@pylonsync/create-pylon 0.3.267 → 0.3.269

package/templates/consumer/app.ts

@@ -0,0 +1,89 @@
+import {
+  entity,
+  field,
+  policy,
+  auth,
+  buildManifest,
+  discoverAppRoutes,
+} from "@pylonsync/sdk";
+
+// A post in the public feed. `authorId: field.owner()` stamps the signed-in
+// (guest) user's id server-side, so an optimistic `db.insert("Post", { text })`
+// can't forge authorship. The feed itself is public-read (everyone sees every
+// post) — that's intentional for a social feed, NOT the insecure wide-open
+// default; writes are still owner-only.
+const Post = entity(
+  "Post",
+  {
+    authorId: field.string().owner(),
+    text: field.string(),
+    createdAt: field.datetime().defaultNow(),
+  },
+  { indexes: [{ name: "by_created", fields: ["createdAt"], unique: false }] },
+);
+
+// A like is a join row (one per user per post). To toggle a like the client
+// inserts or deletes this row; the like count for a post is just how many
+// Like rows point at it. `userId: field.owner()` keeps a like attributable to
+// exactly one user.
+const Like = entity(
+  "Like",
+  {
+    userId: field.string().owner(),
+    postId: field.string(),
+    createdAt: field.datetime().defaultNow(),
+  },
+  {
+    indexes: [
+      { name: "by_post", fields: ["postId"], unique: false },
+      // One like per user per post — the unique index makes a double-like a
+      // no-op at the storage layer.
+      { name: "by_user_post", fields: ["userId", "postId"], unique: true },
+    ],
+  },
+);
+
+// Posts + likes are public-read so the feed and its counts render for
+// everyone; writes are gated to the owner. An entity with no policy is denied
+// to clients by default, so these allow-lists are what make the feed work.
+// `allowInsert` is `auth.userId != null`, not `== data.authorId`: the owner
+// field is stamped by field.owner() *after* the policy check, so it's null at
+// insert-time. The stamp still guarantees the new row is owned by the caller,
+// and read/update/delete enforce ownership on the persisted row.
+const postPolicy = policy({
+  name: "post_feed",
+  entity: "Post",
+  allowRead: "true",
+  allowInsert: "auth.userId != null",
+  allowUpdate: "auth.userId == data.authorId",
+  allowDelete: "auth.userId == data.authorId",
+});
+
+const likePolicy = policy({
+  name: "like_access",
+  entity: "Like",
+  allowRead: "true",
+  allowInsert: "auth.userId != null",
+  allowUpdate: "false",
+  allowDelete: "auth.userId == data.userId",
+});
+
+// `pylon dev` serves the SSR feed and the API from one port. Guest sessions
+// (via `<EnsureGuest>` on the page) let every visitor post + like with no
+// login. Natural next steps: a `Profile` entity (displayName/avatar keyed by
+// userId) to show names instead of ids, and a `Follow` join entity
+// (followerId/followedId) to scope the feed to people you follow.
+const manifest = buildManifest({
+  name: "__APP_NAME__",
+  version: "0.1.0",
+  entities: [Post, Like],
+  queries: [],
+  actions: [],
+  policies: [postPolicy, likePolicy],
+  auth: auth(),
+  routes: await discoverAppRoutes(),
+});
+
+console.log(JSON.stringify(manifest, null, 2));
+
+export default manifest;

package/templates/consumer/components/ui/button.tsx

@@ -0,0 +1,56 @@
+import * as React from "react";
+import { Slot } from "@radix-ui/react-slot";
+import { cva, type VariantProps } from "class-variance-authority";
+
+import { cn } from "@/lib/utils";
+
+const buttonVariants = cva(
+  "inline-flex items-center justify-center gap-2 whitespace-nowrap rounded-md text-sm font-medium transition-colors focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-ring focus-visible:ring-offset-2 disabled:pointer-events-none disabled:opacity-50 [&_svg]:pointer-events-none [&_svg]:size-4 [&_svg]:shrink-0",
+  {
+    variants: {
+      variant: {
+        default: "bg-primary text-primary-foreground hover:bg-primary/90",
+        destructive:
+          "bg-destructive text-white hover:bg-destructive/90",
+        outline:
+          "border border-input bg-background hover:bg-accent hover:text-accent-foreground",
+        secondary:
+          "bg-secondary text-secondary-foreground hover:bg-secondary/80",
+        ghost: "hover:bg-accent hover:text-accent-foreground",
+        link: "text-primary underline-offset-4 hover:underline",
+      },
+      size: {
+        default: "h-9 px-4 py-2",
+        sm: "h-8 rounded-md px-3 text-xs",
+        lg: "h-10 rounded-md px-8",
+        icon: "h-9 w-9",
+      },
+    },
+    defaultVariants: {
+      variant: "default",
+      size: "default",
+    },
+  },
+);
+
+export interface ButtonProps
+  extends React.ButtonHTMLAttributes<HTMLButtonElement>,
+    VariantProps<typeof buttonVariants> {
+  asChild?: boolean;
+}
+
+const Button = React.forwardRef<HTMLButtonElement, ButtonProps>(
+  ({ className, variant, size, asChild = false, ...props }, ref) => {
+    const Comp = asChild ? Slot : "button";
+    return (
+      <Comp
+        className={cn(buttonVariants({ variant, size, className }))}
+        ref={ref}
+        {...props}
+      />
+    );
+  },
+);
+Button.displayName = "Button";
+
+export { Button, buttonVariants };

package/templates/consumer/components/ui/card.tsx

@@ -0,0 +1,90 @@
+import * as React from "react";
+
+import { cn } from "@/lib/utils";
+
+function Card({ className, ...props }: React.HTMLAttributes<HTMLDivElement>) {
+  return (
+    <div
+      data-slot="card"
+      className={cn(
+        "rounded-xl border bg-card text-card-foreground shadow-sm",
+        className,
+      )}
+      {...props}
+    />
+  );
+}
+
+function CardHeader({
+  className,
+  ...props
+}: React.HTMLAttributes<HTMLDivElement>) {
+  return (
+    <div
+      data-slot="card-header"
+      className={cn("flex flex-col space-y-1.5 p-6", className)}
+      {...props}
+    />
+  );
+}
+
+function CardTitle({
+  className,
+  ...props
+}: React.HTMLAttributes<HTMLDivElement>) {
+  return (
+    <div
+      data-slot="card-title"
+      className={cn("font-semibold leading-none tracking-tight", className)}
+      {...props}
+    />
+  );
+}
+
+function CardDescription({
+  className,
+  ...props
+}: React.HTMLAttributes<HTMLDivElement>) {
+  return (
+    <div
+      data-slot="card-description"
+      className={cn("text-sm text-muted-foreground", className)}
+      {...props}
+    />
+  );
+}
+
+function CardContent({
+  className,
+  ...props
+}: React.HTMLAttributes<HTMLDivElement>) {
+  return (
+    <div
+      data-slot="card-content"
+      className={cn("p-6 pt-0", className)}
+      {...props}
+    />
+  );
+}
+
+function CardFooter({
+  className,
+  ...props
+}: React.HTMLAttributes<HTMLDivElement>) {
+  return (
+    <div
+      data-slot="card-footer"
+      className={cn("flex items-center p-6 pt-0", className)}
+      {...props}
+    />
+  );
+}
+
+export {
+  Card,
+  CardHeader,
+  CardFooter,
+  CardTitle,
+  CardDescription,
+  CardContent,
+};

package/templates/consumer/components.json

@@ -0,0 +1,20 @@
+{
+  "$schema": "https://ui.shadcn.com/schema.json",
+  "style": "new-york",
+  "rsc": false,
+  "tsx": true,
+  "tailwind": {
+    "config": "",
+    "css": "app/globals.css",
+    "baseColor": "zinc",
+    "cssVariables": true
+  },
+  "aliases": {
+    "components": "@/components",
+    "utils": "@/lib/utils",
+    "ui": "@/components/ui",
+    "lib": "@/lib",
+    "hooks": "@/hooks"
+  },
+  "iconLibrary": "lucide"
+}

package/templates/consumer/functions/_keep.ts

@@ -0,0 +1,13 @@
+// Server functions go here. Each file in this directory that exports a
+// query() or action() becomes a typed RPC endpoint, callable from your
+// pages and client with full type inference. Delete this placeholder when
+// you add your first one.
+//
+// Example (functions/notes.ts):
+//
+//   import { query } from "@pylonsync/functions";
+//
+//   export const listNotes = query(async (ctx) => {
+//     return ctx.db.list("Note");
+//   });
+export {};

package/templates/consumer/gitignore

@@ -0,0 +1,10 @@
+node_modules/
+.pylon/
+pylon.manifest.json
+pylon.client.ts
+web/dist/
+*.db
+*.db-*
+.env
+.env.local
+.DS_Store

package/templates/consumer/lib/utils.ts

@@ -0,0 +1,10 @@
+import { type ClassValue, clsx } from "clsx";
+import { twMerge } from "tailwind-merge";
+
+// `cn` — the shadcn class merger. clsx resolves conditional/array class
+// inputs; tailwind-merge then dedupes conflicting Tailwind utilities so
+// the last one wins (e.g. `cn("px-2", "px-4")` → "px-4"). Every shadcn
+// component routes its className through this.
+export function cn(...inputs: ClassValue[]) {
+  return twMerge(clsx(inputs));
+}

package/templates/consumer/package.json

@@ -0,0 +1,33 @@
+{
+  "name": "__APP_NAME_KEBAB__",
+  "version": "0.1.0",
+  "private": true,
+  "type": "module",
+  "scripts": {
+    "dev": "pylon dev",
+    "deploy": "pylon deploy",
+    "check": "tsc --noEmit"
+  },
+  "dependencies": {
+    "@pylonsync/react": "^__PYLON_VERSION__",
+    "@pylonsync/sdk": "^__PYLON_VERSION__",
+    "@pylonsync/functions": "^__PYLON_VERSION__",
+    "@pylonsync/client": "^__PYLON_VERSION__",
+    "react": "^19.0.0",
+    "react-dom": "^19.0.0",
+    "tailwindcss": "^4.3.0",
+    "@tailwindcss/cli": "^4.3.0",
+    "tw-animate-css": "^1.2.0",
+    "class-variance-authority": "^0.7.1",
+    "clsx": "^2.1.1",
+    "tailwind-merge": "^2.5.0",
+    "lucide-react": "^0.460.0",
+    "@radix-ui/react-slot": "^1.1.0"
+  },
+  "devDependencies": {
+    "@pylonsync/cli": "^__PYLON_VERSION__",
+    "@types/react": "^19.0.0",
+    "@types/react-dom": "^19.0.0",
+    "typescript": "^5.6.0"
+  }
+}

package/templates/consumer/tsconfig.json

@@ -0,0 +1,18 @@
+{
+  "compilerOptions": {
+    "target": "ES2022",
+    "module": "ESNext",
+    "moduleResolution": "bundler",
+    "jsx": "react",
+    "esModuleInterop": true,
+    "strict": true,
+    "skipLibCheck": true,
+    "lib": ["ES2022", "DOM"],
+    "types": ["react", "react-dom"],
+    "baseUrl": ".",
+    "paths": {
+      "@/*": ["./*"]
+    }
+  },
+  "include": ["app.ts", "app/**/*", "components/**/*", "lib/**/*"]
+}

package/templates/ssr/README.md

@@ -1,8 +1,10 @@
 # __APP_NAME__
 
-A full-stack [Pylon](https://pylonsync.com) app — a server-rendered homepage,
-email/password auth, and a live client dashboard over a synced database, all
-served from one binary on one port. No Next.js, no separate API server.
+A full-stack, multi-tenant SaaS starter on [Pylon](https://pylonsync.com),
+branded as a fictional product called **Acme**: a server-rendered marketing
+landing page, email/password auth, organizations with members + roles, and
+tenant-scoped projects — all from one binary on one port. No Next.js, no
+separate API server, no realtime sidecar.
 
 ## Develop
 
@@ -10,42 +12,55 @@ served from one binary on one port. No Next.js, no separate API server.
 __RUN_DEV__
 ```
 
-Open http://localhost:4321. Sign up, and your notes dashboard updates live
-(open a second tab to watch writes sync). Edit any file under `app/` and save —
-the page reloads instantly.
+Open http://localhost:4321. You get the **Acme landing page**. Sign up, create
+an organization, and you land in a **workspace** with tenant-scoped projects and
+a members panel. Create a second org and switch between them — each org's data
+is private to it. Edit any file under `app/` and save — the page reloads.
 
 ## Layout
 
 ```
-app.ts                 data model + manifest (entities, policies, auth, routes)
-app/page.tsx           "/" — the server-rendered, auth-aware homepage
-app/login,signup/      email/password forms (POST /api/auth/password/*)
-app/dashboard/         "/dashboard" — authed; server-gated, live notes + sign out
-app/auth-form.tsx      shared client island for the login/signup forms
-app/layout.tsx         root layout wrapping every page (auth-aware nav)
-app/globals.css        Tailwind entrypoint (compiled by Pylon)
-functions/             server functions (query/mutation/action) — typed RPC
+app.ts                       User + Org/OrgMember/OrgInvite + tenant-scoped Project
+app/page.tsx                 "/" — the server-rendered Acme landing page (auth-aware)
+app/layout.tsx               marketing nav + footer (rebrand "Acme")
+app/login,signup/            email/password (POST /api/auth/password/*)
+app/dashboard/               "/dashboard" — authed; org switcher + projects + members
+app/dashboard/dashboard-client.tsx   the workspace client island
+app/globals.css              Tailwind v4 + shadcn tokens (compiled by Pylon)
+components/ui/                shadcn primitives (Button, Card)
 ```
 
-## How auth works
+## How it works
 
-Email/password is built in. `/login` and `/signup` call
-`/api/auth/password/*`; on success the server sets an **HttpOnly session
-cookie** (no token in JS-readable storage). `/dashboard` reads `auth` during
-the server render and redirects anonymous visitors to `/login` — a real 3xx
-before any HTML, so there's no flash and it works with JS off. The sync engine
-authenticates with the same cookie.
+**The landing page** (`app/page.tsx`) is server-rendered React — view source and
+the copy + SEO `<head>` are in the HTML, so it's fully indexable. It reads the
+session during the render, so the call-to-action is "Get started" for visitors
+and "Open dashboard" once you're signed in — no flash, no client fetch.
 
-## Add a route
+**Auth** is built in: `/login` + `/signup` POST to `/api/auth/password/*`, the
+server sets an HttpOnly session cookie, and `/dashboard` redirects anonymous
+visitors with a real 3xx before any HTML (works with JS off).
 
-Drop a file at `app/about/page.tsx` and visit `/about`. Pages receive
-`{ url, params, searchParams, auth, response, serverData }` from the SSR
-runtime — all typed via `PageProps` from `@pylonsync/react`.
+**Multi-tenancy** is a framework primitive. Declaring `Org` / `OrgMember` /
+`OrgInvite` lights up `/api/auth/orgs/*` + `/api/auth/select-org`, driven by
+`<OrganizationSwitcher>` from `@pylonsync/client`. Your data lives in
+tenant-scoped entities (`Project`), gated by policy:
 
-## Add data
+```ts
+allowRead:   "auth.tenantId == data.orgId"
+allowInsert: "auth.tenantId == data.orgId"
+```
+
+So `db.useQuery("Project")` returns only your **active org's** projects — switch
+orgs and the list changes, and a client literally cannot read or write another
+tenant's rows. `db.useQuery` is live; `db.insert` is optimistic.
+
+## Make it yours
 
-Edit `app.ts`. Every `entity()` becomes a synced table with a REST +
-realtime API and a typed client — no migrations, no resolvers.
+- **Rebrand:** replace "Acme" in `app/page.tsx` + `app/layout.tsx`.
+- **Add tenant data:** new `entity()` with an `orgId` + the same two policy
+  lines — a new tenant-scoped table, typed client and REST/realtime API included.
+- **Add a route:** drop `app/about/page.tsx` and visit `/about`.
 
 ## Deploy