@vevedh/create-feathers-app 0.0.0-stage → 0.1.0-rc.1

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 vite-plugin-feathersjs contributors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -1,3 +1,43 @@
-# Temporary Holding Version
+# create-feathers-app
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+Create local FeathersJS v5 applications with Vue 3, Pinia and Vite. Choose Quasar 2 or Tailwind CSS + daisyUI.
+
+This package is a separate command-line tool. The runtime integration is published as [`@vevedh/vite-plugin-feathersjs`](https://www.npmjs.com/package/@vevedh/vite-plugin-feathersjs).
+
+## Usage
+
+```powershell
+npm exec --package @vevedh/create-feathers-app -- create-feathers-app portail --ui quasar2 --render spa --adapter koa --transport rest
+```
+
+After npm publication, `npm create @vevedh/feathers-app@latest portail -- --ui daisyui --render ssr` can be used (depending on npm's argument forwarding).
+
+For a local candidate, run `node bin/create-feathers-app.mjs --help` from this package.
+
+| UI | SPA | SSR | SSG |
+| --- | --- | --- | --- |
+| Quasar 2 | Yes | R16 standalone example only | Unsupported on certified CLI |
+| daisyUI 5 | Yes | Yes | Yes |
+
+Generated projects include an independent Feathers REST API (`health`, `notes`), Koa or Express, Pinia, a `.env.example` and a `dev:all` command. Socket.IO is optional for the SPA variants only.
+
+## Options
+
+`--name`, `--dir`, `--ui`, `--render`, `--adapter`, `--transport`, `--dry-run`, `--json`, `--help`, `--version`.
+
+## Windows development
+
+```powershell
+corepack pnpm install
+corepack pnpm run dev:all
+corepack pnpm run typecheck
+corepack pnpm run build
+```
+
+Generated apps are local demonstrations with an in-memory notes service and no authentication. Do not expose them directly on the Internet.
+
+The CLI does not generate OAuth/JWT, persistent databases, PWA or Quasar SSR/SSG yet.
+
+## Documentation
+
+A complete French VitePress guide is included in the companion repository under `docs/cli` (installation, rendering modes, Windows, Feathers services, security and publishing). The documentation site is built and hosted separately from this npm package.

package/bin/create-feathers-app.mjs

@@ -0,0 +1,33 @@
+#!/usr/bin/env node
+import { dirname,resolve } from 'node:path'
+import { fileURLToPath } from 'node:url'
+import { readFile } from 'node:fs/promises'
+import { createGenerator } from '../lib/scaffold.mjs'
+const packageRoot=resolve(dirname(fileURLToPath(import.meta.url)),'..')
+const {version}=JSON.parse(await readFile(resolve(packageRoot,'package.json'),'utf8'))
+const args=process.argv.slice(2)
+if(args.includes('--help')||args.includes('-h')||!args.length){
+  console.log(`create-feathers-app ${version}
+
+Usage: create-feathers-app <name> [options]
+  --name <name>       Project name (alternative to positional name)
+  --dir <directory>   Safe folder name (within current directory)
+  --ui <quasar2|daisyui>  Default daisyui
+  --render <spa|ssr|ssg>  Default spa
+  --adapter <koa|express>  Default koa
+  --transport <rest|both>  Default rest (both only for SPA)
+  --dry-run           Preview files without writing
+  --json              Machine-readable output
+  --version           Print CLI version
+
+Available: Quasar 2 SPA; daisyUI SPA, SSR, SSG.
+Quasar SSR: certified example in the companion repository; Quasar SSG not supported.`)
+}else if(args.includes('--version')||args.includes('-v'))console.log(version)
+else {
+  const {parse,generate}=createGenerator({outputRoot:process.cwd(),templatesRoot:resolve(packageRoot,'templates'),reportRoot:process.cwd()})
+  try {
+    const options=parse(args)
+    const result=await generate(options)
+    console.log(options.json?JSON.stringify(result,null,2):`${options.dryRun?'DRY RUN':'CREATED'}: ${result.destination} (${result.files.length} files)`)
+  } catch(error){console.error(`FAIL: ${error.message}`);process.exitCode=1}
+}

package/lib/planner/options.mjs

@@ -0,0 +1,74 @@
+/** Candidate options for a future scaffolding CLI. No files or runtime services
+ * are generated by this read-only planner. Keep mappings reviewable and explicit.
+ */
+export const UI_PRESETS = Object.freeze(['quasar2', 'daisyui', 'daisyui-kit'])
+export const SCHEMA_PRESETS = Object.freeze(['typebox', 'json', 'zod'])
+export const AUTH_PRESETS = Object.freeze(['none', 'jwt', 'local', 'oauth', 'oidc', 'ldap'])
+export const DATABASE_PRESETS = Object.freeze(['memory', 'mongodb', 'postgresql', 'mariadb', 'mysql', 'sqlite'])
+export const RENDER_PRESETS = Object.freeze(['spa', 'ssr', 'ssg'])
+export const RENDER_ENGINES = Object.freeze(['auto', 'vite', 'quasar-cli-vite'])
+export const TRANSPORT_PRESETS = Object.freeze(['rest', 'socketio', 'both'])
+export const NAME_PATTERN = /^[a-z][a-z0-9]*(?:-[a-z0-9]+)*$/
+
+const AVAILABLE_OPTIONS = new Set(['--name', '--ui', '--render', '--pwa', '--schema', '--auth', '--db', '--primary', '--transport', '--engine', '--dry-run', '--json', '--help'])
+
+function requiredChoice(value, choices, name) {
+  if (!choices.includes(value)) throw new Error(`Invalid ${name}: expected ${choices.join('|')}`)
+  return value
+}
+function parseUniqueCsv(value, name) {
+  if (typeof value !== 'string' || !value || value.length > 512) throw new Error(`Invalid ${name}`)
+  const parts = value.split(',')
+  if (!parts.length || parts.some(part => !part || part !== part.trim()) || new Set(parts).size !== parts.length) throw new Error(`Invalid or duplicate ${name}`)
+  return parts
+}
+export function parsePlanArguments(args) {
+  if (args.includes('--help') || args.includes('-h')) return { help: true }
+  const options = { name: 'my-feathers-app', ui: 'daisyui', render: 'spa', pwa: 'off', schema: 'typebox', auth: 'none', db: 'main:memory', primary: 'main', transport: 'rest', engine: 'auto', dryRun: true, json: false }
+  const seen = new Set()
+  for (let index = 0; index < args.length; index++) {
+    const flag = args[index]
+    if (!AVAILABLE_OPTIONS.has(flag) || flag === '--help' || seen.has(flag)) throw new Error(`Unknown or duplicate option: ${flag}`)
+    seen.add(flag)
+    if (flag === '--dry-run' || flag === '--json') options[flag === '--dry-run' ? 'dryRun' : 'json'] = true
+    else {
+      const value = args[++index]
+      if (!value || value.startsWith('--')) throw new Error(`Missing value for ${flag}`)
+      options[flag.slice(2)] = value
+    }
+  }
+  return options
+}
+export function normalizePlanOptions(input) {
+  const name = input.name ?? 'my-feathers-app'
+  if (typeof name !== 'string' || name.length > 48 || !NAME_PATTERN.test(name)) throw new Error('Invalid --name: lowercase kebab-case, maximum 48 characters')
+  const ui = requiredChoice(input.ui ?? 'daisyui', UI_PRESETS, '--ui')
+  const render = requiredChoice(input.render ?? 'spa', RENDER_PRESETS, '--render')
+  const pwa = requiredChoice(input.pwa ?? 'off', ['on', 'off'], '--pwa')
+  const schema = requiredChoice(input.schema ?? 'typebox', SCHEMA_PRESETS, '--schema')
+  const transport = requiredChoice(input.transport ?? 'rest', TRANSPORT_PRESETS, '--transport')
+  const requestedEngine = requiredChoice(input.engine ?? 'auto', RENDER_ENGINES, '--engine')
+  // Quasar Vite plugin works in SPA; Quasar CLI with Vite is a separate toolchain
+  // required for SSR/SSG. Neither integrates this Feathers plugin automatically.
+  const engine = requestedEngine === 'auto'
+    ? (ui === 'quasar2' && render !== 'spa' ? 'quasar-cli-vite' : 'vite')
+    : requestedEngine
+  if (ui !== 'quasar2' && engine === 'quasar-cli-vite') throw new Error('Quasar CLI is only compatible with --ui quasar2')
+  if (ui === 'quasar2' && render !== 'spa' && engine === 'vite') throw new Error('Quasar standalone Vite plugin supports SPA only; select --engine quasar-cli-vite for SSR/SSG')
+  const auth = parseUniqueCsv(input.auth ?? 'none', '--auth')
+  for (const strategy of auth) requiredChoice(strategy, AUTH_PRESETS, '--auth')
+  if (auth.includes('none') && auth.length > 1) throw new Error('Cannot combine --auth none with authentication strategies')
+  // AuthenticationService issues JWTs for the standard local and OAuth flows.
+  if (auth.some(strategy => ['local', 'oauth'].includes(strategy)) && !auth.includes('jwt')) auth.unshift('jwt')
+  const databases = parseUniqueCsv(input.db ?? 'main:memory', '--db').map(spec => {
+    const match = /^([a-z][a-z0-9-]{0,31}):([a-z]+)$/.exec(spec)
+    if (!match) throw new Error('Invalid --db: use alias:adapter[,alias:adapter]')
+    const [, alias, adapter] = match
+    requiredChoice(adapter, DATABASE_PRESETS, '--db adapter')
+    return { alias, adapter }
+  })
+  if (new Set(databases.map(db => db.alias)).size !== databases.length) throw new Error('Duplicate database connection alias')
+  const primary = input.primary ?? 'main'
+  if (!databases.some(db => db.alias === primary)) throw new Error('--primary must match a --db alias')
+  return { name, ui, render, engine, pwa, schema, transport, auth, databases, primary, dryRun: true, json: Boolean(input.json) }
+}

package/lib/planner/plan.mjs

@@ -0,0 +1,107 @@
+import { normalizePlanOptions } from './options.mjs'
+
+const DATABASE_PACKAGES = {
+  memory: ['@feathersjs/memory'],
+  mongodb: ['@feathersjs/mongodb', 'mongodb'],
+  postgresql: ['@feathersjs/knex', 'knex', 'pg'],
+  mariadb: ['@feathersjs/knex', 'knex', 'mysql2'],
+  mysql: ['@feathersjs/knex', 'knex', 'mysql2'],
+  sqlite: ['@feathersjs/knex', 'knex'],
+}
+const PROVIDERS = {
+  jwt: ['@feathersjs/authentication'],
+  local: ['@feathersjs/authentication-local'],
+  oauth: ['@feathersjs/authentication-oauth'],
+  oidc: [],
+  ldap: [],
+}
+/** Deterministic, read-only plan. This is a capability contract, NOT a scaffold.
+ * Store no connection URLs or authentication secrets in this plan.
+ */
+export function buildProjectPlan(rawOptions) {
+  const options = normalizePlanOptions(rawOptions)
+  const packages = new Set(['vite', 'vue', 'pinia', '@feathersjs/feathers', '@feathersjs/koa', '@vevedh/vite-plugin-feathersjs'])
+  const tasks = []
+  const warnings = []
+  if (options.ui === 'quasar2') {
+    if (options.engine === 'vite') {
+      for (const pkg of ['quasar', '@quasar/extras', '@quasar/vite-plugin@^1', 'sass-embedded']) packages.add(pkg)
+      tasks.push('Vite 7 requires @quasar/vite-plugin 1.x, which supports SPA only; certify Quasar 2 component compatibility.')
+    }
+    else {
+      for (const pkg of ['quasar', '@quasar/extras', '@quasar/app-vite']) packages.add(pkg)
+      tasks.push('Use Quasar CLI with Vite rather than @quasar/vite-plugin. Scaffold independently and certify integration with Feathers v5, services, Pinia, HMR and deployment.')
+      if (options.render === 'ssg') warnings.push('Quasar CLI Vite SSG is in beta: APIs and deployment requirements may change.')
+      warnings.push('Quasar CLI SSR/SSG + vite-plugin-feathersjs integration is NOT yet implemented or certified in this project.')
+    }
+  }
+  else {
+    for (const pkg of ['tailwindcss', '@tailwindcss/vite', 'daisyui']) packages.add(pkg)
+    if (options.ui === 'daisyui-kit') warnings.push('daisyUI kit is an external UI-template/preset selection; its license and assets are NOT bundled or installed by the planner.')
+    tasks.push('Use the Tailwind 4 Vite plugin and daisyUI CSS; avoid duplicate global UnoCSS/Tailwind resets.')
+    if (options.render === 'ssr') {
+      packages.add('@vue/server-renderer')
+      tasks.push('Build a Vite/Vue SSR server entry, isolated per-request Vue/Pinia state, HTML template and hydration, and certify dev and production SSR.')
+    }
+    if (options.render === 'ssg') {
+      packages.add('vite-ssg')
+      tasks.push('Prerender only public/static routes; verify generated HTML and client hydration, and use a separate Feathers API for dynamic data.')
+    }
+  }
+  if (options.render === 'ssr') {
+    warnings.push('SSR must isolate Pinia and authentication state per request; never serialize tokens, secrets or other users’ data into HTML.')
+    tasks.push('Define a production SSR server lifecycle, security headers, cache policy and explicit separation from Feathers REST/Socket.IO endpoints.')
+  }
+  if (options.render === 'ssg') {
+    warnings.push('SSG must not bake user-specific, authenticated or private content into static HTML; dynamic services require a running Feathers API.')
+  }
+  if (options.pwa === 'on') {
+    if (options.engine === 'vite') packages.add('vite-plugin-pwa')
+    tasks.push(options.engine === 'quasar-cli-vite' ? 'Configure Quasar CLI PWA takeover / offline mode for the selected SSR/SSG build, and certify separately.' : 'Configure manifest, icons, service worker lifecycle and offline caching; test update/recovery and HTTPS deployment.')
+  }
+  if (options.schema === 'typebox') {
+    packages.add('@feathersjs/typebox')
+    packages.add('@feathersjs/schema')
+  }
+  else if (options.schema === 'json') {
+    packages.add('@feathersjs/schema')
+    tasks.push('Generate plain JSON Schema and typed Ajv validators/resolvers; compile schema once, do not bypass query validation.')
+  }
+  else {
+    packages.add('zod')
+    warnings.push('Zod requires a Feathers v5 validation/resolver integration. The native TypeBox/Ajv generator cannot be reused unchanged.')
+    tasks.push('Implement and test dedicated Zod validation hooks for data, patch and query before enabling generated services.')
+  }
+  for (const strategy of options.auth.filter(item => item !== 'none')) {
+    for (const pkg of PROVIDERS[strategy]) packages.add(pkg)
+    if (strategy === 'oidc' || strategy === 'ldap') warnings.push(`${strategy.toUpperCase()} requires a separately implemented/audited authentication strategy and identity-provider configuration.`)
+  }
+  if (!options.auth.includes('none')) {
+    packages.add('@feathersjs/authentication-client')
+    tasks.push('Register AuthenticationService and per-service authenticate/authorize hooks; require RBAC for protected services.')
+  }
+  if (options.auth.includes('oauth')) tasks.push('Choose OAuth providers explicitly and configure redirect allowlists, callback HTTPS URLs, account linking and secret storage.')
+  for (const db of options.databases) for (const pkg of DATABASE_PACKAGES[db.adapter]) packages.add(pkg)
+  if (options.databases.some(db => db.adapter === 'sqlite')) warnings.push('Choose and certify a compatible SQLite driver for the target Node/Knex versions before implementation.')
+  if (options.databases.some(db => db.adapter === 'memory')) warnings.push('Memory adapter is for development/test: not durable production storage.')
+  if (options.databases.length > 1) tasks.push('Create separate named clients and bind each service to exactly one connection; cross-database transactions are not automatic.')
+  const connections = options.databases.map(({ alias, adapter }) => ({ alias, adapter, envKey: `FEATHERS_DB_${alias.replaceAll('-', '_').toUpperCase()}_URL`, isPrimary: alias === options.primary }))
+  const rendering = {
+    mode: options.render,
+    engine: options.engine,
+    deployment: options.render === 'ssr' ? 'node-ssr-runtime-required' : options.render === 'ssg' ? 'static-pages-plus-separate-feathers-api' : 'static-spa-plus-feathers-api',
+    hydrationRequired: options.render !== 'spa',
+    integrationStatus: 'not-generated-or-certified',
+  }
+  return {
+    version: 2, status: 'planning-only', writesFiles: false,
+    project: options.name,
+    stack: { vite: options.engine === 'vite' ? '7' : 'managed-by-quasar-cli', vue: '3', feathers: '5', pinia: true, ui: options.ui, render: options.render, renderEngine: options.engine, pwa: options.pwa === 'on', schema: options.schema, transport: options.transport },
+    rendering,
+    authentication: { strategies: options.auth, customIntegrationRequired: options.auth.filter(item => ['oidc', 'ldap'].includes(item)) },
+    database: { primary: options.primary, connections },
+    proposedPackages: [...packages].sort(),
+    implementationTasks: tasks,
+    warnings,
+  }
+}

package/lib/scaffold.mjs

@@ -0,0 +1,136 @@
+import { mkdir, lstat, readdir, readFile, writeFile } from 'node:fs/promises'
+import { existsSync } from 'node:fs'
+import { dirname, join, relative, resolve, sep } from 'node:path'
+import { buildProjectPlan } from './planner/plan.mjs'
+
+const KEYS = new Set(['--name', '--dir', '--ui', '--render', '--adapter', '--transport', '--dry-run', '--json'])
+const CASES = Object.freeze({
+  'quasar2:spa': 'quasar-spa',
+  'daisyui:spa': 'daisyui-spa',
+  'daisyui:ssr': 'daisyui-ssr',
+  'daisyui:ssg': 'daisyui-ssg',
+})
+const IGNORED = new Set(['node_modules', 'dist', 'coverage', '.env', 'test-results', 'playwright-report', 'docs-private', '.vite', '.quasar', '.git', 'pnpm-lock.yaml'])
+
+async function walk(directory, prefix = '') {
+  const output = []
+  for (const entry of (await readdir(directory, {withFileTypes: true})).sort((a,b)=>a.name.localeCompare(b.name,'en'))) {
+    if (entry.isSymbolicLink()) throw new Error('Template symlink refused')
+    if (IGNORED.has(entry.name)) continue
+    const key = prefix ? `${prefix}/${entry.name}` : entry.name
+    if (entry.isDirectory()) output.push(...await walk(join(directory, entry.name), key))
+    else if (entry.isFile()) output.push([key, await readFile(join(directory, entry.name),'utf8')])
+  }
+  return output
+}
+async function rejectSymlinks(pathname) {
+  let current = pathname
+  while (true) {
+    if (existsSync(current) && (await lstat(current)).isSymbolicLink()) throw new Error('Symlink in destination path')
+    const parent = dirname(current)
+    if (parent === current) break
+    current = parent
+  }
+}
+function safeProjectName(value) {
+  return typeof value === 'string' && value.length <= 48 && /^[a-z][a-z0-9]*(?:-[a-z0-9]+)*$/.test(value) && !/^(?:con|prn|aux|nul|com[1-9]|lpt[1-9])$/i.test(value)
+}
+function envChange(text, options) {
+  return text.replace(/^FEATHERS_ADAPTER=.*$/m, `FEATHERS_ADAPTER=${options.adapter}`)
+    .replace(/^FEATHERS_SOCKETIO=.*$/m, `FEATHERS_SOCKETIO=${options.transport === 'both' ? '1' : '0'}`)
+    .replace(/^VITE_FEATHERS_REALTIME=.*$/m, `VITE_FEATHERS_REALTIME=${options.transport === 'both' ? '1' : '0'}`)
+}
+function spaManifest(o) {
+  const dependencies = {
+    '@vevedh/vite-plugin-feathersjs':'0.2.6', '@feathersjs/feathers':'^5.0.50', '@feathersjs/errors':'^5.0.50',
+    '@feathersjs/koa':'^5.0.50', '@feathersjs/express':'^5.0.50', '@feathersjs/socketio':'^5.0.50',
+    vue:'^3.5.44', pinia:'^3.0.4', 'socket.io-client':'^4.8.4',
+  }
+  const devDependencies = {
+    vite:'^7.3.7', '@vitejs/plugin-vue':'^6.0.0', 'vue-tsc':'^3.0.7',
+    typescript:'^5.9.3', '@types/node':'^22.0.0',
+  }
+  if (o.ui === 'quasar2') { dependencies.quasar = '^2.35.2'; devDependencies['@quasar/vite-plugin']='^1.12.0';devDependencies['sass-embedded']='^1.93.2' }
+  else { devDependencies.tailwindcss='^4.1.0';devDependencies['@tailwindcss/vite']='^4.1.0';devDependencies.daisyui='^5.0.0' }
+  return {name:o.name,version:'0.1.0',private:true,type:'module',packageManager:'pnpm@10.30.2',engines:{node:'>=22.12'},
+    scripts:{dev:'vite --host 127.0.0.1', 'dev:api':'node --env-file=.env.example api/server.mjs',
+      'dev:all':'node scripts/dev-all.mjs',build:'vue-tsc --noEmit && vite build',typecheck:'vue-tsc --noEmit',preview:'vite preview --host 127.0.0.1'},
+    dependencies,devDependencies}
+}
+function generatedReadme(o) {
+  const renderInfo = o.render === 'ssg' ? 'Le build pré-rend les routes publiques / et /about. Les notes restent dynamiques via /api.'
+    : o.render === 'ssr' ? 'Le serveur Node effectue le SSR avec un état Pinia distinct par requête.'
+      : 'Le frontend est une SPA Vite. L’API Feathers s’exécute séparément.'
+  return `# ${o.name}\n\nProjet ${o.ui} ${o.render.toUpperCase()} avec Vue 3, Pinia et FeathersJS v5 (${o.adapter}, ${o.transport}).\n\n`+
+  `${renderInfo}\n\n## Démarrage local (Windows / PowerShell)\n\n`+
+  '```powershell\ncorepack pnpm install\ncorepack pnpm run dev:all\n```\n\n' +
+  'Ouvrir http://127.0.0.1:5173. L’API utilise http://127.0.0.1:3030.\n\n' +
+  '```powershell\ncorepack pnpm run typecheck\ncorepack pnpm run build\n```\n\n' +
+  (o.render !== 'spa' ? 'Pour vérifier le build, lancer `corepack pnpm run serve:production` avec l’API active.\n\n' : '') +
+  'Les données sont en mémoire, sans authentification. Cet exemple est réservé au laboratoire local et ne doit pas être exposé sur Internet.\n'
+}
+export function createGenerator({outputRoot, templatesRoot, examplesRoot = templatesRoot, reportRoot = outputRoot}) {
+  const output = resolve(outputRoot), templates = resolve(templatesRoot), report = resolve(reportRoot)
+  function parse(args) {
+    const o={ui:'daisyui',render:'spa',adapter:'koa',transport:'rest',dryRun:false,json:false}
+    const seen=new Set()
+    if (args.length && !args[0].startsWith('-')) {o.name=args[0];args=args.slice(1);if(args.includes('--name'))throw new Error('Use either positional name or --name, not both')}
+    for(let i=0;i<args.length;i++) {
+      const flag=args[i]
+      if(!KEYS.has(flag)||seen.has(flag))throw new Error(`Unknown or duplicate option: ${flag}`)
+      seen.add(flag)
+      if(flag==='--dry-run'||flag==='--json') o[flag==='--dry-run'?'dryRun':'json']=true
+      else { const value=args[++i];if(!value||value.startsWith('--'))throw new Error(`Missing ${flag}`);o[flag.slice(2)]=value }
+    }
+    if(!safeProjectName(o.name))throw new Error('Invalid or missing --name (lowercase kebab-case, max 48 characters)')
+    if(!['koa','express'].includes(o.adapter))throw new Error('Only koa|express adapters are supported')
+    if(!['rest','both'].includes(o.transport))throw new Error('Only rest|both are supported')
+    // Reuse the actual R15 planner as the capability validator, not a separate feature catalogue.
+    const plan=buildProjectPlan({name:o.name,ui:o.ui,render:o.render,transport:o.transport,
+      engine:'auto',auth:'none',db:'main:memory',pwa:'off',schema:'typebox'})
+    if(!CASES[`${o.ui}:${o.render}`])throw new Error('Unsupported combination: Quasar2 supports SPA; daisyui supports SPA, SSR, SSG')
+    if(o.render!=='spa' && o.transport!=='rest')throw new Error('SSR/SSG supports REST only; Socket.IO proxy not certified')
+    if(o.dir!==undefined && !safeProjectName(o.dir))throw new Error('--dir must be a single safe directory name')
+    o.destination=resolve(output,o.dir||o.name)
+    if(dirname(o.destination)!==output)throw new Error('Destination escapes output root')
+    o.case=CASES[`${o.ui}:${o.render}`];o.plan=plan
+    return o
+  }
+  async function generate(o) {
+    await rejectSymlinks(output)
+    await rejectSymlinks(o.destination)
+    if(existsSync(o.destination))throw new Error('Destination already exists; refusing overwrite')
+    const files=new Map(o.render==='spa' ? [
+      ...await walk(join(templates,'spa','common')),
+      ...await walk(join(templates,'spa',o.ui)),
+    ] : await walk(join(resolve(examplesRoot),`daisyui-${o.render}`)))
+    // npm pack excludes files literally named .gitignore, even in subdirectories.
+    // The published templates use gitignore.template, rewritten here to real .gitignore.
+    if(files.has('gitignore.template')){files.set('.gitignore',files.get('gitignore.template'));files.delete('gitignore.template')}
+    if(!files.has('api/server.mjs')||!files.has('.env.example')||!files.has('index.html'))throw new Error('Incomplete source template')
+    files.set('.env.example',envChange(files.get('.env.example'),o))
+    files.set('index.html',files.get('index.html').replace('__R17_CASE__',o.case).replace(/(<meta name="r17-example" content=")[^"]+("\s*\/?>)/,`$1${o.case}$2`))
+    const manifest=o.render==='spa'?spaManifest(o):JSON.parse(files.get('package.json'))
+    manifest.name=o.name;manifest.private=true
+    manifest.scripts={...manifest.scripts,'dev:all':'node scripts/dev-all.mjs'}
+    files.set('package.json',JSON.stringify(manifest,null,2)+'\n')
+    files.set('README.md',generatedReadme(o))
+    files.set('scripts/dev-all.mjs',await readFile(join(templates,'common','dev-all.mjs'),'utf8'))
+    const list=[...files.keys()].sort()
+    const result={name:o.name,ui:o.ui,render:o.render,adapter:o.adapter,transport:o.transport,
+      destination:relative(report,o.destination).split(sep).join('/'),files:list}
+    if(o.dryRun)return result
+    // Do not follow symlinks and refuse any existing destination, including empty ones.
+    await mkdir(output,{recursive:true})
+    await rejectSymlinks(output)
+    await mkdir(o.destination,{recursive:false})
+    for(const [key,value] of [...files].sort(([a],[b])=>a.localeCompare(b,'en'))) {
+      const filepath=resolve(o.destination,key)
+      if(!filepath.startsWith(o.destination+sep))throw new Error('Template path escapes destination')
+      await mkdir(dirname(filepath),{recursive:true})
+      await writeFile(filepath,value.replace(/\r\n/g,'\n'),{flag:'wx'})
+    }
+    return result
+  }
+  return {parse,generate}
+}

package/package.json

@@ -1,6 +1,34 @@
 {
   "name": "@vevedh/create-feathers-app",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
-}
+  "version": "0.1.0-rc.1",
+  "type": "module",
+  "description": "Scaffold FeathersJS v5 projects with Quasar 2 or daisyUI, Vite, Vue 3 and Pinia",
+  "license": "MIT",
+  "bin": {
+    "create-feathers-app": "./bin/create-feathers-app.mjs"
+  },
+  "engines": {
+    "node": ">=22.12.0"
+  },
+  "files": [
+    "bin",
+    "lib",
+    "templates",
+    "README.md",
+    "LICENSE"
+  ],
+  "publishConfig": {
+    "access": "public"
+  },
+  "keywords": [
+    "create",
+    "scaffold",
+    "vite",
+    "feathersjs",
+    "quasar",
+    "daisyui",
+    "vue",
+    "ssr",
+    "ssg"
+  ]
+}

package/templates/common/dev-all.mjs

@@ -0,0 +1,46 @@
+#!/usr/bin/env node
+// Starts Feathers first, then the frontend, with one controlled shutdown.
+import { spawn } from 'node:child_process'
+import { existsSync } from 'node:fs'
+import { loadEnvFile } from 'node:process'
+import { setTimeout as sleep } from 'node:timers/promises'
+
+const file=existsSync('.env') ? '.env' : '.env.example'
+if(!existsSync(file))throw new Error('Missing .env.example')
+loadEnvFile(file)
+const usesVite=existsSync('src/main.ts')
+const isSSG=existsSync('scripts/serve-static.mjs')
+const env={...process.env}
+const processes=[]
+let stopped=false
+function stop(code=0){
+  if(stopped)return
+  stopped=true
+  for(const p of [...processes].reverse())if(p.exitCode===null)try{p.kill()}catch{}
+  process.exitCode=code
+}
+process.on('SIGINT',()=>stop(130))
+process.on('SIGTERM',()=>stop(143))
+const api=spawn(process.execPath,[`--env-file=${file}`,'api/server.mjs'],{env,stdio:'inherit',windowsHide:true})
+processes.push(api)
+api.once('error',err=>{console.error('Feathers:',err.message);stop(1)})
+api.once('exit',code=>{if(!stopped){console.error('Feathers stopped:',code);stop(code||1)}})
+const port=Number(env.FEATHERS_API_PORT||3030)
+let ready=false
+for(let i=0;i<80 && !stopped;i++){
+  if(api.exitCode!==null)break
+  try {
+    const res=await fetch(`http://127.0.0.1:${port}/api/health`,{signal:AbortSignal.timeout(700)})
+    if(res.ok && (await res.json()).transport==='feathers-v5'){ready=true;break}
+  }catch{}
+  await sleep(200)
+}
+if(!ready){console.error('API Feathers non disponible sur 127.0.0.1:'+port);stop(1)}
+if(!stopped){
+  const args=usesVite?['node_modules/vite/bin/vite.js','--host','127.0.0.1','--port','5173','--strictPort']
+    :[isSSG?'node_modules/vite/bin/vite.js':'scripts/serve-ssr.mjs',...(isSSG?['--host','127.0.0.1','--port','5173','--strictPort']:[])]
+  const ui=spawn(process.execPath,args,{env,stdio:'inherit',windowsHide:true})
+  processes.push(ui)
+  ui.once('error',err=>{console.error('Frontend:',err.message);stop(1)})
+  ui.once('exit',code=>{if(!stopped){console.error('Frontend stopped:',code);stop(code||1)}})
+}

package/templates/daisyui-ssg/.env.example

@@ -0,0 +1,6 @@
+# Local demonstration only. No secrets or private addresses.
+FEATHERS_ADAPTER=koa
+FEATHERS_API_PORT=3030
+FEATHERS_SOCKET_PORT=3031
+FEATHERS_SOCKETIO=0
+FEATHERS_PUBLIC_ORIGIN=http://127.0.0.1:5173

package/templates/daisyui-ssg/README.md

@@ -0,0 +1,21 @@
+# daisyUI SSG — FeathersJS v5
+
+Exemple de rendu SSG avec Vue 3, Pinia, Vite 7 et Tailwind CSS/daisyUI. Le service FeathersJS v5 est exécuté dans un processus indépendant. Les pages statiques ne contiennent pas de notes ni de secrets. Données de démonstration uniquement, sans authentification.
+
+```powershell
+corepack pnpm install
+# Terminal 1 : API Feathers
+corepack pnpm run dev:api
+# Terminal 2 : frontend
+corepack pnpm run dev
+```
+
+```powershell
+corepack pnpm run typecheck
+corepack pnpm run build
+corepack pnpm run serve:production
+```
+
+En développement, Vite sert une application cliente. Le build pré-rend `/` et `/about` dans `dist/ssg`. Seules des pages publiques sont générées ; le service `notes` reste dynamique et nécessite une API accessible en production. Prévoir la configuration de proxy `/api` sur le serveur statique.
+
+La certification Windows complète reste à exécuter. Ne pas exposer publiquement l’API de démonstration en mémoire, sans authentification.

package/templates/daisyui-ssg/api/server.mjs

@@ -0,0 +1,45 @@
+import { createServer } from 'node:http'
+import { createFeathersRuntime } from '@vevedh/vite-plugin-feathersjs'
+const adapter = process.env.FEATHERS_ADAPTER === 'express' ? 'express' : 'koa'
+const port = Number(process.env.FEATHERS_API_PORT || 3030)
+const wsPort = Number(process.env.FEATHERS_SOCKET_PORT || 3031)
+const realtime = process.env.FEATHERS_SOCKETIO === '1'
+const origin = process.env.FEATHERS_PUBLIC_ORIGIN || 'http://127.0.0.1:5173'
+if (!Number.isInteger(port) || port < 1024 || port > 65535 || !Number.isInteger(wsPort) || wsPort === port) throw new Error('Invalid port configuration')
+const modules = [
+  new URL('./services/health/health.service.mjs', import.meta.url),
+  new URL('./services/notes/notes.service.mjs', import.meta.url),
+]
+const runtime = await createFeathersRuntime(modules.map(String), file => import(file), {
+  serviceFiles: [], adapter, prefix: '/api', cors: false,
+  socketio: realtime ? { port: wsPort, origins: [origin], host: '127.0.0.1' } : false,
+})
+await runtime.start()
+const httpServer = createServer((req, res) => {
+  const pathname = new URL(req.url || '/', 'http://localhost').pathname
+  if (pathname !== '/api' && !pathname.startsWith('/api/')) {
+    res.writeHead(404, { 'content-type': 'application/json' }); res.end('{"error":"Not found"}'); return
+  }
+  // The Feathers transport is mounted at /api, while its services register as health/notes.
+  req.url = (req.url || '/').slice(4) || '/'
+  runtime.handler(req, res, error => {
+    if (res.headersSent) { res.end(); return }
+    res.writeHead(500, { 'content-type': 'application/json' })
+    res.end(JSON.stringify({ error: 'Internal server error' }))
+    if (error) console.error('[feathers] request failed')
+  })
+})
+await new Promise((resolve, reject) => {
+  httpServer.once('error', reject)
+  httpServer.listen(port, '127.0.0.1', resolve)
+})
+console.log(`Feathers ${adapter} API listening on http://127.0.0.1:${port}/api (socketio=${realtime})`)
+let stopping = false
+async function close() {
+  if (stopping) return
+  stopping = true
+  await new Promise(resolve => httpServer.close(resolve))
+  await runtime.close()
+}
+process.on('SIGINT', () => { void close().then(() => process.exit(0)) })
+process.on('SIGTERM', () => { void close().then(() => process.exit(0)) })

package/templates/daisyui-ssg/api/services/health/health.class.mjs

@@ -0,0 +1,3 @@
+export class HealthService {
+  async find() { return { status: 'ok', transport: 'feathers-v5' } }
+}

package/templates/daisyui-ssg/api/services/health/health.service.mjs

@@ -0,0 +1,4 @@
+import { HealthService } from './health.class.mjs'
+export default function register(app) {
+  app.use('health', new HealthService(), { methods: ['find'] })
+}

package/templates/daisyui-ssg/api/services/notes/notes.class.mjs

@@ -0,0 +1,25 @@
+import { NotFound, BadRequest } from '@feathersjs/errors'
+export class NotesService {
+  // Feathers v5 exposes service methods through its own service wrapper. The
+  // wrapper is not necessarily this class instance, so native #private slots
+  // cannot be read through an unbound method call. Bind to the owning instance.
+  // Keep this per-service-instance: never hoist records or IDs to module scope.
+  constructor() {
+    for (const name of ['find', 'get', 'create', 'patch', 'remove']) {
+      this[name] = this[name].bind(this)
+    }
+  }
+  #records = new Map([[1, { id: 1, title: 'Hello from FeathersJS v5' }]])
+  #nextId = 2
+  #id(value) { const n = Number(value); if (!Number.isSafeInteger(n) || n < 1) throw new BadRequest('Invalid note ID'); return n }
+  #title(value) {
+    const title = value?.title
+    if (typeof title !== 'string' || title.trim().length < 1 || title.length > 120) throw new BadRequest('Invalid note title')
+    return title.trim()
+  }
+  async find() { return [...this.#records.values()].map(note => ({ ...note })) }
+  async get(id) { const note = this.#records.get(this.#id(id)); if (!note) throw new NotFound('Note not found'); return { ...note } }
+  async create(data) { const note = { id: this.#nextId++, title: this.#title(data) }; this.#records.set(note.id, note); return { ...note } }
+  async patch(id, data) { const key = this.#id(id); if (!this.#records.has(key)) throw new NotFound('Note not found'); const note = { id: key, title: this.#title(data) }; this.#records.set(key, note); return { ...note } }
+  async remove(id) { const key = this.#id(id); const note = this.#records.get(key); if (!note) throw new NotFound('Note not found'); this.#records.delete(key); return { ...note } }
+}

package/templates/daisyui-ssg/api/services/notes/notes.service.mjs

@@ -0,0 +1,10 @@
+import { NotesService } from './notes.class.mjs'
+export default function register(app) {
+  app.use('notes', new NotesService(), { methods: ['find', 'get', 'create', 'patch', 'remove'] })
+  const service = app.service('notes')
+  // Demo-only channel: keep the entire stack loopback-only.
+  if (typeof service.publish === 'function') {
+    app.on('connection', connection => app.channel('local-demo').join(connection))
+    service.publish(() => app.channel('local-demo'))
+  }
+}