umpordez 1.3.2 → 1.5.0

package/template-variables.mjs

@@ -39,6 +39,42 @@
 //                            plays the AnimatedSplash on boot or shows
 //                            up instantly (native splash hides on font
 //                            load). Consumed by mobile src/config.ts.
+// {{AUTH_GOOGLE_ENABLED}}  — "true"/"false" — Google sign-in button in
+//                            the mobile app. Consumed by src/config.ts.
+// {{AUTH_APPLE_ENABLED}}   — "true"/"false" — Apple sign-in button in
+//                            the mobile app. Consumed by src/config.ts.
+// {{IOS_APPLE_SIGNIN_JSON}} — app.json fragment: `"usesAppleSignIn":
+//                            true,` (with leading newline+indent) when
+//                            Apple sign-in is on, empty when off.
+// {{APPLE_AUTH_PLUGIN_JSON}} — app.json fragment: the
+//                            `"expo-apple-authentication",` plugins
+//                            entry when Apple sign-in is on, empty
+//                            when off (the plugin adds the Sign in
+//                            with Apple entitlement unconditionally,
+//                            so it must not ship when disabled).
+// {{PROJECT_SLUG_UNDERSCORE}} — Slug with dashes → underscores. Used
+//                            for IAP product IDs (Apple rejects
+//                            dashes in product identifiers).
+// {{IAP_ENABLED}}          — "true"/"false" — in-app purchases picked
+//                            at scaffold time. Consumed by mobile
+//                            src/config.ts; gates PremiumGate and the
+//                            iap service.
+// {{IAP_DEP_JSON}}         — package.json fragment: the `"expo-iap"`
+//                            dependency line when IAP is on, empty
+//                            when off (expo-iap autolinks its native
+//                            billing code whenever installed, so the
+//                            dep itself must not ship when disabled).
+// {{IAP_PLUGIN_JSON}}      — app.json fragment: the `"expo-iap"`
+//                            plugins entry when IAP is on, empty
+//                            when off.
+// {{IAP_BILLING_PERMISSION_JSON}} — app.json fragment: the Android
+//                            `com.android.vending.BILLING` permission
+//                            when IAP is on, empty when off.
+// {{IAP_REQUIRE_BLOCK}}    — services/iap/index.ts fragment: the lazy
+//                            try/require of expo-iap when IAP is on;
+//                            a stub comment when off (Metro resolves
+//                            require() statically, so the literal
+//                            must not appear when the dep is absent).
 
 // ─── Site landing variants ────────────────────────────────────────────────────
 // The public site ships two landing flavors. The SaaS landing (CTAs →
@@ -52,6 +88,101 @@
 
 export const SITE_VARIANT_DIR = 'ui/site/_variants';
 
+// ─── Components ──────────────────────────────────────────────────────────────
+// A project is any combination of four components, each picked with a
+// yes/no at create time:
+//
+//   server   — Admin API + Site API (Express + PostgreSQL)
+//   adminUi  — React admin webapp (requires server)
+//   site     — Public site / landing page (EJS + i18n)
+//   mobile   — Expo + React Native app
+//
+// Both create.mjs and update.mjs derive "which template paths ship"
+// from these flags via the helpers below, so the two tools can never
+// drift. The legacy preset names are kept as manifest labels (old
+// projects only recorded a preset string).
+
+export const LEGACY_PRESET_COMPONENTS = {
+    everything:          { server: true,  adminUi: true,
+                           site: true,   mobile: true  },
+    'web-only':          { server: true,  adminUi: true,
+                           site: true,   mobile: false },
+    'mobile-and-site':   { server: false, adminUi: false,
+                           site: true,   mobile: true  },
+    'mobile-and-server': { server: true,  adminUi: false,
+                           site: false,  mobile: true  },
+    'just-mobile':       { server: false, adminUi: false,
+                           site: false,  mobile: true  }
+};
+
+/** Components for a manifest that only recorded a preset name. */
+export function componentsForPreset(preset) {
+    return LEGACY_PRESET_COMPONENTS[preset]
+        ?? LEGACY_PRESET_COMPONENTS.everything;
+}
+
+/**
+ * Manifest label for a component combo. Combos matching a legacy
+ * preset keep its exact name (older CLI versions still understand
+ * the manifest); anything else is "custom".
+ */
+export function presetNameForComponents(c) {
+    for (const [name, def] of
+        Object.entries(LEGACY_PRESET_COMPONENTS)) {
+        if (def.server === !!c.server
+            && def.adminUi === !!c.adminUi
+            && def.site === !!c.site
+            && def.mobile === !!c.mobile) {
+            return name;
+        }
+    }
+    return 'custom';
+}
+
+/** Top-level template dirs a component combo ships. */
+export function includesForComponents(c) {
+    const includes = ['doc'];
+    if (c.server) {
+        includes.push('server', 'misc');
+    }
+    if (c.adminUi) {
+        includes.push('ui/admin');
+    }
+    if (c.site) {
+        includes.push('ui/site');
+    }
+    if (c.mobile) {
+        includes.push('mobile', 'scripts');
+    }
+    return includes;
+}
+
+/** Root-level template files a component combo ships. */
+export function rootFilesForComponents(c) {
+    const files = ['CLAUDE.md', 'README.md', 'code.md',
+                   'install.sh', 'dev.sh'];
+    if (c.server) {
+        files.push('architecture.md', 'seed.sh');
+    }
+    if (c.server || c.site || c.adminUi) {
+        files.push('AGENTS.md');
+    }
+    return files;
+}
+
+/**
+ * Whether the public site ships the app-marketing landing (store
+ * buttons + download CTA) instead of the SaaS landing (signup CTA).
+ * New projects store the decision in details.appLanding; legacy
+ * manifests fall back to the preset that implied it.
+ */
+export function wantsAppLanding(details, preset) {
+    if (typeof details?.appLanding === 'boolean') {
+        return details.appLanding;
+    }
+    return preset === 'mobile-and-site';
+}
+
 // [variantPath, canonicalPath] — relative to the project root.
 export const APP_LANDING_SWAPS = [
     ['ui/site/_variants/app/home.ejs',
@@ -247,6 +378,7 @@ export function buildReplacements(details) {
         '{{PROJECT_SLUG_UPPER}}': details.slug
             .toUpperCase()
             .replace(/-/g, '_'),
+        '{{PROJECT_SLUG_UNDERSCORE}}': details.slug.replace(/-/g, '_'),
         '{{PROJECT_DESCRIPTION}}': details.description,
         '{{DOMAIN}}': details.domain,
         '{{DB_NAME}}': details.dbName,
@@ -275,5 +407,56 @@ export function buildReplacements(details) {
         '{{JWT_TOKEN_SECRET}}': details.jwtTokenSecret ?? randomSecret(),
         '{{SPLASH_ANIMATED}}':
             details.splashStyle === 'animated' ? 'true' : 'false',
+        // Sign-in providers chosen at scaffold time. Email+password
+        // always ships; these gate the extra buttons in the mobile
+        // app. Default to enabled so legacy manifests (which never
+        // recorded a choice) keep their current behavior on update.
+        '{{AUTH_GOOGLE_ENABLED}}':
+            details.authGoogle === false ? 'false' : 'true',
+        '{{AUTH_APPLE_ENABLED}}':
+            details.authApple === false ? 'false' : 'true',
+        // app.json fragments — the expo-apple-authentication config
+        // plugin adds the Sign in with Apple entitlement
+        // unconditionally when listed, so when Apple is disabled the
+        // plugin entry (and usesAppleSignIn) must disappear from the
+        // JSON entirely, not just flip to false.
+        '{{IOS_APPLE_SIGNIN_JSON}}': details.authApple === false
+            ? ''
+            : '\n            "usesAppleSignIn": true,',
+        '{{APPLE_AUTH_PLUGIN_JSON}}': details.authApple === false
+            ? ''
+            : '\n            "expo-apple-authentication",',
+        // In-app purchases chosen at scaffold time. Defaults to
+        // enabled so legacy manifests (which never recorded a
+        // choice) keep their current behavior on update. When
+        // disabled, the expo-iap dependency / config plugin /
+        // BILLING permission / require() all disappear — the iap
+        // service and PremiumGate degrade to graceful no-ops.
+        '{{IAP_ENABLED}}': details.iap === false ? 'false' : 'true',
+        '{{IAP_DEP_JSON}}': details.iap === false
+            ? ''
+            : '\n        "expo-iap": "^4.4.0",',
+        '{{IAP_PLUGIN_JSON}}': details.iap === false
+            ? ''
+            : ',\n            "expo-iap"',
+        '{{IAP_BILLING_PERMISSION_JSON}}': details.iap === false
+            ? ''
+            : ',\n                "com.android.vending.BILLING"',
+        '{{IAP_REQUIRE_BLOCK}}': details.iap === false
+            ? '// IAP disabled at scaffold time (`umpordez create`\n'
+                + '// without in-app purchases) — expo-iap is not\n'
+                + '// installed and every function below no-ops.\n'
+                + 'const _iap: IAPNative | null = null;'
+            : 'let _iap: IAPNative | null = null;\n'
+                + 'try {\n'
+                + '    // eslint-disable-next-line '
+                + '@typescript-eslint/no-require-imports\n'
+                + '    _iap = require(\'expo-iap\') as IAPNative;\n'
+                + '} catch {\n'
+                + '    console.info(\n'
+                + '        \'[iap] expo-iap not available (Expo Go)'
+                + ' — IAP disabled\'\n'
+                + '    );\n'
+                + '}',
     };
 }

package/update.mjs

@@ -34,7 +34,11 @@ import { fileURLToPath } from 'node:url';
 import chalk from 'chalk';
 import {
     buildReplacements,
-    APP_LANDING_SWAPS
+    APP_LANDING_SWAPS,
+    componentsForPreset,
+    includesForComponents,
+    rootFilesForComponents,
+    wantsAppLanding
 } from './template-variables.mjs';
 import { generateIcons, ICON_TARGETS } from './icons.mjs';
 
@@ -42,23 +46,15 @@ const __dirname = path.dirname(fileURLToPath(import.meta.url));
 const TEMPLATE_DIR = path.join(__dirname, 'template');
 const MANIFEST_PATH = '.umpordez/manifest.json';
 
-// Mirror of the preset → top-level includes mapping in create.mjs.
-// Kept in sync manually because importing from create.mjs would pull
-// inquirer + the prompt code into the update command unnecessarily.
-const PRESET_INCLUDES = {
-    everything: ['server', 'ui/admin', 'ui/site', 'mobile', 'misc',
-                 'scripts', 'doc'],
-    'web-only': ['server', 'ui/admin', 'ui/site', 'misc', 'doc'],
-    'mobile-and-site': ['mobile', 'ui/site', 'scripts', 'doc'],
-    'mobile-and-server': ['server', 'mobile', 'misc', 'scripts',
-                          'doc'],
-    'just-mobile': ['mobile', 'scripts', 'doc']
-};
-
-// Presets that use the app-marketing landing instead of the SaaS one.
-// Mirror of create.mjs's `appLanding` preset flag — kept in sync
-// manually (see PRESET_INCLUDES note above).
-const APP_LANDING_PRESETS = new Set(['mobile-and-site']);
+// Which components a project shipped. New manifests record the
+// components object in details; legacy ones only stored a preset
+// name — map it through the shared table in template-variables.mjs.
+function componentsFromManifest(manifest) {
+    if (manifest.details?.components) {
+        return manifest.details.components;
+    }
+    return componentsForPreset(manifest.preset);
+}
 
 const green = chalk.hex('#02e027');
 const cyan = chalk.hex('#00fff9');
@@ -153,30 +149,26 @@ function applyPathPlaceholders(p, slug) {
 }
 
 /**
- * Walk the template, resolve each file's contents (post-replacement)
- * + final relative path. Returns a map of relative-path → buffer.
- *
- * Skips files outside the project's preset by checking against the
- * project's existing top-level layout — we only want to update what
- * the project actually shipped.
- */
-/**
- * Whether a relative path belongs to the preset. Same prune rules
- * as create.mjs's copyTemplate, expressed as a predicate so we can
- * evaluate per-file instead of pruning a directory.
+ * Whether a relative path belongs to the project's component combo.
+ * Same prune rules as create.mjs's copyTemplate, expressed as a
+ * predicate so we can evaluate per-file instead of pruning a
+ * directory.
  */
-// Top-level directories that ship with every preset (project config
+// Top-level dirs/files that ship with every combo (project config
 // like .claude/ that doesn't belong to any single sub-app). Mirrors
-// the ALWAYS_KEEP set in create.mjs.
-const ALWAYS_IN_PRESET = new Set(['.claude']);
-
-function isPathInPreset(rel, preset) {
-    const includes = PRESET_INCLUDES[preset] ?? PRESET_INCLUDES.everything;
+// the ALWAYS_KEEP sets in create.mjs. Note: rel arrives post
+// path-placeholder pass, so the dot-less `gitignore` the template
+// ships is already `.gitignore` here.
+const ALWAYS_IN_PROJECT = new Set(['.claude']);
+const ALWAYS_ROOT_FILES = new Set(['.gitignore', '.editorconfig']);
+
+function isPathInComponents(rel, components) {
+    const includes = includesForComponents(components);
     const top = rel.split('/')[0];
-    if (ALWAYS_IN_PRESET.has(top)) {
+    if (ALWAYS_IN_PROJECT.has(top)) {
         return true;
     }
-    // ui is special: only the chosen sub-apps live in the preset.
+    // ui is special: only the chosen sub-apps ship.
     if (top === 'ui') {
         const sub = rel.split('/')[1];
         return includes.includes(`ui/${sub}`);
@@ -184,22 +176,34 @@ function isPathInPreset(rel, preset) {
     if (includes.includes(top)) {
         return true;
     }
-    // Top-level files (CLAUDE.md, dev.sh, etc) — let create.mjs's
-    // root-files filter decide. For update we ship them all and let
-    // the manifest comparison do the right thing per file.
-    return rel.indexOf('/') === -1;
+    // Top-level files: same filter create.mjs applies at scaffold
+    // time, so update never re-adds a root file the combo doesn't
+    // ship (e.g. seed.sh on a project without the server).
+    if (rel.indexOf('/') === -1) {
+        return ALWAYS_ROOT_FILES.has(rel)
+            || rootFilesForComponents(components).includes(rel);
+    }
+    return false;
 }
 
-async function loadTemplate(details, preset) {
+/**
+ * Walk the template, resolve each file's contents (post-replacement)
+ * + final relative path. Returns a map of relative-path → buffer.
+ * Skips files outside the project's component combo — we only want
+ * to update what the project actually shipped.
+ */
+
+async function loadTemplate(details, manifest) {
     const replacements = buildReplacements(details);
     const files = await getAllFiles(TEMPLATE_DIR);
     const out = new Map();
+    const components = componentsFromManifest(manifest);
 
     for (const abs of files) {
         const relRaw = path.relative(TEMPLATE_DIR, abs);
         const rel = applyPathPlaceholders(relRaw, details.slug);
 
-        if (preset && !isPathInPreset(rel, preset)) {
+        if (!isPathInComponents(rel, components)) {
             continue;
         }
 
@@ -213,13 +217,13 @@ async function loadTemplate(details, preset) {
     }
 
     // Landing-page variant resolution — mirror create.mjs's copyTemplate
-    // swap. For app-landing presets the canonical landing files are
+    // swap. For app-landing projects the canonical landing files are
     // sourced from ui/site/_variants/app/ so `umpordez update` compares
     // against the SAME flavor the project was scaffolded with (otherwise
     // it would try to push the SaaS landing over an app project). The
-    // _variants/ staging files never ship, so drop them from the map for
-    // every preset.
-    if (APP_LANDING_PRESETS.has(preset)) {
+    // _variants/ staging files never ship, so drop them from the map
+    // in every case.
+    if (wantsAppLanding(details, manifest.preset)) {
         for (const [variant, canonical] of APP_LANDING_SWAPS) {
             if (out.has(variant)) {
                 out.set(canonical, out.get(variant));
@@ -366,7 +370,7 @@ export async function updateProject(projectDirArg, opts = {}) {
     ));
     console.log('');
 
-    const template = await loadTemplate(details, manifest.preset);
+    const template = await loadTemplate(details, manifest);
     const newHashes = {};
 
     let acceptAll = !!opts.yes;

package/template/mobile/{{PROJECT_SLUG}}/src/services/health/index.ts

@@ -1,238 +0,0 @@
-/**
- * Health — unified surface over Apple Health (iOS, react-native-health)
- * and Health Connect (Android, react-native-health-connect).
- *
- * Both libraries are lazy-loaded with try/require so Expo Go (which
- * has neither linked) gets a no-op service instead of a hard crash.
- *
- * The module exposes a small, opinionated API:
- *   - requestPermissions  — surface the platform's permissions UI
- *   - getStepsToday        — read example
- *   - writeExerciseSession — write example: minutes-of-X workout
- *
- * Adapt to whatever data your app actually cares about. Mirror this
- * shape: one method per "thing the app needs" rather than
- * one-method-per-data-type, so a swap of platforms or libraries
- * stays a contained change.
- *
- * All errors are swallowed by callers — health is best-effort.
- * Returns null / 0 on failure rather than throwing.
- */
-
-import { Platform } from 'react-native';
-
-// ── iOS HealthKit (react-native-health) ──────────────────────────────
-interface AppleHealthKit {
-    initHealthKit: (
-        options: unknown,
-        cb: (err: string | null) => void
-    ) => void;
-    getStepCount: (
-        opts: unknown,
-        cb: (err: string | null, result: { value: number }) => void
-    ) => void;
-    saveWorkout: (
-        opts: unknown,
-        cb: (err: string | null) => void
-    ) => void;
-    Constants?: { Permissions?: Record<string, string> };
-}
-
-// ── Android Health Connect (react-native-health-connect) ─────────────
-interface HealthConnect {
-    initialize: () => Promise<boolean>;
-    requestPermission: (
-        permissions: { accessType: string; recordType: string }[]
-    ) => Promise<{ accessType: string; recordType: string }[]>;
-    readRecords: (
-        recordType: string,
-        opts: { timeRangeFilter: { operator: string; startTime: string; endTime: string } }
-    ) => Promise<{ records: { count: number }[] }>;
-    insertRecords: (records: unknown[]) => Promise<unknown>;
-}
-
-let _appleHealth: AppleHealthKit | null | undefined = undefined;
-let _healthConnect: HealthConnect | null | undefined = undefined;
-
-function getAppleHealth(): AppleHealthKit | null {
-    if (Platform.OS !== 'ios') {
-        return null;
-    }
-    if (_appleHealth !== undefined) {
-        return _appleHealth;
-    }
-    try {
-        // eslint-disable-next-line @typescript-eslint/no-require-imports
-        const pkg = require('react-native-health');
-        _appleHealth = (pkg.default ?? pkg) as AppleHealthKit;
-    } catch {
-        _appleHealth = null;
-    }
-    return _appleHealth;
-}
-
-function getHealthConnect(): HealthConnect | null {
-    if (Platform.OS !== 'android') {
-        return null;
-    }
-    if (_healthConnect !== undefined) {
-        return _healthConnect;
-    }
-    try {
-        // eslint-disable-next-line @typescript-eslint/no-require-imports
-        _healthConnect = require('react-native-health-connect') as
-            HealthConnect;
-    } catch {
-        _healthConnect = null;
-    }
-    return _healthConnect;
-}
-
-const APPLE_PERMISSIONS = {
-    permissions: {
-        read:  ['Steps'],
-        write: ['Workout']
-    }
-};
-
-const ANDROID_PERMISSIONS = [
-    { accessType: 'read',  recordType: 'Steps' },
-    { accessType: 'write', recordType: 'ExerciseSession' }
-];
-
-/**
- * Surface the platform's permission sheet. Returns true if the user
- * granted enough permissions for our subsequent reads/writes to work.
- */
-export async function requestHealthPermissions(): Promise<boolean> {
-    if (Platform.OS === 'ios') {
-        const ahk = getAppleHealth();
-        if (!ahk) {
-            return false;
-        }
-        return new Promise(resolve => {
-            ahk.initHealthKit(APPLE_PERMISSIONS, err => {
-                resolve(!err);
-            });
-        });
-    }
-    if (Platform.OS === 'android') {
-        const hc = getHealthConnect();
-        if (!hc) {
-            return false;
-        }
-        try {
-            const ready = await hc.initialize();
-            if (!ready) {
-                return false;
-            }
-            const granted = await hc.requestPermission(
-                ANDROID_PERMISSIONS
-            );
-            return granted.length === ANDROID_PERMISSIONS.length;
-        } catch {
-            return false;
-        }
-    }
-    return false;
-}
-
-export async function getStepsToday(): Promise<number> {
-    const start = new Date();
-    start.setHours(0, 0, 0, 0);
-    const end = new Date();
-
-    if (Platform.OS === 'ios') {
-        const ahk = getAppleHealth();
-        if (!ahk) {
-            return 0;
-        }
-        return new Promise(resolve => {
-            ahk.getStepCount({ date: end.toISOString() }, (err, res) => {
-                if (err) {
-                    resolve(0);
-                    return;
-                }
-                resolve(res?.value ?? 0);
-            });
-        });
-    }
-    if (Platform.OS === 'android') {
-        const hc = getHealthConnect();
-        if (!hc) {
-            return 0;
-        }
-        try {
-            const res = await hc.readRecords('Steps', {
-                timeRangeFilter: {
-                    operator: 'between',
-                    startTime: start.toISOString(),
-                    endTime: end.toISOString()
-                }
-            });
-            return res.records.reduce((sum, r) => sum + (r.count ?? 0), 0);
-        } catch {
-            return 0;
-        }
-    }
-    return 0;
-}
-
-export interface ExerciseSession {
-    type: string;
-    startedAt: Date;
-    durationMs: number;
-    energyBurned?: number;
-}
-
-/**
- * Write a completed exercise session to the platform's health store.
- * `type` is loosely free-form on iOS (Apple maps it to HKWorkoutType)
- * and constrained on Android (must be a Health Connect ExerciseType).
- * For barebones we leave the mapping to the caller — wrap this in a
- * domain method like `recordYogaSession` if you only ever record one
- * kind.
- */
-export async function writeExerciseSession(
-    s: ExerciseSession
-): Promise<boolean> {
-    const startISO = s.startedAt.toISOString();
-    const endISO = new Date(
-        s.startedAt.getTime() + s.durationMs
-    ).toISOString();
-
-    if (Platform.OS === 'ios') {
-        const ahk = getAppleHealth();
-        if (!ahk) {
-            return false;
-        }
-        return new Promise(resolve => {
-            ahk.saveWorkout({
-                type: s.type,
-                startDate: startISO,
-                endDate: endISO,
-                energyBurned: s.energyBurned ?? 0,
-                energyBurnedUnit: 'kilocalorie'
-            }, err => resolve(!err));
-        });
-    }
-    if (Platform.OS === 'android') {
-        const hc = getHealthConnect();
-        if (!hc) {
-            return false;
-        }
-        try {
-            await hc.insertRecords([{
-                recordType: 'ExerciseSession',
-                exerciseType: s.type,
-                startTime: startISO,
-                endTime: endISO,
-                title: s.type
-            }]);
-            return true;
-        } catch {
-            return false;
-        }
-    }
-    return false;
-}