@fraza/core 0.0.0-stage → 0.3.6

package/.env.example

@@ -0,0 +1,55 @@
+# Modèle des variables du projet, suivi par git. Il ne porte aucune valeur
+# secrète et n'est lu par rien : copier ce fichier en .env.local, puis le
+# remplir. .env.local reste sur la machine, git l'ignore.
+#
+# En production, saisir ces variables dans la plateforme d'hébergement
+# (Coolify, par exemple), jamais dans un fichier suivi par git.
+# FRAZA_ENCRYPTION_KEY s'y copie telle quelle depuis .env.local : elle ne doit
+# jamais changer.
+
+# CORE
+NEXT_PUBLIC_URL=http://localhost:3000
+FRAZA_NAME=Fraza
+
+# PROXY (activer si derrière un reverse proxy)
+FRAZA_TRUST_PROXY=false
+
+# DATABASE
+# postgres://utilisateur:mot-de-passe@hôte:5432/base
+FRAZA_DATABASE_URL=
+
+# CHIFFREMENT
+# 64 caractères hexadécimaux, générés par npx @fraza/start dans .env.local.
+FRAZA_ENCRYPTION_KEY=
+
+# STORAGE
+# Fournisseur : 'backblaze' (défaut) ou 'r2'
+FRAZA_STORAGE_PROVIDER=backblaze
+# Backblaze : s3.<region>.backblazeb2.com  |  R2 : <accountId>.r2.cloudflarestorage.com
+FRAZA_STORAGE_ENDPOINT=
+FRAZA_STORAGE_REGION=
+FRAZA_STORAGE_BUCKET=
+FRAZA_STORAGE_ACCESS_KEY=
+FRAZA_STORAGE_SECRET_KEY=
+
+# EMAIL
+# Fournisseur : 'resend' (défaut) ou 'smtp'
+FRAZA_EMAIL_PROVIDER=resend
+FRAZA_EMAIL_FROM_NAME="EXEMPLE"
+FRAZA_EMAIL_FROM_ADDRESS=app@exemple.com
+# RESEND
+FRAZA_EMAIL_RESEND_APIKEY=
+
+# AUTH SETTINGS
+FRAZA_AUTH_REDIRECT_AFTER_LOGIN=/admin
+FRAZA_AUTH_SESSION_COOKIE_NAME=fraza_session
+FRAZA_AUTH_REGISTRATION=true
+
+# UPDATES
+FRAZA_UPDATE_CHECK=true
+
+# OTHERS
+NEXT_TELEMETRY_DISABLED=1
+
+# DEVKIT (developer tools)
+FRAZA_DEVKIT=false

package/CHANGELOG.md

@@ -0,0 +1,410 @@
+# Journal des versions
+
+Historique des versions publiées de `@fraza/core`.
+
+Ce fichier est généré par `fraza-module changelog` à partir des messages de commit. Ne pas le modifier à la main.
+
+## 0.3.6 (2026-10-25)
+
+Maintenance interne, aucun changement de comportement.
+
+## 0.3.5 (2026-10-25)
+
+### Refontes
+
+- **docs, src/tools, test/tools** : update documentation and CLI for version intermediately published on Fraza registry (0595be8)
+
+## 0.3.4 (2026-10-24)
+
+### Refontes
+
+- **docs/00-decouverte/01-qu-est-ce-que-fraza.md, docs/01-demarrage/01-installation.md, etc.** : update registry and installation documentation (5867afc)
+
+## 0.3.3 (2026-10-24)
+
+### Corrections
+
+- update icons and documentation (c0bb07e)
+
+## 0.3.2 (2026-10-24)
+
+### Refontes
+
+- **plan.server.js** : extract npm view value handling into a reusable function (94c0231)
+
+## 0.3.1 (2026-10-24)
+
+### Ruptures
+
+- answer every API error from a French catalogue, let handlers throw ApiError
+- version the module contract, refuse an unknown one at startup
+- refuse an upload in French, with a stable code per layer
+- keep only the Stripe webhook, verify its signature without the SDK
+- publish a digest of a file's etag, never the value itself
+- answer 404 for an unknown or refused admin page, inside the shell
+- render Table as a compact list on narrow screens, open its rows from the keyboard
+- replace Headless UI with a native dialog and a shared menu primitive
+- ship IBM's own WOFF2 subsets of Plex Sans and Plex Mono
+- resolve a path once per request, keep a failing resolver from taking the others down
+- answer ETag, 304, byte ranges and Cache-Control in buildFileResponse
+- declare a page's title and permission on the server, load its code on demand
+- declare in sideEffects only the files that act when imported
+- give each shared component its own entry, fail a module public page on a heavy barrel
+- boot from @fraza/core/init, keep only the boot and the config at the root
+- drop the public loading screen, which made every unknown URL answer 200
+- answer a sign-up the same way whether or not the address has an account
+- hash a new account's password before its transaction opens
+- keep the admin role on its last holder
+- refuse the admin password, address and reset routes on one's own account
+- ship .env.example as a secret-free template, keep values in .env.local
+- write the project .npmrc in mode 0600 and warn about a token that can publish
+- store only the SHA-256 of session and link tokens, spend links atomically
+- read admin.access from the roles, drop the legacy role column
+- grant only what one holds, change only accounts one outranks
+- move account rules into a core/users service, written in transactions
+- refuse register() on an empty database
+- find system roles by a stable key and lock their name
+- store e-mail addresses normalized, unique regardless of case
+- stop exposing setSessionCookie and refreshSessionCookie as actions
+- remove dead user queries, refreshSession and the auth re-export shims
+- stop the per-email counter from locking the owner out of their account
+- throw from queueEmail when it cannot queue inside a transaction
+- require Next.js 16
+- call the Resend REST API with fetch instead of the SDK
+- load the project env files without dotenv, require Node 20.12
+- render emails with the core's own components instead of react-email
+- validate storage policies and refuse an unknown type
+- refuse an extension key or a route already taken by another source
+- lock jobs across instances in fraza_cron_runs and record every run
+- share counters through PostgreSQL, keep unknown addresses limited
+- encode S3 metadata values and send the URL that was signed
+- cap request bodies per route, answer 405 and 413
+- add the shared http entry with apiFetch and the client IP readers
+- add civil date helpers and todayInZone, format in fr-CA by default
+- bound migration lock waits and reject malformed migrations
+- verify the TLS certificate by default, whatever NODE_ENV says
+
+### Action requise
+
+- `npx fraza-db migrate`
+- `npx fraza-doctor --fix`
+
+### Variables d'environnement
+
+- Ajoutée : `FRAZA_ADMIN_SITE_LINK`
+- Ajoutée : `FRAZA_AUTH_REDIRECT_AFTER_LOGIN`
+- Ajoutée : `FRAZA_AUTH_REGISTRATION`
+- Ajoutée : `FRAZA_AUTH_SESSION_COOKIE_NAME`
+- Ajoutée : `FRAZA_AUTH_SESSION_MAX_AGE_DAYS`
+- Ajoutée : `FRAZA_CURRENCY`
+- Ajoutée : `FRAZA_CURRENCY_SYMBOL`
+- Ajoutée : `FRAZA_DATABASE_URL`
+- Ajoutée : `FRAZA_DATE_FORMAT`
+- Ajoutée : `FRAZA_DB_CONNECT_TIMEOUT_MS`
+- Ajoutée : `FRAZA_DB_MIGRATION_LOCK_TIMEOUT_MS`
+- Ajoutée : `FRAZA_DB_POOL_MAX`
+- Ajoutée : `FRAZA_DB_SSL_CA`
+- Ajoutée : `FRAZA_DB_STATEMENT_TIMEOUT_MS`
+- Ajoutée : `FRAZA_DEVKIT`
+- Ajoutée : `FRAZA_EMAIL_FROM_ADDRESS`
+- Ajoutée : `FRAZA_EMAIL_FROM_NAME`
+- Ajoutée : `FRAZA_EMAIL_LOGO`
+- Ajoutée : `FRAZA_EMAIL_LOGO_URL`
+- Ajoutée : `FRAZA_EMAIL_OUTBOX_RETENTION_DAYS`
+- Ajoutée : `FRAZA_EMAIL_PROVIDER`
+- Ajoutée : `FRAZA_EMAIL_RESEND_APIKEY`
+- Ajoutée : `FRAZA_EMAIL_SMTP_HOST`
+- Ajoutée : `FRAZA_EMAIL_SMTP_PASSWORD`
+- Ajoutée : `FRAZA_EMAIL_SMTP_PORT`
+- Ajoutée : `FRAZA_EMAIL_SMTP_REQUIRE_TLS`
+- Ajoutée : `FRAZA_EMAIL_SMTP_SECURE`
+- Ajoutée : `FRAZA_EMAIL_SMTP_TIMEOUT_MS`
+- Ajoutée : `FRAZA_EMAIL_SMTP_TLS_NO_VERIFY`
+- Ajoutée : `FRAZA_EMAIL_SMTP_USER`
+- Ajoutée : `FRAZA_ENCRYPTION_KEY`
+- Ajoutée : `FRAZA_IMAGE_CONCURRENCY`
+- Ajoutée : `FRAZA_IMAGE_MAX_PIXELS`
+- Ajoutée : `FRAZA_LOGO_URL`
+- Ajoutée : `FRAZA_LOGO_URL_DARK`
+- Ajoutée : `FRAZA_LOG_FORMAT`
+- Ajoutée : `FRAZA_LOG_LEVEL`
+- Ajoutée : `FRAZA_NAME`
+- Ajoutée : `FRAZA_SEO`
+- Ajoutée : `FRAZA_SEO_SEPARATOR`
+- Ajoutée : `FRAZA_SEO_TITLE_TEMPLATE`
+- Ajoutée : `FRAZA_SITE_URL`
+- Ajoutée : `FRAZA_STORAGE_ACCESS_KEY`
+- Ajoutée : `FRAZA_STORAGE_BUCKET`
+- Ajoutée : `FRAZA_STORAGE_ENDPOINT`
+- Ajoutée : `FRAZA_STORAGE_PROVIDER`
+- Ajoutée : `FRAZA_STORAGE_REGION`
+- Ajoutée : `FRAZA_STORAGE_SECRET_KEY`
+- Ajoutée : `FRAZA_STORAGE_TIMEOUT_MS`
+- Ajoutée : `FRAZA_SUPPORT_EMAIL`
+- Ajoutée : `FRAZA_TEST_DATABASE_URL`
+- Ajoutée : `FRAZA_TEST_SCHEMA_TTL_HOURS`
+- Ajoutée : `FRAZA_TIMEZONE`
+- Ajoutée : `FRAZA_TRUST_PROXY`
+- Ajoutée : `FRAZA_UPDATE_CHAIN`
+- Ajoutée : `FRAZA_UPDATE_CHECK`
+- Ajoutée : `NEXT_PUBLIC_URL`
+- Ajoutée : `NEXT_TELEMETRY_DISABLED`
+- Ajoutée : `STRIPE_WEBHOOK_SECRET`
+
+### Ajouts
+
+- **test/tools.test.js** : add tests for icons package refactor(package.server.js): add ICONS_NAME constant and update package profile (4e0aebe)
+- add devkit colors page (867fcee)
+- **core** : add `markUnread` and `deleteNotification` functions and routes (43c92ad)
+- **admin** : add devkit scenario endpoint (a711593)
+- **core** : add notification system (1a03ce5)
+- **tools** : accept an exact version in fraza-module release (11c0951)
+- **tools** : bump the version in fraza-module release, patch by default (a2e7a44)
+- **CHANGELOG, package.json** : update version and changelog content (5fc6b48)
+- **api** : answer every API error from a French catalogue, let handlers throw ApiError (3891bc9)
+- **modules** : declare soft dependencies with manifest.optionalModules (e99f9af)
+- **modules** : version the module contract, refuse an unknown one at startup (f43e006)
+- **compat** : check the peer range of a module even when it declares requiresCore (73f4252)
+- **tools** : add fraza-module test-clean to drop the leftover test schemas (309a0d6)
+- **tools** : drop the live test schemas on SIGINT and SIGTERM (264637d)
+- **tools** : date the test schemas and sweep the ones a killed process left (f723e01)
+- **api** : measure a file read on demand, answer its length and its ranges (d14fc9d)
+- **api** : let a file descriptor add X- headers to its response (76e18ff)
+- **api** : let the read of a file refuse it with a status of its own (941eada)
+- **users** : export the account input rules from a neutral @fraza/core/users/validation (dd1f281)
+- **ui** : let Combobox search on the server (1d27120)
+- **ui** : let a Table offer its own page sizes (6a0fefd)
+- **tools** : give module tests the core tables, the migration context and the Next hook (e344924)
+- **crypto** : derive a key per purpose, sign and verify short tokens (756d4e5)
+- **database** : leave expected SQLSTATE codes out of the logs, add isUniqueViolation (49adbfc)
+- **sql** : add escapeLike and containsPattern, clamp a limit of many digits to max (1e78a3b)
+- **http** : add truncateIp, the network of an address in CIDR form (a9099aa)
+- **storage** : add isStorageConfigured and deletePrefix (e9206a8)
+- **api** : export runAfterResponse and parseFormData (220cf1b)
+- **email** : export ADDRESS from a neutral @fraza/core/email/address entry (d09af47)
+- **dates** : edit an instant in a time zone, hand the site's zone to the admin pages (e67d95c)
+- **api** : answer 502 and 503, let apiSuccess carry response headers (7d04124)
+- **api** : let a file response refuse conditional requests (472c6d2)
+- **api** : answer 404 when the read of a file finds the object gone (d948c67)
+- **ui** : render Table as a compact list on narrow screens, open its rows from the keyboard (13de5f7)
+- **ui** : replace Headless UI with a native dialog and a shared menu primitive (5796f75)
+- **ui** : read the session of the admin and auth routes in a Suspense boundary under Cache Components (d340754)
+- **public-content** : add revalidatePublicContent(tag) for a module's cached public reads (899b46d)
+- **api** : answer ETag, 304, byte ranges and Cache-Control in buildFileResponse (c1f3ca9)
+- **admin** : declare a page's title and permission on the server, load its code on demand (3f1dff6)
+- **tools** : check a module's ./client entry for server code (aea6541)
+- **components** : give each shared component its own entry, fail a module public page on a heavy barrel (74ae803)
+- **init** : boot from @fraza/core/init, keep only the boot and the config at the root (2d8e93a)
+- **doctor** : expect the error, loading and global error files in the project contract (1789380)
+- **ui** : add the error, loading and global error screens a project re-exports (cd62024)
+- **doctor** : warn when a FRAZA_MODULE_* flag differs from the generated manifest (f07ef03)
+- **doctor** : report an env file tracked by git that carries a secret (3abb245)
+- **env** : ship .env.example as a secret-free template, keep values in .env.local (07dabdd)
+- **auth** : read a session with its user in one query and end it after an absolute lifetime (79412f2)
+- **auth** : hash passwords in a versioned scrypt format and rehash old ones at sign-in (15aabe1)
+- **admin** : check a new user's fields with the shared rules before sending (226cdb9)
+- **users** : find system roles by a stable key and lock their name (8f9b94c)
+- **users** : store e-mail addresses normalized, unique regardless of case (ea9ca43)
+- **email** : send a Resend idempotency key with every outbox attempt (498fcf9)
+- **email** : add the shared email parts entry (7ab6d6a)
+- **email** : render emails with the core's own components instead of react-email (6ab8c5b)
+- **registry** : refuse an extension key or a route already taken by another source (4966e45)
+- **cron** : purge expired sessions, tokens, counters and old outbox rows hourly (43a1eb2)
+- **email** : add an outbox that stores emails before sending and retries them (529616f)
+- **cron** : lock jobs across instances in fraza_cron_runs and record every run (d76fd47)
+- **rate-limit** : share counters through PostgreSQL, keep unknown addresses limited (fd77c93)
+- **api** : cap request bodies per route, answer 405 and 413 (d827533)
+- **storage** : add bounded image processing on a lazily loaded sharp (569aeac)
+- **storage** : add a streamed ZIP writer with ZIP64 (b5d42c2)
+- **tools** : fail the core build when a client-safe entry reaches server code (af9f894)
+- **http** : add the shared http entry with apiFetch and the client IP readers (c812919)
+- **dates** : add civil date helpers and todayInZone, format in fr-CA by default (d4b1828)
+- **slug** : add a shared slugify and a database uniqueSlug (7cc6315)
+- **database** : add the shared sql helpers entry (8974e89)
+- **database** : show the env files and the target database before fraza-db writes (e187b63)
+- **database** : make the pool configurable, keep it on globalThis, return DATE as strings (9e79fcc)
+- **logger** : keep error stacks, write failures to stderr, add json format and email masking (10f1d39)
+- **tools** : add the fraza-module command shared by every package (d9b2418)
+- **modules** : recognise the @fraza-pro scope for Pro modules (6a9db8f)
+- **docs** : add icon support and documentation (231d39d)
+- initial Fraza 0.1.0 codebase (f99a054)
+
+### Corrections
+
+- **docs** : remove and rephrase description of `requiresCore` in module creation guide (5488a6f)
+- **api** : remove redundant sibling handling logic (f0fade0)
+- **src/shared/icons** : remove deprecated components (8ce40e5)
+- **core** : update documentation for authentication page handling (420f4b1)
+- **shared-icons** : update icon sources and documentation (36b1c20)
+- **src/features/admin/components/AdminShell.js** : set `position: relative` on shell and main for better overflow handling (b77a521)
+- update paths in package.json and documentation (3dc2ee3)
+- **tools** : warn about breaking changes in a patch release instead of refusing it (2a9758a)
+- **tools** : find each dependency on disk instead of trusting npm's path (092beeb)
+- **tools** : refuse to bump again over a release stopped after its commit (52fb015)
+- **tools** : push the release branch and its tag atomically (fbc577a)
+- **tools** : fetch before a release, refuse a branch behind its remote (3551bba)
+- **tools** : refuse a release level below the breaking changes waiting (cbbb6b5)
+- **package** : bump version to 0.2.0 (f2c5876)
+- **api** : percent-encode ' ( ) * in filename* as RFC 8187 asks (cf35ac0)
+- **admin** : show the French message of a refused profile or user call (a2f011b)
+- **media-registry** : answer a write without the media module in French, with a code (1b0038e)
+- **api** : give Content-Disposition a readable ASCII filename fallback (afd0e6f)
+- **payments** : answer the Stripe webhook refusals in French (eeb573a)
+- **storage** : refuse a file in French, answer a storage outage with a 502 (c75cfcf)
+- **auth** : answer the user and role routes in French, leave internal errors to the router (612b405)
+- **admin** : clear a page's error when its path changes under the same slug (e63ff8e)
+- **storage** : refuse an upload in French, with a stable code per layer (df7f4f3)
+- **media-registry** : pass client to the block helpers and getMediaByIds, keep the 404 out of caches (93caa5f)
+- **admin** : pass the server title down to the header of the roles page (14d1567)
+- **ui** : name each selection checkbox of a table after its row (ca9b573)
+- **ui** : open a table row from a real button on its title, not a focusable tr (b34cd19)
+- **ui** : keep a disabled menu item focusable, announced as disabled (d36ed0f)
+- **ui** : describe a dialog by its sentence, make a confirmation an alert dialog (4b788fe)
+- **ui** : open a dialog again after a native close its caller did not follow (597cd55)
+- **ui** : let Escape close the « Aucun résultat » panel of TagInput, not its dialog (2fafc4c)
+- **tools** : count a call in an initializer, a default export or a top-level if as an effect (6bc9d89)
+- **admin** : download a page again after a failed chunk, on the way back too (6710b2c)
+- **admin** : hide a nav item without the permission of the page it opens (b99ed26)
+- **api** : publish a digest of a file's etag, never the value itself (b94bd18)
+- **admin** : answer 404 for an unknown or refused admin page, inside the shell (13e8a79)
+- **admin** : make the closed mobile drawer inert, close it on Escape, size it by dvh (7699d7e)
+- **ui** : label the core form fields by useId, describe them and mark their errors (674d526)
+- **blocks** : render a linked image from the filename the Medias module resolves (233ea1b)
+- **hooks** : remove the mirror history entry of useUnsavedChanges once clean (394777a)
+- **editor** : keep the block selection keys inside the editor that holds them (e4344c8)
+- **blocks** : keep block links to http, https, mailto, tel and relative addresses (44c0753)
+- **admin** : filter the bottom nav items by permission, mark them active in the browser (f06c2df)
+- **ui** : drop the public loading screen, which made every unknown URL answer 200 (4b76a20)
+- **auth** : apply the name rules on PUT /users/:id (b3cc93d)
+- **users** : bound the memory a stored password hash may ask for, not each parameter (094963d)
+- **auth** : check an older password hash in the time of a current one at sign-in (6a205a3)
+- **auth** : answer a sign-up the same way whether or not the address has an account (c73232a)
+- **auth** : issue and queue the verification link after the response of resendVerificationAction (1fb6d1a)
+- **users** : hash a new account's password before its transaction opens (2c31327)
+- **auth** : check the password before the address, count wrong current passwords (01ddfde)
+- **auth** : let an invited account whose invitation is gone still be activated (4dc7242)
+- **auth** : keep the admin role on its last holder (28a9c01)
+- **auth** : refuse the admin password, address and reset routes on one's own account (9a6c7a5)
+- **registry** : write the project .npmrc in mode 0600 and warn about a token that can publish (6f1f2c1)
+- **auth** : issue and queue the reset link after the response of forgotPasswordAction (a95496e)
+- **auth** : close the other sessions on a password or address change (8ed0db9)
+- **auth** : stop writing the session cookie while rendering, make it last the whole session (60ba193)
+- **auth** : store only the SHA-256 of session and link tokens, spend links atomically (b6f0836)
+- **storage** : read admin.access from the roles, drop the legacy role column (01f5e8d)
+- **auth** : grant only what one holds, change only accounts one outranks (1781737)
+- **auth** : refuse register() on an empty database (0d73bed)
+- **auth** : stop exposing setSessionCookie and refreshSessionCookie as actions (44067c3)
+- **auth** : log a wrong password as one warning line, not an error with its stack (f6e8cfd)
+- **auth** : rethrow Next.js control flow from getSession instead of logging it (fed7991)
+- **auth** : stop the per-email counter from locking the owner out of their account (5f11241)
+- **rate-limit** : keep the public guessing presets on the caller's address (00cb0ba)
+- **cron** : run a locked job once per tick, not once per instance (521bc57)
+- **maintenance** : purge in batches so a first purge fits under statement_timeout (4e4e638)
+- **email** : throw from queueEmail when it cannot queue inside a transaction (5db9b9a)
+- **database** : raise when PostgreSQL turns the COMMIT of transaction() into a ROLLBACK (ca574a0)
+- **release** : annotate the version tag so git push --follow-tags sends it (fd1ae7a)
+- **dates** : read the years 0 to 99 as given in daysBetweenISO (863db7a)
+- **slug** : spell the combining marks range with escapes (4f6e83f)
+- **storage** : validate storage policies and refuse an unknown type (436a050)
+- **api** : apply a route's permission on user routes too (d4e5ccb)
+- **auth** : rate limit sign-in and password flows per targeted e-mail too (3e0992d)
+- **email** : bound SMTP connection, TLS handshake and whole send, add REQUIRE_TLS (db5d32e)
+- **storage** : bound every S3 request, retry idempotent ones, batch deletes (3f32632)
+- **storage** : encode S3 metadata values and send the URL that was signed (89f9f0a)
+- **payments** : rate limit the Stripe webhook and cap its body at 64 KiB (b502d15)
+- **database** : bound migration lock waits and reject malformed migrations (19a8742)
+- **database** : verify the TLS certificate by default, whatever NODE_ENV says (c285388)
+- **database** : rethrow non-database errors from transaction() untouched (658f551)
+- **database** : check table, column and index existence in the current schema (8880c81)
+- Correct dimensions and descriptions for the admin bar (2af9ab7)
+
+### Performance
+
+- **fonts** : ship IBM's own WOFF2 subsets of Plex Sans and Plex Mono (2415acb)
+- **public-content** : resolve a path once per request, keep a failing resolver from taking the others down (7b2b365)
+- **hooks** : track the dirty state of useUnsavedChanges with a revision counter (8488ba6)
+- **editor** : render only the changed block on a keystroke (445b283)
+- **build** : declare in sideEffects only the files that act when imported (e1072ae)
+- **api** : check admin.access and a route's permission with one read (23891d7)
+- **users** : count a role's permissions and holders with subqueries (6998ed1)
+- **auth** : ask once per request whether an account exists (e542776)
+- **auth** : read the session and the permissions once per request (3e79232)
+
+### Refontes
+
+- **ui** : update icon references in multiple documents and code files (35d3dc6)
+- **cli** : update `release` command to include adjacent packages and Fraza dependency versions (1419609)
+- **core** : align dependencies with core range (2af2390)
+- **shared** : update documentation and component descriptions (42af50a)
+- **drive** : update icon logic and documentation (1307692)
+- **admin** : update widget registration with title, description, and size (af76bd2)
+- **shared/components/Modal.js** : handle `close` event delay during reopens (32f6f23)
+- **admin** : update breadcrumb logic and documentation (f1fbb40)
+- **api, docs, style** : update theme descriptions and styles (c14e0ae)
+- **admin** : reorganize and improve components layout (2495abc)
+- **auth** : add anti-bot feature and update security guidelines (a6e3238)
+- **payments** : keep only the Stripe webhook, verify its signature without the SDK (6507f25)
+- **users** : move account rules into a core/users service, written in transactions (3af5f0e)
+- **users** : keep the password and name rules in one shared module (71418a8)
+- **users** : remove dead user queries, refreshSession and the auth re-export shims (b544c28)
+- **email** : call the Resend REST API with fetch instead of the SDK (98fc714)
+- **admin** : enhance sidebar section toggle and state persistence (018c0df)
+- **admin** : update navigation sections and groups (16c98bc)
+- **auth** : update logo positioning and page dimensions (b29dbb9)
+- **auth** : removed unused AuthLogoContext (78a5e2c)
+- **icons** : remove old icons (e43e7f5)
+
+### Documentation
+
+- **03-reference/04-partage/icones.md** : improve usage instructions for icon package (ea5aebe)
+- **module** : update package notices and documentation (68e8baf)
+- **docs/03-reference/04-partage/icones.md** : add detailed drawing rules for icons (74fbb08)
+- update permissions and roles documentation (5b22cff)
+- enhance installation and tour guides (e69f488)
+- **00-decouverte, 01-demarrage, 06-structure-du-projet** : update API route paths (68826b2)
+- **publication** : describe how @fraza/start runs fraza-module and its version module (fbc8221)
+- **posts** : document the term_taken refusal of a duplicate term title (88f3f72)
+- **design-system** : describe the inert mobile drawer and the title button of a table row (ad65d74)
+- **guides** : answer a storage failure with a 502 and a failed job with the catalogue 500 (44aad16)
+- **posts** : document the French refusals and codes of the post and term routes (f2ff9c8)
+- **pages** : document the codes of the conflicts of a page (6a56782)
+- **medias** : document the codes of a refused media and the French file route texts (f038c48)
+- **forms** : document details.fieldErrors and the codes of a refusal (530b1bd)
+- **drive** : document the error codes of the drive routes (fba1ea0)
+- **booking** : document the error answers and their codes (cdb0a96)
+- **facturation** : document the error answers of the billing routes (dc43d3e)
+- **pages, posts** : the media module is an optional module, reminded by fraza-doctor (bc89a79)
+- drop the long dash inside sentences of the api barrel, the logger and the handler signature comments (351dac1)
+- **drive** : link listCronRuns to the cron reference without a guessed anchor (1b8d2b0)
+- **medias** : getMediaByIds reads on the caller's client (877ee6e)
+- **drive** : describe the bounded history, the share unlock counter, the deletion queue and the core zip (9aae20f)
+- **booking** : describe one slot rule, the signed form token, framing, the outbox and theme colours (e020a91)
+- **billing** : describe the serialized ledger, the module's own Stripe and PDF, credit notes and the outbox (070d78e)
+- **posts** : describe strict declarations, private fields everywhere, batched reads and transactional writes (31c47a5)
+- **pages** : describe the server-paged tree, the restricted delete, the recursive resolution and the cache tag (b99c499)
+- **medias** : describe the type table, the core image pipeline and the references in a transaction (2dfb5c4)
+- **forms** : describe the per-type validation, the signed delay token, privacy and retention (156700b)
+- **pages, posts** : the compact list keeps the depth of a child (14d9dea)
+- **billing** : the public invoice sends both layouts of its lines (3016f6b)
+- **posts** : the block editor loads with the form, not with the lists (39c37c3)
+- **pages** : the block editor loads with the form, not with the list (fdcb93c)
+- **drive** : the counted download refuses conditional requests (b6514e5)
+- **drive** : a preview or thumbnail whose object is gone answers 404 (cc082f8)
+- **modules** : describe the admin 404 without the read permission, the compact lists and the file answers of the adapted modules (a3a86ee)
+- **drive** : the unlock route counts on the share_unlock preset (2d04f23)
+- **env** : align the env file comments with .env.local and the platform variables (d26fc96)
+- **users** : name consumeEmailChangeToken, which replaced verifyEmailChangeToken (15c04d9)
+- **modules** : say the version module comes from fraza-module sync-version (8eb61fc)
+- **database** : say which hosted databases need FRAZA_DB_SSL_CA (666372a)
+- **drive** : say the blocklist reads the raw suffix of the name (8fcd793)
+- **modules** : document the body ceilings of the drive, medias and forms uploads (4639e2f)
+- **http** : point the proxy settings at the http page (b5050dc)
+- split modules into Gratuit and Pro, drop login from getting started (f1907fc)
+- **admin** : remove unused mention from sidebar description (fa9701b)
+
+### Autres
+
+- docs/refactor: add documentation for fraza-update and fraza-doctor (b096e8f)
+- docs/02-guides/mettre-a-jour-un-projet.md,.docs/03-reference/05-cli/fraza-doctor.md,src/core/doctor/imports.server.js,test/doctor-imports.test.js: Update deprecated imports for @fraza/icons (0.2.22) (c5e7954)
+- docs/drive): Improve menu actions and add copy functionality (f5def22)
+- Initial commit (7eda0fc)

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 HYKO
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -1,3 +1,57 @@
-# Temporary Holding Version
+# Fraza
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+Fraza est un starter kit Next.js avec un back-office modulaire, conçu au Québec. `@fraza/core` est son paquet principal : il apporte à un projet Next.js ordinaire les comptes, la connexion, les rôles, une administration complète et les services que tout projet web refait à chaque fois. Les fonctionnalités s'ajoutent par des modules `@fraza/module-*`, et le projet reste le vôtre.
+
+> [!WARNING]
+> Fraza est en version `0.x`. L'API, la structure et les fonctionnalités peuvent encore changer : une nouvelle version mineure peut contenir un changement cassant.
+
+## Fonctionnalités
+
+- **Authentification** : inscription, connexion, mot de passe oublié, vérification du courriel, invitations.
+- **Administration** : tableau de bord avec widgets, utilisateurs, rôles et permissions, profil, mode sombre.
+- **Modules** : chaque module apporte ses tables, ses écrans d'admin, ses permissions et ses routes, sans modifier le core.
+- **Site public** : pages servies à la racine du domaine, avec un système de templates.
+- **Routeur API** : API REST avec authentification, protection CSRF et limitation du débit.
+- **Courriels** : gabarits écrits avec React Email.
+- **Stockage** : fichiers sur un stockage objet compatible S3.
+- **Paiements** : intégration Stripe.
+- **Tâches planifiées** : exécution de tâches programmées.
+- **Outillage** : commandes `fraza-db`, `fraza-modules`, `fraza-key`, `fraza-doctor` et `fraza-update`.
+
+## Documentation
+
+Toute la documentation vit dans [docs/](./docs/index.md).
+
+| Section | Contenu |
+|---|---|
+| [Démarrage](./docs/01-demarrage/index.md) | De l'installation au premier module, à lire dans l'ordre. |
+| [Guides](./docs/02-guides/index.md) | Un cas d'usage par page. |
+| [Référence](./docs/03-reference/index.md) | Chaque module, fonction, commande et variable d'environnement. |
+| [Architecture](./docs/04-architecture/index.md) | Principes, frontières serveur/client, build, sécurité, design system. |
+| [Contribution](./docs/05-contribution/index.md) | Conventions de code, de rédaction, de commit et publication. |
+| [Modules](./docs/06-modules/index.md) | Usage des modules officiels `@fraza/module-*` et `@fraza-pro/module-*`. |
+
+La documentation est **livrée dans le package** : un projet qui installe `@fraza/core` la trouve sous `node_modules/@fraza/core/dist/docs/`, pour la version exacte qu'il utilise.
+
+## Démarrage rapide
+
+```bash
+npm config set "@fraza:registry" https://registry.fraza.ca/
+npx @fraza/start
+npx fraza-db init
+npm run dev
+```
+
+Aucun compte n'est demandé : le core et les modules gratuits se lisent librement sur le registre. Le détail, et la connexion pour les modules Pro, est dans [Installation](./docs/01-demarrage/01-installation.md).
+
+## Sécurité
+
+Pour signaler une faille de sécurité, voir [SECURITY.md](./SECURITY.md).
+
+## Licence
+
+Licence MIT. Copyright (c) 2026 HYKO. Voir [LICENSE](./LICENSE).
+
+Ce paquet fait partie de Fraza Libre. Les dépendances tierces et leurs licences sont listées dans [THIRD-PARTY-NOTICES.md](./THIRD-PARTY-NOTICES.md).
+
+Les modules Facturation, Rendez-vous et Fichiers (`@fraza-pro/module-billing`, `@fraza-pro/module-booking`, `@fraza-pro/module-drive`) sont distribués à part, sous la licence Fraza Pro. Leur installation demande un compte sur le registre. Le modèle est expliqué dans [Licence et propriété](./docs/04-architecture/07-licence-et-propriete.md).