@jtl-software/create-cloud-app 0.3.1 → 0.5.2

package/dist/index.js

@@ -157,7 +157,10 @@ function captureAuthCode(authorizeUrl, expectedState, verifier, options = {}) {
     const closeAndSettle = (res, next) => {
       if (settled) return;
       settled = true;
-      const finish = () => server.close(() => next());
+      const finish = () => {
+        server.closeAllConnections?.();
+        server.close(() => next());
+      };
       if (res.writableEnded) {
         finish();
       } else {
@@ -364,6 +367,9 @@ async function acquireAccessToken(opts) {
   authorizeUrl.searchParams.set("state", state);
   authorizeUrl.searchParams.set("code_challenge", pkce.challenge);
   authorizeUrl.searchParams.set("code_challenge_method", "S256");
+  if (reauth) {
+    authorizeUrl.searchParams.set("prompt", "select_account");
+  }
   spinner4?.start("Waiting for browser login");
   try {
     const { code, verifier } = await captureAuthCode(
@@ -471,6 +477,10 @@ function tenantsFromClaims(claims) {
   }
   return ordered;
 }
+function activeTenantId(claims) {
+  const active = claims[TENANT_ID_CLAIM];
+  return typeof active === "string" && active ? active : void 0;
+}
 function validateHost(input, flag) {
   let url;
   try {
@@ -680,6 +690,37 @@ function detectBackend(root) {
   }
   return { kind: "node", envFile: path2.join(root, ".env") };
 }
+function detectFrontend(root) {
+  const frontendDir = path2.join(root, "packages", "frontend");
+  return fs2.existsSync(path2.join(frontendDir, "package.json")) ? frontendDir : null;
+}
+function writeFrontendPublicClient(root, authIssuer, publicClientId) {
+  const frontendDir = detectFrontend(root);
+  if (!frontendDir) return null;
+  const envFile = path2.join(frontendDir, ".env");
+  upsertEnv(envFile, {
+    VITE_JTL_CLIENT_ID: publicClientId,
+    VITE_JTL_ISSUER: authIssuer
+  });
+  return envFile;
+}
+function readBackendPort(backend) {
+  if (backend.kind === "node") {
+    for (const file of [backend.envFile, `${backend.envFile}.example`]) {
+      const value = readEnvFile(file).PORT;
+      if (value && /^\d+$/.test(value)) return Number(value);
+    }
+  }
+  return 3005;
+}
+function writeVerifyDemoEnv(root, backend) {
+  if (!backend) return;
+  const frontendDir = detectFrontend(root);
+  if (!frontendDir) return;
+  upsertEnv(path2.join(frontendDir, ".env"), {
+    VITE_BACKEND_URL: `http://localhost:${readBackendPort(backend)}`
+  });
+}
 function readExistingCredentials(backend) {
   if (backend.kind === "node") {
     const values = readEnvFile(backend.envFile);
@@ -696,11 +737,12 @@ function readExistingCredentials(backend) {
     return {};
   }
 }
-function writeBackendCredentials(backend, clientId, clientSecret) {
+function writeBackendCredentials(backend, clientId, clientSecret, issuer) {
   if (backend.kind === "node") {
     upsertEnv(backend.envFile, {
       CLIENT_ID: clientId,
-      CLIENT_SECRET: clientSecret
+      CLIENT_SECRET: clientSecret,
+      ...issuer ? { JTL_ISSUER: issuer } : {}
     });
     return backend.envFile;
   }
@@ -715,7 +757,8 @@ function writeBackendCredentials(backend, clientId, clientSecret) {
   settings.JtlPlatform = {
     ...settings.JtlPlatform ?? {},
     ClientId: clientId,
-    ClientSecret: clientSecret
+    ClientSecret: clientSecret,
+    ...issuer ? { Issuer: issuer } : {}
   };
   fs2.writeFileSync(
     backend.settingsFile,
@@ -772,7 +815,8 @@ function resolveOptions(args) {
         ...COMMON_ARG_OPTIONS,
         "existing-app-id": { type: "string" },
         new: { type: "boolean" },
-        "on-collision": { type: "string" }
+        "on-collision": { type: "string" },
+        "app-service-path": { type: "string" }
       },
       strict: true,
       allowPositionals: false
@@ -788,11 +832,13 @@ function resolveOptions(args) {
   }
   const onCollisionRaw = parsed.values["on-collision"];
   const onCollision = onCollisionRaw ? parseCollisionAction(onCollisionRaw) : void 0;
+  const appServicePath = parsed.values["app-service-path"] ?? "app-service";
   return {
     ...common,
     existingAppId,
     forceNew,
-    onCollision
+    onCollision,
+    appServicePath
   };
 }
 async function selectExistingOrNew(matches, opts) {
@@ -847,9 +893,29 @@ async function resolveCollision(targetLabel, credentialPair, opts) {
     })
   );
 }
-async function listTenantApps(apiBaseUrl, jwt, tenantId) {
+async function confirmRegister(opts, message, isUpdate) {
+  if (opts.yes) return "proceed";
+  return ensureContinue(
+    await p2.select({
+      message,
+      options: [
+        {
+          value: "proceed",
+          label: isUpdate ? "Update the app" : "Create the app"
+        },
+        {
+          value: "switch-org",
+          label: "Use a different organization",
+          hint: "sign in again and pick another org"
+        },
+        { value: "cancel", label: "Cancel" }
+      ]
+    })
+  );
+}
+async function listTenantApps(apiBaseUrl, jwt, tenantId, appServicePath = "app-service") {
   const res = await apiCall(
-    `${apiBaseUrl}/app-service/tenants/apps?onlyAppsOfTenant=true&returnAll=true`,
+    `${apiBaseUrl}/${appServicePath}/tenants/apps?onlyAppsOfTenant=true&returnAll=true`,
     {
       headers: {
         Authorization: `Bearer ${jwt}`,
@@ -868,24 +934,28 @@ async function listTenantApps(apiBaseUrl, jwt, tenantId) {
       technicalName,
       clientId: entry.clientId,
       provisioningStatus: entry.activeVersion?.provisioningStatus,
-      isInstalled: entry.isInstalled
+      isInstalled: entry.isInstalled,
+      publicClientId: entry.credentials?.publicClient?.clientId
     };
   }).filter((a) => a !== null);
 }
-async function updateAppManifest(apiBaseUrl, jwt, tenantId, appId, manifest) {
-  await apiCall(`${apiBaseUrl}/app-service/store/apps/${appId}/manifest`, {
-    method: "PUT",
-    headers: {
-      Authorization: `Bearer ${jwt}`,
-      "Content-Type": "application/json",
-      "X-Tenant-Id": tenantId
-    },
-    body: JSON.stringify({ manifest, tcAccepted: true })
-  });
+async function updateAppManifest(apiBaseUrl, jwt, tenantId, appId, manifest, appServicePath = "app-service") {
+  await apiCall(
+    `${apiBaseUrl}/${appServicePath}/store/apps/${appId}/manifest`,
+    {
+      method: "PUT",
+      headers: {
+        Authorization: `Bearer ${jwt}`,
+        "Content-Type": "application/json",
+        "X-Tenant-Id": tenantId
+      },
+      body: JSON.stringify({ manifest, tcAccepted: true })
+    }
+  );
 }
-async function createDraftApp(apiBaseUrl, jwt, tenantId, manifest) {
+async function createDraftApp(apiBaseUrl, jwt, tenantId, manifest, appServicePath = "app-service") {
   const created = await apiCall(
-    `${apiBaseUrl}/app-service/store/apps`,
+    `${apiBaseUrl}/${appServicePath}/store/apps`,
     {
       method: "POST",
       headers: {
@@ -906,9 +976,9 @@ async function createDraftApp(apiBaseUrl, jwt, tenantId, manifest) {
   }
   return created.id;
 }
-async function provisionApp(apiBaseUrl, jwt, tenantId, appId) {
+async function provisionApp(apiBaseUrl, jwt, tenantId, appId, appServicePath = "app-service") {
   const provisioned = await apiCall(
-    `${apiBaseUrl}/app-service/store/apps/${appId}/provision`,
+    `${apiBaseUrl}/${appServicePath}/store/apps/${appId}/provision`,
     {
       method: "PUT",
       headers: {
@@ -926,7 +996,11 @@ async function provisionApp(apiBaseUrl, jwt, tenantId, appId) {
       `provision response missing clientId or clientSecret: ${JSON.stringify(provisioned)}`
     );
   }
-  return { clientId, clientSecret };
+  return {
+    clientId,
+    clientSecret,
+    publicClientId: provisioned.credentials?.publicClient?.clientId
+  };
 }
 function credentialLabels(backend) {
   if (backend.kind === "node") {
@@ -967,7 +1041,12 @@ async function persistCredentials(backend, clientId, clientSecret, root, opts, c
     p2.outro(pc2.green("Done. Credentials printed above; file left untouched."));
     return;
   }
-  const written = writeBackendCredentials(backend, clientId, clientSecret);
+  const written = writeBackendCredentials(
+    backend,
+    clientId,
+    clientSecret,
+    opts.auth
+  );
   printHubLink(
     context.hub,
     context.tenantSlug,
@@ -985,15 +1064,16 @@ async function register(argv = [], runOpts = {}) {
   console.log();
   p2.intro(pc2.bgCyan(pc2.black(" register cloud app ")));
   const opts = resolveOptions(argv);
-  const backend = detectBackend(root);
+  const backend = fs2.existsSync(path2.join(root, "packages", "backend")) ? detectBackend(root) : null;
   p2.note(
     [
       `${pc2.dim("API")}        ${opts.api}`,
+      opts.appServicePath !== "app-service" ? `${pc2.dim("App svc")}    /${opts.appServicePath}` : null,
       `${pc2.dim("Auth")}       ${opts.auth}`,
       `${pc2.dim("Hub")}        ${opts.hub}`,
       `${pc2.dim("Client ID")}  ${opts.clientId}`,
       `${pc2.dim("Scope")}      ${opts.scope}`
-    ].join("\n"),
+    ].filter(Boolean).join("\n"),
     "Target"
   );
   const spinner4 = p2.spinner();
@@ -1010,114 +1090,198 @@ async function register(argv = [], runOpts = {}) {
   } catch (err) {
     bail(err.message);
   }
-  const identityJwt = jwt;
-  jwt = apiTokenFor(jwt);
-  spinner4.start("Fetching tenants");
-  let tenants;
-  try {
-    tenants = await fetchTenants(opts.api, identityJwt);
-    spinner4.stop(
-      `Found ${tenants.length} tenant${tenants.length === 1 ? "" : "s"}`
-    );
-  } catch (err) {
-    spinner4.stop("Failed to fetch tenants");
-    bail(err.message);
-  }
-  const tenant = await selectTenant(tenants, opts);
   const manifest = readManifest(path2.join(root, "app.json"));
   const summary = summarizeManifest(manifest);
-  spinner4.start("Looking for apps matching this manifest");
-  let matches;
-  try {
-    const apps = await listTenantApps(opts.api, jwt, tenant.id);
-    matches = apps.filter((a) => a.technicalName === summary.technicalName);
-    spinner4.stop(
-      `Found ${matches.length} app${matches.length === 1 ? "" : "s"} with technical name ${pc2.cyan(summary.technicalName)}`
-    );
-  } catch (err) {
-    spinner4.stop("Failed to look up tenant apps");
-    bail(err.message);
-  }
-  const existing = await selectExistingOrNew(matches, opts);
-  const reviewLines = [
-    `${pc2.dim("Technical name")}  ${summary.technicalName}`,
-    `${pc2.dim("Version")}         ${summary.version}`,
-    `${pc2.dim("Tenant")}          ${tenant.name} (${tenant.slug})`,
-    existing ? `${pc2.dim("Updating")}        ${existing.technicalName} (${existing.id}) [${existing.provisioningStatus ?? "?"}]` : `${pc2.dim("Action")}          create new`
-  ].filter(Boolean);
-  p2.note(reviewLines.join("\n"), "Review");
-  const confirmMessage = existing ? `Update app "${existing.technicalName}" in tenant "${tenant.name}"?` : `Create app "${summary.technicalName}" in tenant "${tenant.name}"?`;
-  const confirm2 = await confirmAction(opts, confirmMessage, existing !== null);
-  if (!confirm2) bail("Cancelled.");
-  if (existing) {
-    spinner4.start("Updating manifest");
+  for (; ; ) {
+    const identityJwt = jwt;
+    const apiJwt = apiTokenFor(jwt);
+    spinner4.start("Fetching tenants");
+    let tenants;
     try {
-      await updateAppManifest(opts.api, jwt, tenant.id, existing.id, manifest);
-      spinner4.stop("Manifest updated");
+      tenants = await fetchTenants(opts.api, identityJwt);
+      spinner4.stop(
+        `Found ${tenants.length} tenant${tenants.length === 1 ? "" : "s"}`
+      );
     } catch (err) {
-      spinner4.stop("Failed to update manifest");
+      spinner4.stop("Failed to fetch tenants");
       bail(err.message);
     }
-    printHubLink(
-      opts.hub,
-      tenant.slug,
-      existing.id,
-      existing.isInstalled ?? false
+    let tenant;
+    const scopedTenantId = opts.tenant ? void 0 : activeTenantId(decodeJwtClaims(identityJwt));
+    const scopedTenant = scopedTenantId ? tenants.find((t) => t.id === scopedTenantId) : void 0;
+    if (scopedTenant) {
+      tenant = scopedTenant;
+      p2.log.info(
+        `Organization ${pc2.cyan(tenant.name)} ${pc2.dim(`(${tenant.slug})`)} \u2014 selected at login`
+      );
+    } else {
+      tenant = await selectTenant(tenants, opts);
+    }
+    spinner4.start("Looking for apps matching this manifest");
+    let matches;
+    try {
+      const apps = await listTenantApps(
+        opts.api,
+        apiJwt,
+        tenant.id,
+        opts.appServicePath
+      );
+      matches = apps.filter((a) => a.technicalName === summary.technicalName);
+      spinner4.stop(
+        `Found ${matches.length} app${matches.length === 1 ? "" : "s"} with technical name ${pc2.cyan(summary.technicalName)}`
+      );
+    } catch (err) {
+      spinner4.stop("Failed to look up tenant apps");
+      bail(err.message);
+    }
+    const existing = await selectExistingOrNew(matches, opts);
+    const reviewLines = [
+      `${pc2.dim("Technical name")}  ${summary.technicalName}`,
+      `${pc2.dim("Version")}         ${summary.version}`,
+      `${pc2.dim("Tenant")}          ${tenant.name} (${tenant.slug})`,
+      existing ? `${pc2.dim("Updating")}        ${existing.technicalName} (${existing.id}) [${existing.provisioningStatus ?? "?"}]` : `${pc2.dim("Action")}          create new`
+    ].filter(Boolean);
+    p2.note(reviewLines.join("\n"), "Review");
+    const confirmMessage = existing ? `Update app "${existing.technicalName}" in tenant "${tenant.name}"?` : `Create app "${summary.technicalName}" in tenant "${tenant.name}"?`;
+    const decision = await confirmRegister(
+      opts,
+      confirmMessage,
+      existing !== null
     );
-    if (existing.clientId) {
-      const labels = credentialLabels(backend);
-      const envFile = backend.kind === "node" ? backend.envFile : backend.settingsFile;
-      const localCreds = readExistingCredentials(backend);
-      const hasLocalCreds = !!(localCreds.clientId && localCreds.clientSecret);
-      if (!hasLocalCreds) {
+    if (decision === "cancel") bail("Cancelled.");
+    if (decision === "switch-org") {
+      try {
+        jwt = await acquireAccessToken({
+          auth: opts.auth,
+          clientId: opts.clientId,
+          scope: opts.scope,
+          reauth: true,
+          // forces prompt=select_account so the user re-picks the organization
+          spinner: spinner4,
+          captureOptions: runOpts.captureOptions
+        });
+      } catch (err) {
+        bail(err.message);
+      }
+      continue;
+    }
+    if (existing) {
+      spinner4.start("Updating manifest");
+      try {
+        await updateAppManifest(
+          opts.api,
+          apiJwt,
+          tenant.id,
+          existing.id,
+          manifest,
+          opts.appServicePath
+        );
+        spinner4.stop("Manifest updated");
+      } catch (err) {
+        spinner4.stop("Failed to update manifest");
+        bail(err.message);
+      }
+      if (existing.publicClientId) {
+        const written = writeFrontendPublicClient(
+          root,
+          opts.auth,
+          existing.publicClientId
+        );
+        if (written) {
+          p2.log.success(
+            `Wrote VITE_JTL_CLIENT_ID/VITE_JTL_ISSUER to ${pc2.cyan(path2.relative(root, written))}.`
+          );
+        }
+      }
+      writeVerifyDemoEnv(root, backend);
+      printHubLink(
+        opts.hub,
+        tenant.slug,
+        existing.id,
+        existing.isInstalled ?? false
+      );
+      if (backend && existing.clientId) {
+        const labels = credentialLabels(backend);
+        const envFile = backend.kind === "node" ? backend.envFile : backend.settingsFile;
+        const localCreds = readExistingCredentials(backend);
+        const hasLocalCreds = !!(localCreds.clientId && localCreds.clientSecret);
+        if (!hasLocalCreds) {
+          p2.outro(
+            pc2.yellow(
+              `Manifest updated. Your backend config is missing ${labels.pair} \u2014 they can't be recovered. Re-create the app to get a fresh secret.`
+            )
+          );
+          return;
+        }
         p2.outro(
-          pc2.yellow(
-            `Manifest updated. Your backend config is missing ${labels.pair} \u2014 they can't be recovered. Re-create the app to get a fresh secret.`
+          pc2.green(
+            `Manifest updated. Existing ${labels.pair} in ${pc2.cyan(path2.relative(root, envFile))} kept as-is.`
           )
         );
-        return;
+      } else {
+        p2.outro(pc2.green("Manifest updated."));
       }
-      p2.outro(
-        pc2.green(
-          `Manifest updated. Existing ${labels.pair} in ${pc2.cyan(path2.relative(root, envFile))} kept as-is.`
-        )
+      return;
+    }
+    spinner4.start("Creating draft app");
+    let appId;
+    try {
+      appId = await createDraftApp(
+        opts.api,
+        apiJwt,
+        tenant.id,
+        manifest,
+        opts.appServicePath
       );
-    } else {
-      p2.outro(pc2.green("Manifest updated."));
+      spinner4.stop(`Created app ${pc2.cyan(appId)}`);
+    } catch (err) {
+      spinner4.stop("Failed to create app");
+      bail(err.message);
+    }
+    spinner4.start("Provisioning app");
+    let clientId;
+    let clientSecret;
+    let publicClientId;
+    try {
+      ({ clientId, clientSecret, publicClientId } = await provisionApp(
+        opts.api,
+        apiJwt,
+        tenant.id,
+        appId,
+        opts.appServicePath
+      ));
+      spinner4.stop("Provisioned");
+    } catch (err) {
+      spinner4.stop("Failed to provision app");
+      bail(err.message);
+    }
+    if (publicClientId) {
+      const written = writeFrontendPublicClient(
+        root,
+        opts.auth,
+        publicClientId
+      );
+      if (written) {
+        p2.log.success(
+          `Wrote VITE_JTL_CLIENT_ID/VITE_JTL_ISSUER to ${pc2.cyan(path2.relative(root, written))}.`
+        );
+      }
+    }
+    writeVerifyDemoEnv(root, backend);
+    if (backend) {
+      await persistCredentials(backend, clientId, clientSecret, root, opts, {
+        hub: opts.hub,
+        tenantSlug: tenant.slug,
+        appId,
+        // A freshly created app can't be installed yet.
+        isInstalled: false
+      });
+      return;
     }
+    printHubLink(opts.hub, tenant.slug, appId, false);
+    p2.outro(pc2.green("Done. App registered."));
     return;
   }
-  spinner4.start("Creating draft app");
-  let appId;
-  try {
-    appId = await createDraftApp(opts.api, jwt, tenant.id, manifest);
-    spinner4.stop(`Created app ${pc2.cyan(appId)}`);
-  } catch (err) {
-    spinner4.stop("Failed to create app");
-    bail(err.message);
-  }
-  spinner4.start("Provisioning app");
-  let clientId;
-  let clientSecret;
-  try {
-    ({ clientId, clientSecret } = await provisionApp(
-      opts.api,
-      jwt,
-      tenant.id,
-      appId
-    ));
-    spinner4.stop("Provisioned");
-  } catch (err) {
-    spinner4.stop("Failed to provision app");
-    bail(err.message);
-  }
-  await persistCredentials(backend, clientId, clientSecret, root, opts, {
-    hub: opts.hub,
-    tenantSlug: tenant.slug,
-    appId,
-    // A freshly created app can't be installed yet.
-    isInstalled: false
-  });
 }
 
 // src/listing.ts
@@ -1390,7 +1554,25 @@ async function listing(argv = [], runOpts = {}) {
 // src/scaffold.ts
 import crypto2 from "crypto";
 import fs4 from "fs";
+import net from "net";
 import path4 from "path";
+var DEFAULT_FRONTEND_PORT = 3004;
+var BACKEND_PORT = 3005;
+function isPortFree(port) {
+  return new Promise((resolve) => {
+    const server = net.createServer();
+    server.once("error", () => resolve(false));
+    server.once("listening", () => server.close(() => resolve(true)));
+    server.listen(port, "127.0.0.1");
+  });
+}
+async function pickFrontendPort() {
+  for (let port = DEFAULT_FRONTEND_PORT; port <= 3999; port++) {
+    if (port === BACKEND_PORT) continue;
+    if (await isPortFree(port)) return port;
+  }
+  return DEFAULT_FRONTEND_PORT;
+}
 function toPascalCase(kebab) {
   return kebab.split("-").map((part) => part.charAt(0).toUpperCase() + part.slice(1)).join("");
 }
@@ -1412,7 +1594,8 @@ function buildPlaceholders(opts) {
     "{{APP_NAME_PASCAL}}": toPascalCase(opts.appName),
     "{{APP_TECHNICAL_NAME}}": buildTechnicalName(opts.appName),
     "{{APP_DESCRIPTION}}": opts.description,
-    "{{APP_DESCRIPTION_SHORT}}": buildShortDescription(opts.description)
+    "{{APP_DESCRIPTION_SHORT}}": buildShortDescription(opts.description),
+    "{{FRONTEND_PORT}}": String(opts.frontendPort)
   };
 }
 function applyPlaceholders(content, replacements) {
@@ -1448,9 +1631,11 @@ function transformPackageJson(content, appName, templateType, replacements) {
   const result = applyPlaceholders(JSON.stringify(pkg, null, 2), replacements);
   return result + "\n";
 }
+var SKIP_DIRS = /* @__PURE__ */ new Set(["node_modules", "dist", ".turbo"]);
 function copyDir(src, dest, replacements, templateType, appName) {
   fs4.mkdirSync(dest, { recursive: true });
   for (const entry of fs4.readdirSync(src, { withFileTypes: true })) {
+    if (entry.isDirectory() && SKIP_DIRS.has(entry.name)) continue;
     const srcPath = path4.join(src, entry.name);
     let destName = entry.name;
     if (destName.startsWith("_git")) {
@@ -1485,40 +1670,87 @@ function buildReplacements(base, template) {
   }
   return { ...base, ...resolved };
 }
+function applyManifestAuthentication(appJsonPath, opts) {
+  const manifest = JSON.parse(fs4.readFileSync(appJsonPath, "utf-8"));
+  const { frontend, backend } = opts.authentication;
+  const authentication = {};
+  if (frontend) {
+    const origin = `http://localhost:${opts.frontendPort}`;
+    authentication.publicClient = {
+      redirectUris: [`${origin}/callback`],
+      postLogoutRedirectUris: [`${origin}/`]
+    };
+  }
+  if (backend) {
+    authentication.serviceAccount = {
+      clientCredentials: true,
+      description: `${opts.appName} backend service account`
+    };
+  }
+  manifest.authentication = authentication;
+  if (!frontend) {
+    delete manifest.lifecycle;
+    if (manifest.capabilities) {
+      delete manifest.capabilities.hub;
+      if (manifest.capabilities.erp) {
+        delete manifest.capabilities.erp.menuItems;
+        delete manifest.capabilities.erp.pane;
+      }
+    }
+  }
+  fs4.writeFileSync(appJsonPath, JSON.stringify(manifest, null, 2) + "\n");
+}
 async function scaffold({
   appName,
   description,
   backend,
   frontend,
   shared,
+  frontendPort = DEFAULT_FRONTEND_PORT,
+  authentication,
   targetDir: customTargetDir
 }) {
   const targetDir = customTargetDir ?? path4.resolve(process.cwd(), appName);
-  const baseReplacements = buildPlaceholders({ appName, description });
+  const baseReplacements = buildPlaceholders({
+    appName,
+    description,
+    frontendPort
+  });
   if (fs4.existsSync(targetDir)) {
     throw new Error(`Directory "${appName}" already exists`);
   }
   fs4.mkdirSync(targetDir, { recursive: true });
   copyDir(shared.dir, targetDir, baseReplacements);
-  const frontendDest = path4.join(targetDir, "packages", "frontend");
-  const frontendReplacements = buildReplacements(baseReplacements, frontend);
-  copyDir(
-    frontend.dir,
-    frontendDest,
-    frontendReplacements,
-    frontend.meta.type,
-    appName
-  );
-  const backendDest = path4.join(targetDir, "packages", "backend");
-  const backendReplacements = buildReplacements(baseReplacements, backend);
-  copyDir(
-    backend.dir,
-    backendDest,
-    backendReplacements,
-    backend.meta.type,
-    appName
-  );
-  const runtimeVersions = backend.meta.runtimeVersions ?? {};
+  if (frontend) {
+    const frontendDest = path4.join(targetDir, "packages", "frontend");
+    const frontendReplacements = buildReplacements(baseReplacements, frontend);
+    copyDir(
+      frontend.dir,
+      frontendDest,
+      frontendReplacements,
+      frontend.meta.type,
+      appName
+    );
+  }
+  if (backend) {
+    const backendDest = path4.join(targetDir, "packages", "backend");
+    const backendReplacements = buildReplacements(baseReplacements, backend);
+    copyDir(
+      backend.dir,
+      backendDest,
+      backendReplacements,
+      backend.meta.type,
+      appName
+    );
+  }
+  if (authentication) {
+    applyManifestAuthentication(path4.join(targetDir, "app.json"), {
+      appName,
+      frontendPort,
+      authentication
+    });
+  }
+  const runtimeVersions = backend?.meta.runtimeVersions ?? {};
   if (Object.keys(runtimeVersions).length > 0) {
     const toolVersions = Object.entries(runtimeVersions).map(([tool, version]) => `${tool} ${version}`).join("\n");
     fs4.writeFileSync(
@@ -1585,14 +1817,163 @@ function getTemplatesByType(templates, type) {
 }
 
 // src/posthog.ts
+import { randomUUID } from "crypto";
+import fs6 from "fs";
+import os2 from "os";
+import path6 from "path";
 import { PostHog } from "posthog-node";
 var TOKEN = "phc_SkFAxTIa4RUQxotci1Ftdw7xefZK2Ax0LEIGcl8zuD2";
+var CLI_VERSION = "0.5.2";
 var client = TOKEN ? new PostHog(TOKEN, { host: "https://e.jtl-cloud.com" }) : null;
+function telemetryDisabledByEnv() {
+  const dnt = process.env.DO_NOT_TRACK;
+  if (dnt && dnt !== "0" && dnt !== "false") return true;
+  const optOut = process.env.JTL_CLI_TELEMETRY;
+  if (optOut === "0" || optOut === "false") return true;
+  return false;
+}
+function telemetryClient() {
+  if (!client || telemetryDisabledByEnv()) return null;
+  return client;
+}
+function telemetryIdFile() {
+  return process.env.JTL_CLI_TELEMETRY_ID_FILE ?? path6.join(os2.homedir(), ".config", "jtl-cli", "telemetry.json");
+}
+var cachedId;
+function anonymousId() {
+  if (cachedId) return cachedId;
+  const file = telemetryIdFile();
+  try {
+    const parsed = JSON.parse(fs6.readFileSync(file, "utf8"));
+    if (typeof parsed?.anonymous_id === "string" && parsed.anonymous_id) {
+      cachedId = parsed.anonymous_id;
+      return parsed.anonymous_id;
+    }
+  } catch {
+  }
+  const id = randomUUID();
+  try {
+    fs6.mkdirSync(path6.dirname(file), { recursive: true });
+    fs6.writeFileSync(file, JSON.stringify({ anonymous_id: id }, null, 2));
+  } catch {
+  }
+  cachedId = id;
+  return id;
+}
+function baseProps() {
+  return {
+    cli_version: CLI_VERSION,
+    node_version: process.version,
+    os: process.platform,
+    arch: process.arch,
+    ci: Boolean(process.env.CI)
+  };
+}
+function captureCommand(command, properties = {}) {
+  const c = telemetryClient();
+  if (!c) return;
+  c.capture({
+    distinctId: anonymousId(),
+    event: "cli_command",
+    properties: { command, ...baseProps(), ...properties }
+  });
+}
+function captureError(error, properties = {}) {
+  const c = telemetryClient();
+  if (!c) return;
+  try {
+    c.captureException(error, anonymousId(), { ...baseProps(), ...properties });
+  } catch {
+  }
+}
 async function shutdownPostHog() {
   await client?.shutdown();
 }
 
 // src/index.ts
+var NONE = "__none__";
+function templateSelectOptions(templates) {
+  return templates.map((t) => ({
+    value: t.packageName,
+    label: t.meta.label ?? t.packageName,
+    hint: t.meta.hint
+  }));
+}
+function halfSelectOptions(templates, noneHint) {
+  return [
+    ...templateSelectOptions(templates),
+    { value: NONE, label: "None", hint: noneHint }
+  ];
+}
+function cancelScaffold() {
+  p4.cancel("Cancelled.");
+  process.exit(0);
+}
+async function runNextScaffold(backends, frontends, shared) {
+  const cancelOpts = { onCancel: cancelScaffold };
+  const answers = await p4.group(
+    {
+      appName: () => p4.text({
+        message: "App name",
+        placeholder: "my-jtl-app",
+        validate: (value) => {
+          if (!value) return "App name is required";
+          if (!/^[a-z0-9-]+$/.test(value))
+            return "Use lowercase letters, numbers, and hyphens only";
+        }
+      }),
+      description: () => p4.text({ message: "Description", placeholder: "A JTL Platform app" }),
+      frontend: () => p4.select({
+        message: "Frontend (adds a public client for browser login)",
+        options: halfSelectOptions(frontends, "no frontend")
+      }),
+      backend: () => p4.select({
+        message: "Backend (adds a service account for the JTL API)",
+        options: halfSelectOptions(backends, "no backend")
+      })
+    },
+    cancelOpts
+  );
+  const selectedFrontend = frontends.find(
+    (t) => t.packageName === answers.frontend
+  );
+  const selectedBackend = backends.find(
+    (t) => t.packageName === answers.backend
+  );
+  if (!selectedFrontend && !selectedBackend) {
+    p4.cancel("Pick at least a frontend or a backend.");
+    process.exit(1);
+  }
+  const s = p4.spinner();
+  s.start("Scaffolding project");
+  const frontendPort = selectedFrontend ? await pickFrontendPort() : void 0;
+  await scaffold({
+    appName: answers.appName,
+    description: answers.description || "A JTL Platform app",
+    backend: selectedBackend,
+    frontend: selectedFrontend,
+    shared,
+    frontendPort,
+    authentication: {
+      frontend: Boolean(selectedFrontend),
+      backend: Boolean(selectedBackend)
+    }
+  });
+  s.stop("Project scaffolded");
+  if (selectedFrontend) {
+    p4.note(
+      `The frontend dev server runs on ${pc4.cyan(`http://localhost:${frontendPort}`)}, and its ${pc4.cyan("/callback")} route is registered as the public client's redirect URI.`,
+      "Frontend login"
+    );
+  }
+  printNextSteps(answers.appName);
+  p4.outro(pc4.green("Done! Happy building."));
+  return {
+    next: true,
+    frontend: selectedFrontend ? selectedFrontend.meta.label ?? selectedFrontend.packageName : "none",
+    backend: selectedBackend ? selectedBackend.meta.label ?? selectedBackend.packageName : "none"
+  };
+}
 async function runScaffold() {
   console.log();
   p4.intro(pc4.bgCyan(pc4.black(" create-cloud-app ")));
@@ -1604,6 +1985,9 @@ async function runScaffold() {
     p4.cancel("No templates found. Ensure template packages are installed.");
     process.exit(1);
   }
+  if (process.argv.includes("--next")) {
+    return runNextScaffold(backends, frontends, shared);
+  }
   const answers = await p4.group(
     {
       appName: () => p4.text({
@@ -1621,19 +2005,11 @@ async function runScaffold() {
       }),
       backend: () => p4.select({
         message: "Backend",
-        options: backends.map((t) => ({
-          value: t.packageName,
-          label: t.meta.label ?? t.packageName,
-          hint: t.meta.hint
-        }))
+        options: templateSelectOptions(backends)
       }),
       frontend: () => p4.select({
         message: "Frontend",
-        options: frontends.map((t) => ({
-          value: t.packageName,
-          label: t.meta.label ?? t.packageName,
-          hint: t.meta.hint
-        }))
+        options: templateSelectOptions(frontends)
       })
     },
     {
@@ -1659,9 +2035,17 @@ async function runScaffold() {
     shared
   });
   s.stop("Project scaffolded");
+  printNextSteps(answers.appName);
+  p4.outro(pc4.green("Done! Happy building."));
+  return {
+    backend: selectedBackend.meta.label ?? selectedBackend.packageName,
+    frontend: selectedFrontend.meta.label ?? selectedFrontend.packageName
+  };
+}
+function printNextSteps(appName) {
   p4.note(
     [
-      `${pc4.cyan("cd")} ${answers.appName}`,
+      `${pc4.cyan("cd")} ${appName}`,
       `${pc4.cyan("npm install")}`,
       `${pc4.cyan("npm run register")}`,
       `${pc4.cyan("npm run dev")}`,
@@ -1669,18 +2053,34 @@ async function runScaffold() {
     ].join("\n"),
     "Next steps"
   );
-  p4.outro(pc4.green("Done! Happy building."));
 }
 async function main() {
-  if (process.argv[2] === "register") {
-    await register(process.argv.slice(3));
-    return;
-  }
-  if (process.argv[2] === "listing") {
-    await listing(process.argv.slice(3));
-    return;
+  const command = process.argv[2] === "register" ? "register" : process.argv[2] === "listing" ? "listing" : "scaffold";
+  const startedAt = Date.now();
+  try {
+    let detail = {};
+    if (command === "register") {
+      await register(process.argv.slice(3));
+    } else if (command === "listing") {
+      await listing(process.argv.slice(3));
+    } else {
+      detail = await runScaffold();
+    }
+    captureCommand(command, {
+      success: true,
+      duration_ms: Date.now() - startedAt,
+      ...detail
+    });
+  } catch (err) {
+    const bail2 = err instanceof BailError;
+    captureCommand(command, {
+      success: false,
+      duration_ms: Date.now() - startedAt,
+      outcome: bail2 ? "bailed" : "error"
+    });
+    if (!bail2) captureError(err, { command });
+    throw err;
   }
-  await runScaffold();
 }
 main().then(() => shutdownPostHog()).catch(async (err) => {
   await shutdownPostHog();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@jtl-software/create-cloud-app",
-  "version": "0.3.1",
+  "version": "0.5.2",
   "type": "module",
   "description": "CLI tool for scaffolding JTL Platform cloud apps",
   "bin": {
@@ -18,11 +18,11 @@
   },
   "dependencies": {
     "@clack/prompts": "^1.7.0",
-    "@jtl-software/cloud-app-template-backend-dotnet": "0.0.12",
-    "@jtl-software/cloud-app-template-backend-node": "0.0.15",
-    "@jtl-software/cloud-app-template-backend-php": "0.1.1",
-    "@jtl-software/cloud-app-template-frontend-react": "0.0.18",
-    "@jtl-software/cloud-app-template-shared": "0.1.1",
+    "@jtl-software/cloud-app-template-backend-dotnet": "0.0.13",
+    "@jtl-software/cloud-app-template-backend-node": "0.0.16",
+    "@jtl-software/cloud-app-template-backend-php": "0.1.3",
+    "@jtl-software/cloud-app-template-frontend-react": "0.1.2",
+    "@jtl-software/cloud-app-template-shared": "0.1.2",
     "picocolors": "^1.1.1",
     "posthog-node": "^5.48.1"
   },