@vevedh/create-feathers-app 0.1.0-rc.1 → 0.1.0-rc.5

package/README.md

@@ -1,43 +1,80 @@
 # create-feathers-app
 
-Create local FeathersJS v5 applications with Vue 3, Pinia and Vite. Choose Quasar 2 or Tailwind CSS + daisyUI.
+Générez des applications FeathersJS v5 avec Vue 3, Pinia, Vite, Quasar 2 ou Tailwind CSS + daisyUI.
 
-This package is a separate command-line tool. The runtime integration is published as [`@vevedh/vite-plugin-feathersjs`](https://www.npmjs.com/package/@vevedh/vite-plugin-feathersjs).
+Le CLI est indépendant du runtime [`@vevedh/vite-plugin-feathersjs`](https://www.npmjs.com/package/@vevedh/vite-plugin-feathersjs) (version 0.2.6). La version candidate `0.1.0-rc.4` **n'est pas encore publiée**. Elle ajoute la PWA optionnelle au rendu SPA.
 
 ## Usage
 
 ```powershell
-npm exec --package @vevedh/create-feathers-app -- create-feathers-app portail --ui quasar2 --render spa --adapter koa --transport rest
+# Préversion disponible sur npm : 0.1.0-rc.1
+npm exec --yes --package=@vevedh/create-feathers-app@0.1.0-rc.1 -- create-feathers-app portail --ui daisyui --render spa
+
+# R17-r3 candidat, depuis les sources mises en stage :
+node .release/create-feathers-app/bin/create-feathers-app.mjs portail-ssr --ui quasar2 --render ssr
 ```
 
-After npm publication, `npm create @vevedh/feathers-app@latest portail -- --ui daisyui --render ssr` can be used (depending on npm's argument forwarding).
+| Interface | SPA | SSR | SSG |
+| --- | --- | --- | --- |
+| Quasar 2 | Générable | Générable, validation Windows en cours | Bloqué |
+| daisyUI 5 | Générable | Générable | Générable |
 
-For a local candidate, run `node bin/create-feathers-app.mjs --help` from this package.
+## PWA optionnelle (SPA uniquement)
 
-| UI | SPA | SSR | SSG |
-| --- | --- | --- | --- |
-| Quasar 2 | Yes | R16 standalone example only | Unsupported on certified CLI |
-| daisyUI 5 | Yes | Yes | Yes |
+Le paramètre `--pwa on` ajoute `vite-plugin-pwa` v2 en dépendance de développement, une icône SVG locale de démonstration et un manifeste Web App. Le service worker, désactivé en développement, est généré au build et conserve uniquement des ressources statiques, jamais les réponses `/api` ou les échanges Socket.IO. Par défaut, `--pwa off` ne change pas les templates existants.
+
+```powershell
+node .release/create-feathers-app/bin/create-feathers-app.mjs portail-spa --ui quasar2 --render spa --pwa on --dry-run
+```
+
+SSR/SSG avec PWA est refusé tant que leur cycle de vie n'est pas certifié. Pour une installation sur les navigateurs ciblés, remplacer l'icône SVG de démonstration par des icônes PNG 192 et 512 pixels, puis contrôler HTTPS, les mises à jour et le mode hors-ligne.
+
+## Ajouter un service Feathers
 
-Generated projects include an independent Feathers REST API (`health`, `notes`), Koa or Express, Pinia, a `.env.example` and a `dev:all` command. Socket.IO is optional for the SPA variants only.
+```powershell
+cd portail
+node ../chemin/vers/create-feathers-app/bin/create-feathers-app.mjs service add tickets --schema zod --db main
+```
 
-## Options
+Le générateur ajoute le module `api/services/tickets` et son inscription dans le registre Feathers. Les schémas disponibles sont `typebox`, `json` et `zod`. Le service mémoire est destiné au laboratoire local, avec CRUD REST et validation des données.
 
-`--name`, `--dir`, `--ui`, `--render`, `--adapter`, `--transport`, `--dry-run`, `--json`, `--help`, `--version`.
+## Profils d'identité et de bases
 
-## Windows development
+La création de projet accepte `--auth none|jwt|oauth2|oidc|keycloak`, `--schema typebox|json|zod` et `--db main:memory,audit:mongodb` avec alias nommés. **Les authentifications externes et les connexions persistantes sont des profils de configuration, pas des intégrations opérationnelles.** L'API échoue volontairement au démarrage jusqu'au raccordement et à la certification du fournisseur ou du SGBD.
+
+Les projets sans authentification sont exclusivement des démonstrations locales. Ils ne doivent jamais être exposés tels quels sur Internet. Aucun secret, mot de passe ou jeton n'est inclus dans les templates.
+
+## Windows
 
 ```powershell
 corepack pnpm install
-corepack pnpm run dev:all
 corepack pnpm run typecheck
 corepack pnpm run build
+corepack pnpm run dev:all
 ```
 
-Generated apps are local demonstrations with an in-memory notes service and no authentication. Do not expose them directly on the Internet.
+SPA et daisyUI SSR/SSG utilisent `http://127.0.0.1:5173`. Quasar SSR utilise `http://127.0.0.1:8080` via un proxy local ; le SSR brut écoute sur 9100.
+
+La documentation publique VitePress figure dans `docs/cli` du dépôt et sera déployée sur GitHub Pages après activation du workflow de publication.
 
-The CLI does not generate OAuth/JWT, persistent databases, PWA or Quasar SSR/SSG yet.
+## API Feathers intégrée à Vite en développement (RC4)
 
-## Documentation
+Pour les applications SPA, `--dev-api vite` est désormais la valeur par défaut.
+Le plugin public `@vevedh/vite-plugin-feathersjs@0.2.6` est chargé depuis
+`vite.config.ts` et monte les services sur `/api` pendant `vite dev`.
+Il n'y a pas de second serveur REST ni de proxy REST à démarrer.
+
+L'option `--dev-api separate` conserve l'ancien comportement à deux processus.
+Pour SSR/SSG, le mode séparé reste obligatoire. Avec `--transport both`,
+Socket.IO reste sur le port privé `127.0.0.1:3031`, accessible depuis la SPA
+via le proxy WebSocket Vite. La configuration de Feathers échoue au chargement
+si les profils d'identité ou bases externes ne sont pas opérationnels.
+
+```powershell
+node .release/create-feathers-app/bin/create-feathers-app.mjs mon-spa --ui quasar2 --render spa --dev-api vite --transport both
+```
 
-A complete French VitePress guide is included in the companion repository under `docs/cli` (installation, rendering modes, Windows, Feathers services, security and publishing). The documentation site is built and hosted separately from this npm package.
+**Production** : le plugin Vite s'exécute uniquement en développement.
+Le serveur `api/server.mjs` autonome reste disponible et obligatoire pour
+le déploiement ; `vite preview` n'héberge pas l'API.
+Le runtime `0.2.6` n'a pas été modifié.

package/bin/create-feathers-app.mjs

@@ -3,6 +3,7 @@ import { dirname,resolve } from 'node:path'
 import { fileURLToPath } from 'node:url'
 import { readFile } from 'node:fs/promises'
 import { createGenerator } from '../lib/scaffold.mjs'
+import { runServiceCommand } from '../lib/services.mjs'
 const packageRoot=resolve(dirname(fileURLToPath(import.meta.url)),'..')
 const {version}=JSON.parse(await readFile(resolve(packageRoot,'package.json'),'utf8'))
 const args=process.argv.slice(2)
@@ -16,13 +17,23 @@ Usage: create-feathers-app <name> [options]
   --render <spa|ssr|ssg>  Default spa
   --adapter <koa|express>  Default koa
   --transport <rest|both>  Default rest (both only for SPA)
+  --pwa <on|off>      Optional offline SPA shell (default off, no API caching)
+  --dev-api <vite|separate>    SPA default vite; SSR/SSG always separate
   --dry-run           Preview files without writing
   --json              Machine-readable output
+  --schema <typebox|json|zod>     Service schema preset (default typebox)
+  --auth <none|jwt|oauth2|oidc|keycloak>  Identity configuration blueprint
+  --db <alias:adapter[,alias:adapter]>    Named connections (default main:memory)
   --version           Print CLI version
 
-Available: Quasar 2 SPA; daisyUI SPA, SSR, SSG.
-Quasar SSR: certified example in the companion repository; Quasar SSG not supported.`)
+Service: create-feathers-app service add <name> [--project <path>] [--schema typebox|json|zod] [--db <alias>] [--auth none|jwt] [--lang js|ts] [--dry-run]
+
+Available: Quasar 2 SPA/SSR; daisyUI SPA, SSR, SSG.
+Quasar SSR uses the R16-certified architecture; R17-generated SSR requires its own Windows E2E certification. Quasar SSG not supported.`)
 }else if(args.includes('--version')||args.includes('-v'))console.log(version)
+else if(args[0]==='service') {
+  try { await runServiceCommand(args.slice(1),process.cwd()) } catch(error){console.error(`FAIL: ${error.message}`);process.exitCode=1}
+}
 else {
   const {parse,generate}=createGenerator({outputRoot:process.cwd(),templatesRoot:resolve(packageRoot,'templates'),reportRoot:process.cwd()})
   try {

package/lib/scaffold.mjs

@@ -3,9 +3,10 @@ import { existsSync } from 'node:fs'
 import { dirname, join, relative, resolve, sep } from 'node:path'
 import { buildProjectPlan } from './planner/plan.mjs'
 
-const KEYS = new Set(['--name', '--dir', '--ui', '--render', '--adapter', '--transport', '--dry-run', '--json'])
+const KEYS = new Set(['--name', '--dir', '--ui', '--render', '--adapter', '--transport', '--dry-run', '--json', '--schema', '--auth', '--db', '--pwa', '--dev-api'])
 const CASES = Object.freeze({
   'quasar2:spa': 'quasar-spa',
+  'quasar2:ssr': 'quasar-ssr',
   'daisyui:spa': 'daisyui-spa',
   'daisyui:ssr': 'daisyui-ssr',
   'daisyui:ssg': 'daisyui-ssg',
@@ -50,6 +51,7 @@ function spaManifest(o) {
     vite:'^7.3.7', '@vitejs/plugin-vue':'^6.0.0', 'vue-tsc':'^3.0.7',
     typescript:'^5.9.3', '@types/node':'^22.0.0',
   }
+  if (o.pwa === 'on') devDependencies['vite-plugin-pwa'] = '^2.0.0'
   if (o.ui === 'quasar2') { dependencies.quasar = '^2.35.2'; devDependencies['@quasar/vite-plugin']='^1.12.0';devDependencies['sass-embedded']='^1.93.2' }
   else { devDependencies.tailwindcss='^4.1.0';devDependencies['@tailwindcss/vite']='^4.1.0';devDependencies.daisyui='^5.0.0' }
   return {name:o.name,version:'0.1.0',private:true,type:'module',packageManager:'pnpm@10.30.2',engines:{node:'>=22.12'},
@@ -60,19 +62,100 @@ function spaManifest(o) {
 function generatedReadme(o) {
   const renderInfo = o.render === 'ssg' ? 'Le build pré-rend les routes publiques / et /about. Les notes restent dynamiques via /api.'
     : o.render === 'ssr' ? 'Le serveur Node effectue le SSR avec un état Pinia distinct par requête.'
-      : 'Le frontend est une SPA Vite. L’API Feathers s’exécute séparément.'
+      : o.devApi === 'vite'
+        ? 'En développement, le plugin Vite monte les services Feathers directement sur /api. En production, l’API doit être lancée et déployée séparément.'
+        : 'Le frontend est une SPA Vite. En développement, une API Feathers indépendante écoute sur 127.0.0.1:3030.'
   return `# ${o.name}\n\nProjet ${o.ui} ${o.render.toUpperCase()} avec Vue 3, Pinia et FeathersJS v5 (${o.adapter}, ${o.transport}).\n\n`+
   `${renderInfo}\n\n## Démarrage local (Windows / PowerShell)\n\n`+
   '```powershell\ncorepack pnpm install\ncorepack pnpm run dev:all\n```\n\n' +
-  'Ouvrir http://127.0.0.1:5173. L’API utilise http://127.0.0.1:3030.\n\n' +
+  (o.devApi === 'vite' ? 'Ouvrir http://127.0.0.1:5173. Pendant le développement, Feathers REST est servi sur le même port via /api.\n\n' : 'Ouvrir http://127.0.0.1:5173. L’API indépendante utilise http://127.0.0.1:3030.\n\n') +
   '```powershell\ncorepack pnpm run typecheck\ncorepack pnpm run build\n```\n\n' +
   (o.render !== 'spa' ? 'Pour vérifier le build, lancer `corepack pnpm run serve:production` avec l’API active.\n\n' : '') +
-  'Les données sont en mémoire, sans authentification. Cet exemple est réservé au laboratoire local et ne doit pas être exposé sur Internet.\n'
+  (o.devApi === 'vite' ? 'Le plugin Vite est actif en développement uniquement. `pnpm run preview` sert les fichiers statiques et ne démarre pas l’API. Pour tester la SPA construite avec CRUD, lancer `corepack pnpm run dev:api` dans un premier terminal puis `corepack pnpm run preview` dans un second. Le proxy `preview.proxy` relaie /api vers 127.0.0.1:3030 (et Socket.IO vers 3031 si activé). En l’absence de backend, l’interface affiche « API indisponible » ; hors ligne, seule la coque statique reste disponible. Ne jamais exposer le serveur de démonstration sans authentification.\n\n' : '') +
+  `Profil: schema ${o.schema}; auth ${o.auth}; databases ${o.db}. Les profils d'identité et les bases externes nécessitent un raccordement explicite.\n\n`+
+  (o.ui==='quasar2' && o.render==='ssr'?'Quasar SSR : ouvrir http://127.0.0.1:8080 (reverse proxy local). Ne pas exposer le serveur SSR directement.\n\n':'')+
+  (o.pwa === 'on' ? 'PWA SPA activée : le service worker n’est produit qu’au build. Il met en cache les ressources statiques uniquement, jamais les réponses API ou Socket.IO.\nL’icône SVG d’exemple doit être remplacée par des icônes PNG 192/512 adaptées avant une distribution publique. En HTTPS, tester les mises à jour et l’installation sur le navigateur cible.\n\n' : '') +
+  'Les données de démonstration sont en mémoire ; sans authentification les services ne doivent pas être exposés publiquement.\n'
 }
+/** Replace the SPA proxy with the public Vite plugin. The standalone API remains for production. */
+function enableSpaViteRuntime(files, options) {
+  const source = files.get('vite.config.ts')
+  const marker = 'plugins: [vue(),'
+  const oldProxy = ",\n    proxy: { '/api': 'http://127.0.0.1:3030', '/socket.io': { target: 'ws://127.0.0.1:3031', ws: true } }"
+  if (typeof source !== 'string' || !source.includes(marker) || !source.includes(oldProxy)) {
+    throw new Error('Unsupported SPA Vite template for embedded Feathers; refusing partial generation')
+  }
+  const realtime = options.transport === 'both'
+  const socket = realtime
+    ? "{ port: 3031, host: '127.0.0.1', origins: ['http://127.0.0.1:5173'] }"
+    : 'false'
+  const runtime = `feathers({
+    serviceFiles: 'api/services/*/*.service.mjs',
+    watchDirectories: ['api/services'],
+    adapter: ${JSON.stringify(options.adapter)},
+    prefix: '/api',
+    lifecycle: 'managed',
+    cors: false,
+    socketio: ${socket},
+  })`
+  // 'vite preview' serves static assets: the Feathers Vite plugin is dev-only.
+  // Proxy API traffic to the separately started, loopback-bound demo API.
+  const previewProxy = `preview: { host: '127.0.0.1', port: 4173, strictPort: true,
+    proxy: { '/api': 'http://127.0.0.1:3030',${realtime ? " '/socket.io': { target: 'ws://127.0.0.1:3031', ws: true }" : ''} } },`
+  const socketProxy = realtime
+    ? ",\n    proxy: { '/socket.io': { target: 'ws://127.0.0.1:3031', ws: true } }"
+    : ''
+  files.set('vite.config.ts',
+    `import feathers from '@vevedh/vite-plugin-feathersjs'\n` +
+    `import { assertCapabilities } from './api/config/capabilities.mjs'\n` +
+    source.replace(marker, `${marker} ${runtime},`).replace(oldProxy, socketProxy)
+      .replace('export default defineConfig({',
+        '// Do not silently start an unprotected or unconfigured identity/database service.\nassertCapabilities()\nexport default defineConfig({\n' +
+        `  ${previewProxy}\n` +
+        `  define: { 'import.meta.env.VITE_FEATHERS_REALTIME': '${JSON.stringify(realtime ? '1' : '0')}' },`))
+}
+
+/** PWA is opt-in, SPA-only, and must never cache API or realtime responses. */
+function enableSpaPwa(files, options) {
+  const config = files.get('vite.config.ts')
+  const marker = 'plugins: [vue(),'
+  if (typeof config !== 'string' || !config.includes(marker) || config.includes('vite-plugin-pwa')) {
+    throw new Error('Unsupported Vite SPA template for PWA; refusing partial generation')
+  }
+  const pwa = `VitePWA({
+      registerType: 'prompt',
+      injectRegister: 'auto',
+      devOptions: { enabled: false },
+      includeAssets: ['pwa-icon.svg'],
+      manifest: {
+        name: ${JSON.stringify(options.name)},
+        short_name: ${JSON.stringify(options.name)},
+        description: 'Application Feathers et Vue',
+        lang: 'fr',
+        start_url: '/',
+        scope: '/',
+        display: 'standalone',
+        background_color: '#ffffff',
+        theme_color: '#ffffff',
+        icons: [{ src: '/pwa-icon.svg', sizes: 'any', type: 'image/svg+xml', purpose: 'any' }],
+      },
+      workbox: {
+        globPatterns: ['**/*.{js,css,html,svg}'],
+        globIgnores: ['**/api/**', '**/socket.io/**'],
+        navigateFallback: '/index.html',
+        navigateFallbackDenylist: [/^\\/api(?:\\/|$)/, /^\\/socket\\.io(?:\\/|$)/],
+        runtimeCaching: [],
+      },
+    })`
+  files.set('vite.config.ts', `import { VitePWA } from 'vite-plugin-pwa'\n${config.replace(marker, `${marker} ${pwa},`)}`)
+  if (files.has('public/pwa-icon.svg')) throw new Error('PWA icon conflict in source template')
+  files.set('public/pwa-icon.svg', '<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 192 192" role="img" aria-label="Feathers app"><rect width="192" height="192" rx="40" fill="#1e293b"/><path d="M44 96l40 40 64-80" fill="none" stroke="#fff" stroke-width="14" stroke-linecap="round" stroke-linejoin="round"/></svg>\n')
+}
+
 export function createGenerator({outputRoot, templatesRoot, examplesRoot = templatesRoot, reportRoot = outputRoot}) {
   const output = resolve(outputRoot), templates = resolve(templatesRoot), report = resolve(reportRoot)
   function parse(args) {
-    const o={ui:'daisyui',render:'spa',adapter:'koa',transport:'rest',dryRun:false,json:false}
+    const o={ui:'daisyui',render:'spa',adapter:'koa',transport:'rest',schema:'typebox',auth:'none',db:'main:memory',pwa:'off',devApi:undefined,dryRun:false,json:false}
     const seen=new Set()
     if (args.length && !args[0].startsWith('-')) {o.name=args[0];args=args.slice(1);if(args.includes('--name'))throw new Error('Use either positional name or --name, not both')}
     for(let i=0;i<args.length;i++) {
@@ -80,20 +163,30 @@ export function createGenerator({outputRoot, templatesRoot, examplesRoot = templ
       if(!KEYS.has(flag)||seen.has(flag))throw new Error(`Unknown or duplicate option: ${flag}`)
       seen.add(flag)
       if(flag==='--dry-run'||flag==='--json') o[flag==='--dry-run'?'dryRun':'json']=true
-      else { const value=args[++i];if(!value||value.startsWith('--'))throw new Error(`Missing ${flag}`);o[flag.slice(2)]=value }
+      else { const value=args[++i];if(!value||value.startsWith('--'))throw new Error(`Missing ${flag}`);o[flag==='--dev-api'?'devApi':flag.slice(2)]=value }
     }
     if(!safeProjectName(o.name))throw new Error('Invalid or missing --name (lowercase kebab-case, max 48 characters)')
+    o.devApi ??= o.render === 'spa' ? 'vite' : 'separate'
+    if (!['vite','separate'].includes(o.devApi)) throw new Error('Invalid --dev-api: expected vite|separate')
+    if (o.devApi === 'vite' && o.render !== 'spa') throw new Error('--dev-api vite is supported for SPA only; SSR/SSG require separate API')
     if(!['koa','express'].includes(o.adapter))throw new Error('Only koa|express adapters are supported')
     if(!['rest','both'].includes(o.transport))throw new Error('Only rest|both are supported')
+    if (!['on','off'].includes(o.pwa)) throw new Error('Invalid --pwa: expected on|off')
+    if (o.pwa==='on' && o.render!=='spa') throw new Error('PWA is supported for SPA only; SSR/SSG require separate certification')
+    if (!['typebox','json','zod'].includes(o.schema)) throw new Error('Invalid --schema: expected typebox|json|zod')
+    if (!['none','jwt','oauth2','oidc','keycloak'].includes(o.auth)) throw new Error('Invalid --auth: expected none|jwt|oauth2|oidc|keycloak')
+    if (!/^[a-z][a-z0-9-]{0,31}:(?:memory|mongodb|postgresql|mariadb|mysql|sqlite)(?:,[a-z][a-z0-9-]{0,31}:(?:memory|mongodb|postgresql|mariadb|mysql|sqlite))*$/.test(o.db)) throw new Error('Invalid --db: use alias:adapter[,alias:adapter]')
+    const dbPairs=o.db.split(',').map(x=>{const [alias,adapter]=x.split(':');return {alias,adapter}})
+    if(new Set(dbPairs.map(x=>x.alias)).size!==dbPairs.length)throw new Error('Duplicate database alias')
     // Reuse the actual R15 planner as the capability validator, not a separate feature catalogue.
     const plan=buildProjectPlan({name:o.name,ui:o.ui,render:o.render,transport:o.transport,
-      engine:'auto',auth:'none',db:'main:memory',pwa:'off',schema:'typebox'})
-    if(!CASES[`${o.ui}:${o.render}`])throw new Error('Unsupported combination: Quasar2 supports SPA; daisyui supports SPA, SSR, SSG')
+      engine:'auto',auth:o.auth==='oauth2'?'jwt,oauth':o.auth==='oidc'||o.auth==='keycloak'?'jwt,oidc':o.auth,db:o.db,primary:dbPairs[0].alias,pwa:o.pwa,schema:o.schema})
+    if(!CASES[`${o.ui}:${o.render}`])throw new Error('Unsupported combination: Quasar2 supports SPA/SSR; daisyui supports SPA/SSR/SSG')
     if(o.render!=='spa' && o.transport!=='rest')throw new Error('SSR/SSG supports REST only; Socket.IO proxy not certified')
     if(o.dir!==undefined && !safeProjectName(o.dir))throw new Error('--dir must be a single safe directory name')
     o.destination=resolve(output,o.dir||o.name)
     if(dirname(o.destination)!==output)throw new Error('Destination escapes output root')
-    o.case=CASES[`${o.ui}:${o.render}`];o.plan=plan
+    o.case=CASES[`${o.ui}:${o.render}`];o.plan=plan;o.databases=dbPairs
     return o
   }
   async function generate(o) {
@@ -103,22 +196,83 @@ export function createGenerator({outputRoot, templatesRoot, examplesRoot = templ
     const files=new Map(o.render==='spa' ? [
       ...await walk(join(templates,'spa','common')),
       ...await walk(join(templates,'spa',o.ui)),
-    ] : await walk(join(resolve(examplesRoot),`daisyui-${o.render}`)))
+    ] : await walk(join(resolve(examplesRoot),`${o.ui==='quasar2'?'quasar':'daisyui'}-${o.render}`)))
     // npm pack excludes files literally named .gitignore, even in subdirectories.
     // The published templates use gitignore.template, rewritten here to real .gitignore.
     if(files.has('gitignore.template')){files.set('.gitignore',files.get('gitignore.template'));files.delete('gitignore.template')}
+    if(files.has('.gitignore')) {
+      const ignores=files.get('.gitignore')
+      const additions=['.agents/','AGENTS.md','SKILLS.md','*.prompt.md','.ai/','.codex/','.cursor/','.claude/','.gemini/','.windsurf/','.aider*','.mcp.json','.vscode/mcp.json','.github/copilot-instructions.md','docs-private/','.npmrc','.env*','!.env.example','api/.create-feathers-service.lock']
+      files.set('.gitignore',ignores.trimEnd()+'\n\n# Local editor tooling and private maintenance files\n'+additions.filter(x=>!ignores.split(/\r?\n/).includes(x)).join('\n')+'\n')
+    }
     if(!files.has('api/server.mjs')||!files.has('.env.example')||!files.has('index.html'))throw new Error('Incomplete source template')
     files.set('.env.example',envChange(files.get('.env.example'),o))
+    if (o.devApi === 'vite') {
+      enableSpaViteRuntime(files, o)
+      files.set('api/config/capabilities.d.mts', 'export declare function assertCapabilities(): void\n')
+    }
+    if (o.pwa === 'on') enableSpaPwa(files,o)
+    if(o.ui==='quasar2' && o.render==='ssr') {
+      // R16 HTML has no Vite SPA identity marker; add one without touching frozen R16 sources.
+      const html=files.get('index.html')
+      files.set('index.html',html.replace('<meta charset="utf-8">','<meta charset="utf-8">\n    <meta name="r17-example" content="quasar-ssr">\n    <link rel="icon" href="data:image/svg+xml,%3Csvg xmlns=\'http://www.w3.org/2000/svg\'/%3E">'))
+    }
     files.set('index.html',files.get('index.html').replace('__R17_CASE__',o.case).replace(/(<meta name="r17-example" content=")[^"]+("\s*\/?>)/,`$1${o.case}$2`))
-    const manifest=o.render==='spa'?spaManifest(o):JSON.parse(files.get('package.json'))
+    const manifest=o.render==='spa'?spaManifest(o):o.ui==='quasar2'?quasarSSRManifest(o):JSON.parse(files.get('package.json'))
     manifest.name=o.name;manifest.private=true
-    manifest.scripts={...manifest.scripts,'dev:all':'node scripts/dev-all.mjs'}
+    manifest.scripts={...manifest.scripts,'dev:all':o.devApi==='vite'?'vite --host 127.0.0.1':'node scripts/dev-all.mjs'}
     files.set('package.json',JSON.stringify(manifest,null,2)+'\n')
     files.set('README.md',generatedReadme(o))
-    files.set('scripts/dev-all.mjs',await readFile(join(templates,'common','dev-all.mjs'),'utf8'))
+    // Keep the visible application description consistent with the actual dev API mode.
+    // The standalone production API is intentionally unaffected.
+    if (o.render === 'spa' && o.devApi === 'vite') {
+      const app = files.get('src/App.vue')
+      const separateDescription = 'Le service Feathers est exécuté dans un processus séparé.'
+      if (typeof app !== 'string' || !app.includes(separateDescription)) {
+        throw new Error('SPA description contract changed: refusing inconsistent Vite-native scaffold')
+      }
+      files.set('src/App.vue', app.replace(separateDescription,
+        'En développement, les services Feathers sont intégrés directement à Vite.'))
+    }
+    if (o.devApi !== 'vite') files.set('scripts/dev-all.mjs',await readFile(join(templates,'common',o.ui==='quasar2'&&o.render==='ssr'?'dev-all-quasar-ssr.mjs':'dev-all.mjs'),'utf8'))
+    // A configuration contract, not a simulated authentication or persistence layer.
+    // Non-memory databases and external identity providers fail closed at startup
+    // until explicitly integrated and tested with a real provider.
+    files.set('api/config/capabilities.mjs',capabilityGuard(o))
+    const server=files.get('api/server.mjs').replace("from 'vite-plugin-feathersjs'","from '@vevedh/vite-plugin-feathersjs'")
+    files.set('api/server.mjs',"import { assertCapabilities } from './config/capabilities.mjs'\nassertCapabilities()\n" + server)
+    files.set('api/config/README.md',`# Configuration des capacités\n\nProfil sélectionné : schéma ${o.schema}, identité ${o.auth}, connexions ${o.db}.\n\nLes services en mémoire et sans authentification sont destinés au laboratoire local. Les bases externes nécessitent une instance réelle, un client Feathers/Knex ou MongoDB, ses migrations et la vérification de son cycle de vie.\n\nL'authentification JWT exige un service utilisateurs, un secret hors Git, une stratégie JWT active, des contrôles d'accès et des tests. OAuth2, OIDC et Keycloak exigent en plus un fournisseur HTTPS, la vérification de l'issuer, audience, JWKS, PKCE et le mapping des identités. Ne pas exposer l'API avant validation.\n\nLa commande \`service add tickets --schema zod --db main\` crée un service et l'enregistre dans l'API.\n`)
+    files.set('api/config/profile.json',JSON.stringify({schema:o.schema,auth:o.auth,databases:o.databases,primary:o.databases[0].alias,operational:o.auth==='none' && o.databases.every(db=>db.adapter==='memory')},null,2)+'\n')
+    const depMap={typebox:['@feathersjs/typebox','ajv'],json:['ajv'],zod:['zod']}
+    // Dependencies for the service subcommand; project options alone create no arbitrary services.
+    for(const dep of depMap[o.schema])manifest.dependencies[dep] ||= dep==='ajv'?'^8.17.1':dep==='zod'?'^4.1.0':'^5.0.50'
+    if(o.auth==='jwt')manifest.dependencies['@feathersjs/authentication']='^5.0.50'
+    if(o.auth==='oauth2')manifest.dependencies['@feathersjs/authentication-oauth']='^5.0.50'
+    for(const db of o.databases) {
+      const drivers={mongodb:['@feathersjs/mongodb','mongodb'],postgresql:['@feathersjs/knex','knex','pg'],mariadb:['@feathersjs/knex','knex','mysql2'],mysql:['@feathersjs/knex','knex','mysql2'],sqlite:['@feathersjs/knex','knex','better-sqlite3']}
+      for(const dep of drivers[db.adapter]||[])manifest.dependencies[dep] ||= dep === 'mongodb' ? '6.19.0' : dep === '@feathersjs/mongodb' ? '5.0.51' : '*'
+    }
+    files.set('package.json',JSON.stringify(manifest,null,2)+'\n')
+    if (o.auth === 'jwt' && o.databases.some(db => ['postgresql','mariadb','mongodb'].includes(db.adapter))) {
+      for (const name of ['register.mjs','policy.mjs']) files.set('api/security/' + name, await readFile(new URL('./secure-runtime/' + name, import.meta.url), 'utf8'))
+      Object.assign(manifest.dependencies, { '@feathersjs/authentication-local': '5.0.50', '@casl/ability': '6.8.1', 'feathers-casl': '3.1.0' })
+      manifest.dependencies.zod ||= '^4.1.0'
+      files.set('package.json',JSON.stringify(manifest,null,2)+'\n')
+    }
+    const persistentDatabases = o.databases.filter(db => ['postgresql','mariadb','mongodb'].includes(db.adapter))
+    if (o.auth === 'jwt' && persistentDatabases.length) {
+      const declarations = persistentDatabases.map(db => ({ alias: db.alias, adapter: db.adapter, envPrefix: 'P5_DB_' + db.alias.replaceAll('-', '_').toUpperCase() }))
+      if (new Set(declarations.map(db => db.envPrefix)).size !== declarations.length) throw new Error('Database environment prefix collision')
+      files.set('api/config/database-connections.generated.mjs', 'export const databaseDeclarations = Object.freeze(' + JSON.stringify(declarations, null, 2) + ')\n')
+      for (const [source, target] of [['providers.mjs','api/runtime/database-providers.generated.mjs'], ['storage.mjs','api/runtime/storage.mjs'], ['prepare-storage.mjs','scripts/prepare-storage.mjs'], ['connect.mjs','api/security/connect.mjs']]) {
+        files.set(target, await readFile(new URL('./secure-runtime/' + source, import.meta.url), 'utf8'))
+      }
+      const env = declarations.flatMap(db => [db.envPrefix + '_HOST=127.0.0.1', db.envPrefix + '_PORT=' + (db.adapter === 'postgresql' ? '5432' : db.adapter === 'mariadb' ? '3306' : '27017'), db.envPrefix + '_USER=', db.envPrefix + '_PASSWORD=', db.envPrefix + '_NAME='])
+      files.set('database.env.example', env.join('\n') + '\n')
+    }
     const list=[...files.keys()].sort()
     const result={name:o.name,ui:o.ui,render:o.render,adapter:o.adapter,transport:o.transport,
-      destination:relative(report,o.destination).split(sep).join('/'),files:list}
+      destination:relative(report,o.destination).split(sep).join('/'),schema:o.schema,auth:o.auth,pwa:o.pwa,devApi:o.devApi,databases:o.databases,files:list}
     if(o.dryRun)return result
     // Do not follow symlinks and refuse any existing destination, including empty ones.
     await mkdir(output,{recursive:true})
@@ -134,3 +288,31 @@ export function createGenerator({outputRoot, templatesRoot, examplesRoot = templ
   }
   return {parse,generate}
 }
+
+function quasarSSRManifest(o){
+  return {name:o.name,version:'0.1.0',private:true,type:'module',packageManager:'pnpm@10.30.2',engines:{node:'>=22.12'},
+    scripts:{'dev:ssr':'quasar dev -m ssr','build:ssr':'quasar build -m ssr',build:'quasar build -m ssr',
+      typecheck:'vue-tsc --noEmit', 'dev:api':'node --env-file=.env.example api/server.mjs',
+      'serve:production':'node dist/ssr/index.js',postinstall:'quasar prepare', 'dev:edge':'node scripts/edge-proxy.mjs'},
+    dependencies:{'@vevedh/vite-plugin-feathersjs':'0.2.6', '@feathersjs/feathers':'^5.0.50', '@feathersjs/koa':'^5.0.50',
+      '@feathersjs/express':'^5.0.50', '@feathersjs/errors':'^5.0.50', '@feathersjs/socketio':'^5.0.50',
+      '@feathersjs/rest-client':'^5.0.50', '@feathersjs/socketio-client':'^5.0.50',
+      '@quasar/extras':'^1.18.0',pinia:'^3.0.4',quasar:'^2.35.2','socket.io-client':'^4.8.4',
+      vue:'^3.5.44','vue-router':'^4.6.4',express:'^4.22.3','serialize-javascript':'^7.1.4'},
+    devDependencies:{'@quasar/app-vite':'2.6.2','@types/node':'^22.0.0',typescript:'^5.9.3','vue-tsc':'^3.3.14',
+      // Quasar app-vite 2.6.2 runs Express v4. Keep its ambient types in
+      // the same major as Express runtime, including nested pnpm dependencies.
+      '@types/express':'4.17.25','@types/express-serve-static-core':'4.19.9',vite:'^7.3.7'},
+    pnpm:{overrides:{'@types/express':'4.17.25','@types/express-serve-static-core':'4.19.9'}}}
+}
+function capabilityGuard(o) {
+ const external=o.databases.filter(x=>x.adapter!=='memory')
+ const desc=JSON.stringify({auth:o.auth,databases:o.databases})
+ return `// Generated capability contract: never silently downgrade identity or persistence.\n`+
+   `export const profile=Object.freeze(${desc})\n`+
+   `export function assertCapabilities(){\n`+
+   `  if (profile.auth !== 'none') throw new Error('Authentication '+profile.auth+' is a configuration blueprint; identity provider and JWT validation must be integrated and certified before serving requests')\n`+
+   `  const missing=profile.databases.filter(item=>item.adapter!=='memory')\n`+
+   `  if(missing.length)throw new Error('Database adapters not provisioned: '+missing.map(x=>x.alias+':'+x.adapter).join(', ')+'. Configure named adapters before serving requests')\n`+
+   `}\n`
+}

package/lib/secure-runtime/connect.mjs

@@ -0,0 +1,28 @@
+import { openNamedDatabaseProviders } from '../runtime/database-providers.generated.mjs'
+import { storageNames } from '../runtime/storage.mjs'
+import { registerSecuredPersistence } from './register.mjs'
+
+/** Attach real persistence/auth to an unstarted Feathers app; caller owns listener and shutdown.
+ * No schema creation, account seeding or socket broadcast occurs during startup.
+ */
+export async function connectSecuredPersistence(app, config) {
+  if (!config || Object.keys(config).sort().join(',') !== 'alias,audience,issuer,secret') throw Error('INVALID_SECURITY_CONFIG')
+  let providers
+  try {
+    providers = await openNamedDatabaseProviders()
+    const provider = providers.get(config.alias)
+    // Readiness checks the actual schema/collections before registration.
+    if (provider.adapter === 'mongodb') {
+      for (const name of Object.values(storageNames)) {
+        if (!await provider.db.listCollections({ name }).hasNext()) throw Error('STORAGE_NOT_PREPARED')
+      }
+    } else {
+      for (const name of Object.values(storageNames)) if (!await provider.db.schema.hasTable(name)) throw Error('STORAGE_NOT_PREPARED')
+    }
+    registerSecuredPersistence(app, providers, { ...config, ...storageNames })
+    return Object.freeze({ close: () => providers.close() })
+  } catch (error) {
+    try { await providers?.close() } catch {}
+    throw error
+  }
+}

package/lib/secure-runtime/policy.mjs

@@ -0,0 +1,85 @@
+/** P5-R5-R4-R2: only server-validated identities determine Feathers/CASL permissions. */
+import { randomUUID } from 'node:crypto'
+import { AbilityBuilder, createMongoAbility } from '@casl/ability'
+import { BadRequest, NotAuthenticated } from '@feathersjs/errors'
+                                                       
+import { z } from 'zod'
+
+const id = z.string().uuid()
+const title = z.string().trim().min(1).max(80).regex(/^[A-Za-z0-9 _.-]+$/)
+const create = z.object({ title }).strict()
+const patch = z.object({ title }).strict()
+const list = z.object({
+  $limit: z.coerce.number().int().min(0).max(50).optional(),
+  $skip: z.coerce.number().int().min(0).max(100).optional(),
+}).strict()
+const empty = z.object({}).strict()
+
+                                                
+                                        
+            
+            
+                  
+                        
+  
+
+export function validateIdentity(input         )                  {
+  if (typeof input !== 'object' || input === null || Array.isArray(input)) {
+    throw new NotAuthenticated('Identity unavailable')
+  }
+  const value = input                           
+  const parsed = z.object({
+    id,
+    role: z.enum(['viewer','editor','admin']),
+    status: z.literal('active'),
+    sessionVersion: z.number().int().positive().safe(),
+  }).passthrough().safeParse(value)
+  if (!parsed.success) throw new NotAuthenticated('Identity unavailable')
+  return parsed.data
+}
+
+export function serverAbility(identity                 ) {
+  const { can, rules } = new AbilityBuilder(createMongoAbility)
+  if (identity.role === 'admin') {
+    can('manage', 'all')
+  } else {
+    can('find', 'documents', ['id','title','ownerId'], { ownerId: identity.id })
+    can('get', 'documents', ['id','title','ownerId'], { ownerId: identity.id })
+    if (identity.role === 'editor') {
+      can('create', 'documents')
+      can('patch', 'documents', ['title'], { ownerId: identity.id })
+    }
+  }
+  return createMongoAbility(rules)
+}
+
+                                               
+                                            
+                                            
+ 
+
+/** Must run after real Feathers authenticate('jwt') and before CASL authorize(). */
+export function documentPolicy(revalidate                                           ) {
+  return async (context             )                => {
+    if (['get', 'patch', 'remove'].includes(context.method) && !id.safeParse(context.id).success) throw new BadRequest('Invalid id')
+    const params = context.params                  
+    if (!params.provider) throw new NotAuthenticated('Authenticated transport required')
+    const token = params.authentication?.accessToken
+    if (typeof token !== 'string' || token.length < 24 || token.length > 4096) {
+      throw new NotAuthenticated('Authentication required')
+    }
+    // Never use params.user, client JWT roles, client-supplied ability, or stale socket permissions.
+    const identity = validateIdentity(await revalidate(token))
+    params.ability = serverAbility(identity)
+    const query = (context.method === 'find' ? list : empty).safeParse(params.query ?? {})
+    if (!query.success) throw new BadRequest('Invalid query')
+    context.params.query = query.data
+    if (context.method === 'create' || context.method === 'patch') {
+      const parsed = (context.method === 'create' ? create : patch).safeParse(context.data           )
+      if (!parsed.success) throw new BadRequest('Invalid data')
+      context.data = context.method === 'create'
+        ? { ...parsed.data, id: randomUUID(), ownerId: identity.id, internal: null }
+        : parsed.data
+    }
+  }
+}

package/lib/secure-runtime/prepare-storage.mjs

@@ -0,0 +1,14 @@
+import { openNamedDatabaseProviders } from '../api/runtime/database-providers.generated.mjs'
+import { prepareIdentityStorage } from '../api/runtime/storage.mjs'
+const [mode, flag, alias, ...extra] = process.argv.slice(2)
+if (mode !== '--apply' || flag !== '--alias' || !/^[a-z][a-z0-9-]{0,31}$/.test(alias ?? '') || extra.length) {
+  console.error('STORAGE=REFUSED | EXPECTED=--apply --alias NAME'); process.exitCode = 2
+} else {
+  let providers
+  try {
+    providers = await openNamedDatabaseProviders()
+    await prepareIdentityStorage(providers.get(alias))
+    console.log('STORAGE=PREPARED | ACCOUNTS_CREATED=0 | PUBLIC_RUNTIME=BLOCKED')
+  } catch { console.error('STORAGE=FAILED | PUBLIC_RUNTIME=BLOCKED'); process.exitCode = 2 }
+  finally { try { await providers?.close() } catch { console.error('STORAGE=CLEANUP_FAILED'); process.exitCode = 2 } }
+}