@pylonsync/create-pylon 0.3.53 → 0.3.55

package/bin/create-pylon.js

@@ -57,10 +57,38 @@ const PYLON_VERSION = JSON.parse(
 
 // ---------------------------------------------------------------------------
 // Templates + platforms registry
+//
+// Each template declares which platforms it supports — `b2b` is web/mac
+// only because the demo flow (org switcher, member invite, RBAC admin
+// panel) is desktop-shaped and porting it to mobile would be busy work
+// without value. Pick a different template if you want mobile.
 // ---------------------------------------------------------------------------
 
-const TEMPLATES_AVAILABLE = ["barebones", "todo"];
-const PLATFORMS_AVAILABLE = ["web", "mobile", "expo"];
+const PLATFORMS_AVAILABLE = ["web", "ios", "mac", "expo"];
+
+const TEMPLATE_REGISTRY = {
+	barebones: {
+		blurb: "Single entity, list + create. The smallest working app.",
+		platforms: ["web", "ios", "mac", "expo"],
+	},
+	todo: {
+		blurb: "CRUD + drag-reorder + optimistic mutations.",
+		platforms: ["web", "ios", "mac", "expo"],
+	},
+	b2b: {
+		blurb: "Multi-tenant SaaS: orgs, members, roles, RBAC policies.",
+		platforms: ["web", "mac"],
+	},
+	consumer: {
+		blurb: "Social feed: profiles, posts, likes, follows.",
+		platforms: ["web", "ios", "mac", "expo"],
+	},
+	chat: {
+		blurb: "Realtime messaging: rooms, presence, live message feed.",
+		platforms: ["web", "ios", "mac", "expo"],
+	},
+};
+const TEMPLATES_AVAILABLE = Object.keys(TEMPLATE_REGISTRY);
 
 // ---------------------------------------------------------------------------
 // CLI args + interactive prompts
@@ -95,18 +123,24 @@ function pickValue(arr, ...candidates) {
 }
 
 if (flags.help) {
+	const tmplLines = Object.entries(TEMPLATE_REGISTRY).map(
+		([k, v]) => `    ${k.padEnd(10)} ${v.blurb} (${v.platforms.join(", ")})`,
+	);
 	process.stdout.write(`
 Usage: npm create @pylonsync/pylon [name] [options]
 
-  --template <t>         barebones | todo
-  --platforms <list>     comma list: web,mobile,expo  (default: web)
+  --template <t>         ${TEMPLATES_AVAILABLE.join(" | ")}
+${tmplLines.join("\n")}
+
+  --platforms <list>     comma list: ${PLATFORMS_AVAILABLE.join(",")}  (default: web)
   --bun|--pnpm|--yarn|--npm
   --skip-install         scaffold only, don't run install
 
 Examples:
   npm create @pylonsync/pylon my-app
-  npm create @pylonsync/pylon my-app --template todo --platforms web,mobile
-  npm create @pylonsync/pylon my-app --template barebones --platforms expo --bun
+  npm create @pylonsync/pylon my-app --template todo --platforms web,ios
+  npm create @pylonsync/pylon my-app --template b2b --platforms web,mac
+  npm create @pylonsync/pylon my-app --template chat --platforms ios,mac,expo
 `);
 	exit(0);
 }
@@ -116,6 +150,10 @@ if (!projectName) {
 	projectName = (await rl.question("Project name: ")).trim() || "my-pylon-app";
 }
 if (!flags.template) {
+	const lines = Object.entries(TEMPLATE_REGISTRY)
+		.map(([k, v]) => `  ${k.padEnd(10)} ${v.blurb}`)
+		.join("\n");
+	process.stdout.write(`\n${lines}\n`);
 	const ans = (
 		await rl.question(
 			`Template (${TEMPLATES_AVAILABLE.join(", ")}) [todo]: `,
@@ -126,9 +164,10 @@ if (!flags.template) {
 	flags.template = TEMPLATES_AVAILABLE.includes(ans) ? ans : "todo";
 }
 if (!flags.platforms) {
+	const supported = TEMPLATE_REGISTRY[flags.template].platforms.join(", ");
 	const ans = (
 		await rl.question(
-			`Platforms (${PLATFORMS_AVAILABLE.join(", ")}, comma-separated) [web]: `,
+			`Platforms for ${flags.template} (${supported}, comma-separated) [web]: `,
 		)
 	).trim();
 	flags.platforms = ans || "web";
@@ -169,6 +208,21 @@ if (!TEMPLATES_AVAILABLE.includes(flags.template)) {
 	exit(1);
 }
 
+// Reject combos a template doesn't yet support — better to fail loud
+// than to scaffold an incomplete tree (e.g. b2b + expo would skip
+// frontend entirely and leave the user with a half-empty workspace).
+const supportedPlatforms = TEMPLATE_REGISTRY[flags.template].platforms;
+const invalidForTemplate = platforms.filter(
+	(p) => !supportedPlatforms.includes(p),
+);
+if (invalidForTemplate.length > 0) {
+	console.error(
+		`\nError: template "${flags.template}" doesn't support platform(s): ${invalidForTemplate.join(", ")}.\n` +
+			`       supported: ${supportedPlatforms.join(", ")}\n`,
+	);
+	exit(1);
+}
+
 // Some PMs reject the `workspace:` protocol. Bun/pnpm/yarn berry
 // understand it and rewrite to the local sibling version at install
 // time. npm errors EUNSUPPORTEDPROTOCOL ("Unsupported URL Type").
@@ -260,13 +314,11 @@ function copyTemplate(srcSubpath, destSubpath = "") {
 
 // ---------------------------------------------------------------------------
 // Apply templates in order:
-//   1. _root/_shared       — gitignore, env.example, basic README
-//   2. backend/<template>  — apps/api/* always present
-//   3. ui                  — packages/ui (only if web is in platforms)
-//   4. web/<template>      — apps/web/* (only if web in platforms)
-//   5. mobile/<template>   — apps/mobile/* (only if mobile in platforms)
-//   6. expo/<template>     — apps/expo/* (only if expo in platforms)
-//   7. Root package.json   — generated, not templated; depends on platforms
+//   1. _root            — gitignore, env.example, README
+//   2. backend/<t>      — apps/api/* always present (one per template)
+//   3. ui               — packages/ui (only if web is in platforms)
+//   4. <platform>/<t>   — one per requested platform under apps/<platform>/
+//   5. Root package.json — generated, not templated
 // ---------------------------------------------------------------------------
 
 copyTemplate("_root");
@@ -276,11 +328,8 @@ if (platforms.includes("web")) {
 	copyTemplate("ui");
 	copyTemplate(`web/${flags.template}`);
 }
-if (platforms.includes("mobile")) {
-	copyTemplate(`mobile/${flags.template}`);
-}
-if (platforms.includes("expo")) {
-	copyTemplate(`expo/${flags.template}`);
+for (const p of ["ios", "mac", "expo"]) {
+	if (platforms.includes(p)) copyTemplate(`${p}/${flags.template}`);
 }
 
 walkAndSubstitute(root);
@@ -293,23 +342,19 @@ walkAndSubstitute(root);
 
 const wsScripts = pmScripts(flags.pm);
 const devScripts = {};
-const buildScripts = {};
-if (platforms.includes("web")) {
-	devScripts["dev:api"] = wsScripts.devApi;
-	devScripts["dev:web"] = wsScripts.devWeb;
-}
-if (!platforms.includes("web")) {
-	// API still runs even without a web platform — mobile / expo connect
-	// to it directly.
-	devScripts["dev:api"] = wsScripts.devApi;
-}
-if (platforms.includes("expo")) {
-	devScripts["dev:expo"] = wsScripts.devExpo;
+// API runs always — every frontend connects to it.
+devScripts["dev:api"] = wsScripts.devApi;
+if (platforms.includes("web")) devScripts["dev:web"] = wsScripts.devWeb;
+if (platforms.includes("expo")) devScripts["dev:expo"] = wsScripts.devExpo;
+if (platforms.includes("ios")) {
+	// `xcodegen generate` materializes the .xcodeproj from project.yml,
+	// then it's an Xcode-driven flow — no `bun run dev` semantics.
+	devScripts["dev:ios"] =
+		"echo 'cd apps/ios && xcodegen generate && open *.xcodeproj  (or: swift run for a quick macOS preview)'";
 }
-if (platforms.includes("mobile")) {
-	// Swift/iOS isn't a `bun run dev` thing — surfaced as a separate
-	// script invocation since `swift run` blocks and Xcode is out-of-band.
-	devScripts["dev:mobile"] = "echo 'Open apps/mobile in Xcode (or run: cd apps/mobile && swift run)'";
+if (platforms.includes("mac")) {
+	devScripts["dev:mac"] =
+		"echo 'cd apps/mac && swift run  (or: xcodegen generate && open *.xcodeproj)'";
 }
 
 const parallelDevs = Object.keys(devScripts);
@@ -363,13 +408,27 @@ if (!flags.skipInstall) {
 const runDev = flags.pm === "npm" ? "npm run dev" : `${flags.pm} run dev`;
 
 const platformLines = [];
+platformLines.push("  → api      http://localhost:4321  (Pylon control plane)");
 if (platforms.includes("web"))
 	platformLines.push("  → web      http://localhost:3000  (Next.js)");
-platformLines.push("  → api      http://localhost:4321  (Pylon control plane)");
 if (platforms.includes("expo"))
 	platformLines.push(`  → expo     ${flags.pm} run dev:expo  (Metro + simulator)`);
-if (platforms.includes("mobile"))
-	platformLines.push(`  → mobile   open apps/mobile in Xcode  (or: swift run)`);
+if (platforms.includes("ios"))
+	platformLines.push(`  → ios      cd apps/ios && xcodegen generate && open *.xcodeproj`);
+if (platforms.includes("mac"))
+	platformLines.push(`  → mac      cd apps/mac && swift run  (or xcodegen for .app)`);
+
+const layoutLines = ["  apps/api          schema + functions/ handlers"];
+if (platforms.includes("web")) {
+	layoutLines.push("  apps/web          Next.js 16 + React 19 + Tailwind v4");
+	layoutLines.push("  packages/ui       shared UI primitives");
+}
+if (platforms.includes("ios"))
+	layoutLines.push("  apps/ios          Swift / SwiftUI (iOS)");
+if (platforms.includes("mac"))
+	layoutLines.push("  apps/mac          Swift / SwiftUI (macOS)");
+if (platforms.includes("expo"))
+	layoutLines.push("  apps/expo         Expo + React Native");
 
 console.log(`
 ✓ Created ${projectName}
@@ -380,10 +439,7 @@ console.log(`
 ${platformLines.join("\n")}
 
 Layout:
-  apps/api          schema + functions/ handlers
-${platforms.includes("web") ? "  apps/web          Next.js 16 + React 19 + Tailwind v4\n  packages/ui       shared UI primitives" : ""}
-${platforms.includes("mobile") ? "  apps/mobile       Swift / SwiftUI" : ""}
-${platforms.includes("expo") ? "  apps/expo         Expo + React Native" : ""}
+${layoutLines.join("\n")}
 
 Docs: https://pylonsync.com/docs
 `);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pylonsync/create-pylon",
-  "version": "0.3.53",
+  "version": "0.3.55",
   "description": "Scaffold a new Pylon app — realtime backend + web/mobile/expo frontends in one command. Run via `npm create @pylonsync/pylon@latest`.",
   "publishConfig": {
     "access": "public"

package/templates/backend/b2b/apps/api/functions/archiveProject.ts

@@ -0,0 +1,15 @@
+import { mutation, v } from "@pylonsync/functions";
+
+/**
+ * Soft-delete: set archived = true. Project policy gates updates to
+ * org owner/admin only, so a regular member can't archive a project
+ * even if they created it. Restore by writing archived = false (this
+ * scaffold doesn't ship a restore action — left as an exercise).
+ */
+export default mutation({
+	args: { id: v.id("Project") },
+	async handler(ctx, args: { id: string }) {
+		await ctx.db.update("Project", args.id, { archived: true });
+		return await ctx.db.get("Project", args.id);
+	},
+});

package/templates/backend/b2b/apps/api/functions/createOrg.ts

@@ -0,0 +1,43 @@
+import { mutation, v } from "@pylonsync/functions";
+
+/**
+ * Create a new Org with the caller as owner. Atomically writes the
+ * Org row + the founding Membership; both must succeed or neither
+ * does (Pylon mutations run in a single transaction).
+ */
+export default mutation({
+	args: { slug: v.string(), name: v.string() },
+	async handler(ctx, args: { slug: string; name: string }) {
+		if (!ctx.auth.userId) {
+			throw ctx.error("UNAUTHENTICATED", "log in first");
+		}
+		const slug = args.slug.trim().toLowerCase();
+		if (!/^[a-z0-9][a-z0-9-]{1,30}[a-z0-9]$/.test(slug)) {
+			throw ctx.error(
+				"INVALID_SLUG",
+				"slug must be 3–32 chars, alphanumeric + dashes, no leading/trailing dash",
+			);
+		}
+		const name = args.name.trim();
+		if (!name) {
+			throw ctx.error("EMPTY_NAME", "org name cannot be empty");
+		}
+		const dup = (await ctx.db.query("Org", { slug })) as any[];
+		if (dup.length > 0) {
+			throw ctx.error("SLUG_TAKEN", `org slug "${slug}" is taken`);
+		}
+		const orgId = await ctx.db.insert("Org", {
+			slug,
+			name,
+			ownerId: ctx.auth.userId,
+			createdAt: new Date().toISOString(),
+		});
+		await ctx.db.insert("Membership", {
+			orgId,
+			userId: ctx.auth.userId,
+			role: "owner",
+			createdAt: new Date().toISOString(),
+		});
+		return await ctx.db.get("Org", orgId);
+	},
+});

package/templates/backend/b2b/apps/api/functions/createProject.ts

@@ -0,0 +1,25 @@
+import { mutation, v } from "@pylonsync/functions";
+
+/**
+ * Create a Project inside an Org. Project policy already gates this
+ * to org members; we additionally trim the name and stamp the caller
+ * as creator.
+ */
+export default mutation({
+	args: { orgId: v.id("Org"), name: v.string() },
+	async handler(ctx, args: { orgId: string; name: string }) {
+		if (!ctx.auth.userId) {
+			throw ctx.error("UNAUTHENTICATED", "log in first");
+		}
+		const name = args.name.trim();
+		if (!name) throw ctx.error("EMPTY_NAME", "project name cannot be empty");
+		const id = await ctx.db.insert("Project", {
+			orgId: args.orgId,
+			name,
+			createdBy: ctx.auth.userId,
+			archived: false,
+			createdAt: new Date().toISOString(),
+		});
+		return await ctx.db.get("Project", id);
+	},
+});

package/templates/backend/b2b/apps/api/functions/inviteMember.ts

@@ -0,0 +1,49 @@
+import { mutation, v } from "@pylonsync/functions";
+
+/**
+ * Add a User to an Org with a role. Membership policy already gates
+ * this to owners / admins; we additionally validate the role string
+ * here (Pylon enforces enum at the schema level too, but a clearer
+ * error message is nicer than a generic constraint failure).
+ *
+ * For a real app, replace this with an email-invite flow that emits
+ * an Invite row + emails the user — but the wiring is the same: the
+ * Membership row is what grants access.
+ */
+const ROLES = new Set(["owner", "admin", "member"]);
+
+export default mutation({
+	args: {
+		orgId: v.id("Org"),
+		userId: v.id("User"),
+		role: v.string(),
+	},
+	async handler(
+		ctx,
+		args: { orgId: string; userId: string; role: string },
+	) {
+		if (!ROLES.has(args.role)) {
+			throw ctx.error(
+				"INVALID_ROLE",
+				`role must be one of ${[...ROLES].join(", ")}`,
+			);
+		}
+		const dup = (await ctx.db.query("Membership", {
+			orgId: args.orgId,
+			userId: args.userId,
+		})) as any[];
+		if (dup.length > 0) {
+			throw ctx.error(
+				"ALREADY_MEMBER",
+				"user is already a member of this org",
+			);
+		}
+		const id = await ctx.db.insert("Membership", {
+			orgId: args.orgId,
+			userId: args.userId,
+			role: args.role,
+			createdAt: new Date().toISOString(),
+		});
+		return await ctx.db.get("Membership", id);
+	},
+});

package/templates/backend/b2b/apps/api/functions/myOrgs.ts

@@ -0,0 +1,37 @@
+import { query } from "@pylonsync/functions";
+
+/**
+ * List every Org the caller belongs to. Joins Membership against Org
+ * so the response carries everything the org switcher needs to render
+ * a row (name, slug, the caller's role).
+ */
+export default query({
+	args: {},
+	async handler(ctx) {
+		if (!ctx.auth.userId) return [];
+		const memberships = await ctx.db.query("Membership", {
+			userId: ctx.auth.userId,
+		});
+		const out: Array<{
+			id: string;
+			slug: string;
+			name: string;
+			role: string;
+			createdAt: string;
+		}> = [];
+		for (const m of memberships as any[]) {
+			const org = (await ctx.db.get("Org", m.orgId)) as any;
+			if (!org) continue;
+			out.push({
+				id: org.id,
+				slug: org.slug,
+				name: org.name,
+				role: m.role,
+				createdAt: org.createdAt,
+			});
+		}
+		return out.sort((a, b) =>
+			Date.parse(b.createdAt) - Date.parse(a.createdAt),
+		);
+	},
+});

package/templates/backend/b2b/apps/api/functions/orgMembers.ts

@@ -0,0 +1,13 @@
+import { query, v } from "@pylonsync/functions";
+
+/**
+ * List every member of an Org. Membership policy gates this to
+ * org-admins + owners (members see only their own row), so non-admin
+ * callers get a single-element array; admins get everyone.
+ */
+export default query({
+	args: { orgId: v.id("Org") },
+	async handler(ctx, args: { orgId: string }) {
+		return await ctx.db.query("Membership", { orgId: args.orgId });
+	},
+});

package/templates/backend/b2b/apps/api/functions/orgProjects.ts

@@ -0,0 +1,18 @@
+import { query, v } from "@pylonsync/functions";
+
+/**
+ * Every Project in an Org. Project policy enforces tenant scope, so
+ * even if the caller passes a foreign `orgId` they're not a member of,
+ * the query returns nothing.
+ */
+export default query({
+	args: { orgId: v.id("Org") },
+	async handler(ctx, args: { orgId: string }) {
+		const rows = (await ctx.db.query("Project", {
+			orgId: args.orgId,
+		})) as any[];
+		return rows
+			.filter((r) => !r.archived)
+			.sort((a, b) => Date.parse(b.createdAt) - Date.parse(a.createdAt));
+	},
+});

package/templates/backend/b2b/apps/api/functions/removeMember.ts

@@ -0,0 +1,29 @@
+import { mutation, v } from "@pylonsync/functions";
+
+/**
+ * Remove a User from an Org. Refuses to remove the org's owner
+ * (transfer ownership first via setMemberRole + a manual Org.ownerId
+ * update — left as an exercise; this scaffold stops at the safety
+ * check).
+ */
+export default mutation({
+	args: { orgId: v.id("Org"), userId: v.id("User") },
+	async handler(ctx, args: { orgId: string; userId: string }) {
+		const org = (await ctx.db.get("Org", args.orgId)) as any;
+		if (!org) throw ctx.error("NOT_FOUND", "org not found");
+		if (org.ownerId === args.userId) {
+			throw ctx.error(
+				"OWNER_CANT_LEAVE",
+				"the org owner can't be removed; transfer ownership first",
+			);
+		}
+		const memberships = (await ctx.db.query("Membership", {
+			orgId: args.orgId,
+			userId: args.userId,
+		})) as any[];
+		for (const m of memberships) {
+			await ctx.db.delete("Membership", m.id);
+		}
+		return memberships[0] ?? null;
+	},
+});

package/templates/backend/b2b/apps/api/functions/setMemberRole.ts

@@ -0,0 +1,38 @@
+import { mutation, v } from "@pylonsync/functions";
+
+const ROLES = new Set(["owner", "admin", "member"]);
+
+/**
+ * Promote/demote a member. Only one row per (orgId, userId) so we
+ * find by composite then update. Setting role=owner does NOT change
+ * Org.ownerId — those are separate concepts (the founder vs current
+ * org-leadership members); this scaffold leaves transfer-of-ownership
+ * as a separate flow.
+ */
+export default mutation({
+	args: {
+		orgId: v.id("Org"),
+		userId: v.id("User"),
+		role: v.string(),
+	},
+	async handler(
+		ctx,
+		args: { orgId: string; userId: string; role: string },
+	) {
+		if (!ROLES.has(args.role)) {
+			throw ctx.error(
+				"INVALID_ROLE",
+				`role must be one of ${[...ROLES].join(", ")}`,
+			);
+		}
+		const memberships = (await ctx.db.query("Membership", {
+			orgId: args.orgId,
+			userId: args.userId,
+		})) as any[];
+		if (memberships.length === 0) {
+			throw ctx.error("NOT_A_MEMBER", "user is not a member of this org");
+		}
+		await ctx.db.update("Membership", memberships[0].id, { role: args.role });
+		return await ctx.db.get("Membership", memberships[0].id);
+	},
+});

package/templates/backend/b2b/apps/api/package.json

@@ -0,0 +1,20 @@
+{
+  "name": "@__APP_NAME_KEBAB__/api",
+  "version": "0.0.1",
+  "private": true,
+  "type": "module",
+  "scripts": {
+    "dev": "pylon dev schema.ts --port 4321",
+    "build": "pylon codegen schema.ts --out pylon.manifest.json && pylon codegen client pylon.manifest.json --out pylon.client.ts",
+    "schema:push": "pylon schema push pylon.manifest.json --sqlite dev.db",
+    "schema:inspect": "pylon schema inspect --sqlite dev.db"
+  },
+  "dependencies": {
+    "@pylonsync/sdk": "^__PYLON_VERSION__",
+    "@pylonsync/functions": "^__PYLON_VERSION__"
+  },
+  "devDependencies": {
+    "@pylonsync/cli": "^__PYLON_VERSION__",
+    "typescript": "^5.5.0"
+  }
+}