@podosoft/podokit 0.1.1 → 0.3.0

package/dist/templates/fullstack-nest-svelte/apps/web/src/lib/components/ui/table/table-caption.svelte

@@ -0,0 +1,20 @@
+<script lang="ts">
+	import { cn, type WithElementRef } from "$lib/utils.js";
+	import type { HTMLAttributes } from "svelte/elements";
+
+	let {
+		ref = $bindable(null),
+		class: className,
+		children,
+		...restProps
+	}: WithElementRef<HTMLAttributes<HTMLElement>> = $props();
+</script>
+
+<caption
+	bind:this={ref}
+	data-slot="table-caption"
+	class={cn("text-muted-foreground mt-4 text-sm", className)}
+	{...restProps}
+>
+	{@render children?.()}
+</caption>

package/dist/templates/fullstack-nest-svelte/apps/web/src/lib/components/ui/table/table-cell.svelte

@@ -0,0 +1,15 @@
+<script lang="ts">
+	import { cn, type WithElementRef } from "$lib/utils.js";
+	import type { HTMLTdAttributes } from "svelte/elements";
+
+	let {
+		ref = $bindable(null),
+		class: className,
+		children,
+		...restProps
+	}: WithElementRef<HTMLTdAttributes> = $props();
+</script>
+
+<td bind:this={ref} data-slot="table-cell" class={cn("p-2 align-middle whitespace-nowrap [&:has([role=checkbox])]:pr-0", className)} {...restProps}>
+	{@render children?.()}
+</td>

package/dist/templates/fullstack-nest-svelte/apps/web/src/lib/components/ui/table/table-footer.svelte

@@ -0,0 +1,20 @@
+<script lang="ts">
+	import { cn, type WithElementRef } from "$lib/utils.js";
+	import type { HTMLAttributes } from "svelte/elements";
+
+	let {
+		ref = $bindable(null),
+		class: className,
+		children,
+		...restProps
+	}: WithElementRef<HTMLAttributes<HTMLTableSectionElement>> = $props();
+</script>
+
+<tfoot
+	bind:this={ref}
+	data-slot="table-footer"
+	class={cn("bg-muted/50 border-t font-medium [&>tr]:last:border-b-0", className)}
+	{...restProps}
+>
+	{@render children?.()}
+</tfoot>

package/dist/templates/fullstack-nest-svelte/apps/web/src/lib/components/ui/table/table-head.svelte

@@ -0,0 +1,15 @@
+<script lang="ts">
+	import { cn, type WithElementRef } from "$lib/utils.js";
+	import type { HTMLThAttributes } from "svelte/elements";
+
+	let {
+		ref = $bindable(null),
+		class: className,
+		children,
+		...restProps
+	}: WithElementRef<HTMLThAttributes> = $props();
+</script>
+
+<th bind:this={ref} data-slot="table-head" class={cn("text-foreground h-10 px-2 text-left align-middle font-medium whitespace-nowrap [&:has([role=checkbox])]:pr-0", className)} {...restProps}>
+	{@render children?.()}
+</th>

package/dist/templates/fullstack-nest-svelte/apps/web/src/lib/components/ui/table/table-header.svelte

@@ -0,0 +1,20 @@
+<script lang="ts">
+	import { cn, type WithElementRef } from "$lib/utils.js";
+	import type { HTMLAttributes } from "svelte/elements";
+
+	let {
+		ref = $bindable(null),
+		class: className,
+		children,
+		...restProps
+	}: WithElementRef<HTMLAttributes<HTMLTableSectionElement>> = $props();
+</script>
+
+<thead
+	bind:this={ref}
+	data-slot="table-header"
+	class={cn("[&_tr]:border-b", className)}
+	{...restProps}
+>
+	{@render children?.()}
+</thead>

package/dist/templates/fullstack-nest-svelte/apps/web/src/lib/components/ui/table/table-row.svelte

@@ -0,0 +1,15 @@
+<script lang="ts">
+	import { cn, type WithElementRef } from "$lib/utils.js";
+	import type { HTMLAttributes } from "svelte/elements";
+
+	let {
+		ref = $bindable(null),
+		class: className,
+		children,
+		...restProps
+	}: WithElementRef<HTMLAttributes<HTMLTableRowElement>> = $props();
+</script>
+
+<tr bind:this={ref} data-slot="table-row" class={cn("hover:bg-muted/50 data-[state=selected]:bg-muted border-b transition-colors", className)} {...restProps}>
+	{@render children?.()}
+</tr>

package/dist/templates/fullstack-nest-svelte/apps/web/src/lib/components/ui/table/table.svelte

@@ -0,0 +1,17 @@
+<script lang="ts">
+	import type { HTMLTableAttributes } from "svelte/elements";
+	import { cn, type WithElementRef } from "$lib/utils.js";
+
+	let {
+		ref = $bindable(null),
+		class: className,
+		children,
+		...restProps
+	}: WithElementRef<HTMLTableAttributes> = $props();
+</script>
+
+<div data-slot="table-container" class="relative w-full overflow-x-auto">
+	<table bind:this={ref} data-slot="table" class={cn("w-full caption-bottom text-sm", className)} {...restProps}>
+		{@render children?.()}
+	</table>
+</div>

package/dist/templates/fullstack-nest-svelte/apps/web/src/lib/components/ui/tabs/index.ts

@@ -0,0 +1,18 @@
+import Root from "./tabs.svelte";
+import Content from "./tabs-content.svelte";
+import List, { tabsListVariants, type TabsListVariant } from "./tabs-list.svelte";
+import Trigger from "./tabs-trigger.svelte";
+
+export {
+	Root,
+	Content,
+	List,
+	Trigger,
+	tabsListVariants,
+	type TabsListVariant,
+	//
+	Root as Tabs,
+	Content as TabsContent,
+	List as TabsList,
+	Trigger as TabsTrigger,
+};

package/dist/templates/fullstack-nest-svelte/apps/web/src/lib/components/ui/tabs/tabs-content.svelte

@@ -0,0 +1,17 @@
+<script lang="ts">
+	import { Tabs as TabsPrimitive } from "bits-ui";
+	import { cn } from "$lib/utils.js";
+
+	let {
+		ref = $bindable(null),
+		class: className,
+		...restProps
+	}: TabsPrimitive.ContentProps = $props();
+</script>
+
+<TabsPrimitive.Content
+	bind:ref
+	data-slot="tabs-content"
+	class={cn("text-sm flex-1 outline-none", className)}
+	{...restProps}
+/>

package/dist/templates/fullstack-nest-svelte/apps/web/src/lib/components/ui/tabs/tabs-list.svelte

@@ -0,0 +1,40 @@
+<script lang="ts" module>
+	import { tv, type VariantProps } from "tailwind-variants";
+
+	export const tabsListVariants = tv({
+		base: "rounded-lg p-[3px] group-data-horizontal/tabs:h-8 data-[variant=line]:rounded-none group/tabs-list text-muted-foreground inline-flex w-fit items-center justify-center group-data-[orientation=vertical]/tabs:h-fit group-data-[orientation=vertical]/tabs:flex-col",
+		variants: {
+			variant: {
+				default: "cn-tabs-list-variant-default bg-muted",
+				line: "cn-tabs-list-variant-line gap-1 bg-transparent",
+			},
+		},
+		defaultVariants: {
+			variant: "default",
+		},
+	});
+
+	export type TabsListVariant = VariantProps<typeof tabsListVariants>["variant"];
+</script>
+
+<script lang="ts">
+	import { Tabs as TabsPrimitive } from "bits-ui";
+	import { cn } from "$lib/utils.js";
+
+	let {
+		ref = $bindable(null),
+		variant = "default",
+		class: className,
+		...restProps
+	}: TabsPrimitive.ListProps & {
+		variant?: TabsListVariant;
+	} = $props();
+</script>
+
+<TabsPrimitive.List
+	bind:ref
+	data-slot="tabs-list"
+	data-variant={variant}
+	class={cn(tabsListVariants({ variant }), className)}
+	{...restProps}
+/>

package/dist/templates/fullstack-nest-svelte/apps/web/src/lib/components/ui/tabs/tabs-trigger.svelte

@@ -0,0 +1,23 @@
+<script lang="ts">
+	import { Tabs as TabsPrimitive } from "bits-ui";
+	import { cn } from "$lib/utils.js";
+
+	let {
+		ref = $bindable(null),
+		class: className,
+		...restProps
+	}: TabsPrimitive.TriggerProps = $props();
+</script>
+
+<TabsPrimitive.Trigger
+	bind:ref
+	data-slot="tabs-trigger"
+	class={cn(
+		"gap-1.5 rounded-md border border-transparent px-1.5 py-0.5 text-sm font-medium has-data-[icon=inline-end]:pr-1 has-data-[icon=inline-start]:pl-1 group-data-[variant=default]/tabs-list:data-active:shadow-sm group-data-[variant=line]/tabs-list:data-active:shadow-none [&_svg:not([class*='size-'])]:size-4 focus-visible:border-ring focus-visible:ring-ring/50 focus-visible:outline-ring text-foreground/60 hover:text-foreground dark:text-muted-foreground dark:hover:text-foreground relative inline-flex h-[calc(100%-1px)] flex-1 items-center justify-center whitespace-nowrap transition-all group-data-[orientation=vertical]/tabs:w-full group-data-[orientation=vertical]/tabs:justify-start focus-visible:ring-[3px] focus-visible:outline-1 disabled:pointer-events-none disabled:opacity-50 [&_svg]:pointer-events-none [&_svg]:shrink-0",
+		"group-data-[variant=line]/tabs-list:bg-transparent group-data-[variant=line]/tabs-list:data-active:bg-transparent dark:group-data-[variant=line]/tabs-list:data-active:border-transparent dark:group-data-[variant=line]/tabs-list:data-active:bg-transparent",
+		"data-active:bg-background dark:data-active:text-foreground dark:data-active:border-input dark:data-active:bg-input/30 data-active:text-foreground",
+		"after:bg-foreground after:absolute after:opacity-0 after:transition-opacity group-data-[orientation=horizontal]/tabs:after:inset-x-0 group-data-[orientation=horizontal]/tabs:after:bottom-[-5px] group-data-[orientation=horizontal]/tabs:after:h-0.5 group-data-[orientation=vertical]/tabs:after:inset-y-0 group-data-[orientation=vertical]/tabs:after:-right-1 group-data-[orientation=vertical]/tabs:after:w-0.5 group-data-[variant=line]/tabs-list:data-active:after:opacity-100",
+		className
+	)}
+	{...restProps}
+/>

package/dist/templates/fullstack-nest-svelte/apps/web/src/lib/components/ui/tabs/tabs.svelte

@@ -0,0 +1,19 @@
+<script lang="ts">
+	import { Tabs as TabsPrimitive } from "bits-ui";
+	import { cn } from "$lib/utils.js";
+
+	let {
+		ref = $bindable(null),
+		value = $bindable(""),
+		class: className,
+		...restProps
+	}: TabsPrimitive.RootProps = $props();
+</script>
+
+<TabsPrimitive.Root
+	bind:ref
+	bind:value
+	data-slot="tabs"
+	class={cn("gap-2 group/tabs flex data-[orientation=horizontal]:flex-col", className)}
+	{...restProps}
+/>

package/dist/templates/fullstack-nest-svelte/apps/web/src/lib/components/ui/tooltip/index.ts

@@ -0,0 +1,19 @@
+import Root from "./tooltip.svelte";
+import Trigger from "./tooltip-trigger.svelte";
+import Content from "./tooltip-content.svelte";
+import Provider from "./tooltip-provider.svelte";
+import Portal from "./tooltip-portal.svelte";
+
+export {
+	Root,
+	Trigger,
+	Content,
+	Provider,
+	Portal,
+	//
+	Root as Tooltip,
+	Content as TooltipContent,
+	Trigger as TooltipTrigger,
+	Provider as TooltipProvider,
+	Portal as TooltipPortal,
+};

package/dist/templates/fullstack-nest-svelte/apps/web/src/lib/components/ui/tooltip/tooltip-content.svelte

@@ -0,0 +1,52 @@
+<script lang="ts">
+	import { Tooltip as TooltipPrimitive } from "bits-ui";
+	import { cn } from "$lib/utils.js";
+	import TooltipPortal from "./tooltip-portal.svelte";
+	import type { ComponentProps } from "svelte";
+	import type { WithoutChildrenOrChild } from "$lib/utils.js";
+
+	let {
+		ref = $bindable(null),
+		class: className,
+		sideOffset = 0,
+		side = "top",
+		children,
+		arrowClasses,
+		portalProps,
+		...restProps
+	}: TooltipPrimitive.ContentProps & {
+		arrowClasses?: string;
+		portalProps?: WithoutChildrenOrChild<ComponentProps<typeof TooltipPortal>>;
+	} = $props();
+</script>
+
+<TooltipPortal {...portalProps}>
+	<TooltipPrimitive.Content
+		bind:ref
+		data-slot="tooltip-content"
+		{sideOffset}
+		{side}
+		class={cn(
+			"data-open:animate-in data-open:fade-in-0 data-open:zoom-in-95 data-[state=delayed-open]:animate-in data-[state=delayed-open]:fade-in-0 data-[state=delayed-open]:zoom-in-95 data-closed:animate-out data-closed:fade-out-0 data-closed:zoom-out-95 data-[side=bottom]:slide-in-from-top-2 data-[side=left]:slide-in-from-right-2 data-[side=right]:slide-in-from-left-2 data-[side=top]:slide-in-from-bottom-2 inline-flex items-center gap-1.5 rounded-md px-3 py-1.5 text-xs has-data-[slot=kbd]:pr-1.5 **:data-[slot=kbd]:relative **:data-[slot=kbd]:isolate **:data-[slot=kbd]:z-50 **:data-[slot=kbd]:rounded-sm bg-foreground text-background z-50 w-fit max-w-xs origin-(--bits-tooltip-content-transform-origin)",
+			className
+		)}
+		{...restProps}
+	>
+		{@render children?.()}
+		<TooltipPrimitive.Arrow>
+			{#snippet child({ props })}
+				<div
+					class={cn(
+						"size-2.5 translate-y-[calc(-50%-2px)] rotate-45 rounded-[2px] bg-foreground fill-foreground z-50",
+						"data-[side=top]:translate-x-1/2 data-[side=top]:translate-y-[calc(-50%+2px)]",
+						"data-[side=bottom]:-translate-x-1/2 data-[side=bottom]:-translate-y-[calc(-50%+1px)]",
+						"data-[side=right]:translate-x-[calc(50%+2px)] data-[side=right]:translate-y-1/2",
+						"data-[side=left]:-translate-y-[calc(50%-3px)]",
+						arrowClasses
+					)}
+					{...props}
+				></div>
+			{/snippet}
+		</TooltipPrimitive.Arrow>
+	</TooltipPrimitive.Content>
+</TooltipPortal>

package/dist/templates/fullstack-nest-svelte/apps/web/src/lib/components/ui/tooltip/tooltip-portal.svelte

@@ -0,0 +1,7 @@
+<script lang="ts">
+	import { Tooltip as TooltipPrimitive } from "bits-ui";
+
+	let { ...restProps }: TooltipPrimitive.PortalProps = $props();
+</script>
+
+<TooltipPrimitive.Portal {...restProps} />

package/dist/templates/fullstack-nest-svelte/apps/web/src/lib/components/ui/tooltip/tooltip-provider.svelte

@@ -0,0 +1,7 @@
+<script lang="ts">
+	import { Tooltip as TooltipPrimitive } from "bits-ui";
+
+	let { delayDuration = 0, ...restProps }: TooltipPrimitive.ProviderProps = $props();
+</script>
+
+<TooltipPrimitive.Provider {delayDuration} {...restProps} />

package/dist/templates/fullstack-nest-svelte/apps/web/src/lib/components/ui/tooltip/tooltip-trigger.svelte

@@ -0,0 +1,7 @@
+<script lang="ts" generics="T = never">
+	import { Tooltip as TooltipPrimitive } from "bits-ui";
+
+	let { ref = $bindable(null), ...restProps }: TooltipPrimitive.TriggerProps<T> = $props();
+</script>
+
+<TooltipPrimitive.Trigger bind:ref data-slot="tooltip-trigger" {...restProps} />

package/dist/templates/fullstack-nest-svelte/apps/web/src/lib/components/ui/tooltip/tooltip.svelte

@@ -0,0 +1,7 @@
+<script lang="ts" generics="T = never">
+	import { Tooltip as TooltipPrimitive } from "bits-ui";
+
+	let { open = $bindable(false), ...restProps }: TooltipPrimitive.RootProps<T> = $props();
+</script>
+
+<TooltipPrimitive.Root bind:open {...restProps} />

package/dist/templates/fullstack-nest-svelte/apps/web/src/lib/i18n/ko.ts

@@ -1,8 +1,11 @@
-import type { Translation } from "typesafe-i18n";
+import type { BaseTranslation } from "typesafe-i18n";
 
+// Uses BaseTranslation until you generate typed runtimes with `npx typesafe-i18n`.
+// After generating, switch to `import type { Translation } from "../i18n-types"`
+// so this locale is checked against the base locale's keys.
 const ko = {
   appTitle: "{{projectName}}",
   checkHealth: "API 상태 확인",
-} satisfies Translation;
+} satisfies BaseTranslation;
 
 export default ko;

package/dist/templates/fullstack-nest-svelte/apps/web/src/lib/utils.ts

@@ -0,0 +1,11 @@
+import { clsx, type ClassValue } from "clsx";
+import { twMerge } from "tailwind-merge";
+
+export function cn(...inputs: ClassValue[]): string {
+  return twMerge(clsx(inputs));
+}
+
+export type WithoutChild<T> = T extends { child?: unknown } ? Omit<T, "child"> : T;
+export type WithoutChildren<T> = T extends { children?: unknown } ? Omit<T, "children"> : T;
+export type WithoutChildrenOrChild<T> = WithoutChildren<WithoutChild<T>>;
+export type WithElementRef<T, U extends HTMLElement = HTMLElement> = T & { ref?: U | null };

package/dist/templates/fullstack-nest-svelte/apps/web/src/routes/+page.svelte

@@ -1,4 +1,7 @@
 <script lang="ts">
+  import { Button } from "$lib/components/ui/button";
+  import * as Card from "$lib/components/ui/card";
+
   type Health = { status: string } | { error: string };
 
   let health = $state<Health | null>(null);
@@ -10,17 +13,21 @@
 </script>
 
 <main class="mx-auto flex min-h-full max-w-2xl flex-col gap-6 p-8">
-  <h1 class="text-3xl font-bold">{{projectName}}</h1>
-  <p class="text-sm opacity-70">Full-stack starter generated with PodoKit.</p>
-
-  <button
-    class="w-fit rounded-md border border-current/20 px-4 py-2 text-sm font-medium hover:opacity-80"
-    onclick={check}
-  >
-    Check API health
-  </button>
+  <div>
+    <h1 class="text-3xl font-bold">{{projectName}}</h1>
+    <p class="text-muted-foreground text-sm">Full-stack starter generated with PodoKit.</p>
+  </div>
 
-  {#if health}
-    <pre class="rounded-md bg-current/5 p-4 text-sm">{JSON.stringify(health, null, 2)}</pre>
-  {/if}
+  <Card.Root>
+    <Card.Header>
+      <Card.Title>API health</Card.Title>
+      <Card.Description>Check the NestJS API through the SvelteKit server proxy.</Card.Description>
+    </Card.Header>
+    <Card.Content class="flex flex-col gap-4">
+      <Button class="w-fit" onclick={check}>Check API health</Button>
+      {#if health}
+        <pre class="bg-muted rounded-md p-4 text-sm">{JSON.stringify(health, null, 2)}</pre>
+      {/if}
+    </Card.Content>
+  </Card.Root>
 </main>

package/dist/templates/modules/api-key-auth/files/apps/api/src/api-key/api-key.decorator.ts

@@ -0,0 +1,9 @@
+import { applyDecorators, UseGuards } from "@nestjs/common";
+import { Public } from "@thallesp/nestjs-better-auth";
+import { ApiKeyGuard } from "./api-key.guard";
+
+// Opens a route to API-key holders: skips the user-session guard and
+// requires a valid X-API-Key instead. For machine/service clients.
+export function ApiKeyProtected(): ReturnType<typeof applyDecorators> {
+  return applyDecorators(Public(), UseGuards(ApiKeyGuard));
+}

package/dist/templates/modules/api-key-auth/files/apps/api/src/api-key/api-key.guard.ts

@@ -0,0 +1,29 @@
+import { type CanActivate, type ExecutionContext, Injectable, UnauthorizedException } from "@nestjs/common";
+import { timingSafeEqual } from "node:crypto";
+import type { Request } from "express";
+
+// Validates the X-API-Key header against the API_KEYS allowlist.
+@Injectable()
+export class ApiKeyGuard implements CanActivate {
+  private readonly keys = (process.env.API_KEYS ?? "")
+    .split(",")
+    .map((key) => key.trim())
+    .filter(Boolean);
+
+  canActivate(context: ExecutionContext): boolean {
+    const request = context.switchToHttp().getRequest<Request>();
+    const provided = request.header("x-api-key");
+    if (!provided) {
+      throw new UnauthorizedException("Missing X-API-Key");
+    }
+    const supplied = Buffer.from(provided);
+    const valid = this.keys.some((key) => {
+      const expected = Buffer.from(key);
+      return expected.length === supplied.length && timingSafeEqual(expected, supplied);
+    });
+    if (!valid) {
+      throw new UnauthorizedException("Invalid API key");
+    }
+    return true;
+  }
+}

package/dist/templates/modules/api-key-auth/files/apps/api/src/api-key/api-key.module.ts

@@ -0,0 +1,9 @@
+import { Module } from "@nestjs/common";
+import { MachineController } from "../machine/machine.controller";
+import { ApiKeyGuard } from "./api-key.guard";
+
+@Module({
+  controllers: [MachineController],
+  providers: [ApiKeyGuard],
+})
+export class ApiKeyModule {}

package/dist/templates/modules/api-key-auth/files/apps/api/src/machine/machine.controller.ts

@@ -0,0 +1,14 @@
+import { Controller, Get } from "@nestjs/common";
+import { ApiTags } from "@nestjs/swagger";
+import { ApiKeyProtected } from "../api-key/api-key.decorator";
+
+@ApiTags("machine")
+@Controller("machine")
+export class MachineController {
+  // Reachable with a valid X-API-Key, no user session required.
+  @ApiKeyProtected()
+  @Get("ping")
+  ping(): { ok: true; via: "api-key" } {
+    return { ok: true, via: "api-key" };
+  }
+}

package/dist/templates/modules/api-key-auth/module.manifest.json

@@ -0,0 +1,19 @@
+{
+  "name": "api-key-auth",
+  "description": "API-key auth for machine/service clients (X-API-Key), separate from user sessions. Provides an ApiKeyGuard and @ApiKeyProtected() to open a route to key holders. Requires auth.",
+  "requires": ["auth"],
+  "targetApp": "api",
+  "env": [
+    "# api keys for machine clients (comma-separated)",
+    "API_KEYS=dev-key-please-change"
+  ],
+  "inject": [
+    { "file": "apps/api/src/app.module.ts", "marker": "// podokit:imports", "text": "import { ApiKeyModule } from \"./api-key/api-key.module\";" },
+    { "file": "apps/api/src/app.module.ts", "marker": "// podokit:module-imports", "text": "ApiKeyModule," }
+  ],
+  "instructions": [
+    "Set API_KEYS in .env (comma-separated).",
+    "Protect a route for machine clients with @ApiKeyProtected() (bypasses the user session, requires X-API-Key).",
+    "Call it:  curl -H 'x-api-key: dev-key-please-change' localhost:3000/machine/ping"
+  ]
+}

package/dist/templates/modules/audit-log/files/apps/api/src/audit/audit-log.entity.ts

@@ -0,0 +1,25 @@
+import { Column, CreateDateColumn, Entity, PrimaryGeneratedColumn } from "typeorm";
+
+@Entity("audit_logs")
+export class AuditLog {
+  @PrimaryGeneratedColumn("uuid")
+  id!: string;
+
+  @Column({ type: "varchar", nullable: true })
+  userId!: string | null;
+
+  @Column({ type: "varchar", length: 10 })
+  method!: string;
+
+  @Column({ type: "varchar", length: 2048 })
+  path!: string;
+
+  @Column({ type: "int" })
+  statusCode!: number;
+
+  @Column({ type: "varchar", nullable: true })
+  ip!: string | null;
+
+  @CreateDateColumn({ type: "timestamptz" })
+  createdAt!: Date;
+}

package/dist/templates/modules/audit-log/files/apps/api/src/audit/audit.controller.ts

@@ -0,0 +1,16 @@
+import { Controller, Get } from "@nestjs/common";
+import { InjectRepository } from "@nestjs/typeorm";
+import { ApiTags } from "@nestjs/swagger";
+import { Repository } from "typeorm";
+import { AuditLog } from "./audit-log.entity";
+
+@ApiTags("audit")
+@Controller("audit-logs")
+export class AuditController {
+  constructor(@InjectRepository(AuditLog) private readonly logs: Repository<AuditLog>) {}
+
+  @Get()
+  recent(): Promise<AuditLog[]> {
+    return this.logs.find({ order: { createdAt: "DESC" }, take: 50 });
+  }
+}

package/dist/templates/modules/audit-log/files/apps/api/src/audit/audit.interceptor.ts

@@ -0,0 +1,39 @@
+import { type CallHandler, type ExecutionContext, Injectable, type NestInterceptor } from "@nestjs/common";
+import { InjectRepository } from "@nestjs/typeorm";
+import { fromNodeHeaders } from "better-auth/node";
+import type { Request, Response } from "express";
+import { type Observable, tap } from "rxjs";
+import { Repository } from "typeorm";
+import { auth } from "../auth/auth";
+import { AuditLog } from "./audit-log.entity";
+
+const AUDITED_METHODS = new Set(["POST", "PUT", "PATCH", "DELETE"]);
+
+// Records who performed each mutating request. Skips the auth endpoints.
+@Injectable()
+export class AuditInterceptor implements NestInterceptor {
+  constructor(@InjectRepository(AuditLog) private readonly logs: Repository<AuditLog>) {}
+
+  intercept(context: ExecutionContext, next: CallHandler): Observable<unknown> {
+    const req = context.switchToHttp().getRequest<Request>();
+    const path = req.originalUrl ?? req.url;
+    if (!AUDITED_METHODS.has(req.method) || path.startsWith("/api/auth")) {
+      return next.handle();
+    }
+    const res = context.switchToHttp().getResponse<Response>();
+    return next.handle().pipe(tap(() => void this.record(req, res, path)));
+  }
+
+  private async record(req: Request, res: Response, path: string): Promise<void> {
+    let userId: string | null = null;
+    try {
+      const session = await auth.api.getSession({ headers: fromNodeHeaders(req.headers) });
+      userId = session?.user?.id ?? null;
+    } catch {
+      userId = null;
+    }
+    await this.logs.save(
+      this.logs.create({ userId, method: req.method, path, statusCode: res.statusCode, ip: req.ip ?? null }),
+    );
+  }
+}

package/dist/templates/modules/audit-log/files/apps/api/src/audit/audit.module.ts

@@ -0,0 +1,13 @@
+import { Module } from "@nestjs/common";
+import { APP_INTERCEPTOR } from "@nestjs/core";
+import { TypeOrmModule } from "@nestjs/typeorm";
+import { AuditController } from "./audit.controller";
+import { AuditInterceptor } from "./audit.interceptor";
+import { AuditLog } from "./audit-log.entity";
+
+@Module({
+  imports: [TypeOrmModule.forFeature([AuditLog])],
+  controllers: [AuditController],
+  providers: [{ provide: APP_INTERCEPTOR, useClass: AuditInterceptor }],
+})
+export class AuditModule {}

package/dist/templates/modules/audit-log/files/apps/api/src/migrations/1720300000000-InitAuditLogs.ts

@@ -0,0 +1,25 @@
+import type { MigrationInterface, QueryRunner } from "typeorm";
+
+export class InitAuditLogs1720300000000 implements MigrationInterface {
+  name = "InitAuditLogs1720300000000";
+
+  async up(queryRunner: QueryRunner): Promise<void> {
+    await queryRunner.query(`CREATE EXTENSION IF NOT EXISTS "pgcrypto"`);
+    await queryRunner.query(`
+      CREATE TABLE "audit_logs" (
+        "id" uuid NOT NULL DEFAULT gen_random_uuid(),
+        "userId" character varying,
+        "method" character varying(10) NOT NULL,
+        "path" character varying(2048) NOT NULL,
+        "statusCode" integer NOT NULL,
+        "ip" character varying,
+        "createdAt" TIMESTAMP WITH TIME ZONE NOT NULL DEFAULT now(),
+        CONSTRAINT "PK_audit_logs_id" PRIMARY KEY ("id")
+      )
+    `);
+  }
+
+  async down(queryRunner: QueryRunner): Promise<void> {
+    await queryRunner.query(`DROP TABLE "audit_logs"`);
+  }
+}