@pylonsync/create-pylon 0.3.327 → 0.3.329

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pylonsync/create-pylon",
-  "version": "0.3.327",
+  "version": "0.3.329",
   "description": "Scaffold a new Pylon app — realtime backend + web/mobile/expo frontends in one command. Run via `npm create @pylonsync/pylon@latest`.",
   "publishConfig": {
     "access": "public"

package/templates/default/AGENTS.md

@@ -22,7 +22,7 @@ Operating rules for a coding agent in this Pylon app. You — the agent — are
 
 ## Key gotchas
 
-- **Policies deny by default; server functions BYPASS them.** Direct client CRUD (`/api/entities/*`) and sync are policy-checked. Functions run with full DB access — enforce trust with `ctx.auth` checks inside the handler, not policies.
+- **Policies deny by default; server functions BYPASS them.** Direct client CRUD (`/api/entities/*`) and sync are policy-checked. Functions run with full DB access — enforce trust inside the handler with `ctx.auth` checks, or `ctx.requireMember(orgId, { role: ["owner", "admin"] })` for org membership / role gating (throws `FORBIDDEN` for non-members; available on query, mutation, and action). Don't hand-roll a members lookup — the primitive fails closed.
 - **Type page props from the SDK, don't hand-roll them.** `import type { PageProps, Metadata } from "@pylonsync/react"`. Every page/layout gets `{ url, params, searchParams, auth, response, serverData }`; `PageProps<{ slug: string }>` types a `[slug]` route's params. Request headers/cookies are intentionally NOT on `PageProps` — they're server-only and stripped from hydration, so reading them in the render would mismatch.
 - **Anonymous output caching is opt-in + earned.** `export const revalidate = 60` (seconds) on a page makes it CDN-cacheable (`public, s-maxage=60`) — but ONLY if the render is auth-INDEPENDENT: it must NOT read `props.auth` (reading it at all opts out, even for anonymous), set no cookie, and the app must not run strict per-caller policies (`PYLON_STRICT_FN_POLICIES`). `export const dynamic = "force-static"` caches until the next deploy; `"force-dynamic"` never caches. Fail-closed: without the opt-in (or if any condition fails) the page is `no-cache`. A page that reads `auth` or sets a cookie is never shared. The SAME earned render is also kept in an **origin disk cache** (`.pylon/.cache/ssr`): a cookie-less GET with no query string is served straight off disk for the TTL — skipping the render entirely — then re-rendered live when stale. The disk cache is namespaced per deploy (wiped on each new build) and OFF in `pylon dev` (so an edit is never masked by a stale entry); invalidation is by the `revalidate` TTL or the next deploy.
 - **No-JS forms use `route.ts` + `<Form>`.** Drop `app/.../route.ts` exporting `export const POST: RouteHandler = async ({ form, db, response, auth }) => { await db.insert("X", {...}); response.redirect("/x?ok=1"); }` (303 POST-redirect-GET by default). Render `<Form action="/x">` (from @pylonsync/react) with plain `<input name=...>` — works with JS off (native POST→handler→redirect) and is enhanced to no-reload when JS is on. The handler's `db` is read+write (mutation trust model — gate on `auth`); CSRF is automatic (Origin gate + SameSite=Lax). Multipart/file uploads aren't supported yet — use urlencoded forms + `/api/files`.

package/templates/default/app/dashboard/dashboard-client.tsx

@@ -445,9 +445,10 @@ function IconBtn({
   );
 }
 
-// One project card. Reads/writes live via the reactive `db` — rename, archive,
-// and delete are optimistic and sync across tabs (all gated by the tenant
-// policy). Editing swaps the card for an inline name + description form.
+// One project card. Archive + delete are optimistic client `db` writes (gated
+// by the tenant policy) that sync across tabs; editing details saves through the
+// updateProject server function. Editing swaps the card for an inline name +
+// description form.
 function ProjectCard({ p }: { p: Project }) {
   const archived = (p.status ?? "active") === "archived";
   const [editing, setEditing] = useState(false);
@@ -459,7 +460,12 @@ function ProjectCard({ p }: { p: Project }) {
     const n = name.trim();
     if (!n) return;
     setEditing(false);
-    await db.update("Project", p.id, {
+    // Saving details goes through the updateProject server function (server-side
+    // validation + a workspace-membership re-check) rather than a bare
+    // db.update — see functions/updateProject.ts. The reactive `db` still
+    // re-renders this card the moment the write lands.
+    await callFn("updateProject", {
+      projectId: p.id,
       name: n,
       description: desc.trim() || undefined,
     });
@@ -1049,12 +1055,14 @@ function BillingView({
       const msg = e instanceof Error ? e.message : String(e);
       // A missing STRIPE_PRICE_PRO surfaces as "plan pro has no monthly
       // priceId" rather than STRIPE_NOT_CONFIGURED, so treat the price/config
-      // errors the same — both mean "finish the Stripe setup".
+      // errors the same — both mean the Stripe setup isn't finished (set
+      // STRIPE_SECRET_KEY + STRIPE_PRICE_PRO). That guidance is for you, the
+      // developer; the customer just sees the generic "contact support" line.
       setError(
         /not.?configured|STRIPE_NOT_CONFIGURED|no monthly price|priceId/i.test(
           msg,
         )
-          ? "Stripe isn't configured yet — set STRIPE_SECRET_KEY + STRIPE_PRICE_PRO to enable billing."
+          ? "Billing isn't available yet. Contact support and we'll get you set up."
           : msg,
       );
       setBusy(null);
@@ -1174,10 +1182,12 @@ function BillingView({
         {error && <p className="mt-3 text-xs text-red-600">{error}</p>}
       </Card>
 
+      {/* Dev setup (not shown to customers): set STRIPE_SECRET_KEY,
+          STRIPE_WEBHOOK_SECRET, and STRIPE_PRICE_PRO to go live; point the
+          Stripe webhook at /api/fn/stripeWebhook. Billing is wired through
+          @pylonsync/stripe — see lib/billing.ts. */}
       <p className="text-xs text-zinc-400">
-        Powered by Stripe Checkout + Customer Portal via the @pylonsync/stripe
-        plugin. Set STRIPE_SECRET_KEY, STRIPE_WEBHOOK_SECRET, and STRIPE_PRICE_PRO
-        to go live; point the webhook at <code>/api/fn/stripeWebhook</code>.
+        Payments and invoices are processed securely by Stripe.
       </p>
     </div>
   );

package/templates/default/app/layout.tsx

@@ -439,17 +439,8 @@ function SiteFooter() {
           </div>
         </div>
 
-        <div className="mt-14 flex flex-col items-start justify-between gap-3 border-t border-zinc-200/70 pt-6 text-[12px] text-zinc-400 sm:flex-row sm:items-center">
+        <div className="mt-14 border-t border-zinc-200/70 pt-6 text-[12px] text-zinc-400">
           <span>© {new Date().getFullYear()} {siteConfig.brand.copyrightName}</span>
-          <span>
-            Built with{" "}
-            <a
-              href="https://pylonsync.com"
-              className="font-medium text-zinc-600 hover:text-zinc-900"
-            >
-              Pylon
-            </a>
-          </span>
         </div>
       </div>
     </footer>

package/templates/default/functions/updateProject.ts

@@ -0,0 +1,53 @@
+import { mutation, v } from "@pylonsync/functions";
+import { normalizeProjectName } from "../lib/projects";
+
+// updateProject — the reference example for a first-party server function, and
+// the core authoring loop end to end: entity → policy → FUNCTION → call it from
+// the client. The Projects tab's edit form (app/dashboard/dashboard-client.tsx)
+// saves through this via `callFn("updateProject", …)`.
+//
+// Why a server function and not a direct client `db.update`? Two reasons the
+// pattern exists:
+//   1. Server-side validation the client can't be trusted to enforce — the name
+//      bounds run on the server no matter what the browser sends.
+//   2. Authorization beyond "owns the row". Functions BYPASS entity policies and
+//      run with full DB access, so a handler that trusted a caller-supplied
+//      `projectId` would be an IDOR. `ctx.requireMember` re-checks that the
+//      caller belongs to THAT project's workspace, failing CLOSED (throws
+//      FORBIDDEN otherwise). Pass `{ role: ["owner", "admin"] }` to make edits
+//      admin-only.
+//
+// Quick archive/delete stay as direct client `db` writes — the Project row
+// policy (`auth.tenantId == data.orgId`) already covers "edit a row you own".
+// Reach for a function when you need more than that.
+export default mutation<
+  { projectId: string; name: string; description?: string },
+  { id: string; name: string }
+>({
+  // `auth` defaults to "user" (secure-by-default) — requireMember does the rest.
+  args: {
+    projectId: v.string(),
+    name: v.string(),
+    description: v.optional(v.string()),
+  },
+  async handler(ctx, args) {
+    const name = normalizeProjectName(args.name);
+    if (!name) {
+      throw ctx.error("INVALID_ARGS", "Project name must be 1–80 characters.");
+    }
+    const description = args.description?.trim() || undefined;
+
+    // Load the target row, then authorize against ITS OWN workspace — never a
+    // caller-supplied org id.
+    const project = await ctx.db.get("Project", args.projectId);
+    if (!project) {
+      throw ctx.error("NOT_FOUND", "Project not found.");
+    }
+    await ctx.requireMember(project.orgId as string);
+
+    // Authorized above, so write through the explicit trusted-handler surface
+    // (also correct under PYLON_STRICT_FN_POLICIES).
+    await ctx.db.unsafe.update("Project", args.projectId, { name, description });
+    return { id: args.projectId, name };
+  },
+});

package/templates/default/lib/projects.ts

@@ -0,0 +1,14 @@
+// Pure project helpers. AGENTS.md's testing guidance: keep the decision logic
+// out of the handler and in a pure function here, so it's exhaustively testable
+// without a running server (see tests/projects.test.ts). functions/updateProject.ts
+// is a thin wrapper around this.
+
+/**
+ * Trim + validate a project name. Returns the cleaned name, or null when it's
+ * empty (or whitespace-only) or longer than 80 characters after trimming.
+ */
+export function normalizeProjectName(raw: string): string | null {
+  const name = raw.trim();
+  if (name.length < 1 || name.length > 80) return null;
+  return name;
+}

package/templates/default/lib/site.config.ts

@@ -124,12 +124,12 @@ export const siteConfig: SiteConfig = {
     socials: [
       {
         label: "X",
-        href: "https://x.com/pylonsync",
+        href: "https://x.com/acme",
         path: "M18.244 2.25h3.308l-7.227 8.26 8.502 11.24H16.17l-5.214-6.817L4.99 21.75H1.68l7.73-8.835L1.254 2.25H8.08l4.713 6.231zm-1.161 17.52h1.833L7.084 4.126H5.117z",
       },
       {
         label: "GitHub",
-        href: "https://github.com/pylonsync/pylon",
+        href: "https://github.com/acme",
         path: "M12 .297c-6.63 0-12 5.373-12 12 0 5.303 3.438 9.8 8.205 11.385.6.113.82-.258.82-.577 0-.285-.01-1.04-.015-2.04-3.338.724-4.042-1.61-4.042-1.61C4.422 18.07 3.633 17.7 3.633 17.7c-1.087-.744.084-.729.084-.729 1.205.084 1.838 1.236 1.838 1.236 1.07 1.835 2.809 1.305 3.495.998.108-.776.417-1.305.76-1.605-2.665-.3-5.466-1.332-5.466-5.93 0-1.31.465-2.38 1.235-3.22-.135-.303-.54-1.523.105-3.176 0 0 1.005-.322 3.3 1.23.96-.267 1.98-.399 3-.405 1.02.006 2.04.138 3 .405 2.28-1.552 3.285-1.23 3.285-1.23.645 1.653.24 2.873.12 3.176.765.84 1.23 1.91 1.23 3.22 0 4.61-2.805 5.625-5.475 5.92.42.36.81 1.096.81 2.22 0 1.606-.015 2.896-.015 3.286 0 .315.21.69.825.57C20.565 22.092 24 17.592 24 12.297c0-6.627-5.373-12-12-12",
       },
     ],

package/templates/default/tests/projects.test.ts

@@ -0,0 +1,18 @@
+import { expect, test } from "bun:test";
+import { normalizeProjectName } from "../lib/projects";
+
+// Tier 1 (pure logic) — the validation functions/updateProject.ts enforces
+// server-side, tested without a running app. Keep decision logic like this in
+// lib/ and the handler a thin wrapper, so it's covered here.
+
+test("normalizeProjectName trims and accepts 1–80 chars", () => {
+  expect(normalizeProjectName("  Launch  ")).toBe("Launch");
+  expect(normalizeProjectName("x")).toBe("x");
+  expect(normalizeProjectName("a".repeat(80))).toBe("a".repeat(80));
+});
+
+test("normalizeProjectName rejects empty, whitespace-only, and too-long names", () => {
+  expect(normalizeProjectName("")).toBeNull();
+  expect(normalizeProjectName("   ")).toBeNull();
+  expect(normalizeProjectName("a".repeat(81))).toBeNull();
+});

package/templates/expo/chat/apps/expo/App.tsx

@@ -10,8 +10,8 @@ import {
 	Platform,
 	Alert,
 	KeyboardAvoidingView,
-	SafeAreaView,
 } from "react-native";
+import { SafeAreaProvider, SafeAreaView } from "react-native-safe-area-context";
 import { StatusBar } from "expo-status-bar";
 import { init, db, callFn } from "@pylonsync/react-native";
 
@@ -47,6 +47,14 @@ function ensureInit() {
 }
 
 export default function App() {
+	return (
+		<SafeAreaProvider>
+			<AppContent />
+		</SafeAreaProvider>
+	);
+}
+
+function AppContent() {
 	const [ready, setReady] = useState(false);
 	useEffect(() => {
 		ensureInit().then(() => setReady(true));

package/templates/expo/chat/apps/expo/package.json

@@ -21,7 +21,8 @@
     "expo-status-bar": "~56.0.0",
     "react": "19.2.0",
     "react-dom": "19.2.0",
-    "react-native": "0.85.3"
+    "react-native": "0.85.3",
+    "react-native-safe-area-context": "~5.6.0"
   },
   "devDependencies": {
     "@babel/core": "^7.25.0",

package/templates/expo/consumer/apps/expo/App.tsx

@@ -9,8 +9,8 @@ import {
 	StyleSheet,
 	Platform,
 	Alert,
-	SafeAreaView,
 } from "react-native";
+import { SafeAreaProvider, SafeAreaView } from "react-native-safe-area-context";
 import { StatusBar } from "expo-status-bar";
 import { init, db, callFn } from "@pylonsync/react-native";
 import AsyncStorage from "@react-native-async-storage/async-storage";
@@ -56,6 +56,14 @@ function ensureInit() {
 }
 
 export default function App() {
+	return (
+		<SafeAreaProvider>
+			<AppContent />
+		</SafeAreaProvider>
+	);
+}
+
+function AppContent() {
 	const [ready, setReady] = useState(false);
 	const [profileId, setProfileId] = useState<string | null>(null);
 	useEffect(() => {

package/templates/expo/consumer/apps/expo/package.json

@@ -21,7 +21,8 @@
     "expo-status-bar": "~56.0.0",
     "react": "19.2.0",
     "react-dom": "19.2.0",
-    "react-native": "0.85.3"
+    "react-native": "0.85.3",
+    "react-native-safe-area-context": "~5.6.0"
   },
   "devDependencies": {
     "@babel/core": "^7.25.0",