync/functions": "^__PYLON_VERSION__"
+    "@pylonsync/functions": "^__PYLON_VERSION__",
+    "@pylonsync/react": "^__PYLON_VERSION__",
+    "react": "^19.0.0",
+    "react-dom": "^19.0.0"
   },
   "devDependencies": {
     "@pylonsync/cli": "^__PYLON_VERSION__",
-    "typescript": "^5.5.0"
+    "typescript": "^5.5.0",
+    "@types/react": "^19.0.0",
+    "@types/react-dom": "^19.0.0"
   }
 }

package/templates/backend/consumer/apps/api/tsconfig.json

@@ -7,7 +7,17 @@
     "skipLibCheck": true,
     "noEmit": true,
     "esModuleInterop": true,
-    "allowSyntheticDefaultImports": true
+    "allowSyntheticDefaultImports": true,
+    "jsx": "react",
+    "lib": [
+      "ES2022",
+      "DOM"
+    ]
   },
-  "include": ["schema.ts", "functions/**/*.ts"]
+  "include": [
+    "app.ts",
+    "app/**/*",
+    "functions/**/*",
+    "lib/**/*"
+  ]
 }