umpordez 1.0.2 → 1.1.0

package/.claude/settings.local.json

@@ -14,7 +14,39 @@
       "WebFetch(domain:github.com)",
       "WebFetch(domain:raw.githubusercontent.com)",
       "Bash(gh api:*)",
-      "WebFetch(domain:api.github.com)"
+      "WebFetch(domain:api.github.com)",
+      "Bash(git checkout *)",
+      "Bash(cp /Users/ligeiro/dev/tranqs/app/mobile/tranqs/assets/icon.png /Users/ligeiro/dev/umpordez-cli/template/mobile/{{PROJECT_SLUG}}/assets/icon.png)",
+      "Bash(cp /Users/ligeiro/dev/tranqs/app/mobile/tranqs/assets/adaptive-icon.png /Users/ligeiro/dev/umpordez-cli/template/mobile/{{PROJECT_SLUG}}/assets/adaptive-icon.png)",
+      "Bash(cp /Users/ligeiro/dev/tranqs/app/mobile/tranqs/assets/splash-icon.png /Users/ligeiro/dev/umpordez-cli/template/mobile/{{PROJECT_SLUG}}/assets/splash-icon.png)",
+      "Bash(cp /Users/ligeiro/dev/tranqs/app/mobile/tranqs/assets/favicon.png /Users/ligeiro/dev/umpordez-cli/template/mobile/{{PROJECT_SLUG}}/assets/favicon.png)",
+      "Bash(git add *)",
+      "Bash(git commit -m ' *)",
+      "Bash(npm install *)",
+      "Read(//private/tmp/**)",
+      "Bash(rm -rf icon-test)",
+      "Bash(mkdir icon-test *)",
+      "Read(//tmp/**)",
+      "Bash(git commit *)",
+      "Bash(mv /Users/ligeiro/dev/umpordez-cli/template/mobile/{{PROJECT_SLUG}}/scripts/*.sh /Users/ligeiro/dev/umpordez-cli/template/scripts/)",
+      "Bash(rmdir /Users/ligeiro/dev/umpordez-cli/template/mobile/{{PROJECT_SLUG}}/scripts)",
+      "Read(//Users/ligeiro/dev/umpordez-aulass/**)",
+      "Bash(npx tsc *)",
+      "Bash(sed -i '' 's|^import React, { |import { |' App.tsx src/components/*.tsx src/contexts/*.tsx src/pages/auth/*.tsx src/pages/main/*.tsx)",
+      "Bash(sed -i '' 's|^import React from .react.;||' App.tsx src/components/*.tsx src/contexts/*.tsx src/pages/auth/*.tsx src/pages/main/*.tsx)",
+      "Bash(sed -i '' 's|^import React, { ReactNode }|import { ReactNode }|' src/contexts/*.tsx)",
+      "Bash(grep -l \"^import React\" App.tsx src/components/*.tsx src/contexts/*.tsx src/pages/auth/*.tsx src/pages/main/*.tsx)",
+      "Bash(npm run *)",
+      "Bash(npx expo *)",
+      "Bash(bash scripts/install-native.sh)",
+      "Bash(npm test *)",
+      "Bash(rm -rf /tmp/icon-test)",
+      "Bash(mkdir /tmp/icon-test)",
+      "Bash(md5 /Users/ligeiro/dev/umpordez-cli/template/mobile/{{PROJECT_SLUG}}/assets/icon.png /Users/ligeiro/dev/tranqs/app/mobile/tranqs/assets/icon.png)",
+      "Bash(md5 /tmp/umptest/everything/mobile/testapp/assets/icon.png /Users/ligeiro/dev/tranqs/app/mobile/tranqs/assets/icon.png)",
+      "Bash(git merge *)",
+      "Bash(git tag *)",
+      "Bash(npm pack *)"
     ]
   }
 }

package/README.md

@@ -1,6 +1,7 @@
 # umpordez
 
-SaaS starter kit generator.
+SaaS starter kit generator. Server, admin SPA, public site (i18n + SEO),
+mobile app — all wired up, single command.
 
 ---
 
@@ -12,45 +13,70 @@ access... and then you still haven't written a single line of your
 actual product.
 
 I've built this same architecture across multiple production apps
-(different domains, same bones). At some point I got tired of
-copying between repos, adapting folder names, and forgetting to
-update that one hardcoded port somewhere.
+(different domains, same bones). At some point I got tired of copying
+between repos, adapting folder names, and forgetting to update that
+one hardcoded port somewhere.
 
-So I made a CLI that generates the whole thing. One command, answer a
-few questions, and you get a production-ready multi-tenant SaaS with
-everything wired up.
+So I made a CLI that generates the whole thing. One command, answer
+a few questions, and you get a production-ready multi-tenant SaaS
+with **server + admin + site + mobile** already talking to each
+other.
 
 **No magic, no hidden abstractions.** The generated code is yours;
-plain TypeScript, plain React, plain SQL. Read it, change it, own it.
+plain TypeScript, plain React, plain SQL, plain Expo. Read it,
+change it, own it.
 
 ## What you get
 
 ```
-server/
-  apps/api/           Admin API (Express + TypeScript)
-  apps/site-api/      Public API (Express + TypeScript)
-  apps/shared/        Shared middlewares + utilities
-  core/               Models, DB, S3, email, auth
-  console/            Task runner (migrations, seeds, custom tasks)
-  migrations/         Raw SQL migrations (Knex)
-
-ui/admin/             React SPA (Vite + shadcn/ui + Tailwind)
-ui/site/              Public site (Express + EJS + Tailwind)
+<project>/
+├── server/                   Admin API + Site API + console + DB
+│                              (Express + TypeScript + PostgreSQL +
+│                               Knex + Zod)
+├── ui/admin/                 React SPA (Vite + shadcn/ui + Tailwind)
+├── ui/site/                  Public site (Express + EJS + Tailwind +
+│                              i18n with SEO best practices)
+├── mobile/<slug>/            Expo + React Native + TypeScript
+│                              with auth, offline SQLite, content
+│                              sync, IAP, push (custom-native),
+│                              Apple Health + Health Connect
+├── scripts/                  All helpers in one place (mobile, deploy,
+│                              version bumping, icon generation)
+├── doc/index.html            HTML docs themed in your primary color
+├── .claude/                  Claude Code permission allowlist
+└── CLAUDE.md (× 5)           Per-app rules for AI agents
 ```
 
-The architecture:
-
-- **Multi-tenant**; users > accounts with role-based access
-  (admin, owner, manager, user)
-- **Multi-API**; separate Express servers sharing core logic,
-  add more as you need
-- **Cookie auth**; httpOnly JWT, 30-day expiry, no tokens
-  in localStorage
-- **S3 uploads**; multer-s3 with signed URLs (never public-read)
-- **Context DI**; fresh context per request with all models
-  instantiated, no singletons
-- **PostgreSQL**; Knex.js with raw SQL migrations, because ORMs
-  lie to you eventually :X
+## Architecture (the bones)
+
+- **Multi-tenant** — users → user_in_accounts → accounts → domain
+  entities. Roles: admin / owner / manager / user.
+- **Multi-API** — separate Express servers sharing one `core/`
+  layer. Add more APIs by copying `apps/api/`.
+- **Hybrid auth** — httpOnly JWT cookies for web, Bearer tokens for
+  mobile, refresh-token rotation single-flighted to prevent false
+  logouts on concurrent refresh.
+- **Apple Sign-In + Google OAuth** pre-wired. Apple via JWKS verify
+  (zero-dep), Google via server-side flow that keeps the
+  `client_secret` out of the app bundle.
+- **Free-first mobile** — anyone can use the app without sign-in.
+  Auth reached via Profile or via PremiumGate's onUpgrade.
+- **Offline-first SQLite** with USER vs SHARED table classes,
+  cloud backup/restore via S3 (two-phase upload survives
+  mid-failure).
+- **Content sync** — versioned catalog + HMAC-signed presigned
+  asset URLs cached for 55 min, server out of the streaming path.
+- **i18n done right** — pt-BR default + en, every string via
+  `t()`. Site uses URL prefixes (`/` vs `/en/`) for SEO with full
+  hreflang + canonical + sitemap.xml.
+- **Custom-native push** with cold-start tap dispatch (the bit
+  expo-notifications can't do reliably).
+- **Context DI** — fresh `Context` per request, all models
+  instantiated, no singletons, no shared state.
+- **Routes go through models** — never knex from a route. Path
+  aliases (`#core/*`, `#shared/*`, `@/*`) over relative paths.
+- **PostgreSQL with raw SQL migrations** — because ORMs lie to you
+  eventually.
 
 ## Install
 
@@ -66,22 +92,70 @@ npm install -g umpordez
 umpordez
 ```
 
-That's it. It asks you a few questions (name, domain, ports, colors)
-and generates everything. Then:
+It asks **what to generate** first:
+
+| Preset | Includes |
+|---|---|
+| everything          | server + admin UI + site + mobile |
+| web-only            | server + admin UI + site (no mobile) |
+| mobile-and-server   | server + mobile (no UI) |
+| just-mobile         | mobile only (assumes external API) |
+
+Then a few questions (name, domain, ports, primary color, mobile
+bundle ID if applicable). After scaffold:
 
 ```bash
 cd my-project
-./install.sh          # install deps
-./seed.sh             # create db + migrate + seed admin
-./dev.sh              # start all services
+./install.sh           # install all node deps + seed .env files
+./install.sh --native  # also expo prebuild + pod install + native
+./seed.sh              # create db + run migrations + seed admin
+./dev.sh               # start every service (mobile included by default)
+./dev.sh --no-mobile   # skip Metro this run
+```
+
+### Update an existing project
+
+When the umpordez template ships fixes / new files / refactors, pull
+them into your project:
+
+```bash
+umpordez update <path>          # walk template + project, prompt per file
+umpordez update <path> --yes    # accept all auto-updates without prompting
 ```
 
+How it knows what's safe to auto-update: at scaffold time, the CLI
+writes `.umpordez/manifest.json` with sha256 of every file as it was
+generated. On update:
+
+- File untouched since scaffold → auto-updates if template changed
+- File user-edited → shows a diff and asks (y / N / d=full diff /
+  a=accept all)
+- Generated assets (icons, splash, favicon) regenerate from the
+  manifest's stored primary color when missing
+
+Random secrets (JWT, content HMAC) are persisted in the manifest
+so updates don't mint fresh ones and break sessions / signed URLs
+already issued by the running app.
+
+### Generate icons
+
+The mobile preset auto-generates a branded icon set at scaffold
+time from your primary color + first letter of the project name. To
+re-run later (e.g. after dropping in a real logo PNG):
+
+```bash
+umpordez icons --primary '#02e027' --letter U --out ./assets
+umpordez icons --from logo.png --primary '#02e027' --out ./assets
+```
+
+Outputs: `icon.png`, `adaptive-icon.png`, `splash-icon.png`,
+`favicon.png`, `appstore.png`, `playstore.png`.
+
 ### Build for production
 
-The build system is split in two steps on purpose; compilation is
-expensive and should run on your machine, dependency installation
-needs to happen on the target machine (native bindings, OS-specific
-stuff).
+The build system is split in two on purpose: compilation is
+expensive and should run locally; dependency installation needs to
+happen on the target machine (native bindings, OS-specific stuff).
 
 ```bash
 # Step 1: compile locally, push artifacts to builds repo
@@ -91,27 +165,61 @@ umpordez build ../app ../builds
 umpordez build-deps ../builds
 ```
 
-After `build-deps`, the builds repo is ready to clone and run. Add
-your `.env`, start the services, done.
-
-### Other commands
+### Mobile release
 
 ```bash
-umpordez --help       # see all commands
-umpordez --version    # check version
+./scripts/bump-version.sh patch       # bumps every version-holding file atomically
+./scripts/release-android.sh          # EAS local build → submit to Play (internal track)
+# iOS: open ios/<slug>.xcworkspace and Archive, or use eas build
+```
+
+### All commands
+
+```
+umpordez                          create a new project
+umpordez create                   same
+umpordez build <app> <builds>     compile for production
+umpordez build-deps <builds>      install prod deps on target machine
+umpordez icons [--from logo.png]  generate the mobile icon set
+umpordez update <path> [--yes]    pull template changes into a project
+umpordez --help                   show this help
+umpordez --version                check version
 ```
 
 ## Tech stack
 
-| Layer      | Tech |
-|------------|------|
+| Layer | Tech |
+|---|---|
 | Backend    | TypeScript, Express, PostgreSQL, Knex.js, Zod |
-| Admin UI   | React 18, Vite, Tailwind, shadcn/ui (Radix), React Query v5 |
-| Public site| Express + EJS + Tailwind |
-| Auth       | httpOnly JWT cookies (bcrypt + 30-day expiry) |
-| Uploads    | AWS S3 via multer-s3, signed URLs |
+| Admin UI   | React 18, Vite, Tailwind, shadcn/ui (Radix), React Query v5, React Hook Form |
+| Public site| Express + EJS + Tailwind + i18next (with hreflang/canonical/sitemap) |
+| Mobile     | Expo, React Native, TypeScript, expo-sqlite, react-native-iap, react-native-health, custom-native push |
+| Auth       | httpOnly JWT cookies (web) + Bearer + refresh rotation (mobile), Apple + Google OAuth |
+| Uploads    | AWS S3 with signed URLs |
 | Email      | Nodemailer + HTML templates |
 
+## What changed in 1.1
+
+The big one. v1.0.x was server + web only. v1.1 adds:
+
+- **Mobile preset** — full Expo + RN app with auth, offline DB,
+  cloud backup, content sync, IAP, push, health.
+- **CLI presets** — pick what you want generated up front.
+- **`umpordez update`** — pull template changes into existing
+  projects without losing your custom code.
+- **`umpordez icons`** — branded icon generator.
+- **i18n** — site (URL-prefixed, SEO-best-practices) and mobile
+  (Profile picker with country flags).
+- **Custom-native push** with cold-start tap dispatch (Swift +
+  Kotlin), Apple Sign-In + Google server-side OAuth.
+- **Per-app `CLAUDE.md`** files + `.claude/settings.json` with a
+  permission allowlist for routine commands.
+- **Tests scaffold** in `server/tests/` (KISS — node:test + tsx).
+- **Production hardening** — TZ=UTC, fatal handlers,
+  trust-proxy lifted from agendalize.
+
+Existing projects pick up everything via `umpordez update <path>`.
+
 ## License
 
 MIT; do whatever you want with it.

package/cli.mjs

@@ -6,6 +6,8 @@ import { createRequire } from 'node:module';
 
 import { createProject } from './create.mjs';
 import { buildProject, buildDeps } from './build.mjs';
+import { generateIcons } from './icons.mjs';
+import { updateProject } from './update.mjs';
 
 const require = createRequire(import.meta.url);
 const { version } = require('./package.json');
@@ -33,6 +35,8 @@ function showHelp() {
     console.log(`  umpordez create       ${dim('Create a new project')}`);
     console.log(`  umpordez build ${dim('<app> <builds>')}       ${dim('Build for production')}`);
     console.log(`  umpordez build-deps ${dim('<builds>')}        ${dim('Install deps in build')}`);
+    console.log(`  umpordez icons ${dim('[--from logo.png]')}    ${dim('Generate mobile icons')}`);
+    console.log(`  umpordez update ${dim('<path> [--yes]')}      ${dim('Pull template updates into a project')}`);
     console.log(`  umpordez --help                  ${dim('Show this help')}`);
     console.log(`  umpordez --version               ${dim('Show version')}`);
     console.log('');
@@ -71,6 +75,62 @@ async function runBuild(args) {
     await buildProject(appDir, buildDir);
 }
 
+function parseFlags(args) {
+    const flags = {};
+    for (let i = 0; i < args.length; i++) {
+        const a = args[i];
+        if (!a.startsWith('--')) {
+            continue;
+        }
+        const key = a.slice(2);
+        const next = args[i + 1];
+        if (next === undefined || next.startsWith('--')) {
+            flags[key] = true;
+        } else {
+            flags[key] = next;
+            i++;
+        }
+    }
+    return flags;
+}
+
+async function runIcons(args) {
+    const flags = parseFlags(args.slice(1));
+    const out = flags.out ?? './assets';
+    const primary = flags.primary ?? '#2563eb';
+    const letter = flags.letter ?? 'A';
+    const sourcePath = typeof flags.from === 'string' ? flags.from : null;
+
+    if (!flags.primary) {
+        console.log(dim(`No --primary given, using default ${primary}`));
+    }
+    if (!flags.letter && !sourcePath) {
+        console.log(dim(`No --letter given, using default ${letter}`));
+    }
+
+    console.log('');
+    console.log(green('  Generating icons'));
+    console.log(dim(`  Output: ${out}`));
+    console.log(dim(`  Primary: ${primary}`));
+    if (sourcePath) {
+        console.log(dim(`  Source: ${sourcePath}`));
+    } else {
+        console.log(dim(`  Letter: ${letter}`));
+    }
+    console.log('');
+
+    const written = await generateIcons({
+        outDir: out,
+        primaryColor: primary,
+        letter: letter.charAt(0).toUpperCase(),
+        sourcePath
+    });
+    for (const p of written) {
+        console.log(`  ${green('✓')} ${p}`);
+    }
+    console.log('');
+}
+
 async function runBuildDeps(args) {
     const buildDir = args[1];
 
@@ -97,6 +157,21 @@ if (!command || command === 'create') {
     await runBuild(args);
 } else if (command === 'build-deps') {
     await runBuildDeps(args);
+} else if (command === 'icons') {
+    await runIcons(args);
+} else if (command === 'update') {
+    const flags = parseFlags(args.slice(1));
+    const projectPath = args[1] && !args[1].startsWith('--')
+        ? args[1]
+        : '.';
+    if (!projectPath) {
+        console.log(red('Usage: umpordez update <path> [--yes]'));
+        console.log(dim(
+            '  --yes  Accept all auto-updates without prompting.'
+        ));
+        process.exit(1);
+    }
+    await updateProject(projectPath, { yes: !!flags.yes });
 } else if (command === '--help' || command === '-h' || command === 'help') {
     showHelp();
 } else if (command === '--version' || command === '-v') {