@podosoft/podokit 0.13.0 → 0.15.0

package/README.md

@@ -101,6 +101,9 @@ podo update --apply  # apply it: clean updates are written, your edits are 3-way
 
 Files you own (routes, your components, shadcn UI) are never touched. See the
 [updating guide](https://github.com/podosoft-dev/podokit/blob/main/docs/updating.md).
+An exact path handed over with `podo eject` remains owned even if a module also
+declares it managed; if you later move or delete that file, update reports the
+missing owned path instead of recreating it.
 
 ## What you get (`fullstack-nest-svelte`)
 

package/dist/add.d.ts

@@ -7,7 +7,31 @@ interface Injection {
 }
 /** Highest `module.manifest.json` schema version this CLI understands. A package
  *  module declaring a higher version is rejected rather than mis-applied. */
-export declare const SUPPORTED_MANIFEST_VERSION = 1;
+export declare const SUPPORTED_MANIFEST_VERSION = 2;
+export interface ModulePathMove {
+    /** Project-relative file or directory path from an older module layout. */
+    from: string;
+    /** Project-relative destination. Existing files are never overwritten. */
+    to: string;
+}
+export interface ModuleTextReplacement {
+    /** Destination path after all migration moves have been applied. */
+    path: string;
+    /** Exact text expected in the existing generated file. */
+    from: string;
+    /** Replacement text written while preserving every other local edit. */
+    to: string;
+    /** Required number of matches. A mismatch aborts the migration atomically. */
+    expected: number;
+}
+export interface ModuleMigration {
+    /** Stable module-local identifier recorded after a successful apply. */
+    id: string;
+    /** File or directory moves performed as one atomic migration. */
+    moves: ModulePathMove[];
+    /** Optional exact rewrites needed after a move, such as renamed imports. */
+    replacements?: ModuleTextReplacement[];
+}
 export interface ModuleManifest {
     /** Manifest schema version. Absent (bundled modules) means "same as the CLI". */
     manifestVersion?: number;
@@ -35,6 +59,8 @@ export interface ModuleManifest {
     /** Module files that remain update-managed even when a broad default glob
      *  (for example `.claude/**`) would otherwise classify them as owned. */
     managedOverrides?: string[];
+    /** Idempotent path migrations applied by `podo update --apply`. */
+    migrations?: ModuleMigration[];
 }
 export interface PackageOverlay {
     dependencies?: Record<string, string>;

package/dist/add.js

@@ -14,7 +14,7 @@ const podokit_template_engine_1 = require("@podosoft/podokit-template-engine");
 const lockfile_1 = require("./lockfile");
 /** Highest `module.manifest.json` schema version this CLI understands. A package
  *  module declaring a higher version is rejected rather than mis-applied. */
-exports.SUPPORTED_MANIFEST_VERSION = 1;
+exports.SUPPORTED_MANIFEST_VERSION = 2;
 /** Return the legacy targetApp package fields plus any additional app overlays. */
 function modulePackageOverlays(manifest) {
     const overlays = new Map();
@@ -281,10 +281,12 @@ function applyModule(projectRoot, module, modulesDir, applied, adopt) {
     };
 }
 function moduleRecord(module) {
+    const migrations = readModuleManifest(module.dir).migrations ?? [];
     return {
         name: module.name,
         packageName: module.packageName,
         moduleVersion: module.moduleVersion,
+        appliedMigrations: migrations.map((migration) => migration.id),
     };
 }
 /** Copy a module overlay without clobbering app-owned presentation files. */

package/dist/index.js

@@ -288,7 +288,8 @@ async function main(argv) {
         try {
             if (args.apply) {
                 const result = (0, update_1.applyUpdate)(process.cwd(), templatesDir, { oldTemplatesDir: args.from });
-                process.stdout.write(`Applied: ${result.written.length} written, ${result.removed.length} removed, ` +
+                process.stdout.write(`Applied: ${result.written.length} written, ${result.moved.length} moved, ` +
+                    `${result.removed.length} removed, ` +
                     `${result.merged.length} merged, ${result.conflicts.length} conflict.\n`);
                 if (result.conflicts.length) {
                     process.stdout.write("\nResolve the following, then commit:\n" +
@@ -306,9 +307,11 @@ async function main(argv) {
             }
             else {
                 for (const c of shown) {
-                    process.stdout.write(`  ${c.action.padEnd(9)} ${c.path}  (${c.note})\n`);
+                    const path = c.fromPath ? `${c.fromPath} -> ${c.path}` : c.path;
+                    process.stdout.write(`  ${c.action.padEnd(9)} ${path}  (${c.note})\n`);
                 }
-                process.stdout.write(`\n${counts.update} update, ${counts.add} add, ${counts.remove} remove, ${counts.conflict} conflict. ` +
+                process.stdout.write(`\n${counts.update} update, ${counts.add} add, ${counts.move} move, ` +
+                    `${counts.remove} remove, ${counts.conflict} conflict. ` +
                     `Dry-run — nothing was written. Re-run with --apply to write (use --from <dir> for a 3-way merge).\n`);
             }
         }

package/dist/lib.d.ts

@@ -3,7 +3,7 @@ export type { CreateOptions, CreateResult } from "./create";
 export { TEMPLATES, DEFAULT_TEMPLATE, TEMPLATE_NAMES, isKnownTemplate } from "./templates";
 export type { TemplateInfo } from "./templates";
 export { listModules, addModule } from "./add";
-export type { ModuleManifest, AddOptions, AddResult } from "./add";
+export type { ModuleManifest, ModuleMigration, ModulePathMove, ModuleTextReplacement, AddOptions, AddResult, } from "./add";
 export { status, diff, doctor, SUPPORTED_FRAMEWORKS } from "./inspect";
 export type { StatusReport, DoctorFinding } from "./inspect";
 export { planUpdate, summarize } from "./update";

package/dist/lockfile.d.ts

@@ -3,7 +3,7 @@
  * `podo update` can rebuild the same inputs and detect user edits. See
  * ADR-0009 (update mechanism) and ADR-0010 (ownership model).
  */
-export declare const LOCK_SCHEMA_VERSION = 1;
+export declare const LOCK_SCHEMA_VERSION = 2;
 /** File ownership tier. See ADR-0010. */
 export type Tier = "managed" | "assembled" | "owned";
 export interface ManifestModule {
@@ -16,11 +16,14 @@ export interface ManifestModule {
     packageName?: string;
     /** Installed external-module version last applied to this project. */
     moduleVersion?: string;
+    /** Module-local update migrations already applied to this project. */
+    appliedMigrations?: string[];
 }
 export interface ManifestModuleInput {
     name: string;
     packageName?: string;
     moduleVersion?: string;
+    appliedMigrations?: string[];
 }
 export interface PodokitManifest {
     schemaVersion: number;

package/dist/lockfile.js

@@ -24,7 +24,7 @@ const podokit_template_engine_1 = require("@podosoft/podokit-template-engine");
  * `podo update` can rebuild the same inputs and detect user edits. See
  * ADR-0009 (update mechanism) and ADR-0010 (ownership model).
  */
-exports.LOCK_SCHEMA_VERSION = 1;
+exports.LOCK_SCHEMA_VERSION = 2;
 const PODOKIT_DIR = ".podokit";
 const MANIFEST_FILE = "manifest.json";
 const FILES_LOCK_FILE = "files.lock";
@@ -66,6 +66,8 @@ exports.DEFAULT_OWNED_GLOBS = [
     ".env.docker",
     "infra/traefik/**",
     ".podokit/dev.json",
+    // Optional application-owned Playwright device/browser projects.
+    "tests/playwright.projects.cjs",
 ];
 const TEXT_EXT = /\.(json|md|ts|tsx|js|mjs|cjs|css|html|yml|yaml|txt|env|svelte|gitignore|example)$/i;
 function podokitDir(projectRoot) {
@@ -83,11 +85,11 @@ function readManifest(projectRoot) {
 }
 function writeManifest(projectRoot, manifest) {
     (0, node_fs_1.mkdirSync)(podokitDir(projectRoot), { recursive: true });
-    (0, node_fs_1.writeFileSync)(manifestPath(projectRoot), `${JSON.stringify(manifest, null, 2)}\n`);
+    (0, node_fs_1.writeFileSync)(manifestPath(projectRoot), `${JSON.stringify({ ...manifest, schemaVersion: exports.LOCK_SCHEMA_VERSION }, null, 2)}\n`);
 }
 function writeFilesLock(projectRoot, lock) {
     (0, node_fs_1.mkdirSync)(podokitDir(projectRoot), { recursive: true });
-    (0, node_fs_1.writeFileSync)(filesLockPath(projectRoot), `${JSON.stringify(lock, null, 2)}\n`);
+    (0, node_fs_1.writeFileSync)(filesLockPath(projectRoot), `${JSON.stringify({ ...lock, schemaVersion: exports.LOCK_SCHEMA_VERSION }, null, 2)}\n`);
 }
 /** Read the PodoKit CLI's own version to stamp into the manifest. */
 function podokitVersion() {
@@ -242,6 +244,7 @@ function recordModules(projectRoot, moduleInputs, version, ownedGlobs, lockSnaps
             addedWith: stampedWith,
             packageName: module.packageName,
             moduleVersion: module.moduleVersion,
+            appliedMigrations: module.appliedMigrations,
         });
         known.add(module.name);
     }

package/dist/module-migrations.d.ts

@@ -0,0 +1,25 @@
+import type { VfsTree } from "@podosoft/podokit-template-engine";
+import { type ModuleMigration } from "./add";
+import type { FilesLock, ManifestModule, Tier } from "./lockfile";
+export interface PendingModuleMigration {
+    module: string;
+    migration: ModuleMigration;
+}
+export interface PlannedPathMove {
+    from: string;
+    to: string;
+    tier: Tier;
+    content: Buffer;
+}
+export interface ModuleMigrationPlan {
+    pending: PendingModuleMigration[];
+    moves: PlannedPathMove[];
+    conflicts: string[];
+}
+export declare function collectPendingMigrations(projectRoot: string, templatesDir: string, modules: ManifestModule[]): PendingModuleMigration[];
+export declare function planModuleMigrations(projectRoot: string, targetTree: VfsTree, lock: FilesLock, pending: PendingModuleMigration[]): ModuleMigrationPlan;
+export declare function applyModuleMigrations(projectRoot: string, plan: ModuleMigrationPlan): {
+    from: string;
+    to: string;
+}[];
+export declare function migrateConfiguredPath(path: string, pending: PendingModuleMigration[]): string;

package/dist/module-migrations.js

@@ -0,0 +1,233 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.collectPendingMigrations = collectPendingMigrations;
+exports.planModuleMigrations = planModuleMigrations;
+exports.applyModuleMigrations = applyModuleMigrations;
+exports.migrateConfiguredPath = migrateConfiguredPath;
+const node_fs_1 = require("node:fs");
+const node_crypto_1 = require("node:crypto");
+const node_path_1 = require("node:path");
+const add_1 = require("./add");
+function treeBuffer(tree, path) {
+    const file = tree.get(path);
+    if (!file)
+        return null;
+    return Buffer.isBuffer(file.content) ? file.content : Buffer.from(file.content);
+}
+function assertProjectPath(path, label) {
+    if (!path ||
+        path.startsWith("/") ||
+        path.endsWith("/") ||
+        node_path_1.posix.normalize(path) !== path ||
+        path.split("/").includes("..")) {
+        throw new Error(`${label} must be a normalized project-relative path: ${path}`);
+    }
+}
+function filesUnder(projectRoot, path) {
+    const absolute = (0, node_path_1.join)(projectRoot, path);
+    if (!(0, node_fs_1.existsSync)(absolute))
+        return [];
+    if (!(0, node_fs_1.statSync)(absolute).isDirectory())
+        return [path];
+    const files = [];
+    const visit = (relative) => {
+        for (const entry of (0, node_fs_1.readdirSync)((0, node_path_1.join)(projectRoot, relative), { withFileTypes: true })) {
+            const child = `${relative}/${entry.name}`;
+            if (entry.isDirectory())
+                visit(child);
+            else
+                files.push(child);
+        }
+    };
+    visit(path);
+    return files.sort();
+}
+function destinationFor(path, from, to) {
+    return path === from ? to : `${to}${path.slice(from.length)}`;
+}
+function occurrences(content, needle) {
+    if (!needle)
+        return 0;
+    let count = 0;
+    let offset = 0;
+    while (true) {
+        const index = content.indexOf(needle, offset);
+        if (index === -1)
+            return count;
+        count += 1;
+        offset = index + needle.length;
+    }
+}
+function transformedContent(path, content, pending, conflicts) {
+    let text = null;
+    for (const { module, migration } of pending) {
+        for (const replacement of migration.replacements ?? []) {
+            if (replacement.path !== path)
+                continue;
+            text ??= content.toString("utf8");
+            const currentCount = occurrences(text, replacement.from);
+            if (currentCount === replacement.expected) {
+                text = text.split(replacement.from).join(replacement.to);
+                continue;
+            }
+            const replacementCount = occurrences(text, replacement.to);
+            if (currentCount === 0 && replacementCount === replacement.expected)
+                continue;
+            conflicts.push(`${module}:${migration.id} expected ${replacement.expected} occurrence(s) in ` +
+                `${replacement.path}, found ${currentCount}`);
+        }
+    }
+    return text === null ? content : Buffer.from(text);
+}
+function matchesPathOrChild(path, prefix) {
+    return path === prefix || path.startsWith(`${prefix}/`);
+}
+function collectPendingMigrations(projectRoot, templatesDir, modules) {
+    const modulesDir = (0, node_path_1.join)(templatesDir, "modules");
+    const pending = [];
+    for (const module of modules) {
+        const resolved = (0, add_1.resolveModule)(module.packageName ?? module.name, modulesDir, projectRoot);
+        if (!resolved)
+            continue;
+        const manifest = (0, add_1.readModuleManifest)(resolved.dir);
+        const applied = new Set(module.appliedMigrations ?? []);
+        for (const migration of manifest.migrations ?? []) {
+            if (applied.has(migration.id))
+                continue;
+            if (!migration.id || migration.moves.length === 0) {
+                throw new Error(`Module "${module.name}" declares an invalid migration.`);
+            }
+            for (const move of migration.moves) {
+                assertProjectPath(move.from, `${module.name}:${migration.id} move.from`);
+                assertProjectPath(move.to, `${module.name}:${migration.id} move.to`);
+                if (move.from === move.to) {
+                    throw new Error(`${module.name}:${migration.id} cannot move a path onto itself.`);
+                }
+            }
+            for (const replacement of migration.replacements ?? []) {
+                assertProjectPath(replacement.path, `${module.name}:${migration.id} replacement.path`);
+                if (!replacement.from || replacement.expected < 1) {
+                    throw new Error(`${module.name}:${migration.id} declares an invalid text replacement.`);
+                }
+            }
+            pending.push({ module: module.name, migration });
+        }
+    }
+    return pending;
+}
+function planModuleMigrations(projectRoot, targetTree, lock, pending) {
+    const conflicts = [];
+    const moveSources = new Set();
+    const moveTargets = new Set();
+    const candidates = [];
+    for (const { module, migration } of pending) {
+        for (const move of migration.moves) {
+            const staleTargetPaths = [...targetTree.keys()].filter((path) => matchesPathOrChild(path, move.from));
+            if (staleTargetPaths.length) {
+                conflicts.push(`${module}:${migration.id} target modules still provide legacy path ${move.from}; ` +
+                    `upgrade external modules before updating`);
+                continue;
+            }
+            for (const source of filesUnder(projectRoot, move.from)) {
+                const target = destinationFor(source, move.from, move.to);
+                if (moveSources.has(source)) {
+                    conflicts.push(`${module}:${migration.id} moves ${source} more than once`);
+                    continue;
+                }
+                if (moveTargets.has(target)) {
+                    conflicts.push(`${module}:${migration.id} has duplicate destination ${target}`);
+                    continue;
+                }
+                moveSources.add(source);
+                moveTargets.add(target);
+                candidates.push({
+                    from: source,
+                    to: target,
+                    tier: lock.files[source]?.tier ?? "owned",
+                });
+            }
+        }
+    }
+    for (const candidate of candidates) {
+        if ((0, node_fs_1.existsSync)((0, node_path_1.join)(projectRoot, candidate.to)) && !moveSources.has(candidate.to)) {
+            conflicts.push(`cannot move ${candidate.from}: destination already exists at ${candidate.to}`);
+        }
+    }
+    const moves = candidates.map((candidate) => {
+        const sourceContent = (0, node_fs_1.readFileSync)((0, node_path_1.join)(projectRoot, candidate.from));
+        const locked = lock.files[candidate.from];
+        const targetContent = treeBuffer(targetTree, candidate.to);
+        const content = locked && locked.outHash === hashBuffer(sourceContent) && targetContent
+            ? targetContent
+            : transformedContent(candidate.to, sourceContent, pending, conflicts);
+        return { ...candidate, content };
+    });
+    for (const { module, migration } of pending) {
+        for (const replacement of migration.replacements ?? []) {
+            if (moves.some((move) => move.to === replacement.path))
+                continue;
+            const target = (0, node_path_1.join)(projectRoot, replacement.path);
+            if (!(0, node_fs_1.existsSync)(target))
+                continue;
+            transformedContent(replacement.path, (0, node_fs_1.readFileSync)(target), [{ module, migration }], conflicts);
+        }
+    }
+    return { pending, moves, conflicts: [...new Set(conflicts)] };
+}
+function hashBuffer(content) {
+    return `sha256:${(0, node_crypto_1.createHash)("sha256").update(content).digest("hex")}`;
+}
+function pruneEmptyDirectories(projectRoot, relative) {
+    let current = relative;
+    while (current && current !== "." && current !== "/") {
+        try {
+            (0, node_fs_1.rmdirSync)((0, node_path_1.join)(projectRoot, current));
+        }
+        catch {
+            return;
+        }
+        current = (0, node_path_1.dirname)(current);
+    }
+}
+function applyModuleMigrations(projectRoot, plan) {
+    if (plan.conflicts.length)
+        return [];
+    const moved = [];
+    const replacementByPath = new Map();
+    for (const move of plan.moves)
+        replacementByPath.set(move.to, move.content);
+    for (const { module, migration } of plan.pending) {
+        for (const replacement of migration.replacements ?? []) {
+            if (replacementByPath.has(replacement.path))
+                continue;
+            const target = (0, node_path_1.join)(projectRoot, replacement.path);
+            if (!(0, node_fs_1.existsSync)(target))
+                continue;
+            replacementByPath.set(replacement.path, transformedContent(replacement.path, (0, node_fs_1.readFileSync)(target), [{ module, migration }], []));
+        }
+    }
+    for (const move of plan.moves) {
+        (0, node_fs_1.mkdirSync)((0, node_path_1.dirname)((0, node_path_1.join)(projectRoot, move.to)), { recursive: true });
+        (0, node_fs_1.writeFileSync)((0, node_path_1.join)(projectRoot, move.to), replacementByPath.get(move.to) ?? move.content);
+        (0, node_fs_1.rmSync)((0, node_path_1.join)(projectRoot, move.from));
+        pruneEmptyDirectories(projectRoot, (0, node_path_1.dirname)(move.from));
+        moved.push({ from: move.from, to: move.to });
+    }
+    for (const [path, content] of replacementByPath) {
+        if (plan.moves.some((move) => move.to === path))
+            continue;
+        (0, node_fs_1.writeFileSync)((0, node_path_1.join)(projectRoot, path), content);
+    }
+    return moved;
+}
+function migrateConfiguredPath(path, pending) {
+    let migrated = path;
+    for (const { migration } of pending) {
+        for (const move of migration.moves) {
+            if (matchesPathOrChild(migrated, move.from)) {
+                migrated = destinationFor(migrated, move.from, move.to);
+            }
+        }
+    }
+    return migrated;
+}

package/dist/templates/fullstack-nest-svelte/Dockerfile.dev

@@ -17,7 +17,9 @@ WORKDIR /app
 COPY package.json ./
 COPY apps/api/package.json ./apps/api/package.json
 COPY apps/web/package.json ./apps/web/package.json
-RUN npm install
+ARG PODOKIT_NPM_REGISTRY=""
+RUN if [ -n "$PODOKIT_NPM_REGISTRY" ]; then npm config set registry "$PODOKIT_NPM_REGISTRY"; fi \
+  && npm install
 
 # Baked source (kept in sync during development by `docker compose watch`).
 COPY . .

package/dist/templates/fullstack-nest-svelte/apps/api/package.json

@@ -14,7 +14,7 @@
     "migration:generate": "npm run typeorm -- migration:generate"
   },
   "dependencies": {
-    "@podosoft/podokit-contracts": "^0.3.0",
+    "@podosoft/podokit-contracts": "^0.4.0",
     "@nestjs/common": "^11.1.27",
     "@nestjs/config": "^4.0.4",
     "@nestjs/core": "^11.1.27",

package/dist/templates/fullstack-nest-svelte/apps/web/Dockerfile

@@ -16,6 +16,9 @@ RUN npm run build --workspace=apps/web
 FROM node:22-alpine AS runtime
 WORKDIR /app
 ENV NODE_ENV=production
+# Keep the adapter-node proxy above the 2 MiB application upload policy so the
+# API can return stable validation codes after accounting for multipart framing.
+ENV BODY_SIZE_LIMIT=3M
 RUN addgroup -S app && adduser -S app -G app
 COPY --from=build /app/node_modules ./node_modules
 COPY --from=deps /app/apps/web ./apps/web

package/dist/templates/fullstack-nest-svelte/apps/web/package.json

@@ -13,7 +13,7 @@
   "dependencies": {
     "@internationalized/date": "^3.12.2",
     "@lucide/svelte": "^1.23.0",
-    "@podosoft/podokit-api-client": "^0.7.0",
+    "@podosoft/podokit-api-client": "^0.8.0",
     "bits-ui": "^2.18.1",
     "clsx": "^2.1.1",
     "mode-watcher": "^1.1.0",

package/dist/templates/fullstack-nest-svelte/apps/web/src/app.html

@@ -2,6 +2,8 @@
 <html lang="en" class="h-full">
   <head>
     <meta charset="utf-8" />
+    <!-- Add viewport-fit=cover only when the application-owned layout also
+         handles env(safe-area-inset-*) padding for edge-to-edge content. -->
     <meta name="viewport" content="width=device-width, initial-scale=1" />
     <title>{{projectName}}</title>
     <link rel="icon" href="/favicon.svg" type="image/svg+xml" />

package/dist/templates/fullstack-nest-svelte/apps/web/src/lib/components/ui/input/input.svelte

@@ -16,6 +16,7 @@
 		files = $bindable(),
 		class: className,
 		"data-slot": dataSlot = "input",
+		onchange,
 		...restProps
 	}: Props = $props();
 </script>
@@ -30,7 +31,7 @@
 		)}
 		type="file"
 		bind:files
-		bind:value
+		{onchange}
 		{...restProps}
 	/>
 {:else}
@@ -43,6 +44,7 @@
 		)}
 		{type}
 		bind:value
+		{onchange}
 		{...restProps}
 	/>
 {/if}

package/dist/templates/fullstack-nest-svelte/apps/web/src/routes/+page.svelte

@@ -3,6 +3,8 @@
   import * as Card from "$lib/components/ui/card";
   import { api } from "$lib/api";
   import { ApiError } from "@podosoft/podokit-api-client";
+  // podokit:begin:landing-imports
+  // podokit:end:landing-imports
 
   type Health = { status: string } | { error: string };
 
@@ -17,6 +19,9 @@
   }
 </script>
 
+<!-- podokit:begin:landing-actions -->
+<!-- podokit:end:landing-actions -->
+
 <main class="mx-auto flex min-h-full max-w-2xl flex-col gap-6 p-8">
   <div>
     <h1 class="text-3xl font-bold">{{projectName}}</h1>

package/dist/templates/fullstack-nest-svelte/compose.dev.yaml

@@ -41,6 +41,8 @@ services:
     build:
       context: .
       dockerfile: Dockerfile.dev
+      args:
+        PODOKIT_NPM_REGISTRY: ${PODOKIT_NPM_REGISTRY:-}
     command: npm run dev -w {{projectName}}-web -- --host 0.0.0.0
     working_dir: /app
     env_file: .env.docker
@@ -64,6 +66,8 @@ services:
     build:
       context: .
       dockerfile: Dockerfile.dev
+      args:
+        PODOKIT_NPM_REGISTRY: ${PODOKIT_NPM_REGISTRY:-}
     init: true
     command: npm run dev -w {{projectName}}-api
     working_dir: /app
@@ -87,6 +91,8 @@ services:
     build:
       context: .
       dockerfile: Dockerfile.dev
+      args:
+        PODOKIT_NPM_REGISTRY: ${PODOKIT_NPM_REGISTRY:-}
     init: true
     command: npm run dev:worker -w {{projectName}}-api
     working_dir: /app

package/dist/templates/fullstack-nest-svelte/dot-env.example

@@ -13,6 +13,8 @@ POSTGRES_DB=podokit
 # Web -> API boundary (server-side only; not exposed to the browser)
 BACKEND_INTERNAL_URL=http://localhost:5002
 CORS_ORIGIN=http://localhost:5001
+# adapter-node request limit; leave room for a 2 MiB multipart upload
+BODY_SIZE_LIMIT=3M
 
 # ── Optional / development ───────────────────────────────────────────
 # Redis — only needed by cache/queue modules (redis, bullmq, rate-limit,

package/dist/templates/fullstack-nest-svelte/infra/k3s/configmap.yaml

@@ -8,5 +8,6 @@ data:
   PORT: "3000"
   CORS_ORIGIN: "https://example.com"
   BACKEND_INTERNAL_URL: "http://api:3000"
+  BODY_SIZE_LIMIT: "3M"
   ADDRESS_HEADER: "x-forwarded-for"
   XFF_DEPTH: "1"

package/dist/templates/fullstack-nest-svelte/tests/playwright.config.ts

@@ -1,10 +1,15 @@
 import { defineConfig, devices } from "@playwright/test";
+import { loadPlaywrightProjects } from "./playwright.extensions";
 
 // The suite runs against a live stack: web on E2E_BASE_URL (proxying /api/* to
 // the API). Start it first (see docs/testing.md) — locally via the dev harness,
 // in CI via scripts/e2e-ci.mjs. Two projects: `api` (request-only, backend e2e)
 // and `ui` (chromium, pages). Files are routed by suffix (*.api/*.ui.spec.ts).
 const baseURL = process.env.E2E_BASE_URL ?? "http://localhost:5001";
+const coreProjects = [
+  { name: "api", testMatch: /.*\.api\.spec\.ts/ },
+  { name: "ui", testMatch: /.*\.ui\.spec\.ts/, use: { ...devices["Desktop Chrome"] } },
+];
 
 export default defineConfig({
   testDir: ".",
@@ -18,8 +23,5 @@ export default defineConfig({
     trace: "on-first-retry",
     screenshot: "only-on-failure",
   },
-  projects: [
-    { name: "api", testMatch: /.*\.api\.spec\.ts/ },
-    { name: "ui", testMatch: /.*\.ui\.spec\.ts/, use: { ...devices["Desktop Chrome"] } },
-  ],
+  projects: [...coreProjects, ...loadPlaywrightProjects(coreProjects)],
 });

package/dist/templates/fullstack-nest-svelte/tests/playwright.extensions.ts

@@ -0,0 +1,44 @@
+import { existsSync } from "node:fs";
+import { createRequire } from "node:module";
+import { join } from "node:path";
+import type { TestConfig } from "@playwright/test";
+
+type Projects = NonNullable<TestConfig["projects"]>;
+
+const requireFromTests = createRequire(__filename);
+
+function projectName(project: unknown): string | null {
+  if (typeof project !== "object" || project === null || !("name" in project)) return null;
+  return typeof project.name === "string" && project.name.length > 0 ? project.name : null;
+}
+
+/**
+ * Merge application-owned Playwright projects into PodoKit's managed config.
+ * The optional CommonJS file stays owned so applications can add devices and
+ * browsers without creating a 3-way merge hotspot in playwright.config.ts.
+ */
+export function loadPlaywrightProjects(coreProjects: Projects): Projects {
+  const extensionPath = join(__dirname, "playwright.projects.cjs");
+  if (!existsSync(extensionPath)) return [];
+
+  const loaded = requireFromTests(extensionPath) as unknown;
+  if (!Array.isArray(loaded)) {
+    throw new Error("tests/playwright.projects.cjs must export an array of Playwright projects.");
+  }
+
+  const names = new Set(
+    coreProjects.map((project) => projectName(project)).filter((name): name is string => name !== null),
+  );
+  for (const project of loaded) {
+    const name = projectName(project);
+    if (!name) {
+      throw new Error("Every project in tests/playwright.projects.cjs must have a non-empty name.");
+    }
+    if (names.has(name)) {
+      throw new Error(`Duplicate Playwright project name: ${name}`);
+    }
+    names.add(name);
+  }
+
+  return loaded as Projects;
+}