@vevedh/create-feathers-app 0.0.0-stage → 0.1.0-rc.4

package/lib/scaffold.mjs

@@ -0,0 +1,300 @@
+import { mkdir, lstat, readdir, readFile, writeFile } from 'node:fs/promises'
+import { existsSync } from 'node:fs'
+import { dirname, join, relative, resolve, sep } from 'node:path'
+import { buildProjectPlan } from './planner/plan.mjs'
+
+const KEYS = new Set(['--name', '--dir', '--ui', '--render', '--adapter', '--transport', '--dry-run', '--json', '--schema', '--auth', '--db', '--pwa', '--dev-api'])
+const CASES = Object.freeze({
+  'quasar2:spa': 'quasar-spa',
+  'quasar2:ssr': 'quasar-ssr',
+  'daisyui:spa': 'daisyui-spa',
+  'daisyui:ssr': 'daisyui-ssr',
+  'daisyui:ssg': 'daisyui-ssg',
+})
+const IGNORED = new Set(['node_modules', 'dist', 'coverage', '.env', 'test-results', 'playwright-report', 'docs-private', '.vite', '.quasar', '.git', 'pnpm-lock.yaml'])
+
+async function walk(directory, prefix = '') {
+  const output = []
+  for (const entry of (await readdir(directory, {withFileTypes: true})).sort((a,b)=>a.name.localeCompare(b.name,'en'))) {
+    if (entry.isSymbolicLink()) throw new Error('Template symlink refused')
+    if (IGNORED.has(entry.name)) continue
+    const key = prefix ? `${prefix}/${entry.name}` : entry.name
+    if (entry.isDirectory()) output.push(...await walk(join(directory, entry.name), key))
+    else if (entry.isFile()) output.push([key, await readFile(join(directory, entry.name),'utf8')])
+  }
+  return output
+}
+async function rejectSymlinks(pathname) {
+  let current = pathname
+  while (true) {
+    if (existsSync(current) && (await lstat(current)).isSymbolicLink()) throw new Error('Symlink in destination path')
+    const parent = dirname(current)
+    if (parent === current) break
+    current = parent
+  }
+}
+function safeProjectName(value) {
+  return typeof value === 'string' && value.length <= 48 && /^[a-z][a-z0-9]*(?:-[a-z0-9]+)*$/.test(value) && !/^(?:con|prn|aux|nul|com[1-9]|lpt[1-9])$/i.test(value)
+}
+function envChange(text, options) {
+  return text.replace(/^FEATHERS_ADAPTER=.*$/m, `FEATHERS_ADAPTER=${options.adapter}`)
+    .replace(/^FEATHERS_SOCKETIO=.*$/m, `FEATHERS_SOCKETIO=${options.transport === 'both' ? '1' : '0'}`)
+    .replace(/^VITE_FEATHERS_REALTIME=.*$/m, `VITE_FEATHERS_REALTIME=${options.transport === 'both' ? '1' : '0'}`)
+}
+function spaManifest(o) {
+  const dependencies = {
+    '@vevedh/vite-plugin-feathersjs':'0.2.6', '@feathersjs/feathers':'^5.0.50', '@feathersjs/errors':'^5.0.50',
+    '@feathersjs/koa':'^5.0.50', '@feathersjs/express':'^5.0.50', '@feathersjs/socketio':'^5.0.50',
+    vue:'^3.5.44', pinia:'^3.0.4', 'socket.io-client':'^4.8.4',
+  }
+  const devDependencies = {
+    vite:'^7.3.7', '@vitejs/plugin-vue':'^6.0.0', 'vue-tsc':'^3.0.7',
+    typescript:'^5.9.3', '@types/node':'^22.0.0',
+  }
+  if (o.pwa === 'on') devDependencies['vite-plugin-pwa'] = '^2.0.0'
+  if (o.ui === 'quasar2') { dependencies.quasar = '^2.35.2'; devDependencies['@quasar/vite-plugin']='^1.12.0';devDependencies['sass-embedded']='^1.93.2' }
+  else { devDependencies.tailwindcss='^4.1.0';devDependencies['@tailwindcss/vite']='^4.1.0';devDependencies.daisyui='^5.0.0' }
+  return {name:o.name,version:'0.1.0',private:true,type:'module',packageManager:'pnpm@10.30.2',engines:{node:'>=22.12'},
+    scripts:{dev:'vite --host 127.0.0.1', 'dev:api':'node --env-file=.env.example api/server.mjs',
+      'dev:all':'node scripts/dev-all.mjs',build:'vue-tsc --noEmit && vite build',typecheck:'vue-tsc --noEmit',preview:'vite preview --host 127.0.0.1'},
+    dependencies,devDependencies}
+}
+function generatedReadme(o) {
+  const renderInfo = o.render === 'ssg' ? 'Le build pré-rend les routes publiques / et /about. Les notes restent dynamiques via /api.'
+    : o.render === 'ssr' ? 'Le serveur Node effectue le SSR avec un état Pinia distinct par requête.'
+      : o.devApi === 'vite'
+        ? 'En développement, le plugin Vite monte les services Feathers directement sur /api. En production, l’API doit être lancée et déployée séparément.'
+        : 'Le frontend est une SPA Vite. En développement, une API Feathers indépendante écoute sur 127.0.0.1:3030.'
+  return `# ${o.name}\n\nProjet ${o.ui} ${o.render.toUpperCase()} avec Vue 3, Pinia et FeathersJS v5 (${o.adapter}, ${o.transport}).\n\n`+
+  `${renderInfo}\n\n## Démarrage local (Windows / PowerShell)\n\n`+
+  '```powershell\ncorepack pnpm install\ncorepack pnpm run dev:all\n```\n\n' +
+  (o.devApi === 'vite' ? 'Ouvrir http://127.0.0.1:5173. Pendant le développement, Feathers REST est servi sur le même port via /api.\n\n' : 'Ouvrir http://127.0.0.1:5173. L’API indépendante utilise http://127.0.0.1:3030.\n\n') +
+  '```powershell\ncorepack pnpm run typecheck\ncorepack pnpm run build\n```\n\n' +
+  (o.render !== 'spa' ? 'Pour vérifier le build, lancer `corepack pnpm run serve:production` avec l’API active.\n\n' : '') +
+  (o.devApi === 'vite' ? 'Le plugin Vite est actif en développement uniquement. `pnpm run preview` sert les fichiers statiques et ne démarre pas l’API. Pour tester la SPA construite avec CRUD, lancer `corepack pnpm run dev:api` dans un premier terminal puis `corepack pnpm run preview` dans un second. Le proxy `preview.proxy` relaie /api vers 127.0.0.1:3030 (et Socket.IO vers 3031 si activé). En l’absence de backend, l’interface affiche « API indisponible » ; hors ligne, seule la coque statique reste disponible. Ne jamais exposer le serveur de démonstration sans authentification.\n\n' : '') +
+  `Profil: schema ${o.schema}; auth ${o.auth}; databases ${o.db}. Les profils d'identité et les bases externes nécessitent un raccordement explicite.\n\n`+
+  (o.ui==='quasar2' && o.render==='ssr'?'Quasar SSR : ouvrir http://127.0.0.1:8080 (reverse proxy local). Ne pas exposer le serveur SSR directement.\n\n':'')+
+  (o.pwa === 'on' ? 'PWA SPA activée : le service worker n’est produit qu’au build. Il met en cache les ressources statiques uniquement, jamais les réponses API ou Socket.IO.\nL’icône SVG d’exemple doit être remplacée par des icônes PNG 192/512 adaptées avant une distribution publique. En HTTPS, tester les mises à jour et l’installation sur le navigateur cible.\n\n' : '') +
+  'Les données de démonstration sont en mémoire ; sans authentification les services ne doivent pas être exposés publiquement.\n'
+}
+/** Replace the SPA proxy with the public Vite plugin. The standalone API remains for production. */
+function enableSpaViteRuntime(files, options) {
+  const source = files.get('vite.config.ts')
+  const marker = 'plugins: [vue(),'
+  const oldProxy = ",\n    proxy: { '/api': 'http://127.0.0.1:3030', '/socket.io': { target: 'ws://127.0.0.1:3031', ws: true } }"
+  if (typeof source !== 'string' || !source.includes(marker) || !source.includes(oldProxy)) {
+    throw new Error('Unsupported SPA Vite template for embedded Feathers; refusing partial generation')
+  }
+  const realtime = options.transport === 'both'
+  const socket = realtime
+    ? "{ port: 3031, host: '127.0.0.1', origins: ['http://127.0.0.1:5173'] }"
+    : 'false'
+  const runtime = `feathers({
+    serviceFiles: 'api/services/*/*.service.mjs',
+    watchDirectories: ['api/services'],
+    adapter: ${JSON.stringify(options.adapter)},
+    prefix: '/api',
+    cors: false,
+    socketio: ${socket},
+  })`
+  // 'vite preview' serves static assets: the Feathers Vite plugin is dev-only.
+  // Proxy API traffic to the separately started, loopback-bound demo API.
+  const previewProxy = `preview: { host: '127.0.0.1', port: 4173, strictPort: true,
+    proxy: { '/api': 'http://127.0.0.1:3030',${realtime ? " '/socket.io': { target: 'ws://127.0.0.1:3031', ws: true }" : ''} } },`
+  const socketProxy = realtime
+    ? ",\n    proxy: { '/socket.io': { target: 'ws://127.0.0.1:3031', ws: true } }"
+    : ''
+  files.set('vite.config.ts',
+    `import feathers from '@vevedh/vite-plugin-feathersjs'\n` +
+    `import { assertCapabilities } from './api/config/capabilities.mjs'\n` +
+    source.replace(marker, `${marker} ${runtime},`).replace(oldProxy, socketProxy)
+      .replace('export default defineConfig({',
+        '// Do not silently start an unprotected or unconfigured identity/database service.\nassertCapabilities()\nexport default defineConfig({\n' +
+        `  ${previewProxy}\n` +
+        `  define: { 'import.meta.env.VITE_FEATHERS_REALTIME': '${JSON.stringify(realtime ? '1' : '0')}' },`))
+}
+
+/** PWA is opt-in, SPA-only, and must never cache API or realtime responses. */
+function enableSpaPwa(files, options) {
+  const config = files.get('vite.config.ts')
+  const marker = 'plugins: [vue(),'
+  if (typeof config !== 'string' || !config.includes(marker) || config.includes('vite-plugin-pwa')) {
+    throw new Error('Unsupported Vite SPA template for PWA; refusing partial generation')
+  }
+  const pwa = `VitePWA({
+      registerType: 'prompt',
+      injectRegister: 'auto',
+      devOptions: { enabled: false },
+      includeAssets: ['pwa-icon.svg'],
+      manifest: {
+        name: ${JSON.stringify(options.name)},
+        short_name: ${JSON.stringify(options.name)},
+        description: 'Application Feathers et Vue',
+        lang: 'fr',
+        start_url: '/',
+        scope: '/',
+        display: 'standalone',
+        background_color: '#ffffff',
+        theme_color: '#ffffff',
+        icons: [{ src: '/pwa-icon.svg', sizes: 'any', type: 'image/svg+xml', purpose: 'any' }],
+      },
+      workbox: {
+        globPatterns: ['**/*.{js,css,html,svg}'],
+        globIgnores: ['**/api/**', '**/socket.io/**'],
+        navigateFallback: '/index.html',
+        navigateFallbackDenylist: [/^\\/api(?:\\/|$)/, /^\\/socket\\.io(?:\\/|$)/],
+        runtimeCaching: [],
+      },
+    })`
+  files.set('vite.config.ts', `import { VitePWA } from 'vite-plugin-pwa'\n${config.replace(marker, `${marker} ${pwa},`)}`)
+  if (files.has('public/pwa-icon.svg')) throw new Error('PWA icon conflict in source template')
+  files.set('public/pwa-icon.svg', '<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 192 192" role="img" aria-label="Feathers app"><rect width="192" height="192" rx="40" fill="#1e293b"/><path d="M44 96l40 40 64-80" fill="none" stroke="#fff" stroke-width="14" stroke-linecap="round" stroke-linejoin="round"/></svg>\n')
+}
+
+export function createGenerator({outputRoot, templatesRoot, examplesRoot = templatesRoot, reportRoot = outputRoot}) {
+  const output = resolve(outputRoot), templates = resolve(templatesRoot), report = resolve(reportRoot)
+  function parse(args) {
+    const o={ui:'daisyui',render:'spa',adapter:'koa',transport:'rest',schema:'typebox',auth:'none',db:'main:memory',pwa:'off',devApi:undefined,dryRun:false,json:false}
+    const seen=new Set()
+    if (args.length && !args[0].startsWith('-')) {o.name=args[0];args=args.slice(1);if(args.includes('--name'))throw new Error('Use either positional name or --name, not both')}
+    for(let i=0;i<args.length;i++) {
+      const flag=args[i]
+      if(!KEYS.has(flag)||seen.has(flag))throw new Error(`Unknown or duplicate option: ${flag}`)
+      seen.add(flag)
+      if(flag==='--dry-run'||flag==='--json') o[flag==='--dry-run'?'dryRun':'json']=true
+      else { const value=args[++i];if(!value||value.startsWith('--'))throw new Error(`Missing ${flag}`);o[flag==='--dev-api'?'devApi':flag.slice(2)]=value }
+    }
+    if(!safeProjectName(o.name))throw new Error('Invalid or missing --name (lowercase kebab-case, max 48 characters)')
+    o.devApi ??= o.render === 'spa' ? 'vite' : 'separate'
+    if (!['vite','separate'].includes(o.devApi)) throw new Error('Invalid --dev-api: expected vite|separate')
+    if (o.devApi === 'vite' && o.render !== 'spa') throw new Error('--dev-api vite is supported for SPA only; SSR/SSG require separate API')
+    if(!['koa','express'].includes(o.adapter))throw new Error('Only koa|express adapters are supported')
+    if(!['rest','both'].includes(o.transport))throw new Error('Only rest|both are supported')
+    if (!['on','off'].includes(o.pwa)) throw new Error('Invalid --pwa: expected on|off')
+    if (o.pwa==='on' && o.render!=='spa') throw new Error('PWA is supported for SPA only; SSR/SSG require separate certification')
+    if (!['typebox','json','zod'].includes(o.schema)) throw new Error('Invalid --schema: expected typebox|json|zod')
+    if (!['none','jwt','oauth2','oidc','keycloak'].includes(o.auth)) throw new Error('Invalid --auth: expected none|jwt|oauth2|oidc|keycloak')
+    if (!/^[a-z][a-z0-9-]{0,31}:(?:memory|mongodb|postgresql|mariadb|mysql|sqlite)(?:,[a-z][a-z0-9-]{0,31}:(?:memory|mongodb|postgresql|mariadb|mysql|sqlite))*$/.test(o.db)) throw new Error('Invalid --db: use alias:adapter[,alias:adapter]')
+    const dbPairs=o.db.split(',').map(x=>{const [alias,adapter]=x.split(':');return {alias,adapter}})
+    if(new Set(dbPairs.map(x=>x.alias)).size!==dbPairs.length)throw new Error('Duplicate database alias')
+    // Reuse the actual R15 planner as the capability validator, not a separate feature catalogue.
+    const plan=buildProjectPlan({name:o.name,ui:o.ui,render:o.render,transport:o.transport,
+      engine:'auto',auth:o.auth==='oauth2'?'jwt,oauth':o.auth==='oidc'||o.auth==='keycloak'?'jwt,oidc':o.auth,db:o.db,primary:dbPairs[0].alias,pwa:o.pwa,schema:o.schema})
+    if(!CASES[`${o.ui}:${o.render}`])throw new Error('Unsupported combination: Quasar2 supports SPA/SSR; daisyui supports SPA/SSR/SSG')
+    if(o.render!=='spa' && o.transport!=='rest')throw new Error('SSR/SSG supports REST only; Socket.IO proxy not certified')
+    if(o.dir!==undefined && !safeProjectName(o.dir))throw new Error('--dir must be a single safe directory name')
+    o.destination=resolve(output,o.dir||o.name)
+    if(dirname(o.destination)!==output)throw new Error('Destination escapes output root')
+    o.case=CASES[`${o.ui}:${o.render}`];o.plan=plan;o.databases=dbPairs
+    return o
+  }
+  async function generate(o) {
+    await rejectSymlinks(output)
+    await rejectSymlinks(o.destination)
+    if(existsSync(o.destination))throw new Error('Destination already exists; refusing overwrite')
+    const files=new Map(o.render==='spa' ? [
+      ...await walk(join(templates,'spa','common')),
+      ...await walk(join(templates,'spa',o.ui)),
+    ] : await walk(join(resolve(examplesRoot),`${o.ui==='quasar2'?'quasar':'daisyui'}-${o.render}`)))
+    // npm pack excludes files literally named .gitignore, even in subdirectories.
+    // The published templates use gitignore.template, rewritten here to real .gitignore.
+    if(files.has('gitignore.template')){files.set('.gitignore',files.get('gitignore.template'));files.delete('gitignore.template')}
+    if(files.has('.gitignore')) {
+      const ignores=files.get('.gitignore')
+      const additions=['.agents/','AGENTS.md','SKILLS.md','*.prompt.md','.ai/','.codex/','.cursor/','.claude/','.gemini/','.windsurf/','.aider*','.mcp.json','.vscode/mcp.json','.github/copilot-instructions.md','docs-private/','.npmrc','.env*','!.env.example']
+      files.set('.gitignore',ignores.trimEnd()+'\n\n# Local editor tooling and private maintenance files\n'+additions.filter(x=>!ignores.split(/\r?\n/).includes(x)).join('\n')+'\n')
+    }
+    if(!files.has('api/server.mjs')||!files.has('.env.example')||!files.has('index.html'))throw new Error('Incomplete source template')
+    files.set('.env.example',envChange(files.get('.env.example'),o))
+    if (o.devApi === 'vite') {
+      enableSpaViteRuntime(files, o)
+      files.set('api/config/capabilities.d.mts', 'export declare function assertCapabilities(): void\n')
+    }
+    if (o.pwa === 'on') enableSpaPwa(files,o)
+    if(o.ui==='quasar2' && o.render==='ssr') {
+      // R16 HTML has no Vite SPA identity marker; add one without touching frozen R16 sources.
+      const html=files.get('index.html')
+      files.set('index.html',html.replace('<meta charset="utf-8">','<meta charset="utf-8">\n    <meta name="r17-example" content="quasar-ssr">\n    <link rel="icon" href="data:image/svg+xml,%3Csvg xmlns=\'http://www.w3.org/2000/svg\'/%3E">'))
+    }
+    files.set('index.html',files.get('index.html').replace('__R17_CASE__',o.case).replace(/(<meta name="r17-example" content=")[^"]+("\s*\/?>)/,`$1${o.case}$2`))
+    const manifest=o.render==='spa'?spaManifest(o):o.ui==='quasar2'?quasarSSRManifest(o):JSON.parse(files.get('package.json'))
+    manifest.name=o.name;manifest.private=true
+    manifest.scripts={...manifest.scripts,'dev:all':o.devApi==='vite'?'vite --host 127.0.0.1':'node scripts/dev-all.mjs'}
+    files.set('package.json',JSON.stringify(manifest,null,2)+'\n')
+    files.set('README.md',generatedReadme(o))
+    // Keep the visible application description consistent with the actual dev API mode.
+    // The standalone production API is intentionally unaffected.
+    if (o.render === 'spa' && o.devApi === 'vite') {
+      const app = files.get('src/App.vue')
+      const separateDescription = 'Le service Feathers est exécuté dans un processus séparé.'
+      if (typeof app !== 'string' || !app.includes(separateDescription)) {
+        throw new Error('SPA description contract changed: refusing inconsistent Vite-native scaffold')
+      }
+      files.set('src/App.vue', app.replace(separateDescription,
+        'En développement, les services Feathers sont intégrés directement à Vite.'))
+    }
+    if (o.devApi !== 'vite') files.set('scripts/dev-all.mjs',await readFile(join(templates,'common',o.ui==='quasar2'&&o.render==='ssr'?'dev-all-quasar-ssr.mjs':'dev-all.mjs'),'utf8'))
+    // A configuration contract, not a simulated authentication or persistence layer.
+    // Non-memory databases and external identity providers fail closed at startup
+    // until explicitly integrated and tested with a real provider.
+    files.set('api/config/capabilities.mjs',capabilityGuard(o))
+    const server=files.get('api/server.mjs').replace("from 'vite-plugin-feathersjs'","from '@vevedh/vite-plugin-feathersjs'")
+    files.set('api/server.mjs',"import { assertCapabilities } from './config/capabilities.mjs'\nassertCapabilities()\n" + server)
+    files.set('api/config/README.md',`# Configuration des capacités\n\nProfil sélectionné : schéma ${o.schema}, identité ${o.auth}, connexions ${o.db}.\n\nLes services en mémoire et sans authentification sont destinés au laboratoire local. Les bases externes nécessitent une instance réelle, un client Feathers/Knex ou MongoDB, ses migrations et la vérification de son cycle de vie.\n\nL'authentification JWT exige un service utilisateurs, un secret hors Git, une stratégie JWT active, des contrôles d'accès et des tests. OAuth2, OIDC et Keycloak exigent en plus un fournisseur HTTPS, la vérification de l'issuer, audience, JWKS, PKCE et le mapping des identités. Ne pas exposer l'API avant validation.\n\nLa commande \`service add tickets --schema zod --db main\` crée un service et l'enregistre dans l'API.\n`)
+    files.set('api/config/profile.json',JSON.stringify({schema:o.schema,auth:o.auth,databases:o.databases,primary:o.databases[0].alias,operational:o.auth==='none' && o.databases.every(db=>db.adapter==='memory')},null,2)+'\n')
+    const depMap={typebox:['@feathersjs/typebox','ajv'],json:['ajv'],zod:['zod']}
+    // Dependencies for the service subcommand; project options alone create no arbitrary services.
+    for(const dep of depMap[o.schema])manifest.dependencies[dep] ||= dep==='ajv'?'^8.17.1':dep==='zod'?'^4.1.0':'^5.0.50'
+    if(o.auth==='jwt')manifest.dependencies['@feathersjs/authentication']='^5.0.50'
+    if(o.auth==='oauth2')manifest.dependencies['@feathersjs/authentication-oauth']='^5.0.50'
+    for(const db of o.databases) {
+      const drivers={mongodb:['@feathersjs/mongodb','mongodb'],postgresql:['@feathersjs/knex','knex','pg'],mariadb:['@feathersjs/knex','knex','mysql2'],mysql:['@feathersjs/knex','knex','mysql2'],sqlite:['@feathersjs/knex','knex','better-sqlite3']}
+      for(const dep of drivers[db.adapter]||[])manifest.dependencies[dep]||='*'
+    }
+    files.set('package.json',JSON.stringify(manifest,null,2)+'\n')
+    const list=[...files.keys()].sort()
+    const result={name:o.name,ui:o.ui,render:o.render,adapter:o.adapter,transport:o.transport,
+      destination:relative(report,o.destination).split(sep).join('/'),schema:o.schema,auth:o.auth,pwa:o.pwa,devApi:o.devApi,databases:o.databases,files:list}
+    if(o.dryRun)return result
+    // Do not follow symlinks and refuse any existing destination, including empty ones.
+    await mkdir(output,{recursive:true})
+    await rejectSymlinks(output)
+    await mkdir(o.destination,{recursive:false})
+    for(const [key,value] of [...files].sort(([a],[b])=>a.localeCompare(b,'en'))) {
+      const filepath=resolve(o.destination,key)
+      if(!filepath.startsWith(o.destination+sep))throw new Error('Template path escapes destination')
+      await mkdir(dirname(filepath),{recursive:true})
+      await writeFile(filepath,value.replace(/\r\n/g,'\n'),{flag:'wx'})
+    }
+    return result
+  }
+  return {parse,generate}
+}
+
+function quasarSSRManifest(o){
+  return {name:o.name,version:'0.1.0',private:true,type:'module',packageManager:'pnpm@10.30.2',engines:{node:'>=22.12'},
+    scripts:{'dev:ssr':'quasar dev -m ssr','build:ssr':'quasar build -m ssr',build:'quasar build -m ssr',
+      typecheck:'vue-tsc --noEmit', 'dev:api':'node --env-file=.env.example api/server.mjs',
+      'serve:production':'node dist/ssr/index.js',postinstall:'quasar prepare', 'dev:edge':'node scripts/edge-proxy.mjs'},
+    dependencies:{'@vevedh/vite-plugin-feathersjs':'0.2.6', '@feathersjs/feathers':'^5.0.50', '@feathersjs/koa':'^5.0.50',
+      '@feathersjs/express':'^5.0.50', '@feathersjs/errors':'^5.0.50', '@feathersjs/socketio':'^5.0.50',
+      '@feathersjs/rest-client':'^5.0.50', '@feathersjs/socketio-client':'^5.0.50',
+      '@quasar/extras':'^1.18.0',pinia:'^3.0.4',quasar:'^2.35.2','socket.io-client':'^4.8.4',
+      vue:'^3.5.44','vue-router':'^4.6.4',express:'^4.22.3','serialize-javascript':'^7.1.4'},
+    devDependencies:{'@quasar/app-vite':'2.6.2','@types/node':'^22.0.0',typescript:'^5.9.3','vue-tsc':'^3.3.14',
+      // Quasar app-vite 2.6.2 runs Express v4. Keep its ambient types in
+      // the same major as Express runtime, including nested pnpm dependencies.
+      '@types/express':'4.17.25','@types/express-serve-static-core':'4.19.9',vite:'^7.3.7'},
+    pnpm:{overrides:{'@types/express':'4.17.25','@types/express-serve-static-core':'4.19.9'}}}
+}
+function capabilityGuard(o) {
+ const external=o.databases.filter(x=>x.adapter!=='memory')
+ const desc=JSON.stringify({auth:o.auth,databases:o.databases})
+ return `// Generated capability contract: never silently downgrade identity or persistence.\n`+
+   `export const profile=Object.freeze(${desc})\n`+
+   `export function assertCapabilities(){\n`+
+   `  if (profile.auth !== 'none') throw new Error('Authentication '+profile.auth+' is a configuration blueprint; identity provider and JWT validation must be integrated and certified before serving requests')\n`+
+   `  const missing=profile.databases.filter(item=>item.adapter!=='memory')\n`+
+   `  if(missing.length)throw new Error('Database adapters not provisioned: '+missing.map(x=>x.alias+':'+x.adapter).join(', ')+'. Configure named adapters before serving requests')\n`+
+   `}\n`
+}

package/lib/services.mjs

@@ -0,0 +1,110 @@
+import { existsSync } from 'node:fs'
+import { lstat, mkdir, readFile, writeFile } from 'node:fs/promises'
+import { dirname, join, resolve, sep } from 'node:path'
+
+const VALID_NAME = /^[a-z][a-z0-9]*(?:-[a-z0-9]+)*$/
+const VALID_SCHEMA = new Set(['typebox','json','zod'])
+const VALID_AUTH = new Set(['none','jwt'])
+function safeName(s){return typeof s==='string' && s.length<=48 && VALID_NAME.test(s) && !/^(?:con|prn|aux|nul|com[1-9]|lpt[1-9])$/i.test(s)}
+async function rejectLinks(path){
+ let current=path
+ while(true){if(existsSync(current)&&(await lstat(current)).isSymbolicLink())throw new Error('Symlink path refused');const next=dirname(current);if(next===current)break;current=next}
+}
+export function parseServiceArguments(args){
+ if(args[0]!=='add')throw new Error('Use: service add <name> [--project <dir>] [--schema typebox|json|zod] [--db <alias>] [--auth none|jwt] [--dry-run]')
+ if(!safeName(args[1]))throw new Error('Invalid service name (lowercase kebab-case)')
+ const options={name:args[1],project:'.',schema:undefined,db:undefined,auth:undefined,dryRun:false}
+ const keys=new Map([['--project','project'],['--schema','schema'],['--db','db'],['--auth','auth']])
+ const seen=new Set()
+ for(let i=2;i<args.length;i++){
+  const flag=args[i]
+  if(seen.has(flag))throw new Error('Duplicate option: '+flag)
+  seen.add(flag)
+  if(flag==='--dry-run'){options.dryRun=true;continue}
+  if(!keys.has(flag))throw new Error('Unknown service option: '+flag)
+  const value=args[++i]
+  if(!value||value.startsWith('--'))throw new Error('Missing service option: '+flag)
+  options[keys.get(flag)]=value
+ }
+ if(!VALID_SCHEMA.has(options.schema??'typebox'))throw new Error('Invalid schema')
+ if(!VALID_AUTH.has(options.auth??'none'))throw new Error('Invalid service auth: none|jwt')
+ if(options.db!==undefined&&!safeName(options.db))throw new Error('Invalid database alias')
+ if(!/^\.?\/?[a-zA-Z0-9._/-]*$/.test(options.project)||options.project.includes('..')||options.project.includes('\\')||options.project.startsWith('/'))throw new Error('Unsafe project path; use a local relative directory')
+ return options
+}
+function schemaSource(schema){
+ const opening="import { BadRequest } from '@feathersjs/errors'\n"
+ if(schema==='zod')return opening+`import { z } from 'zod'
+export const dataSchema=z.object({title:z.string().trim().min(1).max(120)}).strict()
+export function validateData(value){const parsed=dataSchema.safeParse(value);if(!parsed.success)throw new BadRequest('Invalid service data');return parsed.data}
+`
+ const def=schema==='typebox'?`import { Type } from '@feathersjs/typebox'
+export const dataSchema=Type.Object({title:Type.String({minLength:1,maxLength:120})},{additionalProperties:false})
+`:`export const dataSchema={type:'object',additionalProperties:false,required:['title'],properties:{title:{type:'string',minLength:1,maxLength:120}}}
+`
+ return opening+`import Ajv from 'ajv'
+`+def+`const valid=new Ajv({allErrors:true}).compile(dataSchema)
+export function validateData(value){if(!valid(value))throw new BadRequest('Invalid service data');return {title:value.title.trim()}}
+`
+}
+function classSource(){return `import { NotFound, BadRequest } from '@feathersjs/errors'
+import { validateData } from './schema.mjs'
+export class GeneratedService {
+  #items=new Map()
+  #counter=1
+  constructor(){for(const method of ['find','get','create','patch','remove'])this[method]=this[method].bind(this)}
+  #id(value){const n=Number(value);if(!Number.isSafeInteger(n)||n<1)throw new BadRequest('Invalid ID');return n}
+  async find(){return [...this.#items.values()].map(x=>({...x}))}
+  async get(id){const item=this.#items.get(this.#id(id));if(!item)throw new NotFound('Not found');return {...item}}
+  async create(data){const row={id:this.#counter++,...validateData(data)};this.#items.set(row.id,row);return {...row}}
+  async patch(id,data){const key=this.#id(id);if(!this.#items.has(key))throw new NotFound('Not found');const row={id:key,...validateData(data)};this.#items.set(key,row);return {...row}}
+  async remove(id){const key=this.#id(id);const row=this.#items.get(key);if(!row)throw new NotFound('Not found');this.#items.delete(key);return {...row}}
+}
+`}
+function registrar(name,auth){
+ return `import { GeneratedService } from './service.class.mjs'
+${auth==='jwt'?"import { authenticate } from '@feathersjs/authentication'\n":''}export default function register(app){
+ app.use('${name}',new GeneratedService(),{methods:['find','get','create','patch','remove']})
+ ${auth==='jwt'?`app.service('${name}').hooks({before:{all:[authenticate('jwt')]}})`:'// This demonstration service has no authentication; bind HTTP only to loopback.'}
+}
+`
+}
+export async function generateService(opts, cwd=process.cwd()){
+ const project=resolve(cwd,opts.project)
+ if(opts.project!=='.' && !project.startsWith(resolve(cwd)+sep))throw new Error('Project escapes current directory')
+ await rejectLinks(project)
+ const manifestPath=join(project,'package.json'),serverPath=join(project,'api/server.mjs'),profilePath=join(project,'api/config/profile.json')
+ if(!existsSync(manifestPath)||!existsSync(serverPath)||!existsSync(profilePath))throw new Error('Not a CLI generated project')
+ const manifest=JSON.parse(await readFile(manifestPath,'utf8'))
+ const profile=JSON.parse(await readFile(profilePath,'utf8'))
+ const schema=opts.schema??profile.schema,auth=opts.auth??profile.auth,db=opts.db??profile.primary
+ if(!VALID_SCHEMA.has(schema))throw new Error('Invalid schema')
+ if(!VALID_AUTH.has(auth))throw new Error('Service supports none|jwt; OAuth2/OIDC/Keycloak require audited identity integration')
+ if(auth!=='none' && profile.auth!==auth)throw new Error('Service auth must match configured project profile')
+ const connection=profile.databases.find(x=>x.alias===db)
+ if(!connection)throw new Error('Unknown database alias: '+db)
+ const destination=join(project,'api/services',opts.name)
+ await rejectLinks(destination)
+ if(existsSync(destination))throw new Error('Service already exists; refusing overwrite')
+ const text=await readFile(serverPath,'utf8')
+ const marker='const modules = [\n'
+ if(!text.includes(marker))throw new Error('Missing Feathers modules registry; no changes made')
+ const moduleEntry=`  new URL('./services/${opts.name}/${opts.name}.service.mjs', import.meta.url),\n`
+ if(text.includes(moduleEntry))throw new Error('Duplicate service registration')
+ // Never replace a user-controlled arbitrary string outside of the explicit registry.
+ const output={name:opts.name,project,database:{alias:db,adapter:connection.adapter},auth,schema,files:[`api/services/${opts.name}/schema.mjs`,`api/services/${opts.name}/service.class.mjs`,`api/services/${opts.name}/${opts.name}.service.mjs`],ready:connection.adapter==='memory'&&auth==='none'}
+ if(opts.dryRun)return output
+ const dependencies=manifest.dependencies||{}
+ const deps=schema==='zod'?{'zod':'^4.1.0'}:schema==='typebox'?{'@feathersjs/typebox':'^5.0.50','ajv':'^8.17.1'}:{'ajv':'^8.17.1'}
+ if(auth==='jwt')deps['@feathersjs/authentication']='^5.0.50'
+ for(const [name,version] of Object.entries(deps))dependencies[name]??=version
+ await mkdir(destination,{recursive:false})
+ for(const [name,contents] of Object.entries({'schema.mjs':schemaSource(schema),'service.class.mjs':classSource(),[`${opts.name}.service.mjs`]:registrar(opts.name,auth)}))await writeFile(join(destination,name),contents,{flag:'wx'})
+ await writeFile(serverPath,text.replace(marker,marker+moduleEntry))
+ await writeFile(manifestPath,JSON.stringify({...manifest,dependencies},null,2)+'\n')
+ return output
+}
+export async function runServiceCommand(args,cwd){
+ const result=await generateService(parseServiceArguments(args),cwd)
+ console.log(JSON.stringify(result,null,2))
+}

package/package.json

@@ -1,6 +1,34 @@
 {
   "name": "@vevedh/create-feathers-app",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
-}
+  "version": "0.1.0-rc.4",
+  "type": "module",
+  "description": "Scaffold FeathersJS v5 projects with Quasar 2 or daisyUI, Vite, Vue 3 and Pinia",
+  "license": "MIT",
+  "bin": {
+    "create-feathers-app": "./bin/create-feathers-app.mjs"
+  },
+  "engines": {
+    "node": ">=22.12.0"
+  },
+  "files": [
+    "bin",
+    "lib",
+    "templates",
+    "README.md",
+    "LICENSE"
+  ],
+  "publishConfig": {
+    "access": "public"
+  },
+  "keywords": [
+    "create",
+    "scaffold",
+    "vite",
+    "feathersjs",
+    "quasar",
+    "daisyui",
+    "vue",
+    "ssr",
+    "ssg"
+  ]
+}

package/templates/common/dev-all-quasar-ssr.mjs

@@ -0,0 +1,37 @@
+#!/usr/bin/env node
+import { spawn } from 'node:child_process'
+import { existsSync } from 'node:fs'
+import { loadEnvFile } from 'node:process'
+import { setTimeout as sleep } from 'node:timers/promises'
+const file=existsSync('.env')?'.env':'.env.example'
+if (!existsSync(file))throw new Error('Missing .env.example')
+loadEnvFile(file)
+const env={...process.env}
+const children=[]
+let closed=false
+function stop(code=0){if(closed)return;closed=true;for(const child of children.slice().reverse())if(child.exitCode===null)try{child.kill()}catch{};process.exitCode=code}
+for(const signal of ['SIGINT','SIGTERM'])process.on(signal,()=>stop(signal==='SIGINT'?130:143))
+function start(label,command,args,opts={}) {
+ const proc=spawn(command,args,{env,stdio:'inherit',windowsHide:true,...opts})
+ children.push(proc)
+ proc.on('error',error=>{console.error(label,error.message);stop(1)})
+ proc.on('exit',code=>{if(!closed){console.error(label,'stopped',code);stop(code||1)}})
+ return proc
+}
+start('Feathers',process.execPath,[`--env-file=${file}`,'api/server.mjs'])
+let ready=false
+for(let attempt=0;attempt<90 && !closed;attempt++){
+ try{const res=await fetch('http://127.0.0.1:3030/api/health',{signal:AbortSignal.timeout(650)});if(res.ok){ready=true;break}}catch{}
+ await sleep(200)
+}
+if(!ready){console.error('Feathers health unavailable on loopback');stop(1)}
+if(!closed){
+ start('Quasar SSR',process.platform==='win32'?'corepack.cmd':'corepack',['pnpm','run','dev:ssr'],{shell:process.platform==='win32'})
+ let ssrReady=false
+ for(let attempt=0;attempt<150 && !closed;attempt++){
+  try{const res=await fetch('http://127.0.0.1:9100/',{signal:AbortSignal.timeout(800)});if(res.ok){ssrReady=true;break}}catch{}
+  await sleep(350)
+ }
+ if(!ssrReady){console.error('Quasar SSR unavailable on loopback :9100');stop(1)}
+ else start('Edge',process.execPath,['scripts/edge-proxy.mjs'])
+}

package/templates/common/dev-all.mjs

@@ -0,0 +1,46 @@
+#!/usr/bin/env node
+// Starts Feathers first, then the frontend, with one controlled shutdown.
+import { spawn } from 'node:child_process'
+import { existsSync } from 'node:fs'
+import { loadEnvFile } from 'node:process'
+import { setTimeout as sleep } from 'node:timers/promises'
+
+const file=existsSync('.env') ? '.env' : '.env.example'
+if(!existsSync(file))throw new Error('Missing .env.example')
+loadEnvFile(file)
+const usesVite=existsSync('src/main.ts')
+const isSSG=existsSync('scripts/serve-static.mjs')
+const env={...process.env}
+const processes=[]
+let stopped=false
+function stop(code=0){
+  if(stopped)return
+  stopped=true
+  for(const p of [...processes].reverse())if(p.exitCode===null)try{p.kill()}catch{}
+  process.exitCode=code
+}
+process.on('SIGINT',()=>stop(130))
+process.on('SIGTERM',()=>stop(143))
+const api=spawn(process.execPath,[`--env-file=${file}`,'api/server.mjs'],{env,stdio:'inherit',windowsHide:true})
+processes.push(api)
+api.once('error',err=>{console.error('Feathers:',err.message);stop(1)})
+api.once('exit',code=>{if(!stopped){console.error('Feathers stopped:',code);stop(code||1)}})
+const port=Number(env.FEATHERS_API_PORT||3030)
+let ready=false
+for(let i=0;i<80 && !stopped;i++){
+  if(api.exitCode!==null)break
+  try {
+    const res=await fetch(`http://127.0.0.1:${port}/api/health`,{signal:AbortSignal.timeout(700)})
+    if(res.ok && (await res.json()).transport==='feathers-v5'){ready=true;break}
+  }catch{}
+  await sleep(200)
+}
+if(!ready){console.error('API Feathers non disponible sur 127.0.0.1:'+port);stop(1)}
+if(!stopped){
+  const args=usesVite?['node_modules/vite/bin/vite.js','--host','127.0.0.1','--port','5173','--strictPort']
+    :[isSSG?'node_modules/vite/bin/vite.js':'scripts/serve-ssr.mjs',...(isSSG?['--host','127.0.0.1','--port','5173','--strictPort']:[])]
+  const ui=spawn(process.execPath,args,{env,stdio:'inherit',windowsHide:true})
+  processes.push(ui)
+  ui.once('error',err=>{console.error('Frontend:',err.message);stop(1)})
+  ui.once('exit',code=>{if(!stopped){console.error('Frontend stopped:',code);stop(code||1)}})
+}

package/templates/daisyui-ssg/.env.example

@@ -0,0 +1,6 @@
+# Local demonstration only. No secrets or private addresses.
+FEATHERS_ADAPTER=koa
+FEATHERS_API_PORT=3030
+FEATHERS_SOCKET_PORT=3031
+FEATHERS_SOCKETIO=0
+FEATHERS_PUBLIC_ORIGIN=http://127.0.0.1:5173

package/templates/daisyui-ssg/README.md

@@ -0,0 +1,21 @@
+# daisyUI SSG — FeathersJS v5
+
+Exemple de rendu SSG avec Vue 3, Pinia, Vite 7 et Tailwind CSS/daisyUI. Le service FeathersJS v5 est exécuté dans un processus indépendant. Les pages statiques ne contiennent pas de notes ni de secrets. Données de démonstration uniquement, sans authentification.
+
+```powershell
+corepack pnpm install
+# Terminal 1 : API Feathers
+corepack pnpm run dev:api
+# Terminal 2 : frontend
+corepack pnpm run dev
+```
+
+```powershell
+corepack pnpm run typecheck
+corepack pnpm run build
+corepack pnpm run serve:production
+```
+
+En développement, Vite sert une application cliente. Le build pré-rend `/` et `/about` dans `dist/ssg`. Seules des pages publiques sont générées ; le service `notes` reste dynamique et nécessite une API accessible en production. Prévoir la configuration de proxy `/api` sur le serveur statique.
+
+La certification Windows complète reste à exécuter. Ne pas exposer publiquement l’API de démonstration en mémoire, sans authentification.

package/templates/daisyui-ssg/api/server.mjs

@@ -0,0 +1,45 @@
+import { createServer } from 'node:http'
+import { createFeathersRuntime } from '@vevedh/vite-plugin-feathersjs'
+const adapter = process.env.FEATHERS_ADAPTER === 'express' ? 'express' : 'koa'
+const port = Number(process.env.FEATHERS_API_PORT || 3030)
+const wsPort = Number(process.env.FEATHERS_SOCKET_PORT || 3031)
+const realtime = process.env.FEATHERS_SOCKETIO === '1'
+const origin = process.env.FEATHERS_PUBLIC_ORIGIN || 'http://127.0.0.1:5173'
+if (!Number.isInteger(port) || port < 1024 || port > 65535 || !Number.isInteger(wsPort) || wsPort === port) throw new Error('Invalid port configuration')
+const modules = [
+  new URL('./services/health/health.service.mjs', import.meta.url),
+  new URL('./services/notes/notes.service.mjs', import.meta.url),
+]
+const runtime = await createFeathersRuntime(modules.map(String), file => import(file), {
+  serviceFiles: [], adapter, prefix: '/api', cors: false,
+  socketio: realtime ? { port: wsPort, origins: [origin], host: '127.0.0.1' } : false,
+})
+await runtime.start()
+const httpServer = createServer((req, res) => {
+  const pathname = new URL(req.url || '/', 'http://localhost').pathname
+  if (pathname !== '/api' && !pathname.startsWith('/api/')) {
+    res.writeHead(404, { 'content-type': 'application/json' }); res.end('{"error":"Not found"}'); return
+  }
+  // The Feathers transport is mounted at /api, while its services register as health/notes.
+  req.url = (req.url || '/').slice(4) || '/'
+  runtime.handler(req, res, error => {
+    if (res.headersSent) { res.end(); return }
+    res.writeHead(500, { 'content-type': 'application/json' })
+    res.end(JSON.stringify({ error: 'Internal server error' }))
+    if (error) console.error('[feathers] request failed')
+  })
+})
+await new Promise((resolve, reject) => {
+  httpServer.once('error', reject)
+  httpServer.listen(port, '127.0.0.1', resolve)
+})
+console.log(`Feathers ${adapter} API listening on http://127.0.0.1:${port}/api (socketio=${realtime})`)
+let stopping = false
+async function close() {
+  if (stopping) return
+  stopping = true
+  await new Promise(resolve => httpServer.close(resolve))
+  await runtime.close()
+}
+process.on('SIGINT', () => { void close().then(() => process.exit(0)) })
+process.on('SIGTERM', () => { void close().then(() => process.exit(0)) })

package/templates/daisyui-ssg/api/services/health/health.class.mjs

@@ -0,0 +1,3 @@
+export class HealthService {
+  async find() { return { status: 'ok', transport: 'feathers-v5' } }
+}

package/templates/daisyui-ssg/api/services/health/health.service.mjs

@@ -0,0 +1,4 @@
+import { HealthService } from './health.class.mjs'
+export default function register(app) {
+  app.use('health', new HealthService(), { methods: ['find'] })
+}