@cmpose/core 0.2.4 → 0.2.6

package/package.json

@@ -1,16 +1,16 @@
 {
   "name": "@cmpose/core",
-  "version": "0.2.4",
+  "version": "0.2.6",
   "description": "cmpose project generator core (Compose Multiplatform)",
   "license": "MIT",
   "repository": {
     "type": "git",
-    "url": "git+https://github.com/Keremturker/cmpose.git",
+    "url": "git+https://github.com/whinstudio/cmpose.git",
     "directory": "packages/core"
   },
-  "homepage": "https://github.com/Keremturker/cmpose/tree/main/packages/core#readme",
+  "homepage": "https://github.com/whinstudio/cmpose/tree/main/packages/core#readme",
   "bugs": {
-    "url": "https://github.com/Keremturker/cmpose/issues"
+    "url": "https://github.com/whinstudio/cmpose/issues"
   },
   "keywords": [
     "compose-multiplatform",

package/src/ProjectValidator.js

@@ -47,8 +47,8 @@
     // Module names the generator cannot use: file processing skips every directory named build
     // (Gradle output), so feature/build would keep the template package; monetization is the
     // template's own feature/monetization module (purchases/ads flags); notes is blank's Room demo
-    // (feature/notes)
-    const RESERVED_MODULE_NAMES = ['build', 'monetization', 'notes'];
+    // (feature/notes); account and sharing are the backend flag's feature/account and feature/sharing
+    const RESERVED_MODULE_NAMES = ['build', 'monetization', 'notes', 'account', 'sharing'];
 
     /**
      * Compare two version strings (e.g., '15.0' vs '15.0.1')

package/src/backendOption.js

@@ -0,0 +1,284 @@
+'use strict';
+const fs = require('fs-extra');
+const path = require('path');
+const { removeSwiftPackage, parseObjects, isa } = require('./xcodePackages');
+const { PRIVACY_MANIFEST } = require('./privacyManifest');
+
+// featuresConfig.backend: the template marks everything the backend adds (MAINTAINING.md → Backend markers).
+// Off strips it, on keeps it and drops only the markers. Runs on the template package, before the rename.
+
+const MARKERS = {
+    slash: { open: '// cmpose:backend', close: '// /cmpose:backend' },
+    hash: { open: '# cmpose:backend', close: '# /cmpose:backend' },
+    html: { open: '<!-- cmpose:backend -->', close: '<!-- /cmpose:backend -->' }
+};
+const SWAP = '// cmpose:backend-off: ';
+
+const KIND_BY_EXTENSION = {
+    '.kt': 'slash', '.kts': 'slash', '.swift': 'slash', '.xcconfig': 'slash',
+    '.toml': 'hash', '.gitignore': 'hash', '.properties': 'hash',
+    '.md': 'html', '.xml': 'html', '.plist': 'html', '.xcprivacy': 'html'
+};
+const SKIP_DIRS = new Set(['.git', '.gradle', 'build', 'node_modules']);
+
+// Template-relative paths the backend adds outside the files it marks; deleted when backend is off
+const TEMPLATE_PACKAGE_PATH = 'com/kturker/multiplatform';
+const BACKEND_PATHS = [
+    'server',
+    'core/api',
+    'core/auth',
+    'feature/account',
+    'feature/sharing',
+    'androidApp/src/debug',
+    'iosApp/iosApp/SignInBridge.swift',
+    'iosApp/iosApp/iosApp.entitlements',
+    `shared/src/iosMain/kotlin/${TEMPLATE_PACKAGE_PATH}/SignInRegistration.kt`,
+    `shared/src/commonMain/kotlin/${TEMPLATE_PACKAGE_PATH}/SessionGate.kt`,
+    `shared/src/androidHostTest/kotlin/${TEMPLATE_PACKAGE_PATH}/MainScreenGateTest.kt`,
+    `shared/src/androidHostTest/kotlin/${TEMPLATE_PACKAGE_PATH}/di/BackendBindingsTest.kt`,
+    ...['BackendClient', 'BackendConfig', 'EmulatorDetection', 'LocalHost', 'TokenSource']
+        .map((name) => `core/network/src/commonMain/kotlin/${TEMPLATE_PACKAGE_PATH}/core/network/${name}.kt`),
+    `core/network/src/androidMain/kotlin/${TEMPLATE_PACKAGE_PATH}/core/network/LocalHost.android.kt`,
+    `core/network/src/iosMain/kotlin/${TEMPLATE_PACKAGE_PATH}/core/network/LocalHost.ios.kt`,
+    ...['AuthenticatedClientTest', 'BackendConfigTest', 'EmulatorDetectionTest']
+        .map((name) => `core/network/src/commonTest/kotlin/${TEMPLATE_PACKAGE_PATH}/core/network/${name}.kt`),
+    `core/image/src/commonMain/kotlin/${TEMPLATE_PACKAGE_PATH}/core/image/ImageNormalization.kt`,
+    `core/image/src/androidMain/kotlin/${TEMPLATE_PACKAGE_PATH}/core/image/ImageNormalization.android.kt`,
+    `core/image/src/iosMain/kotlin/${TEMPLATE_PACKAGE_PATH}/core/image/ImageNormalization.ios.kt`,
+    `core/image/src/commonTest/kotlin/${TEMPLATE_PACKAGE_PATH}/core/image/ImageNormalizationTest.kt`,
+    `core/image/src/androidDeviceTest/kotlin/${TEMPLATE_PACKAGE_PATH}/core/image/ImageNormalizationDeviceTest.kt`,
+    ...['core/multilang', 'blank/layers/multilang/core/multilang'].flatMap((module) => ['AccountStrings', 'SharingStrings']
+        .map((name) => `${module}/src/commonMain/kotlin/${TEMPLATE_PACKAGE_PATH}/core/multilang/resource/${name}.kt`)),
+    ...['SharedSpacesWarningTest', 'SharingStringsTest']
+        .map((name) => `core/multilang/src/commonTest/kotlin/${TEMPLATE_PACKAGE_PATH}/core/multilang/resource/${name}.kt`)
+];
+
+// Imports the template leaves outside the markers (import ordering) that only marked code uses
+const BACKEND_ONLY_IMPORTS = [
+    /^import [\w.]+\.core\.auth\./,
+    /^import [\w.]+\.feature\.account\./,
+    /^import [\w.]+\.feature\.sharing\./
+];
+const IMPORT_FILE_KINDS = new Set(['.kt', '.kts', '.swift']);
+
+const PBXPROJ = ['iosApp', 'iosApp.xcodeproj', 'project.pbxproj'];
+const PACKAGE_RESOLVED = ['iosApp', 'iosApp.xcodeproj', 'project.xcworkspace', 'xcshareddata', 'swiftpm', 'Package.resolved'];
+const BACKEND_PACKAGE_URLS = ['https://github.com/firebase/firebase-ios-sdk', 'https://github.com/google/GoogleSignIn-iOS'];
+const COPY_GOOGLE_SERVICE_PHASE = 'Copy GoogleService-Info if present';
+const BACKEND_MEMBERSHIP_EXCEPTION = /^\t+(?:iosApp\.entitlements|"GoogleService-Info\.plist"),$/;
+const BACKEND_BUILD_SETTING = /^\t+(?:CODE_SIGN_ENTITLEMENTS|INFOPLIST_PREPROCESS|INFOPLIST_PREPROCESSOR_DEFINITIONS) = [^\n]*;$/;
+
+// Firebase, GoogleSignIn and what they pull in; the template's other pins (GMA, UMP) stay
+const BACKEND_PIN_IDENTITIES = new Set([
+    'abseil-cpp-binary', 'app-check', 'appauth-ios', 'firebase-ios-sdk', 'google-ads-on-device-conversion-ios-sdk',
+    'googleappmeasurement', 'googledatatransport', 'googlesignin-ios', 'googleutilities', 'grpc-binary',
+    'gtm-session-fetcher', 'gtmappauth', 'interop-ios-for-google-sdks', 'leveldb', 'nanopb', 'promises', 'swift-protobuf'
+]);
+
+// Off: drops each marked block with its marker lines; on: drops only the marker lines. Either way a blank
+// line on both sides of a dropped run becomes one (blank runs elsewhere stay).
+function removeMarkedBlocks(content, kind, keep) {
+    const { open, close } = MARKERS[kind];
+    const out = [];
+    const joins = [];
+    let inside = false;
+    let dropped = false;
+    for (const line of content.split('\n')) {
+        const t = line.trim();
+        if (t === open) {
+            if (inside) throw new Error(`nested ${open}`);
+            inside = true;
+            dropped = true;
+            continue;
+        }
+        if (t === close) {
+            if (!inside) throw new Error(`stray ${close}`);
+            inside = false;
+            dropped = true;
+            continue;
+        }
+        if (inside && !keep) continue;
+        if (dropped) joins.push(out.length);
+        dropped = false;
+        out.push(line);
+    }
+    if (inside) throw new Error('unclosed cmpose:backend block');
+    if (dropped) joins.push(out.length);
+    return collapseBlankRuns(out, joins).join('\n');
+}
+
+// At each join (the index of the first line after a dropped run), blank lines that follow a blank line go
+function collapseBlankRuns(lines, joins) {
+    const drop = new Set();
+    for (const join of joins) {
+        if (join === 0 || lines[join - 1] !== '') continue;
+        for (let i = join; i < lines.length && lines[i] === ''; i++) drop.add(i);
+    }
+    return lines.filter((_, i) => !drop.has(i));
+}
+
+// Off: the line after a swap marker becomes the marker's text at that line's indentation; on: the marker goes
+function applySwapMarkers(content, keep) {
+    const lines = content.split('\n');
+    const out = [];
+    for (let i = 0; i < lines.length; i++) {
+        const t = lines[i].trim();
+        if (!t.startsWith(SWAP)) { out.push(lines[i]); continue; }
+        const next = lines[i + 1];
+        if (next === undefined) throw new Error('cmpose:backend-off marker on the last line');
+        if (keep) { out.push(next); } else { out.push(next.match(/^\s*/)[0] + t.slice(SWAP.length)); }
+        i++;
+    }
+    return out.join('\n');
+}
+
+// Off: the Firebase and GoogleSignIn packages, the build phase copying GoogleService-Info.plist, the
+// membership exceptions of the entitlements and GoogleService-Info.plist, and the entitlements and
+// Info.plist preprocessing (LOCAL_SERVER) build settings. Text edits only.
+function stripBackendPbxproj(content) {
+    const crlf = content.includes('\r\n');
+    let result = crlf ? content.replace(/\r\n/g, '\n') : content;
+    for (const url of BACKEND_PACKAGE_URLS) result = removeSwiftPackage(result, url);
+    result = removeCopyGoogleServicePhase(result);
+    result = result.split('\n')
+        .filter((line) => !BACKEND_MEMBERSHIP_EXCEPTION.test(line) && !BACKEND_BUILD_SETTING.test(line))
+        .join('\n');
+    if (result.includes(COPY_GOOGLE_SERVICE_PHASE)) {
+        throw new Error(`stripBackendPbxproj: "${COPY_GOOGLE_SERVICE_PHASE}" is in project.pbxproj but could not be removed (unexpected formatting)`);
+    }
+    return crlf ? result.replace(/\n/g, '\r\n') : result;
+}
+
+function removeCopyGoogleServicePhase(content) {
+    const lines = content.split('\n');
+    const phases = parseObjects(lines).filter((object) => isa(object) === 'PBXShellScriptBuildPhase'
+        && object.text.includes(`name = "${COPY_GOOGLE_SERVICE_PHASE}";`));
+    if (phases.length === 0) return content;
+    // One object per isa: a phase whose closing line is missing would swallow the next object
+    if (phases.some((object) => (object.text.match(/\bisa = /g) || []).length !== 1)) {
+        throw new Error(`stripBackendPbxproj: "${COPY_GOOGLE_SERVICE_PHASE}" could not be parsed (unexpected formatting)`);
+    }
+    const ids = new Set(phases.map((object) => object.id));
+    const drop = new Set();
+    for (const object of phases) {
+        for (let i = object.start; i <= object.end; i++) drop.add(i);
+    }
+    const listEntry = /^\t+([0-9A-F]{24})(?: \/\*.*?\*\/)?,$/;
+    lines.forEach((line, i) => {
+        const match = line.match(listEntry);
+        if (match && ids.has(match[1])) drop.add(i);
+    });
+    return lines.filter((_, i) => !drop.has(i)).join('\n')
+        .replace(/\n\n\/\* Begin (\w+) section \*\/\n\/\* End \1 section \*\/(?=\n)/g, '');
+}
+
+// Package.resolved without the pins whose identity is in `identities`, in Xcode's layout ("key" : value).
+// originHash goes (Xcode recomputes it); null when no pin is left, so the caller deletes the file.
+function stripPins(json, identities) {
+    const resolved = JSON.parse(json);
+    const pins = (resolved.pins || []).filter((pin) => !identities.has(pin.identity));
+    if (pins.length === 0) return null;
+    // Nothing to drop: the file stays as Xcode wrote it (originHash included)
+    if (pins.length === (resolved.pins || []).length) return json;
+    const { originHash, ...rest } = resolved;
+    const text = JSON.stringify({ ...rest, pins }, null, 2).replace(/^(\s*"(?:[^"\\]|\\.)*"): /gm, '$1 : ');
+    return `${text}\n`;
+}
+
+// Off: Package.resolved without the backend's pins
+function stripBackendPins(json) {
+    return stripPins(json, BACKEND_PIN_IDENTITIES);
+}
+
+function kindOf(file) {
+    const name = path.basename(file);
+    return KIND_BY_EXTENSION[name === '.gitignore' ? name : path.extname(name)];
+}
+
+async function listMarkableFiles(dir) {
+    const files = [];
+    for (const entry of await fs.readdir(dir, { withFileTypes: true })) {
+        const full = path.join(dir, entry.name);
+        if (entry.isDirectory()) {
+            if (!SKIP_DIRS.has(entry.name)) files.push(...await listMarkableFiles(full));
+        } else if (kindOf(entry.name)) {
+            files.push(full);
+        }
+    }
+    return files;
+}
+
+// Removes a path, then the directories it leaves empty (never projectDir itself)
+async function removeAndPrune(projectDir, target) {
+    await fs.remove(target);
+    let dir = path.dirname(target);
+    while (dir.startsWith(projectDir + path.sep) && (await fs.pathExists(dir)) && (await fs.readdir(dir)).length === 0) {
+        await fs.remove(dir);
+        dir = path.dirname(dir);
+    }
+}
+
+function renderFile(content, file, enabled) {
+    const kind = kindOf(file);
+    let out = content;
+    if (kind === 'slash') out = applySwapMarkers(out, enabled);
+    out = removeMarkedBlocks(out, kind, enabled);
+    if (!enabled && IMPORT_FILE_KINDS.has(path.extname(file))) {
+        out = out.split('\n').filter((line) => !BACKEND_ONLY_IMPORTS.some((re) => re.test(line))).join('\n');
+    }
+    return out;
+}
+
+// The privacy manifest's cmpose:backend block belongs to writePrivacyManifest, so it is left alone here
+async function applyBackendOption(projectDir, enabled) {
+    const root = path.resolve(projectDir);
+    if (!enabled) {
+        for (const relative of BACKEND_PATHS) {
+            const target = path.join(root, ...relative.split('/'));
+            if (await fs.pathExists(target)) await removeAndPrune(root, target);
+        }
+    }
+
+    const privacyManifest = path.join(root, ...PRIVACY_MANIFEST);
+    for (const file of await listMarkableFiles(root)) {
+        if (file === privacyManifest) continue;
+        const content = await fs.readFile(file, 'utf8');
+        if (!content.includes('cmpose:backend') && (enabled || !IMPORT_FILE_KINDS.has(path.extname(file)))) continue;
+        let updated;
+        try {
+            updated = renderFile(content, file, enabled);
+        } catch (error) {
+            throw new Error(`${path.relative(root, file)}: ${error.message}`);
+        }
+        if (updated !== content) await fs.writeFile(file, updated);
+    }
+
+    if (enabled) return;
+
+    const pbxproj = path.join(root, ...PBXPROJ);
+    if (await fs.pathExists(pbxproj)) {
+        const content = await fs.readFile(pbxproj, 'utf8');
+        const updated = stripBackendPbxproj(content);
+        if (updated !== content) await fs.writeFile(pbxproj, updated);
+    }
+
+    const resolved = path.join(root, ...PACKAGE_RESOLVED);
+    if (await fs.pathExists(resolved)) {
+        const content = await fs.readFile(resolved, 'utf8');
+        const updated = stripBackendPins(content);
+        if (updated === null) await removeAndPrune(root, resolved);
+        else if (updated !== content) await fs.writeFile(resolved, updated);
+    }
+}
+
+module.exports = {
+    removeMarkedBlocks,
+    applySwapMarkers,
+    stripBackendPbxproj,
+    stripBackendPins,
+    stripPins,
+    applyBackendOption,
+    BACKEND_PATHS,
+    BACKEND_ONLY_IMPORTS,
+    BACKEND_PIN_IDENTITIES
+};

package/src/contract.js

@@ -8,10 +8,10 @@ const { OLD_PACKAGE_NAME } = require('./templateIdentity');
 // sync-contract.sh; featuresConfig.js and the generator read the same objects.
 const SCHEMA = {
     templateTypes: ['blank', 'showcase'],
-    featuresConfigKeys: ['network', 'networkInspector', 'networkBaseUrl', 'theming', 'multiLang', 'dataStore', 'detekt', 'detektYamlContent', 'purchases', 'ads', 'room'],
+    featuresConfigKeys: ['network', 'networkInspector', 'networkBaseUrl', 'theming', 'multiLang', 'dataStore', 'detekt', 'detektYamlContent', 'purchases', 'ads', 'room', 'backend'],
     dependencyRules: {
         alwaysOn: ['koin', 'navigation'],
-        implies: { networkInspector: ['network'] },        // inspector => network
+        implies: { networkInspector: ['network'], backend: ['multiLang', 'network'] },  // inspector => network; backend => multiLang + network
         auto: { dataStore: ['theming', 'multiLang'] }      // theming || multiLang => dataStore
     },
     // Top-level request options that apply to every template (featuresConfig is blank-only)
@@ -30,24 +30,31 @@ const SCHEMA = {
             'core/database': { requires: ['dataStore'], note: 'DataStore persistence; with theming also the saved Light/Dark/System choice (DarkModeManager)' },
             'core/purchases': { requires: ['purchases'], note: 'offer / purchase / restore API, RevenueCat KMP (Test Store key: replace before you ship)' },
             'core/ads': { requires: ['ads'], note: 'AdMob banner/interstitial/rewarded + UMP/ATT consent (test IDs)' },
-            'core/room': { requires: ['room'], note: 'Room KMP database (bundled SQLite): AppDatabase, DAOs, schemas/' }
+            'core/room': { requires: ['room'], note: 'Room KMP database (bundled SQLite): AppDatabase, DAOs, schemas/' },
+            'core/api': { requires: ['backend'], note: 'models and routes shared by the app and the server' },
+            'core/auth': { requires: ['backend'], note: 'Firebase sign-in (email, Google, Apple); the server client\'s token' }
         },
         // featuresConfig flag -> feature modules kept in a blank project (same requires/requiresAny rules).
         featureModules: {
             'feature/monetization': { requiresAny: ['purchases', 'ads'], note: 'custom paywall (Compose) and/or ads demo' },
-            'feature/notes': { requires: ['room'], note: 'Notes demo screen on Room (blank only; showcase uses Room for favorites)' }
+            'feature/notes': { requires: ['room'], note: 'Notes demo screen on Room (blank only; showcase uses Room for favorites)' },
+            'feature/account': { requires: ['backend'], note: 'sign-in screens and the account (blank only)' },
+            'feature/sharing': { requires: ['backend'], note: 'shared spaces and invites (blank only)' }
         },
         detektDir: { requires: ['detekt'], path: 'detekt/' },
+        // Ktor server (blank only): `./gradlew :server:runLocal` runs it locally
+        serverDir: { path: 'server/', requires: ['backend'] },
         showcaseFeatures: ['feature/home', 'feature/monetization', 'feature/onboarding'],
         customFeaturePath: 'feature/<name>',
         customFeatureLayers: ['contract', 'data', 'domain', 'presentation']
     },
     // Deep links (<scheme>://<path>): the generator writes the scheme; '' opens the start screen and
-    // '<module>' each generated feature module
+    // '<module>' each generated feature module; backend adds the sharing invite (blank only)
     deepLinks: {
         scheme: 'projectName, lower case',
         showcase: ['user/{username}', 'settings'],
-        blank: ['', '<module>']
+        blank: ['', '<module>'],
+        backend: { links: ['invite/<token>'], requires: ['backend'] }
     }
 };
 

package/src/featureModules.js

@@ -147,11 +147,10 @@ async function applyBlankShell(projectPath, templateType, featuresConfig = {}) {
     await fs.remove(overlay);
 }
 
-// What a blank project's purchases/ads flags need from the template. A template pinned before
-// the monetization release has none of it; generation then stops before the pipeline runs with a
-// 500 that names the missing modules (not the generic verifier 500 after it; not 503, which the
-// contract reserves for the concurrency limit that clients retry), and a readiness check reports the
-// cache as stale.
+// What a blank project's on flags need from the template. A template pinned before the release that
+// brought them has none of it; generation then stops before the pipeline runs with a 500 that names the
+// missing directories (not the generic verifier 500 after it; not 503, which the contract reserves for the
+// concurrency limit that clients retry).
 const MONETIZATION_LAYER = BLANK_LAYERS.find((layer) => layer.name === 'ads-without-purchases');
 const MONETIZATION_CAPABILITIES = [
     { dir: 'core/purchases', needed: (cfg) => cfg.purchases === true },
@@ -159,6 +158,10 @@ const MONETIZATION_CAPABILITIES = [
     { dir: 'feature/monetization', needed: (cfg) => cfg.purchases === true || cfg.ads === true },
     { dir: `${BLANK_OVERLAY_DIR}/${LAYERS_DIR}/${MONETIZATION_LAYER.name}`, needed: MONETIZATION_LAYER.applies }
 ];
+// Checked per request only: a readiness check (no config) does not need them, so a template pinned
+// before the backend release still serves every other option
+const BACKEND_CAPABILITIES = ['server', 'core/api', 'core/auth', 'feature/account', 'feature/sharing']
+    .map((dir) => ({ dir, needed: (cfg) => cfg.backend === true }));
 
 class TemplateCapabilityError extends Error {
     constructor(missing) {
@@ -170,15 +173,15 @@ class TemplateCapabilityError extends Error {
 }
 
 function templateLacksMessage(missing) {
-    return `Template lacks the monetization modules (missing: ${missing.join(', ')}); update templateRef`;
+    return `Template lacks ${missing.join(', ')} (older than the release that added them); update templateRef`;
 }
 
-// Every monetization directory the template at `templatePath` lacks (for a readiness check: any of them
-// means the cache is stale)
+// Every directory the template at `templatePath` lacks for `cfg`'s on flags; without a config (a readiness
+// check: any of them means the cache is stale), every monetization directory
 async function missingTemplateCapabilities(templatePath, cfg = null) {
+    const capabilities = cfg ? [...MONETIZATION_CAPABILITIES, ...BACKEND_CAPABILITIES].filter((c) => c.needed(cfg)) : MONETIZATION_CAPABILITIES;
     const missing = [];
-    for (const capability of MONETIZATION_CAPABILITIES) {
-        if (cfg && !capability.needed(cfg)) continue;
+    for (const capability of capabilities) {
         if (!(await fs.pathExists(path.join(templatePath, capability.dir)))) missing.push(capability.dir);
     }
     return missing;

package/src/featuresConfig.js

@@ -3,7 +3,7 @@
  * Pure function: no HTTP or file system, does not mutate its input.
  *
  * The web wizard applied the dependency rules (networkInspector ⇒ network,
- * theming || multiLang ⇒ dataStore) only on the client; this function applies
+ * backend ⇒ multiLang + network, theming || multiLang ⇒ dataStore) only on the client; this function applies
  * the same rules here too (as auto-true, never as an error) and fills missing
  * keys with safe defaults, so `fileService.js` always gets a complete,
  * consistent object.
@@ -20,7 +20,8 @@ const DEFAULTS = Object.freeze({
     detekt: false,
     purchases: false,
     ads: false,
-    room: false
+    room: false,
+    backend: false
 });
 
 // Boolean flags = the contract's featuresConfig keys that have a default (networkBaseUrl and

package/src/fileService.js

@@ -2,6 +2,7 @@ const fs = require('fs-extra');
 const path = require('path');
 const { listTextFiles } = require('./projectFiles');
 const { removeSwiftPackage } = require('./xcodePackages');
+const { stripPins } = require('./backendOption');
 const { capitalize, TEST_SOURCE_SET_REGEX } = require('./featureModules');
 const { removeMarkedBlock } = require('./readmeService');
 const { log } = require('./log');
@@ -76,7 +77,10 @@ const NOTES_MODULE = 'notes';
 const NOTES_LAYERS = ['contract', 'presentation'];
 const TEMPLATE_FEATURE_MODULES = {
     [MONETIZATION_MODULE]: (cfg) => cfg.purchases === true || cfg.ads === true,
-    [NOTES_MODULE]: (cfg) => cfg.room === true
+    [NOTES_MODULE]: (cfg) => cfg.room === true,
+    // The backend's sign-in gate (feature/account) and shared spaces (feature/sharing)
+    account: (cfg) => cfg.backend === true,
+    sharing: (cfg) => cfg.backend === true
 };
 
 // Deletes every test source set (src/*Test) of a Gradle module; a missing src/ is fine
@@ -232,6 +236,13 @@ function replaceInContent(content, oldPackage, newPackage, oldProject, newProjec
             new RegExp(`applicationId\\s*=\\s*"${oldPackageEscaped}"`, 'g'),
             () => `applicationId = "${newPackage}"`
         );
+
+        // Any other mention of the package as a whole name (the server's main class and logger names, a
+        // plugin id applied with id("..."), a KDoc link), bounded like the verifier's stale identifier rule
+        updated = updated.replace(
+            new RegExp(`(?<![A-Za-z0-9_.])${oldPackageEscaped}(?![A-Za-z0-9_])`, 'g'),
+            () => newPackage
+        );
     }
 
     if (oldProject && newProject) {
@@ -1047,7 +1058,8 @@ function monitorResidueRules(packagePath) {
         // substring would be a false positive for a valid appName such as "Tools -lsqlite3" (see
         // above). Only an OTHER_LDFLAGS line that still links sqlite is residue.
         { file: ['iosApp', 'Configuration', 'Config.xcconfig'], tokens: [], patterns: [{ regex: /^\s*OTHER_LDFLAGS\s*=.*-lsqlite3/m, label: '-lsqlite3' }] },
-        { file: ['core', 'network', 'build.gradle.kts'], tokens: gradleTokens },
+        { file: ['core', 'network', 'src', 'commonMain', 'kotlin', packagePath, 'core', 'network', 'BackendClient.kt'], tokens: ['installNetworkMonitor'] },
+        { file: ['core', 'network', 'build.gradle.kts'], tokens: [...gradleTokens, '-lsqlite3'] },
         { file: ['androidApp', 'build.gradle.kts'], tokens: gradleTokens }
     ];
 }
@@ -1162,6 +1174,8 @@ const ROOM_PLUGIN_ALIAS = /\balias\(libs\.plugins\.room\)/;
 // .git, removeSwiftPackage matches it either way
 const GMA_PACKAGE_URL = 'https://github.com/googleads/swift-package-manager-google-mobile-ads';
 const PACKAGE_RESOLVED = ['iosApp', 'iosApp.xcodeproj', 'project.xcworkspace', 'xcshareddata', 'swiftpm', 'Package.resolved'];
+// The pins the GMA package brings into Package.resolved (the Google Mobile Ads SDK and UMP)
+const ADS_PIN_IDENTITIES = new Set(['swift-package-manager-google-mobile-ads', 'swift-package-manager-google-user-messaging-platform']);
 
 const PLIST = new Set(['.plist']);
 const XML = new Set(['.xml']);
@@ -1234,8 +1248,7 @@ const MONETIZATION_RESIDUE_FILES = {
     purchases: () => [],
     ads: (packagePath) => [
         path.join('shared', 'src', 'iosMain', 'kotlin', packagePath, 'AdsBridgeRegistration.kt'),
-        path.join('iosApp', 'iosApp', 'AdsBridge.swift'),
-        path.join(...PACKAGE_RESOLVED)
+        path.join('iosApp', 'iosApp', 'AdsBridge.swift')
     ],
     monetization: () => []
 };
@@ -1257,6 +1270,34 @@ const ROOM_RESIDUE_TOKENS = [
 ];
 const ROOM_RESIDUE_FILES = () => [path.join('core', 'room'), path.join('feature', 'notes')];
 
+// Backend off (applyBackendOption): the tokens the backend's parts must leave nowhere. Bounded like the
+// module references above, so a custom module (api, auth, account2, ...) never matches; the user's
+// package and a custom module's own class names are masked by scanForResidue. Markup and the Xcode
+// project are looked at only where user input cannot spell the token.
+const BACKEND_CODE_EXTENSIONS = new Set(['.kt', '.kts', '.toml', '.swift', '.properties']);
+const BACKEND_IOS_EXTENSIONS = new Set([...BACKEND_CODE_EXTENSIONS, '.pbxproj']);
+const code = (regex, label, extensions = BACKEND_CODE_EXTENSIONS) => ({ regex, label, extensions });
+const BACKEND_RESIDUE_TOKENS = [
+    code(/\bcore\.auth(?![A-Za-z0-9_])/, 'core.auth'),
+    code(/\bcore\.api(?![A-Za-z0-9_])/, 'core.api'),
+    code(/\bBACKEND_CLIENT\b/, 'BACKEND_CLIENT'),
+    code(/\bFirebaseAuth\b/, 'FirebaseAuth', BACKEND_IOS_EXTENSIONS),
+    code(/\bFirebaseCore\b/, 'FirebaseCore', BACKEND_IOS_EXTENSIONS),
+    code(/\bGoogleSignIn\b/, 'GoogleSignIn', BACKEND_IOS_EXTENSIONS),
+    code(/\bgoogle-services\b/, 'google-services'),
+    code(/\bgoogleServices\b/, 'googleServices'),
+    code(/\bLOCAL_SERVER\b/, 'LOCAL_SERVER', BACKEND_IOS_EXTENSIONS),
+    code(/^\s*#if LOCAL_SERVER\b/m, 'LOCAL_SERVER', PLIST),
+    code(/com\.apple\.developer\.applesignin/, 'applesignin', new Set([...BACKEND_IOS_EXTENSIONS, '.plist'])),
+    { ...classToken('rememberSessionStart', /\brememberSessionStart\b/), extensions: BACKEND_CODE_EXTENSIONS },
+    { ...classToken('registerSignInBridge', /\bregisterSignInBridge\b/), extensions: BACKEND_CODE_EXTENSIONS },
+    // Any marker the template left (block and swap markers); the privacy manifest's block is
+    // writePrivacyManifest's, after this check
+    code(/cmpose:backend/, 'cmpose:backend', new Set([...BACKEND_IOS_EXTENSIONS, '.xcconfig', '.plist', '.xml', '.md']))
+];
+const BACKEND_RESIDUE_FILES = () => ['server', path.join('core', 'api'), path.join('core', 'auth'),
+    path.join('feature', 'account'), path.join('feature', 'sharing')];
+
 // Whether a MONETIZATION_RESIDUE_TOKENS key is off (monetization = purchases and ads both off)
 function monetizationKeyOff(config, key) {
     if (key === MONETIZATION_MODULE) return config.purchases !== true && config.ads !== true;
@@ -1344,7 +1385,8 @@ async function assertNoMonetizationResidue(projectPath, packageName, config) {
     if (tokens.length === 0) return;
     const packagePath = packageName.replace(/\./g, '/');
     const files = offKeys.flatMap((key) => MONETIZATION_RESIDUE_FILES[key](packagePath));
-    await scanForResidue(projectPath, packageName, { tokens, files, title: 'Monetization residue after removal' });
+    const pins = offKeys.includes('ads') ? ADS_PIN_IDENTITIES : null;
+    await scanForResidue(projectPath, packageName, { tokens, files, pins, title: 'Monetization residue after removal' });
 }
 
 // Room off: nothing of core/room or feature/notes is left (see ROOM_RESIDUE_TOKENS)
@@ -1357,13 +1399,38 @@ async function assertNoRoomResidue(projectPath, packageName, config) {
     });
 }
 
+// Backend off: nothing of the backend is left (see BACKEND_RESIDUE_TOKENS)
+async function assertNoBackendResidue(projectPath, packageName, config) {
+    if (config.backend === true) return;
+    await scanForResidue(projectPath, packageName, {
+        tokens: BACKEND_RESIDUE_TOKENS,
+        files: BACKEND_RESIDUE_FILES(),
+        title: 'Backend residue after removal'
+    });
+}
+
 // Fails with `title` and a file: label list when a path in `files` (relative to the project) is still
 // there or a token is in a file it is looked for in (user input and the user's own package masked)
-async function scanForResidue(projectPath, packageName, { tokens, files: residueFiles, title }) {
+async function scanForResidue(projectPath, packageName, { tokens, files, pins, title }) {
+    const problems = await findResidue(projectPath, packageName, { tokens, files, pins });
+    if (problems.length > 0) {
+        throw new Error(`${title}:\n  ${problems.join('\n  ')}`);
+    }
+}
+
+// scanForResidue's problems as a `file: label` list (the verifier collects them); `pins`: identities
+// Package.resolved, if there, must no longer pin
+async function findResidue(projectPath, packageName, { tokens, files: residueFiles, pins = null }) {
     const problems = [];
     for (const rel of residueFiles) {
         if (await fs.pathExists(path.join(projectPath, rel))) problems.push(`${rel}: file still present`);
     }
+    const resolvedPath = path.join(projectPath, ...PACKAGE_RESOLVED);
+    if (pins && (await fs.pathExists(resolvedPath))) {
+        for (const pin of JSON.parse(await fs.readFile(resolvedPath, 'utf8')).pins || []) {
+            if (pins.has(pin.identity)) problems.push(`${path.join(...PACKAGE_RESOLVED)}: ${pin.identity} pin`);
+        }
+    }
 
     const scanned = new Set(tokens.flatMap((token) => [...tokenExtensions(token)]));
     const files = [];
@@ -1400,10 +1467,7 @@ async function scanForResidue(projectPath, packageName, { tokens, files: residue
             }
         }
     }
-
-    if (problems.length > 0) {
-        throw new Error(`${title}:\n  ${problems.join('\n  ')}`);
-    }
+    return problems;
 }
 
 async function processCoreFeatures(projectPath, config, packageName) {
@@ -1479,6 +1543,25 @@ async function processCoreFeatures(projectPath, config, packageName) {
             log.info('✅ Cleaned NetworkModule.kt');
         }
 
+        // 3a. Backend on: the backend's client records its calls in debug builds too, and core/network's iOS
+        // test executable links the system SQLite only for the monitor
+        const backendClientPath = path.join(projectPath, 'core', 'network', 'src', 'commonMain', 'kotlin', packagePath, 'core', 'network', 'BackendClient.kt');
+        if (await fs.pathExists(backendClientPath)) {
+            let content = await fs.readFile(backendClientPath, 'utf8');
+            content = content.split('\n').filter((line) => {
+                const t = line.trim();
+                return t !== 'if (isDebug) installNetworkMonitor()' && !t.startsWith('// Debug builds only, like the request log: the monitor');
+            }).join('\n');
+            content = content.replace(/\n[ \t]*\n([ \t]*\})/g, '\n$1');
+            await fs.writeFile(backendClientPath, content);
+        }
+        const networkGradlePath = path.join(projectPath, 'core', 'network', 'build.gradle.kts');
+        if (await fs.pathExists(networkGradlePath)) {
+            const content = await fs.readFile(networkGradlePath, 'utf8');
+            const cleaned = content.replace(/\n*\/\/ The backend client \(BackendClient\.kt\) keeps the network monitor[^\n]*\n\/\/[^\n]*\nkotlin\.targets\.withType<[^\n]*KotlinNativeTarget>\(\)\.configureEach \{\n[^\n]*TestExecutable>\(\)\.configureEach \{\n\s*linkerOpts\("-lsqlite3"\)\n\s*\}\n\}/, '');
+            if (cleaned !== content) await fs.writeFile(networkGradlePath, cleaned);
+        }
+
         // 3b. Current template: remove the monitor helper files
         for (const [sourceSet, fileName] of MONITOR_HELPER_FILES) {
             await fs.remove(path.join(projectPath, 'core', 'network', 'src', sourceSet, 'kotlin', packagePath, 'core', 'network', fileName));
@@ -1596,7 +1679,8 @@ async function processCoreFeatures(projectPath, config, packageName) {
         // permission stays while a monetization flag is on.
         const manifestPath = path.join(projectPath, 'androidApp', 'src', 'main', 'AndroidManifest.xml');
         const monetizationNeedsInternet = config.purchases === true || config.ads === true;
-        if (!monetizationNeedsInternet) {
+        // backend implies network, so this is the network block's own guard should that rule change
+        if (!monetizationNeedsInternet && config.backend !== true) {
             await dropLines(manifestPath, (line) =>
                 /<uses-permission android:name="android\.permission\.INTERNET"\s*\/>/.test(line));
         }
@@ -1929,14 +2013,19 @@ async function processCoreFeatures(projectPath, config, packageName) {
         await rewriteIfExists(path.join(projectPath, 'androidApp', 'src', 'main', 'AndroidManifest.xml'), stripAdsManifest);
         await rewriteIfExists(path.join(projectPath, 'iosApp', 'iosApp', 'Info.plist'), stripAdsInfoPlist);
 
-        // 5. The Google Mobile Ads Swift package. Package.resolved pins only GMA and UMP, so it goes
-        // as a whole (Xcode writes a new one if the user adds a package), with the swiftpm/ and
-        // xcshareddata/ directories it leaves empty.
+        // 5. The Google Mobile Ads Swift package. Package.resolved loses the GMA and UMP pins (the
+        // backend's stay); with no pin left it goes as a whole (Xcode writes a new one if the user adds a
+        // package), with the swiftpm/ and xcshareddata/ directories it leaves empty.
         await rewriteIfExists(
             path.join(projectPath, 'iosApp', 'iosApp.xcodeproj', 'project.pbxproj'),
             (content) => removeSwiftPackage(content, GMA_PACKAGE_URL)
         );
-        await fs.remove(path.join(projectPath, ...PACKAGE_RESOLVED));
+        const resolvedPath = path.join(projectPath, ...PACKAGE_RESOLVED);
+        if (await fs.pathExists(resolvedPath)) {
+            const stripped = stripPins(await fs.readFile(resolvedPath, 'utf8'), ADS_PIN_IDENTITIES);
+            if (stripped === null) await fs.remove(resolvedPath);
+            else await fs.writeFile(resolvedPath, stripped);
+        }
         for (const depth of [1, 2]) {
             const emptied = path.join(projectPath, ...PACKAGE_RESOLVED.slice(0, -depth));
             if ((await fs.pathExists(emptied)) && (await fs.readdir(emptied)).length === 0) await fs.remove(emptied);
@@ -2035,6 +2124,8 @@ async function processCoreFeatures(projectPath, config, packageName) {
     await assertNoMonetizationResidue(projectPath, packageName, config);
     // Room residue check, at the same point and for the same reason
     await assertNoRoomResidue(projectPath, packageName, config);
+    // Backend residue check (applyBackendOption removed it on the template package), likewise
+    await assertNoBackendResidue(projectPath, packageName, config);
 
     // --- Detekt Removal Logic ---
     if (config.detekt !== true) {
@@ -2096,6 +2187,20 @@ async function processCoreFeatures(projectPath, config, packageName) {
             }
         }
 
+        // 6. Modules outside the convention plugins that apply it by id (core/api and the server: the
+        // backend's JVM-capable modules)
+        const detektPluginLine = `id("${packageName}.detekt")`;
+        for (const moduleDir of [path.join(projectPath, 'core', 'api'), path.join(projectPath, 'server')]) {
+            await dropLines(path.join(moduleDir, 'build.gradle.kts'), (line) => line.trim() === detektPluginLine);
+        }
+        // The server also points detekt at its local runner's sources
+        const serverGradle = path.join(projectPath, 'server', 'build.gradle.kts');
+        if (await fs.pathExists(serverGradle)) {
+            const content = await fs.readFile(serverGradle, 'utf8');
+            const cleaned = content.replace(/(?:^|\n)(?:\/\/[^\n]*\n)?detekt \{ source\.from\("src\/local\/kotlin"\) \}\n(?:[ \t]*\n)?/, '\n');
+            if (cleaned !== content) await fs.writeFile(serverGradle, cleaned);
+        }
+
         // The CI workflow's detekt step would fail without the plugin
         const ciPath = path.join(projectPath, '.github', 'workflows', 'ci.yml');
         if (await fs.pathExists(ciPath)) {
@@ -2168,6 +2273,9 @@ module.exports = {
     assertNoNetworkResidue,
     assertNoMonetizationResidue,
     assertNoRoomResidue,
+    assertNoBackendResidue,
+    findResidue,
+    BACKEND_RESIDUE_TOKENS,
     processCoreFeatures,
     sortImportsLikeKtlint,
     sortKotlinImports

package/src/generate.js

@@ -10,6 +10,7 @@ const {
 } = require('./fileService');
 const { applyBlankShell, cloneFeatureModules, assertTemplateCapabilities } = require('./featureModules');
 const { applyCiOption } = require('./ciOption');
+const { applyBackendOption } = require('./backendOption');
 const { writePrivacyManifest } = require('./privacyManifest');
 const { fillReadme } = require('./readmeService');
 const { buildGenerationRecord, writeGenerationRecord } = require('./generationRecord');
@@ -22,7 +23,7 @@ async function generateCmpProject(value, { projectDir, generatorVersion = null }
     const { projectName, appName, packageName, templateType, features, featuresConfig, ci, minSdk, iosVersion } = value;
     const blankConfig = templateType === 'blank' ? featuresConfig : null;
 
-    // An older template without the monetization modules stops here, naming what is missing
+    // An older template without the modules an on flag needs stops here, naming what is missing
     await assertTemplateCapabilities(projectDir, templateType, featuresConfig);
 
     // The template's own versions (SDK levels for the log, the README's requirements table)
@@ -52,6 +53,8 @@ async function generateCmpProject(value, { projectDir, generatorVersion = null }
     // blank's shell and every requested module come from the template, applied on the
     // template's own package before the rename below
     await applyBlankShell(projectDir, templateType, featuresConfig);
+    // The backend's parts stay (markers dropped) for blank with backend on; everywhere else they go
+    await applyBackendOption(projectDir, templateType === 'blank' && featuresConfig.backend === true);
     await cloneFeatureModules(projectDir, sanitizedFeatures);
     log.info(`✅ Template skeleton ready (${sanitizedFeatures.length} feature modules)`);
 
@@ -76,10 +79,11 @@ async function generateCmpProject(value, { projectDir, generatorVersion = null }
 
     await updateiOSProject(projectDir, packageName, iosVersion);
     await updateiOSConfigFiles(projectDir, packageName, appName, iosVersion);
-    // Store-ready: the privacy manifest declares the data the on flags collect (showcase: both on)
+    // Store-ready: the privacy manifest declares the data the on flags collect (showcase: ads and
+    // purchases on, never backend)
     await writePrivacyManifest(projectDir, templateType === 'blank'
-        ? { ads: featuresConfig.ads === true, purchases: featuresConfig.purchases === true }
-        : { ads: true, purchases: true });
+        ? { ads: featuresConfig.ads === true, purchases: featuresConfig.purchases === true, backend: featuresConfig.backend === true }
+        : { ads: true, purchases: true, backend: false });
     log.info('✅ iOS configuration updated');
 
     await fillReadme(projectDir, { versions, minSdk, iosVersion });

package/src/generationVerifier.js

@@ -1,7 +1,7 @@
 const fs = require('fs-extra');
 const path = require('path');
 const { listTextFiles } = require('./projectFiles');
-const { escapeRegExp } = require('./fileService');
+const { escapeRegExp, findResidue, BACKEND_RESIDUE_TOKENS } = require('./fileService');
 const { TEST_SOURCE_SET_REGEX } = require('./featureModules');
 const { OLD_PACKAGE_NAME } = require('./templateIdentity');
 
@@ -324,7 +324,7 @@ async function verifyStoreReady(projectPath, input, packagePath, problems) {
     if (manifest.includes('cmpose:')) problems.add(`${manifestRel}: cmpose marker left`);
     if (!manifest.includes('NSPrivacyAccessedAPICategoryUserDefaults')) problems.add(`${manifestRel}: required reason APIs missing`);
 
-    const flags = input.featuresConfig ? input.featuresConfig : { ads: true, purchases: true };
+    const flags = input.featuresConfig ? input.featuresConfig : { ads: true, purchases: true, backend: false };
     if (flags.ads === true) {
         if (!manifest.includes('NSPrivacyCollectedDataTypeAdvertisingData')) {
             problems.add(`${manifestRel}: ad data not declared although ads is on`);
@@ -338,6 +338,12 @@ async function verifyStoreReady(projectPath, input, packagePath, problems) {
     } else if (flags.purchases !== true && purchaseHistory) {
         problems.add(`${manifestRel}: purchase history declared although purchases is off`);
     }
+    const accountData = manifest.includes('NSPrivacyCollectedDataTypeEmailAddress');
+    if (flags.backend === true && !accountData) {
+        problems.add(`${manifestRel}: account data not declared although backend is on`);
+    } else if (flags.backend !== true && accountData) {
+        problems.add(`${manifestRel}: account data declared although backend is off`);
+    }
 }
 
 // Network UX: every project keeps core/update, wired through settings, initKoin and MainScreen, which
@@ -489,6 +495,65 @@ async function readIfExists(file) {
     return (await fs.pathExists(file)) ? fs.readFile(file, 'utf8') : '';
 }
 
+// Backend: blank keeps the server, core/api, core/auth, feature/account and feature/sharing exactly when its
+// backend flag is on, wired, with the Google Sign-In URL scheme left to the build setting; otherwise (and
+// always in showcase) none of them and no reference to them. No cmpose:backend marker is ever left.
+const BACKEND_MODULES = [
+    { dir: 'server', build: 'server/build.gradle.kts', include: ':server' },
+    { dir: 'core/api', build: 'core/api/build.gradle.kts', include: ':core:api' },
+    { dir: 'core/auth', build: 'core/auth/build.gradle.kts', include: ':core:auth' },
+    { dir: 'feature/account', build: 'feature/account/presentation/build.gradle.kts', include: ':feature:account:presentation' },
+    { dir: 'feature/sharing', build: 'feature/sharing/presentation/build.gradle.kts', include: ':feature:sharing:presentation' }
+];
+const BACKEND_SHARED_DEPENDENCIES = ['projects.core.auth', 'projects.feature.account.presentation', 'projects.feature.sharing.presentation'];
+const BACKEND_KOIN_MODULES = ['AuthModule', 'AccountModule', 'SharingModule'];
+const GOOGLE_URL_SCHEME = '<string>$(GOOGLE_REVERSED_CLIENT_ID)</string>';
+const BACKEND_MARKER = 'cmpose:backend';
+
+async function verifyBackend(projectPath, input, cfg, problems) {
+    const on = input.templateType === 'blank' && cfg.backend === true;
+    const exists = (rel) => fs.pathExists(path.join(projectPath, rel));
+
+    for (const file of await listTextFiles(projectPath)) {
+        if ((await fs.readFile(file, 'utf8')).includes(BACKEND_MARKER)) problems.add(`${relPath(projectPath, file)}: ${BACKEND_MARKER} marker left`);
+    }
+
+    if (!on) {
+        const where = input.templateType === 'blank' ? 'although backend is off' : 'in a showcase project';
+        for (const { dir } of BACKEND_MODULES) {
+            if (await exists(dir)) problems.add(`${dir}: present ${where}`);
+        }
+        const tokens = BACKEND_RESIDUE_TOKENS.filter((token) => token.label !== BACKEND_MARKER);
+        for (const problem of await findResidue(projectPath, input.packageName, { tokens, files: [] })) {
+            problems.add(problem.split(path.sep).join('/'));
+        }
+        return;
+    }
+
+    const settings = await readIfExists(path.join(projectPath, 'settings.gradle.kts'));
+    for (const { build, include } of BACKEND_MODULES) {
+        if (!(await exists(build))) problems.add(`${build}: missing although backend is on`);
+        if (!settings.includes(`"${include}"`)) problems.add(`settings.gradle.kts: ${include} not included`);
+    }
+    const sharedBuild = await readIfExists(path.join(projectPath, 'shared', 'build.gradle.kts'));
+    for (const dependency of BACKEND_SHARED_DEPENDENCIES) {
+        if (!new RegExp(`\\b${escapeRegExp(dependency)}(?![A-Za-z0-9.])`).test(sharedBuild)) {
+            problems.add(`shared/build.gradle.kts: ${dependency} not a dependency`);
+        }
+    }
+    const packagePath = input.packageName.replace(/\./g, '/');
+    const initKoinRel = `shared/src/commonMain/kotlin/${packagePath}/di/initKoin.kt`;
+    const initKoin = await readIfExists(path.join(projectPath, initKoinRel));
+    // Word match: a custom module named "auth" brings AuthPresentationModule, not AuthModule
+    for (const module of BACKEND_KOIN_MODULES) {
+        if (!new RegExp(`\\b${module}\\b`).test(initKoin)) problems.add(`${initKoinRel}: ${module} not registered`);
+    }
+    const plistRel = 'iosApp/iosApp/Info.plist';
+    if (!(await readIfExists(path.join(projectPath, plistRel))).includes(GOOGLE_URL_SCHEME)) {
+        problems.add(`${plistRel}: the $(GOOGLE_REVERSED_CLIENT_ID) URL scheme is missing`);
+    }
+}
+
 /**
  * Checks the generated project right before it is zipped; throws if anything is wrong (the request fails).
  * @param {string} projectPath
@@ -598,6 +663,9 @@ async function verifyGeneratedProject(projectPath, input) {
     // 13. Paywall: the template's own paywall, the first-launch call and the interstitial pacer
     await verifyPaywall(projectPath, input, packagePath, problems);
 
+    // 14. Backend: the server and its modules exactly when blank's backend flag is on, no residue otherwise
+    await verifyBackend(projectPath, input, input.featuresConfig || {}, problems);
+
     if (problems.size > 0) {
         // Cap the message: a badly broken generation (many unwired modules) can produce dozens of
         // lines, which is unreadable in an error response or a log line.
@@ -610,4 +678,4 @@ async function verifyGeneratedProject(projectPath, input) {
     }
 }
 
-module.exports = { verifyGeneratedProject };
+module.exports = { verifyGeneratedProject, verifyBackend };

package/src/index.js

@@ -26,6 +26,7 @@ module.exports = {
     generationRecord: require('./generationRecord'),
     fileService: require('./fileService'),
     featureModules: require('./featureModules'),
+    backendOption: require('./backendOption'),
     TemplateCapabilityError: require('./featureModules').TemplateCapabilityError,
     verifyGeneratedProject: require('./generationVerifier').verifyGeneratedProject,
     validate: require('./validate').validate,

package/src/pins.js

@@ -1,7 +1,7 @@
 'use strict';
 // The template tags this core version was tested with (immutable tags)
 module.exports = Object.freeze({
-    cmp: Object.freeze({ repo: 'Keremturker/cmpose-template', ref: 'template-2026.10.14' }),
+    cmp: Object.freeze({ repo: 'whinstudio/cmpose-template', ref: 'template-2026.10.16' }),
     // The release step replaces the placeholder with the game template's tag
-    game: Object.freeze({ repo: 'Keremturker/cmpose-game-template', ref: 'game-template-2026.10.15.2' })
+    game: Object.freeze({ repo: 'whinstudio/cmpose-game-template', ref: 'game-template-2026.10.15.2' })
 });

package/src/privacyManifest.js

@@ -4,7 +4,7 @@ const path = require('path');
 // Store-ready: iosApp/iosApp/PrivacyInfo.xcprivacy marks what a flag adds. A block (each marker on its own
 // line) goes when its flag is off and loses only its markers when on; the tracking value line flips.
 const PRIVACY_MANIFEST = ['iosApp', 'iosApp', 'PrivacyInfo.xcprivacy'];
-const BLOCKS = ['ads', 'purchases'];
+const BLOCKS = ['ads', 'purchases', 'backend'];
 const TRACKING_LINE = /<true\/><!-- cmpose:ads-tracking -->/;
 
 function renderPrivacyManifest(content, flags) {

package/src/readmeService.js

@@ -23,7 +23,9 @@ const CORE_DESCRIPTIONS = {
     review: 'in-app review (Play In-App Review, StoreKit) and the store page link',
     update: 'app updates: Play In-App Updates, the App Store lookup and an optional minimum version',
     ads: 'AdMob ads and consent (test IDs)',
-    room: 'Room database (bundled SQLite): AppDatabase, DAOs and schemas'
+    room: 'Room database (bundled SQLite): AppDatabase, DAOs and schemas',
+    api: 'models and routes shared by the app and the server',
+    auth: "Firebase sign-in: email, Google, Apple; the server client's token"
 };
 
 function renderRequirements(versions, { minSdk, iosVersion }) {
@@ -64,6 +66,9 @@ function renderModules(settingsContent) {
         const layers = paths.filter((x) => x.startsWith(`:feature:${feature}:`)).map((x) => x.split(':')[3]).sort();
         lines.push(layers.length ? `- \`:feature:${feature}\`: ${layers.join(', ')}` : `- \`:feature:${feature}\``);
     }
+    if (paths.includes(':server')) {
+        lines.push('- `:server`: Ktor server: sign-in check, spaces, sharing, files; `./gradlew :server:runLocal`');
+    }
     return lines.join('\n');
 }
 

package/src/warnings.js

@@ -5,6 +5,10 @@ function generationWarnings({ templateType, featuresConfig }) {
     const warnings = [];
     if (on('ads')) warnings.push('Ads use AdMob test IDs: replace them with your own before release.');
     if (on('purchases')) warnings.push('Purchases use the RevenueCat Test Store key: replace it before release.');
+    // Backend is blank only: showcase never has it
+    if (templateType === 'blank' && featuresConfig != null && featuresConfig.backend === true) {
+        warnings.push('Sign-in needs your Firebase config files (google-services.json, GoogleService-Info.plist) and the server: run ./gradlew :server:runLocal; see the README.');
+    }
     return warnings;
 }
 

package/src/xcodePackages.js

@@ -114,4 +114,4 @@ function removeSwiftPackageLf(content, repositoryUrl) {
     return result;
 }
 
-module.exports = { removeSwiftPackage };
+module.exports = { removeSwiftPackage, parseObjects, isa };