@vevedh/create-feathers-app 0.1.0-rc.4 → 0.1.0-rc.5

package/bin/create-feathers-app.mjs

@@ -26,7 +26,7 @@ Usage: create-feathers-app <name> [options]
   --db <alias:adapter[,alias:adapter]>    Named connections (default main:memory)
   --version           Print CLI version
 
-Service: create-feathers-app service add <name> [--project <path>] [--schema typebox|json|zod] [--db <alias>] [--auth none|jwt] [--dry-run]
+Service: create-feathers-app service add <name> [--project <path>] [--schema typebox|json|zod] [--db <alias>] [--auth none|jwt] [--lang js|ts] [--dry-run]
 
 Available: Quasar 2 SPA/SSR; daisyUI SPA, SSR, SSG.
 Quasar SSR uses the R16-certified architecture; R17-generated SSR requires its own Windows E2E certification. Quasar SSG not supported.`)

package/lib/scaffold.mjs

@@ -94,6 +94,7 @@ function enableSpaViteRuntime(files, options) {
     watchDirectories: ['api/services'],
     adapter: ${JSON.stringify(options.adapter)},
     prefix: '/api',
+    lifecycle: 'managed',
     cors: false,
     socketio: ${socket},
   })`
@@ -201,7 +202,7 @@ export function createGenerator({outputRoot, templatesRoot, examplesRoot = templ
     if(files.has('gitignore.template')){files.set('.gitignore',files.get('gitignore.template'));files.delete('gitignore.template')}
     if(files.has('.gitignore')) {
       const ignores=files.get('.gitignore')
-      const additions=['.agents/','AGENTS.md','SKILLS.md','*.prompt.md','.ai/','.codex/','.cursor/','.claude/','.gemini/','.windsurf/','.aider*','.mcp.json','.vscode/mcp.json','.github/copilot-instructions.md','docs-private/','.npmrc','.env*','!.env.example']
+      const additions=['.agents/','AGENTS.md','SKILLS.md','*.prompt.md','.ai/','.codex/','.cursor/','.claude/','.gemini/','.windsurf/','.aider*','.mcp.json','.vscode/mcp.json','.github/copilot-instructions.md','docs-private/','.npmrc','.env*','!.env.example','api/.create-feathers-service.lock']
       files.set('.gitignore',ignores.trimEnd()+'\n\n# Local editor tooling and private maintenance files\n'+additions.filter(x=>!ignores.split(/\r?\n/).includes(x)).join('\n')+'\n')
     }
     if(!files.has('api/server.mjs')||!files.has('.env.example')||!files.has('index.html'))throw new Error('Incomplete source template')
@@ -249,9 +250,26 @@ export function createGenerator({outputRoot, templatesRoot, examplesRoot = templ
     if(o.auth==='oauth2')manifest.dependencies['@feathersjs/authentication-oauth']='^5.0.50'
     for(const db of o.databases) {
       const drivers={mongodb:['@feathersjs/mongodb','mongodb'],postgresql:['@feathersjs/knex','knex','pg'],mariadb:['@feathersjs/knex','knex','mysql2'],mysql:['@feathersjs/knex','knex','mysql2'],sqlite:['@feathersjs/knex','knex','better-sqlite3']}
-      for(const dep of drivers[db.adapter]||[])manifest.dependencies[dep]||='*'
+      for(const dep of drivers[db.adapter]||[])manifest.dependencies[dep] ||= dep === 'mongodb' ? '6.19.0' : dep === '@feathersjs/mongodb' ? '5.0.51' : '*'
     }
     files.set('package.json',JSON.stringify(manifest,null,2)+'\n')
+    if (o.auth === 'jwt' && o.databases.some(db => ['postgresql','mariadb','mongodb'].includes(db.adapter))) {
+      for (const name of ['register.mjs','policy.mjs']) files.set('api/security/' + name, await readFile(new URL('./secure-runtime/' + name, import.meta.url), 'utf8'))
+      Object.assign(manifest.dependencies, { '@feathersjs/authentication-local': '5.0.50', '@casl/ability': '6.8.1', 'feathers-casl': '3.1.0' })
+      manifest.dependencies.zod ||= '^4.1.0'
+      files.set('package.json',JSON.stringify(manifest,null,2)+'\n')
+    }
+    const persistentDatabases = o.databases.filter(db => ['postgresql','mariadb','mongodb'].includes(db.adapter))
+    if (o.auth === 'jwt' && persistentDatabases.length) {
+      const declarations = persistentDatabases.map(db => ({ alias: db.alias, adapter: db.adapter, envPrefix: 'P5_DB_' + db.alias.replaceAll('-', '_').toUpperCase() }))
+      if (new Set(declarations.map(db => db.envPrefix)).size !== declarations.length) throw new Error('Database environment prefix collision')
+      files.set('api/config/database-connections.generated.mjs', 'export const databaseDeclarations = Object.freeze(' + JSON.stringify(declarations, null, 2) + ')\n')
+      for (const [source, target] of [['providers.mjs','api/runtime/database-providers.generated.mjs'], ['storage.mjs','api/runtime/storage.mjs'], ['prepare-storage.mjs','scripts/prepare-storage.mjs'], ['connect.mjs','api/security/connect.mjs']]) {
+        files.set(target, await readFile(new URL('./secure-runtime/' + source, import.meta.url), 'utf8'))
+      }
+      const env = declarations.flatMap(db => [db.envPrefix + '_HOST=127.0.0.1', db.envPrefix + '_PORT=' + (db.adapter === 'postgresql' ? '5432' : db.adapter === 'mariadb' ? '3306' : '27017'), db.envPrefix + '_USER=', db.envPrefix + '_PASSWORD=', db.envPrefix + '_NAME='])
+      files.set('database.env.example', env.join('\n') + '\n')
+    }
     const list=[...files.keys()].sort()
     const result={name:o.name,ui:o.ui,render:o.render,adapter:o.adapter,transport:o.transport,
       destination:relative(report,o.destination).split(sep).join('/'),schema:o.schema,auth:o.auth,pwa:o.pwa,devApi:o.devApi,databases:o.databases,files:list}

package/lib/secure-runtime/connect.mjs

@@ -0,0 +1,28 @@
+import { openNamedDatabaseProviders } from '../runtime/database-providers.generated.mjs'
+import { storageNames } from '../runtime/storage.mjs'
+import { registerSecuredPersistence } from './register.mjs'
+
+/** Attach real persistence/auth to an unstarted Feathers app; caller owns listener and shutdown.
+ * No schema creation, account seeding or socket broadcast occurs during startup.
+ */
+export async function connectSecuredPersistence(app, config) {
+  if (!config || Object.keys(config).sort().join(',') !== 'alias,audience,issuer,secret') throw Error('INVALID_SECURITY_CONFIG')
+  let providers
+  try {
+    providers = await openNamedDatabaseProviders()
+    const provider = providers.get(config.alias)
+    // Readiness checks the actual schema/collections before registration.
+    if (provider.adapter === 'mongodb') {
+      for (const name of Object.values(storageNames)) {
+        if (!await provider.db.listCollections({ name }).hasNext()) throw Error('STORAGE_NOT_PREPARED')
+      }
+    } else {
+      for (const name of Object.values(storageNames)) if (!await provider.db.schema.hasTable(name)) throw Error('STORAGE_NOT_PREPARED')
+    }
+    registerSecuredPersistence(app, providers, { ...config, ...storageNames })
+    return Object.freeze({ close: () => providers.close() })
+  } catch (error) {
+    try { await providers?.close() } catch {}
+    throw error
+  }
+}

package/lib/secure-runtime/policy.mjs

@@ -0,0 +1,85 @@
+/** P5-R5-R4-R2: only server-validated identities determine Feathers/CASL permissions. */
+import { randomUUID } from 'node:crypto'
+import { AbilityBuilder, createMongoAbility } from '@casl/ability'
+import { BadRequest, NotAuthenticated } from '@feathersjs/errors'
+                                                       
+import { z } from 'zod'
+
+const id = z.string().uuid()
+const title = z.string().trim().min(1).max(80).regex(/^[A-Za-z0-9 _.-]+$/)
+const create = z.object({ title }).strict()
+const patch = z.object({ title }).strict()
+const list = z.object({
+  $limit: z.coerce.number().int().min(0).max(50).optional(),
+  $skip: z.coerce.number().int().min(0).max(100).optional(),
+}).strict()
+const empty = z.object({}).strict()
+
+                                                
+                                        
+            
+            
+                  
+                        
+  
+
+export function validateIdentity(input         )                  {
+  if (typeof input !== 'object' || input === null || Array.isArray(input)) {
+    throw new NotAuthenticated('Identity unavailable')
+  }
+  const value = input                           
+  const parsed = z.object({
+    id,
+    role: z.enum(['viewer','editor','admin']),
+    status: z.literal('active'),
+    sessionVersion: z.number().int().positive().safe(),
+  }).passthrough().safeParse(value)
+  if (!parsed.success) throw new NotAuthenticated('Identity unavailable')
+  return parsed.data
+}
+
+export function serverAbility(identity                 ) {
+  const { can, rules } = new AbilityBuilder(createMongoAbility)
+  if (identity.role === 'admin') {
+    can('manage', 'all')
+  } else {
+    can('find', 'documents', ['id','title','ownerId'], { ownerId: identity.id })
+    can('get', 'documents', ['id','title','ownerId'], { ownerId: identity.id })
+    if (identity.role === 'editor') {
+      can('create', 'documents')
+      can('patch', 'documents', ['title'], { ownerId: identity.id })
+    }
+  }
+  return createMongoAbility(rules)
+}
+
+                                               
+                                            
+                                            
+ 
+
+/** Must run after real Feathers authenticate('jwt') and before CASL authorize(). */
+export function documentPolicy(revalidate                                           ) {
+  return async (context             )                => {
+    if (['get', 'patch', 'remove'].includes(context.method) && !id.safeParse(context.id).success) throw new BadRequest('Invalid id')
+    const params = context.params                  
+    if (!params.provider) throw new NotAuthenticated('Authenticated transport required')
+    const token = params.authentication?.accessToken
+    if (typeof token !== 'string' || token.length < 24 || token.length > 4096) {
+      throw new NotAuthenticated('Authentication required')
+    }
+    // Never use params.user, client JWT roles, client-supplied ability, or stale socket permissions.
+    const identity = validateIdentity(await revalidate(token))
+    params.ability = serverAbility(identity)
+    const query = (context.method === 'find' ? list : empty).safeParse(params.query ?? {})
+    if (!query.success) throw new BadRequest('Invalid query')
+    context.params.query = query.data
+    if (context.method === 'create' || context.method === 'patch') {
+      const parsed = (context.method === 'create' ? create : patch).safeParse(context.data           )
+      if (!parsed.success) throw new BadRequest('Invalid data')
+      context.data = context.method === 'create'
+        ? { ...parsed.data, id: randomUUID(), ownerId: identity.id, internal: null }
+        : parsed.data
+    }
+  }
+}

package/lib/secure-runtime/prepare-storage.mjs

@@ -0,0 +1,14 @@
+import { openNamedDatabaseProviders } from '../api/runtime/database-providers.generated.mjs'
+import { prepareIdentityStorage } from '../api/runtime/storage.mjs'
+const [mode, flag, alias, ...extra] = process.argv.slice(2)
+if (mode !== '--apply' || flag !== '--alias' || !/^[a-z][a-z0-9-]{0,31}$/.test(alias ?? '') || extra.length) {
+  console.error('STORAGE=REFUSED | EXPECTED=--apply --alias NAME'); process.exitCode = 2
+} else {
+  let providers
+  try {
+    providers = await openNamedDatabaseProviders()
+    await prepareIdentityStorage(providers.get(alias))
+    console.log('STORAGE=PREPARED | ACCOUNTS_CREATED=0 | PUBLIC_RUNTIME=BLOCKED')
+  } catch { console.error('STORAGE=FAILED | PUBLIC_RUNTIME=BLOCKED'); process.exitCode = 2 }
+  finally { try { await providers?.close() } catch { console.error('STORAGE=CLEANUP_FAILED'); process.exitCode = 2 } }
+}

package/lib/secure-runtime/providers.mjs

@@ -0,0 +1,74 @@
+/** P5-R5-R4-R4-R1 — named Feathers providers. Internal-only, no HTTP routes. */
+import { databaseDeclarations } from '../config/database-connections.generated.mjs'
+const known = new Set(['postgresql', 'mariadb', 'mongodb'])
+const tableName = /^[a-z][a-z0-9_]{0,56}$/
+const hostName = /^(?:localhost|(?:[a-zA-Z0-9](?:[a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?)(?:\.(?:[a-zA-Z0-9](?:[a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?))*)$/
+const accountName = /^[a-zA-Z_][a-zA-Z0-9_]{0,62}$/
+const text = (env,key,min,max)=> { const v=env[key]; if(typeof v!=='string'||v.length<min||v.length>max||v.trim()!==v)throw Error('INVALID_DB_ENV');return v }
+function readSettings(env, entry){
+  const prefix=entry.envPrefix
+  const host=text(env,`${prefix}_HOST`,1,253)
+  const rawPort=text(env,`${prefix}_PORT`,1,5)
+  const user=text(env,`${prefix}_USER`,1,63)
+  const password=text(env,`${prefix}_PASSWORD`,1,256)
+  const database=text(env,`${prefix}_NAME`,1,63)
+  const port=Number(rawPort)
+  if(!hostName.test(host)||!Number.isSafeInteger(port)||port<1||port>65535||String(port)!==rawPort||!accountName.test(user)||!accountName.test(database)||/\p{C}/u.test(password))throw Error('INVALID_DB_ENV')
+  return {host,port,user,password,database}
+}
+function validateDeclarations(){
+  if(!Array.isArray(databaseDeclarations)||databaseDeclarations.length<1||databaseDeclarations.length>8)throw Error('INVALID_DECLARATIONS')
+  const seen=new Set()
+  for(const d of databaseDeclarations){
+    if(!d||typeof d.alias!=='string'||!tableName.test(d.alias.replaceAll('-','_'))||!known.has(d.adapter)||typeof d.envPrefix!=='string'||!/^P5_DB_[A-Z][A-Z0-9_]*$/.test(d.envPrefix)||seen.has(d.alias))throw Error('INVALID_DECLARATIONS')
+    seen.add(d.alias)
+  }
+}
+export function validateNamedProviderEnvironment(env=process.env){
+  validateDeclarations()
+  for(const d of databaseDeclarations)readSettings(env,d)
+  return databaseDeclarations.length
+}
+export async function openNamedDatabaseProviders(env=process.env){
+  validateNamedProviderEnvironment(env)
+  const providers=new Map()
+  let closed=false
+  const close=async()=>{
+    if(closed)return
+    closed=true
+    const failures=[]
+    for(const entry of [...providers.values()].reverse())try{await entry.close()}catch{failures.push(1)}
+    providers.clear()
+    if(failures.length)throw Error('DB_CLEANUP_FAILED')
+  }
+  try{
+    for(const declaration of databaseDeclarations){
+      const cfg=readSettings(env,declaration)
+      if(declaration.adapter==='mongodb'){
+        const { MongoClient }=await import('mongodb')
+        const { MongoDBService }=await import('@feathersjs/mongodb')
+        const client=new MongoClient(`mongodb://${cfg.host}:${cfg.port}`,{auth:{username:cfg.user,password:cfg.password},authSource:'admin',serverSelectionTimeoutMS:8000,maxPoolSize:3})
+        try{await client.connect();await client.db(cfg.database).command({ping:1})}
+        catch{await client.close();throw Error('DB_CONNECT_FAILED')}
+        const db=client.db(cfg.database)
+        providers.set(declaration.alias,{alias:declaration.alias,adapter:'mongodb',db,close:()=>client.close(), service(name){
+          if(typeof name!=='string'||!tableName.test(name))throw Error('INVALID_TABLE_NAME')
+          return new MongoDBService({Model:db.collection(name),id:'id',disableObjectify:true,paginate:false,disabledOperators:['$rename','$set','$inc','$unset','$push','$pull','$pop']})
+        }})
+      }else{
+        const { default: knex }=await import('knex')
+        const { KnexService }=await import('@feathersjs/knex')
+        const db=knex({client:declaration.adapter==='postgresql'?'pg':'mysql2',connection:{host:cfg.host,port:cfg.port,user:cfg.user,password:cfg.password,database:cfg.database},pool:{min:0,max:3},acquireConnectionTimeout:8000})
+        try{await db.raw('SELECT 1')}catch{await db.destroy();throw Error('DB_CONNECT_FAILED')}
+        providers.set(declaration.alias,{alias:declaration.alias,adapter:declaration.adapter,db,close:()=>db.destroy(),service(name){
+          if(typeof name!=='string'||!tableName.test(name))throw Error('INVALID_TABLE_NAME')
+          return new KnexService({Model:db,name,id:'id',paginate:false})
+        }})
+      }
+    }
+    return Object.freeze({aliases:Object.freeze([...providers.keys()]),get(alias){
+      if(closed||typeof alias!=='string'||!providers.has(alias))throw Error('DB_ALIAS_UNAVAILABLE')
+      return providers.get(alias)
+    },close})
+  }catch{try{await close()}catch{};throw Error('DB_PROVIDER_BOOT_FAILED')}
+}

package/lib/secure-runtime/register.mjs

@@ -0,0 +1,80 @@
+import { AuthenticationService, JWTStrategy, authenticate } from '@feathersjs/authentication'
+import { LocalStrategy } from '@feathersjs/authentication-local'
+import { NotAuthenticated } from '@feathersjs/errors'
+import { feathersCasl, authorize } from 'feathers-casl'
+import { documentPolicy, validateIdentity } from './policy.mjs'
+
+class SessionAuthentication extends AuthenticationService {
+  async getPayload(result) {
+    const identity = validateIdentity(result.user)
+    return { sessionVersion: identity.sessionVersion }
+  }
+  async create(data, params) {
+    const result = await super.create(data, params)
+    if (!result.user) return result
+    const user = validateIdentity(result.user)
+    // Explicit allowlist: never serialize the stored password or adapter metadata.
+    return { ...result, user: { id: user.id, role: user.role, status: user.status, sessionVersion: user.sessionVersion } }
+  }
+}
+class SessionJWT extends JWTStrategy {
+  async authenticate(data, params) {
+    const result = await super.authenticate(data, params)
+    const identity = validateIdentity(result.user)
+    if (identity.sessionVersion !== result.authentication?.payload?.sessionVersion) throw new NotAuthenticated('Invalid session')
+    return result
+  }
+}
+class ActiveLocal extends LocalStrategy {
+  async authenticate(data, params) {
+    const result = await super.authenticate(data, params)
+    validateIdentity(result.user)
+    return result
+  }
+}
+
+/** Server-owned configuration only. Tables and indexes must be provisioned separately.
+ * Register before opening any HTTP or Socket.IO listener. No account is seeded here.
+ * The caller owns provider teardown. Existing generated capability guard remains authoritative.
+ */
+export function registerSecuredPersistence(app, providers, config) {
+  if (!config || Object.keys(config).sort().join(',') !== 'alias,audience,documents,issuer,secret,users') throw Error('INVALID_SECURITY_CONFIG')
+  if (typeof config.secret !== 'string' || config.secret.length < 48 || config.secret.length > 512 || /\s/.test(config.secret)) throw Error('INVALID_JWT_SECRET')
+  for (const key of ['issuer','audience']) if (typeof config[key] !== 'string' || !/^[a-zA-Z0-9:_-]{3,100}$/.test(config[key])) throw Error('INVALID_JWT_SCOPE')
+  for (const key of ['users','documents']) if (typeof config[key] !== 'string' || !/^[a-z][a-z0-9_]{0,55}$/.test(config[key])) throw Error('INVALID_STORAGE_NAME')
+  if (config.users === config.documents || typeof config.alias !== 'string' || !/^[a-z][a-z0-9-]{0,31}$/.test(config.alias)) throw Error('INVALID_BINDING')
+  if (!app || typeof app.use !== 'function' || !providers || typeof providers.get !== 'function') throw Error('INVALID_RUNTIME')
+  for (const path of ['users','authentication','documents']) if (app.services?.[path]) throw Error('SERVICE_COLLISION')
+  const provider = providers.get(config.alias)
+  if (!provider || !['mongodb','postgresql','mariadb'].includes(provider.adapter)) throw Error('UNSUPPORTED_PROVIDER')
+  const adapter = provider.adapter === 'mongodb' ? '@feathersjs/mongodb' : '@feathersjs/knex'
+  const users = provider.service(config.users)
+  const documents = provider.service(config.documents)
+  if (provider.adapter === 'mongodb') {
+    documents.options.filters = { ...documents.options.filters, $nor: true }
+    documents.options.operators = [...new Set([...(documents.options.operators ?? []), '$nor', '$and'])]
+  }
+  app.configure(feathersCasl({ defaultAdapter: adapter }))
+  app.set('authentication', {
+    secret: config.secret, service: 'users', entity: 'user', authStrategies: ['jwt','local'], parseStrategies: ['jwt'],
+    jwtOptions: { algorithm: 'HS256', expiresIn: '15m', issuer: config.issuer, audience: config.audience },
+    local: { usernameField: 'email', passwordField: 'password', hashSize: 10 },
+  })
+  app.use('users', users, { methods: [], events: [] })
+  const auth = new SessionAuthentication(app)
+  auth.register('jwt', new SessionJWT())
+  auth.register('local', new ActiveLocal())
+  app.use('authentication', auth, { methods: ['create','remove'], events: [] })
+  app.use('documents', documents, { methods: ['find','get','create','patch'], events: [] })
+  const access = authorize({ adapter, modelName: 'documents' })
+  app.service('documents').hooks({
+    around: { all: [authenticate('jwt')] },
+    before: { all: [documentPolicy(async accessToken => {
+      const result = await auth.authenticate({ strategy: 'jwt', accessToken }, {}, 'jwt')
+      return result.user
+    }), access] },
+    after: { all: [access] },
+  })
+  // No broadcast until recipient-level filtering has its own qualification.
+  return Object.freeze({ paths: Object.freeze(['authentication','documents']) })
+}

package/lib/secure-runtime/storage.mjs

@@ -0,0 +1,31 @@
+/** Explicit schema provisioning. Never drops tables, collections, records or indexes. */
+export const storageNames = Object.freeze({ users: 'app_users', documents: 'app_documents' })
+export async function prepareIdentityStorage(provider) {
+  if (!provider || !['postgresql','mariadb','mongodb'].includes(provider.adapter)) throw Error('UNSUPPORTED_PROVIDER')
+  const { users, documents } = storageNames
+  if (provider.adapter === 'mongodb') {
+    for (const name of [users, documents]) {
+      try { await provider.db.createCollection(name) } catch (error) { if (error?.code !== 48) throw error }
+    }
+    await provider.db.collection(users).createIndex({ id: 1 }, { unique: true })
+    await provider.db.collection(users).createIndex({ email: 1 }, { unique: true })
+    await provider.db.collection(documents).createIndex({ id: 1 }, { unique: true })
+    await provider.db.collection(documents).createIndex({ ownerId: 1 })
+  } else {
+    const db = provider.db
+    if (!await db.schema.hasTable(users)) await db.schema.createTable(users, t => {
+      t.string('id', 36).primary(); t.string('email', 120).notNullable().unique()
+      t.string('password', 120).notNullable(); t.string('role', 16).notNullable()
+      t.string('status', 16).notNullable(); t.integer('sessionVersion').notNullable()
+    })
+    if (!await db.schema.hasTable(documents)) await db.schema.createTable(documents, t => {
+      t.string('id', 36).primary(); t.string('title', 80).notNullable()
+      t.string('ownerId', 36).notNullable().index(); t.text('internal').nullable()
+    })
+    // Existing tables must contain every required column; no implicit destructive migration.
+    for (const [table, columns] of [[users, ['id','email','password','role','status','sessionVersion']], [documents, ['id','title','ownerId','internal']]]) {
+      for (const column of columns) if (!await db.schema.hasColumn(table, column)) throw Error('SCHEMA_MIGRATION_REQUIRED')
+    }
+  }
+  return storageNames
+}

package/lib/services.mjs

@@ -1,10 +1,12 @@
+import { schemaSourceTs, classSourceTs, registrarTs, tsServiceConfig } from './typescript.mjs'
 import { existsSync } from 'node:fs'
-import { lstat, mkdir, readFile, writeFile } from 'node:fs/promises'
+import { lstat, mkdir, readFile, rm, writeFile } from 'node:fs/promises'
 import { dirname, join, resolve, sep } from 'node:path'
 
 const VALID_NAME = /^[a-z][a-z0-9]*(?:-[a-z0-9]+)*$/
 const VALID_SCHEMA = new Set(['typebox','json','zod'])
 const VALID_AUTH = new Set(['none','jwt'])
+const VALID_LANGUAGE = new Set(['js','ts'])
 function safeName(s){return typeof s==='string' && s.length<=48 && VALID_NAME.test(s) && !/^(?:con|prn|aux|nul|com[1-9]|lpt[1-9])$/i.test(s)}
 async function rejectLinks(path){
  let current=path
@@ -13,8 +15,8 @@ async function rejectLinks(path){
 export function parseServiceArguments(args){
  if(args[0]!=='add')throw new Error('Use: service add <name> [--project <dir>] [--schema typebox|json|zod] [--db <alias>] [--auth none|jwt] [--dry-run]')
  if(!safeName(args[1]))throw new Error('Invalid service name (lowercase kebab-case)')
- const options={name:args[1],project:'.',schema:undefined,db:undefined,auth:undefined,dryRun:false}
- const keys=new Map([['--project','project'],['--schema','schema'],['--db','db'],['--auth','auth']])
+ const options={name:args[1],project:'.',schema:undefined,db:undefined,auth:undefined,lang:'js',dryRun:false}
+ const keys=new Map([['--project','project'],['--schema','schema'],['--db','db'],['--auth','auth'],['--lang','lang']])
  const seen=new Set()
  for(let i=2;i<args.length;i++){
   const flag=args[i]
@@ -26,6 +28,7 @@ export function parseServiceArguments(args){
   if(!value||value.startsWith('--'))throw new Error('Missing service option: '+flag)
   options[keys.get(flag)]=value
  }
+ if(!VALID_LANGUAGE.has(options.lang))throw new Error('Invalid language; use js|ts')
  if(!VALID_SCHEMA.has(options.schema??'typebox'))throw new Error('Invalid schema')
  if(!VALID_AUTH.has(options.auth??'none'))throw new Error('Invalid service auth: none|jwt')
  if(options.db!==undefined&&!safeName(options.db))throw new Error('Invalid database alias')
@@ -34,30 +37,82 @@ export function parseServiceArguments(args){
 }
 function schemaSource(schema){
  const opening="import { BadRequest } from '@feathersjs/errors'\n"
+ const query=`
+// Only a deliberately small, documented query dialect is accepted.
+// Feathers adapter-specific $ operators must never pass through unchecked.
+export function validateQuery(value){
+ if(value === undefined || value === null) return {}
+ if(typeof value !== 'object' || Array.isArray(value)) throw new BadRequest('Invalid query')
+ const result={}
+ for(const [key,raw] of Object.entries(value)){
+  if(key==='title'){
+   if(typeof raw!=='string'||raw.length>120||raw.trim().length<1)throw new BadRequest('Invalid query title')
+   result.title=raw.trim()
+   continue
+  }
+  if(key==='$limit'||key==='$skip'){
+   if(typeof raw!=='number'&&typeof raw!=='string')throw new BadRequest('Invalid query pagination')
+   if(typeof raw==='string'&&!/^(0|[1-9][0-9]*)$/.test(raw))throw new BadRequest('Invalid query pagination')
+   const n=Number(raw)
+   if(!Number.isSafeInteger(n)||n<0||n>1000)throw new BadRequest('Invalid query pagination')
+   result[key]=n
+   continue
+  }
+  throw new BadRequest('Unsupported query field')
+ }
+ return result
+}
+`
  if(schema==='zod')return opening+`import { z } from 'zod'
 export const dataSchema=z.object({title:z.string().trim().min(1).max(120)}).strict()
+export const patchSchema=dataSchema.partial()
 export function validateData(value){const parsed=dataSchema.safeParse(value);if(!parsed.success)throw new BadRequest('Invalid service data');return parsed.data}
-`
- const def=schema==='typebox'?`import { Type } from '@feathersjs/typebox'
-export const dataSchema=Type.Object({title:Type.String({minLength:1,maxLength:120})},{additionalProperties:false})
-`:`export const dataSchema={type:'object',additionalProperties:false,required:['title'],properties:{title:{type:'string',minLength:1,maxLength:120}}}
+export function validatePatch(value){const parsed=patchSchema.safeParse(value);if(!parsed.success||!Object.keys(parsed.data).length)throw new BadRequest('Invalid service patch');return parsed.data}
+`+query
+ const shape=schema==='typebox'?`import { Type } from '@feathersjs/typebox'
+const titleSchema=Type.String({minLength:1,maxLength:120})
+export const dataSchema=Type.Object({title:titleSchema},{additionalProperties:false})
+export const patchSchema=Type.Object({title:Type.Optional(titleSchema)},{additionalProperties:false})
+`:`const titleSchema={type:'string',minLength:1,maxLength:120}
+export const dataSchema={type:'object',additionalProperties:false,required:['title'],properties:{title:titleSchema}}
+export const patchSchema={type:'object',additionalProperties:false,properties:{title:titleSchema}}
 `
  return opening+`import Ajv from 'ajv'
-`+def+`const valid=new Ajv({allErrors:true}).compile(dataSchema)
-export function validateData(value){if(!valid(value))throw new BadRequest('Invalid service data');return {title:value.title.trim()}}
-`
+`+shape+`const ajv=new Ajv({allErrors:true,coerceTypes:false,removeAdditional:false,useDefaults:false})
+const validData=ajv.compile(dataSchema)
+const validPatch=ajv.compile(patchSchema)
+function normalized(value, validator, operation){
+ // Apply the same trim-before-validation contract as the Zod preset.
+ if(!value||typeof value!=='object'||Array.isArray(value)||typeof value.title!=='string')throw new BadRequest('Invalid service '+operation)
+ const canonical={...value,title:value.title.trim()}
+ if(!validator(canonical)||!canonical.title)throw new BadRequest('Invalid service '+operation)
+ return {title:canonical.title}
+}
+export function validateData(value){return normalized(value,validData,'data')}
+export function validatePatch(value){return normalized(value,validPatch,'patch')}
+`+query
 }
 function classSource(){return `import { NotFound, BadRequest } from '@feathersjs/errors'
-import { validateData } from './schema.mjs'
+import { validateData, validatePatch, validateQuery } from './schema.mjs'
 export class GeneratedService {
   #items=new Map()
   #counter=1
   constructor(){for(const method of ['find','get','create','patch','remove'])this[method]=this[method].bind(this)}
-  #id(value){const n=Number(value);if(!Number.isSafeInteger(n)||n<1)throw new BadRequest('Invalid ID');return n}
-  async find(){return [...this.#items.values()].map(x=>({...x}))}
+  #id(value){
+    if(typeof value!=='number'&&typeof value!=='string')throw new BadRequest('Invalid ID')
+    if(typeof value==='string'&&!/^[1-9][0-9]*$/.test(value))throw new BadRequest('Invalid ID')
+    const n=Number(value)
+    if(!Number.isSafeInteger(n)||n<1)throw new BadRequest('Invalid ID')
+    return n
+  }
+  async find(params={}){
+    const query=validateQuery(params?.query)
+    const values=[...this.#items.values()].filter(row=>query.title===undefined||row.title===query.title)
+    return values.slice(query.$skip??0,(query.$skip??0)+(query.$limit??values.length)).map(row=>({...row}))
+  }
   async get(id){const item=this.#items.get(this.#id(id));if(!item)throw new NotFound('Not found');return {...item}}
-  async create(data){const row={id:this.#counter++,...validateData(data)};this.#items.set(row.id,row);return {...row}}
-  async patch(id,data){const key=this.#id(id);if(!this.#items.has(key))throw new NotFound('Not found');const row={id:key,...validateData(data)};this.#items.set(key,row);return {...row}}
+  async create(data){const input=validateData(data);const row={id:this.#counter++,...input};this.#items.set(row.id,row);return {...row}}
+  async patch(id,data){const key=this.#id(id);const row=this.#items.get(key);if(!row)throw new NotFound('Not found');const next={...row,...validatePatch(data)};this.#items.set(key,next);return {...next}}
   async remove(id){const key=this.#id(id);const row=this.#items.get(key);if(!row)throw new NotFound('Not found');this.#items.delete(key);return {...row}}
 }
 `}
@@ -69,40 +124,102 @@ ${auth==='jwt'?"import { authenticate } from '@feathersjs/authentication'\n":''}
 }
 `
 }
-export async function generateService(opts, cwd=process.cwd()){
- const project=resolve(cwd,opts.project)
- if(opts.project!=='.' && !project.startsWith(resolve(cwd)+sep))throw new Error('Project escapes current directory')
+// Non-public IO injection enables deterministic Windows-safe fault tests. CLI calls use default fs.
+export async function generateService(opts, cwd=process.cwd(), io={writeFile}) {
+ if(!opts || !safeName(opts.name))throw new Error('Invalid service name')
+ const projectOption=opts.project??'.'
+ if(typeof projectOption!=='string'||!/^\.?\/?[a-zA-Z0-9._/-]*$/.test(projectOption)||projectOption.includes('..')||projectOption.includes('\\')||projectOption.startsWith('/'))throw new Error('Unsafe project path')
+ if(opts.schema!==undefined&&!VALID_SCHEMA.has(opts.schema))throw new Error('Invalid schema')
+ if(opts.lang!==undefined&&!VALID_LANGUAGE.has(opts.lang))throw new Error('Invalid language')
+ if(opts.auth!==undefined&&!VALID_AUTH.has(opts.auth))throw new Error('Invalid service auth')
+ if(opts.db!==undefined&&!safeName(opts.db))throw new Error('Invalid database alias')
+ const project=resolve(cwd,projectOption)
+ if(projectOption!=='.' && !project.startsWith(resolve(cwd)+sep))throw new Error('Project escapes current directory')
  await rejectLinks(project)
  const manifestPath=join(project,'package.json'),serverPath=join(project,'api/server.mjs'),profilePath=join(project,'api/config/profile.json')
+ const lockPath=join(project,'api/.create-feathers-service.lock')
+ for(const file of [manifestPath,serverPath,profilePath,lockPath]) await rejectLinks(file)
  if(!existsSync(manifestPath)||!existsSync(serverPath)||!existsSync(profilePath))throw new Error('Not a CLI generated project')
- const manifest=JSON.parse(await readFile(manifestPath,'utf8'))
- const profile=JSON.parse(await readFile(profilePath,'utf8'))
- const schema=opts.schema??profile.schema,auth=opts.auth??profile.auth,db=opts.db??profile.primary
- if(!VALID_SCHEMA.has(schema))throw new Error('Invalid schema')
- if(!VALID_AUTH.has(auth))throw new Error('Service supports none|jwt; OAuth2/OIDC/Keycloak require audited identity integration')
- if(auth!=='none' && profile.auth!==auth)throw new Error('Service auth must match configured project profile')
- const connection=profile.databases.find(x=>x.alias===db)
- if(!connection)throw new Error('Unknown database alias: '+db)
- const destination=join(project,'api/services',opts.name)
- await rejectLinks(destination)
- if(existsSync(destination))throw new Error('Service already exists; refusing overwrite')
- const text=await readFile(serverPath,'utf8')
- const marker='const modules = [\n'
- if(!text.includes(marker))throw new Error('Missing Feathers modules registry; no changes made')
- const moduleEntry=`  new URL('./services/${opts.name}/${opts.name}.service.mjs', import.meta.url),\n`
- if(text.includes(moduleEntry))throw new Error('Duplicate service registration')
- // Never replace a user-controlled arbitrary string outside of the explicit registry.
- const output={name:opts.name,project,database:{alias:db,adapter:connection.adapter},auth,schema,files:[`api/services/${opts.name}/schema.mjs`,`api/services/${opts.name}/service.class.mjs`,`api/services/${opts.name}/${opts.name}.service.mjs`],ready:connection.adapter==='memory'&&auth==='none'}
- if(opts.dryRun)return output
- const dependencies=manifest.dependencies||{}
- const deps=schema==='zod'?{'zod':'^4.1.0'}:schema==='typebox'?{'@feathersjs/typebox':'^5.0.50','ajv':'^8.17.1'}:{'ajv':'^8.17.1'}
- if(auth==='jwt')deps['@feathersjs/authentication']='^5.0.50'
- for(const [name,version] of Object.entries(deps))dependencies[name]??=version
- await mkdir(destination,{recursive:false})
- for(const [name,contents] of Object.entries({'schema.mjs':schemaSource(schema),'service.class.mjs':classSource(),[`${opts.name}.service.mjs`]:registrar(opts.name,auth)}))await writeFile(join(destination,name),contents,{flag:'wx'})
- await writeFile(serverPath,text.replace(marker,marker+moduleEntry))
- await writeFile(manifestPath,JSON.stringify({...manifest,dependencies},null,2)+'\n')
- return output
+ // Only one service may update the registry and manifest at a time. A stale lock
+ // must be inspected by the operator rather than automatically stolen.
+ let ownsLock=false
+ if(!opts.dryRun){
+  try{await writeFile(lockPath,JSON.stringify({pid:process.pid})+'\n',{flag:'wx'});ownsLock=true}
+  catch(error){if(error?.code==='EEXIST')throw new Error('Concurrent service generation or stale lock; refusing changes');throw error}
+ }
+ try {
+  const manifestSource=await readFile(manifestPath,'utf8')
+  const text=await readFile(serverPath,'utf8')
+  const manifest=JSON.parse(manifestSource)
+  const profile=JSON.parse(await readFile(profilePath,'utf8'))
+  if(!manifest||typeof manifest!=='object'||Array.isArray(manifest)||!manifest.dependencies||typeof manifest.dependencies!=='object'||Array.isArray(manifest.dependencies))throw new Error('Invalid project dependencies manifest')
+  const schema=opts.schema??profile.schema,auth=opts.auth??profile.auth,db=opts.db??profile.primary,lang=opts.lang??'js'
+  if(!VALID_SCHEMA.has(schema))throw new Error('Invalid schema')
+  if(!VALID_AUTH.has(auth))throw new Error('Service supports none|jwt; OAuth2/OIDC/Keycloak require audited identity integration')
+  if(auth!=='none' && profile.auth!==auth)throw new Error('Service auth must match configured project profile')
+  if(!Array.isArray(profile.databases))throw new Error('Invalid project database profile')
+  const connection=profile.databases.find(x=>x && x.alias===db)
+  if(!connection)throw new Error('Unknown database alias: '+db)
+  const destination=join(project,'api/services',opts.name)
+  await rejectLinks(destination)
+  if(existsSync(destination))throw new Error('Service already exists; refusing overwrite')
+  const marker='const modules = [\n'
+  if(text.split(marker).length!==2)throw new Error('Missing or ambiguous Feathers modules registry; no changes made')
+  const ext=lang==='ts'?'ts':'mjs'
+  const moduleEntry=`  new URL('./services/${opts.name}/${opts.name}.service.${ext}', import.meta.url),\n`
+  if(text.includes(moduleEntry))throw new Error('Duplicate service registration')
+  const tsReady = lang !== 'ts' || (typeof manifest.scripts?.['dev:api'] === 'string' && manifest.scripts['dev:api'].includes('api/server.mjs') && manifest.scripts?.['dev:all'] !== 'vite --host 127.0.0.1')
+  const ready=connection.adapter==='memory'&&auth==='none'&&profile.auth==='none'&&tsReady
+  const output={name:opts.name,project,database:{alias:db,adapter:connection.adapter},auth,schema,lang,files:[`api/services/${opts.name}/schema.${ext}`,`api/services/${opts.name}/service.class.${ext}`,`api/services/${opts.name}/${opts.name}.service.${ext}`],ready}
+  if(opts.dryRun)return output
+  if(connection.adapter!=='memory')throw new Error('Database adapter not provisioned for service: '+connection.adapter+'. Refusing implicit in-memory fallback')
+  if(!tsReady)throw new Error('TypeScript services require a separate API runtime; Vite-embedded runtime not yet certified')
+  if(!ready)throw new Error('Authentication infrastructure not provisioned; refusing service generation')
+  const deps=schema==='zod'?{'zod':'^4.1.0'}:schema==='typebox'?{'@feathersjs/typebox':'^5.0.50','ajv':'^8.17.1'}:{'ajv':'^8.17.1'}
+  const dependencies={...manifest.dependencies}
+  for(const [name,version] of Object.entries(deps))dependencies[name]??=version
+  let manifestResult
+  const tsconfigPath = join(project, 'api/tsconfig.json')
+  let writeTsconfig = false
+  if(lang==='ts'){
+   await rejectLinks(tsconfigPath)
+   if(existsSync(tsconfigPath)){
+    const existing = JSON.parse(await readFile(tsconfigPath,'utf8'))
+    if(existing?.compilerOptions?.strict!==true||existing?.compilerOptions?.noEmit!==true||existing?.compilerOptions?.allowImportingTsExtensions!==true)throw new Error('Unsafe existing TypeScript API configuration')
+   } else writeTsconfig=true
+   // Node --import tsx ensures .ts service registration is executable by the standalone Feathers API.
+   const scripts={...manifest.scripts,'dev:api':manifest.scripts['dev:api'].includes('--import tsx')?manifest.scripts['dev:api']:manifest.scripts['dev:api'].replace(/^node\s+/, 'node --import tsx '), 'typecheck:api':'tsc --noEmit -p api/tsconfig.json'}
+   // Preserve any project-level Vue/Quasar typecheck command while requiring strict backend checks.
+   if(!scripts.typecheck?.includes('typecheck:api')) scripts.typecheck=(scripts.typecheck??'tsc --noEmit')+' && npm run typecheck:api'
+   const devDependencies={...manifest.devDependencies,tsx:manifest.devDependencies?.tsx??'^4.20.0',typescript:manifest.devDependencies?.typescript??'^5.9.3','@types/node':manifest.devDependencies?.['@types/node']??'^22.0.0'}
+   manifestResult=JSON.stringify({...manifest,dependencies,devDependencies,scripts},null,2)+'\n'
+  } else manifestResult=JSON.stringify({...manifest,dependencies},null,2)+'\n'
+  const files=lang==='ts'
+    ? Object.entries({'schema.ts':schemaSourceTs(schema),'service.class.ts':classSourceTs(),[`${opts.name}.service.ts`]:registrarTs(opts.name)})
+    : Object.entries({'schema.mjs':schemaSource(schema),'service.class.mjs':classSource(),[`${opts.name}.service.mjs`]:registrar(opts.name,auth)})
+  let directoryCreated=false, serverAttempted=false, manifestAttempted=false, tsconfigAttempted=false
+  try {
+   await mkdir(destination,{recursive:false});directoryCreated=true
+   for(const [name,contents] of files)await io.writeFile(join(destination,name),contents,{flag:'wx'})
+   if(writeTsconfig){tsconfigAttempted=true;await io.writeFile(tsconfigPath,tsServiceConfig,{flag:'wx'})}
+   serverAttempted=true
+   await io.writeFile(serverPath,text.replace(marker,marker+moduleEntry))
+   manifestAttempted=true
+   await io.writeFile(manifestPath,manifestResult)
+  } catch(error) {
+   const failures=[]
+   // Restore even when a write was interrupted in the middle of a file.
+   if(manifestAttempted)try{await writeFile(manifestPath,manifestSource)}catch(e){failures.push(e)}
+   if(tsconfigAttempted)try{await rm(tsconfigPath,{force:true})}catch(e){failures.push(e)}
+   if(serverAttempted)try{await writeFile(serverPath,text)}catch(e){failures.push(e)}
+   if(directoryCreated)try{await rm(destination,{recursive:true,force:true})}catch(e){failures.push(e)}
+   if(failures.length)throw new AggregateError([error,...failures],'Service generation failed; rollback incomplete; inspect project before retry')
+   throw error
+  }
+  return output
+ } finally {
+  if(ownsLock)await rm(lockPath,{force:true})
+ }
 }
 export async function runServiceCommand(args,cwd){
  const result=await generateService(parseServiceArguments(args),cwd)

package/lib/typescript.mjs

@@ -0,0 +1,148 @@
+// Opt-in strict TypeScript Feathers service output for separately hosted API.
+// Keep the established JS defaults untouched; never generate a TypeScript facade.
+export const tsServiceConfig = JSON.stringify({
+  compilerOptions: {
+    target: 'ES2022', module: 'NodeNext', moduleResolution: 'NodeNext',
+    lib: ['ES2022'], types: ['node'], strict: true, noEmit: true,
+    isolatedModules: true, exactOptionalPropertyTypes: true,
+    noUncheckedIndexedAccess: true, allowImportingTsExtensions: true,
+    skipLibCheck: true,
+  }, include: ['services/**/*.ts'],
+}, null, 2) + '\n'
+
+const querySource = `
+export interface ValidQuery { title?: string; $limit?: number; $skip?: number }
+export function validateQuery(value: unknown): ValidQuery {
+  if (value === undefined || value === null) return {}
+  if (typeof value !== 'object' || Array.isArray(value)) throw new BadRequest('Invalid query')
+  const result: ValidQuery = {}
+  for (const [key, raw] of Object.entries(value)) {
+    if (key === 'title') {
+      if (typeof raw !== 'string' || raw.length > 120 || raw.trim().length < 1) throw new BadRequest('Invalid query title')
+      result.title = raw.trim()
+      continue
+    }
+    if (key === '$limit' || key === '$skip') {
+      if (typeof raw !== 'number' && typeof raw !== 'string') throw new BadRequest('Invalid query pagination')
+      if (typeof raw === 'string' && !/^(0|[1-9][0-9]*)$/.test(raw)) throw new BadRequest('Invalid query pagination')
+      const n = Number(raw)
+      if (!Number.isSafeInteger(n) || n < 0 || n > 1000) throw new BadRequest('Invalid query pagination')
+      result[key] = n
+      continue
+    }
+    throw new BadRequest('Unsupported query field')
+  }
+  return result
+}
+`
+
+export function schemaSourceTs(schema) {
+  const opening = "import { BadRequest } from '@feathersjs/errors'\n" +
+    'export interface ServiceData { title: string }\n' +
+    'export type ServicePatch = Partial<ServiceData>\n'
+  if (schema === 'zod') return opening + `import { z } from 'zod'
+export const dataSchema = z.object({title: z.string().trim().min(1).max(120)}).strict()
+export const patchSchema = dataSchema.partial()
+export function validateData(value: unknown): ServiceData {
+  const parsed = dataSchema.safeParse(value)
+  if (!parsed.success) throw new BadRequest('Invalid service data')
+  return parsed.data
+}
+export function validatePatch(value: unknown): ServicePatch {
+  const parsed = patchSchema.safeParse(value)
+  // .partial() permits an explicit undefined; never allow it to erase an existing title.
+  if (!parsed.success || typeof parsed.data.title !== 'string') throw new BadRequest('Invalid service patch')
+  return { title: parsed.data.title }
+}
+` + querySource
+  const declarations = schema === 'typebox'
+    ? `import { Type } from '@feathersjs/typebox'
+const titleSchema = Type.String({minLength:1,maxLength:120})
+export const dataSchema = Type.Object({title:titleSchema},{additionalProperties:false})
+export const patchSchema = Type.Object({title:Type.Optional(titleSchema)},{additionalProperties:false})
+`
+    : `const titleSchema = {type:'string',minLength:1,maxLength:120}
+export const dataSchema = {type:'object',additionalProperties:false,required:['title'],properties:{title:titleSchema}}
+export const patchSchema = {type:'object',additionalProperties:false,properties:{title:titleSchema}}
+`
+  return opening + "import AjvModule, { type ValidateFunction } from 'ajv'\n" + declarations + `// Ajv v8 ships CommonJS: NodeNext resolves its default import to the module namespace.\nconst Ajv = AjvModule.default\nconst ajv = new Ajv({allErrors:true,coerceTypes:false,removeAdditional:false,useDefaults:false})
+const validData = ajv.compile(dataSchema)
+const validPatch = ajv.compile(patchSchema)
+function normalized(value: unknown, validator: ValidateFunction, operation: string): ServiceData {
+  if (value === null || typeof value !== 'object' || Array.isArray(value) ||
+      !('title' in value) || typeof value.title !== 'string') throw new BadRequest('Invalid service ' + operation)
+  const canonical = { ...value, title: value.title.trim() }
+  if (!validator(canonical) || !canonical.title) throw new BadRequest('Invalid service ' + operation)
+  return { title: canonical.title }
+}
+export function validateData(value: unknown): ServiceData { return normalized(value, validData, 'data') }
+export function validatePatch(value: unknown): ServicePatch { return normalized(value, validPatch, 'patch') }
+` + querySource
+}
+
+export function classSourceTs() {
+  return `import { NotFound, BadRequest } from '@feathersjs/errors'
+import type { Id, Params } from '@feathersjs/feathers'
+import { validateData, validatePatch, validateQuery, type ServiceData, type ServicePatch } from './schema.ts'
+export interface ServiceRecord { id: number; title: string }
+export class GeneratedService {
+  readonly #items = new Map<number, ServiceRecord>()
+  #counter = 1
+  constructor() {
+    this.find = this.find.bind(this)
+    this.get = this.get.bind(this)
+    this.create = this.create.bind(this)
+    this.patch = this.patch.bind(this)
+    this.remove = this.remove.bind(this)
+  }
+  #id(value: Id): number {
+    if (typeof value !== 'number' && typeof value !== 'string') throw new BadRequest('Invalid ID')
+    if (typeof value === 'string' && !/^[1-9][0-9]*$/.test(value)) throw new BadRequest('Invalid ID')
+    const n = Number(value)
+    if (!Number.isSafeInteger(n) || n < 1) throw new BadRequest('Invalid ID')
+    return n
+  }
+  async find(params: Params = {}): Promise<ServiceRecord[]> {
+    const query = validateQuery(params.query)
+    const values = [...this.#items.values()].filter(row => query.title === undefined || row.title === query.title)
+    return values.slice(query.$skip ?? 0, (query.$skip ?? 0) + (query.$limit ?? values.length)).map(row => ({...row}))
+  }
+  async get(id: Id): Promise<ServiceRecord> {
+    const item = this.#items.get(this.#id(id))
+    if (!item) throw new NotFound('Not found')
+    return {...item}
+  }
+  async create(data: ServiceData): Promise<ServiceRecord> {
+    const input = validateData(data)
+    const row = {id: this.#counter++, ...input}
+    this.#items.set(row.id, row)
+    return {...row}
+  }
+  async patch(id: Id, data: ServicePatch): Promise<ServiceRecord> {
+    const key = this.#id(id)
+    const row = this.#items.get(key)
+    if (!row) throw new NotFound('Not found')
+    const next = {...row, ...validatePatch(data)}
+    this.#items.set(key, next)
+    return {...next}
+  }
+  async remove(id: Id): Promise<ServiceRecord> {
+    const key = this.#id(id)
+    const row = this.#items.get(key)
+    if (!row) throw new NotFound('Not found')
+    this.#items.delete(key)
+    return {...row}
+  }
+}
+`
+}
+
+export function registrarTs(name) {
+  return `import type { Application } from '@feathersjs/feathers'
+import { GeneratedService } from './service.class.ts'
+export default function register(app: Application): void {
+  app.use('${name}', new GeneratedService(), {methods: ['find','get','create','patch','remove']})
+  // No authentication: demo service must only listen on loopback.
+}
+`
+}

package/package.json

@@ -1,11 +1,11 @@
 {
   "name": "@vevedh/create-feathers-app",
-  "version": "0.1.0-rc.4",
+  "version": "0.1.0-rc.5",
   "type": "module",
   "description": "Scaffold FeathersJS v5 projects with Quasar 2 or daisyUI, Vite, Vue 3 and Pinia",
   "license": "MIT",
   "bin": {
-    "create-feathers-app": "./bin/create-feathers-app.mjs"
+    "create-feathers-app": "bin/create-feathers-app.mjs"
   },
   "engines": {
     "node": ">=22.12.0"