zudojs-cli 2.0.1 → 2.1.1

package/dist/src/cliApplication/invocation/invocation.sanitize.d.ts

@@ -0,0 +1,19 @@
+/**
+ * zudojs-cli — Terminal-Safe Text
+ *
+ * Neutralises control characters in text that echoes user input back to
+ * the terminal.
+ */
+/**
+ * Replaces terminal control characters with a visible escape.
+ *
+ * Error messages quote what the user passed (`Command "…" was not found.`,
+ * `Unknown or invalid option "…"`). An argument carrying ESC sequences —
+ * from a script that forwards untrusted input — could otherwise recolour
+ * the terminal, rewrite its title, hide text or emit OSC 8 links. The
+ * escaped form (`\x1b`) still shows the user what was received.
+ *
+ * @param text - Text about to be written to the terminal.
+ */
+export declare function escapeControlCharacters(text: string): string;
+//# sourceMappingURL=invocation.sanitize.d.ts.map

package/dist/src/cliApplication/invocation/invocation.sanitize.js

@@ -0,0 +1,32 @@
+/**
+ * zudojs-cli — Terminal-Safe Text
+ *
+ * Neutralises control characters in text that echoes user input back to
+ * the terminal.
+ */
+/**
+ * C0 and C1 control characters other than tab and newline, plus the Unicode
+ * bidirectional overrides that can make a line read differently from what
+ * it contains.
+ */
+const UNSAFE_CHARACTERS = /[\u0000-\u0008\u000B-\u001F\u007F-\u009F‎‏‪-‮⁦-⁩]/g;
+/**
+ * Replaces terminal control characters with a visible escape.
+ *
+ * Error messages quote what the user passed (`Command "…" was not found.`,
+ * `Unknown or invalid option "…"`). An argument carrying ESC sequences —
+ * from a script that forwards untrusted input — could otherwise recolour
+ * the terminal, rewrite its title, hide text or emit OSC 8 links. The
+ * escaped form (`\x1b`) still shows the user what was received.
+ *
+ * @param text - Text about to be written to the terminal.
+ */
+export function escapeControlCharacters(text) {
+    return text.replace(UNSAFE_CHARACTERS, (character) => {
+        const code = character.codePointAt(0);
+        return code <= 0xff
+            ? `\\x${code.toString(16).padStart(2, "0")}`
+            : `\\u${code.toString(16).padStart(4, "0")}`;
+    });
+}
+//# sourceMappingURL=invocation.sanitize.js.map

package/dist/src/cliParser/cliParser.core.js

@@ -28,7 +28,9 @@ export class CLIParser {
         const tokens = Array.from(args);
         const commands = [];
         const positional = [];
-        const options = {};
+        // No prototype: an undeclared `--constructor` (allowUnknownOptions) must
+        // not read or shadow Object.prototype members.
+        const options = Object.create(null);
         const definitions = command?.options ?? [];
         const argumentsDefinitions = command?.arguments ?? [];
         let index = 0;

package/dist/src/cliParser/cliParser.helper.d.ts

@@ -11,6 +11,13 @@ export declare function parseCLIArguments(args: CLIArguments, command?: CLIComma
 export declare function parseOptionValue(definition: CLIOption, value: string): CLIValue;
 /** Parses a string into a boolean. */
 export declare function parseBoolean(value: string, option?: string): boolean;
+/**
+ * Returns whether an option name would touch an object's prototype chain.
+ *
+ * Only reachable when `allowUnknownOptions` is on: undeclared names are then
+ * written to the values object as typed, so `--__proto__` must be refused.
+ */
+export declare function isReservedOptionKey(name: string): boolean;
 /** Returns whether a token is any option (short or long). */
 export declare function isOption(token: string): boolean;
 /** Returns whether a token is a long option (e.g. `--verbose`). */

package/dist/src/cliParser/cliParser.helper.js

@@ -19,8 +19,10 @@ export function parseOptionValue(definition, value) {
         case "boolean":
             return parseBoolean(value, definition.name);
         case "number": {
-            const parsed = Number(value);
-            if (Number.isNaN(parsed)) {
+            // `Number("")` is 0 and `Number("Infinity")` is Infinity, so
+            // `--port=` used to start the server with PORT=0 instead of failing.
+            const parsed = value.trim() === "" ? Number.NaN : Number(value);
+            if (!Number.isFinite(parsed)) {
                 throw new InvalidArgumentsError(`Option "${definition.name}" expects a number, received "${value}".`);
             }
             return parsed;
@@ -42,6 +44,21 @@ export function parseBoolean(value, option = "option") {
 /* -------------------------------------------------------------------------- */
 /* Token Classification                                                       */
 /* -------------------------------------------------------------------------- */
+/** Keys that must never be written from the command line. */
+const RESERVED_OPTION_KEYS = new Set([
+    "__proto__",
+    "constructor",
+    "prototype",
+]);
+/**
+ * Returns whether an option name would touch an object's prototype chain.
+ *
+ * Only reachable when `allowUnknownOptions` is on: undeclared names are then
+ * written to the values object as typed, so `--__proto__` must be refused.
+ */
+export function isReservedOptionKey(name) {
+    return RESERVED_OPTION_KEYS.has(name);
+}
 /** Returns whether a token is any option (short or long). */
 export function isOption(token) {
     return ((token.startsWith(CLI_OPTION_PREFIXES.LONG) && token !== "--") ||

package/dist/src/cliParser/cliParser.longOption.js

@@ -5,7 +5,7 @@
  */
 import { CLI_OPTION_PREFIXES } from "../cliConstant/cliConstant.value.js";
 import { InvalidOptionError, MissingOptionValueError, } from "../cliError/cliError.option.js";
-import { isOption, isOptionValueToken, parseBoolean, parseOptionValue, } from "./cliParser.helper.js";
+import { isOption, isOptionValueToken, isReservedOptionKey, parseBoolean, parseOptionValue, } from "./cliParser.helper.js";
 /** Parses a long option token from the token stream. */
 export function parseLongOption(tokens, index, definitions, values, allowUnknownOptions) {
     const token = tokens[index];
@@ -26,7 +26,7 @@ export function parseLongOption(tokens, index, definitions, values, allowUnknown
         }
     }
     const definition = findOption(name, definitions);
-    if (!definition && !allowUnknownOptions) {
+    if (!definition && (!allowUnknownOptions || isReservedOptionKey(name))) {
         throw new InvalidOptionError(token);
     }
     if (!definition) {

package/dist/src/commands/add.command.d.ts

@@ -1,7 +1,10 @@
 /**
  * zudojs-cli — Add Command
  *
- * The `zudojs add` command for adding feature packages.
+ * `zudojs add <feature>` writes a working recipe for the feature (see
+ * `src/recipes/`): the integration code, its registration, config, env
+ * variables and dependencies — or, for `docker`, the project's container
+ * files — then records the feature and installs.
  */
 import type { CLIContext } from "../cliType/cliType.type.js";
 import { type ProjectLayout } from "../resolvers/layout/projectLayout.core.js";
@@ -29,9 +32,10 @@ export declare function selectAddTargets(layout: ProjectLayout, service: string
  * them contains the framework packages, so the next install failed with
  * "not found in workspace". The protocol is now used only when the target
  * already links a framework package that way — i.e. inside the Zudojs
- * monorepo itself.
+ * monorepo itself. Otherwise the package gets a caret range on the version
+ * this CLI build targets.
  */
-export declare function versionForNewDependency(pkg: PackageJsonShape): string;
+export declare function versionForNewDependency(pkg: PackageJsonShape, name?: string): string;
 export declare function runAddCommand(context: CLIContext): Promise<void>;
 export {};
 //# sourceMappingURL=add.command.d.ts.map

package/dist/src/commands/add.command.js

@@ -1,17 +1,22 @@
 /**
  * zudojs-cli — Add Command
  *
- * The `zudojs add` command for adding feature packages.
+ * `zudojs add <feature>` writes a working recipe for the feature (see
+ * `src/recipes/`): the integration code, its registration, config, env
+ * variables and dependencies — or, for `docker`, the project's container
+ * files — then records the feature and installs.
  */
-import { join, relative } from "node:path";
-import { existsSync, readFileSync, writeFileSync } from "node:fs";
+import { join } from "node:path";
 import { runStreaming } from "../utils/utils.exec.js";
 import { assertSafePathSegment } from "../utils/utils.name.js";
 import { CLIValidationError, CLIGenerationError } from "../errors/index.js";
 import { ManifestManager } from "../manifest/manifestManager.core.js";
 import { getInstallCommand } from "../installers/dependency.installer.js";
-import { FEATURE_PACKAGES, ZUDOJS_PACKAGES_VERSION, } from "../constants/index.js";
+import { FEATURE_NAMES, zudojsVersionRange } from "../constants/index.js";
 import { resolveProjectLayout, } from "../resolvers/layout/projectLayout.core.js";
+import { applyAppRecipe, applyProjectRecipe, applyProjectSettings, projectRecipeContext, recipeContextFor, recordFeature, recordProjectFeature, refreshGeneratedDockerfiles, reportOutcomes, resolveFeatureRecipe, } from "../recipes/index.js";
+import { existsSync, readFileSync } from "node:fs";
+import { findProjectRoot } from "../resolvers/project.resolver.js";
 /**
  * Picks the `package.json` files a feature is added to.
  *
@@ -48,34 +53,39 @@ export function selectAddTargets(layout, service) {
  * them contains the framework packages, so the next install failed with
  * "not found in workspace". The protocol is now used only when the target
  * already links a framework package that way — i.e. inside the Zudojs
- * monorepo itself.
+ * monorepo itself. Otherwise the package gets a caret range on the version
+ * this CLI build targets.
  */
-export function versionForNewDependency(pkg) {
+export function versionForNewDependency(pkg, name = "@zudojs/core") {
     const linksFramework = Object.entries({
         ...pkg.dependencies,
         ...pkg.devDependencies,
-    }).some(([name, version]) => name.startsWith("@zudojs/") && version.startsWith("workspace:"));
-    return linksFramework ? "workspace:*" : ZUDOJS_PACKAGES_VERSION;
+    }).some(([dep, version]) => dep.startsWith("@zudojs/") && version.startsWith("workspace:"));
+    return linksFramework ? "workspace:*" : zudojsVersionRange(name);
+}
+/** A recipe with its `@zudojs/*` ranges swapped for `workspace:*` when the app links the framework. */
+function forApp(recipe, pkg) {
+    const dependencies = Object.fromEntries(Object.entries(recipe.dependencies).map(([name, range]) => [
+        name,
+        name.startsWith("@zudojs/") ? versionForNewDependency(pkg, name) : range,
+    ]));
+    return { ...recipe, dependencies };
 }
 export async function runAddCommand(context) {
-    const feature = context.values.feature;
+    const requested = context.values.feature;
     const service = context.values.service;
-    const available = Object.keys(FEATURE_PACKAGES).join(", ");
-    if (!feature) {
-        throw new CLIValidationError(`Feature name is required. Available: ${available}`);
-    }
-    // Own keys only: `constructor` or `__proto__` resolved to Object.prototype
-    // members and crashed with "packages.join is not a function".
-    const packages = Object.hasOwn(FEATURE_PACKAGES, feature)
-        ? FEATURE_PACKAGES[feature]
-        : undefined;
-    if (!packages) {
-        throw new CLIValidationError(`Unknown feature: "${feature}". Available: ${available}`);
+    if (!requested) {
+        throw new CLIValidationError(`Feature name is required. Available: ${FEATURE_NAMES.join(", ")}`);
     }
+    const recipe = resolveFeatureRecipe(requested);
+    const feature = recipe.feature;
     if (service !== undefined) {
         assertSafePathSegment(service, "--service");
     }
-    const layout = resolveProjectLayout(context.cwd);
+    // Walks up, so `add` works from any directory inside the project; an app
+    // of a workspace resolves to the workspace, whose manifest is updated.
+    const root = findProjectRoot(context.cwd, { workspace: true });
+    const layout = root === null ? null : resolveProjectLayout(root);
     if (!layout) {
         throw new CLIValidationError("No Zudojs project found in this directory. Run `zudojs create` first.");
     }
@@ -86,8 +96,6 @@ export async function runAddCommand(context) {
     if (targets.length === 0) {
         throw new CLIValidationError("No backend app with a package.json was found in this project.");
     }
-    context.logger.info(`Adding feature: ${feature}`);
-    context.logger.info(`Packages: ${packages.join(", ")}`);
     // The manifest is read and validated before anything is written: an
     // unusable manifest used to be discovered after every package.json had
     // already been rewritten, leaving the project half-updated.
@@ -96,45 +104,48 @@ export async function runAddCommand(context) {
     if (manifestState.status === "invalid") {
         throw new CLIGenerationError(`The project manifest at ${manifest.path} is unusable: ${manifestState.reason ?? "unknown reason"}. Fix or delete it, then re-run; nothing has been changed.`);
     }
+    for (const pkgPath of targets) {
+        if (!existsSync(pkgPath)) {
+            throw new CLIGenerationError(`Could not find ${pkgPath}`);
+        }
+    }
+    context.logger.info(`Adding feature: ${feature} — ${recipe.summary}`);
+    const outcomes = [];
+    const nextSteps = [];
     try {
-        for (const pkgPath of targets) {
-            if (!existsSync(pkgPath)) {
-                throw new CLIGenerationError(`Could not find ${pkgPath}`);
+        if (recipe.scope === "app") {
+            const apps = targets.map((pkgPath) => join(pkgPath, ".."));
+            // Validate every app before touching any of them.
+            for (const dir of apps)
+                recipe.validate?.(recipeContextFor(layout.root, dir));
+            const gitignore = new Set();
+            for (const dir of apps) {
+                const recipeContext = recipeContextFor(layout.root, dir);
+                const pkg = JSON.parse(readFileSync(join(dir, "package.json"), "utf-8"));
+                outcomes.push(await applyAppRecipe(forApp(recipe, pkg), recipeContext, layout.root));
+                for (const line of recipe.gitignore?.(recipeContext) ?? [])
+                    gitignore.add(line);
+                nextSteps.push(...(recipe.nextSteps?.(recipeContext) ?? []));
             }
-            const pkg = JSON.parse(readFileSync(pkgPath, "utf-8"));
-            const version = versionForNewDependency(pkg);
-            pkg.dependencies ??= {};
-            pkg.zudojs ??= { features: [] };
-            const block = pkg.zudojs;
-            const features = new Set(Array.isArray(block.features)
-                ? block.features.filter((f) => typeof f === "string")
-                : []);
-            features.add(feature);
-            block.features = [...features];
-            for (const name of packages) {
-                if (!(name in pkg.dependencies)) {
-                    pkg.dependencies[name] = version;
-                }
-            }
-            writeFileSync(pkgPath, JSON.stringify(pkg, null, 2) + "\n");
-            context.logger.info(`Updated ${relative(context.cwd, pkgPath) || "package.json"}`);
-        }
-        // The manifest records capabilities for the whole project. A project
-        // described by a legacy zudojs.config.ts or a package.json block has
-        // none; that is said out loud rather than passed over in silence.
-        if (manifestState.status === "ok") {
-            await manifest.addCapability(feature);
+            const settings = await applyProjectSettings(layout.root, [...gitignore], recipe.allowBuilds ?? []);
+            // A Dockerfile written before Prisma was added cannot build the app.
+            const dockerfiles = await refreshGeneratedDockerfiles(projectRecipeContext(layout, feature, []));
+            outcomes.push({ written: [], kept: [], edited: [...settings, ...dockerfiles], manualSteps: [] });
         }
         else {
-            context.logger.warn(`No .zudojs/manifest.json in ${layout.root}; "${feature}" was recorded in package.json only.`);
-        }
-        if (context.values["skip-install"] !== true) {
-            const [file, ...args] = getInstallCommand(layout.packageManager);
-            context.logger.info(`Installing dependencies with ${file}...`);
-            await runStreaming(file, args, layout.root);
+            const capabilities = manifestState.manifest?.capabilities ?? [];
+            const projectContext = projectRecipeContext(layout, feature, capabilities);
+            const refreshed = await refreshGeneratedDockerfiles(projectContext);
+            const outcome = await applyProjectRecipe(recipe, projectContext);
+            outcomes.push({
+                ...outcome,
+                edited: [...outcome.edited, ...refreshed],
+                kept: outcome.kept.filter((path) => !refreshed.includes(path)),
+            });
+            for (const pkgPath of targets)
+                recordFeature(pkgPath, feature);
+            nextSteps.push(...(recipe.nextSteps?.(projectContext) ?? []));
         }
-        context.logger.info(`Feature "${feature}" added successfully.`);
-        context.logger.info(`Import from ${packages.map((p) => `"${p}"`).join(", ")} in your modules.`);
     }
     catch (error) {
         if (error instanceof CLIValidationError) {
@@ -143,5 +154,33 @@ export async function runAddCommand(context) {
         const message = error instanceof Error ? error.message : String(error);
         throw new CLIGenerationError(`Failed to add feature "${feature}": ${message}`, error);
     }
+    // The manifest (and a microservice root's package.json) record
+    // capabilities for the whole project, under the same name the apps got.
+    // A project described by a legacy zudojs.config.ts or a package.json
+    // block has no manifest; that is said out loud rather than passed over.
+    if (recordProjectFeature(layout.root, feature, targets)) {
+        outcomes.push({ written: [], kept: [], edited: ["package.json"], manualSteps: [] });
+    }
+    if (manifestState.status === "ok") {
+        await manifest.addCapability(feature);
+    }
+    else {
+        context.logger.warn(`No .zudojs/manifest.json in ${layout.root}; "${feature}" was recorded in package.json only.`);
+    }
+    reportOutcomes(context.logger, context.cwd, layout.root, outcomes);
+    if (context.values["skip-install"] !== true) {
+        const [file, ...args] = getInstallCommand(layout.packageManager);
+        context.logger.info(`Installing dependencies with ${file}...`);
+        try {
+            await runStreaming(file, args, layout.root);
+        }
+        catch (error) {
+            const message = error instanceof Error ? error.message : String(error);
+            throw new CLIGenerationError(`Feature "${feature}" was added, but installing dependencies failed: ${message}. Run "${file} ${args.join(" ")}" to retry.`, error);
+        }
+    }
+    context.logger.info(`Feature "${feature}" added successfully.`);
+    for (const step of new Set(nextSteps))
+        context.logger.info(`Next: ${step}`);
 }
 //# sourceMappingURL=add.command.js.map

package/dist/src/commands/create.command.js

@@ -21,12 +21,14 @@ import { promptFramework, promptFrontendArchitecture, } from "../prompts/fronten
 import { promptPackageManager } from "../prompts/workspace/index.js";
 import { promptCapabilities } from "../prompts/capabilities/index.js";
 import { CLIValidationError, CLIGenerationError } from "../errors/index.js";
+import { InvalidArgumentsError } from "../cliError/cliError.argument.js";
 import { execCommand, runStreaming } from "../utils/utils.exec.js";
 import { writeFileTree } from "../utils/utils.fileSystem.js";
 import { normalizeName } from "../utils/utils.name.js";
 import { resolveMicroserviceServices } from "../templates/microservice/index.js";
+import { capabilityPackages, resolveProjectCapabilities, } from "../templates/shared/index.js";
 import { ManifestManager } from "../manifest/manifestManager.core.js";
-import { CLI_VERSION, FEATURE_PACKAGES, PACKAGE_MANAGERS, ZUDOJS_PACKAGES_VERSION, } from "../constants/index.js";
+import { CLI_VERSION, PACKAGE_MANAGERS, zudojsVersionRange, } from "../constants/index.js";
 import { registerCLIInterruptHandler } from "../cliApplication/cliApplication.writer.js";
 import { resolveProjectLayout } from "../resolvers/layout/projectLayout.core.js";
 import { CapabilityResolver } from "../resolvers/capability/capabilityResolver.core.js";
@@ -253,7 +255,6 @@ export async function runCreateCommand(context) {
     }
     const isInteractive = process.stdin.isTTY;
     let answers;
-    let selectedCapabilities;
     if (isInteractive) {
         p.intro("Zudojs");
         const name = (await promptProjectName(projectName ?? undefined));
@@ -285,7 +286,6 @@ export async function runCreateCommand(context) {
         // `--capabilities` seeds the prompt so both branches start from the
         // same selection.
         const capabilities = await promptCapabilities(capabilitiesExplicit ? requestedCapabilities : []);
-        selectedCapabilities = capabilities;
         const flags = capabilityFlags(capabilities);
         const enableDocker = arch === "microservice";
         const confirmed = await promptConfirmation(`Create project "${name}"?`, true);
@@ -307,6 +307,7 @@ export async function runCreateCommand(context) {
                 "typescript"),
             services: interactiveServices,
             ...flags,
+            capabilities,
             enableDocker,
             installDeps: !noInstall,
             initGit: !noGit,
@@ -315,7 +316,7 @@ export async function runCreateCommand(context) {
     else {
         // Without --capabilities this is the set the branch has always
         // hard-coded; with it, the same project the prompts would produce.
-        selectedCapabilities = capabilitiesExplicit
+        const selectedCapabilities = capabilitiesExplicit
             ? requestedCapabilities
             : DEFAULT_CAPABILITIES;
         answers = {
@@ -333,6 +334,7 @@ export async function runCreateCommand(context) {
             language: languageValue,
             services,
             ...capabilityFlags(selectedCapabilities),
+            capabilities: selectedCapabilities,
             // Match the interactive branch, which enables Docker for microservices.
             enableDocker: architectureValue === "microservice",
             installDeps: !noInstall,
@@ -340,7 +342,9 @@ export async function runCreateCommand(context) {
         };
     }
     if (!answers.projectName) {
-        throw new CLIValidationError("Project name is required.");
+        // A usage error (exit 2), like any other missing positional; `zudojs
+        // new` is the same command, so the example names the canonical form.
+        throw new InvalidArgumentsError('Missing required argument "project-name". Pass one (zudojs create my-api) or run in an interactive terminal to be prompted.');
     }
     // Backend templates only emit TypeScript. `--language javascript` used to
     // be accepted and ignored (tooling/CLI-09); in a fullstack project it
@@ -361,8 +365,11 @@ export async function runCreateCommand(context) {
         answers.projectType === "backend") {
         throw new CLIValidationError(`--frontend ${frontendValue} applies to --type frontend or --type fullstack; a backend project has no frontend. Use --type fullstack to get one.`);
     }
+    if (capabilitiesExplicit && answers.projectType === "frontend") {
+        context.logger.warn("--capabilities applies to backend apps; a frontend project records none.");
+    }
     assertCompatibleOptions(answers, context);
-    await createProject(answers, context, selectedCapabilities);
+    await createProject(answers, context);
 }
 /**
  * Refuses option combinations the generators cannot honour, and reports the
@@ -393,8 +400,10 @@ function assertCompatibleOptions(options, context) {
             .join("\n")}`);
     }
 }
-async function createProject(options, context, capabilities) {
+async function createProject(options, context) {
     const { projectName, packageManager } = options;
+    // One list for the manifest and every backend package.json.
+    const capabilities = resolveProjectCapabilities(options);
     const targetPath = join(context.cwd, projectName);
     if (existsSync(targetPath)) {
         throw new CLIValidationError(`Directory "${projectName}" already exists in ${context.cwd}`);
@@ -534,12 +543,16 @@ function installCommandFor(packageManager) {
     }
 }
 /**
- * Adds the packages behind capabilities the templates do not wire
- * themselves.
+ * Makes every backend app declare `capabilities` in `zudojs.features` and
+ * depend on the packages behind them — the list the manifest records.
  *
  * The capability prompt offers `events` and `security`, but only six of its
  * eight options reached ScaffoldOptions, so ticking **Security** produced
- * no dependency, no manifest capability and no message.
+ * no dependency, no manifest capability and no message. Later this function
+ * returned early when no capability had an entry in FEATURE_PACKAGES, so
+ * `--capabilities events,cqrs` put `events` in the manifest but not in
+ * package.json; and it mapped packages differently from `zudojs doctor`, so
+ * a microservice gateway declared `cqrs` without `@zudojs/cqrs`.
  */
 async function applyCapabilityPackages(targetPath, capabilities, context) {
     if (capabilities.length === 0)
@@ -547,14 +560,7 @@ async function applyCapabilityPackages(targetPath, capabilities, context) {
     const layout = resolveProjectLayout(targetPath);
     if (!layout || layout.backendDirs.length === 0)
         return;
-    const required = new Set();
-    for (const capability of capabilities) {
-        for (const name of FEATURE_PACKAGES[capability] ?? []) {
-            required.add(name);
-        }
-    }
-    if (required.size === 0)
-        return;
+    const required = capabilityPackages(capabilities);
     const added = new Set();
     for (const pkgPath of selectAddTargets(layout, undefined)) {
         if (!existsSync(pkgPath))
@@ -564,7 +570,7 @@ async function applyCapabilityPackages(targetPath, capabilities, context) {
         let changed = false;
         for (const name of required) {
             if (!(name in pkg.dependencies)) {
-                pkg.dependencies[name] = ZUDOJS_PACKAGES_VERSION;
+                pkg.dependencies[name] = zudojsVersionRange(name);
                 added.add(name);
                 changed = true;
             }
@@ -614,26 +620,7 @@ async function collectProjectProblems(targetPath, options, installed) {
  * Writes the machine-managed .zudojs/manifest.json so follow-up commands
  * (`zudojs dev`, `generate`, `add`) recognize the project immediately.
  */
-async function writeProjectManifest(options, targetPath, selected = []) {
-    const capabilities = [];
-    if (options.enableCQRS)
-        capabilities.push("cqrs");
-    if (options.enableMessaging)
-        capabilities.push("messaging");
-    if (options.enableObservability)
-        capabilities.push("observability");
-    if (options.enableOpenAPI)
-        capabilities.push("openapi");
-    if (options.enableDatabase)
-        capabilities.push("database");
-    if (options.enableQueue)
-        capabilities.push("queue");
-    // Capabilities with no ScaffoldOptions flag of their own (events,
-    // security) were selected and then dropped on the floor.
-    for (const capability of selected) {
-        if (!capabilities.includes(capability))
-            capabilities.push(capability);
-    }
+async function writeProjectManifest(options, targetPath, capabilities) {
     // Record the services actually generated, not the raw request: the
     // microservice template drops reserved names (gateway) and duplicates, and
     // the modular-monolith template normalizes each name into a directory
@@ -670,7 +657,7 @@ async function writeProjectManifest(options, targetPath, selected = []) {
             : {}),
         ...(options.database ? { database: { provider: options.database } } : {}),
         workspace: { packageManager: options.packageManager },
-        capabilities,
+        capabilities: [...capabilities],
         ...(services ? { services: [...services] } : {}),
     });
 }
@@ -695,7 +682,7 @@ async function generateFullstackProject(options, projectPath, rollback) {
             workspace: {
                 packageManager: options.packageManager,
             },
-            features: options.services,
+            features: resolveProjectCapabilities(options),
         },
         projectPath,
         installDeps: options.installDeps,
@@ -730,7 +717,7 @@ async function generateFullstackProject(options, projectPath, rollback) {
             workspace: {
                 packageManager: options.packageManager,
             },
-            features: options.services,
+            features: resolveProjectCapabilities(options),
         },
         projectPath,
         backendPort: 3000,

package/dist/src/commands/doctor.command.d.ts

@@ -16,7 +16,8 @@ export interface DoctorCheck {
     readonly severity: "error" | "warning";
 }
 /**
- * Runs every diagnostic for the project at `cwd`.
+ * Runs every diagnostic for the project containing `cwd` (any directory
+ * inside it: the root is found by walking up, as `generate` does).
  *
  * Exported so the checks can be run against a scaffolded directory in tests
  * without going through the logger.