@pylonsync/create-pylon 0.3.295 → 0.3.297

package/templates/shop/app.ts

@@ -5,6 +5,7 @@ import {
   auth,
   buildManifest,
   discoverAppRoutes,
+  font,
 } from "@pylonsync/sdk";
 
 // ---------------------------------------------------------------------------
@@ -126,6 +127,20 @@ const manifest = buildManifest({
   actions: [],
   policies: [productPolicy, orderPolicy, userPolicy],
   auth: auth(),
+  // Self-hosted Inter (next/font parity): the build fetches the woff2, serves it
+  // same-origin (no third-party request, no FOUT), preloads it, and synthesizes a
+  // size-adjusted fallback face so there's no layout shift. globals.css reads it
+  // via `var(--font-sans, …)`; layout.tsx carries no font <link>.
+  fonts: [
+    font({
+      family: "Inter",
+      variable: "--font-sans",
+      weights: ["400", "500", "600", "700"],
+      subsets: ["latin"],
+      display: "swap",
+      preload: true,
+    }),
+  ],
   routes: await discoverAppRoutes(),
 });
 

package/templates/shop/lib/owner.ts

@@ -1,11 +1,12 @@
-// Who owns this waitlist? A waitlist is single-tenant — one business, one
-// owner — so ownership is just "the email the owner signs in with", configured
-// once via the PYLON_OWNER_EMAIL env var. The owner-only `waitlistStats`
-// function reads that env (via `ctx.env`) and compares it here.
+// Who owns this shop? A shop is single-tenant — one business, one owner — so
+// ownership is just "the email the owner signs in with", configured once via the
+// PYLON_OWNER_EMAIL env var. The owner-only functions (ordersForOwner,
+// fulfillOrder, cancelOrder, restockProduct) read that env (via `ctx.env`) and
+// compare it here.
 //
 // Fail closed: if PYLON_OWNER_EMAIL is unset, NOBODY is the owner and the
 // dashboard stays locked. That's deliberate — an unset owner on a public site
-// must not mean "everyone can read the signups". Set it in .env (see
+// must not mean "everyone can read the orders". Set it in .env (see
 // .env.example) before signing in.
 
 export function normalizeOwner(raw: string | null | undefined): string | null {

package/templates/todo/app/layout.tsx

@@ -1,7 +1,7 @@
 import React from "react";
 
-// A layout wraps every page. This one is intentionally minimal — a header
-// and a centered column. The page below it is server-rendered first (so the
+// A layout wraps every page. This one is intentionally minimal — just a
+// centered column. The page below it is server-rendered first (so the
 // shell and copy are in the HTML), then hydrates into the live todo UI.
 interface LayoutProps {
   children: React.ReactNode;

package/templates/todo/app/sitemap.ts

@@ -14,7 +14,7 @@ export default async function sitemap(): Promise<Sitemap> {
     { url: `${SITE}/signup`, changeFrequency: "yearly", priority: 0.5 },
   ];
 
-  // The export is async, so you can enumerate dynamic pages from a DB read:
+  // Example — enumerate dynamic pages from a DB read:
   //
   //   const posts = await fetchPublishedPosts();
   //   const postRoutes: Sitemap = posts.map((p) => ({

package/templates/todo/app.ts

@@ -7,11 +7,10 @@ import {
   discoverAppRoutes,
 } from "@pylonsync/sdk";
 
-// A todo that belongs to one person. `userId: field.owner()` is the key
-// move: the framework stamps the signed-in (here: guest) user's id
-// server-side on insert and rejects any forged value — so the UI can do a
-// plain, optimistic `db.insert("Todo", { title })` (the row shows instantly,
-// no round-trip) while ownership stays unspoofable. No createTodo function to
+// A todo that belongs to one person. `userId: field.owner()` stamps the
+// signed-in (here: guest) user's id server-side on insert and rejects any
+// forged value — so the UI can do a plain, optimistic `db.insert("Todo",
+// { title })` and never send (or spoof) userId. No createTodo function to
 // write — every verb is a direct, policy-checked entity call.
 const Todo = entity(
   "Todo",

package/templates/vite/todo/apps/web/vite.config.ts

@@ -4,18 +4,14 @@ import tailwindcss from "@tailwindcss/vite";
 
 // Pylon dev exposes TWO ports:
 //   :4321  → HTTP (functions, entity CRUD, /api/sync/pull, /api/auth/*)
-//   :4322  → dedicated WebSocket listener with TCP read timeouts set
-//            on the raw socket. Broadcasts flow immediately because
-//            the reader thread's mutex is released every 200ms by the
-//            kernel-level read timeout — no client keepalive ping
-//            needed to break the wedge.
+//   :4322  → dedicated WebSocket listener that pushes broadcasts with
+//            lower latency than the HTTP-multiplexed path.
 //
 // We route the WS upgrade to :4322 and everything else to :4321. The
-// HTTP-multiplexed `/api/sync/ws` on :4321 also works (and is the
+// HTTP-multiplexed `/api/sync/ws` on :4321 also works and is the
 // production fallback for proxies that can't forward to a secondary
-// port), but it can't set stream-level timeouts because tiny_http's
-// `CustomStream` hides the underlying TcpStream — so broadcasts there
-// are latency-bounded by the client SDK's 200ms keepalive ping.
+// port, but its broadcasts are latency-bounded by the client SDK's
+// 200ms keepalive ping.
 const PYLON_HTTP_TARGET = process.env.PYLON_TARGET ?? "http://localhost:4321";
 const PYLON_WS_TARGET = process.env.PYLON_WS_TARGET ?? "ws://localhost:4322";
 

package/templates/waitlist/app/globals.css

@@ -139,7 +139,14 @@
   body {
     background-color: var(--color-background);
     color: var(--color-foreground);
-    font-family: Inter, ui-sans-serif, system-ui, -apple-system, sans-serif;
+    font-family: var(
+      --font-sans,
+      Inter,
+      ui-sans-serif,
+      system-ui,
+      -apple-system,
+      sans-serif
+    );
     -webkit-font-smoothing: antialiased;
   }
   button {

package/templates/waitlist/app/layout.tsx

@@ -44,12 +44,10 @@ export default function RootLayout({ children, url, auth }: LayoutProps) {
         <meta charSet="utf-8" />
         <meta name="viewport" content="width=device-width, initial-scale=1" />
         {/* No <title> here — each page's exported `metadata` sets it. */}
-        <link rel="preconnect" href="https://fonts.googleapis.com" />
-        <link rel="preconnect" href="https://fonts.gstatic.com" crossOrigin="anonymous" />
-        <link
-          rel="stylesheet"
-          href="https://fonts.googleapis.com/css2?family=Inter:wght@400;500;600;700&display=swap"
-        />
+        {/* Inter is declared in app.ts (fonts: [...]) and self-hosted by the
+            build — the runtime injects @font-face + <link rel=preload> + a
+            size-adjusted fallback here automatically. No third-party request,
+            no layout shift; change the family in app.ts. */}
         {/* Tailwind is compiled by Pylon from app/globals.css and injected here. */}
       </head>
       <body className="flex min-h-screen flex-col bg-background text-foreground antialiased">

package/templates/waitlist/app/waitlist-hero.tsx

@@ -6,11 +6,10 @@ import { EnsureGuest } from "@pylonsync/client";
 import type { WaitlistConfig } from "@/lib/site.config";
 
 // The interactive top of the landing page: the email-capture form and the LIVE
-// signup counter. This is the realtime proof — the counter is a live
-// `db.useQuery("WaitlistStat")` over the public, PII-free aggregate row, so the
-// moment anyone (this tab or another) submits an email, joinWaitlist updates
-// that row and the new count syncs to every open tab through the replica. No
-// refresh, no polling.
+// signup counter. The counter is a live `db.useQuery("WaitlistStat")` over the
+// public, PII-free aggregate row, so the moment anyone (this tab or another)
+// submits an email, joinWaitlist updates that row and the new count syncs to
+// every open tab through the replica. No refresh, no polling.
 //
 // The signup form (joinWaitlist) is a public mutation, so it works for any
 // anonymous visitor. The counter needs a live sync connection, so it's wrapped

package/templates/waitlist/app.ts

@@ -5,20 +5,23 @@ import {
   auth,
   buildManifest,
   discoverAppRoutes,
+  font,
 } from "@pylonsync/sdk";
 
 // ---------------------------------------------------------------------------
 // waitlist — a pre-launch / coming-soon landing page with a LIVE signup
-// counter. The whole point is the realtime hook: open the page in two tabs,
-// submit an email in one, and the counter on the other ticks up with no
-// refresh. That's the proof it's a real live app and not a static page.
+// counter. The realtime hook: open the page in two tabs, submit an email in
+// one, and the counter on the other ticks up with no refresh.
 //
-// The data model is deliberately tiny — two entities:
-//   • Signup  — one row per email. Holds visitor PII, so it denies ALL client
-//               reads/writes (writes go through the joinWaitlist mutation; the
-//               public page only ever sees an aggregate count, never an email).
-//   • User    — the business owner's account (email/password is built in), so
-//               the owner can sign in to the dashboard and see their signups.
+// The data model is deliberately tiny — three entities:
+//   • Signup       — one row per email. Holds visitor PII, so it denies ALL
+//                    client reads/writes (writes go through the joinWaitlist
+//                    mutation; the public page only ever sees an aggregate
+//                    count, never an email).
+//   • WaitlistStat — a single-row, PII-free aggregate (just the count) the
+//                    public page reads live for the counter.
+//   • User         — the business owner's account (email/password is built in),
+//                    so the owner can sign in to the dashboard and see signups.
 // ---------------------------------------------------------------------------
 
 // One waitlist signup. `email` is the only PII; `createdAt` powers the
@@ -125,6 +128,20 @@ const manifest = buildManifest({
   // Email/password is on by default against the User entity above. No orgs,
   // no billing — a waitlist is single-tenant (one business, one owner).
   auth: auth(),
+  // Self-hosted Inter (next/font parity): the build fetches the woff2, serves it
+  // same-origin (no third-party request, no FOUT), preloads it, and synthesizes a
+  // size-adjusted fallback face so there's no layout shift. globals.css reads it
+  // via `var(--font-sans, …)`; layout.tsx carries no font <link>.
+  fonts: [
+    font({
+      family: "Inter",
+      variable: "--font-sans",
+      weights: ["400", "500", "600", "700"],
+      subsets: ["latin"],
+      display: "swap",
+      preload: true,
+    }),
+  ],
   routes: await discoverAppRoutes(),
 });
 

package/templates/waitlist/lib/site.config.ts

@@ -1,11 +1,9 @@
 // THE single source of truth for everything business-specific on this waitlist.
 // Rebrand the whole page by editing this ONE file — the landing page and layout
-// read from here and stay generic. The `create-pylon` scaffolder and automated
-// generators (Mast) target this file too, so a whole site can be themed by
-// producing one typed object.
+// read from here and stay generic.
 //
-// Colors live here (applied as CSS variables on <html> in app/layout.tsx), so
-// you don't touch globals.css to re-theme.
+// Colors live here too (applied as CSS variables on <html> in app/layout.tsx),
+// so you don't touch globals.css to re-theme.
 //
 // Fictional demo copy — replace the values, keep the shape.
 

package/templates/web/barebones/apps/web/postcss.config.mjs

@@ -1,4 +1,3 @@
-/** Tailwind v4 PostCSS pipeline. */
 export default {
 	plugins: { "@tailwindcss/postcss": {} },
 };

package/templates/web/barebones/apps/web/src/app/globals.css

@@ -1,9 +1,6 @@
 @import "tailwindcss";
 @source "../../../../packages/ui/src/**/*.{ts,tsx}";
 
-:root {
-	color-scheme: light dark;
-}
-
+:root { color-scheme: light dark; }
 html, body { height: 100%; }
 body { font-family: ui-sans-serif, system-ui, -apple-system, sans-serif; }