@pylonsync/create-pylon 0.3.274 → 0.3.275

package/templates/marketplace/client/market.ts

@@ -0,0 +1,341 @@
+"use client";
+
+// Shared client-side glue for Pylon Market: types, display helpers, and the
+// email/password auth bootstrap. Same-origin under native SSR, so no baseUrl —
+// init() resolves window.location.origin.
+import { init, configureClient, callFn, storageKey } from "@pylonsync/react";
+
+export const APP_NAME = "market";
+
+// Prefilled demo account — the shopper you sign in as. Owns a couple of its
+// own listings so "My Market" isn't empty, but NOT the bulk of the catalog,
+// so it can actually buy + bid on things.
+export const DEMO = {
+  email: "demo@pylon.market",
+  password: "pylondemo123",
+  name: "Demo Shopper",
+} as const;
+
+// The seed seller that owns most of the catalog. Nobody logs in as this; it
+// exists so the demo shopper has plenty of other people's listings to buy.
+const BAZAAR = {
+  email: "bazaar@pylon.market",
+  password: "bazaarseed123",
+  name: "Pylon Bazaar",
+} as const;
+
+// How many of the seeded listings the bazaar owns; the rest go to the demo.
+const BAZAAR_COUNT = 10;
+
+export interface Listing {
+  id: string;
+  sellerId: string;
+  sellerName: string;
+  title: string;
+  slug: string;
+  description: string;
+  price: number;
+  category: string;
+  condition: string;
+  status: "active" | "sold";
+  seed: string;
+  createdAt: string;
+}
+
+export interface Offer {
+  id: string;
+  listingId: string;
+  listingTitle: string;
+  sellerId: string;
+  buyerId: string;
+  buyerName: string;
+  amount: number;
+  message?: string;
+  status: "pending" | "accepted" | "declined";
+  createdAt: string;
+}
+
+export interface Watch {
+  id: string;
+  userId: string;
+  listingId: string;
+  listingTitle: string;
+  createdAt: string;
+}
+
+export interface Identity {
+  userId: string;
+  name: string;
+}
+
+// ---------------------------------------------------------------------------
+// Display helpers (pure)
+// ---------------------------------------------------------------------------
+
+function hash(s: string): number {
+  let h = 2166136261;
+  for (let i = 0; i < s.length; i++) {
+    h ^= s.charCodeAt(i);
+    h = Math.imul(h, 16777619);
+  }
+  return h >>> 0;
+}
+
+/** Deterministic gradient "photo" from a seed — no image hosting needed. */
+export function gradient(seed: string): string {
+  const h = hash(seed);
+  const a = h % 360;
+  const b = (a + 40 + ((h >> 3) % 90)) % 360;
+  return `linear-gradient(135deg, hsl(${a} 68% 56%), hsl(${b} 72% 44%))`;
+}
+
+export function initials(title: string): string {
+  return (
+    title
+      .split(/\s+/)
+      .filter(Boolean)
+      .slice(0, 2)
+      .map((w) => w[0]?.toUpperCase() ?? "")
+      .join("") || "·"
+  );
+}
+
+export function money(n: number): string {
+  const v = Math.round(n * 100) / 100;
+  return (
+    "$" +
+    v.toLocaleString(undefined, {
+      minimumFractionDigits: v % 1 ? 2 : 0,
+      maximumFractionDigits: 2,
+    })
+  );
+}
+
+export function timeAgo(iso: string): string {
+  const s = (Date.now() - Date.parse(iso)) / 1000;
+  if (!Number.isFinite(s)) return "";
+  if (s < 60) return "just now";
+  const m = Math.floor(s / 60);
+  if (m < 60) return `${m}m ago`;
+  const h = Math.floor(m / 60);
+  if (h < 24) return `${h}h ago`;
+  return `${Math.floor(h / 24)}d ago`;
+}
+
+export function conditionLabel(c: string): string {
+  return (
+    { "like-new": "Like new", new: "New", good: "Good", fair: "Fair" }[c] ?? c
+  );
+}
+
+/** Title → URL-safe slug stem. */
+export function slugify(s: string): string {
+  return s
+    .toLowerCase()
+    .trim()
+    .replace(/[^a-z0-9]+/g, "-")
+    .replace(/^-+|-+$/g, "")
+    .slice(0, 60);
+}
+
+/** A listing's URL key: slugified title + a short unique suffix. */
+export function makeSlug(title: string, suffix: string): string {
+  const stem = slugify(title) || "item";
+  return `${stem}-${suffix}`;
+}
+
+// ---------------------------------------------------------------------------
+// Auth — real email/password (no email verification)
+// ---------------------------------------------------------------------------
+//
+// Storage slots:
+//   storageKey("token")  — the bearer the sync engine sends on every request.
+//                          A guest token for read connectivity, OR the signed-
+//                          in user's token after login.
+//   storageKey("userId") — set ONLY when a real user is signed in. Its
+//                          presence is what "logged in" means.
+//   market:displayName   — the signed-in user's name, cached for instant UI.
+
+const TOKEN = () => storageKey("token");
+const USER_ID = () => storageKey("userId");
+const DISPLAY_NAME = "market:displayName";
+
+let booted = false;
+
+/** Boot the sync engine once. Same-origin, so init() resolves the origin. */
+export function bootClient(): void {
+  if (booted) return;
+  booted = true;
+  init({ appName: APP_NAME });
+  configureClient({ appName: APP_NAME });
+}
+
+/**
+ * Establish a guest session purely for READ connectivity — the public browse
+ * grid + "just listed" ticker run live for signed-out visitors. Writes are
+ * gated behind a real sign-in (see {@link signIn}), so this guest token never
+ * authors a row. Idempotent: skipped once any token (guest or user) exists.
+ */
+export async function ensureReadSession(): Promise<void> {
+  bootClient();
+  if (localStorage.getItem(TOKEN())) return;
+  try {
+    const res = await fetch("/api/auth/guest", { method: "POST" });
+    if (res.ok) {
+      const body = (await res.json()) as { token?: string };
+      if (body.token) localStorage.setItem(TOKEN(), body.token);
+      configureClient({ appName: APP_NAME });
+    }
+  } catch {
+    // Server not reachable yet — the engine retries on connect.
+  }
+}
+
+function applySession(token: string, userId: string, name: string): void {
+  localStorage.setItem(TOKEN(), token);
+  localStorage.setItem(USER_ID(), userId);
+  localStorage.setItem(DISPLAY_NAME, name);
+  configureClient({ appName: APP_NAME });
+  // Notify in-tab + cross-tab listeners (MarketProvider) to re-read identity.
+  window.dispatchEvent(new Event("pylon-auth-changed"));
+}
+
+type AuthResponse = { token: string; user_id: string };
+
+export async function signIn(email: string, password: string): Promise<void> {
+  const res = await fetch("/api/auth/password/login", {
+    method: "POST",
+    headers: { "Content-Type": "application/json" },
+    body: JSON.stringify({ email, password }),
+  });
+  const json = await res.json();
+  if (!res.ok) throw new Error(json.error?.message ?? "Sign-in failed");
+  const { token, user_id } = json as AuthResponse;
+  // Login doesn't return displayName; default to the email handle and let
+  // MarketProvider's live User query upgrade it.
+  applySession(token, user_id, email.split("@")[0] ?? "you");
+}
+
+export async function signUp(
+  email: string,
+  password: string,
+  name: string,
+): Promise<void> {
+  const res = await fetch("/api/auth/password/register", {
+    method: "POST",
+    headers: { "Content-Type": "application/json" },
+    body: JSON.stringify({
+      email,
+      password,
+      displayName: name || email.split("@")[0],
+    }),
+  });
+  const json = await res.json();
+  if (!res.ok) throw new Error(json.error?.message ?? "Sign-up failed");
+  const { token, user_id } = json as AuthResponse;
+  applySession(token, user_id, name || email.split("@")[0] || "you");
+}
+
+export async function signOut(): Promise<void> {
+  localStorage.removeItem(TOKEN());
+  localStorage.removeItem(USER_ID());
+  localStorage.removeItem(DISPLAY_NAME);
+  window.dispatchEvent(new Event("pylon-auth-changed"));
+  // Restore read connectivity for the now-anonymous visitor.
+  await ensureReadSession();
+  window.dispatchEvent(new Event("pylon-auth-changed"));
+}
+
+export function readIdentity(): Identity | null {
+  const userId = localStorage.getItem(USER_ID());
+  if (!userId) return null;
+  return { userId, name: localStorage.getItem(DISPLAY_NAME) ?? "you" };
+}
+
+/** Cache the freshest displayName (from the live User query) for instant UI. */
+export function cacheDisplayName(name: string): void {
+  if (name) localStorage.setItem(DISPLAY_NAME, name);
+}
+
+/** Register an account (or log in if it already exists). Returns its token,
+ *  or undefined on failure. Used transiently for seeding — the returned token
+ *  is NOT persisted as the visitor's session. */
+async function ensureAccount(
+  email: string,
+  password: string,
+  name: string,
+): Promise<string | undefined> {
+  try {
+    const reg = await fetch("/api/auth/password/register", {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify({ email, password, displayName: name }),
+    });
+    if (reg.ok) return ((await reg.json()) as AuthResponse).token;
+    const login = await fetch("/api/auth/password/login", {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify({ email, password }),
+    });
+    if (login.ok) return ((await login.json()) as AuthResponse).token;
+  } catch {
+    /* offline — caller swallows */
+  }
+  return undefined;
+}
+
+/**
+ * Make sure the demo accounts exist and the catalog is seeded — so the
+ * prefilled login is one click from a working session that can actually buy
+ * and sell. Idempotent and best-effort: any failure is swallowed.
+ *
+ * Two accounts are seeded:
+ *   - **bazaar** owns the bulk of the catalog, so the demo shopper has other
+ *     people's listings to buy + bid on (you can't buy your own);
+ *   - **demo** (the prefilled login) owns a couple of its own listings so
+ *     "My Market" has something in it.
+ *
+ * Both tokens are used transiently to seed and then discarded — the visitor
+ * stays anonymous (read-only) until they choose to sign in.
+ */
+// Shared in-flight promise so the many islands that mount MarketProvider on
+// one page (ticker, header, SeedOnEmpty) all await the SAME seed run instead
+// of each firing their own — that flood was tripping the login rate limit,
+// and a premature reload could abort it mid-flight.
+let seedPromise: Promise<void> | null = null;
+
+export function ensureDemoSeed(): Promise<void> {
+  // Already seeded in a previous visit (accounts + catalog persist
+  // server-side) — nothing to do.
+  if (localStorage.getItem("market:demo-seeded") === "1") return Promise.resolve();
+  if (seedPromise) return seedPromise;
+
+  seedPromise = (async () => {
+    const bazaarToken = await ensureAccount(
+      BAZAAR.email,
+      BAZAAR.password,
+      BAZAAR.name,
+    );
+    if (bazaarToken) {
+      await callFn(
+        "seedMarket",
+        { start: 0, end: BAZAAR_COUNT },
+        { token: bazaarToken },
+      );
+    }
+
+    const demoToken = await ensureAccount(DEMO.email, DEMO.password, DEMO.name);
+    if (demoToken) {
+      await callFn("seedMarket", { start: BAZAAR_COUNT }, { token: demoToken });
+    }
+
+    // Mark done only AFTER a successful pass, so a failed/partial run retries
+    // on the next load instead of being permanently skipped.
+    localStorage.setItem("market:demo-seeded", "1");
+  })().catch(() => {
+    // Allow a later attempt to retry from scratch.
+    seedPromise = null;
+  });
+
+  return seedPromise;
+}

package/templates/marketplace/functions/buyNow.ts

@@ -0,0 +1,78 @@
+import { mutation, v } from "@pylonsync/functions";
+
+/**
+ * Buy a listing outright at its asking price. Records the purchase as an
+ * accepted Offer (so it shows up in both parties' views exactly like a
+ * negotiated sale), marks the listing sold, and declines any other pending
+ * offers. The cross-entity, multi-row work is why this is a function rather
+ * than a plain db.insert.
+ */
+
+interface BuyNowArgs {
+  listingId: string;
+  buyerName: string;
+  _optimisticId?: string;
+}
+
+interface BuyNowResult {
+  id: string;
+}
+
+export default mutation<BuyNowArgs, BuyNowResult>({
+  // Defaults to auth: "user" — only signed-in members can buy.
+  args: {
+    listingId: v.id("Listing"),
+    buyerName: v.string(),
+    // Threaded by db.useMutation({ optimistic }) so the server's accepted
+    // Offer reuses the id of the optimistic ghost the client painted.
+    _optimisticId: v.optional(v.string()),
+  },
+  async handler(ctx, args) {
+    if (!ctx.auth.userId) throw ctx.error("UNAUTHENTICATED", "sign in first");
+
+    const listing = await ctx.db.get("Listing", args.listingId) as {
+      id: string;
+      title: string;
+      price: number;
+      status: string;
+      sellerId: string;
+    } | null;
+    if (!listing) throw ctx.error("NOT_FOUND", "listing not found");
+    if (listing.status !== "active")
+      throw ctx.error("INVALID_ARGS", "this listing is no longer available");
+    if (listing.sellerId === ctx.auth.userId)
+      throw ctx.error("INVALID_ARGS", "you can't buy your own listing");
+
+    const id = await ctx.db.insert("Offer", {
+      id: args._optimisticId,
+      listingId: args.listingId,
+      listingTitle: listing.title,
+      sellerId: listing.sellerId,
+      buyerId: ctx.auth.userId,
+      buyerName: args.buyerName || "anonymous",
+      amount: listing.price,
+      message: "Bought at list price",
+      status: "accepted",
+      createdAt: new Date().toISOString(),
+    });
+
+    // Mark sold and decline the rest — same reconciliation respondToOffer does
+    // on an accept.
+    await ctx.db.update("Listing", args.listingId, { status: "sold" });
+    const siblings = (await ctx.db.list("Offer")) as Array<{
+      id: string;
+      listingId: string;
+      status: string;
+    }>;
+    for (const o of siblings) {
+      if (
+        o.listingId === args.listingId &&
+        o.id !== id &&
+        o.status === "pending"
+      ) {
+        await ctx.db.update("Offer", o.id, { status: "declined" });
+      }
+    }
+    return { id };
+  },
+});

package/templates/marketplace/functions/makeOffer.ts

@@ -0,0 +1,65 @@
+import { mutation, v } from "@pylonsync/functions";
+
+/**
+ * Make an offer on a listing. Denormalizes the listing title + seller id
+ * onto the offer so the seller's inbox + the buyer's "my offers" list can
+ * render without a join.
+ */
+
+interface MakeOfferArgs {
+  listingId: string;
+  amount: number;
+  message?: string;
+  buyerName: string;
+  _optimisticId?: string;
+}
+
+interface MakeOfferResult {
+  id: string;
+}
+
+export default mutation<MakeOfferArgs, MakeOfferResult>({
+  // Defaults to auth: "user" — only signed-in members can bid.
+  args: {
+    listingId: v.id("Listing"),
+    amount: v.number(),
+    message: v.optional(v.string()),
+    buyerName: v.string(),
+    // Threaded by db.useMutation({ optimistic }) so the server row reuses the
+    // id of the optimistic ghost the client already painted — the broadcast
+    // merges in place instead of flashing a temp row.
+    _optimisticId: v.optional(v.string()),
+  },
+  async handler(ctx, args) {
+    if (!ctx.auth.userId) throw ctx.error("UNAUTHENTICATED", "sign in first");
+
+    const listing = await ctx.db.get("Listing", args.listingId) as {
+      id: string;
+      title: string;
+      sellerId: string;
+      status: string;
+    } | null;
+    if (!listing) throw ctx.error("NOT_FOUND", "listing not found");
+    if (listing.status !== "active")
+      throw ctx.error("INVALID_ARGS", "this listing is no longer available");
+    if (listing.sellerId === ctx.auth.userId)
+      throw ctx.error("INVALID_ARGS", "you can't bid on your own listing");
+    if (args.amount <= 0)
+      throw ctx.error("INVALID_ARGS", "offer must be greater than zero");
+
+    const id = await ctx.db.insert("Offer", {
+      // Reuse the optimistic ghost's id so the broadcast merges in place.
+      id: args._optimisticId,
+      listingId: args.listingId,
+      listingTitle: listing.title,
+      sellerId: listing.sellerId,
+      buyerId: ctx.auth.userId,
+      buyerName: args.buyerName || "anonymous",
+      amount: Math.round(args.amount * 100) / 100,
+      message: (args.message ?? "").trim(),
+      status: "pending",
+      createdAt: new Date().toISOString(),
+    });
+    return { id };
+  },
+});

package/templates/marketplace/functions/respondToOffer.ts

@@ -0,0 +1,62 @@
+import { mutation, v } from "@pylonsync/functions";
+
+/**
+ * Seller accepts or declines an offer. Accepting is the interesting path:
+ * it marks the offer accepted, flips the listing to "sold", and declines
+ * every other pending offer on that listing — all in one mutation, fanned
+ * out to every watching tab by the change log.
+ *
+ * Ownership is enforced here (not in a policy expression) because the rule
+ * spans two entities: "the caller must own the LISTING the OFFER points at."
+ */
+
+interface RespondToOfferArgs {
+  offerId: string;
+  accept: boolean;
+}
+
+interface RespondToOfferResult {
+  accepted: boolean;
+}
+
+export default mutation<RespondToOfferArgs, RespondToOfferResult>({
+  // Defaults to auth: "user" — only the signed-in seller responds.
+  args: {
+    offerId: v.id("Offer"),
+    accept: v.boolean(),
+  },
+  async handler(ctx, args) {
+    if (!ctx.auth.userId) throw ctx.error("UNAUTHENTICATED", "sign in first");
+
+    const offer = await ctx.db.get("Offer", args.offerId) as {
+      id: string;
+      listingId: string;
+      sellerId: string;
+      status: string;
+    } | null;
+    if (!offer) throw ctx.error("NOT_FOUND", "offer not found");
+    if (offer.sellerId !== ctx.auth.userId)
+      throw ctx.error("UNAUTHORIZED", "only the seller can answer this offer");
+    if (offer.status !== "pending")
+      throw ctx.error("INVALID_ARGS", "this offer was already answered");
+
+    if (!args.accept) {
+      await ctx.db.update("Offer", args.offerId, { status: "declined" });
+      return { accepted: false };
+    }
+
+    await ctx.db.update("Offer", args.offerId, { status: "accepted" });
+    await ctx.db.update("Listing", String(offer.listingId), { status: "sold" });
+
+    // Decline the losers.
+    const siblings = await ctx.db.query("Offer", {
+      listingId: offer.listingId,
+    }) as Array<{ id: string; status: string }>;
+    for (const o of siblings) {
+      if (o.id !== args.offerId && o.status === "pending") {
+        await ctx.db.update("Offer", String(o.id), { status: "declined" });
+      }
+    }
+    return { accepted: true };
+  },
+});

package/templates/marketplace/functions/seedMarket.ts

@@ -0,0 +1,90 @@
+import { mutation, v } from "@pylonsync/functions";
+
+// A handful of believable listings so the marketplace isn't empty on first
+// run. Idempotent: seeds only when the catalog is empty, so the browse page
+// can call it on load without worrying about duplicates.
+const DEMO: Array<{
+  seller: string;
+  title: string;
+  description: string;
+  price: number;
+  category: string;
+  condition: string;
+  seed: string;
+}> = [
+  { seller: "maple-fox", title: "Herman Miller Aeron (size B)", description: "Fully loaded, posture-fit SL. Light desk use, no squeaks.", price: 540, category: "furniture", condition: "like-new", seed: "a1f3" },
+  { seller: "amber-lynx", title: "Kodak Retina IIa rangefinder", description: "1950s folding 35mm. Clean glass, accurate shutter, leather case.", price: 185, category: "cameras", condition: "good", seed: "b7c2" },
+  { seller: "swift-otter", title: "Specialized Allez road bike, 54cm", description: "Shimano Claris, fresh bar tape, recently tuned. Fast commuter.", price: 420, category: "bikes", condition: "good", seed: "c4e9" },
+  { seller: "cosmic-wren", title: "Vintage Technics SL-1200 MK2", description: "Legendary direct-drive turntable. Spins true, new slipmat.", price: 650, category: "audio", condition: "good", seed: "d8a1" },
+  { seller: "ivory-sparrow", title: "Le Creuset 5.5qt Dutch oven", description: "Flame orange, enamel intact. The one everyone wants.", price: 120, category: "kitchen", condition: "like-new", seed: "e2b6" },
+  { seller: "slate-heron", title: 'LG 27" 4K UltraFine monitor', description: "USB-C, 60Hz, color-accurate. Box + cables included.", price: 240, category: "electronics", condition: "good", seed: "f5d0" },
+  { seller: "maple-fox", title: "Eames-style lounge + ottoman", description: "Walnut + tan leather replica. Sturdy, very comfortable.", price: 380, category: "furniture", condition: "good", seed: "a9c4" },
+  { seller: "amber-lynx", title: "Patagonia Black Hole 55L duffel", description: "One trip old. Weatherproof, zips perfect. Forest green.", price: 75, category: "outdoor", condition: "like-new", seed: "b3f8" },
+  { seller: "cosmic-wren", title: "Fender Player Stratocaster, sunburst", description: "Maple neck, plays great. Small buckle rash on back.", price: 560, category: "instruments", condition: "good", seed: "d1e7" },
+  { seller: "slate-heron", title: "iPad Air (5th gen) 64GB", description: "Space gray, 100% battery health, screen flawless.", price: 330, category: "electronics", condition: "like-new", seed: "f0a2" },
+  { seller: "ivory-sparrow", title: "Mid-century teak sideboard", description: "Three drawers, two cabinets. Real teak, refinished top.", price: 295, category: "furniture", condition: "good", seed: "e7c3" },
+  { seller: "swift-otter", title: "Brooks Brothers wool overcoat, 40R", description: "Charcoal herringbone, fully lined. Dry-cleaned, ready to wear.", price: 90, category: "apparel", condition: "good", seed: "c2b5" },
+];
+
+interface SeedMarketArgs {
+  start?: number;
+  end?: number;
+}
+
+interface SeedMarketResult {
+  seeded: number;
+}
+
+export default mutation<SeedMarketArgs, SeedMarketResult>({
+  // Defaults to auth: "user" — seeds a slice of the catalog owned by the
+  // caller. The bootstrap calls this twice: once as a "bazaar" seller for the
+  // bulk of the catalog (so the demo buyer can bid on it), and once as the
+  // demo account for a couple of its own listings.
+  args: {
+    start: v.optional(v.number()),
+    end: v.optional(v.number()),
+  },
+  async handler(ctx, args) {
+    if (!ctx.auth.userId) throw ctx.error("UNAUTHENTICATED", "sign in first");
+
+    // Per-caller idempotency: skip if THIS seller already has listings, so the
+    // two seed calls (and any reloads) don't duplicate.
+    const all = await ctx.db.list("Listing") as Array<{ sellerId: string }>;
+    if (all.some((l) => l.sellerId === ctx.auth.userId)) return { seeded: 0 };
+
+    const start = args.start ?? 0;
+    const end = args.end ?? DEMO.length;
+    const slice = DEMO.slice(start, end);
+
+    // Stagger createdAt so the grid + ticker have a believable order. The
+    // seller id is the caller — `Listing.sellerId` is `field.owner()`, so the
+    // framework would reject any other value. `seller` stays a display name.
+    const slugify = (s: string) =>
+      s
+        .toLowerCase()
+        .trim()
+        .replace(/[^a-z0-9]+/g, "-")
+        .replace(/^-+|-+$/g, "")
+        .slice(0, 60);
+
+    const now = Date.now();
+    let n = 0;
+    for (const d of slice) {
+      await ctx.db.insert("Listing", {
+        sellerId: ctx.auth.userId,
+        sellerName: d.seller,
+        title: d.title,
+        slug: `${slugify(d.title) || "item"}-${d.seed}`,
+        description: d.description,
+        price: d.price,
+        category: d.category,
+        condition: d.condition,
+        status: "active",
+        seed: d.seed,
+        createdAt: new Date(now - (start + n) * 7 * 60_000).toISOString(),
+      });
+      n++;
+    }
+    return { seeded: n };
+  },
+});

package/templates/marketplace/gitignore

@@ -0,0 +1,10 @@
+node_modules/
+.pylon/
+pylon.manifest.json
+pylon.client.ts
+web/dist/
+*.db
+*.db-*
+.env
+.env.local
+.DS_Store

package/templates/marketplace/package.json

@@ -0,0 +1,35 @@
+{
+  "name": "__APP_NAME_KEBAB__",
+  "version": "0.1.0",
+  "private": true,
+  "type": "module",
+  "scripts": {
+    "dev": "pylon dev",
+    "deploy": "pylon deploy",
+    "check": "tsc --noEmit"
+  },
+  "dependencies": {
+    "@pylonsync/react": "^__PYLON_VERSION__",
+    "@pylonsync/sdk": "^__PYLON_VERSION__",
+    "@pylonsync/functions": "^__PYLON_VERSION__",
+    "@pylonsync/sync": "^__PYLON_VERSION__",
+    "react": "^19.0.0",
+    "react-dom": "^19.0.0",
+    "tailwindcss": "^4.3.0",
+    "@tailwindcss/cli": "^4.3.0",
+    "tw-animate-css": "^1.2.0",
+    "class-variance-authority": "^0.7.1",
+    "clsx": "^2.1.1",
+    "tailwind-merge": "^2.5.0",
+    "lucide-react": "^0.460.0",
+    "@radix-ui/react-slot": "^1.1.0",
+    "@radix-ui/react-label": "^2.1.0"
+  },
+  "devDependencies": {
+    "@pylonsync/cli": "^__PYLON_VERSION__",
+    "@types/node": "^22.0.0",
+    "@types/react": "^19.0.0",
+    "@types/react-dom": "^19.0.0",
+    "typescript": "^5.6.0"
+  }
+}