create-composure-app 1.0.0

package/dist/steps/validate-license.js

@@ -0,0 +1,135 @@
+import { execFileSync } from "node:child_process";
+import { join } from "node:path";
+import { homedir } from "node:os";
+import { existsSync } from "node:fs";
+const COMPOSURE_DIR = join(homedir(), ".composure");
+const CREDENTIALS_PATH = join(COMPOSURE_DIR, "credentials.json");
+const TOKEN_SCRIPT = join(COMPOSURE_DIR, "bin", "composure-token.mjs");
+/**
+ * Validate license via Composure's auth system.
+ *
+ * Priority:
+ *   1. --token flag (legacy, still supported)
+ *   2. ~/.composure/credentials.json (Composure login)
+ *
+ * Returns plan info used to determine available tiers.
+ */
+export async function validateLicense(token) {
+    // Method 1: Composure credentials (preferred)
+    if (existsSync(CREDENTIALS_PATH)) {
+        return validateViaComposure();
+    }
+    // Method 2: Legacy token flag
+    if (token) {
+        return validateViaToken(token);
+    }
+    throw new Error("Not authenticated. Log in with Composure first:\n" +
+        "  Run: /composure:auth login\n\n" +
+        "Or use a license token:\n" +
+        "  npx create-composure-app --token=<your-token>\n\n" +
+        "Get a license at https://composure-pro.com/template");
+}
+/**
+ * Validate using Composure's composure-token.mjs CLI
+ */
+async function validateViaComposure() {
+    // Check if composure-token.mjs exists
+    if (!existsSync(TOKEN_SCRIPT)) {
+        throw new Error("Composure CLI not found. Install Composure first:\n" +
+            "  claude plugin install composure@composure-suite\n" +
+            "  Then: /composure:auth login");
+    }
+    try {
+        // Step 1: Validate token is current (handles refresh automatically)
+        const validateOutput = execFileSync("node", [TOKEN_SCRIPT, "validate"], {
+            encoding: "utf8",
+            timeout: 15000,
+        }).trim();
+        // Output format: "valid:{plan}:{email}" or "expired" or "not-authenticated"
+        if (validateOutput === "not-authenticated") {
+            throw new Error("Not authenticated. Run: /composure:auth login");
+        }
+        if (validateOutput === "expired") {
+            throw new Error("Session expired. Run: /composure:auth login to refresh.");
+        }
+        const parts = validateOutput.split(":");
+        if (parts[0] !== "valid" || parts.length < 3) {
+            throw new Error(`Unexpected validation response: ${validateOutput}`);
+        }
+        const plan = normalizePlan(parts[1]);
+        const email = parts.slice(2).join(":"); // email may contain colons (unlikely but safe)
+        // Step 2: Get full license info (features, etc.)
+        let features = [];
+        try {
+            const licenseOutput = execFileSync("node", [TOKEN_SCRIPT, "license"], { encoding: "utf8", timeout: 15000 }).trim();
+            const licenseData = JSON.parse(licenseOutput);
+            features = licenseData.features ?? [];
+        }
+        catch {
+            // License endpoint unavailable — proceed with plan-based features
+            features = getDefaultFeatures(plan);
+        }
+        return { valid: true, plan, email, features };
+    }
+    catch (error) {
+        if (error instanceof Error && error.message.includes("Not authenticated")) {
+            throw error;
+        }
+        if (error instanceof Error && error.message.includes("Session expired")) {
+            throw error;
+        }
+        throw new Error(`License validation failed: ${error instanceof Error ? error.message : String(error)}`);
+    }
+}
+/**
+ * Validate using legacy token (standalone license server)
+ */
+async function validateViaToken(token) {
+    const LICENSE_SERVER = process.env.TEMPLATE_LICENSE_SERVER ?? "https://composure-pro.com";
+    const response = await fetch(`${LICENSE_SERVER}/api/v1/license/validate`, {
+        headers: {
+            Authorization: `Bearer ${token}`,
+            "Content-Type": "application/json",
+        },
+    });
+    if (!response.ok) {
+        const body = await response
+            .json()
+            .catch(() => ({ message: "Unknown error" }));
+        throw new Error(`License validation failed: ${body.message ?? response.statusText}`);
+    }
+    const data = (await response.json());
+    return {
+        valid: true,
+        plan: normalizePlan(data.plan),
+        email: data.email ?? "unknown",
+        features: data.features ?? getDefaultFeatures(normalizePlan(data.plan)),
+    };
+}
+/**
+ * Normalize plan string to TemplatePlan
+ */
+function normalizePlan(plan) {
+    switch (plan?.toLowerCase()) {
+        case "enterprise":
+            return "enterprise";
+        case "pro":
+            return "pro";
+        default:
+            return "free";
+    }
+}
+/**
+ * Default features by plan when license endpoint doesn't return them
+ */
+function getDefaultFeatures(plan) {
+    switch (plan) {
+        case "enterprise":
+            return ["starter", "pro", "mobile", "support"];
+        case "pro":
+            return ["starter", "pro", "mobile"];
+        case "free":
+        default:
+            return ["starter", "mobile"];
+    }
+}

package/dist/steps/validate-target.d.ts

@@ -0,0 +1 @@
+export declare function validateTarget(projectName: string): Promise<void>;

package/dist/steps/validate-target.js

@@ -0,0 +1,14 @@
+import { existsSync, readdirSync } from "node:fs";
+import { resolve } from "node:path";
+export async function validateTarget(projectName) {
+    if (!/^[a-z0-9-_]+$/i.test(projectName)) {
+        throw new Error(`Invalid project name "${projectName}". Use letters, numbers, dashes, and underscores only.`);
+    }
+    const targetPath = resolve(process.cwd(), projectName);
+    if (existsSync(targetPath)) {
+        const contents = readdirSync(targetPath);
+        if (contents.length > 0) {
+            throw new Error(`Target directory "${projectName}" exists and is not empty. Refusing to overwrite.`);
+        }
+    }
+}

package/package.json

@@ -0,0 +1,33 @@
+{
+  "name": "create-composure-app",
+  "version": "1.0.0",
+  "description": "Scaffold a new Composure Template project — multi-tenant Next.js + Supabase + Expo",
+  "type": "module",
+  "bin": {
+    "create-composure-app": "./dist/index.js"
+  },
+  "scripts": {
+    "build": "tsc",
+    "dev": "tsc --watch",
+    "test": "vitest run",
+    "prepublishOnly": "pnpm build"
+  },
+  "dependencies": {
+    "commander": "^13.1.0",
+    "kleur": "^4.1.5",
+    "ora": "^8.2.0",
+    "prompts": "^2.4.2"
+  },
+  "devDependencies": {
+    "@types/node": "^22.0.0",
+    "@types/prompts": "^2.4.9",
+    "typescript": "^5.9.3",
+    "vitest": "^4.1.2"
+  },
+  "engines": {
+    "node": ">=22.0.0"
+  },
+  "publishConfig": {
+    "access": "public"
+  }
+}

package/src/commands/create.ts

@@ -0,0 +1,124 @@
+import kleur from "kleur";
+import ora from "ora";
+import { validateTarget } from "../steps/validate-target.js";
+import { validateLicense } from "../steps/validate-license.js";
+import { downloadTemplate } from "../steps/download-template.js";
+import { rewritePackageNames } from "../steps/rewrite-package-names.js";
+import { resetMigrations } from "../steps/reset-migrations.js";
+import { scaffoldTier } from "../steps/scaffold-tier.js";
+import { initGit } from "../steps/init-git.js";
+import { installDeps } from "../steps/install-deps.js";
+import { printNextSteps } from "../steps/print-next-steps.js";
+import { promptProjectName, promptInstallTier } from "../lib/prompts.js";
+import type { InstallTier } from "../lib/prompts.js";
+import { logger } from "../lib/logger.js";
+
+export interface CreateOptions {
+  token?: string;
+  cleanMigrations?: boolean;
+  skipInstall?: boolean;
+  dev?: boolean;
+  tier?: string;
+}
+
+export async function createCommand(
+  name: string | undefined,
+  options: CreateOptions,
+) {
+  logger.info(kleur.bold().blue("\n  create-composure-app\n"));
+
+  try {
+    const projectName = name ?? (await promptProjectName());
+
+    await validateTarget(projectName);
+
+    // ── License validation ──────────────────────────────────
+    let tier: InstallTier;
+
+    if (options.dev) {
+      logger.warn("Dev mode — skipping license validation");
+      // In dev mode, allow tier flag or prompt
+      tier = (options.tier as InstallTier) ?? (await promptInstallTier("enterprise"));
+    } else {
+      const spinner = ora("Validating license...").start();
+      const license = await validateLicense(options.token);
+      spinner.succeed(
+        `License validated — ${kleur.green(license.plan)} plan (${license.email})`,
+      );
+
+      // ── Interactive tier selection ──────────────────────────
+      logger.info("");
+      tier = (options.tier as InstallTier) ?? (await promptInstallTier(license.plan));
+    }
+
+    const includeMobile = tier === "starter-mobile" || tier === "pro-mobile";
+    const includePro = tier === "pro" || tier === "pro-mobile";
+
+    logger.info(
+      `\n  ${kleur.bold("Selected:")} ${tierLabel(tier)}\n`,
+    );
+
+    // ── Download ──────────────────────────────────────────────
+    const downloadSpinner = ora("Downloading template...").start();
+    await downloadTemplate(projectName, options.token, options.dev);
+    downloadSpinner.succeed("Template downloaded");
+
+    // ── Scaffold tier (remove unused files) ──────────────────
+    const scaffoldSpinner = ora("Scaffolding for selected tier...").start();
+    const { removed } = await scaffoldTier(projectName, tier);
+    if (removed.length > 0) {
+      scaffoldSpinner.succeed(
+        `Scaffolded — removed ${removed.length} items not in ${tierLabel(tier)}`,
+      );
+    } else {
+      scaffoldSpinner.succeed("Full template installed");
+    }
+
+    // ── Personalize ──────────────────────────────────────────
+    const rewriteSpinner = ora("Personalizing project...").start();
+    await rewritePackageNames(projectName);
+    rewriteSpinner.succeed("Project personalized");
+
+    // ── Migrations ───────────────────────────────────────────
+    if (options.cleanMigrations) {
+      const migSpinner = ora("Resetting migrations...").start();
+      await resetMigrations(projectName);
+      migSpinner.succeed("Migrations reset");
+    }
+
+    // ── Git ──────────────────────────────────────────────────
+    const gitSpinner = ora("Initializing git...").start();
+    await initGit(projectName);
+    gitSpinner.succeed("Git initialized");
+
+    // ── Dependencies ─────────────────────────────────────────
+    if (!options.skipInstall) {
+      const installSpinner = ora(
+        "Installing dependencies (this may take a minute)...",
+      ).start();
+      await installDeps(projectName);
+      installSpinner.succeed("Dependencies installed");
+    }
+
+    // ── Summary ──────────────────────────────────────────────
+    printNextSteps(projectName, { includeMobile, includePro });
+  } catch (error) {
+    logger.error(
+      `\nFailed: ${error instanceof Error ? error.message : String(error)}`,
+    );
+    process.exit(1);
+  }
+}
+
+function tierLabel(tier: InstallTier): string {
+  switch (tier) {
+    case "starter":
+      return "Starter (Web)";
+    case "starter-mobile":
+      return "Starter + Mobile";
+    case "pro":
+      return "Pro (Web)";
+    case "pro-mobile":
+      return "Pro + Mobile";
+  }
+}

package/src/index.ts

@@ -0,0 +1,22 @@
+#!/usr/bin/env node
+
+import { Command } from "commander";
+import { createCommand } from "./commands/create.js";
+
+const program = new Command();
+
+program
+  .name("create-composure-app")
+  .description("Scaffold a new Composure Template project — multi-tenant Next.js + Supabase + Expo")
+  .version("1.0.0");
+
+program
+  .argument("[name]", "Project name")
+  .option("-t, --token <token>", "OAuth license token (or use Composure login)")
+  .option("--tier <tier>", "Install tier: starter, starter-mobile, pro, pro-mobile")
+  .option("--clean-migrations", "Reset migrations to a single baseline", false)
+  .option("--skip-install", "Skip pnpm install step", false)
+  .option("--dev", "Development mode — skips license validation", false)
+  .action(createCommand);
+
+program.parse();

package/src/lib/logger.ts

@@ -0,0 +1,8 @@
+import kleur from "kleur";
+
+export const logger = {
+  info: (msg: string) => console.log(kleur.blue(msg)),
+  success: (msg: string) => console.log(kleur.green(msg)),
+  warn: (msg: string) => console.log(kleur.yellow(msg)),
+  error: (msg: string) => console.error(kleur.red(msg)),
+};

package/src/lib/prompts.ts

@@ -0,0 +1,114 @@
+import prompts from "prompts";
+import type { TemplatePlan } from "../steps/validate-license.js";
+
+export async function promptProjectName(): Promise<string> {
+  const { name } = await prompts({
+    type: "text",
+    name: "name",
+    message: "Project name",
+    validate: (value: string) =>
+      /^[a-z0-9-_]+$/i.test(value) || "Use letters, numbers, dashes, and underscores only",
+  });
+
+  if (!name) {
+    throw new Error("Project name is required.");
+  }
+
+  return name;
+}
+
+export async function promptConfirm(message: string): Promise<boolean> {
+  const { confirmed } = await prompts({
+    type: "confirm",
+    name: "confirmed",
+    message,
+    initial: true,
+  });
+
+  return confirmed ?? false;
+}
+
+// =============================================================================
+// Tier Selection
+// =============================================================================
+
+export type InstallTier = "starter" | "starter-mobile" | "pro" | "pro-mobile";
+
+interface TierOption {
+  title: string;
+  value: InstallTier;
+  description: string;
+}
+
+const ALL_TIERS: TierOption[] = [
+  {
+    title: "Starter (Web only)",
+    value: "starter",
+    description: "Auth, accounts, users, contacts, settings, team",
+  },
+  {
+    title: "Starter + Mobile",
+    value: "starter-mobile",
+    description: "Starter + Expo app with 3 tenant tab layouts",
+  },
+  {
+    title: "Pro (Web only)",
+    value: "pro",
+    description: "All 30 tables, all screens, CRM, inbox, workflows, AI, commerce",
+  },
+  {
+    title: "Pro + Mobile",
+    value: "pro-mobile",
+    description: "Everything + Expo mobile app",
+  },
+];
+
+/**
+ * Get available tiers based on license plan.
+ *
+ * - enterprise: all tiers
+ * - pro: all tiers
+ * - free: starter tiers only
+ */
+function getAvailableTiers(plan: TemplatePlan): TierOption[] {
+  switch (plan) {
+    case "enterprise":
+    case "pro":
+      return ALL_TIERS;
+    case "free":
+    default:
+      return ALL_TIERS.filter(
+        (t) => t.value === "starter" || t.value === "starter-mobile",
+      );
+  }
+}
+
+/**
+ * Prompt the user to select their install tier.
+ * Enterprise users see all options. Free users see starter options only.
+ */
+export async function promptInstallTier(
+  plan: TemplatePlan,
+): Promise<InstallTier> {
+  const available = getAvailableTiers(plan);
+
+  // If enterprise with only one sensible choice, still show the prompt
+  // so internal users can choose web-only vs web+mobile
+  const { tier } = await prompts({
+    type: "select",
+    name: "tier",
+    message: "What would you like to install?",
+    choices: available.map((t) => ({
+      title: t.title,
+      value: t.value,
+      description: t.description,
+    })),
+    initial: available.length - 1, // Default to the highest tier available
+  });
+
+  if (!tier) {
+    throw new Error("Installation cancelled.");
+  }
+
+  return tier as InstallTier;
+}

package/src/steps/download-template.ts

@@ -0,0 +1,55 @@
+import { execFileSync } from "node:child_process";
+import { resolve, basename } from "node:path";
+
+const TEMPLATE_REPO =
+  process.env.TEMPLATE_REPO_URL ?? "https://github.com/hrconsultnj/template-monorepo.git";
+
+export async function downloadTemplate(
+  projectName: string,
+  token?: string,
+  devMode?: boolean,
+): Promise<void> {
+  // Defense-in-depth: ensure projectName is just a directory name, no path traversal
+  if (basename(projectName) !== projectName) {
+    throw new Error(`Invalid project name: "${projectName}" contains path separators.`);
+  }
+
+  const targetPath = resolve(process.cwd(), projectName);
+
+  if (devMode) {
+    // execFileSync bypasses the shell — no injection possible
+    execFileSync("git", [
+      "clone", "--depth=1", "--single-branch", TEMPLATE_REPO, targetPath,
+    ], { stdio: "pipe" });
+    return;
+  }
+
+  // Production mode: download tarball from license server
+  const LICENSE_SERVER =
+    process.env.TEMPLATE_LICENSE_SERVER ?? "https://composure-pro.com";
+
+  const response = await fetch(`${LICENSE_SERVER}/download`, {
+    headers: {
+      Authorization: `Bearer ${token}`,
+    },
+  });
+
+  if (!response.ok) {
+    throw new Error(`Download failed: ${response.statusText}`);
+  }
+
+  const { mkdirSync, writeFileSync } = await import("node:fs");
+  mkdirSync(targetPath, { recursive: true });
+
+  const buffer = Buffer.from(await response.arrayBuffer());
+  const tarballPath = resolve(targetPath, ".template.tar.gz");
+  writeFileSync(tarballPath, buffer);
+
+  // --no-absolute-names prevents path traversal in tarball entries
+  execFileSync("tar", [
+    "xzf", ".template.tar.gz", "--strip-components=1", "--no-absolute-names",
+  ], { cwd: targetPath, stdio: "pipe" });
+
+  const { unlinkSync } = await import("node:fs");
+  unlinkSync(tarballPath);
+}

package/src/steps/init-git.ts

@@ -0,0 +1,18 @@
+import { execSync } from "node:child_process";
+import { rmSync } from "node:fs";
+import { resolve } from "node:path";
+
+export async function initGit(projectName: string): Promise<void> {
+  const targetPath = resolve(process.cwd(), projectName);
+
+  // Remove the cloned .git directory
+  rmSync(resolve(targetPath, ".git"), { recursive: true, force: true });
+
+  // Initialize fresh git repo
+  execSync("git init", { cwd: targetPath, stdio: "pipe" });
+  execSync("git add -A", { cwd: targetPath, stdio: "pipe" });
+  execSync(
+    'git commit -m "chore: initial commit from create-composure-app"',
+    { cwd: targetPath, stdio: "pipe" },
+  );
+}

package/src/steps/install-deps.ts

@@ -0,0 +1,7 @@
+import { execSync } from "node:child_process";
+import { resolve } from "node:path";
+
+export async function installDeps(projectName: string): Promise<void> {
+  const targetPath = resolve(process.cwd(), projectName);
+  execSync("pnpm install", { cwd: targetPath, stdio: "pipe" });
+}

package/src/steps/print-next-steps.ts

@@ -0,0 +1,60 @@
+import kleur from "kleur";
+
+interface NextStepsOptions {
+  includeMobile?: boolean;
+  includePro?: boolean;
+}
+
+export function printNextSteps(
+  projectName: string,
+  options: NextStepsOptions = {},
+): void {
+  const { includeMobile = false, includePro = false } = options;
+  const name = kleur.cyan(projectName);
+
+  const features = [
+    `- ${kleur.blue("Web app")} — Next.js 16 + Tailwind + shadcn`,
+    `- ${kleur.blue("Database")} — Supabase + typed queries + RLS`,
+    `- ${kleur.blue("3 tenant types")} — Admin / Workspace / Portal`,
+    `- ${kleur.blue("Auth")} — Contact-first signup + multi-account`,
+  ];
+
+  if (includeMobile) {
+    features.push(
+      `- ${kleur.blue("Mobile app")} — Expo SDK 55 + React Native`,
+    );
+  }
+
+  if (includePro) {
+    features.push(
+      `- ${kleur.blue("CRM")} — Tasks, deals, pipelines`,
+      `- ${kleur.blue("Inbox")} — Threads, compose, reply`,
+      `- ${kleur.blue("AI")} — Agents, memory graph, thinking`,
+      `- ${kleur.blue("Commerce")} — Invoices, quotes, payments`,
+      `- ${kleur.blue("Workflows")} — Visual automation engine`,
+    );
+  }
+
+  console.log(`
+${kleur.green().bold("Your project is ready!")}
+
+${kleur.bold("Next steps:")}
+  ${kleur.gray("$")} cd ${name}
+  ${kleur.gray("$")} pnpm supabase start
+  ${kleur.gray("$")} pnpm dev
+
+${kleur.bold("First-time setup:")}
+  1. Copy ${kleur.yellow(".env.example")} to ${kleur.yellow(".env")}
+  2. Fill in your Supabase keys
+  3. Run ${kleur.yellow(`pnpm --filter @${projectName}/database db:types`)} after migrations apply
+  4. Visit ${kleur.underline("http://localhost:3000")} to sign up
+
+${kleur.bold("What's included:")}
+${features.map((f) => `  ${f}`).join("\n")}
+${!includePro ? `\n${kleur.yellow("Upgrade to Pro for CRM, inbox, workflows, AI, and commerce.")}` : ""}
+${!includeMobile ? `\n${kleur.yellow("Add mobile with the + Mobile tier for Expo SDK 55 support.")}` : ""}
+
+${kleur.gray("Docs: https://composure-pro.com/template/docs")}
+${kleur.gray("Support: support@composure-pro.com")}
+`);
+}

package/src/steps/reset-migrations.ts

@@ -0,0 +1,27 @@
+import { readdirSync, readFileSync, writeFileSync, unlinkSync } from "node:fs";
+import { resolve, join } from "node:path";
+
+export async function resetMigrations(projectName: string): Promise<void> {
+  const migrationsDir = resolve(process.cwd(), projectName, "supabase/migrations");
+  const files = readdirSync(migrationsDir)
+    .filter((f) => f.endsWith(".sql"))
+    .sort();
+
+  if (files.length <= 1) return; // Already a single migration
+
+  // Concatenate all migrations into one baseline
+  let combined = "-- Baseline migration generated by create-composure-app --clean-migrations\n\n";
+  for (const file of files) {
+    combined += `-- Source: ${file}\n`;
+    combined += readFileSync(join(migrationsDir, file), "utf-8");
+    combined += "\n\n";
+  }
+
+  // Delete all existing migrations
+  for (const file of files) {
+    unlinkSync(join(migrationsDir, file));
+  }
+
+  // Write the combined baseline
+  writeFileSync(join(migrationsDir, "20260101000001_init.sql"), combined, "utf-8");
+}

package/src/steps/rewrite-package-names.test.ts

@@ -0,0 +1,35 @@
+import { describe, it, expect } from "vitest";
+import { rewritePackageJsonContent } from "./rewrite-package-names.js";
+
+describe("rewritePackageJsonContent", () => {
+  it("replaces @template/* references with project name", () => {
+    const input = JSON.stringify({
+      name: "@template/web",
+      dependencies: {
+        "@template/database": "workspace:*",
+        "@template/shared": "workspace:*",
+      },
+    });
+    const output = rewritePackageJsonContent(input, "my-app");
+    const parsed = JSON.parse(output);
+    expect(parsed.name).toBe("@my-app/web");
+    expect(parsed.dependencies["@my-app/database"]).toBe("workspace:*");
+    expect(parsed.dependencies["@my-app/shared"]).toBe("workspace:*");
+  });
+
+  it("preserves non-template dependencies", () => {
+    const input = JSON.stringify({
+      dependencies: { react: "^19.0.0", "@template/database": "workspace:*" },
+    });
+    const output = rewritePackageJsonContent(input, "acme");
+    const parsed = JSON.parse(output);
+    expect(parsed.dependencies.react).toBe("^19.0.0");
+    expect(parsed.dependencies["@acme/database"]).toBe("workspace:*");
+  });
+
+  it("handles content with no @template/ references", () => {
+    const input = JSON.stringify({ name: "plain-package", version: "1.0.0" });
+    const output = rewritePackageJsonContent(input, "my-app");
+    expect(output).toBe(input);
+  });
+});