zudojs-cli 2.0.1 → 2.1.1

package/dist/src/commands/doctor.command.js

@@ -7,23 +7,30 @@ import { existsSync, readFileSync } from "node:fs";
 import { join, relative } from "node:path";
 import { CLIValidationError } from "../errors/index.js";
 import { FEATURE_PACKAGES } from "../constants/index.js";
+import { parseManifest } from "../manifest/manifestFile.helper.js";
+import { findProjectRoot } from "../resolvers/project.resolver.js";
 import { resolveProjectLayout, } from "../resolvers/layout/projectLayout.core.js";
 import { EnvironmentValidator, } from "../validators/environment/environmentValidator.core.js";
 /**
- * Runs every diagnostic for the project at `cwd`.
+ * Runs every diagnostic for the project containing `cwd` (any directory
+ * inside it: the root is found by walking up, as `generate` does).
  *
  * Exported so the checks can be run against a scaffolded directory in tests
  * without going through the logger.
  */
 export function runDoctorChecks(cwd) {
-    const layout = resolveProjectLayout(cwd);
+    const layout = resolveProjectLayout(projectRootFor(cwd));
     const checks = [checkProject(layout)];
     if (!layout) {
         return checks;
     }
-    checks.push(checkPackageManager(layout), checkInstalled(layout), checkTypeScriptConfig(layout), checkDependencies(layout), checkFeatures(layout));
+    checks.push(checkPackageManager(layout), checkInstalled(layout), checkTypeScriptConfig(layout), checkDependencies(layout), checkFeatures(layout), checkCapabilities(layout));
     return checks;
 }
+/** The workspace root above `cwd`, or `cwd` itself outside any project. */
+function projectRootFor(cwd) {
+    return findProjectRoot(cwd, { workspace: true }) ?? cwd;
+}
 /**
  * Environment checks: Node.js, Git and the project's own package manager.
  *
@@ -32,7 +39,7 @@ export function runDoctorChecks(cwd) {
  * inline.
  */
 export async function runEnvironmentChecks(cwd) {
-    const layout = resolveProjectLayout(cwd);
+    const layout = resolveProjectLayout(projectRootFor(cwd));
     const result = await new EnvironmentValidator().validate(layout?.projectType ?? "backend", layout?.packageManager);
     return result.checks.map((check) => check.name === "Node.js"
         ? checkNodeVersion(check)
@@ -271,4 +278,45 @@ function checkFeatures(layout) {
             : violations.join("; "),
     };
 }
+/** The `zudojs.features` an app's package.json declares. */
+function declaredFeatures(dir) {
+    const features = readPackageJson(dir)?.zudojs?.features;
+    return Array.isArray(features)
+        ? features.filter((f) => typeof f === "string")
+        : [];
+}
+/**
+ * The manifest's `capabilities` and the backend apps' `zudojs.features`
+ * must name the same set. zudojs-cli 2.0.1 recorded `events` and
+ * `security` in the manifest only, so `info` and `add` (which read the
+ * manifest) and `doctor` (which reads package.json) disagreed.
+ */
+function checkCapabilities(layout) {
+    const name = "Capabilities";
+    const manifestPath = join(layout.root, ".zudojs", "manifest.json");
+    const manifest = existsSync(manifestPath)
+        ? parseManifest(readFileSync(manifestPath, "utf-8")).manifest
+        : null;
+    if (manifest === null || layout.backendDirs.length === 0) {
+        return { name, severity: "warning", passed: true, message: "Nothing to compare" };
+    }
+    const declared = new Set(layout.backendDirs.flatMap(declaredFeatures));
+    const recorded = new Set(manifest.capabilities);
+    const problems = [
+        ...[...recorded]
+            .filter((c) => !declared.has(c))
+            .map((c) => `"${c}" is in .zudojs/manifest.json but in no app's zudojs.features`),
+        ...[...declared]
+            .filter((c) => !recorded.has(c))
+            .map((c) => `"${c}" is in zudojs.features but not in .zudojs/manifest.json`),
+    ];
+    return {
+        name,
+        severity: "warning",
+        passed: problems.length === 0,
+        message: problems.length === 0
+            ? "The manifest and package.json record the same capabilities"
+            : problems.join("; "),
+    };
+}
 //# sourceMappingURL=doctor.command.js.map

package/dist/src/commands/generate.command.js

@@ -10,14 +10,11 @@ import { generateService } from "../generators/service/service.generator.js";
 import { generateModule } from "../generators/module/module.generator.js";
 import { generateCommand } from "../generators/command/command.generator.js";
 import { generateQuery } from "../generators/query/query.generator.js";
-import { generateController } from "../generators/controller/controller.generator.js";
-import { generateRepository } from "../generators/repository/repository.generator.js";
 import { generateMiddleware } from "../generators/middleware/middleware.generator.js";
 import { generateEvent } from "../generators/event/event.generator.js";
 import { generateJob } from "../generators/job/job.generator.js";
-import { generateRoute } from "../generators/route/route.generator.js";
 import { generateModel } from "../generators/model/model.generator.js";
-import { generateDto } from "../generators/dto/dto.generator.js";
+import { isResourceSchematic, runResourceSchematic, } from "../generators/resource/index.js";
 import { generateValidator } from "../generators/validator/validator.generator.js";
 import { CLIGenerationError, CLINotInProjectError, CLIValidationError, } from "../errors/index.js";
 import { assertGeneratableName, assertSafePathSegment, } from "../utils/utils.name.js";
@@ -26,6 +23,7 @@ import { resolveProjectLayout } from "../resolvers/layout/projectLayout.core.js"
 import { findProjectRoot } from "../resolvers/project.resolver.js";
 import { describeError } from "./commandError.helper.js";
 import { captureWrites, findWriteConflicts } from "../utils/utils.writeGuard.js";
+import { describeAddedDependencies, ensureZudojsDependencies, fileCount, } from "../wiring/index.js";
 /**
  * Resolves the directory a schematic is generated into.
  *
@@ -117,6 +115,12 @@ export async function runGenerateCommand(context) {
     if (!name) {
         throw new CLIValidationError("Resource name is required.");
     }
+    // A name with a path in it used to be normalized silently
+    // (`generate resource ../../x` wrote `x`), hiding a typo or a hostile
+    // argument in a script. Names are plain names.
+    if (/[\\/]|\.\./.test(name)) {
+        throw new CLIValidationError(`Invalid resource name: "${name}". Use a plain name such as "users"; paths are not allowed.`);
+    }
     // Reject names that normalize to nothing (`zudojs generate event "..."`
     // wrote src/events/.event.ts with an anonymous export), and reject option
     // values that are interpolated verbatim into a generated path. `--service ..`
@@ -179,6 +183,20 @@ export async function runGenerateCommand(context) {
     if (effectiveSchematic !== schematic) {
         context.logger.info('Mapping "service" → "module" for modular-monolith architecture.');
     }
+    if (isResourceSchematic(effectiveSchematic)) {
+        await runResourceSchematic(context, {
+            schematic: effectiveSchematic,
+            name,
+            cwd,
+            backendRoot: backendPrefix(cwd).replace(/\/$/, ""),
+            architecture: architecture ?? undefined,
+            service,
+            moduleName,
+            dryRun,
+            force,
+        });
+        return;
+    }
     const schematicOptions = {
         service,
         module: moduleName,
@@ -197,22 +215,27 @@ export async function runGenerateCommand(context) {
     const result = await runSchematic(effectiveSchematic, name, {
         ...schematicOptions,
         onModuleRegistered: (registration) => {
-            if (registration.registered)
+            if (registration.manualSteps.length === 0)
                 return;
-            context.logger.warn(`Could not register the module in app.ts automatically. Add:\n${registration.manualSteps
+            context.logger.warn(`Could not register the module automatically. Add:\n${registration.manualSteps
                 .map((step) => `  ${step}`)
                 .join("\n")}`);
         },
     }, cwd);
     if (dryRun) {
-        context.logger.info(`Dry run: ${result.length} files would be generated (nothing written):`);
+        context.logger.info(`Dry run: ${fileCount(result.length)} would be generated (nothing written):`);
     }
     else {
-        context.logger.info(`Generated ${result.length} files:`);
+        context.logger.info(`Generated ${fileCount(result.length)}:`);
     }
     for (const file of result) {
         context.logger.info(`  - ${file}`);
     }
+    if (!dryRun) {
+        for (const line of describeAddedDependencies(ensureZudojsDependencies(cwd, result))) {
+            context.logger.warn(line);
+        }
+    }
 }
 async function runSchematic(schematic, name, options, cwd) {
     try {
@@ -239,22 +262,14 @@ async function runSchematic(schematic, name, options, cwd) {
                 return await generateCommand({ name, ...(cqrsService ? { service: cqrsService } : {}), basePath, dryRun }, cwd);
             case "query":
                 return await generateQuery({ name, ...(cqrsService ? { service: cqrsService } : {}), basePath, dryRun }, cwd);
-            case "controller":
-                return await generateController({ name, basePath, dryRun }, cwd);
-            case "repository":
-                return await generateRepository({ name, basePath, dryRun }, cwd);
             case "middleware":
                 return await generateMiddleware({ name, basePath, dryRun }, cwd);
             case "event":
                 return await generateEvent({ name, basePath, dryRun }, cwd);
             case "job":
                 return await generateJob({ name, basePath, dryRun }, cwd);
-            case "route":
-                return await generateRoute({ name, basePath, dryRun }, cwd);
             case "model":
                 return await generateModel({ name, basePath, dryRun }, cwd);
-            case "dto":
-                return await generateDto({ name, basePath, dryRun }, cwd);
             case "validator":
                 return await generateValidator({ name, basePath, dryRun }, cwd);
             default:

package/dist/src/commands/info.command.js

@@ -8,6 +8,8 @@ import { join, relative } from "node:path";
 import { CLI_VERSION } from "../constants/index.js";
 import { checkForNewerVersion } from "../cliVersion/cliVersion.update.js";
 import { resolveProjectLayout } from "../resolvers/layout/projectLayout.core.js";
+import { ConfigurationResolver } from "../resolvers/configuration/configurationResolver.core.js";
+import { findProjectRoot } from "../resolvers/project.resolver.js";
 export async function runInfoCommand(context) {
     context.logger.info("Zudojs CLI");
     context.logger.info(`  Version: ${CLI_VERSION}`);
@@ -17,7 +19,9 @@ export async function runInfoCommand(context) {
         context.logger.info(`  Update available: ${update.latest} (npm install -g zudojs-cli@latest)`);
     }
     context.logger.info("");
-    const layout = resolveProjectLayout(context.cwd);
+    // From any directory inside the project, like `generate` and `build`.
+    const root = findProjectRoot(context.cwd, { workspace: true });
+    const layout = root === null ? null : resolveProjectLayout(root);
     if (!layout) {
         context.logger.info("Not in a Zudojs project directory.");
         context.logger.info("Run `zudojs create <project-name>` to create a new project.");
@@ -47,6 +51,12 @@ export async function runInfoCommand(context) {
     if (layout.services.length > 0) {
         context.logger.info(`  Services: ${layout.services.join(", ")}`);
     }
+    // The manifest's list, which `create` and `add` keep equal to the
+    // backend apps' `zudojs.features`; `zudojs doctor` checks the two agree.
+    const capabilities = new ConfigurationResolver().resolve(layout.root)?.features ?? [];
+    if (layout.backendDirs.length > 0) {
+        context.logger.info(`  Capabilities: ${capabilities.length > 0 ? capabilities.join(", ") : "(none)"}`);
+    }
     context.logger.info("");
     context.logger.info("Zudojs dependencies");
     const deps = new Map();

package/dist/src/constants/index.d.ts

@@ -6,7 +6,10 @@
 import type { BackendArchitecture, DatabaseProvider, PackageManagerType } from "../types/projectConfiguration.type.js";
 export { CLI_VERSION } from "../cliConstant/cliVersion.js";
 /**
- * Version range every generated project depends on for `@zudojs/*` packages.
+ * Legacy version range for `@zudojs/*` packages. Generated projects now use
+ * {@link zudojsVersionRange}, which pins each package to the version this
+ * CLI build targets; this remains for the few places that must name a
+ * range without knowing the package.
  *
  * This is a caret range, not an exact pin, on purpose. The framework
  * packages are released independently, so at any moment their latest
@@ -16,13 +19,28 @@ export { CLI_VERSION } from "../cliConstant/cliVersion.js";
  * moved on. A range resolves each package to its newest compatible release.
  */
 export declare const ZUDOJS_PACKAGES_VERSION: "^1.0.0";
+export { ZUDOJS_PACKAGE_VERSIONS } from "./zudojsVersions.generated.js";
+export { ZUDOJS_FALLBACK_VERSION_RANGE, zudojsDependencies, zudojsVersionRange, } from "./zudojsVersions.helper.js";
 /**
- * Packages installed by `zudojs add <feature>`.
+ * Packages that back each feature `zudojs add <feature>` accepts.
  *
  * Also used by `zudojs doctor` to verify that every feature recorded in a
- * project is backed by its package.
+ * project is backed by its package. `add` does more than install these: it
+ * writes a working recipe for every feature (see `src/recipes/`), so a name
+ * is only listed here when it has one. `docs` used to be accepted and only
+ * installed `@zudojs/docs`, a documentation-site toolkit with nothing to
+ * wire into an application; it is refused with an explanation instead.
  */
 export declare const FEATURE_PACKAGES: Readonly<Record<string, readonly string[]>>;
+/**
+ * Other names `zudojs add` understands, mapped to the feature they mean.
+ */
+export declare const FEATURE_ALIASES: Readonly<Record<string, string>>;
+/**
+ * Names `zudojs add` refuses, with the reason. They were accepted once, or
+ * are commonly guessed, but have no application recipe.
+ */
+export declare const FEATURE_REFUSALS: Readonly<Record<string, string>>;
 /** A selectable answer offered by a prompt. */
 export interface CLIChoiceOption<Value extends string = string> {
     readonly value: Value;

package/dist/src/constants/index.js

@@ -5,7 +5,10 @@
  */
 export { CLI_VERSION } from "../cliConstant/cliVersion.js";
 /**
- * Version range every generated project depends on for `@zudojs/*` packages.
+ * Legacy version range for `@zudojs/*` packages. Generated projects now use
+ * {@link zudojsVersionRange}, which pins each package to the version this
+ * CLI build targets; this remains for the few places that must name a
+ * range without knowing the package.
  *
  * This is a caret range, not an exact pin, on purpose. The framework
  * packages are released independently, so at any moment their latest
@@ -15,25 +18,52 @@ export { CLI_VERSION } from "../cliConstant/cliVersion.js";
  * moved on. A range resolves each package to its newest compatible release.
  */
 export const ZUDOJS_PACKAGES_VERSION = "^1.0.0";
+export { ZUDOJS_PACKAGE_VERSIONS } from "./zudojsVersions.generated.js";
+export { ZUDOJS_FALLBACK_VERSION_RANGE, zudojsDependencies, zudojsVersionRange, } from "./zudojsVersions.helper.js";
 /**
- * Packages installed by `zudojs add <feature>`.
+ * Packages that back each feature `zudojs add <feature>` accepts.
  *
  * Also used by `zudojs doctor` to verify that every feature recorded in a
- * project is backed by its package.
+ * project is backed by its package. `add` does more than install these: it
+ * writes a working recipe for every feature (see `src/recipes/`), so a name
+ * is only listed here when it has one. `docs` used to be accepted and only
+ * installed `@zudojs/docs`, a documentation-site toolkit with nothing to
+ * wire into an application; it is refused with an explanation instead.
  */
 export const FEATURE_PACKAGES = {
     database: ["@zudojs/database"],
+    redis: ["redis"],
+    websockets: ["ws"],
+    email: ["nodemailer"],
+    docker: [],
     queue: ["@zudojs/queue"],
     messaging: ["@zudojs/messaging"],
     openapi: ["@zudojs/openapi"],
     observability: ["@zudojs/observability"],
-    security: ["@zudojs/security"],
     cache: ["@zudojs/cache"],
     storage: ["@zudojs/storage"],
     // Used to install @zudojs/queue; the scheduler package exists and is the
     // one the feature name promises.
     scheduler: ["@zudojs/scheduler"],
-    docs: ["@zudojs/docs"],
+};
+/**
+ * Other names `zudojs add` understands, mapped to the feature they mean.
+ */
+export const FEATURE_ALIASES = {
+    postgres: "database",
+    postgresql: "database",
+    prisma: "database",
+    websocket: "websockets",
+    ws: "websockets",
+    mail: "email",
+};
+/**
+ * Names `zudojs add` refuses, with the reason. They were accepted once, or
+ * are commonly guessed, but have no application recipe.
+ */
+export const FEATURE_REFUSALS = {
+    security: "it is built in. Every generated server applies the @zudojs/security default headers, a CORS policy (CORS_ORIGINS) and per-client rate limiting (RATE_LIMIT_MAX, RATE_LIMIT_WINDOW_MS), and depends on @zudojs/security already.",
+    docs: "@zudojs/docs builds documentation sites; it has nothing to wire into an application. Install it directly with your package manager if you need it.",
 };
 /** Backend architectures offered by `zudojs create`. */
 export const ARCHITECTURE_CHOICES = Object.freeze([
@@ -98,6 +128,11 @@ export const FEATURE_CHOICES = Object.freeze(Object.keys(FEATURE_PACKAGES).map((
  * This is the canonical list; the hand-written one named six of thirteen.
  */
 export const SCHEMA_CHOICES = Object.freeze([
+    {
+        value: "resource",
+        label: "Resource",
+        hint: "DTO, repository, service, controller, CRUD routes and a test, registered",
+    },
     { value: "service", label: "Service (CQRS)" },
     { value: "module", label: "Module" },
     { value: "command", label: "Command" },

package/dist/src/constants/zudojsVersions.generated.d.ts

@@ -0,0 +1,9 @@
+/**
+ * zudojs-cli — Versions of the @zudojs/* packages this CLI build targets.
+ *
+ * GENERATED by scripts/generateZudojsVersions.mjs from the package.json of
+ * every workspace package.
+ * Do not edit by hand; run `node scripts/generateZudojsVersions.mjs`.
+ */
+export declare const ZUDOJS_PACKAGE_VERSIONS: Readonly<Record<string, string>>;
+//# sourceMappingURL=zudojsVersions.generated.d.ts.map

package/dist/src/constants/zudojsVersions.generated.js

@@ -0,0 +1,48 @@
+/**
+ * zudojs-cli — Versions of the @zudojs/* packages this CLI build targets.
+ *
+ * GENERATED by scripts/generateZudojsVersions.mjs from the package.json of
+ * every workspace package.
+ * Do not edit by hand; run `node scripts/generateZudojsVersions.mjs`.
+ */
+export const ZUDOJS_PACKAGE_VERSIONS = Object.freeze({
+    "@zudojs/adapters": "1.2.1",
+    "@zudojs/api": "1.2.1",
+    "@zudojs/auth": "1.3.1",
+    "@zudojs/auth-oauth": "1.2.3",
+    "@zudojs/cache": "1.2.1",
+    "@zudojs/config": "1.3.1",
+    "@zudojs/constants": "1.1.2",
+    "@zudojs/container": "1.2.1",
+    "@zudojs/core": "1.2.2",
+    "@zudojs/cqrs": "1.2.1",
+    "@zudojs/crypto": "1.3.1",
+    "@zudojs/database": "1.3.1",
+    "@zudojs/docs": "1.0.4",
+    "@zudojs/errors": "1.3.0",
+    "@zudojs/events": "1.3.1",
+    "@zudojs/feature-flags": "1.4.0",
+    "@zudojs/http": "1.4.2",
+    "@zudojs/lifecycle": "1.2.1",
+    "@zudojs/logger": "1.4.1",
+    "@zudojs/messaging": "1.2.1",
+    "@zudojs/middleware": "1.1.0",
+    "@zudojs/observability": "1.2.1",
+    "@zudojs/openapi": "1.5.0",
+    "@zudojs/permissions": "1.4.1",
+    "@zudojs/plugins": "1.3.1",
+    "@zudojs/queue": "1.4.1",
+    "@zudojs/rpc": "1.4.1",
+    "@zudojs/runtime": "1.3.1",
+    "@zudojs/scheduler": "1.2.0",
+    "@zudojs/schema": "1.2.1",
+    "@zudojs/security": "1.3.1",
+    "@zudojs/serialization": "1.2.1",
+    "@zudojs/storage": "1.2.1",
+    "@zudojs/tenancy": "1.3.1",
+    "@zudojs/testing": "1.2.2",
+    "@zudojs/transactions": "1.2.0",
+    "@zudojs/types": "1.2.0",
+    "@zudojs/validation": "1.1.0",
+});
+//# sourceMappingURL=zudojsVersions.generated.js.map

package/dist/src/constants/zudojsVersions.helper.d.ts

@@ -0,0 +1,21 @@
+/**
+ * zudojs-cli — Version ranges written for `@zudojs/*` dependencies.
+ *
+ * Every generated package.json used to depend on `^1.0.0` of every framework
+ * package, which resolves to any 1.x release — including ones that predate
+ * the APIs the generated code calls (`createRouter` OpenAPI metadata,
+ * `mountOpenAPI`, `createHttpTestClient`). Each package now gets a caret
+ * range on the version this CLI build was generated against
+ * ({@link ZUDOJS_PACKAGE_VERSIONS}), so a newer compatible release is still
+ * picked up but an older one never is.
+ */
+/**
+ * Fallback for a package the version map does not know (for example a
+ * name recorded by an older project). A plain caret on the first major.
+ */
+export declare const ZUDOJS_FALLBACK_VERSION_RANGE: "^1.0.0";
+/** The range written for `name` (`^<version this CLI targets>`). */
+export declare function zudojsVersionRange(name: string): string;
+/** `{ name: range }` for a list of `@zudojs/*` packages, deduplicated. */
+export declare function zudojsDependencies(names: readonly string[]): Record<string, string>;
+//# sourceMappingURL=zudojsVersions.helper.d.ts.map

package/dist/src/constants/zudojsVersions.helper.js

@@ -0,0 +1,29 @@
+/**
+ * zudojs-cli — Version ranges written for `@zudojs/*` dependencies.
+ *
+ * Every generated package.json used to depend on `^1.0.0` of every framework
+ * package, which resolves to any 1.x release — including ones that predate
+ * the APIs the generated code calls (`createRouter` OpenAPI metadata,
+ * `mountOpenAPI`, `createHttpTestClient`). Each package now gets a caret
+ * range on the version this CLI build was generated against
+ * ({@link ZUDOJS_PACKAGE_VERSIONS}), so a newer compatible release is still
+ * picked up but an older one never is.
+ */
+import { ZUDOJS_PACKAGE_VERSIONS } from "./zudojsVersions.generated.js";
+/**
+ * Fallback for a package the version map does not know (for example a
+ * name recorded by an older project). A plain caret on the first major.
+ */
+export const ZUDOJS_FALLBACK_VERSION_RANGE = "^1.0.0";
+/** The range written for `name` (`^<version this CLI targets>`). */
+export function zudojsVersionRange(name) {
+    const version = Object.hasOwn(ZUDOJS_PACKAGE_VERSIONS, name)
+        ? ZUDOJS_PACKAGE_VERSIONS[name]
+        : undefined;
+    return version === undefined ? ZUDOJS_FALLBACK_VERSION_RANGE : `^${version}`;
+}
+/** `{ name: range }` for a list of `@zudojs/*` packages, deduplicated. */
+export function zudojsDependencies(names) {
+    return Object.fromEntries([...new Set(names)].map((name) => [name, zudojsVersionRange(name)]));
+}
+//# sourceMappingURL=zudojsVersions.helper.js.map

package/dist/src/generators/frontend/frontendGenerator.core.js

@@ -8,7 +8,6 @@ import { PackageManagerRegistry } from "../../registries/adapter/packageManagerR
 import { DependencyResolver } from "../../resolvers/dependency/dependencyResolver.core.js";
 import { CLIGenerationError } from "../../errors/index.js";
 import { runFrontendPipeline } from "./frontendPipeline.js";
-import { writeFileTree } from "../../utils/utils.fileSystem.js";
 import { renderPnpmWorkspaceFile } from "../../templates/shared/pnpm.template.js";
 /**
  * Generates frontend projects using framework adapters.
@@ -47,15 +46,15 @@ export class FrontendGenerator {
         const files = [];
         const errors = [];
         try {
-            // A frontend-only project is its own pnpm root. Vite depends on
-            // esbuild, whose install script pnpm 10+ refuses without this list,
-            // and the pipeline installs dependencies right after scaffolding.
-            if (context.packageManager === "pnpm") {
-                await writeFileTree(context.projectPath, {
-                    "pnpm-workspace.yaml": renderPnpmWorkspaceFile(),
-                });
-            }
-            const outcome = await runFrontendPipeline(adapter, context, this.packageManagerRegistry, this.dependencyResolver);
+            // A frontend-only project is its own pnpm root. Toolchains depend on
+            // packages with install scripts (esbuild, sharp, @parcel/watcher)
+            // that pnpm 10+ refuses without this list. It is written after the
+            // official scaffolder runs, which must see an empty directory, and
+            // before the pipeline installs dependencies.
+            const postScaffoldFiles = context.packageManager === "pnpm"
+                ? { "pnpm-workspace.yaml": renderPnpmWorkspaceFile() }
+                : {};
+            const outcome = await runFrontendPipeline(adapter, context, this.packageManagerRegistry, this.dependencyResolver, postScaffoldFiles);
             files.push(...outcome.files);
             errors.push(...outcome.errors);
         }

package/dist/src/generators/frontend/frontendPipeline.d.ts

@@ -21,6 +21,11 @@ export interface FrontendPipelineResult {
 /**
  * Runs the full adapter sequence: availability check, scaffold, structure,
  * integration, dependency resolution, dependency installation, validation.
+ *
+ * @param postScaffoldFiles - Files written right after the scaffold step
+ *   (e.g. a standalone project's `pnpm-workspace.yaml`). They must not exist
+ *   earlier: `create-vite` cancels in a non-empty directory yet exits 0, so
+ *   a pre-written file left the project with no Vite app at all.
  */
-export declare function runFrontendPipeline(adapter: FrontendAdapter, context: FrontendGenerationContext, packageManagerRegistry: PackageManagerRegistry, dependencyResolver: DependencyResolver): Promise<FrontendPipelineResult>;
+export declare function runFrontendPipeline(adapter: FrontendAdapter, context: FrontendGenerationContext, packageManagerRegistry: PackageManagerRegistry, dependencyResolver: DependencyResolver, postScaffoldFiles?: Readonly<Record<string, string>>): Promise<FrontendPipelineResult>;
 //# sourceMappingURL=frontendPipeline.d.ts.map

package/dist/src/generators/frontend/frontendPipeline.js

@@ -32,8 +32,13 @@ function assertSafePackageNames(names) {
 /**
  * Runs the full adapter sequence: availability check, scaffold, structure,
  * integration, dependency resolution, dependency installation, validation.
+ *
+ * @param postScaffoldFiles - Files written right after the scaffold step
+ *   (e.g. a standalone project's `pnpm-workspace.yaml`). They must not exist
+ *   earlier: `create-vite` cancels in a non-empty directory yet exits 0, so
+ *   a pre-written file left the project with no Vite app at all.
  */
-export async function runFrontendPipeline(adapter, context, packageManagerRegistry, dependencyResolver) {
+export async function runFrontendPipeline(adapter, context, packageManagerRegistry, dependencyResolver, postScaffoldFiles = {}) {
     const files = [];
     const errors = [];
     // 0. Fail fast with a readable message when the framework's own toolchain
@@ -53,6 +58,9 @@ export async function runFrontendPipeline(adapter, context, packageManagerRegist
     //    templates where one exists).
     await adapter.scaffold(context);
     files.push("scaffold");
+    if (Object.keys(postScaffoldFiles).length > 0) {
+        await writeFileTree(context.projectPath, { ...postScaffoldFiles });
+    }
     // 2. Apply the Zudojs structure over the scaffolded project.
     await adapter.applyZudojsStructure(context);
     files.push("structure");

package/dist/src/generators/fullstack/fullstackComposer.core.js

@@ -13,6 +13,7 @@ import { DependencyResolver } from "../../resolvers/dependency/dependencyResolve
 import { runFrontendPipeline } from "../frontend/frontendPipeline.js";
 import { writeFileTree } from "../../utils/utils.fileSystem.js";
 import { renderPnpmWorkspaceFile } from "../../templates/shared/pnpm.template.js";
+import { TYPESCRIPT_VERSION_RANGES } from "../../resolvers/dependency/dependencyVersions.constant.js";
 /**
  * Composes fullstack projects by orchestrating multiple generators.
  */
@@ -92,7 +93,12 @@ export class FullstackComposer {
                 typecheck: scriptFor("typecheck"),
             },
             devDependencies: {
-                typescript: "^5.0.0",
+                // The root compiler is hoisted over every workspace by npm, yarn
+                // and bun, so it must satisfy the frontend toolchain's TypeScript
+                // peer range; apps/api keeps its own TypeScript 7.
+                typescript: context.project.frontend
+                    ? TYPESCRIPT_VERSION_RANGES.frontend
+                    : TYPESCRIPT_VERSION_RANGES.backend,
             },
         };
         // The project's type, architecture and frontend are recorded in

package/dist/src/generators/index.d.ts

@@ -11,6 +11,5 @@ export { generateModule } from "./module/module.generator.js";
 export { generateService } from "./service/service.generator.js";
 export { generateCommand } from "./command/command.generator.js";
 export { generateQuery } from "./query/query.generator.js";
-export { generateController } from "./controller/controller.generator.js";
-export { generateRepository } from "./repository/repository.generator.js";
+export { generateResource, resolveResourceLayout, planResource, RESOURCE_SCHEMATICS, } from "./resource/index.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/src/generators/index.js

@@ -11,6 +11,5 @@ export { generateModule } from "./module/module.generator.js";
 export { generateService } from "./service/service.generator.js";
 export { generateCommand } from "./command/command.generator.js";
 export { generateQuery } from "./query/query.generator.js";
-export { generateController } from "./controller/controller.generator.js";
-export { generateRepository } from "./repository/repository.generator.js";
+export { generateResource, resolveResourceLayout, planResource, RESOURCE_SCHEMATICS, } from "./resource/index.js";
 //# sourceMappingURL=index.js.map

package/dist/src/generators/infrastructure/infrastructure.generator.js

@@ -9,6 +9,13 @@ import { resolveDatabaseAdapter } from "../../adapters/databases/databaseAdapter
 import { resolveMicroserviceServices } from "../../templates/microservice/microservice.template.js";
 import { renderAppPackageDockerfile, renderWorkspaceAppDockerfile, } from "../../templates/shared/dockerfile.template.js";
 const SERVICE_NAME_PATTERN = /^[a-zA-Z0-9_-]+$/;
+/**
+ * Database passwords are interpolated by compose from `.env`
+ * (see `.env.example`); compose refuses to start without them. The files
+ * used to carry `postgres`/`mysql` as literal passwords.
+ */
+const POSTGRES_PASSWORD = "${POSTGRES_PASSWORD:?Set POSTGRES_PASSWORD in .env}";
+const MYSQL_PASSWORD = "${MYSQL_ROOT_PASSWORD:?Set MYSQL_ROOT_PASSWORD in .env}";
 export class InfrastructureGenerator {
     async generate(options, basePath) {
         // Rejects engines with no adapter (e.g. mongodb) instead of falling
@@ -60,11 +67,12 @@ export class InfrastructureGenerator {
             return {
                 image: "mysql:8",
                 port: 3306,
+                // Read from .env by compose: no credential is written here.
                 environment: [
-                    "MYSQL_ROOT_PASSWORD=mysql",
+                    `MYSQL_ROOT_PASSWORD=${MYSQL_PASSWORD}`,
                     `MYSQL_DATABASE=${options.projectName}`,
                 ],
-                url: `mysql://root:mysql@db:3306/${options.projectName}`,
+                url: `mysql://root:${MYSQL_PASSWORD}@db:3306/${options.projectName}`,
                 dataPath: "/var/lib/mysql",
             };
         }
@@ -77,10 +85,10 @@ export class InfrastructureGenerator {
             port: 5432,
             environment: [
                 "POSTGRES_USER=postgres",
-                "POSTGRES_PASSWORD=postgres",
+                `POSTGRES_PASSWORD=${POSTGRES_PASSWORD}`,
                 `POSTGRES_DB=${options.projectName}`,
             ],
-            url: `postgresql://postgres:postgres@db:5432/${options.projectName}`,
+            url: `postgresql://postgres:${POSTGRES_PASSWORD}@db:5432/${options.projectName}`,
             dataPath: "/var/lib/postgresql/data",
         };
     }
@@ -92,7 +100,7 @@ export class InfrastructureGenerator {
         return `  db:
     image: ${db.image}
     ports:
-      - "${db.port}:${db.port}"
+      - "127.0.0.1:${db.port}:${db.port}"
     environment:
 ${db.environment.map((e) => `      - ${e}`).join("\n")}
     volumes:

package/dist/src/generators/integration/integrationGenerator.core.d.ts

@@ -30,6 +30,8 @@ export declare class IntegrationGenerator {
     private getBackendPath;
     private generateApiClient;
     private getApiClientPath;
+    /** Origins the frontend dev server is reached on. */
+    private frontendOrigins;
     private generateCorsConfig;
     private generateViteProxy;
 }