@pylonsync/create-pylon 0.3.275 → 0.3.276

package/templates/agency/app/layout.tsx

@@ -70,7 +70,7 @@ export default function RootLayout({ children, url, auth }: LayoutProps) {
                   </span>
                 </Link>
                 <nav className="flex items-center gap-1 sm:gap-2">
-                  <a href="/#work" className="hidden rounded-full px-3 py-1.5 text-[13px] font-medium text-zinc-600 transition-colors hover:text-zinc-900 sm:inline-flex">
+                  <a href="/work" className="hidden rounded-full px-3 py-1.5 text-[13px] font-medium text-zinc-600 transition-colors hover:text-zinc-900 sm:inline-flex">
                     Work
                   </a>
                   <a href="/#services" className="hidden rounded-full px-3 py-1.5 text-[13px] font-medium text-zinc-600 transition-colors hover:text-zinc-900 sm:inline-flex">

package/templates/agency/app/page.tsx

@@ -1,15 +1,18 @@
-import React from "react";
-import { type Metadata } from "@pylonsync/react";
+import React, { Suspense, use } from "react";
+import { Link, type Metadata, type PageProps, type ServerData } from "@pylonsync/react";
 import {
   WRAP,
   Eyebrow,
   Divider,
   SectionHead,
   ImagePlaceholder,
+  ProjectCard,
   initials,
 } from "@/components/marketing";
 import { LiveSlots, ContactForm } from "./contact-form";
+import { SeedProjects } from "./seeder";
 import { siteConfig } from "@/lib/site.config";
+import { slugify, viewFromRow, type ProjectRow, type ProjectView } from "@/lib/agency";
 
 export const metadata: Metadata = {
   title: siteConfig.seo.title,
@@ -17,12 +20,46 @@ export const metadata: Metadata = {
   openGraph: { title: siteConfig.seo.title, description: siteConfig.seo.description, type: "website" },
 };
 
+// The homepage "Selected work" grid reads the live Project portfolio on the
+// server (the `selected` + `published` ones, ordered), so curating it in the
+// dashboard re-curates the homepage. Before the portfolio is seeded, it falls
+// back to the config case studies so the section is never empty on first paint.
+function selectedFromConfig(): ProjectView[] {
+  return siteConfig.work.items
+    .filter((c) => c.selected)
+    .map((c) => ({
+      slug: c.slug || slugify(c.title),
+      title: c.title,
+      client: c.client,
+      summary: c.summary,
+      year: c.year ?? null,
+      tags: c.tags,
+    }));
+}
+
+function SelectedWork({ serverData }: { serverData: ServerData }) {
+  const rows = use(serverData.list<ProjectRow>("Project"));
+  const fromDb = rows
+    .filter((p) => p.selected && p.published)
+    .sort((a, b) => a.order - b.order || (a.createdAt < b.createdAt ? -1 : 1))
+    .map(viewFromRow);
+  const projects = fromDb.length > 0 ? fromDb : selectedFromConfig();
+
+  return (
+    <div className="mt-10 grid gap-6 sm:grid-cols-2">
+      {projects.map((p) => (
+        <ProjectCard key={p.slug} p={p} />
+      ))}
+    </div>
+  );
+}
+
 // `app/page.tsx` → `/`. Server-rendered studio site. Hero, services, work,
 // process, team, and testimonials are static server HTML (SEO + first paint);
 // the live "slots open" pill and the contact form (#contact) are client islands
-// driven by the public Capacity row. All copy comes from siteConfig. Doesn't
-// read `auth`, so the public page stays cacheable.
-export default function LandingPage() {
+// driven by the public Capacity row. The "Selected work" grid reads the Project
+// portfolio server-side. All other copy comes from siteConfig.
+export default function LandingPage({ serverData }: PageProps) {
   const { hero, logos, services, work, process, team, testimonials, contact } = siteConfig;
 
   return (
@@ -97,32 +134,34 @@ export default function LandingPage() {
       {/* ============================== WORK ============================= */}
       <Divider />
       <section id="work" className={`${WRAP} py-16`}>
-        <SectionHead eyebrow={work.eyebrow} title={work.headline} />
-        <div className="mt-10 grid gap-6 sm:grid-cols-2">
-          {work.items.map((c) => (
-            <div key={c.title} className="group">
-              {/* Case-study image — drop in a real project screenshot. */}
-              <ImagePlaceholder
-                shape="landscape"
-                title={`${c.title} — project shot`}
-                hint="Swap for an <img> per case study"
-              />
-              <div className="mt-4 flex items-baseline justify-between gap-3">
-                <h3 className="text-[16px] font-semibold text-zinc-900">{c.title}</h3>
-                <span className="shrink-0 font-mono text-[11px] uppercase tracking-wide text-zinc-400">
-                  {c.client}
-                </span>
-              </div>
-              <p className="mt-1.5 text-[14px] leading-relaxed text-zinc-500">{c.summary}</p>
-              <div className="mt-3 flex flex-wrap gap-1.5">
-                {c.tags.map((t) => (
-                  <span key={t} className="rounded-full bg-zinc-100 px-2.5 py-0.5 text-[11px] font-medium text-zinc-600">
-                    {t}
-                  </span>
-                ))}
-              </div>
+        <div className="flex items-end justify-between gap-4">
+          <SectionHead eyebrow={work.eyebrow} title={work.headline} />
+          <Link
+            href="/work"
+            className="hidden shrink-0 text-[13.5px] font-medium text-zinc-600 transition-colors hover:text-zinc-900 sm:inline-flex"
+          >
+            All work →
+          </Link>
+        </div>
+        <Suspense
+          fallback={
+            <div className="mt-10 grid gap-6 sm:grid-cols-2">
+              {[0, 1].map((i) => (
+                <div key={i}>
+                  <div className="aspect-[4/3] animate-pulse rounded-2xl bg-zinc-100" />
+                  <div className="mt-4 h-4 w-1/3 animate-pulse rounded bg-zinc-100" />
+                  <div className="mt-2 h-3 w-3/4 animate-pulse rounded bg-zinc-100" />
+                </div>
+              ))}
             </div>
-          ))}
+          }
+        >
+          <SelectedWork serverData={serverData} />
+        </Suspense>
+        <div className="mt-8 sm:hidden">
+          <Link href="/work" className="text-[14px] font-medium text-brand">
+            See all work →
+          </Link>
         </div>
       </section>
 
@@ -202,6 +241,9 @@ export default function LandingPage() {
           <ContactForm />
         </div>
       </section>
+
+      {/* Seeds the public portfolio on first visit (idempotent, zero UI). */}
+      <SeedProjects />
     </div>
   );
 }

package/templates/agency/app/seeder.tsx

@@ -0,0 +1,26 @@
+"use client";
+
+import React, { useEffect } from "react";
+import { callFn } from "@pylonsync/react";
+import { EnsureGuest } from "@pylonsync/client";
+
+// A zero-UI client island that seeds the public Project portfolio on first
+// visit (idempotent server-side — a no-op once any project exists). Drop it on
+// any public page so /work and the case-study pages aren't empty even if the
+// visitor never hit the homepage. Wrapped in <EnsureGuest> so a session exists
+// for the call; seedProjects is a public mutation, so an anonymous guest can run
+// it (it only ever writes the config's marketing copy — no PII).
+export function SeedProjects() {
+  return (
+    <EnsureGuest fallback={null}>
+      <Seed />
+    </EnsureGuest>
+  );
+}
+
+function Seed() {
+  useEffect(() => {
+    void callFn("seedProjects", {});
+  }, []);
+  return null;
+}

package/templates/agency/app/work/[slug]/page.tsx

@@ -0,0 +1,182 @@
+import React, { Suspense, use } from "react";
+import {
+  Link,
+  type GenerateMetadata,
+  type Metadata,
+  type PageProps,
+  type ServerData,
+  type SsrResponse,
+} from "@pylonsync/react";
+import { ImagePlaceholder } from "@/components/marketing";
+import { SeedProjects } from "../../seeder";
+import { siteConfig } from "@/lib/site.config";
+import { slugify, viewFromRow, type ProjectRow, type ProjectView } from "@/lib/agency";
+
+// Resolve a case study from the URL slug. Prefer the live Project row; if the
+// row exists but is a draft (`published === false`) it's NOT public → treat as
+// missing. Only when there's NO row at all (the portfolio hasn't been seeded
+// yet) do we fall back to the matching config case study, so deep links work on
+// a fresh install.
+async function resolveProject(
+  serverData: ServerData,
+  slug: string,
+): Promise<ProjectView | null> {
+  const row = await serverData.lookup<ProjectRow>("Project", "slug", slug);
+  if (row) return row.published ? viewFromRow(row) : null;
+
+  const cfg = siteConfig.work.items.find((c) => (c.slug || slugify(c.title)) === slug);
+  if (!cfg) return null;
+  return {
+    slug: cfg.slug || slugify(cfg.title),
+    title: cfg.title,
+    client: cfg.client,
+    summary: cfg.summary,
+    year: cfg.year ?? null,
+    tags: cfg.tags,
+    challenge: cfg.challenge ?? null,
+    approach: cfg.approach ?? null,
+    outcome: cfg.outcome ?? null,
+    liveUrl: cfg.liveUrl ?? null,
+  };
+}
+
+export const generateMetadata: GenerateMetadata = async ({
+  params,
+  serverData,
+}): Promise<Metadata> => {
+  const p = await resolveProject(serverData, params.slug);
+  if (!p) return { title: `Case study not found — ${siteConfig.brand.name}`, robots: "noindex" };
+  return {
+    title: `${p.title} — ${siteConfig.brand.name}`,
+    description: p.summary,
+    openGraph: { title: `${p.title} — ${siteConfig.brand.name}`, description: p.summary, type: "article" },
+  };
+};
+
+const WRAP_NARROW = "mx-auto w-full max-w-3xl px-6";
+
+function CaseStudy({
+  serverData,
+  response,
+  slug,
+}: {
+  serverData: ServerData;
+  response: SsrResponse;
+  slug: string;
+}) {
+  const p = use(resolveProject(serverData, slug));
+
+  if (!p) {
+    response.setStatus(404);
+    return (
+      <div className={`${WRAP_NARROW} py-24 text-center`}>
+        <p className="text-[15px] font-medium text-zinc-900">That case study doesn&apos;t exist.</p>
+        <Link href="/work" className="mt-2 inline-block text-[14px] font-medium text-brand">
+          ← Back to all work
+        </Link>
+      </div>
+    );
+  }
+
+  return (
+    <article className={`${WRAP_NARROW} py-14`}>
+      <Link href="/work" className="text-[13.5px] font-medium text-zinc-500 transition-colors hover:text-zinc-900">
+        ← All work
+      </Link>
+
+      <header className="mt-6">
+        <p className="font-mono text-[11px] uppercase tracking-[0.16em] text-brand">
+          {p.client}
+          {p.year ? ` · ${p.year}` : ""}
+        </p>
+        <h1 className="mt-3 text-balance text-[2rem] font-semibold leading-[1.08] tracking-[-0.02em] sm:text-[2.5rem]">
+          {p.title}
+        </h1>
+        <p className="mt-4 max-w-2xl text-[17px] leading-relaxed text-zinc-500">{p.summary}</p>
+        {p.tags.length > 0 ? (
+          <div className="mt-5 flex flex-wrap gap-1.5">
+            {p.tags.map((t) => (
+              <span key={t} className="rounded-full bg-zinc-100 px-2.5 py-0.5 text-[11px] font-medium text-zinc-600">
+                {t}
+              </span>
+            ))}
+          </div>
+        ) : null}
+        {p.liveUrl ? (
+          <a
+            href={p.liveUrl}
+            target="_blank"
+            rel="noopener noreferrer"
+            className="mt-6 inline-flex items-center rounded-full border border-zinc-300 px-4 py-2 text-[13.5px] font-medium text-zinc-700 transition-colors hover:border-zinc-400 hover:text-zinc-900"
+          >
+            Visit live site ↗
+          </a>
+        ) : null}
+      </header>
+
+      {/* Hero shot — drop in a real project image. */}
+      <div className="mt-10">
+        <ImagePlaceholder shape="landscape" title={`${p.title} — hero shot`} hint="Swap for an <img> in app/work/[slug]/page.tsx" />
+      </div>
+
+      <div className="mt-12 space-y-10">
+        <CaseSection label="The challenge" body={p.challenge} />
+        <CaseSection label="Our approach" body={p.approach} />
+        <CaseSection label="The outcome" body={p.outcome} />
+        {!p.challenge && !p.approach && !p.outcome ? (
+          <p className="text-[15px] leading-relaxed text-zinc-500">
+            A full write-up is on the way. In the meantime, {p.summary.toLowerCase()}
+          </p>
+        ) : null}
+      </div>
+
+      {/* Contact CTA */}
+      <div className="mt-14 rounded-2xl border border-zinc-200 bg-paper p-8 text-center">
+        <h2 className="text-[18px] font-semibold tracking-tight text-zinc-900">Have something like this in mind?</h2>
+        <p className="mx-auto mt-2 max-w-md text-[14px] leading-relaxed text-zinc-500">
+          We take on a few projects at a time. Tell us what you&apos;re building.
+        </p>
+        <Link
+          href="/#contact"
+          className="mt-5 inline-flex items-center rounded-full bg-brand px-5 py-2.5 text-[14px] font-medium text-white transition-opacity hover:opacity-90"
+        >
+          Start a project
+        </Link>
+      </div>
+
+      <SeedProjects />
+    </article>
+  );
+}
+
+function CaseSection({ label, body }: { label: string; body?: string | null }) {
+  if (!body) return null;
+  return (
+    <section>
+      <h2 className="font-mono text-[11px] uppercase tracking-[0.16em] text-zinc-400">{label}</h2>
+      <p className="mt-3 whitespace-pre-wrap text-[16px] leading-relaxed text-zinc-700">{body}</p>
+    </section>
+  );
+}
+
+// `app/work/[slug]/page.tsx` → `/work/:slug`. The case-study detail. Suspends on
+// the project lookup; renders a 404 (with a real status) when the slug is
+// unknown or the project is a draft.
+export default function CaseStudyPage({ params, serverData, response }: PageProps) {
+  return (
+    <div className="bg-white text-zinc-900">
+      <Suspense
+        fallback={
+          <div className={`${WRAP_NARROW} py-14`}>
+            <div className="h-4 w-20 animate-pulse rounded bg-zinc-100" />
+            <div className="mt-6 h-10 w-2/3 animate-pulse rounded bg-zinc-100" />
+            <div className="mt-4 h-4 w-full animate-pulse rounded bg-zinc-100" />
+            <div className="mt-10 aspect-[4/3] animate-pulse rounded-2xl bg-zinc-100" />
+          </div>
+        }
+      >
+        <CaseStudy serverData={serverData} response={response} slug={params.slug} />
+      </Suspense>
+    </div>
+  );
+}

package/templates/agency/app/work/page.tsx

@@ -0,0 +1,83 @@
+import React, { Suspense, use } from "react";
+import { Link, type Metadata, type PageProps, type ServerData } from "@pylonsync/react";
+import { WRAP, SectionHead, ProjectCard } from "@/components/marketing";
+import { SeedProjects } from "../seeder";
+import { siteConfig } from "@/lib/site.config";
+import { slugify, viewFromRow, type ProjectRow, type ProjectView } from "@/lib/agency";
+
+export const metadata: Metadata = {
+  title: `Work — ${siteConfig.brand.name}`,
+  description: `Case studies from ${siteConfig.brand.name}: ${siteConfig.work.headline}`,
+  openGraph: { title: `Work — ${siteConfig.brand.name}`, type: "website" },
+};
+
+// `app/work/page.tsx` → `/work`. The full portfolio: every PUBLISHED project,
+// server-rendered for SEO, each linking to its case study. Reads the Project
+// entity via serverData; falls back to the config case studies before the
+// portfolio is seeded so the page is never empty.
+function allFromConfig(): ProjectView[] {
+  return siteConfig.work.items.map((c) => ({
+    slug: c.slug || slugify(c.title),
+    title: c.title,
+    client: c.client,
+    summary: c.summary,
+    year: c.year ?? null,
+    tags: c.tags,
+  }));
+}
+
+function WorkGrid({ serverData }: { serverData: ServerData }) {
+  const rows = use(serverData.list<ProjectRow>("Project"));
+  const fromDb = rows
+    .filter((p) => p.published)
+    .sort((a, b) => a.order - b.order || (a.createdAt < b.createdAt ? -1 : 1))
+    .map(viewFromRow);
+  const projects = fromDb.length > 0 ? fromDb : allFromConfig();
+
+  if (projects.length === 0) {
+    return <p className="mt-10 text-[15px] text-zinc-500">No published work yet.</p>;
+  }
+  return (
+    <div className="mt-10 grid gap-x-6 gap-y-10 sm:grid-cols-2">
+      {projects.map((p) => (
+        <ProjectCard key={p.slug} p={p} />
+      ))}
+    </div>
+  );
+}
+
+export default function WorkIndexPage({ serverData }: PageProps) {
+  return (
+    <div className="bg-white text-zinc-900">
+      <section className={`${WRAP} py-16`}>
+        <SectionHead
+          eyebrow="Work"
+          title={siteConfig.work.headline}
+          body="A fuller look at what we've shipped — each one a short case study."
+        />
+        <Suspense
+          fallback={
+            <div className="mt-10 grid gap-x-6 gap-y-10 sm:grid-cols-2">
+              {[0, 1, 2, 3].map((i) => (
+                <div key={i}>
+                  <div className="aspect-[4/3] animate-pulse rounded-2xl bg-zinc-100" />
+                  <div className="mt-4 h-4 w-1/3 animate-pulse rounded bg-zinc-100" />
+                </div>
+              ))}
+            </div>
+          }
+        >
+          <WorkGrid serverData={serverData} />
+        </Suspense>
+
+        <div className="mt-12">
+          <Link href="/#contact" className="text-[14px] font-medium text-brand">
+            Have a project in mind? Start one →
+          </Link>
+        </div>
+      </section>
+
+      <SeedProjects />
+    </div>
+  );
+}

package/templates/agency/app.ts

@@ -8,21 +8,30 @@ import {
 } from "@pylonsync/sdk";
 
 // ---------------------------------------------------------------------------
-// agency — a site for a boutique studio that takes on a LIMITED number of
-// projects at a time. The realtime hook is scarcity: the hero shows how many
-// project slots are open this quarter, and the moment the owner books a new
-// client from the dashboard, that number drops for EVERYONE with the page
-// open — no refresh. Open it in two tabs to see it.
+// agency — a site + back-office for a boutique studio that takes on a LIMITED
+// number of projects at a time. The public site is a marketing page (hero,
+// services, selected work, case studies, process, team, testimonials, contact);
+// the owner dashboard is the studio's back-office (pipeline, portfolio, clients,
+// invoices). The realtime hook is scarcity: the hero shows how many project
+// slots are open this quarter, and the moment the owner books a client, that
+// number drops for EVERYONE with the page open — no refresh.
 //
-// Three entities:
-//   • Inquiry  — a "start a project" lead, with the prospect's name, email,
-//                company + budget + message. Pure PII → denies ALL client
-//                reads/writes. The public site never reads an Inquiry; the
-//                owner sees them only through the owner-gated inquiriesForOwner.
-//   • Capacity — a single, PII-FREE row the public page reads live: the current
-//                booking period + how many project slots are open. This is what
-//                makes the hero counter realtime. Booking an inquiry decrements
-//                it; the owner can reset it any time.
+// Entities, split by who can see them:
+//
+//   PUBLIC (marketing — read by anyone, written only by the owner's functions)
+//   • Capacity — a single PII-FREE row: the booking window + open slots. Drives
+//                the live "N slots open" hero counter.
+//   • Project  — a portfolio piece + case study (title, summary, tags, the
+//                challenge/approach/outcome write-up). `selected` flags the ones
+//                featured on the homepage; `published` hides drafts. Public-read
+//                so the marketing site + case-study pages render server-side.
+//
+//   PRIVATE (back-office — deny ALL client access; owner-gated functions only)
+//   • Inquiry  — a "start a project" lead (name, email, company, budget, msg).
+//   • Client   — a CRM contact (name, company, email, phone, notes, status).
+//   • Invoice  — a bill tied to a client (+ optional project): amount, status,
+//                issue/due dates. Money + client data, so it never leaves the
+//                owner-gated functions.
 //   • User     — the studio owner's account for the dashboard.
 // ---------------------------------------------------------------------------
 
@@ -62,6 +71,96 @@ const Capacity = entity(
   {},
 );
 
+// A portfolio piece + its case study. PUBLIC marketing content — no PII — so it
+// reads publicly: the homepage shows the `selected` ones, /work lists every
+// `published` one, and /work/[slug] renders the full case study, all
+// server-side for SEO + first paint. Only the owner's functions write it
+// (upsertProject / setProjectFlags / deleteProject / seedProjects), so a visitor
+// can read the portfolio but never edit it.
+//
+//   • selected  — featured on the homepage "Selected work" grid. Toggling it in
+//                 the dashboard re-curates the homepage.
+//   • published — false = a draft, hidden from the public site (the owner still
+//                 sees it in the dashboard, which reads every row).
+//   • order     — manual sort (ascending) within the grids.
+const Project = entity(
+  "Project",
+  {
+    title: field.string(),
+    slug: field.string(), // URL segment for /work/[slug]
+    client: field.string().default(""), // display label, e.g. "Fintech · 0→1"
+    summary: field.string().default(""), // one-liner on the card
+    year: field.string().optional(), // "2026"
+    tags: field.string().optional(), // comma-separated → chips
+    selected: field.boolean().default(false), // featured on the homepage
+    published: field.boolean().default(true), // false = draft, hidden publicly
+    order: field.int().default(0), // manual sort
+    // Case-study body — three short sections render on /work/[slug].
+    challenge: field.string().optional(),
+    approach: field.string().optional(),
+    outcome: field.string().optional(),
+    liveUrl: field.string().optional(),
+    createdAt: field.datetime().defaultNow(),
+  },
+  {
+    indexes: [
+      { name: "by_slug", fields: ["slug"], unique: true },
+      { name: "by_created", fields: ["createdAt"], unique: false },
+    ],
+  },
+);
+
+// A CRM contact — the people behind booked projects. Name/email/phone are PII,
+// so it denies ALL client access; the dashboard reads + writes it only through
+// the owner-gated functions (clientsForOwner / upsertClient / deleteClient).
+const Client = entity(
+  "Client",
+  {
+    name: field.string(),
+    company: field.string().optional(),
+    email: field.string().optional(),
+    phone: field.string().optional(),
+    status: field.string().default("prospect"), // "prospect" | "active" | "past"
+    notes: field.string().optional(),
+    createdAt: field.datetime().defaultNow(),
+  },
+  { indexes: [{ name: "by_created", fields: ["createdAt"], unique: false }] },
+);
+
+// A bill tied to a client (and optionally a project). This is MONEY plus client
+// data, so like Client it denies all client access — invoices are owner-only,
+// read + written through invoicesForOwner / upsertInvoice / setInvoiceStatus /
+// deleteInvoice. `amountCents` is stored as integer cents to avoid float money
+// bugs. `clientName` / `projectTitle` are denormalized for display so the list
+// renders without extra joins.
+const Invoice = entity(
+  "Invoice",
+  {
+    number: field.string(), // "INV-001"
+    clientId: field.string(),
+    clientName: field.string().default(""),
+    projectId: field.string().optional(),
+    projectTitle: field.string().optional(),
+    // Line items as a JSON-encoded array of { description, quantity, unitCents }
+    // (Pylon has no JSON column type, so it's a string). `amountCents` is the
+    // computed total, kept in sync on write so the list + totals don't have to
+    // re-parse every row. The case-study PDF + the invoice view render the items.
+    lineItems: field.string().optional(),
+    amountCents: field.int().default(0),
+    status: field.string().default("draft"), // "draft" | "sent" | "paid" | "overdue"
+    issuedAt: field.string().optional(), // ISO date "2026-06-01"
+    dueAt: field.string().optional(),
+    notes: field.string().optional(),
+    createdAt: field.datetime().defaultNow(),
+  },
+  {
+    indexes: [
+      { name: "by_client", fields: ["clientId"], unique: false },
+      { name: "by_created", fields: ["createdAt"], unique: false },
+    ],
+  },
+);
+
 // The studio owner's account. Email/password auth is built in against an entity
 // named "User" (passwordHash is server-only). The dashboard is gated to the
 // owner — see PYLON_OWNER_EMAIL in lib/owner.ts + the owner-only functions.
@@ -105,6 +204,45 @@ const capacityPolicy = policy({
   allowDelete: "false",
 });
 
+// Projects are PUBLIC to READ — they're marketing content (portfolio + case
+// studies), so the site renders them server-side for SEO. Clients can't WRITE
+// them: only the owner-gated functions do. Drafts (`published == false`) are
+// filtered out in the public read paths (the homepage, /work, /work/[slug]);
+// the dashboard reads every row. (We keep the read open rather than gating on
+// `published` in the policy so the owner's dashboard can list drafts with the
+// same live `db.useQuery` the public uses — simplest path, and a draft case
+// study is not sensitive the way a lead or an invoice is.)
+const projectPolicy = policy({
+  name: "project_public_read",
+  entity: "Project",
+  allowRead: "true",
+  allowInsert: "false",
+  allowUpdate: "false",
+  allowDelete: "false",
+});
+
+// Clients + Invoices are the studio's back-office: contact PII and money. Both
+// deny ALL client access, exactly like Inquiry — they're never read or written
+// over entity sync. The owner reaches them only through the owner-gated
+// functions, which check PYLON_OWNER_EMAIL and use ctx.db.unsafe.
+const clientPolicy = policy({
+  name: "client_private",
+  entity: "Client",
+  allowRead: "false",
+  allowInsert: "false",
+  allowUpdate: "false",
+  allowDelete: "false",
+});
+
+const invoicePolicy = policy({
+  name: "invoice_private",
+  entity: "Invoice",
+  allowRead: "false",
+  allowInsert: "false",
+  allowUpdate: "false",
+  allowDelete: "false",
+});
+
 const userPolicy = policy({
   name: "user_self",
   entity: "User",
@@ -117,13 +255,24 @@ const userPolicy = policy({
 const manifest = buildManifest({
   name: "__APP_NAME__",
   version: "0.1.0",
-  entities: [Inquiry, Capacity, User],
-  // submitInquiry / seedCapacity (public) + inquiriesForOwner / bookInquiry /
-  // declineInquiry / setCapacity (owner-gated) live in functions/ and are
-  // discovered automatically — they don't need listing here.
+  entities: [Inquiry, Capacity, Project, Client, Invoice, User],
+  // Functions live in functions/ and are discovered automatically:
+  //   public:  submitInquiry, seedCapacity, seedProjects
+  //   owner:   inquiriesForOwner, bookInquiry, declineInquiry, setCapacity,
+  //            upsertProject, setProjectFlags, deleteProject,
+  //            clientsForOwner, upsertClient, deleteClient,
+  //            invoicesForOwner, upsertInvoice, setInvoiceStatus, deleteInvoice,
+  //            seedStudioBackoffice
   queries: [],
   actions: [],
-  policies: [inquiryPolicy, capacityPolicy, userPolicy],
+  policies: [
+    inquiryPolicy,
+    capacityPolicy,
+    projectPolicy,
+    clientPolicy,
+    invoicePolicy,
+    userPolicy,
+  ],
   // Email/password is on by default against the User entity above. No orgs, no
   // billing — a single studio is single-tenant (one business, one owner).
   auth: auth(),