@vevedh/create-feathers-app 0.0.0-stage → 0.1.0-rc.10

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 vite-plugin-feathersjs contributors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -1,3 +1,80 @@
-# Temporary Holding Version
+# create-feathers-app
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+Générez des applications FeathersJS v5 avec Vue 3, Pinia, Vite, Quasar 2 ou Tailwind CSS + daisyUI.
+
+Le CLI est indépendant du runtime [`@vevedh/vite-plugin-feathersjs`](https://www.npmjs.com/package/@vevedh/vite-plugin-feathersjs) (version 0.2.7). La version `0.1.0-rc.10` est la candidate présente dans les sources locales. Ne pas présumer de sa publication npm ; vérifier les versions du registre avant installation. La PWA reste optionnelle pour une SPA.
+
+## Usage
+
+```powershell
+# Après publication de cette préversion sur npm
+npm exec --yes --package=@vevedh/create-feathers-app@0.1.0-rc.10 -- create-feathers-app portail --ui daisyui --render spa
+
+# Candidate RC5, depuis les sources mises en stage :
+cfapp portail-ssr --ui quasar2 --render ssr
+```
+
+| Interface | SPA | SSR | SSG |
+| --- | --- | --- | --- |
+| Quasar 2 | Générable | Générable, validation Windows complète à vérifier | Bloqué |
+| daisyUI 5 | Générable | Générable | Générable |
+
+## PWA optionnelle (SPA uniquement)
+
+Le paramètre `--pwa on` ajoute `vite-plugin-pwa` v2 en dépendance de développement, une icône SVG locale de démonstration et un manifeste Web App. Le service worker, désactivé en développement, est généré au build et conserve uniquement des ressources statiques, jamais les réponses `/api` ou les échanges Socket.IO. Par défaut, `--pwa off` ne change pas les templates existants.
+
+```powershell
+cfapp portail-spa --ui quasar2 --render spa --pwa on --dry-run
+```
+
+SSR/SSG avec PWA est refusé tant que leur cycle de vie n'est pas certifié. Pour une installation sur les navigateurs ciblés, remplacer l'icône SVG de démonstration par des icônes PNG 192 et 512 pixels, puis contrôler HTTPS, les mises à jour et le mode hors-ligne.
+
+## Ajouter un service Feathers
+
+```powershell
+cd portail
+node ../chemin/vers/create-feathers-app/bin/create-feathers-app.mjs service add tickets --schema zod --db main
+```
+
+Le générateur ajoute le module `api/services/tickets` et son inscription dans le registre Feathers. Les schémas disponibles sont `typebox`, `json` et `zod`. Le service mémoire est destiné au laboratoire local, avec CRUD REST et validation des données.
+
+## Profils d'identité et de bases
+
+La création de projet accepte `--auth none|jwt|oauth2|oidc|keycloak`, `--schema typebox|json|zod` et `--db main:memory,audit:mongodb` avec alias nommés. **Les profils JWT disposent de modules Feathers/CASL et les providers nommés de modules serveur ; le bootstrap HTTP sécurisé et les tests DB restent à certifier. Les autres fournisseurs externes sont des profils de configuration, pas des intégrations opérationnelles.** L'API échoue volontairement au démarrage jusqu'au raccordement et à la certification du fournisseur ou du SGBD.
+
+Les projets sans authentification sont exclusivement des démonstrations locales. Ils ne doivent jamais être exposés tels quels sur Internet. Aucun secret, mot de passe ou jeton n'est inclus dans les templates.
+
+## Windows
+
+```powershell
+corepack pnpm install
+corepack pnpm run typecheck
+corepack pnpm run build
+corepack pnpm run dev:all
+```
+
+SPA et daisyUI SSR/SSG utilisent `http://127.0.0.1:5173`. Quasar SSR utilise `http://127.0.0.1:8080` via un proxy local ; le SSR brut écoute sur 9100.
+
+La documentation publique VitePress figure dans `docs/cli` du dépôt et sera déployée sur GitHub Pages après activation du workflow de publication.
+
+## API Feathers intégrée à Vite en développement (RC5)
+
+Pour les applications SPA, `--dev-api vite` est désormais la valeur par défaut.
+Le plugin public `@vevedh/vite-plugin-feathersjs@0.2.7` est chargé depuis
+`vite.config.ts` et monte les services sur `/api` pendant `vite dev`.
+Il n'y a pas de second serveur REST ni de proxy REST à démarrer.
+
+L'option `--dev-api separate` conserve l'ancien comportement à deux processus.
+Pour SSR/SSG, le mode séparé reste obligatoire. Avec `--transport both`,
+Socket.IO reste sur le port privé `127.0.0.1:3031`, accessible depuis la SPA
+via le proxy WebSocket Vite. La configuration de Feathers échoue au chargement
+si les profils d'identité ou bases externes ne sont pas opérationnels.
+
+```powershell
+cfapp mon-spa --ui quasar2 --render spa --dev-api vite --transport both
+```
+
+**Production** : le plugin Vite s'exécute uniquement en développement.
+Le serveur `api/server.mjs` autonome reste disponible et obligatoire pour
+le déploiement ; `vite preview` n'héberge pas l'API.
+La version `0.2.7` du plugin doit être certifiée et publiée avant une installation depuis npm.

package/bin/create-feathers-app.mjs

@@ -0,0 +1,52 @@
+#!/usr/bin/env node
+import { dirname,resolve } from 'node:path'
+import { fileURLToPath } from 'node:url'
+import { readFile } from 'node:fs/promises'
+import { createGenerator } from '../lib/scaffold.mjs'
+import { runServiceCommand } from '../lib/services.mjs'
+const packageRoot=resolve(dirname(fileURLToPath(import.meta.url)),'..')
+const {version}=JSON.parse(await readFile(resolve(packageRoot,'package.json'),'utf8'))
+const args=process.argv.slice(2)
+if(args.includes('--help')||args.includes('-h')||!args.length){
+  console.log(`create-feathers-app ${version}
+
+Usage: create-feathers-app <name> [options]
+  --name <name>       Project name (alternative to positional name)
+  --dir <directory>   Safe folder name (within current directory)
+  --ui <quasar2|daisyui>  Default daisyui
+  --render <spa|ssr|ssg>  Default spa
+  --adapter <koa|express>  Default koa
+  --transport <rest|both>  Default rest (both only for SPA)
+  --pwa <on|off>      Optional offline SPA shell (default off, no API caching)
+  --compose <off|dev|prod|both>   Generate Docker Compose for SPA (default off)
+  --dev-api <vite|separate>    SPA default vite; SSR/SSG always separate
+  --single-server <node|bun>    Gate25 opt-in SPA Express isolated JWT universal lab
+  --dry-run           Preview files without writing
+  --json              Machine-readable output
+  --schema <typebox|json|zod>     Service schema preset (default typebox)
+  --auth <none|jwt|oauth2|oidc|keycloak>  Identity configuration blueprint
+  --db <alias:adapter[,alias:adapter]>    Named connections (default main:memory)
+  --persistence <off|lab>    Opt-in private Docker Production DB demonstration
+  --tenant-mode <off|isolated-lab>    Opt-in per-tenant ACL lab (JWT + persistent DB)
+  --compose <off|dev|prod|both|dev-prod>    Docker Compose profile (default off)
+  --database-mode <single|universal|multi>    Default single; multi is blueprint only
+  --cache <none|valkey>    Cache blueprint (not connected)
+  --storage <none|s3-external>    Object-storage blueprint (not connected)
+  --version           Print CLI version
+
+Service: create-feathers-app service add <name> [--project <path>] [--schema typebox|json|zod] [--db <alias>] [--auth none|jwt] [--lang js|ts] [--dry-run]
+
+Available: Quasar 2 SPA/SSR; daisyUI SPA, SSR, SSG.
+Quasar SSR uses the R16-certified architecture; R17-generated SSR requires its own Windows E2E certification. Quasar SSG not supported.`)
+}else if(args.includes('--version')||args.includes('-v'))console.log(version)
+else if(args[0]==='service') {
+  try { await runServiceCommand(args.slice(1),process.cwd()) } catch(error){console.error(`FAIL: ${error.message}`);process.exitCode=1}
+}
+else {
+  const {parse,generate}=createGenerator({outputRoot:process.cwd(),templatesRoot:resolve(packageRoot,'templates'),reportRoot:process.cwd()})
+  try {
+    const options=parse(args)
+    const result=await generate(options)
+    console.log(options.json?JSON.stringify(result,null,2):`${options.dryRun?'DRY RUN':'CREATED'}: ${result.destination} (${result.files.length} files)`)
+  } catch(error){console.error(`FAIL: ${error.message}`);process.exitCode=1}
+}

package/lib/auth-lab/AUTHENTICATION.md

@@ -0,0 +1,31 @@
+# Authentification Feathers et sessions durables — laboratoire
+
+Ce profil utilise **Feathers AuthenticationService**, les stratégies **local + JWT**, un registre de sessions durable dans le provider universel et une authentification **obligatoire** sur le service `notes` (REST et Socket.IO).
+
+## Démarrage
+
+Créer les secrets de la base puis de l'authentification, une seule fois :
+
+```powershell
+node scripts/create-lab-secret.mjs
+node scripts/create-auth-secrets.mjs
+corepack pnpm install --lockfile-only
+docker compose -f compose.prod.yaml up --build -d
+```
+
+Les secrets sont enregistrés sous `secrets/`, exclus de Git et des images Docker. Ne jamais afficher ni communiquer leurs valeurs.
+
+Le compte de laboratoire interne est `lab-admin@example.invalid`. Son mot de passe initial se trouve dans le fichier privé `secrets/admin_password`. Ne pas l'utiliser en dehors de ce laboratoire ni conserver ce compte en production.
+
+## Contrat HTTP
+
+- `POST /api/authentication` avec `{ "strategy":"local", "email":"lab-admin@example.invalid", "password":"<valeur privée>" }` renvoie un JWT de 15 minutes.
+- `Authorization: Bearer <JWT>` est obligatoire pour `/api/notes`.
+- `POST /api/sessions` avec `{ "operation":"revoke" }` révoque le jeton courant ; `{ "operation":"rotate" }` le consomme et renvoie un nouveau jeton.
+- `/api/users` ne propose aucune méthode publique : le service de résolution d'identité reste interne.
+
+Les sessions sont stockées dans la même base que les notes, avec une expiration persistante et une transition atomique de révocation. Après redémarrage de l'API, un JWT non révoqué peut être réutilisé jusqu'à son expiration ; un JWT révoqué doit rester refusé. Le mot de passe hashé n'est jamais renvoyé par l'API.
+
+## Limites
+
+Laboratoire Docker **loopback uniquement**. RBAC multi-rôles, MFA, protections anti-bruteforce multi-instance, renouvellement de clés, HTTPS public, récupération de compte et gestion du cycle de vie des utilisateurs ne sont pas certifiés. Pas de stockage de JWT en localStorage dans la SPA.

package/lib/auth-lab/RBAC.md

@@ -0,0 +1,16 @@
+# Contrôle des accès RBAC — laboratoire
+
+Le service `notes` est protégé par `authenticate('jwt')` puis par une politique côté serveur.
+La politique relit le rôle depuis la base active et vérifie la session durable.
+Un rôle fourni dans le JWT, les paramètres Socket.IO ou la requête est ignoré.
+
+| Rôle | Lecture `find/get` | Création `create` | Modification `patch` | Remplacement / suppression |
+| --- | --- | --- | --- | --- |
+| viewer | Oui | Non | Non | Non |
+| editor | Oui | Oui | Oui | Non |
+| admin | Oui | Oui | Oui | Oui |
+
+Le service `health` demeure public. Les services `users` sont internes et `sessions` applique déjà une vérification JWT durable.
+La connexion via Socket.IO n'est **pas encore certifiée en E2E** : les tests couvrent la politique et le générateur, pas le réseau réel.
+
+Limites : laboratoire local ; aucune isolation multitenant ni ACL par enregistrement. La politique n'autorise pas l'exposition Internet sans audit et tests supplémentaires.

package/lib/auth-lab/create-secret.mjs

@@ -0,0 +1,19 @@
+#!/usr/bin/env node
+import { randomBytes } from 'node:crypto'
+import { mkdir, open, lstat } from 'node:fs/promises'
+import { join, resolve } from 'node:path'
+const root = resolve('secrets')
+try {
+  if (process.argv.length !== 2) throw Error('NO_ARGUMENTS_ALLOWED')
+  await mkdir(root,{recursive:true,mode:0o700})
+  if ((await lstat(root)).isSymbolicLink()) throw Error('SECRET_DIRECTORY_REFUSED')
+  const entries = [['jwt_secret',48], ['admin_password',32]]
+  const existing = await Promise.all(entries.map(async ([name]) => lstat(join(root,name)).then(()=>true,e=>{if(e.code==='ENOENT')return false;throw e})))
+  if (existing.every(Boolean)) { console.log('AUTH_SECRETS=EXISTING | CONTENT=REDACTED'); process.exit(0) }
+  if (existing.some(Boolean)) throw Error('PARTIAL_SECRET_SET_REFUSED')
+  for (const [name,size] of entries) {
+    const file = await open(join(root,name),'wx',0o600)
+    try { await file.writeFile(randomBytes(size).toString('base64url')+'\n') } finally { await file.close() }
+  }
+  console.log('AUTH_SECRETS=CREATED | CONTENT=REDACTED')
+} catch { console.error('AUTH_SECRETS=REFUSED'); process.exitCode=2 }

package/lib/auth-lab/rbac-policy.mjs

@@ -0,0 +1,39 @@
+/** One provider per deployment, roles reloaded from the server-side store on each request. */
+export const NOTES_PERMISSIONS = Object.freeze({
+  viewer: Object.freeze(['find', 'get']),
+  editor: Object.freeze(['find', 'get', 'create', 'patch']),
+  admin: Object.freeze(['find', 'get', 'create', 'update', 'patch', 'remove']),
+})
+
+const UUID = /^[0-9a-f]{8}-(?:[0-9a-f]{4}-){3}[0-9a-f]{12}$/i
+const ROLES = new Set(Object.keys(NOTES_PERMISSIONS))
+const METHODS = new Set(['find', 'get', 'create', 'update', 'patch', 'remove'])
+
+export function canAccessNotes(role, method) {
+  return typeof role === 'string' && typeof method === 'string'
+    && ROLES.has(role) && METHODS.has(method) && NOTES_PERMISSIONS[role].includes(method)
+}
+
+/**
+ * Called ONLY AFTER the Feathers authenticate('jwt') before hook.
+ * Never grant access using a role from JWT claims, query, request body or socket metadata.
+ * An internal service call without a documented server authority is denied as well.
+ */
+export async function evaluateNotesAccess(context, store) {
+  if (!context || typeof context !== 'object' || context.path !== 'notes'
+      || !METHODS.has(context.method) || !store || typeof store.getById !== 'function'
+      || typeof store.validSession !== 'function') return false
+  const params = context.params
+  if (!params || !['rest', 'socketio'].includes(params.provider)) return false
+  const provided = params.user
+  const payload = params.authentication?.payload
+  if (!provided || !UUID.test(provided.id) || !payload || !UUID.test(payload.sid)
+      || payload.sub !== provided.id || !Number.isSafeInteger(payload.ver)
+      || payload.ver < 1) return false
+  // The authenticated user is only an identity pointer: roles come from the database.
+  const authoritative = await store.getById(provided.id)
+  if (!authoritative || authoritative.id !== provided.id || authoritative.status !== 'active'
+      || !Number.isSafeInteger(authoritative.sessionVersion)
+      || authoritative.sessionVersion !== payload.ver || !canAccessNotes(authoritative.role,context.method)) return false
+  return Boolean(await store.validSession(payload.sid, authoritative.id, authoritative.sessionVersion))
+}

package/lib/auth-lab/rbac.mjs

@@ -0,0 +1,16 @@
+import { Forbidden } from '@feathersjs/errors'
+import { evaluateNotesAccess } from './auth-rbac-policy.mjs'
+
+export function createNotesRbacHook(store) {
+  if (!store || typeof store.getById !== 'function' || typeof store.validSession !== 'function') {
+    throw new TypeError('Trusted RBAC store required')
+  }
+  return async function authorizeNotes(context) {
+    try {
+      if (await evaluateNotesAccess(context, store)) return context
+    } catch {
+      // Provider errors and identity details are never returned to clients.
+    }
+    throw new Forbidden('Forbidden')
+  }
+}

package/lib/auth-lab/schema.mjs

@@ -0,0 +1,42 @@
+const users = 'app_auth_users'
+const sessions = 'app_auth_sessions'
+// Additive only. Never remove tables, columns or MongoDB collections.
+export async function prepareAuthSchema(provider) {
+  if (!provider || !['postgresql','mariadb','mongodb'].includes(provider.adapter)) throw Error('AUTH_PROVIDER_REQUIRED')
+  const db = provider.db
+  if (provider.adapter === 'mongodb') {
+    for (const name of [users,sessions]) {
+      try { await db.createCollection(name) } catch (error) { if (error?.code !== 48) throw error }
+      await db.collection(name).createIndex({ id: 1 }, { unique: true })
+    }
+    await db.collection(users).createIndex({ email: 1 }, { unique: true })
+    await db.collection(sessions).createIndex({ user_id: 1, expires_at: 1 })
+    return
+  }
+  if (!await db.schema.hasTable(users)) await db.schema.createTable(users, table => {
+    table.string('id', 36).primary()
+    table.string('email', 190).notNullable().unique()
+    table.string('password', 255).notNullable()
+    table.string('status', 16).notNullable()
+    table.string('role', 16).notNullable()
+    table.integer('session_version').notNullable()
+  })
+  if (!await db.schema.hasTable(sessions)) await db.schema.createTable(sessions, table => {
+    table.string('id', 36).primary()
+    table.string('user_id', 36).notNullable().index()
+    table.integer('session_version').notNullable()
+    table.bigInteger('expires_at').notNullable()
+    table.boolean('revoked').notNullable().defaultTo(false)
+  })
+  for (const [name, columns] of [[users,['id','email','password','status','role','session_version']], [sessions,['id','user_id','session_version','expires_at','revoked']]]) {
+    for (const field of columns) if (!await db.schema.hasColumn(name,field)) throw Error('AUTH_SCHEMA_MIGRATION_REQUIRED')
+  }
+}
+export async function checkAuthSchema(provider) {
+  if (!provider || !['postgresql','mariadb','mongodb'].includes(provider.adapter)) throw Error('AUTH_PROVIDER_REQUIRED')
+  if (provider.adapter === 'mongodb') {
+    for (const name of [users,sessions]) if (!await provider.db.listCollections({ name }).hasNext()) throw Error('AUTH_SCHEMA_NOT_READY')
+  } else {
+    for (const name of [users,sessions]) if (!await provider.db.schema.hasTable(name)) throw Error('AUTH_SCHEMA_NOT_READY')
+  }
+}

package/lib/auth-lab/secrets.mjs

@@ -0,0 +1,12 @@
+import { readFile, lstat } from 'node:fs/promises'
+const allowed = Object.freeze({jwt:'/run/secrets/p5_jwt_secret',admin:'/run/secrets/p5_admin_password'})
+export async function readAuthSecret(kind) {
+  const wanted = allowed[kind]
+  const actual = kind === 'jwt' ? process.env.P5_JWT_SECRET_FILE : process.env.P5_ADMIN_PASSWORD_FILE
+  if (!wanted || wanted !== actual) throw Error('AUTH_SECRET_PATH_REFUSED')
+  const stat = await lstat(actual)
+  if (!stat.isFile() || stat.isSymbolicLink() || stat.size < 32 || stat.size > 256) throw Error('AUTH_SECRET_INVALID')
+  const secret = (await readFile(actual,'utf8')).replace(/\r?\n$/, '')
+  if (secret.length < 32 || secret.length > 256 || /[\u0000-\u001f\u007f]/.test(secret)) throw Error('AUTH_SECRET_INVALID')
+  return secret
+}

package/lib/auth-lab/setup.mjs

@@ -0,0 +1,121 @@
+import { AuthenticationService, JWTStrategy, authenticate } from '@feathersjs/authentication'
+import { LocalStrategy } from '@feathersjs/authentication-local'
+import { NotAuthenticated, BadRequest } from '@feathersjs/errors'
+import { createAuthStore } from './auth-store.mjs'
+import { checkAuthSchema } from './auth-schema.mjs'
+import { createNotesRbacHook } from './auth-rbac.mjs'
+
+const ADMIN_EMAIL = 'lab-admin@example.invalid'
+const UUID = /^[0-9a-f]{8}-(?:[0-9a-f]{4}-){3}[0-9a-f]{12}$/i
+function safeUser(value) {
+  if (!value || typeof value !== 'object' || !UUID.test(value.id) || value.status !== 'active' || !['viewer','editor','admin'].includes(value.role) || !Number.isSafeInteger(value.sessionVersion)) throw new NotAuthenticated('Identity unavailable')
+  return { id:value.id, role:value.role, status:value.status, sessionVersion:value.sessionVersion }
+}
+export async function configureJwtLab(app, provider, secret) {
+  if (process.env.NODE_ENV !== 'production' || process.env.P5_AUTH_MODE !== 'jwt-lab' || typeof secret !== 'string' || secret.length < 32) throw Error('AUTH_PROFILE_REFUSED')
+  await checkAuthSchema(provider)
+  const store = createAuthStore(provider)
+  const usersService = {
+    id: 'id',
+    async get(id) { const user = await store.getById(id); if (!user) throw new NotAuthenticated('Identity unavailable'); return user },
+    async find(params) {
+      const query = params?.query
+      if (!query || Object.keys(query).some(key => !['email','$limit'].includes(key)) || typeof query.email !== 'string') throw new BadRequest('Query refused')
+      const user = await store.getByEmail(query.email)
+      return user ? [user] : []
+    },
+  }
+  // No transport methods: users are resolved internally by Feathers strategies.
+  app.use('users', usersService, { methods: [] })
+  app.set('authentication', {
+    secret,
+    entity: 'user', service: 'users',
+    authStrategies: ['local', 'jwt'], parseStrategies: ['jwt'],
+    jwtOptions: { header:{typ:'access'}, audience:'p5-jwt-lab', issuer:'p5-jwt-lab', algorithm:'HS256', expiresIn:'15m' },
+    local: { usernameField:'email', passwordField:'password' },
+  })
+  class SafeLocalStrategy extends LocalStrategy {
+    // Feathers LocalStrategy otherwise re-reads the user with a provider-tagged
+    // get() call after password verification. The users service has no public
+    // methods: return the verified internal record without opening that route.
+    async getEntity(result) { return safeUser(result) }
+    async authenticate(data, params) {
+      const result = await super.authenticate(data, params)
+      return { ...result, user: safeUser(result.user) }
+    }
+  }
+  class DurableJWTStrategy extends JWTStrategy {
+    // JWTStrategy's default external getEntity() repeats get() with provider=rest.
+    // Resolve server-side instead: the users Feathers service remains internal.
+    async getEntity(id) { return safeUser(await store.getById(id)) }
+    async authenticate(data, params) {
+      const result = await super.authenticate(data, params)
+      const user = safeUser(result.user)
+      const payload = result.authentication?.payload
+      if (!payload || !UUID.test(payload.sid) || payload.ver !== user.sessionVersion || !await store.validSession(payload.sid,user.id,user.sessionVersion)) throw new NotAuthenticated('Session unavailable')
+      return { ...result, user }
+    }
+  }
+  class DurableAuthService extends AuthenticationService {
+    async getPayload(authResult, params) {
+      // JWT reauthentication must never mint a new durable session.
+      if (authResult?.authentication?.strategy === 'jwt') throw new NotAuthenticated('JWT renewal refused')
+      const payload = await super.getPayload(authResult,params)
+      const user = safeUser(authResult.user)
+      const sid = await store.createSession(user.id,user.sessionVersion)
+      return { ...payload, sid, ver:user.sessionVersion }
+    }
+    async create(data, params) {
+      if (!data || typeof data !== 'object' || Array.isArray(data)) throw new NotAuthenticated('Invalid login')
+      if (data.strategy === 'jwt') {
+        // Existing token only: a socket reconnect is not a login/refresh flow.
+        if (Object.keys(data).length !== 2 || !Object.hasOwn(data,'accessToken') || !Object.hasOwn(data,'strategy')
+          || typeof data.accessToken !== 'string' || data.accessToken.length < 40 || data.accessToken.length > 4096
+          || !/^[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+$/.test(data.accessToken)) throw new NotAuthenticated('Invalid JWT reauthentication')
+        const result = await super.create(data,params)
+        // Feathers JWTStrategy returns its input token unchanged; fail closed if that changes.
+        if (result.accessToken !== data.accessToken) throw new NotAuthenticated('Unexpected JWT renewal')
+        return { accessToken:data.accessToken, authentication:{strategy:'jwt'}, user:safeUser(result.user) }
+      }
+      if (data.strategy !== 'local' || Object.keys(data).some(key=>!['strategy','email','password'].includes(key)) || typeof data.email !== 'string' || data.email.length > 190 || typeof data.password !== 'string' || data.password.length > 256) throw new NotAuthenticated('Invalid login')
+      const result = await super.create(data,params)
+      return { accessToken:result.accessToken, authentication:{strategy:'local'}, user:safeUser(result.user) }
+    }
+  }
+  const auth = new DurableAuthService(app)
+  auth.register('jwt',new DurableJWTStrategy())
+  auth.register('local',new SafeLocalStrategy())
+  app.use('authentication',auth,{methods:['create']})
+  const sessionsService = {
+    async create(data, params) {
+      if (!data || typeof data !== 'object' || Array.isArray(data) || Object.keys(data).length !== 1 || !['revoke','rotate'].includes(data.operation)) throw new BadRequest('Invalid session operation')
+      const user = safeUser(params.user)
+      const sid = params.authentication?.payload?.sid
+      if (!UUID.test(sid) || !await store.consumeSession(sid,user.id,user.sessionVersion)) throw new NotAuthenticated('Session unavailable')
+      if (data.operation === 'revoke') return { revoked:true }
+      const replacement = await store.createSession(user.id,user.sessionVersion)
+      const accessToken = await auth.createAccessToken({sid:replacement,ver:user.sessionVersion},{subject:user.id})
+      return { accessToken, rotated:true }
+    },
+  }
+  app.use('sessions',sessionsService,{methods:['create']})
+  app.service('sessions').hooks({ before:{ create:[authenticate('jwt')] } })
+  app.set('p5AuthStore',store)
+  app.set('p5AuthConfigured',true)
+}
+export function protectNotesWithJwt(app) {
+  if (app.get('p5AuthConfigured') !== true) throw Error('AUTH_NOT_CONFIGURED')
+  app.service('notes').hooks({before:{all:[authenticate('jwt'),createNotesRbacHook(app.get('p5AuthStore'))]}})
+  // Fail closed for server-to-client events. RPC responses still work.
+  // Private per-record/tenant channels require their own future certification.
+  for (const name of ['notes','sessions','authentication']) {
+    const service = app.service(name)
+    if (!service) throw Error('AUTH_EVENT_SERVICE_MISSING')
+    if (typeof service.publish === 'function') service.publish(() => null)
+    else if (typeof app.publish === 'function') throw Error('AUTH_EVENT_PUBLISHER_MISSING')
+  }
+  // Authentication login/logout are application-level EventEmitter notifications,
+  // not publishable service events. Feathers handles them internally; no
+  // authentication data is broadcast by the service-level publishers above.
+}
+export const bootstrapAdminEmail = ADMIN_EMAIL

package/lib/auth-lab/store.mjs

@@ -0,0 +1,52 @@
+import { randomUUID } from 'node:crypto'
+
+// Server-only durable identity and session repository. SQL queries are parameterized
+// by Knex; MongoDB receives closed, validated field sets. No transport-specific data.
+const users = 'app_auth_users'
+const sessions = 'app_auth_sessions'
+const isUUID = value => typeof value === 'string' && /^[0-9a-f]{8}-(?:[0-9a-f]{4}-){3}[0-9a-f]{12}$/i.test(value)
+const now = () => Date.now()
+export function createAuthStore(provider) {
+  if (!provider || !['postgresql','mariadb','mongodb'].includes(provider.adapter)) throw Error('AUTH_PROVIDER_REQUIRED')
+  const mongo = provider.adapter === 'mongodb'
+  const sql = provider.db
+  const userColl = mongo ? sql.collection(users) : null
+  const sessionColl = mongo ? sql.collection(sessions) : null
+  const convert = row => row ? Object.freeze({ id: row.id, email: row.email, password: row.password, status: row.status, role: row.role, sessionVersion: row.session_version ?? row.sessionVersion }) : null
+  const getById = async id => isUUID(id) ? convert(mongo ? await userColl.findOne({ id }) : await sql(users).where({ id }).first()) : null
+  const getByEmail = async email => typeof email === 'string' && email.length <= 190
+    ? convert(mongo ? await userColl.findOne({ email }) : await sql(users).where({ email }).first()) : null
+  async function seedAdmin(email, hashed) {
+    if (typeof email !== 'string' || !/^[a-z0-9.-]{1,80}@[a-z0-9.-]{1,70}$/.test(email) || typeof hashed !== 'string' || !/^\$2[aby]\$/.test(hashed)) throw Error('AUTH_BOOTSTRAP_INVALID')
+    if (await getByEmail(email)) return false
+    const record = { id: randomUUID(), email, password: hashed, status: 'active', role: 'admin' }
+    if (mongo) await userColl.insertOne({ ...record, sessionVersion: 1 })
+    else await sql(users).insert({ ...record, session_version: 1 })
+    return true
+  }
+  async function createSession(userId, version, ttlMs = 900000) {
+    if (!isUUID(userId) || !Number.isSafeInteger(version) || version < 1 || ttlMs !== 900000) throw Error('AUTH_SESSION_INVALID')
+    const value = { id: randomUUID(), user_id: userId, session_version: version, expires_at: now() + ttlMs, revoked: false }
+    if (mongo) await sessionColl.insertOne(value)
+    else await sql(sessions).insert(value)
+    return value.id
+  }
+  async function validSession(id, userId, version) {
+    if (!isUUID(id) || !isUUID(userId) || !Number.isSafeInteger(version)) return false
+    const row = mongo
+      ? await sessionColl.findOne({ id, user_id: userId, session_version: version, revoked: false, expires_at: { $gt: now() } })
+      : await sql(sessions).where({ id, user_id: userId, session_version: version, revoked: false }).where('expires_at', '>', now()).first()
+    return Boolean(row)
+  }
+  async function consumeSession(id, userId, version) {
+    if (!isUUID(id) || !isUUID(userId) || !Number.isSafeInteger(version)) return false
+    const filter = { id, user_id: userId, session_version: version, revoked: false }
+    if (mongo) {
+      const result = await sessionColl.updateOne({ ...filter, expires_at: { $gt: now() } }, { $set: { revoked: true } })
+      return result.modifiedCount === 1
+    }
+    const changed = await sql(sessions).where(filter).where('expires_at', '>', now()).update({ revoked: true })
+    return changed === 1
+  }
+  return Object.freeze({ getById, getByEmail, seedAdmin, createSession, validSession, consumeSession })
+}

package/lib/auth-lab.mjs

@@ -0,0 +1,91 @@
+import { readFile } from 'node:fs/promises'
+const content = name => readFile(new URL(`./auth-lab/${name}`, import.meta.url),'utf8')
+function replaceOnce(files,path,needle,withText) {
+  const value = files.get(path)
+  if (typeof value !== 'string' || value.split(needle).length !== 2) throw Error('AUTH_TEMPLATE_DRIFT: '+path)
+  files.set(path,value.replace(needle,withText))
+}
+export async function enableJwtSessionLab(files,options) {
+  if (options.persistence !== 'lab' || options.compose !== 'prod' || options.auth !== 'jwt' || options.render !== 'spa' || options.databases.length !== 1 || !['postgresql','mariadb','mongodb'].includes(options.databases[0].adapter)) throw Error('JWT_LAB_PROFILE_REFUSED')
+  for (const [name,target] of [
+    ['store.mjs','api/runtime/auth-store.mjs'],
+    ['schema.mjs','api/runtime/auth-schema.mjs'],
+    ['secrets.mjs','api/runtime/auth-secrets.mjs'],
+    ['setup.mjs','api/runtime/auth-setup.mjs'],
+    ['rbac-policy.mjs','api/runtime/auth-rbac-policy.mjs'],
+    ['rbac.mjs','api/runtime/auth-rbac.mjs'],
+    ['create-secret.mjs','scripts/create-auth-secrets.mjs'],
+  ]) files.set(target,await content(name))
+  replaceOnce(files,'api/runtime/open.mjs','return { adapter, close: () => providers.close() }','return { adapter, provider: providers.get(declaration.alias), close: () => providers.close() }')
+  // The database migration runs in the one-shot, private Docker job; secrets
+  // never enter generated code, images, environment values or browser bundles.
+  const prepImports = `import { prepareAuthSchema } from '../api/runtime/auth-schema.mjs'\nimport { createAuthStore } from '../api/runtime/auth-store.mjs'\nimport { readAuthSecret } from '../api/runtime/auth-secrets.mjs'\nimport { hash } from 'bcryptjs'\n`
+  replaceOnce(files,'scripts/prepare-notes.mjs',"import { readFile, lstat } from 'node:fs/promises'\n", "import { readFile, lstat } from 'node:fs/promises'\n"+prepImports)
+  replaceOnce(files,'scripts/prepare-notes.mjs',"    await prepareNotesStorage(providers.get(declaration.alias))\n    console.log('P5_DB_INIT=PASS | NOTES_SCHEMA=READY | NO_SEED=YES')", `    const provider = providers.get(declaration.alias)
+    await prepareNotesStorage(provider)
+    if (process.env.P5_AUTH_MODE !== 'jwt-lab') throw Error('AUTH_MODE_REFUSED')
+    await prepareAuthSchema(provider)
+    const adminPassword = await readAuthSecret('admin')
+    await createAuthStore(provider).seedAdmin('lab-admin@example.invalid',await hash(adminPassword,12))
+    console.log('P5_AUTH_INIT=PASS | USERS=INTERNAL | SESSIONS=DURABLE')
+    console.log('P5_DB_INIT=PASS | NOTES_SCHEMA=READY')`)
+  const server = files.get('api/server.mjs')
+  if (typeof server !== 'string' || !server.includes("configure: app => app.set('p5PersistentNotes', new PersistentNotesService(persistence.adapter)),")) throw Error('AUTH_BOOTSTRAP_DRIFT')
+  files.set('api/server.mjs',`import { configureJwtLab, protectNotesWithJwt } from './runtime/auth-setup.mjs'\nimport { readAuthSecret } from './runtime/auth-secrets.mjs'\n`+server.replace('const runtime = await createFeathersRuntime(modules.map(String), file => import(file), {',`const jwtSecret = await readAuthSecret('jwt')
+const runtime = await createFeathersRuntime(modules.map(String), file => import(file), {`).replace("configure: app => app.set('p5PersistentNotes', new PersistentNotesService(persistence.adapter)),",`configure: async app => {
+    app.set('p5PersistentNotes',new PersistentNotesService(persistence.adapter))
+    await configureJwtLab(app,persistence.provider,jwtSecret)
+  },
+  afterRegister: app => protectNotesWithJwt(app),`))
+  let prod = files.get('compose.prod.yaml')
+  if (typeof prod !== 'string' || !prod.includes('  migrate:\n') || !prod.includes('  db:\n') || prod.split('      P5_PERSISTENCE_MODE: notes-lab\n').length !== 3) throw Error('AUTH_COMPOSE_DRIFT')
+  prod = prod.replaceAll('      P5_PERSISTENCE_MODE: notes-lab\n','      P5_PERSISTENCE_MODE: notes-lab\n      P5_AUTH_MODE: jwt-lab\n')
+  const migratePos = prod.indexOf('\n  migrate:\n') + 1
+  const dbPos = prod.indexOf('\n  db:\n', migratePos) + 1
+  if (dbPos < 0) throw Error('AUTH_COMPOSE_DRIFT')
+  let api = prod.slice(0,migratePos)
+  let migrate = prod.slice(migratePos,dbPos)
+  const dbRest=prod.slice(dbPos)
+  const needle='      - p5_database_password\n'
+  if (api.split(needle).length !== 2 || migrate.split(needle).length !== 2) throw Error('AUTH_COMPOSE_SECRET_DRIFT')
+  api=api.replace(needle,needle+'      - p5_jwt_secret\n')
+  migrate=migrate.replace(needle,needle+'      - p5_admin_password\n')
+  api=api.replace('      P5_AUTH_MODE: jwt-lab\n','      P5_AUTH_MODE: jwt-lab\n      P5_JWT_SECRET_FILE: /run/secrets/p5_jwt_secret\n')
+  migrate=migrate.replace('      P5_AUTH_MODE: jwt-lab\n','      P5_AUTH_MODE: jwt-lab\n      P5_ADMIN_PASSWORD_FILE: /run/secrets/p5_admin_password\n')
+  prod=api+migrate+dbRest
+  if (!prod.endsWith('    file: ./secrets/db_password\n')) throw Error('AUTH_COMPOSE_SECRET_DRIFT')
+  prod += '  p5_jwt_secret:\n    file: ./secrets/jwt_secret\n  p5_admin_password:\n    file: ./secrets/admin_password\n'
+  files.set('compose.prod.yaml',prod)
+  // Limit brute-force attempts on the sole local login route.
+  const nginx=files.get('infra/compose/nginx.conf')
+  if (typeof nginx !== 'string' || !nginx.startsWith('server {\n') || !nginx.includes('  location /api/ {')) throw Error('AUTH_NGINX_DRIFT')
+  files.set('infra/compose/nginx.conf', 'limit_req_zone $binary_remote_addr zone=p5_auth:10m rate=6r/m;\n'+nginx.replace('  location /api/ {',`  limit_req_status 429;
+  location = /api/authentication {
+    limit_req zone=p5_auth burst=6 nodelay;
+    proxy_pass http://api:3030/api/authentication;
+    proxy_http_version 1.1;
+    proxy_set_header Host $host;
+    proxy_set_header X-Forwarded-Proto $scheme;
+    proxy_set_header X-Forwarded-For $remote_addr;
+    proxy_read_timeout 30s;
+    client_max_body_size 8k;
+  }
+  location /api/ {`))
+  const manifest=JSON.parse(files.get('package.json'))
+  manifest.dependencies['@feathersjs/authentication']='5.0.50'
+  manifest.dependencies['@feathersjs/authentication-local']='5.0.50'
+  manifest.dependencies.bcryptjs='3.0.3'
+  manifest.scripts['auth:secrets:lab']='node scripts/create-auth-secrets.mjs'
+  files.set('package.json',JSON.stringify(manifest,null,2)+'\n')
+  files.set('AUTHENTICATION.md',await content('AUTHENTICATION.md'))
+  files.set('RBAC.md',await content('RBAC.md'))
+  files.set('api/contracts/rbac.ts', `export type NotesRole = 'viewer' | 'editor' | 'admin'\nexport type NotesMethod = 'find' | 'get' | 'create' | 'update' | 'patch' | 'remove'\nexport type NotesPermissions = Readonly<Record<NotesRole, readonly NotesMethod[]>>\n`)
+  const old=files.get('PERSISTENCE.md')
+  if (typeof old!=='string')throw Error('AUTH_DOC_DRIFT')
+  files.set('PERSISTENCE.md',old+'\n## Identité et sessions\n\nLe profil JWT dispose du guide [AUTHENTICATION.md](AUTHENTICATION.md). Ne pas exposer en dehors du laboratoire loopback.\n')
+  files.set('api/contracts/durable-auth.ts',`export type UserRole = 'viewer' | 'editor' | 'admin'
+export interface PublicUser { readonly id: string; readonly role: UserRole; readonly status: 'active'; readonly sessionVersion: number }
+export type AuthSessionAction = Readonly<{ operation: 'revoke' | 'rotate' }>
+export type AuthSessionResult = Readonly<{ revoked: true } | { rotated: true; accessToken: string }>
+`)
+}