@pylonsync/create-pylon 0.3.279 → 0.3.281

package/bin/create-pylon.js

@@ -63,10 +63,10 @@ const PYLON_VERSION = JSON.parse(
 // ---------------------------------------------------------------------------
 // Templates + platforms registry
 //
-// Each template declares which platforms it supports — `b2b` is web/mac
-// only because the demo flow (org switcher, member invite, RBAC admin
-// panel) is desktop-shaped and porting it to mobile would be busy work
-// without value. Pick a different template if you want mobile.
+// Each template declares which platforms it supports. Unified templates
+// (the default and every archetype) are a single full-stack SSR app and
+// take no platforms at all. The few non-unified monorepo templates list
+// the platforms whose demo flow they actually ship.
 // ---------------------------------------------------------------------------
 
 // `web` and `vite` both render into apps/web — they're mutually
@@ -98,12 +98,6 @@ const TEMPLATE_REGISTRY = {
 		platforms: [],
 		unified: true,
 	},
-	b2b: {
-		blurb:
-			"Multi-tenant SaaS — orgs, members, roles, tenant-scoped data. One SSR app.",
-		platforms: [],
-		unified: true,
-	},
 	consumer: {
 		blurb:
 			"Social feed — live posts + likes, public-read, owner-write. One SSR app.",
@@ -245,7 +239,6 @@ ${tmplLines.join("\n")}
 Examples:
   npm create @pylonsync/pylon my-app                        # default — SaaS landing + multi-tenant dashboard
   npm create @pylonsync/pylon my-app --template todo        # live, optimistic todo (SSR, one port)
-  npm create @pylonsync/pylon my-app --template b2b          # minimal multi-tenant (orgs, members, RBAC)
   npm create @pylonsync/pylon my-app --template chat         # realtime live chat room
   npm create @pylonsync/pylon my-app --template waitlist     # coming-soon landing + live signup counter
   npm create @pylonsync/pylon my-app --template local-service # appointment business + live booking availability
@@ -383,8 +376,8 @@ if (!TEMPLATES_AVAILABLE.includes(flags.template)) {
 }
 
 // Reject combos a template doesn't yet support — better to fail loud
-// than to scaffold an incomplete tree (e.g. b2b + expo would skip
-// frontend entirely and leave the user with a half-empty workspace).
+// than to scaffold an incomplete tree (e.g. a web-only template + expo
+// would skip frontend entirely and leave a half-empty workspace).
 const supportedPlatforms = TEMPLATE_REGISTRY[flags.template].platforms;
 const invalidForTemplate = platforms.filter(
 	(p) => !supportedPlatforms.includes(p),

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pylonsync/create-pylon",
-  "version": "0.3.279",
+  "version": "0.3.281",
   "description": "Scaffold a new Pylon app — realtime backend + web/mobile/expo frontends in one command. Run via `npm create @pylonsync/pylon@latest`.",
   "publishConfig": {
     "access": "public"

package/templates/backend/chat/apps/api/schema.ts

@@ -15,7 +15,7 @@ import {
 //
 // Public reads inside a room (anyone can browse). Writes require a
 // signed-in user. For private rooms in production, add a Membership
-// entity and gate Room reads on it (mirrors the b2b pattern).
+// entity and gate Room reads on it (the standard multi-tenant pattern).
 // ---------------------------------------------------------------------------
 
 const Room = entity("Room", {

package/templates/default/app/auth-form.tsx

@@ -1,19 +1,29 @@
 "use client";
 
 import React, { useState } from "react";
-import { passwordLogin, passwordRegister, ApiError } from "@pylonsync/client";
+import { db } from "@pylonsync/react";
+import {
+  passwordLogin,
+  passwordRegister,
+  persistSession,
+  createOrg,
+  ApiError,
+} from "@pylonsync/client";
 
 // The email/password form, shared by /login and /signup. It calls the built-in
 // auth API directly — `passwordLogin` / `passwordRegister` (from
 // @pylonsync/client) POST to `/api/auth/password/*`.
 //
-// On success the server sets an HttpOnly session cookie on the response. We do
-// a full navigation to /dashboard rather than a client transition: the fresh
-// page load hands that cookie to the SSR runtime (which resolves auth and
-// renders the dashboard server-side) and to the sync engine (which
-// authenticates with the same cookie via `credentials: include`). Because the
-// cookie is HttpOnly it can never be read by JavaScript, so there is no session
-// token sitting in `localStorage` for an XSS to lift.
+// On success the server sets a session cookie (used by the SSR runtime to
+// resolve auth on the next full navigation) AND returns the session token. We
+// call `persistSession` with that token so the sync engine adopts the new
+// identity: it writes the token to storage (overwriting any earlier guest
+// token a demo flow may have left behind) and re-fetches `/api/auth/me`.
+//
+// Skipping this was a real footgun: a stale anonymous guest token left in
+// localStorage would be sent as a `Bearer` on the engine's auth calls, where
+// the server prefers it over the cookie — so `selectOrg` would 401 with
+// "anonymous session" even though the cookie was a valid user.
 export function AuthForm({ mode }: { mode: "login" | "signup" }) {
   const [email, setEmail] = useState("");
   const [password, setPassword] = useState("");
@@ -26,14 +36,27 @@ export function AuthForm({ mode }: { mode: "login" | "signup" }) {
     setPending(true);
     try {
       if (mode === "login") {
-        await passwordLogin({ email, password });
+        const session = await passwordLogin({ email, password });
+        // Adopt the real identity locally before navigating — otherwise a
+        // leftover guest token shadows this session on the sync engine's calls.
+        persistSession(session);
         // Full navigation: the SSR dashboard re-renders with the new cookie.
         window.location.assign("/dashboard");
       } else {
-        await passwordRegister({ email, password });
-        // New accounts have no workspace yet — send them through first-run
-        // onboarding (which redirects to /dashboard once they're in an org).
-        window.location.assign("/onboarding");
+        const session = await passwordRegister({ email, password });
+        persistSession(session);
+        // Auto-provision a first workspace so new accounts land in a ready
+        // dashboard instead of an empty first-run screen. Named "My Workspace"
+        // (renamable in Settings) and made the active tenant. Either way we land
+        // on /dashboard — if provisioning failed here, the dashboard's org-less
+        // safety net retries it.
+        try {
+          const org = await createOrg("My Workspace");
+          await db.sync.selectOrg(org.id);
+        } catch {
+          // Swallowed — the dashboard provisions on load if there's still no org.
+        }
+        window.location.assign("/dashboard");
       }
     } catch (err) {
       setError(messageFor(err));

package/templates/default/app/dashboard/billing/page.tsx

@@ -19,13 +19,13 @@ export default function BillingPage({ auth, response, serverData }: PageProps) {
     response.redirect("/login");
     return null;
   }
+  if (!auth.tenant_id) {
+    response.redirect("/dashboard");
+    return null;
+  }
   const me = use(serverData.get<{ email?: string }>("User", auth.user_id));
-  const org = auth.tenant_id
-    ? use(serverData.get<{ name?: string }>("Org", auth.tenant_id))
-    : null;
-  const subs = auth.tenant_id
-    ? use(serverData.list<Subscription>("StripeSubscription"))
-    : [];
+  const org = use(serverData.get<{ name?: string }>("Org", auth.tenant_id));
+  const subs = use(serverData.list<Subscription>("StripeSubscription"));
   const subscription =
     subs.find(
       (s) => s.referenceId === auth.tenant_id && ACTIVE.includes(s.status),

package/templates/default/app/dashboard/dashboard-client.tsx

@@ -46,7 +46,7 @@ function NoOrg() {
         projects and members are private to it.
       </p>
       <a
-        href="/onboarding"
+        href="/dashboard"
         className="mt-4 inline-flex h-9 items-center rounded-lg bg-zinc-900 px-4 text-[13px] font-medium text-white transition-colors hover:bg-zinc-700"
       >
         Set up your workspace
@@ -570,8 +570,8 @@ function SettingsView({
 }
 
 // Real, irreversible delete: type the workspace name to confirm, then call the
-// framework's owner-gated DELETE endpoint, drop the active org, and bounce back
-// to onboarding.
+// framework's owner-gated DELETE endpoint, drop the active org, and bounce to
+// the dashboard — which selects another workspace or provisions a fresh one.
 function DeleteOrg({
   org,
   onDeleted,
@@ -591,7 +591,7 @@ function DeleteOrg({
     try {
       await deleteOrg(org.id);
       await onDeleted();
-      window.location.assign("/onboarding");
+      window.location.assign("/dashboard");
     } catch {
       setError("Delete failed. Try again.");
       setDeleting(false);

package/templates/default/app/dashboard/members/page.tsx

@@ -16,10 +16,12 @@ export default function MembersPage({ auth, response, serverData }: PageProps) {
     response.redirect("/login");
     return null;
   }
+  if (!auth.tenant_id) {
+    response.redirect("/dashboard");
+    return null;
+  }
   const me = use(serverData.get<{ email?: string }>("User", auth.user_id));
-  const org = auth.tenant_id
-    ? use(serverData.get<{ name?: string }>("Org", auth.tenant_id))
-    : null;
+  const org = use(serverData.get<{ name?: string }>("Org", auth.tenant_id));
   return (
     <DashboardShell
       active="members"

package/templates/default/app/dashboard/page.tsx

@@ -1,6 +1,7 @@
 import React, { use } from "react";
 import { type Metadata, type PageProps } from "@pylonsync/react";
 import { DashboardShell } from "@/components/dashboard-shell";
+import { ProvisionWorkspace } from "./provision-workspace";
 import {
   Overview,
   type Project,
@@ -28,10 +29,14 @@ export default function DashboardPage({
     response.redirect("/login");
     return null;
   }
+  // No active workspace (signup's auto-provision failed, or the user left/
+  // deleted their last org). Every read below is tenant-scoped, so instead of
+  // an empty shell, provision one client-side and reload into a ready dashboard.
+  if (!auth.tenant_id) {
+    return <ProvisionWorkspace />;
+  }
   const me = use(serverData.get<{ email?: string }>("User", auth.user_id));
-  const org = auth.tenant_id
-    ? use(serverData.get<{ name?: string }>("Org", auth.tenant_id))
-    : null;
+  const org = use(serverData.get<{ name?: string }>("Org", auth.tenant_id));
   const projects = use(serverData.list<Project>("Project"));
   const members = use(serverData.list<OrgMemberRow>("OrgMember"));
   // The OrgMember read policy returns this user's memberships across every org,
@@ -39,9 +44,7 @@ export default function DashboardPage({
   const memberCount = members.filter((m) => m.orgId === auth.tenant_id).length;
   // Active-plan badge from the workspace's Stripe subscription (Free until one
   // exists). Scoped to the active tenant by the plugin's read policy.
-  const subs = auth.tenant_id
-    ? use(serverData.list<Subscription>("StripeSubscription"))
-    : [];
+  const subs = use(serverData.list<Subscription>("StripeSubscription"));
   const active = subs.find((s) =>
     ["active", "trialing", "past_due"].includes(s.status),
   );

package/templates/default/app/dashboard/projects/page.tsx

@@ -19,10 +19,12 @@ export default function ProjectsPage({
     response.redirect("/login");
     return null;
   }
+  if (!auth.tenant_id) {
+    response.redirect("/dashboard");
+    return null;
+  }
   const me = use(serverData.get<{ email?: string }>("User", auth.user_id));
-  const org = auth.tenant_id
-    ? use(serverData.get<{ name?: string }>("Org", auth.tenant_id))
-    : null;
+  const org = use(serverData.get<{ name?: string }>("Org", auth.tenant_id));
   const projects = use(serverData.list<Project>("Project"));
   return (
     <DashboardShell

package/templates/default/app/dashboard/provision-workspace.tsx

@@ -0,0 +1,74 @@
+"use client";
+
+import React, { useEffect, useState } from "react";
+import { createOrg, listOrgs } from "@pylonsync/client";
+import { db } from "@pylonsync/react";
+
+// Org-less safety net. New signups get "My Workspace" auto-created in the signup
+// flow, so this only renders in edge cases: that creation failed, or a user left
+// or deleted their last workspace. Pick an existing org if one turned up,
+// otherwise create "My Workspace", make it active, and reload into the ready
+// dashboard. No multi-step onboarding — there's nothing for the user to decide.
+export function ProvisionWorkspace() {
+  const [error, setError] = useState<string | null>(null);
+
+  useEffect(() => {
+    let cancelled = false;
+    void (async () => {
+      try {
+        const orgs = await listOrgs();
+        const target = orgs[0] ?? (await createOrg("My Workspace"));
+        await db.sync.selectOrg(target.id);
+        if (!cancelled) window.location.reload();
+      } catch (err) {
+        if (!cancelled) {
+          setError(
+            err instanceof Error
+              ? err.message
+              : "Couldn't set up your workspace.",
+          );
+        }
+      }
+    })();
+    return () => {
+      cancelled = true;
+    };
+  }, []);
+
+  async function signOut() {
+    await db.sync.signOut();
+    window.location.assign("/login");
+  }
+
+  return (
+    <div className="flex min-h-screen flex-col items-center justify-center gap-4 bg-zinc-50 px-6 text-center">
+      {error ? (
+        <>
+          <p className="max-w-sm text-sm text-red-700">{error}</p>
+          <button
+            type="button"
+            onClick={() => window.location.reload()}
+            className="inline-flex h-9 items-center rounded-lg bg-zinc-900 px-4 text-[13px] font-medium text-white transition-colors hover:bg-zinc-700"
+          >
+            Try again
+          </button>
+        </>
+      ) : (
+        <>
+          <span
+            aria-hidden
+            className="size-5 animate-spin rounded-full border-2 border-zinc-300 border-t-zinc-900"
+          />
+          <p className="text-sm text-zinc-500">Setting up your workspace…</p>
+        </>
+      )}
+      <button
+        type="button"
+        onClick={signOut}
+        className="mt-1 text-[13px] text-zinc-400 underline underline-offset-2 transition-colors hover:text-zinc-600"
+      >
+        Wrong account? Sign out
+      </button>
+    </div>
+  );
+}

package/templates/default/app/dashboard/settings/page.tsx

@@ -20,10 +20,12 @@ export default function SettingsPage({ auth, response, serverData }: PageProps)
     response.redirect("/login");
     return null;
   }
+  if (!auth.tenant_id) {
+    response.redirect("/dashboard");
+    return null;
+  }
   const me = use(serverData.get<{ email?: string }>("User", auth.user_id));
-  const org = auth.tenant_id
-    ? use(serverData.get<OrgInfo>("Org", auth.tenant_id))
-    : null;
+  const org = use(serverData.get<OrgInfo>("Org", auth.tenant_id));
   const members = use(serverData.list<OrgMemberRow>("OrgMember"));
   const memberCount = members.filter(
     (m) => m.orgId === auth.tenant_id,

package/templates/default/app/layout.tsx

@@ -182,7 +182,7 @@ export default function RootLayout({ children, url, auth }: LayoutProps) {
   // (not a substring) so a future marketing slug that happens to contain one
   // of these words — e.g. /products/dashboard-tools — keeps its chrome.
   const path = (url ?? "").split("?")[0];
-  const BARE_PREFIXES = ["/login", "/signup", "/onboarding", "/dashboard"];
+  const BARE_PREFIXES = ["/login", "/signup", "/dashboard"];
   const isBare = BARE_PREFIXES.some((p) => path === p || path.startsWith(p + "/"));
   return (
     <html

package/templates/default/components/dashboard-shell.tsx

@@ -63,6 +63,7 @@ export function DashboardShell({
               A soft client navigation (router.push) re-fetches the SSR page —
               all data updates — without the full-reload white flash. */}
           <OrganizationSwitcher
+            hidePersonal
             initialActiveName={orgName}
             onSwitched={() => router.push("/dashboard")}
           />

package/templates/b2b/AGENTS.md

@@ -1,61 +0,0 @@
-# AGENTS.md — working in a Pylon project
-
-Operating rules for a coding agent in this Pylon app. Pylon is a Rails-like framework for realtime apps: you declare entities, policies, and server functions in TypeScript, and a single Rust binary (`pylon`) serves the API, auth, sync, WebSocket, SSE, and native React 19 SSR — one process, one port. The full API reference is at **/llms-full.txt** (served at `/llms-full.txt`; in the repo at `apps/web/public/llms-full.txt`). Read it before guessing an API name.
-
-## Directory conventions
-
-**Unified SSR app:**
-- `app.ts` — data model + manifest (`entity()` + `field.*`, queries/actions/policies, `routes: await discoverAppRoutes()`). Ends with `console.log(JSON.stringify(manifest))`.
-- `app/` — file-based SSR routes. `app/page.tsx` → `/`, `app/about/page.tsx` → `/about`, `app/blog/[slug]/page.tsx` → `/blog/:slug`. `app/layout.tsx` is the shell; `app/error.tsx` / `app/not-found.tsx` are boundaries.
-- `app/globals.css` — Tailwind v4 entrypoint (auto-compiled and injected).
-- `functions/` — server functions, one per file, `default`-exported.
-- `.pylon/` — local dev state (sqlite, jobs, sessions, uploads). Created by `pylon dev`. Do not commit.
-
-**Monorepo app:** backend is `apps/api/` (entry `apps/api/schema.ts`, handlers in `apps/api/functions/`); frontend in `apps/web/`. `pylon.manifest.json` / `pylon.client.ts` are generated — do not hand-edit.
-
-## The core authoring loop
-
-1. **Define an entity** — `entity("Thing", { name: field.string(), done: field.boolean().default(false) })`. Modifiers: `.optional()`, `.unique()`, `.readonly()` (settable on insert, rejected on client update — use for `authorId`/`orgId`), `.serverOnly()` (never in HTTP responses), `.encrypted()` (AEAD at rest, needs `PYLON_ENCRYPTION_KEY`), `.crdt("text")` (collaborative).
-2. **Write a policy** — `policy({ entity: "Thing", allowRead, allowInsert, allowUpdate, allowDelete })` with CEL-like expressions over `auth.*` / `data.*` (e.g. `"auth.userId == data.authorId"`). **Omitted actions DENY by default.** Wide-open dev policies (`allow*: "true"`) are flagged by `pylon lint` — tighten before shipping.
-3. **Author a function** in `functions/<name>.ts` — `query` (read-only), `mutation` (transactional read+write), or `action` (external I/O, no direct `ctx.db`). Import `{ query, mutation, action, v }` from `@pylonsync/functions`. `auth` defaults to `"user"` (secure-by-default); set `"public"` explicitly for unauthenticated access. Use `ctx.db.*`, `ctx.auth.userId`, `ctx.error(code, msg)`.
-4. **Read it on the client** — `db.useQuery("Thing")` (live, re-renders on any write) or `db.useQueryOne("Thing", id)`. Call functions with `db.fn(name, args)` / `callFn`. On SSR pages, read via `use(serverData.list("Thing"))` inside `<Suspense>`.
-
-## Key gotchas
-
-- **Policies deny by default; server functions BYPASS them.** Direct client CRUD (`/api/entities/*`) and sync are policy-checked. Functions run with full DB access — enforce trust with `ctx.auth` checks inside the handler, not policies.
-- **Type page props from the SDK, don't hand-roll them.** `import type { PageProps, Metadata } from "@pylonsync/react"`. Every page/layout gets `{ url, params, searchParams, auth, response, serverData }`; `PageProps<{ slug: string }>` types a `[slug]` route's params. Request headers/cookies are intentionally NOT on `PageProps` — they're server-only and stripped from hydration, so reading them in the render would mismatch.
-- **Anonymous output caching is opt-in + earned.** `export const revalidate = 60` (seconds) on a page makes it CDN-cacheable (`public, s-maxage=60`) — but ONLY if the render is auth-INDEPENDENT: it must NOT read `props.auth` (reading it at all opts out, even for anonymous), set no cookie, and the app must not run strict per-caller policies (`PYLON_STRICT_FN_POLICIES`). `export const dynamic = "force-static"` caches until the next deploy; `"force-dynamic"` never caches. Fail-closed: without the opt-in (or if any condition fails) the page is `no-cache`. A page that reads `auth` or sets a cookie is never shared. The SAME earned render is also kept in an **origin disk cache** (`.pylon/.cache/ssr`): a cookie-less GET with no query string is served straight off disk for the TTL — skipping the render entirely — then re-rendered live when stale. The disk cache is namespaced per deploy (wiped on each new build) and OFF in `pylon dev` (so an edit is never masked by a stale entry); invalidation is by the `revalidate` TTL or the next deploy.
-- **No-JS forms use `route.ts` + `<Form>`.** Drop `app/.../route.ts` exporting `export const POST: RouteHandler = async ({ form, db, response, auth }) => { await db.insert("X", {...}); response.redirect("/x?ok=1"); }` (303 POST-redirect-GET by default). Render `<Form action="/x">` (from @pylonsync/react) with plain `<input name=...>` — works with JS off (native POST→handler→redirect) and is enhanced to no-reload when JS is on. The handler's `db` is read+write (mutation trust model — gate on `auth`); CSRF is automatic (Origin gate + SameSite=Lax). Multipart/file uploads aren't supported yet — use urlencoded forms + `/api/files`.
-- **`loading.tsx` streams a skeleton while the page's data resolves.** Drop `app/.../loading.tsx` (default export, page props) and the nearest one becomes a route-level Suspense fallback: Pylon flushes the shell + skeleton immediately, then reveals the real page when its top-level `use(serverData…)` resolves (no blank page). It only shows when the PAGE suspends — a page that wraps its own `<Suspense>` around a child (like `/dashboard` in this template) handles that itself. The skeleton is SERVER-ONLY: don't read `serverData` in it. A page with no `loading.tsx` is buffered (unchanged).
-- **`export const streaming = true` streams a page's OWN inner `<Suspense>` boundaries.** Without it (and without a `loading.tsx`), a page is BUFFERED — the whole document, including suspended children, resolves before the first byte. Opt in and the shell + each inner `<Suspense>` fallback flush immediately, then each boundary's real content streams in as its data resolves (multi-boundary progressive streaming). It's opt-in because it changes the response timing contract: a streaming render commits its HTTP head BEFORE suspended subtrees finish, so (a) it's never CDN/disk cacheable — don't combine with `export const revalidate`; (b) `response.setStatus/setCookie/redirect/notFound` only take effect from the SYNCHRONOUS shell render — a call from inside a suspended subtree is dropped (the runtime logs a loud warning naming what was lost); (c) a `throw` from a deep `<Suspense>` child resolves via its nearest `error.tsx` at HTTP 200, not a 5xx. Hydration is clean for any number of boundaries (the data blob ships before hydration runs). Type the config with `import type { RouteSegmentConfig } from "@pylonsync/react"`.
-- **`error.tsx` / `not-found.tsx` boundaries are HYDRATED (interactive).** `app/.../error.tsx` catches a throw below it (HTTP 500) and receives `{ error: { message, digest }, reset }` (`import type { ErrorBoundaryProps }`) — `reset()` re-attempts the route; the stack NEVER reaches the client (dev overlay + logs only). `app/.../not-found.tsx` renders at 404 (also for `response.notFound()`) and gets the page props (`NotFoundProps`), no `reset`. Both run useState/onClick/hooks.
-- **Client navigation hooks live in @pylonsync/react.** `useRouter()` → `{ push, replace, back, forward, refresh, prefetch }`; `useSearchParams()` → reactive `URLSearchParams`; `usePathname()` → reactive pathname. The hooks are CLIENT-reactive — during SSR they return defaults (empty params / "/"); for server-side URL values read the `url` / `searchParams` page props.
-- **Dynamic + catch-all routes follow Next conventions.** `app/blog/[slug]/page.tsx` → `params.slug`. `app/docs/[...path]/page.tsx` is a catch-all (matches `/docs/a/b/c`; `params.path === "a/b/c"` — `.split("/")` for segments). `app/shop/[[...filters]]/page.tsx` is an optional catch-all (also matches the bare `/shop`, with `params.filters === ""`). A catch-all must be the last segment; static beats dynamic beats catch-all on overlap.
-- **`serverData` (SSR) is READ-ONLY.** No write methods; the runtime rejects write frames (`SSR_WRITE_FORBIDDEN`). Mutations belong in actions/functions, never in a page render.
-- **`response.*` / `response.redirect()` / `response.notFound()` must fire in the synchronous shell render**, before any `await` / `<Suspense>`. The HTTP head commits when the shell is ready — status/headers/cookies set from a suspended subtree are lost, and `redirect`/`notFound` thrown below a Suspense boundary are swallowed.
-- **`ctx.llm` and `ctx.connections` are on mutation + action only, NOT query** (reactive purity). `action` has no direct `ctx.db` — use `ctx.runQuery` / `ctx.runMutation`.
-- **It's `db.useQueryOne`, not `useOne`.** Validators and field types have aliases: `v.bool`/`v.boolean`, `v.float`/`v.number`.
-- **There is no `ctx.files` or `defineWorkflow`/`defineJob`.** Files go through `<FileUpload>` + `/api/files/*`; deferred execution is `ctx.scheduler.runAfter/runAt/cancel`.
-
-## Use the CLI — don't guess
-
-| Need | Command |
-|---|---|
-| Run the app (SSR + API, hot reload, one port `:4321`) | `pylon dev` (or `npm run dev`) |
-| Regenerate manifest + typed client | `pylon codegen` (Swift client: `pylon codegen client --target swift`) |
-| Validate / diff / push schema | `pylon schema check` \| `diff` \| `push` |
-| Migrations | `pylon migrate create <name>` \| `plan` \| `apply` |
-| Lint policies (PYL001–PYL004) | `pylon lint --strict` |
-| Tests | `pylon test` |
-| Adversarial security probe | `pylon test:security` |
-| Inspect cloud request logs (agent-safe) | `pylon logs --json --limit 50` |
-| Inspect data / entities | `pylon data entities` \| `pylon data list <Entity>` |
-| Call a function | `pylon fn <name> key=value` |
-| Health snapshot | `pylon status` |
-| Build for prod | `pylon build` |
-| Deploy (Pylon Cloud by default) | `pylon deploy` |
-| Look up an error code | `pylon explain <CODE>` |
-
-`--json` works on every command for machine-readable output. Prefer one-shot/agent-safe flags (`pylon logs --limit N`, not a blocking `--follow`).
-
-For full signatures, env vars, the complete CLI, and SSR/client/server-primitive details: **/llms-full.txt**.

package/templates/b2b/README.md

@@ -1,62 +0,0 @@
-# __APP_NAME__
-
-A multi-tenant SaaS starter on [Pylon](https://pylonsync.com) — email/password
-accounts, organizations with members + roles, and tenant-scoped data, all
-server-rendered from one binary on one port. No Next.js, no separate API server.
-
-## Develop
-
-```bash
-__RUN_DEV__
-```
-
-Open http://localhost:4321. Sign up, create an organization, and you land in a
-workspace with **tenant-scoped projects** and a **members** panel. Create a
-second org and switch between them — each org's projects are private to it.
-Edit any file under `app/` and save — the page reloads instantly.
-
-## Layout
-
-```
-app.ts                       User + Org/OrgMember/OrgInvite + tenant-scoped Project
-app/page.tsx                 "/" — server-rendered, auth-aware homepage
-app/login,signup/            email/password (POST /api/auth/password/*)
-app/dashboard/               "/dashboard" — authed; org switcher + projects + members
-app/dashboard/dashboard-client.tsx   the workspace client island
-```
-
-## How multi-tenancy works
-
-Organizations are a **framework primitive**. Declaring `Org` / `OrgMember` /
-`OrgInvite` with the framework's field names lights up `/api/auth/orgs/*`
-(create/list orgs, members, invites) and `/api/auth/select-org` (switch your
-active tenant) — driven by `<OrganizationSwitcher>` from `@pylonsync/client`.
-
-`select-org` checks your `OrgMember` row before committing, then sets the
-session's `tenantId`. Your data lives in tenant-scoped entities:
-
-```ts
-allowRead:   "auth.tenantId == data.orgId"
-allowInsert: "auth.tenantId == data.orgId"
-```
-
-So `db.useQuery("Project")` returns only your **active org's** projects, and a
-client literally cannot read or write another tenant's rows — switch orgs and
-the list changes. **RBAC** is built in too: the framework gates invites/member
-management to org admins, so a `member` calling `createInvite` gets a 403.
-
-## Grow it
-
-- **Add tenant data:** new `entity()` with an `orgId` + the same two policy
-  lines. That's a new tenant-scoped table.
-- **Custom roles:** read `OrgMember.role` in a server function and gate writes
-  with `ctx.elevate({ admin })` / `ctx.db.unsafe.*`.
-- **SSO / SAML:** per-org SSO is built in at `/api/auth/orgs/:id/sso/*`.
-
-## Deploy
-
-```bash
-pylon deploy
-```
-
-Docs: https://docs.pylonsync.com

package/templates/b2b/app/auth-form.tsx

@@ -1,142 +0,0 @@
-"use client";
-
-import React, { useState } from "react";
-import { passwordLogin, passwordRegister, ApiError } from "@pylonsync/client";
-import { Button } from "@/components/ui/button";
-
-// The email/password form, shared by /login and /signup. It calls the built-in
-// auth API directly — `passwordLogin` / `passwordRegister` (from
-// @pylonsync/client) POST to `/api/auth/password/*`.
-//
-// On success the server sets an HttpOnly session cookie on the response. We do
-// a full navigation to /dashboard rather than a client transition: the fresh
-// page load hands that cookie to the SSR runtime (which resolves auth and
-// renders the dashboard server-side) and to the sync engine (which
-// authenticates with the same cookie via `credentials: include`). Because the
-// cookie is HttpOnly it can never be read by JavaScript, so there is no
-// session token sitting in `localStorage` for an XSS to lift. (Cross-origin or
-// native clients, which can't rely on the cookie, use the token-based path via
-// `persistSession` instead — not needed here, same origin.)
-export function AuthForm({ mode }: { mode: "login" | "signup" }) {
-  const [email, setEmail] = useState("");
-  const [password, setPassword] = useState("");
-  const [displayName, setDisplayName] = useState("");
-  const [error, setError] = useState<string | null>(null);
-  const [pending, setPending] = useState(false);
-
-  async function onSubmit(e: React.FormEvent) {
-    e.preventDefault();
-    setError(null);
-    setPending(true);
-    try {
-      if (mode === "login") {
-        await passwordLogin({ email, password });
-      } else {
-        await passwordRegister({
-          email,
-          password,
-          displayName: displayName.trim() || undefined,
-        });
-      }
-      // Full navigation: the SSR dashboard re-renders with the new cookie.
-      window.location.assign("/dashboard");
-    } catch (err) {
-      setError(messageFor(err));
-      setPending(false); // keep the form up to retry (success navigates away)
-    }
-  }
-
-  return (
-    <form onSubmit={onSubmit} className="space-y-4">
-      {mode === "signup" ? (
-        <Field
-          label="Name"
-          value={displayName}
-          onChange={setDisplayName}
-          autoComplete="name"
-          placeholder="optional"
-        />
-      ) : null}
-      <Field
-        label="Email"
-        type="email"
-        value={email}
-        onChange={setEmail}
-        required
-        autoComplete="email"
-        placeholder="you@example.com"
-      />
-      <Field
-        label="Password"
-        type="password"
-        value={password}
-        onChange={setPassword}
-        required
-        autoComplete={mode === "login" ? "current-password" : "new-password"}
-        placeholder={mode === "signup" ? "at least 8 characters" : undefined}
-      />
-      {error ? (
-        <p className="rounded-md border border-red-600/30 bg-red-600/10 px-3 py-2 text-sm text-red-700">
-          {error}
-        </p>
-      ) : null}
-      <Button type="submit" disabled={pending} className="w-full">
-        {pending ? "…" : mode === "login" ? "Sign in" : "Create account"}
-      </Button>
-    </form>
-  );
-}
-
-function Field({
-  label,
-  value,
-  onChange,
-  type = "text",
-  required,
-  autoComplete,
-  placeholder,
-}: {
-  label: string;
-  value: string;
-  onChange: (v: string) => void;
-  type?: string;
-  required?: boolean;
-  autoComplete?: string;
-  placeholder?: string;
-}) {
-  return (
-    <label className="block space-y-1.5">
-      <span className="text-sm font-medium">{label}</span>
-      <input
-        type={type}
-        value={value}
-        onChange={(e) => onChange(e.target.value)}
-        required={required}
-        autoComplete={autoComplete}
-        placeholder={placeholder}
-        className="flex h-9 w-full rounded-md border border-input bg-transparent px-3 py-1 text-sm shadow-sm outline-none focus-visible:ring-1 focus-visible:ring-ring"
-      />
-    </label>
-  );
-}
-
-// Map the framework's auth error codes to friendly copy. `ApiError` carries a
-// stable `.code` (and `.status`) so you branch on the code, not the message.
-function messageFor(err: unknown): string {
-  if (err instanceof ApiError) {
-    switch (err.code) {
-      case "INVALID_CREDENTIALS":
-        return "Wrong email or password.";
-      case "USER_EXISTS":
-        return "That email is already in use — sign in instead.";
-      case "WEAK_PASSWORD":
-        return "Pick a stronger password (at least 8 characters).";
-      case "RATE_LIMITED":
-        return "Too many attempts — try again in a minute.";
-      default:
-        return err.message;
-    }
-  }
-  if (err instanceof Error) return err.message;
-  return "Something went wrong. Try again.";
-}