@vevedh/create-feathers-app 0.1.0-rc.4 → 0.1.0-rc.6

package/README.md

@@ -2,7 +2,7 @@
 
 Générez des applications FeathersJS v5 avec Vue 3, Pinia, Vite, Quasar 2 ou Tailwind CSS + daisyUI.
 
-Le CLI est indépendant du runtime [`@vevedh/vite-plugin-feathersjs`](https://www.npmjs.com/package/@vevedh/vite-plugin-feathersjs) (version 0.2.6). La version candidate `0.1.0-rc.4` **n'est pas encore publiée**. Elle ajoute la PWA optionnelle au rendu SPA.
+Le CLI est indépendant du runtime [`@vevedh/vite-plugin-feathersjs`](https://www.npmjs.com/package/@vevedh/vite-plugin-feathersjs) (version 0.2.7). La version `0.1.0-rc.5` est la candidate présente dans les sources locales. Ne pas présumer de sa publication npm ; vérifier les versions du registre avant installation. La PWA reste optionnelle pour une SPA.
 
 ## Usage
 
@@ -10,13 +10,13 @@ Le CLI est indépendant du runtime [`@vevedh/vite-plugin-feathersjs`](https://ww
 # Préversion disponible sur npm : 0.1.0-rc.1
 npm exec --yes --package=@vevedh/create-feathers-app@0.1.0-rc.1 -- create-feathers-app portail --ui daisyui --render spa
 
-# R17-r3 candidat, depuis les sources mises en stage :
+# Candidate RC5, depuis les sources mises en stage :
 node .release/create-feathers-app/bin/create-feathers-app.mjs portail-ssr --ui quasar2 --render ssr
 ```
 
 | Interface | SPA | SSR | SSG |
 | --- | --- | --- | --- |
-| Quasar 2 | Générable | Générable, validation Windows en cours | Bloqué |
+| Quasar 2 | Générable | Générable, validation Windows complète à vérifier | Bloqué |
 | daisyUI 5 | Générable | Générable | Générable |
 
 ## PWA optionnelle (SPA uniquement)
@@ -40,7 +40,7 @@ Le générateur ajoute le module `api/services/tickets` et son inscription dans
 
 ## Profils d'identité et de bases
 
-La création de projet accepte `--auth none|jwt|oauth2|oidc|keycloak`, `--schema typebox|json|zod` et `--db main:memory,audit:mongodb` avec alias nommés. **Les authentifications externes et les connexions persistantes sont des profils de configuration, pas des intégrations opérationnelles.** L'API échoue volontairement au démarrage jusqu'au raccordement et à la certification du fournisseur ou du SGBD.
+La création de projet accepte `--auth none|jwt|oauth2|oidc|keycloak`, `--schema typebox|json|zod` et `--db main:memory,audit:mongodb` avec alias nommés. **Les profils JWT disposent de modules Feathers/CASL et les providers nommés de modules serveur ; le bootstrap HTTP sécurisé et les tests DB restent à certifier. Les autres fournisseurs externes sont des profils de configuration, pas des intégrations opérationnelles.** L'API échoue volontairement au démarrage jusqu'au raccordement et à la certification du fournisseur ou du SGBD.
 
 Les projets sans authentification sont exclusivement des démonstrations locales. Ils ne doivent jamais être exposés tels quels sur Internet. Aucun secret, mot de passe ou jeton n'est inclus dans les templates.
 
@@ -57,10 +57,10 @@ SPA et daisyUI SSR/SSG utilisent `http://127.0.0.1:5173`. Quasar SSR utilise `ht
 
 La documentation publique VitePress figure dans `docs/cli` du dépôt et sera déployée sur GitHub Pages après activation du workflow de publication.
 
-## API Feathers intégrée à Vite en développement (RC4)
+## API Feathers intégrée à Vite en développement (RC5)
 
 Pour les applications SPA, `--dev-api vite` est désormais la valeur par défaut.
-Le plugin public `@vevedh/vite-plugin-feathersjs@0.2.6` est chargé depuis
+Le plugin public `@vevedh/vite-plugin-feathersjs@0.2.7` est chargé depuis
 `vite.config.ts` et monte les services sur `/api` pendant `vite dev`.
 Il n'y a pas de second serveur REST ni de proxy REST à démarrer.
 
@@ -77,4 +77,4 @@ node .release/create-feathers-app/bin/create-feathers-app.mjs mon-spa --ui quasa
 **Production** : le plugin Vite s'exécute uniquement en développement.
 Le serveur `api/server.mjs` autonome reste disponible et obligatoire pour
 le déploiement ; `vite preview` n'héberge pas l'API.
-Le runtime `0.2.6` n'a pas été modifié.
+La version `0.2.7` du plugin doit être certifiée et publiée avant une installation depuis npm.

package/bin/create-feathers-app.mjs

@@ -18,6 +18,7 @@ Usage: create-feathers-app <name> [options]
   --adapter <koa|express>  Default koa
   --transport <rest|both>  Default rest (both only for SPA)
   --pwa <on|off>      Optional offline SPA shell (default off, no API caching)
+  --compose <off|dev|prod|both>   Generate Docker Compose for SPA (default off)
   --dev-api <vite|separate>    SPA default vite; SSR/SSG always separate
   --dry-run           Preview files without writing
   --json              Machine-readable output
@@ -26,7 +27,7 @@ Usage: create-feathers-app <name> [options]
   --db <alias:adapter[,alias:adapter]>    Named connections (default main:memory)
   --version           Print CLI version
 
-Service: create-feathers-app service add <name> [--project <path>] [--schema typebox|json|zod] [--db <alias>] [--auth none|jwt] [--dry-run]
+Service: create-feathers-app service add <name> [--project <path>] [--schema typebox|json|zod] [--db <alias>] [--auth none|jwt] [--lang js|ts] [--dry-run]
 
 Available: Quasar 2 SPA/SSR; daisyUI SPA, SSR, SSG.
 Quasar SSR uses the R16-certified architecture; R17-generated SSR requires its own Windows E2E certification. Quasar SSG not supported.`)

package/lib/compose.mjs

@@ -0,0 +1,248 @@
+/** Opt-in, loopback-only Docker Compose profiles for Vite-first SPA applications.
+ * Authentication and database capability guards from scaffold.mjs stay active.
+ */
+const composeModes = new Set(['dev', 'prod', 'both'])
+
+function requireExact(files, path, before, after) {
+  const source = files.get(path)
+  if (typeof source !== 'string' || source.split(before).length !== 2) {
+    throw new Error(`Unexpected ${path} template; refusing Docker generation`)
+  }
+  files.set(path, source.replace(before, after))
+}
+
+function composeReadme(options) {
+  const dev = options.compose === 'dev' || options.compose === 'both'
+  const prod = options.compose === 'prod' || options.compose === 'both'
+  return `# Docker Compose — ${options.name}
+
+Ces fichiers déploient le squelette Vite-first, **pas une application déjà sécurisée pour Internet**.
+Le service de démonstration \`notes\` est en mémoire et sans authentification. Les ports HTTP sont publiés sur \`127.0.0.1\` uniquement.
+Aucun port de base de données n'est exposé. Le générateur **n'active pas** les profils JWT, OAuth ou bases externes : leurs garde-fous existants continuent de refuser le démarrage tant que leur intégration n'est pas certifiée.
+
+## Prérequis
+
+- Docker Desktop avec Docker Compose v2.
+- Node.js compatible et Corepack/pnpm pour produire \`pnpm-lock.yaml\`.
+- Vérifier les dépendances, leurs licences et vulnérabilités avant tout déploiement.
+
+${dev ? `## Développement
+
+\`docker compose -f compose.dev.yaml up --build\`
+
+Ouvrir http://127.0.0.1:5173. Le serveur Vite monte Feathers via le plugin Vite, sans lancer un deuxième processus d'API. Aucun autre port n'est publié.
+
+Arrêt : \`docker compose -f compose.dev.yaml down\` (le volume de dépendances est conservé).
+
+` : ''}${prod ? `## Image de déploiement (prototype isolé)
+
+Créer et réviser le lockfile à la racine du projet :
+
+\`corepack pnpm install --lockfile-only\`
+
+\`docker compose -f compose.prod.yaml up --build -d\`
+
+Ouvrir http://127.0.0.1:8080. Nginx sert la SPA et relaie \`/api/\` à Feathers et ${options.transport === 'both' ? '\`/socket.io/\` au serveur temps réel.' : 'aucun Socket.IO (REST uniquement).'} Le backend n'a pas de port publié sur l'hôte.
+
+Arrêt : \`docker compose -f compose.prod.yaml down\`.
+
+**Avant une réelle mise en production :** remplacer le service notes non protégé, activer JWT/RBAC et une persistance durable, vérifier les migrations, isoler les secrets, mettre en place le reverse proxy HTTPS et la politique d'origines, vérifier les journaux et sauvegardes et exécuter les E2E REST/Socket.IO de la cible. Ne pas changer l'interface hôte de \`127.0.0.1\` vers \`0.0.0.0\` sans ces contrôles.
+
+` : ''}## Particularités
+
+- Choix générés : ${options.ui} SPA, ${options.adapter}, ${options.transport}, PWA ${options.pwa}.
+- Le serveur API autonome peut écouter sur toutes les interfaces **du conteneur** uniquement via \`FEATHERS_BIND_HOST=0.0.0.0\` ; le réseau \`backend\` est interne et non publié.
+- Le mode PWA, lorsqu'il est sélectionné, ne doit jamais mettre \`/api/\` ou \`/socket.io/\` en cache.
+- Les images de production sont construites depuis un lockfile audité ; ne jamais copier de \`.env\` réel dans les images.
+- Les ports peuvent être personnalisés uniquement côté loopback via \`P4_DEV_PORT\` et \`P4_HTTP_PORT\`.
+`
+}
+
+function devCompose(options) {
+  return `name: ${options.name}-dev
+services:
+  app:
+    image: node:24-bookworm-slim
+    working_dir: /workspace
+    command: ["sh", "-c", "corepack pnpm install --no-frozen-lockfile && corepack pnpm exec vite --host 0.0.0.0 --port 5173 --strictPort"]
+    environment:
+      NODE_ENV: development
+      VITE_FEATHERS_REALTIME: "${options.transport === 'both' ? '1' : '0'}"
+      P4_DEV_PORT: "\${P4_DEV_PORT:-5173}"
+    volumes:
+      - .:/workspace
+      - dependencies:/workspace/node_modules
+    ports:
+      - "127.0.0.1:\${P4_DEV_PORT:-5173}:5173"
+    security_opt:
+      - no-new-privileges:true
+volumes:
+  dependencies:
+`
+}
+
+function prodCompose(options) {
+  return `name: ${options.name}-prod
+services:
+  api:
+    build:
+      context: .
+      dockerfile: infra/compose/Dockerfile.api
+    environment:
+      NODE_ENV: production
+      FEATHERS_BIND_HOST: "0.0.0.0"
+      FEATHERS_ADAPTER: "${options.adapter}"
+      FEATHERS_SOCKETIO: "${options.transport === 'both' ? '1' : '0'}"
+      FEATHERS_API_PORT: "3030"
+      FEATHERS_SOCKET_PORT: "3031"
+      FEATHERS_PUBLIC_ORIGIN: "http://127.0.0.1:\${P4_HTTP_PORT:-8080}"
+      FEATHERS_PREVIEW_ORIGIN: "http://127.0.0.1:\${P4_HTTP_PORT:-8080}"
+    expose:
+      - "3030"
+${options.transport === 'both' ? '      - "3031"\n' : ''}    networks:
+      - backend
+    security_opt:
+      - no-new-privileges:true
+    read_only: true
+    tmpfs:
+      - /tmp
+    healthcheck:
+      test: ["CMD", "node", "-e", "fetch('http://127.0.0.1:3030/api/health').then(r=>process.exit(r.ok?0:1)).catch(()=>process.exit(1))"]
+      interval: 10s
+      timeout: 5s
+      retries: 8
+      start_period: 20s
+  web:
+    build:
+      context: .
+      dockerfile: infra/compose/Dockerfile.web
+    depends_on:
+      api:
+        condition: service_healthy
+    ports:
+      - "127.0.0.1:\${P4_HTTP_PORT:-8080}:8080"
+    networks:
+      - frontend
+      - backend
+    security_opt:
+      - no-new-privileges:true
+networks:
+  frontend:
+  backend:
+    internal: true
+`
+}
+
+const apiDockerfile = `FROM node:24-bookworm-slim
+WORKDIR /app
+RUN corepack enable
+COPY package.json pnpm-lock.yaml ./
+RUN corepack pnpm install --frozen-lockfile --prod
+COPY api ./api
+USER node
+EXPOSE 3030 3031
+CMD ["node", "api/server.mjs"]
+`
+
+const webDockerfile = `FROM node:24-bookworm-slim AS builder
+WORKDIR /app
+RUN corepack enable
+COPY package.json pnpm-lock.yaml ./
+RUN corepack pnpm install --frozen-lockfile
+COPY . .
+RUN corepack pnpm run build
+
+FROM nginx:stable-alpine
+COPY infra/compose/nginx.conf /etc/nginx/conf.d/default.conf
+COPY --from=builder /app/dist /usr/share/nginx/html
+EXPOSE 8080
+`
+
+function nginx(options) {
+  return `server {
+  listen 8080;
+  server_name _;
+  root /usr/share/nginx/html;
+  index index.html;
+  autoindex off;
+  server_tokens off;
+  add_header X-Content-Type-Options nosniff always;
+  add_header Referrer-Policy no-referrer always;
+  add_header X-Frame-Options DENY always;
+  location = /api { return 404; }
+  location /api/ {
+    proxy_pass http://api:3030/api/;
+    proxy_http_version 1.1;
+    proxy_set_header Host $host;
+    proxy_set_header X-Forwarded-Proto $scheme;
+    proxy_set_header X-Forwarded-For $remote_addr;
+    proxy_read_timeout 30s;
+  }
+${options.transport === 'both' ? `  location /socket.io/ {
+    proxy_pass http://api:3031;
+    proxy_http_version 1.1;
+    proxy_set_header Upgrade $http_upgrade;
+    proxy_set_header Connection "upgrade";
+    proxy_set_header Host $host;
+    proxy_read_timeout 65s;
+  }
+` : `  location /socket.io/ { return 404; }
+`}  location / {
+    try_files $uri $uri/ /index.html;
+  }
+}
+`
+}
+
+const dockerIgnore = `node_modules
+.git
+.agents
+.ai
+.codex
+.cursor
+.claude
+.gemini
+.windsurf
+.mcp.json
+.env
+.env.*
+!.env.example
+database.env
+*.zip
+*.log
+coverage
+dist
+.vite
+.quasar
+docs-private
+test-results
+playwright-report
+`
+
+export function enableCompose(files, options) {
+  if (!composeModes.has(options.compose) || options.render !== 'spa') {
+    throw new Error('Compose generation supports only SPA and compose dev|prod|both')
+  }
+  const dev = options.compose === 'dev' || options.compose === 'both'
+  const prod = options.compose === 'prod' || options.compose === 'both'
+  if (dev && options.devApi !== 'vite') {
+    throw new Error('Compose development requires --dev-api vite for a single Feathers/Vite listener')
+  }
+  const created = new Map([['COMPOSE.md', composeReadme(options)]])
+  if (dev) created.set('compose.dev.yaml', devCompose(options))
+  if (prod) {
+    created.set('compose.prod.yaml', prodCompose(options))
+    created.set('infra/compose/Dockerfile.api', apiDockerfile)
+    created.set('infra/compose/Dockerfile.web', webDockerfile)
+    created.set('infra/compose/nginx.conf', nginx(options))
+    // The only Docker interface bound to all container addresses is the private API listener.
+    requireExact(files, 'api/server.mjs', "const realtime = process.env.FEATHERS_SOCKETIO === '1'", "const bindHost = process.env.FEATHERS_BIND_HOST === '0.0.0.0' ? '0.0.0.0' : '127.0.0.1'\nconst realtime = process.env.FEATHERS_SOCKETIO === '1'")
+    requireExact(files, 'api/server.mjs', "host: '127.0.0.1' } : false", 'host: bindHost } : false')
+    requireExact(files, 'api/server.mjs', "httpServer.listen(port, '127.0.0.1', resolve)", 'httpServer.listen(port, bindHost, resolve)')
+  }
+  created.set('.dockerignore', dockerIgnore)
+  for (const [key, content] of created) {
+    if (files.has(key)) throw new Error(`Compose file conflicts with a template: ${key}`)
+    files.set(key, content)
+  }
+}

package/lib/scaffold.mjs

@@ -2,8 +2,9 @@ import { mkdir, lstat, readdir, readFile, writeFile } from 'node:fs/promises'
 import { existsSync } from 'node:fs'
 import { dirname, join, relative, resolve, sep } from 'node:path'
 import { buildProjectPlan } from './planner/plan.mjs'
+import { enableCompose } from './compose.mjs'
 
-const KEYS = new Set(['--name', '--dir', '--ui', '--render', '--adapter', '--transport', '--dry-run', '--json', '--schema', '--auth', '--db', '--pwa', '--dev-api'])
+const KEYS = new Set(['--name', '--dir', '--ui', '--render', '--adapter', '--transport', '--dry-run', '--json', '--schema', '--auth', '--db', '--pwa', '--dev-api', '--compose'])
 const CASES = Object.freeze({
   'quasar2:spa': 'quasar-spa',
   'quasar2:ssr': 'quasar-ssr',
@@ -43,8 +44,8 @@ function envChange(text, options) {
 }
 function spaManifest(o) {
   const dependencies = {
-    '@vevedh/vite-plugin-feathersjs':'0.2.6', '@feathersjs/feathers':'^5.0.50', '@feathersjs/errors':'^5.0.50',
-    '@feathersjs/koa':'^5.0.50', '@feathersjs/express':'^5.0.50', '@feathersjs/socketio':'^5.0.50',
+    '@vevedh/vite-plugin-feathersjs':'0.2.7', '@feathersjs/feathers':'5.0.50', '@feathersjs/errors':'5.0.50',
+    '@feathersjs/koa':'5.0.51', '@feathersjs/express':'5.0.51', '@feathersjs/socketio':'5.0.51',
     vue:'^3.5.44', pinia:'^3.0.4', 'socket.io-client':'^4.8.4',
   }
   const devDependencies = {
@@ -87,13 +88,14 @@ function enableSpaViteRuntime(files, options) {
   }
   const realtime = options.transport === 'both'
   const socket = realtime
-    ? "{ port: 3031, host: '127.0.0.1', origins: ['http://127.0.0.1:5173'] }"
+    ? "{ port: 3031, host: '127.0.0.1', origins: ['http://127.0.0.1:' + String(Number(process.env.P4_DEV_PORT || 5173))] }"
     : 'false'
   const runtime = `feathers({
     serviceFiles: 'api/services/*/*.service.mjs',
     watchDirectories: ['api/services'],
     adapter: ${JSON.stringify(options.adapter)},
     prefix: '/api',
+    lifecycle: 'managed',
     cors: false,
     socketio: ${socket},
   })`
@@ -154,7 +156,7 @@ function enableSpaPwa(files, options) {
 export function createGenerator({outputRoot, templatesRoot, examplesRoot = templatesRoot, reportRoot = outputRoot}) {
   const output = resolve(outputRoot), templates = resolve(templatesRoot), report = resolve(reportRoot)
   function parse(args) {
-    const o={ui:'daisyui',render:'spa',adapter:'koa',transport:'rest',schema:'typebox',auth:'none',db:'main:memory',pwa:'off',devApi:undefined,dryRun:false,json:false}
+    const o={ui:'daisyui',render:'spa',adapter:'koa',transport:'rest',schema:'typebox',auth:'none',db:'main:memory',pwa:'off',compose:'off',devApi:undefined,dryRun:false,json:false}
     const seen=new Set()
     if (args.length && !args[0].startsWith('-')) {o.name=args[0];args=args.slice(1);if(args.includes('--name'))throw new Error('Use either positional name or --name, not both')}
     for(let i=0;i<args.length;i++) {
@@ -170,6 +172,9 @@ export function createGenerator({outputRoot, templatesRoot, examplesRoot = templ
     if (o.devApi === 'vite' && o.render !== 'spa') throw new Error('--dev-api vite is supported for SPA only; SSR/SSG require separate API')
     if(!['koa','express'].includes(o.adapter))throw new Error('Only koa|express adapters are supported')
     if(!['rest','both'].includes(o.transport))throw new Error('Only rest|both are supported')
+    if (!['off','dev','prod','both'].includes(o.compose)) throw new Error('Invalid --compose: expected off|dev|prod|both')
+    if (o.compose !== 'off' && o.render !== 'spa') throw new Error('Docker Compose currently supports SPA only; SSR/SSG must be certified separately')
+    if (o.compose !== 'off' && o.devApi !== 'vite' && o.compose !== 'prod') throw new Error('Compose dev requires --dev-api vite')
     if (!['on','off'].includes(o.pwa)) throw new Error('Invalid --pwa: expected on|off')
     if (o.pwa==='on' && o.render!=='spa') throw new Error('PWA is supported for SPA only; SSR/SSG require separate certification')
     if (!['typebox','json','zod'].includes(o.schema)) throw new Error('Invalid --schema: expected typebox|json|zod')
@@ -201,7 +206,7 @@ export function createGenerator({outputRoot, templatesRoot, examplesRoot = templ
     if(files.has('gitignore.template')){files.set('.gitignore',files.get('gitignore.template'));files.delete('gitignore.template')}
     if(files.has('.gitignore')) {
       const ignores=files.get('.gitignore')
-      const additions=['.agents/','AGENTS.md','SKILLS.md','*.prompt.md','.ai/','.codex/','.cursor/','.claude/','.gemini/','.windsurf/','.aider*','.mcp.json','.vscode/mcp.json','.github/copilot-instructions.md','docs-private/','.npmrc','.env*','!.env.example']
+      const additions=['.agents/','AGENTS.md','SKILLS.md','*.prompt.md','.ai/','.codex/','.cursor/','.claude/','.gemini/','.windsurf/','.aider*','.mcp.json','.vscode/mcp.json','.github/copilot-instructions.md','docs-private/','.npmrc','.env*','!.env.example','api/.create-feathers-service.lock']
       files.set('.gitignore',ignores.trimEnd()+'\n\n# Local editor tooling and private maintenance files\n'+additions.filter(x=>!ignores.split(/\r?\n/).includes(x)).join('\n')+'\n')
     }
     if(!files.has('api/server.mjs')||!files.has('.env.example')||!files.has('index.html'))throw new Error('Incomplete source template')
@@ -244,17 +249,35 @@ export function createGenerator({outputRoot, templatesRoot, examplesRoot = templ
     files.set('api/config/profile.json',JSON.stringify({schema:o.schema,auth:o.auth,databases:o.databases,primary:o.databases[0].alias,operational:o.auth==='none' && o.databases.every(db=>db.adapter==='memory')},null,2)+'\n')
     const depMap={typebox:['@feathersjs/typebox','ajv'],json:['ajv'],zod:['zod']}
     // Dependencies for the service subcommand; project options alone create no arbitrary services.
-    for(const dep of depMap[o.schema])manifest.dependencies[dep] ||= dep==='ajv'?'^8.17.1':dep==='zod'?'^4.1.0':'^5.0.50'
-    if(o.auth==='jwt')manifest.dependencies['@feathersjs/authentication']='^5.0.50'
-    if(o.auth==='oauth2')manifest.dependencies['@feathersjs/authentication-oauth']='^5.0.50'
+    for(const dep of depMap[o.schema])manifest.dependencies[dep] ||= dep==='ajv'?'^8.17.1':dep==='zod'?'^4.1.0':'5.0.51'
+    if(o.auth==='jwt')manifest.dependencies['@feathersjs/authentication']='5.0.50'
+    if(o.auth==='oauth2')manifest.dependencies['@feathersjs/authentication-oauth']='5.0.51'
     for(const db of o.databases) {
       const drivers={mongodb:['@feathersjs/mongodb','mongodb'],postgresql:['@feathersjs/knex','knex','pg'],mariadb:['@feathersjs/knex','knex','mysql2'],mysql:['@feathersjs/knex','knex','mysql2'],sqlite:['@feathersjs/knex','knex','better-sqlite3']}
-      for(const dep of drivers[db.adapter]||[])manifest.dependencies[dep]||='*'
+      for(const dep of drivers[db.adapter]||[])manifest.dependencies[dep] ||= dep === 'mongodb' ? '6.19.0' : dep === '@feathersjs/mongodb' ? '5.0.51' : dep === '@feathersjs/knex' ? '5.0.50' : '*'
     }
     files.set('package.json',JSON.stringify(manifest,null,2)+'\n')
+    if (o.auth === 'jwt' && o.databases.some(db => ['postgresql','mariadb','mongodb'].includes(db.adapter))) {
+      for (const name of ['register.mjs','policy.mjs']) files.set('api/security/' + name, await readFile(new URL('./secure-runtime/' + name, import.meta.url), 'utf8'))
+      Object.assign(manifest.dependencies, { '@feathersjs/authentication-local': '5.0.50', '@casl/ability': '6.8.1', 'feathers-casl': '3.1.0' })
+      manifest.dependencies.zod ||= '^4.1.0'
+      files.set('package.json',JSON.stringify(manifest,null,2)+'\n')
+    }
+    const persistentDatabases = o.databases.filter(db => ['postgresql','mariadb','mongodb'].includes(db.adapter))
+    if (o.auth === 'jwt' && persistentDatabases.length) {
+      const declarations = persistentDatabases.map(db => ({ alias: db.alias, adapter: db.adapter, envPrefix: 'P5_DB_' + db.alias.replaceAll('-', '_').toUpperCase() }))
+      if (new Set(declarations.map(db => db.envPrefix)).size !== declarations.length) throw new Error('Database environment prefix collision')
+      files.set('api/config/database-connections.generated.mjs', 'export const databaseDeclarations = Object.freeze(' + JSON.stringify(declarations, null, 2) + ')\n')
+      for (const [source, target] of [['providers.mjs','api/runtime/database-providers.generated.mjs'], ['storage.mjs','api/runtime/storage.mjs'], ['prepare-storage.mjs','scripts/prepare-storage.mjs'], ['connect.mjs','api/security/connect.mjs']]) {
+        files.set(target, await readFile(new URL('./secure-runtime/' + source, import.meta.url), 'utf8'))
+      }
+      const env = declarations.flatMap(db => [db.envPrefix + '_HOST=127.0.0.1', db.envPrefix + '_PORT=' + (db.adapter === 'postgresql' ? '5432' : db.adapter === 'mariadb' ? '3306' : '27017'), db.envPrefix + '_USER=', db.envPrefix + '_PASSWORD=', db.envPrefix + '_NAME='])
+      files.set('database.env.example', env.join('\n') + '\n')
+    }
+    if (o.compose !== 'off') enableCompose(files, o)
     const list=[...files.keys()].sort()
     const result={name:o.name,ui:o.ui,render:o.render,adapter:o.adapter,transport:o.transport,
-      destination:relative(report,o.destination).split(sep).join('/'),schema:o.schema,auth:o.auth,pwa:o.pwa,devApi:o.devApi,databases:o.databases,files:list}
+      destination:relative(report,o.destination).split(sep).join('/'),schema:o.schema,auth:o.auth,pwa:o.pwa,compose:o.compose,devApi:o.devApi,databases:o.databases,files:list}
     if(o.dryRun)return result
     // Do not follow symlinks and refuse any existing destination, including empty ones.
     await mkdir(output,{recursive:true})
@@ -276,9 +299,9 @@ function quasarSSRManifest(o){
     scripts:{'dev:ssr':'quasar dev -m ssr','build:ssr':'quasar build -m ssr',build:'quasar build -m ssr',
       typecheck:'vue-tsc --noEmit', 'dev:api':'node --env-file=.env.example api/server.mjs',
       'serve:production':'node dist/ssr/index.js',postinstall:'quasar prepare', 'dev:edge':'node scripts/edge-proxy.mjs'},
-    dependencies:{'@vevedh/vite-plugin-feathersjs':'0.2.6', '@feathersjs/feathers':'^5.0.50', '@feathersjs/koa':'^5.0.50',
-      '@feathersjs/express':'^5.0.50', '@feathersjs/errors':'^5.0.50', '@feathersjs/socketio':'^5.0.50',
-      '@feathersjs/rest-client':'^5.0.50', '@feathersjs/socketio-client':'^5.0.50',
+    dependencies:{'@vevedh/vite-plugin-feathersjs':'0.2.7', '@feathersjs/feathers':'5.0.50', '@feathersjs/koa':'5.0.51',
+      '@feathersjs/express':'5.0.51', '@feathersjs/errors':'5.0.50', '@feathersjs/socketio':'5.0.51',
+      '@feathersjs/rest-client':'5.0.50', '@feathersjs/socketio-client':'5.0.50',
       '@quasar/extras':'^1.18.0',pinia:'^3.0.4',quasar:'^2.35.2','socket.io-client':'^4.8.4',
       vue:'^3.5.44','vue-router':'^4.6.4',express:'^4.22.3','serialize-javascript':'^7.1.4'},
     devDependencies:{'@quasar/app-vite':'2.6.2','@types/node':'^22.0.0',typescript:'^5.9.3','vue-tsc':'^3.3.14',

package/lib/secure-runtime/connect.mjs

@@ -0,0 +1,28 @@
+import { openNamedDatabaseProviders } from '../runtime/database-providers.generated.mjs'
+import { storageNames } from '../runtime/storage.mjs'
+import { registerSecuredPersistence } from './register.mjs'
+
+/** Attach real persistence/auth to an unstarted Feathers app; caller owns listener and shutdown.
+ * No schema creation, account seeding or socket broadcast occurs during startup.
+ */
+export async function connectSecuredPersistence(app, config) {
+  if (!config || Object.keys(config).sort().join(',') !== 'alias,audience,issuer,secret') throw Error('INVALID_SECURITY_CONFIG')
+  let providers
+  try {
+    providers = await openNamedDatabaseProviders()
+    const provider = providers.get(config.alias)
+    // Readiness checks the actual schema/collections before registration.
+    if (provider.adapter === 'mongodb') {
+      for (const name of Object.values(storageNames)) {
+        if (!await provider.db.listCollections({ name }).hasNext()) throw Error('STORAGE_NOT_PREPARED')
+      }
+    } else {
+      for (const name of Object.values(storageNames)) if (!await provider.db.schema.hasTable(name)) throw Error('STORAGE_NOT_PREPARED')
+    }
+    registerSecuredPersistence(app, providers, { ...config, ...storageNames })
+    return Object.freeze({ close: () => providers.close() })
+  } catch (error) {
+    try { await providers?.close() } catch {}
+    throw error
+  }
+}

package/lib/secure-runtime/policy.mjs

@@ -0,0 +1,85 @@
+/** P5-R5-R4-R2: only server-validated identities determine Feathers/CASL permissions. */
+import { randomUUID } from 'node:crypto'
+import { AbilityBuilder, createMongoAbility } from '@casl/ability'
+import { BadRequest, NotAuthenticated } from '@feathersjs/errors'
+                                                       
+import { z } from 'zod'
+
+const id = z.string().uuid()
+const title = z.string().trim().min(1).max(80).regex(/^[A-Za-z0-9 _.-]+$/)
+const create = z.object({ title }).strict()
+const patch = z.object({ title }).strict()
+const list = z.object({
+  $limit: z.coerce.number().int().min(0).max(50).optional(),
+  $skip: z.coerce.number().int().min(0).max(100).optional(),
+}).strict()
+const empty = z.object({}).strict()
+
+                                                
+                                        
+            
+            
+                  
+                        
+  
+
+export function validateIdentity(input         )                  {
+  if (typeof input !== 'object' || input === null || Array.isArray(input)) {
+    throw new NotAuthenticated('Identity unavailable')
+  }
+  const value = input                           
+  const parsed = z.object({
+    id,
+    role: z.enum(['viewer','editor','admin']),
+    status: z.literal('active'),
+    sessionVersion: z.number().int().positive().safe(),
+  }).passthrough().safeParse(value)
+  if (!parsed.success) throw new NotAuthenticated('Identity unavailable')
+  return parsed.data
+}
+
+export function serverAbility(identity                 ) {
+  const { can, rules } = new AbilityBuilder(createMongoAbility)
+  if (identity.role === 'admin') {
+    can('manage', 'all')
+  } else {
+    can('find', 'documents', ['id','title','ownerId'], { ownerId: identity.id })
+    can('get', 'documents', ['id','title','ownerId'], { ownerId: identity.id })
+    if (identity.role === 'editor') {
+      can('create', 'documents')
+      can('patch', 'documents', ['title'], { ownerId: identity.id })
+    }
+  }
+  return createMongoAbility(rules)
+}
+
+                                               
+                                            
+                                            
+ 
+
+/** Must run after real Feathers authenticate('jwt') and before CASL authorize(). */
+export function documentPolicy(revalidate                                           ) {
+  return async (context             )                => {
+    if (['get', 'patch', 'remove'].includes(context.method) && !id.safeParse(context.id).success) throw new BadRequest('Invalid id')
+    const params = context.params                  
+    if (!params.provider) throw new NotAuthenticated('Authenticated transport required')
+    const token = params.authentication?.accessToken
+    if (typeof token !== 'string' || token.length < 24 || token.length > 4096) {
+      throw new NotAuthenticated('Authentication required')
+    }
+    // Never use params.user, client JWT roles, client-supplied ability, or stale socket permissions.
+    const identity = validateIdentity(await revalidate(token))
+    params.ability = serverAbility(identity)
+    const query = (context.method === 'find' ? list : empty).safeParse(params.query ?? {})
+    if (!query.success) throw new BadRequest('Invalid query')
+    context.params.query = query.data
+    if (context.method === 'create' || context.method === 'patch') {
+      const parsed = (context.method === 'create' ? create : patch).safeParse(context.data           )
+      if (!parsed.success) throw new BadRequest('Invalid data')
+      context.data = context.method === 'create'
+        ? { ...parsed.data, id: randomUUID(), ownerId: identity.id, internal: null }
+        : parsed.data
+    }
+  }
+}

package/lib/secure-runtime/prepare-storage.mjs

@@ -0,0 +1,14 @@
+import { openNamedDatabaseProviders } from '../api/runtime/database-providers.generated.mjs'
+import { prepareIdentityStorage } from '../api/runtime/storage.mjs'
+const [mode, flag, alias, ...extra] = process.argv.slice(2)
+if (mode !== '--apply' || flag !== '--alias' || !/^[a-z][a-z0-9-]{0,31}$/.test(alias ?? '') || extra.length) {
+  console.error('STORAGE=REFUSED | EXPECTED=--apply --alias NAME'); process.exitCode = 2
+} else {
+  let providers
+  try {
+    providers = await openNamedDatabaseProviders()
+    await prepareIdentityStorage(providers.get(alias))
+    console.log('STORAGE=PREPARED | ACCOUNTS_CREATED=0 | PUBLIC_RUNTIME=BLOCKED')
+  } catch { console.error('STORAGE=FAILED | PUBLIC_RUNTIME=BLOCKED'); process.exitCode = 2 }
+  finally { try { await providers?.close() } catch { console.error('STORAGE=CLEANUP_FAILED'); process.exitCode = 2 } }
+}

package/lib/secure-runtime/providers.mjs

@@ -0,0 +1,74 @@
+/** P5-R5-R4-R4-R1 — named Feathers providers. Internal-only, no HTTP routes. */
+import { databaseDeclarations } from '../config/database-connections.generated.mjs'
+const known = new Set(['postgresql', 'mariadb', 'mongodb'])
+const tableName = /^[a-z][a-z0-9_]{0,56}$/
+const hostName = /^(?:localhost|(?:[a-zA-Z0-9](?:[a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?)(?:\.(?:[a-zA-Z0-9](?:[a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?))*)$/
+const accountName = /^[a-zA-Z_][a-zA-Z0-9_]{0,62}$/
+const text = (env,key,min,max)=> { const v=env[key]; if(typeof v!=='string'||v.length<min||v.length>max||v.trim()!==v)throw Error('INVALID_DB_ENV');return v }
+function readSettings(env, entry){
+  const prefix=entry.envPrefix
+  const host=text(env,`${prefix}_HOST`,1,253)
+  const rawPort=text(env,`${prefix}_PORT`,1,5)
+  const user=text(env,`${prefix}_USER`,1,63)
+  const password=text(env,`${prefix}_PASSWORD`,1,256)
+  const database=text(env,`${prefix}_NAME`,1,63)
+  const port=Number(rawPort)
+  if(!hostName.test(host)||!Number.isSafeInteger(port)||port<1||port>65535||String(port)!==rawPort||!accountName.test(user)||!accountName.test(database)||/\p{C}/u.test(password))throw Error('INVALID_DB_ENV')
+  return {host,port,user,password,database}
+}
+function validateDeclarations(){
+  if(!Array.isArray(databaseDeclarations)||databaseDeclarations.length<1||databaseDeclarations.length>8)throw Error('INVALID_DECLARATIONS')
+  const seen=new Set()
+  for(const d of databaseDeclarations){
+    if(!d||typeof d.alias!=='string'||!tableName.test(d.alias.replaceAll('-','_'))||!known.has(d.adapter)||typeof d.envPrefix!=='string'||!/^P5_DB_[A-Z][A-Z0-9_]*$/.test(d.envPrefix)||seen.has(d.alias))throw Error('INVALID_DECLARATIONS')
+    seen.add(d.alias)
+  }
+}
+export function validateNamedProviderEnvironment(env=process.env){
+  validateDeclarations()
+  for(const d of databaseDeclarations)readSettings(env,d)
+  return databaseDeclarations.length
+}
+export async function openNamedDatabaseProviders(env=process.env){
+  validateNamedProviderEnvironment(env)
+  const providers=new Map()
+  let closed=false
+  const close=async()=>{
+    if(closed)return
+    closed=true
+    const failures=[]
+    for(const entry of [...providers.values()].reverse())try{await entry.close()}catch{failures.push(1)}
+    providers.clear()
+    if(failures.length)throw Error('DB_CLEANUP_FAILED')
+  }
+  try{
+    for(const declaration of databaseDeclarations){
+      const cfg=readSettings(env,declaration)
+      if(declaration.adapter==='mongodb'){
+        const { MongoClient }=await import('mongodb')
+        const { MongoDBService }=await import('@feathersjs/mongodb')
+        const client=new MongoClient(`mongodb://${cfg.host}:${cfg.port}`,{auth:{username:cfg.user,password:cfg.password},authSource:'admin',serverSelectionTimeoutMS:8000,maxPoolSize:3})
+        try{await client.connect();await client.db(cfg.database).command({ping:1})}
+        catch{await client.close();throw Error('DB_CONNECT_FAILED')}
+        const db=client.db(cfg.database)
+        providers.set(declaration.alias,{alias:declaration.alias,adapter:'mongodb',db,close:()=>client.close(), service(name){
+          if(typeof name!=='string'||!tableName.test(name))throw Error('INVALID_TABLE_NAME')
+          return new MongoDBService({Model:db.collection(name),id:'id',disableObjectify:true,paginate:false,disabledOperators:['$rename','$set','$inc','$unset','$push','$pull','$pop']})
+        }})
+      }else{
+        const { default: knex }=await import('knex')
+        const { KnexService }=await import('@feathersjs/knex')
+        const db=knex({client:declaration.adapter==='postgresql'?'pg':'mysql2',connection:{host:cfg.host,port:cfg.port,user:cfg.user,password:cfg.password,database:cfg.database},pool:{min:0,max:3},acquireConnectionTimeout:8000})
+        try{await db.raw('SELECT 1')}catch{await db.destroy();throw Error('DB_CONNECT_FAILED')}
+        providers.set(declaration.alias,{alias:declaration.alias,adapter:declaration.adapter,db,close:()=>db.destroy(),service(name){
+          if(typeof name!=='string'||!tableName.test(name))throw Error('INVALID_TABLE_NAME')
+          return new KnexService({Model:db,name,id:'id',paginate:false})
+        }})
+      }
+    }
+    return Object.freeze({aliases:Object.freeze([...providers.keys()]),get(alias){
+      if(closed||typeof alias!=='string'||!providers.has(alias))throw Error('DB_ALIAS_UNAVAILABLE')
+      return providers.get(alias)
+    },close})
+  }catch{try{await close()}catch{};throw Error('DB_PROVIDER_BOOT_FAILED')}
+}

package/lib/secure-runtime/register.mjs

@@ -0,0 +1,80 @@
+import { AuthenticationService, JWTStrategy, authenticate } from '@feathersjs/authentication'
+import { LocalStrategy } from '@feathersjs/authentication-local'
+import { NotAuthenticated } from '@feathersjs/errors'
+import { feathersCasl, authorize } from 'feathers-casl'
+import { documentPolicy, validateIdentity } from './policy.mjs'
+
+class SessionAuthentication extends AuthenticationService {
+  async getPayload(result) {
+    const identity = validateIdentity(result.user)
+    return { sessionVersion: identity.sessionVersion }
+  }
+  async create(data, params) {
+    const result = await super.create(data, params)
+    if (!result.user) return result
+    const user = validateIdentity(result.user)
+    // Explicit allowlist: never serialize the stored password or adapter metadata.
+    return { ...result, user: { id: user.id, role: user.role, status: user.status, sessionVersion: user.sessionVersion } }
+  }
+}
+class SessionJWT extends JWTStrategy {
+  async authenticate(data, params) {
+    const result = await super.authenticate(data, params)
+    const identity = validateIdentity(result.user)
+    if (identity.sessionVersion !== result.authentication?.payload?.sessionVersion) throw new NotAuthenticated('Invalid session')
+    return result
+  }
+}
+class ActiveLocal extends LocalStrategy {
+  async authenticate(data, params) {
+    const result = await super.authenticate(data, params)
+    validateIdentity(result.user)
+    return result
+  }
+}
+
+/** Server-owned configuration only. Tables and indexes must be provisioned separately.
+ * Register before opening any HTTP or Socket.IO listener. No account is seeded here.
+ * The caller owns provider teardown. Existing generated capability guard remains authoritative.
+ */
+export function registerSecuredPersistence(app, providers, config) {
+  if (!config || Object.keys(config).sort().join(',') !== 'alias,audience,documents,issuer,secret,users') throw Error('INVALID_SECURITY_CONFIG')
+  if (typeof config.secret !== 'string' || config.secret.length < 48 || config.secret.length > 512 || /\s/.test(config.secret)) throw Error('INVALID_JWT_SECRET')
+  for (const key of ['issuer','audience']) if (typeof config[key] !== 'string' || !/^[a-zA-Z0-9:_-]{3,100}$/.test(config[key])) throw Error('INVALID_JWT_SCOPE')
+  for (const key of ['users','documents']) if (typeof config[key] !== 'string' || !/^[a-z][a-z0-9_]{0,55}$/.test(config[key])) throw Error('INVALID_STORAGE_NAME')
+  if (config.users === config.documents || typeof config.alias !== 'string' || !/^[a-z][a-z0-9-]{0,31}$/.test(config.alias)) throw Error('INVALID_BINDING')
+  if (!app || typeof app.use !== 'function' || !providers || typeof providers.get !== 'function') throw Error('INVALID_RUNTIME')
+  for (const path of ['users','authentication','documents']) if (app.services?.[path]) throw Error('SERVICE_COLLISION')
+  const provider = providers.get(config.alias)
+  if (!provider || !['mongodb','postgresql','mariadb'].includes(provider.adapter)) throw Error('UNSUPPORTED_PROVIDER')
+  const adapter = provider.adapter === 'mongodb' ? '@feathersjs/mongodb' : '@feathersjs/knex'
+  const users = provider.service(config.users)
+  const documents = provider.service(config.documents)
+  if (provider.adapter === 'mongodb') {
+    documents.options.filters = { ...documents.options.filters, $nor: true }
+    documents.options.operators = [...new Set([...(documents.options.operators ?? []), '$nor', '$and'])]
+  }
+  app.configure(feathersCasl({ defaultAdapter: adapter }))
+  app.set('authentication', {
+    secret: config.secret, service: 'users', entity: 'user', authStrategies: ['jwt','local'], parseStrategies: ['jwt'],
+    jwtOptions: { algorithm: 'HS256', expiresIn: '15m', issuer: config.issuer, audience: config.audience },
+    local: { usernameField: 'email', passwordField: 'password', hashSize: 10 },
+  })
+  app.use('users', users, { methods: [], events: [] })
+  const auth = new SessionAuthentication(app)
+  auth.register('jwt', new SessionJWT())
+  auth.register('local', new ActiveLocal())
+  app.use('authentication', auth, { methods: ['create','remove'], events: [] })
+  app.use('documents', documents, { methods: ['find','get','create','patch'], events: [] })
+  const access = authorize({ adapter, modelName: 'documents' })
+  app.service('documents').hooks({
+    around: { all: [authenticate('jwt')] },
+    before: { all: [documentPolicy(async accessToken => {
+      const result = await auth.authenticate({ strategy: 'jwt', accessToken }, {}, 'jwt')
+      return result.user
+    }), access] },
+    after: { all: [access] },
+  })
+  // No broadcast until recipient-level filtering has its own qualification.
+  return Object.freeze({ paths: Object.freeze(['authentication','documents']) })
+}

package/lib/secure-runtime/storage.mjs

@@ -0,0 +1,31 @@
+/** Explicit schema provisioning. Never drops tables, collections, records or indexes. */
+export const storageNames = Object.freeze({ users: 'app_users', documents: 'app_documents' })
+export async function prepareIdentityStorage(provider) {
+  if (!provider || !['postgresql','mariadb','mongodb'].includes(provider.adapter)) throw Error('UNSUPPORTED_PROVIDER')
+  const { users, documents } = storageNames
+  if (provider.adapter === 'mongodb') {
+    for (const name of [users, documents]) {
+      try { await provider.db.createCollection(name) } catch (error) { if (error?.code !== 48) throw error }
+    }
+    await provider.db.collection(users).createIndex({ id: 1 }, { unique: true })
+    await provider.db.collection(users).createIndex({ email: 1 }, { unique: true })
+    await provider.db.collection(documents).createIndex({ id: 1 }, { unique: true })
+    await provider.db.collection(documents).createIndex({ ownerId: 1 })
+  } else {
+    const db = provider.db
+    if (!await db.schema.hasTable(users)) await db.schema.createTable(users, t => {
+      t.string('id', 36).primary(); t.string('email', 120).notNullable().unique()
+      t.string('password', 120).notNullable(); t.string('role', 16).notNullable()
+      t.string('status', 16).notNullable(); t.integer('sessionVersion').notNullable()
+    })
+    if (!await db.schema.hasTable(documents)) await db.schema.createTable(documents, t => {
+      t.string('id', 36).primary(); t.string('title', 80).notNullable()
+      t.string('ownerId', 36).notNullable().index(); t.text('internal').nullable()
+    })
+    // Existing tables must contain every required column; no implicit destructive migration.
+    for (const [table, columns] of [[users, ['id','email','password','role','status','sessionVersion']], [documents, ['id','title','ownerId','internal']]]) {
+      for (const column of columns) if (!await db.schema.hasColumn(table, column)) throw Error('SCHEMA_MIGRATION_REQUIRED')
+    }
+  }
+  return storageNames
+}

package/lib/services.mjs

@@ -1,10 +1,12 @@
+import { schemaSourceTs, classSourceTs, registrarTs, tsServiceConfig } from './typescript.mjs'
 import { existsSync } from 'node:fs'
-import { lstat, mkdir, readFile, writeFile } from 'node:fs/promises'
+import { lstat, mkdir, readFile, rm, writeFile } from 'node:fs/promises'
 import { dirname, join, resolve, sep } from 'node:path'
 
 const VALID_NAME = /^[a-z][a-z0-9]*(?:-[a-z0-9]+)*$/
 const VALID_SCHEMA = new Set(['typebox','json','zod'])
 const VALID_AUTH = new Set(['none','jwt'])
+const VALID_LANGUAGE = new Set(['js','ts'])
 function safeName(s){return typeof s==='string' && s.length<=48 && VALID_NAME.test(s) && !/^(?:con|prn|aux|nul|com[1-9]|lpt[1-9])$/i.test(s)}
 async function rejectLinks(path){
  let current=path
@@ -13,8 +15,8 @@ async function rejectLinks(path){
 export function parseServiceArguments(args){
  if(args[0]!=='add')throw new Error('Use: service add <name> [--project <dir>] [--schema typebox|json|zod] [--db <alias>] [--auth none|jwt] [--dry-run]')
  if(!safeName(args[1]))throw new Error('Invalid service name (lowercase kebab-case)')
- const options={name:args[1],project:'.',schema:undefined,db:undefined,auth:undefined,dryRun:false}
- const keys=new Map([['--project','project'],['--schema','schema'],['--db','db'],['--auth','auth']])
+ const options={name:args[1],project:'.',schema:undefined,db:undefined,auth:undefined,lang:'js',dryRun:false}
+ const keys=new Map([['--project','project'],['--schema','schema'],['--db','db'],['--auth','auth'],['--lang','lang']])
  const seen=new Set()
  for(let i=2;i<args.length;i++){
   const flag=args[i]
@@ -26,6 +28,7 @@ export function parseServiceArguments(args){
   if(!value||value.startsWith('--'))throw new Error('Missing service option: '+flag)
   options[keys.get(flag)]=value
  }
+ if(!VALID_LANGUAGE.has(options.lang))throw new Error('Invalid language; use js|ts')
  if(!VALID_SCHEMA.has(options.schema??'typebox'))throw new Error('Invalid schema')
  if(!VALID_AUTH.has(options.auth??'none'))throw new Error('Invalid service auth: none|jwt')
  if(options.db!==undefined&&!safeName(options.db))throw new Error('Invalid database alias')
@@ -34,30 +37,82 @@ export function parseServiceArguments(args){
 }
 function schemaSource(schema){
  const opening="import { BadRequest } from '@feathersjs/errors'\n"
+ const query=`
+// Only a deliberately small, documented query dialect is accepted.
+// Feathers adapter-specific $ operators must never pass through unchecked.
+export function validateQuery(value){
+ if(value === undefined || value === null) return {}
+ if(typeof value !== 'object' || Array.isArray(value)) throw new BadRequest('Invalid query')
+ const result={}
+ for(const [key,raw] of Object.entries(value)){
+  if(key==='title'){
+   if(typeof raw!=='string'||raw.length>120||raw.trim().length<1)throw new BadRequest('Invalid query title')
+   result.title=raw.trim()
+   continue
+  }
+  if(key==='$limit'||key==='$skip'){
+   if(typeof raw!=='number'&&typeof raw!=='string')throw new BadRequest('Invalid query pagination')
+   if(typeof raw==='string'&&!/^(0|[1-9][0-9]*)$/.test(raw))throw new BadRequest('Invalid query pagination')
+   const n=Number(raw)
+   if(!Number.isSafeInteger(n)||n<0||n>1000)throw new BadRequest('Invalid query pagination')
+   result[key]=n
+   continue
+  }
+  throw new BadRequest('Unsupported query field')
+ }
+ return result
+}
+`
  if(schema==='zod')return opening+`import { z } from 'zod'
 export const dataSchema=z.object({title:z.string().trim().min(1).max(120)}).strict()
+export const patchSchema=dataSchema.partial()
 export function validateData(value){const parsed=dataSchema.safeParse(value);if(!parsed.success)throw new BadRequest('Invalid service data');return parsed.data}
-`
- const def=schema==='typebox'?`import { Type } from '@feathersjs/typebox'
-export const dataSchema=Type.Object({title:Type.String({minLength:1,maxLength:120})},{additionalProperties:false})
-`:`export const dataSchema={type:'object',additionalProperties:false,required:['title'],properties:{title:{type:'string',minLength:1,maxLength:120}}}
+export function validatePatch(value){const parsed=patchSchema.safeParse(value);if(!parsed.success||!Object.keys(parsed.data).length)throw new BadRequest('Invalid service patch');return parsed.data}
+`+query
+ const shape=schema==='typebox'?`import { Type } from '@feathersjs/typebox'
+const titleSchema=Type.String({minLength:1,maxLength:120})
+export const dataSchema=Type.Object({title:titleSchema},{additionalProperties:false})
+export const patchSchema=Type.Object({title:Type.Optional(titleSchema)},{additionalProperties:false})
+`:`const titleSchema={type:'string',minLength:1,maxLength:120}
+export const dataSchema={type:'object',additionalProperties:false,required:['title'],properties:{title:titleSchema}}
+export const patchSchema={type:'object',additionalProperties:false,properties:{title:titleSchema}}
 `
  return opening+`import Ajv from 'ajv'
-`+def+`const valid=new Ajv({allErrors:true}).compile(dataSchema)
-export function validateData(value){if(!valid(value))throw new BadRequest('Invalid service data');return {title:value.title.trim()}}
-`
+`+shape+`const ajv=new Ajv({allErrors:true,coerceTypes:false,removeAdditional:false,useDefaults:false})
+const validData=ajv.compile(dataSchema)
+const validPatch=ajv.compile(patchSchema)
+function normalized(value, validator, operation){
+ // Apply the same trim-before-validation contract as the Zod preset.
+ if(!value||typeof value!=='object'||Array.isArray(value)||typeof value.title!=='string')throw new BadRequest('Invalid service '+operation)
+ const canonical={...value,title:value.title.trim()}
+ if(!validator(canonical)||!canonical.title)throw new BadRequest('Invalid service '+operation)
+ return {title:canonical.title}
+}
+export function validateData(value){return normalized(value,validData,'data')}
+export function validatePatch(value){return normalized(value,validPatch,'patch')}
+`+query
 }
 function classSource(){return `import { NotFound, BadRequest } from '@feathersjs/errors'
-import { validateData } from './schema.mjs'
+import { validateData, validatePatch, validateQuery } from './schema.mjs'
 export class GeneratedService {
   #items=new Map()
   #counter=1
   constructor(){for(const method of ['find','get','create','patch','remove'])this[method]=this[method].bind(this)}
-  #id(value){const n=Number(value);if(!Number.isSafeInteger(n)||n<1)throw new BadRequest('Invalid ID');return n}
-  async find(){return [...this.#items.values()].map(x=>({...x}))}
+  #id(value){
+    if(typeof value!=='number'&&typeof value!=='string')throw new BadRequest('Invalid ID')
+    if(typeof value==='string'&&!/^[1-9][0-9]*$/.test(value))throw new BadRequest('Invalid ID')
+    const n=Number(value)
+    if(!Number.isSafeInteger(n)||n<1)throw new BadRequest('Invalid ID')
+    return n
+  }
+  async find(params={}){
+    const query=validateQuery(params?.query)
+    const values=[...this.#items.values()].filter(row=>query.title===undefined||row.title===query.title)
+    return values.slice(query.$skip??0,(query.$skip??0)+(query.$limit??values.length)).map(row=>({...row}))
+  }
   async get(id){const item=this.#items.get(this.#id(id));if(!item)throw new NotFound('Not found');return {...item}}
-  async create(data){const row={id:this.#counter++,...validateData(data)};this.#items.set(row.id,row);return {...row}}
-  async patch(id,data){const key=this.#id(id);if(!this.#items.has(key))throw new NotFound('Not found');const row={id:key,...validateData(data)};this.#items.set(key,row);return {...row}}
+  async create(data){const input=validateData(data);const row={id:this.#counter++,...input};this.#items.set(row.id,row);return {...row}}
+  async patch(id,data){const key=this.#id(id);const row=this.#items.get(key);if(!row)throw new NotFound('Not found');const next={...row,...validatePatch(data)};this.#items.set(key,next);return {...next}}
   async remove(id){const key=this.#id(id);const row=this.#items.get(key);if(!row)throw new NotFound('Not found');this.#items.delete(key);return {...row}}
 }
 `}
@@ -69,40 +124,102 @@ ${auth==='jwt'?"import { authenticate } from '@feathersjs/authentication'\n":''}
 }
 `
 }
-export async function generateService(opts, cwd=process.cwd()){
- const project=resolve(cwd,opts.project)
- if(opts.project!=='.' && !project.startsWith(resolve(cwd)+sep))throw new Error('Project escapes current directory')
+// Non-public IO injection enables deterministic Windows-safe fault tests. CLI calls use default fs.
+export async function generateService(opts, cwd=process.cwd(), io={writeFile}) {
+ if(!opts || !safeName(opts.name))throw new Error('Invalid service name')
+ const projectOption=opts.project??'.'
+ if(typeof projectOption!=='string'||!/^\.?\/?[a-zA-Z0-9._/-]*$/.test(projectOption)||projectOption.includes('..')||projectOption.includes('\\')||projectOption.startsWith('/'))throw new Error('Unsafe project path')
+ if(opts.schema!==undefined&&!VALID_SCHEMA.has(opts.schema))throw new Error('Invalid schema')
+ if(opts.lang!==undefined&&!VALID_LANGUAGE.has(opts.lang))throw new Error('Invalid language')
+ if(opts.auth!==undefined&&!VALID_AUTH.has(opts.auth))throw new Error('Invalid service auth')
+ if(opts.db!==undefined&&!safeName(opts.db))throw new Error('Invalid database alias')
+ const project=resolve(cwd,projectOption)
+ if(projectOption!=='.' && !project.startsWith(resolve(cwd)+sep))throw new Error('Project escapes current directory')
  await rejectLinks(project)
  const manifestPath=join(project,'package.json'),serverPath=join(project,'api/server.mjs'),profilePath=join(project,'api/config/profile.json')
+ const lockPath=join(project,'api/.create-feathers-service.lock')
+ for(const file of [manifestPath,serverPath,profilePath,lockPath]) await rejectLinks(file)
  if(!existsSync(manifestPath)||!existsSync(serverPath)||!existsSync(profilePath))throw new Error('Not a CLI generated project')
- const manifest=JSON.parse(await readFile(manifestPath,'utf8'))
- const profile=JSON.parse(await readFile(profilePath,'utf8'))
- const schema=opts.schema??profile.schema,auth=opts.auth??profile.auth,db=opts.db??profile.primary
- if(!VALID_SCHEMA.has(schema))throw new Error('Invalid schema')
- if(!VALID_AUTH.has(auth))throw new Error('Service supports none|jwt; OAuth2/OIDC/Keycloak require audited identity integration')
- if(auth!=='none' && profile.auth!==auth)throw new Error('Service auth must match configured project profile')
- const connection=profile.databases.find(x=>x.alias===db)
- if(!connection)throw new Error('Unknown database alias: '+db)
- const destination=join(project,'api/services',opts.name)
- await rejectLinks(destination)
- if(existsSync(destination))throw new Error('Service already exists; refusing overwrite')
- const text=await readFile(serverPath,'utf8')
- const marker='const modules = [\n'
- if(!text.includes(marker))throw new Error('Missing Feathers modules registry; no changes made')
- const moduleEntry=`  new URL('./services/${opts.name}/${opts.name}.service.mjs', import.meta.url),\n`
- if(text.includes(moduleEntry))throw new Error('Duplicate service registration')
- // Never replace a user-controlled arbitrary string outside of the explicit registry.
- const output={name:opts.name,project,database:{alias:db,adapter:connection.adapter},auth,schema,files:[`api/services/${opts.name}/schema.mjs`,`api/services/${opts.name}/service.class.mjs`,`api/services/${opts.name}/${opts.name}.service.mjs`],ready:connection.adapter==='memory'&&auth==='none'}
- if(opts.dryRun)return output
- const dependencies=manifest.dependencies||{}
- const deps=schema==='zod'?{'zod':'^4.1.0'}:schema==='typebox'?{'@feathersjs/typebox':'^5.0.50','ajv':'^8.17.1'}:{'ajv':'^8.17.1'}
- if(auth==='jwt')deps['@feathersjs/authentication']='^5.0.50'
- for(const [name,version] of Object.entries(deps))dependencies[name]??=version
- await mkdir(destination,{recursive:false})
- for(const [name,contents] of Object.entries({'schema.mjs':schemaSource(schema),'service.class.mjs':classSource(),[`${opts.name}.service.mjs`]:registrar(opts.name,auth)}))await writeFile(join(destination,name),contents,{flag:'wx'})
- await writeFile(serverPath,text.replace(marker,marker+moduleEntry))
- await writeFile(manifestPath,JSON.stringify({...manifest,dependencies},null,2)+'\n')
- return output
+ // Only one service may update the registry and manifest at a time. A stale lock
+ // must be inspected by the operator rather than automatically stolen.
+ let ownsLock=false
+ if(!opts.dryRun){
+  try{await writeFile(lockPath,JSON.stringify({pid:process.pid})+'\n',{flag:'wx'});ownsLock=true}
+  catch(error){if(error?.code==='EEXIST')throw new Error('Concurrent service generation or stale lock; refusing changes');throw error}
+ }
+ try {
+  const manifestSource=await readFile(manifestPath,'utf8')
+  const text=await readFile(serverPath,'utf8')
+  const manifest=JSON.parse(manifestSource)
+  const profile=JSON.parse(await readFile(profilePath,'utf8'))
+  if(!manifest||typeof manifest!=='object'||Array.isArray(manifest)||!manifest.dependencies||typeof manifest.dependencies!=='object'||Array.isArray(manifest.dependencies))throw new Error('Invalid project dependencies manifest')
+  const schema=opts.schema??profile.schema,auth=opts.auth??profile.auth,db=opts.db??profile.primary,lang=opts.lang??'js'
+  if(!VALID_SCHEMA.has(schema))throw new Error('Invalid schema')
+  if(!VALID_AUTH.has(auth))throw new Error('Service supports none|jwt; OAuth2/OIDC/Keycloak require audited identity integration')
+  if(auth!=='none' && profile.auth!==auth)throw new Error('Service auth must match configured project profile')
+  if(!Array.isArray(profile.databases))throw new Error('Invalid project database profile')
+  const connection=profile.databases.find(x=>x && x.alias===db)
+  if(!connection)throw new Error('Unknown database alias: '+db)
+  const destination=join(project,'api/services',opts.name)
+  await rejectLinks(destination)
+  if(existsSync(destination))throw new Error('Service already exists; refusing overwrite')
+  const marker='const modules = [\n'
+  if(text.split(marker).length!==2)throw new Error('Missing or ambiguous Feathers modules registry; no changes made')
+  const ext=lang==='ts'?'ts':'mjs'
+  const moduleEntry=`  new URL('./services/${opts.name}/${opts.name}.service.${ext}', import.meta.url),\n`
+  if(text.includes(moduleEntry))throw new Error('Duplicate service registration')
+  const tsReady = lang !== 'ts' || (typeof manifest.scripts?.['dev:api'] === 'string' && manifest.scripts['dev:api'].includes('api/server.mjs') && manifest.scripts?.['dev:all'] !== 'vite --host 127.0.0.1')
+  const ready=connection.adapter==='memory'&&auth==='none'&&profile.auth==='none'&&tsReady
+  const output={name:opts.name,project,database:{alias:db,adapter:connection.adapter},auth,schema,lang,files:[`api/services/${opts.name}/schema.${ext}`,`api/services/${opts.name}/service.class.${ext}`,`api/services/${opts.name}/${opts.name}.service.${ext}`],ready}
+  if(opts.dryRun)return output
+  if(connection.adapter!=='memory')throw new Error('Database adapter not provisioned for service: '+connection.adapter+'. Refusing implicit in-memory fallback')
+  if(!tsReady)throw new Error('TypeScript services require a separate API runtime; Vite-embedded runtime not yet certified')
+  if(!ready)throw new Error('Authentication infrastructure not provisioned; refusing service generation')
+  const deps=schema==='zod'?{'zod':'^4.1.0'}:schema==='typebox'?{'@feathersjs/typebox':'5.0.51','ajv':'^8.17.1'}:{'ajv':'^8.17.1'}
+  const dependencies={...manifest.dependencies}
+  for(const [name,version] of Object.entries(deps))dependencies[name]??=version
+  let manifestResult
+  const tsconfigPath = join(project, 'api/tsconfig.json')
+  let writeTsconfig = false
+  if(lang==='ts'){
+   await rejectLinks(tsconfigPath)
+   if(existsSync(tsconfigPath)){
+    const existing = JSON.parse(await readFile(tsconfigPath,'utf8'))
+    if(existing?.compilerOptions?.strict!==true||existing?.compilerOptions?.noEmit!==true||existing?.compilerOptions?.allowImportingTsExtensions!==true)throw new Error('Unsafe existing TypeScript API configuration')
+   } else writeTsconfig=true
+   // Node --import tsx ensures .ts service registration is executable by the standalone Feathers API.
+   const scripts={...manifest.scripts,'dev:api':manifest.scripts['dev:api'].includes('--import tsx')?manifest.scripts['dev:api']:manifest.scripts['dev:api'].replace(/^node\s+/, 'node --import tsx '), 'typecheck:api':'tsc --noEmit -p api/tsconfig.json'}
+   // Preserve any project-level Vue/Quasar typecheck command while requiring strict backend checks.
+   if(!scripts.typecheck?.includes('typecheck:api')) scripts.typecheck=(scripts.typecheck??'tsc --noEmit')+' && npm run typecheck:api'
+   const devDependencies={...manifest.devDependencies,tsx:manifest.devDependencies?.tsx??'^4.20.0',typescript:manifest.devDependencies?.typescript??'^5.9.3','@types/node':manifest.devDependencies?.['@types/node']??'^22.0.0'}
+   manifestResult=JSON.stringify({...manifest,dependencies,devDependencies,scripts},null,2)+'\n'
+  } else manifestResult=JSON.stringify({...manifest,dependencies},null,2)+'\n'
+  const files=lang==='ts'
+    ? Object.entries({'schema.ts':schemaSourceTs(schema),'service.class.ts':classSourceTs(),[`${opts.name}.service.ts`]:registrarTs(opts.name)})
+    : Object.entries({'schema.mjs':schemaSource(schema),'service.class.mjs':classSource(),[`${opts.name}.service.mjs`]:registrar(opts.name,auth)})
+  let directoryCreated=false, serverAttempted=false, manifestAttempted=false, tsconfigAttempted=false
+  try {
+   await mkdir(destination,{recursive:false});directoryCreated=true
+   for(const [name,contents] of files)await io.writeFile(join(destination,name),contents,{flag:'wx'})
+   if(writeTsconfig){tsconfigAttempted=true;await io.writeFile(tsconfigPath,tsServiceConfig,{flag:'wx'})}
+   serverAttempted=true
+   await io.writeFile(serverPath,text.replace(marker,marker+moduleEntry))
+   manifestAttempted=true
+   await io.writeFile(manifestPath,manifestResult)
+  } catch(error) {
+   const failures=[]
+   // Restore even when a write was interrupted in the middle of a file.
+   if(manifestAttempted)try{await writeFile(manifestPath,manifestSource)}catch(e){failures.push(e)}
+   if(tsconfigAttempted)try{await rm(tsconfigPath,{force:true})}catch(e){failures.push(e)}
+   if(serverAttempted)try{await writeFile(serverPath,text)}catch(e){failures.push(e)}
+   if(directoryCreated)try{await rm(destination,{recursive:true,force:true})}catch(e){failures.push(e)}
+   if(failures.length)throw new AggregateError([error,...failures],'Service generation failed; rollback incomplete; inspect project before retry')
+   throw error
+  }
+  return output
+ } finally {
+  if(ownsLock)await rm(lockPath,{force:true})
+ }
 }
 export async function runServiceCommand(args,cwd){
  const result=await generateService(parseServiceArguments(args),cwd)

package/lib/typescript.mjs

@@ -0,0 +1,148 @@
+// Opt-in strict TypeScript Feathers service output for separately hosted API.
+// Keep the established JS defaults untouched; never generate a TypeScript facade.
+export const tsServiceConfig = JSON.stringify({
+  compilerOptions: {
+    target: 'ES2022', module: 'NodeNext', moduleResolution: 'NodeNext',
+    lib: ['ES2022'], types: ['node'], strict: true, noEmit: true,
+    isolatedModules: true, exactOptionalPropertyTypes: true,
+    noUncheckedIndexedAccess: true, allowImportingTsExtensions: true,
+    skipLibCheck: true,
+  }, include: ['services/**/*.ts'],
+}, null, 2) + '\n'
+
+const querySource = `
+export interface ValidQuery { title?: string; $limit?: number; $skip?: number }
+export function validateQuery(value: unknown): ValidQuery {
+  if (value === undefined || value === null) return {}
+  if (typeof value !== 'object' || Array.isArray(value)) throw new BadRequest('Invalid query')
+  const result: ValidQuery = {}
+  for (const [key, raw] of Object.entries(value)) {
+    if (key === 'title') {
+      if (typeof raw !== 'string' || raw.length > 120 || raw.trim().length < 1) throw new BadRequest('Invalid query title')
+      result.title = raw.trim()
+      continue
+    }
+    if (key === '$limit' || key === '$skip') {
+      if (typeof raw !== 'number' && typeof raw !== 'string') throw new BadRequest('Invalid query pagination')
+      if (typeof raw === 'string' && !/^(0|[1-9][0-9]*)$/.test(raw)) throw new BadRequest('Invalid query pagination')
+      const n = Number(raw)
+      if (!Number.isSafeInteger(n) || n < 0 || n > 1000) throw new BadRequest('Invalid query pagination')
+      result[key] = n
+      continue
+    }
+    throw new BadRequest('Unsupported query field')
+  }
+  return result
+}
+`
+
+export function schemaSourceTs(schema) {
+  const opening = "import { BadRequest } from '@feathersjs/errors'\n" +
+    'export interface ServiceData { title: string }\n' +
+    'export type ServicePatch = Partial<ServiceData>\n'
+  if (schema === 'zod') return opening + `import { z } from 'zod'
+export const dataSchema = z.object({title: z.string().trim().min(1).max(120)}).strict()
+export const patchSchema = dataSchema.partial()
+export function validateData(value: unknown): ServiceData {
+  const parsed = dataSchema.safeParse(value)
+  if (!parsed.success) throw new BadRequest('Invalid service data')
+  return parsed.data
+}
+export function validatePatch(value: unknown): ServicePatch {
+  const parsed = patchSchema.safeParse(value)
+  // .partial() permits an explicit undefined; never allow it to erase an existing title.
+  if (!parsed.success || typeof parsed.data.title !== 'string') throw new BadRequest('Invalid service patch')
+  return { title: parsed.data.title }
+}
+` + querySource
+  const declarations = schema === 'typebox'
+    ? `import { Type } from '@feathersjs/typebox'
+const titleSchema = Type.String({minLength:1,maxLength:120})
+export const dataSchema = Type.Object({title:titleSchema},{additionalProperties:false})
+export const patchSchema = Type.Object({title:Type.Optional(titleSchema)},{additionalProperties:false})
+`
+    : `const titleSchema = {type:'string',minLength:1,maxLength:120}
+export const dataSchema = {type:'object',additionalProperties:false,required:['title'],properties:{title:titleSchema}}
+export const patchSchema = {type:'object',additionalProperties:false,properties:{title:titleSchema}}
+`
+  return opening + "import AjvModule, { type ValidateFunction } from 'ajv'\n" + declarations + `// Ajv v8 ships CommonJS: NodeNext resolves its default import to the module namespace.\nconst Ajv = AjvModule.default\nconst ajv = new Ajv({allErrors:true,coerceTypes:false,removeAdditional:false,useDefaults:false})
+const validData = ajv.compile(dataSchema)
+const validPatch = ajv.compile(patchSchema)
+function normalized(value: unknown, validator: ValidateFunction, operation: string): ServiceData {
+  if (value === null || typeof value !== 'object' || Array.isArray(value) ||
+      !('title' in value) || typeof value.title !== 'string') throw new BadRequest('Invalid service ' + operation)
+  const canonical = { ...value, title: value.title.trim() }
+  if (!validator(canonical) || !canonical.title) throw new BadRequest('Invalid service ' + operation)
+  return { title: canonical.title }
+}
+export function validateData(value: unknown): ServiceData { return normalized(value, validData, 'data') }
+export function validatePatch(value: unknown): ServicePatch { return normalized(value, validPatch, 'patch') }
+` + querySource
+}
+
+export function classSourceTs() {
+  return `import { NotFound, BadRequest } from '@feathersjs/errors'
+import type { Id, Params } from '@feathersjs/feathers'
+import { validateData, validatePatch, validateQuery, type ServiceData, type ServicePatch } from './schema.ts'
+export interface ServiceRecord { id: number; title: string }
+export class GeneratedService {
+  readonly #items = new Map<number, ServiceRecord>()
+  #counter = 1
+  constructor() {
+    this.find = this.find.bind(this)
+    this.get = this.get.bind(this)
+    this.create = this.create.bind(this)
+    this.patch = this.patch.bind(this)
+    this.remove = this.remove.bind(this)
+  }
+  #id(value: Id): number {
+    if (typeof value !== 'number' && typeof value !== 'string') throw new BadRequest('Invalid ID')
+    if (typeof value === 'string' && !/^[1-9][0-9]*$/.test(value)) throw new BadRequest('Invalid ID')
+    const n = Number(value)
+    if (!Number.isSafeInteger(n) || n < 1) throw new BadRequest('Invalid ID')
+    return n
+  }
+  async find(params: Params = {}): Promise<ServiceRecord[]> {
+    const query = validateQuery(params.query)
+    const values = [...this.#items.values()].filter(row => query.title === undefined || row.title === query.title)
+    return values.slice(query.$skip ?? 0, (query.$skip ?? 0) + (query.$limit ?? values.length)).map(row => ({...row}))
+  }
+  async get(id: Id): Promise<ServiceRecord> {
+    const item = this.#items.get(this.#id(id))
+    if (!item) throw new NotFound('Not found')
+    return {...item}
+  }
+  async create(data: ServiceData): Promise<ServiceRecord> {
+    const input = validateData(data)
+    const row = {id: this.#counter++, ...input}
+    this.#items.set(row.id, row)
+    return {...row}
+  }
+  async patch(id: Id, data: ServicePatch): Promise<ServiceRecord> {
+    const key = this.#id(id)
+    const row = this.#items.get(key)
+    if (!row) throw new NotFound('Not found')
+    const next = {...row, ...validatePatch(data)}
+    this.#items.set(key, next)
+    return {...next}
+  }
+  async remove(id: Id): Promise<ServiceRecord> {
+    const key = this.#id(id)
+    const row = this.#items.get(key)
+    if (!row) throw new NotFound('Not found')
+    this.#items.delete(key)
+    return {...row}
+  }
+}
+`
+}
+
+export function registrarTs(name) {
+  return `import type { Application } from '@feathersjs/feathers'
+import { GeneratedService } from './service.class.ts'
+export default function register(app: Application): void {
+  app.use('${name}', new GeneratedService(), {methods: ['find','get','create','patch','remove']})
+  // No authentication: demo service must only listen on loopback.
+}
+`
+}

package/package.json

@@ -1,11 +1,11 @@
 {
   "name": "@vevedh/create-feathers-app",
-  "version": "0.1.0-rc.4",
+  "version": "0.1.0-rc.6",
   "type": "module",
   "description": "Scaffold FeathersJS v5 projects with Quasar 2 or daisyUI, Vite, Vue 3 and Pinia",
   "license": "MIT",
   "bin": {
-    "create-feathers-app": "./bin/create-feathers-app.mjs"
+    "create-feathers-app": "bin/create-feathers-app.mjs"
   },
   "engines": {
     "node": ">=22.12.0"

package/templates/daisyui-ssg/package.json

@@ -15,12 +15,12 @@
     "serve:production": "node scripts/serve-static.mjs"
   },
   "dependencies": {
-    "@vevedh/vite-plugin-feathersjs": "0.2.6",
-    "@feathersjs/feathers": "^5.0.50",
-    "@feathersjs/errors": "^5.0.50",
-    "@feathersjs/koa": "^5.0.50",
-    "@feathersjs/express": "^5.0.50",
-    "@feathersjs/socketio": "^5.0.50",
+    "@vevedh/vite-plugin-feathersjs": "0.2.7",
+    "@feathersjs/feathers": "5.0.50",
+    "@feathersjs/errors": "5.0.50",
+    "@feathersjs/koa": "5.0.51",
+    "@feathersjs/express": "5.0.51",
+    "@feathersjs/socketio": "5.0.51",
     "vue": "^3.5.44",
     "pinia": "^3.0.4",
     "socket.io-client": "^4.8.4",

package/templates/daisyui-ssr/package.json

@@ -15,12 +15,12 @@
     "serve:production": "node scripts/serve-ssr.mjs"
   },
   "dependencies": {
-    "@vevedh/vite-plugin-feathersjs": "0.2.6",
-    "@feathersjs/feathers": "^5.0.50",
-    "@feathersjs/errors": "^5.0.50",
-    "@feathersjs/koa": "^5.0.50",
-    "@feathersjs/express": "^5.0.50",
-    "@feathersjs/socketio": "^5.0.50",
+    "@vevedh/vite-plugin-feathersjs": "0.2.7",
+    "@feathersjs/feathers": "5.0.50",
+    "@feathersjs/errors": "5.0.50",
+    "@feathersjs/koa": "5.0.51",
+    "@feathersjs/express": "5.0.51",
+    "@feathersjs/socketio": "5.0.51",
     "vue": "^3.5.44",
     "pinia": "^3.0.4",
     "socket.io-client": "^4.8.4",