backend create — Scaffold an Express, Firebase, or Vercel backend

native-update backend create <type> generates a starter backend project that exposes the HTTP contract the SDK expects. It is a scaffold, not turn-key code: bundle lookup, persistent storage, signature verification, and rollout gating are all left as TODO[SCAFFOLD-IMPLEMENT-BEFORE-DEPLOY] markers because the right answer depends on your storage and database choices.

If you want production-ready references instead of a scaffold, use:

• example-apps/node-express/ — a minimal but working HTTP-contract reference
• backend/ — the full Laravel + Nova SaaS implementation that powers the hosted Native Update service

Synopsis

npx native-update backend create <type> [options]

# Alias:
npx native-update backend create-backend <type> [options]

Arguments

Argument	Required	Accepted values
<type>	Yes	express, firebase, vercel

Type	Generates	Best for
express	A Node.js + Express 5 server with rate-limiting, CORS, JWT auth, multer uploads.	Self-hosting on a VPS, Render, Fly.io, Railway, etc.
firebase	Firebase Functions handlers wired into the same contract.	Teams already on Firebase.
vercel	Vercel serverless functions wired into the same contract.	Teams already on Vercel; small footprint.

Flags

Flag	Default	Description
-o, --output <dir>	./native-update-backend	Output directory. The command refuses to run if the directory already exists — protects against accidental overwrites.
--with-monitoring	false	Include a monitoring/stats endpoint scaffold (varies by backend type).
--with-admin	false	Include an admin-dashboard scaffold (varies by backend type).
-h, --help	—	Print help and exit.

Examples

Express backend with admin dashboard

npx native-update backend create express --with-admin

Generates ./native-update-backend/ with package.json, server.js, route files, and admin scaffold. Read the warnings before running it in production.

Firebase Functions backend with monitoring

npx native-update backend create firebase --with-monitoring

Vercel serverless backend with a custom output directory

npx native-update backend create vercel --output ./my-backend

What you get — and what is still TODO

Every entry-point file in the generated project starts with this banner:

/**
 * ⚠️  SCAFFOLD — IMPLEMENT BEFORE DEPLOYING ⚠️
 *
 * This file was generated by `native-update backend-create` as a
 * STARTING POINT, not a deploy-ready service. Every block tagged
 * `TODO[SCAFFOLD-IMPLEMENT-BEFORE-DEPLOY]` MUST be replaced with
 * real persistence + storage + signature verification before this
 * runs in production.
 *
 * Working references:
 *   • example-apps/node-express      — minimal HTTP-contract reference
 *   • backend/ (Laravel + Nova)      — full SaaS implementation
 *
 * Deploying this file as-is will respond with hard-coded sample
 * payloads and silently drop uploaded bundles.
 */

To find every block that needs implementation work, grep the generated project for TODO[SCAFFOLD-IMPLEMENT-BEFORE-DEPLOY]:

cd ./native-update-backend
grep -rn "TODO\[SCAFFOLD-IMPLEMENT-BEFORE-DEPLOY\]" .

Typical TODO categories:

• Bundle lookup. The scaffold returns a hard-coded sample bundle. Replace with a real DB query that selects the newest bundle for the requested channel + appId.
• Persistent storage. The scaffold accepts uploads with multer but does not save them beyond the request's temp file. Wire to S3 / Google Cloud Storage / Google Drive / FilesHub / etc.
• Signature verification on upload. The scaffold accepts whatever ZIP you send. Verify the .sig sidecar before accepting the upload.
• Rollout gating. The scaffold returns the same bundle to every device. Wire a percentage-rollout decision based on the device ID.
• Auth. The scaffold has JWT skeletons but no user model. Wire to your real user / API-key system.
• Stats endpoint. With --with-monitoring, the scaffold has a /api/stats endpoint that returns hard-coded numbers. Wire to your DB.

Generated structure (Express)

native-update-backend/
├── package.json           # Express 5, cors, express-rate-limit, multer, dotenv, jwt, bcrypt
├── server.js              # Entry point — SCAFFOLD_BANNER at top
├── routes/
│   ├── api.js             # Public endpoints (/api/latest, /api/stats, etc.)
│   ├── upload.js          # Bundle upload endpoint
│   └── admin.js           # Admin endpoints (only with --with-admin)
└── .env.example           # All env vars the scaffold uses

The Firebase and Vercel scaffolds have analogous structures adapted to those platforms' conventions (functions/index.js for Firebase; api/*.js for Vercel).

Common errors

Error	Cause	Fix
Directory <path> already exists	The output path already exists.	Delete the existing directory or pass a different --output.
Unknown backend type: <type>	<type> is not express, firebase, or vercel.	Use one of the three supported types.
Failed to create backend: <message>	Filesystem write failure (permission denied, disk full, etc.).	Fix the underlying OS-level issue.

Exit code is 1 on any of the above; 0 on success.

What the command prints on success

✔ express backend scaffold created!

⚠️  SCAFFOLD — NOT PRODUCTION READY ⚠️
This template ships with placeholder bundle lookup + storage logic.
Search the generated code for `TODO[SCAFFOLD-IMPLEMENT-BEFORE-DEPLOY]`
and replace each block with your real DB / storage / signing logic.
See:
  • example-apps/node-express  (minimal HTTP-contract reference)
  • backend/ (Laravel + Nova)  (full SaaS implementation)

Next steps:
  1. cd ./native-update-backend
  2. npm install
  3. Configure your environment variables
  4. Replace every TODO[SCAFFOLD-IMPLEMENT-BEFORE-DEPLOY] block
  5. npm run dev

When NOT to use this command

• If you want a working backend in 30 minutes, do not start here. Clone example-apps/node-express/, point it at your storage of choice, and ship that. The scaffold takes longer because every TODO is a decision point.
• If you want a hosted backend with no code at all, sign up for the hosted Native Update SaaS instead.
• If you are running Laravel already, use the backend/ reference in the main repo. It is a complete, production-deployed application with Nova admin, signing key rotation, rollouts, license management, and PayPal billing.

Why is it only a scaffold?

The HTTP contract is small (GET /api/latest, POST /api/bundles, GET /api/stats), but the choices behind it are large: which DB? which object store? which auth model? which rollout policy? Picking defaults for any of them would produce an implementation that fits ~30% of users and frustrates the other 70%. The scaffold leaves those decision points marked and references the two complete implementations so you can copy whichever fits.

Authored by

Ahsan Mahmood — author and maintainer of native-update.