@ofidj/generator-fidj 1.0.0 → 1.0.3

package/generators/app/templates/typescript/src/tokens.css

@@ -0,0 +1,56 @@
+/* The Fidj design system, v2 — every value the product paints with.
+ *
+ * This file is shared verbatim with fidj-app (src/theme/fidj-tokens.css), so a
+ * style change made here reaches Fidj, mleweb and every generated app at once.
+ * Keep it free of anything path-dependent: @font-face lives in fonts.css, and
+ * each consumer supplies its own. Nothing else in a stylesheet may introduce a
+ * literal colour, family or radius.
+ */
+
+:root {
+  /* Ink — the dark half of the split: brand panel, header, primary button. */
+  --fidj-ink: #14110f;
+  --fidj-ink-raised: #2a2521;
+  --fidj-ink-line: #38322c;
+  --fidj-ink-line-soft: #4a423b;
+  --fidj-on-ink: #f2eee9;
+  --fidj-on-ink-muted: #b6ada5;
+  --fidj-on-ink-faint: #8c847c;
+
+  /* Paper — the light half. */
+  --fidj-paper: #fbfaf8;
+  --fidj-surface: #ffffff;
+  --fidj-surface-sunk: #f5f1ec;
+  --fidj-surface-tint: #f2eee9;
+  --fidj-line: #e4ded7;
+  --fidj-line-soft: #ece7e1;
+  --fidj-line-strong: #dfd9d2;
+  --fidj-line-hover: #c9c1b8;
+  --fidj-text: #14110f;
+  --fidj-text-muted: #4a4540;
+  --fidj-text-faint: #6b655f;
+  --fidj-placeholder: #a8a099;
+
+  /* Accents. The red is the Fidj mark; it identifies the account and privacy
+   * provider, so it stays sparing — a dot, a rule, a hover. */
+  --fidj-accent: #d6342c;
+  --fidj-danger: #b8352c;
+  --fidj-danger-strong: #8c2a22;
+  --fidj-danger-tint: #fdf7f6;
+  --fidj-danger-line: #e8d9d6;
+  --fidj-ok: #3f7a4f;
+  --fidj-warn: #c07a1e;
+  --fidj-warn-tint: #fbf7f1;
+
+  --fidj-focus-ring: 0 0 0 3px rgb(20 17 15 / 0.07);
+  --fidj-overlay-shadow: 0 12px 32px rgb(20 17 15 / 0.18);
+
+  --fidj-font-sans: "IBM Plex Sans", system-ui, -apple-system, sans-serif;
+  --fidj-font-mono: "IBM Plex Mono", ui-monospace, SFMono-Regular, monospace;
+  --fidj-font-display: "Instrument Serif", Georgia, "Times New Roman", serif;
+
+  /* Squared corners are the loudest signal of this style: 2px everywhere, and
+   * a full round only for avatars and status dots. */
+  --fidj-radius: 2px;
+  --fidj-shell-max: 1180px;
+}

package/generators/app/templates/typescript/test/server.test.mjs

@@ -0,0 +1,287 @@
+import {execFile} from "node:child_process";
+import {promisify} from "node:util";
+import { test } from "node:test";
+import assert from "node:assert/strict";
+import { createServer } from "node:http";
+import { mkdtemp, rm, writeFile, readdir } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { createHmac } from "node:crypto";
+import { createRequire } from "node:module";
+const { createApp, DataStore } = createRequire(import.meta.url)(
+  "../dist/server.cjs",
+);
+const listen = (server) =>
+  new Promise((resolve) =>
+    server.listen(0, "127.0.0.1", () =>
+      resolve(`http://127.0.0.1:${server.address().port}`),
+    ),
+  );
+const close = (server) => new Promise((resolve) => server.close(resolve));
+const token = (subject, appId = "test-app") =>
+  `header.${Buffer.from(JSON.stringify({ sub: subject, name: subject + "@test.local", aud: appId, roles: ["Owner"] })).toString("base64url")}.signature`;
+
+test("enforces live app roles, identity isolation and scoped privacy over HTTP", async () => {
+  const directory = await mkdtemp(join(tmpdir(), "fidj-data-test-"));
+  const adapterKey = "test-only-privacy-adapter-secret-32-chars";
+  let appUrl;
+  const adapterCall = async (
+    operation,
+    subject,
+    requestId = "departure-maya",
+    overrides = {},
+  ) => {
+    const data = { operation, subject, appId: "test-app", requestId };
+    const timestamp = String(Date.now());
+    const signature = createHmac("sha256", adapterKey)
+      .update(timestamp + "." + JSON.stringify(data))
+      .digest("hex");
+    return fetch(appUrl + "/fidj/privacy", {
+      method: "POST",
+      headers: {
+        "Content-Type": "application/json",
+        "x-fidj-timestamp": timestamp,
+        "x-fidj-signature": signature,
+        ...overrides,
+      },
+      body: JSON.stringify(data),
+    });
+  };
+  const maya = token("maya");
+  const sam = token("sam");
+  const assignments = new Map([
+    [maya, ["Free"]],
+    [sam, ["Editor"]],
+  ]);
+  const consents = new Map();
+  let outage = false;
+  const issuer = createServer(async (req, res) => {
+    const bearer = req.headers.authorization?.slice(7);
+    const roles = assignments.get(bearer);
+    res.setHeader("Content-Type", "application/json");
+    if (outage) {
+      res.writeHead(503);
+      return res.end("{}");
+    }
+    if (!roles) {
+      res.writeHead(403);
+      return res.end("{}");
+    }
+    if (req.url === "/apps/test-app/me")
+      return res.end(
+        JSON.stringify({ roles: roles.map((type) => ({ type })) }),
+      );
+    if (req.url === "/me/apps/test-app/consents/history")
+      return res.end('{"history":[]}');
+    if (req.url === "/me/apps/test-app/consents") {
+      if (req.method === "PUT") {
+        let text = "";
+        for await (const chunk of req) text += chunk;
+        consents.set(bearer, JSON.parse(text));
+      }
+      return res.end(
+        JSON.stringify({
+          ...(consents.get(bearer) || { terms: true }),
+          appDataConnected: true,
+        }),
+      );
+    }
+    if (req.url === "/me/apps/test-app/export")
+      return res.end(JSON.stringify({ consent: consents.get(bearer) }));
+    if (req.url === "/me/apps/test-app" && req.method === "DELETE") {
+      const erased = await adapterCall(
+        "erase",
+        JSON.parse(Buffer.from(bearer.split(".")[1], "base64url")).sub,
+      );
+      if (!erased.ok) {
+        res.writeHead(202);
+        return res.end('{"status":"pending"}');
+      }
+      assignments.delete(bearer);
+      return res.end('{"status":"completed"}');
+    }
+    res.writeHead(404);
+    res.end("{}");
+  });
+  const apiEndpoint = await listen(issuer);
+  const settings = {
+    appId: "test-app",
+    apiEndpoint,
+    dashboardUrl: "https://fidj.ovh",
+    title: "Test app",
+    localDemo: false,
+  };
+  const persistence = new DataStore(directory, "test-app");
+  const erase = persistence.erase.bind(persistence);
+  let storageUnavailable = false;
+  persistence.erase = async (...args) => {
+    if (storageUnavailable) throw new Error("Simulated storage outage");
+    return erase(...args);
+  };
+  let app = createApp(settings, {
+    dataDir: directory,
+    adapterKey,
+    store: persistence,
+  });
+  let url = await listen(app);
+  appUrl = url;
+  const call = (path, bearer = maya, method = "GET", data) =>
+    fetch(url + "/api/" + path, {
+      method,
+      headers: {
+        Authorization: "Bearer " + bearer,
+        "Content-Type": "application/json",
+      },
+      body: data === undefined ? undefined : JSON.stringify(data),
+    });
+  try {
+    assert.equal((await fetch(url + "/api/notes")).status, 401);
+    assert.equal(
+      (await call("session", token("maya", "other-app"))).status,
+      401,
+    );
+    assert.equal((await call("session", maya + "tampered")).status, 401);
+    assert.equal(
+      (await call("notes", maya, "POST", { title: "Hello", body: "Private" }))
+        .status,
+      403,
+    );
+    assignments.set(maya, ["Editor"]);
+    assert.equal(
+      (await call("notes", maya, "POST", { title: "Hello", body: "Private" }))
+        .status,
+      201,
+    );
+    assert.equal((await (await call("notes", sam)).json()).notes.length, 0);
+    assert.equal((await (await call("notes")).json()).notes.length, 1);
+    await call("notes", sam, "POST", { title: "Sam only", body: "Preserve" });
+    await close(app);
+    app = createApp(settings, {
+      dataDir: directory,
+      adapterKey,
+      store: persistence,
+    });
+    url = await listen(app);
+    appUrl = url;
+    assert.equal((await (await call("notes")).json()).notes[0].title, "Hello");
+    assert.equal(
+      (
+        await adapterCall("export", "maya", "export-test", {
+          "x-fidj-signature": "0".repeat(64),
+        })
+      ).status,
+      401,
+    );
+    assert.equal(
+      (
+        await adapterCall("export", "maya", "export-test", {
+          "x-fidj-timestamp": "1",
+        })
+      ).status,
+      401,
+    );
+    assert.equal(
+      (await (await adapterCall("export", "maya", "export-test")).json()).data
+        .notes.length,
+      1,
+    );
+    assert.equal(
+      (await (await adapterCall("export", "sam", "export-sam")).json()).data
+        .notes.length,
+      1,
+    );
+    assert.equal((await fetch(url + "/.fidj-data/data.json")).status, 404);
+    const readiness = await (await adapterCall("check", "readiness-check", "check-test")).json();
+    assert.equal(readiness.storage, "ready");
+    assert.deepEqual(readiness.capabilities, ["export", "erase"]);
+    const checked = await promisify(execFile)(process.execPath, ["scripts/privacy-check.mjs"], {env: {...process.env, FIDJ_APP_ID: "test-app", FIDJ_APP_URL: url, FIDJ_PRIVACY_ADAPTER_KEY: adapterKey}});
+    assert.match(checked.stdout, /Ready:/);
+    await assert.rejects(promisify(execFile)(process.execPath, ["scripts/privacy-check.mjs"], {env: {...process.env, FIDJ_APP_ID: "test-app", FIDJ_APP_URL: url, FIDJ_PRIVACY_ADAPTER_KEY: "wrong-key-that-is-long-enough-for-check"}}));
+    assert.equal(
+      (await (await fetch(url + "/api/config")).json()).adapterKey,
+      undefined,
+    );
+    assignments.set(maya, ["Free"]);
+    assert.equal(
+      (await call("notes", maya, "POST", { title: "Denied", body: "" })).status,
+      403,
+    );
+    assert.equal(
+      (await call("privacy", maya, "PUT", { analytics: true })).status,
+      200,
+    );
+    assert.equal(consents.get(maya).analytics, true);
+    assert.equal(consents.has(sam), false);
+    assert.equal(
+      (await (await call("privacy/export")).json()).app.notes.length,
+      1,
+    );
+    outage = true;
+    assert.equal((await call("notes")).status, 503);
+    outage = false;
+    assert.equal(
+      (await call("privacy/leave", maya, "DELETE", { confirm: "other-app" }))
+        .status,
+      400,
+    );
+    storageUnavailable = true;
+    assert.equal((await adapterCall("erase", "maya")).status, 500);
+    assert.equal((await (await call("notes")).json()).notes.length, 1);
+    storageUnavailable = false;
+    await writeFile(
+      join(directory, "aaaaaaaa-aaaa-aaaa-aaaa-aaaaaaaaaaaa.tmp"),
+      "Interrupted private data copy",
+    );
+    assert.equal(
+      (await call("privacy/leave", maya, "DELETE", { confirm: "test-app" }))
+        .status,
+      200,
+    );
+    assert.equal((await call("notes")).status, 401);
+    assert.equal(
+      (await readdir(directory)).filter((name) => name.endsWith(".tmp")).length,
+      0,
+    );
+    assignments.set(maya, ["Free"]);
+    assert.equal((await (await call("notes")).json()).notes.length, 0);
+    assert.equal((await call("session", sam)).status, 200);
+    assert.equal(
+      (await (await call("notes", sam)).json()).notes[0].title,
+      "Sam only",
+    );
+    assignments.set(maya, ["Editor"]);
+    await call("notes", maya, "POST", {
+      title: "New membership",
+      body: "Keep this",
+    });
+    await close(app);
+    app = createApp(settings, {
+      dataDir: directory,
+      adapterKey,
+      store: persistence,
+    });
+    url = await listen(app);
+    appUrl = url;
+    assert.equal((await adapterCall("erase", "maya")).status, 200);
+    assert.equal(
+      (await (await call("notes")).json()).notes[0].title,
+      "New membership",
+    );
+    assert.equal((await adapterCall("erase", "sam")).status, 500);
+    const store = new DataStore(directory, "test-app");
+    await assert.rejects(
+      store.add(
+        "maya",
+        { id: "denied", title: "Race", body: "", createdAt: "" },
+        async () => {
+          throw new Error("Revoked during operation");
+        },
+      ),
+    );
+    assert.equal((await store.notes("maya")).length, 1);
+  } finally {
+    await close(app);
+    await close(issuer);
+    await rm(directory, { recursive: true, force: true });
+  }
+});

package/generators/app/templates/typescript/tsconfig.json

@@ -0,0 +1,15 @@
+{
+  "compilerOptions": {
+    "target": "ES2022",
+    "module": "ESNext",
+    "moduleResolution": "Bundler",
+    "strict": true,
+    "esModuleInterop": true,
+    "skipLibCheck": true,
+    "lib": ["ES2022", "DOM"],
+    "types": ["node"],
+    "noEmit": true,
+    "resolveJsonModule": true
+  },
+  "include": ["src/**/*.ts", "server/**/*.ts"]
+}

package/lib/app-module.cjs

@@ -0,0 +1,64 @@
+const fs = require("node:fs");
+const path = require("node:path");
+
+function inspectModule(source, entry = "index.html", destination) {
+  const root = fs.realpathSync(path.resolve(source));
+  const output = path.resolve(destination);
+  if (!fs.statSync(root).isDirectory())
+    throw new Error("Module must be a built website directory.");
+  if (
+    output === root ||
+    output.startsWith(root + path.sep) ||
+    root.startsWith(output + path.sep)
+  )
+    throw new Error(
+      "Module source and generated destination must not contain each other.",
+    );
+  if (/^(?:[a-z]+:|\/\/)/i.test(entry))
+    throw new Error("Module entry must be relative.");
+  const url = new URL(entry, "https://module.invalid/module/");
+  if (
+    url.origin !== "https://module.invalid" ||
+    !url.pathname.startsWith("/module/") ||
+    url.search ||
+    entry.startsWith("/")
+  )
+    throw new Error(
+      "Module entry must be a relative HTML path inside the module.",
+    );
+  const file = decodeURIComponent(url.pathname.slice("/module/".length));
+  if (
+    !file.endsWith(".html") ||
+    file.split("/").some((part) => part === "..") ||
+    file.includes("\\")
+  )
+    throw new Error(
+      "Module entry must be a relative HTML path inside the module.",
+    );
+  if (!fs.statSync(path.join(root, file)).isFile())
+    throw new Error("Module entry does not exist.");
+  if (!fs.readFileSync(path.join(root, file), "utf8").includes("</head>"))
+    throw new Error("Module entry must have an HTML head.");
+  const visit = (directory) => {
+    for (const item of fs.readdirSync(directory, { withFileTypes: true })) {
+      if (item.isSymbolicLink())
+        throw new Error("Built modules must not contain symbolic links.");
+      if (
+        [".git", "node_modules", ".env"].includes(item.name) ||
+        item.name.startsWith(".env.")
+      )
+        throw new Error(
+          "Supply only the module's public build output, without environment or dependency files.",
+        );
+      if (item.isDirectory()) visit(path.join(directory, item.name));
+    }
+  };
+  visit(root);
+  // Address a directory rather than its index file: the generated server and
+  // any static host resolve it, and no index.html shows up in the address bar.
+  const address = file.endsWith("index.html")
+    ? file.slice(0, -"index.html".length)
+    : file;
+  return { root, file, entry: "./module/" + address + url.hash };
+}
+module.exports = { inspectModule };

package/lib/scaffold.cjs

@@ -0,0 +1,214 @@
+const fs = require("node:fs");
+const path = require("node:path");
+const { inspectModule } = require("./app-module.cjs");
+const templateRoot = path.join(
+  __dirname,
+  "../generators/app/templates/typescript",
+);
+
+function scaffold(destination, options) {
+  const anonymous = options.anonymous ?? true;
+  if (![true, false, "true", "false"].includes(anonymous))
+    throw new Error("--anonymous must be true or false.");
+  const name = options.name || path.basename(path.resolve(destination));
+  if (!/^[a-z0-9][a-z0-9-]{0,63}$/.test(name))
+    throw new Error(
+      "Use a lowercase project name with letters, numbers and hyphens.",
+    );
+  if (!/^[a-zA-Z0-9_-]+$/.test(options.appId || ""))
+    throw new Error("Supply your app’s public fidjId with --app-id.");
+  const api = new URL(options.apiEndpoint || "https://api.sandbox.fidj.ovh/v3");
+  if (
+    api.username ||
+    api.password ||
+    api.search ||
+    api.hash ||
+    !["http:", "https:"].includes(api.protocol)
+  )
+    throw new Error(
+      "Use an API URL without credentials, a query or a fragment.",
+    );
+  if (
+    api.protocol === "http:" &&
+    !["localhost", "127.0.0.1", "[::1]"].includes(api.hostname)
+  )
+    throw new Error("Use HTTPS for a remote API.");
+  if (options.oidcIssuer) {
+    const issuer = new URL(options.oidcIssuer);
+    if (issuer.origin !== api.origin || issuer.pathname !== "/oidc" || issuer.hash || issuer.search || issuer.username || issuer.password) throw new Error("OIDC issuer must share the API origin and use /oidc.");
+    if (options.content === undefined && !options.module) throw new Error("OIDC currently requires a content app or console module.");
+  }
+  const title = options.title || name;
+  if (/[\r\n]/.test(title)) throw new Error("Title must be one line.");
+  // Sign-in highlights are the app's own selling points, so they are supplied
+  // per app rather than baked in: an app that passes none simply shows none.
+  const highlights = (options.highlights || []).map((entry) => {
+    const [heading, ...rest] = String(entry).split("|");
+    const body = rest.join("|").trim();
+    if (!heading.trim() || !body)
+      throw new Error('Each --highlight must read "<heading>|<body>".');
+    if (/[\r\n]/.test(entry)) throw new Error("A highlight must be one line.");
+    return { heading: heading.trim(), body };
+  });
+  if (highlights.length > 6)
+    throw new Error("Six highlights is the most the sign-in panel can hold.");
+  // Trust badges are claims about a specific app — where it is hosted, what it
+  // audits. None are supplied by default, because an app cannot inherit them.
+  const badges = (options.badges || []).map((entry) => {
+    const text = String(entry).trim();
+    if (!text || /[\r\n]/.test(text))
+      throw new Error("Each --badge must be one line of text.");
+    if (text.length > 40)
+      throw new Error("A badge must be at most 40 characters.");
+    return text;
+  });
+  if (badges.length > 4)
+    throw new Error("Four badges is the most the sign-in footer can hold.");
+  if (
+    options.domain &&
+    !/^(?:[a-z0-9](?:[a-z0-9-]*[a-z0-9])?\.)+[a-z]{2,}$/i.test(options.domain)
+  )
+    throw new Error("Domain must be a hostname, without a scheme or path.");
+  const brandImage = (value, flag) => {
+    if (!value) return null;
+    const source = path.resolve(value);
+    if (!fs.existsSync(source) || !fs.statSync(source).isFile())
+      throw new Error(`${flag} must point at an image file.`);
+    const extension = path.extname(source).toLowerCase();
+    if (
+      ![".png", ".svg", ".gif", ".jpg", ".jpeg", ".webp", ".ico"].includes(
+        extension,
+      )
+    )
+      throw new Error(
+        `${flag} must be a .png, .svg, .gif, .jpg, .webp or .ico file.`,
+      );
+    if (fs.statSync(source).size > 512 * 1024)
+      throw new Error(`${flag} must be under 512KB; it is served on every visit.`);
+    return { source, extension };
+  };
+  const logo = brandImage(options.logo, "--logo");
+  const favicon = brandImage(options.favicon, "--favicon");
+  const dir = path.resolve(destination);
+  const appModule = options.module
+    ? inspectModule(options.module, options.moduleEntry, dir)
+    : null;
+  if (options.moduleEntry && !appModule)
+    throw new Error("--module-entry requires --module.");
+  if (options.replace && fs.existsSync(dir)) {
+    if (!fs.existsSync(path.join(dir, ".fidj-generated")))
+      throw new Error(
+        "Replacement requires a .fidj-generated marker in the destination.",
+      );
+    fs.rmSync(dir, { recursive: true });
+  }
+  if (fs.existsSync(dir) && fs.readdirSync(dir).length)
+    throw new Error(
+      "Destination must be empty. Existing projects are never overwritten.",
+    );
+  fs.mkdirSync(dir, { recursive: true });
+  fs.cpSync(templateRoot, dir, { recursive: true });
+  const pkg = JSON.parse(
+    fs.readFileSync(path.join(dir, "package.json"), "utf8"),
+  );
+  pkg.name = name;
+  if (options.sdkPath) {
+    const sdkPath = path.resolve(options.sdkPath);
+    const sdk = JSON.parse(
+      fs.readFileSync(path.join(sdkPath, "package.json"), "utf8"),
+    );
+    if (sdk.name !== "@ofidj/node")
+      throw new Error("SDK path must contain a built @ofidj/node package.");
+    pkg.dependencies["@ofidj/node"] = "file:" + sdkPath;
+  }
+  fs.writeFileSync(
+    path.join(dir, "package.json"),
+    JSON.stringify(pkg, null, 2) + "\n",
+  );
+  fs.renameSync(path.join(dir, "gitignore"), path.join(dir, ".gitignore"));
+  const settings = `FIDJ_APP_ID=${options.appId}\nFIDJ_API_ENDPOINT=${api.href.replace(/\/$/, "")}\nFIDJ_DASHBOARD_URL=https://fidj.ovh\nAPP_TITLE=${title}\nPORT=8200\nHOST=127.0.0.1\nLOCAL_DEMO=false\nFIDJ_DATA_DIR=../.fidj-data/${name}\nFIDJ_PRIVACY_ADAPTER_KEY=\n`;
+  const localApi = options.local
+    ? "http://localhost:3201/v3"
+    : api.href.replace(/\/$/, "");
+  const configuration = {
+    appId: options.appId,
+    oidcIssuer: options.oidcIssuer || null,
+    apiEndpoint: localApi,
+    dashboardUrl: options.local ? "http://localhost:4200" : "https://fidj.ovh",
+    title,
+    localDemo: Boolean(options.local),
+    allowAnonymous: anonymous === true || anonymous === "true",
+    welcome: options.welcome || title,
+    description:
+      options.description ||
+      "A space to explore, with an account that puts you in control.",
+    content: appModule ? "" : options.content,
+    highlights,
+    badges,
+    // An app that supplies no mark of its own borrows Fidj's, so the sign-in
+    // and the browser tab are never blank.
+    logo: logo ? "./brand/logo" + logo.extension : "./fidj-logo.png",
+    favicon: favicon ? "./brand/favicon" + favicon.extension : "./fidj-logo.png",
+    moduleEntry: appModule?.entry || "",
+    domain: options.domain,
+  };
+  if (logo || favicon) fs.mkdirSync(path.join(dir, "public/brand"), { recursive: true });
+  if (logo)
+    fs.copyFileSync(logo.source, path.join(dir, "public/brand/logo" + logo.extension));
+  if (favicon)
+    fs.copyFileSync(favicon.source, path.join(dir, "public/brand/favicon" + favicon.extension));
+  if (favicon) {
+    // The workspace starter serves a static index.html rather than rendering
+    // one, so its icon is rewritten here.
+    const page = path.join(dir, "public/index.html");
+    fs.writeFileSync(
+      page,
+      fs
+        .readFileSync(page, "utf8")
+        .replace('href="/fidj-logo.png"', `href="/brand/favicon${favicon.extension}"`),
+    );
+  }
+  if (appModule) {
+    fs.cpSync(appModule.root, path.join(dir, "public/module"), {
+      recursive: true,
+    });
+    const entryFile = path.join(dir, "public/module", appModule.file);
+    // Point back at the shell's directory, not at its index file, for the same
+    // reason the module entry does: no index.html in the address bar.
+    const toRoot =
+      path.posix.relative(
+        path.posix.dirname("module/" + appModule.file),
+        ".",
+      ) || ".";
+    const relativeSignin = toRoot + "/#/signin";
+    const html = fs.readFileSync(entryFile, "utf8");
+    if (!html.includes("</head>"))
+      throw new Error("Module entry must have an HTML head.");
+    fs.writeFileSync(
+      entryFile,
+      html.replace(
+        "</head>",
+        `<meta name="fidj-signin" content="${relativeSignin}"></head>`,
+      ),
+    );
+  }
+  fs.writeFileSync(
+    path.join(dir, "app.config.json"),
+    JSON.stringify(configuration, null, 2) + "\n",
+  );
+  const env = settings
+    .replace(api.href.replace(/\/$/, ""), localApi)
+    .replace(
+      "FIDJ_DASHBOARD_URL=https://fidj.ovh",
+      `FIDJ_DASHBOARD_URL=${configuration.dashboardUrl}`,
+    )
+    .replace("LOCAL_DEMO=false", `LOCAL_DEMO=${configuration.localDemo}`);
+  fs.writeFileSync(path.join(dir, ".env.example"), env);
+  fs.writeFileSync(path.join(dir, ".env"), env);
+  fs.writeFileSync(
+    path.join(dir, ".fidj-generated"),
+    "Disposable generator output.\n",
+  );
+  return dir;
+}
+module.exports = { scaffold };