@podosoft/podokit 0.14.0 → 0.15.0

package/README.md

@@ -101,6 +101,9 @@ podo update --apply  # apply it: clean updates are written, your edits are 3-way
 
 Files you own (routes, your components, shadcn UI) are never touched. See the
 [updating guide](https://github.com/podosoft-dev/podokit/blob/main/docs/updating.md).
+An exact path handed over with `podo eject` remains owned even if a module also
+declares it managed; if you later move or delete that file, update reports the
+missing owned path instead of recreating it.
 
 ## What you get (`fullstack-nest-svelte`)
 

package/dist/lockfile.js

@@ -66,6 +66,8 @@ exports.DEFAULT_OWNED_GLOBS = [
     ".env.docker",
     "infra/traefik/**",
     ".podokit/dev.json",
+    // Optional application-owned Playwright device/browser projects.
+    "tests/playwright.projects.cjs",
 ];
 const TEXT_EXT = /\.(json|md|ts|tsx|js|mjs|cjs|css|html|yml|yaml|txt|env|svelte|gitignore|example)$/i;
 function podokitDir(projectRoot) {

package/dist/templates/fullstack-nest-svelte/apps/web/src/app.html

@@ -2,6 +2,8 @@
 <html lang="en" class="h-full">
   <head>
     <meta charset="utf-8" />
+    <!-- Add viewport-fit=cover only when the application-owned layout also
+         handles env(safe-area-inset-*) padding for edge-to-edge content. -->
     <meta name="viewport" content="width=device-width, initial-scale=1" />
     <title>{{projectName}}</title>
     <link rel="icon" href="/favicon.svg" type="image/svg+xml" />

package/dist/templates/fullstack-nest-svelte/tests/playwright.config.ts

@@ -1,10 +1,15 @@
 import { defineConfig, devices } from "@playwright/test";
+import { loadPlaywrightProjects } from "./playwright.extensions";
 
 // The suite runs against a live stack: web on E2E_BASE_URL (proxying /api/* to
 // the API). Start it first (see docs/testing.md) — locally via the dev harness,
 // in CI via scripts/e2e-ci.mjs. Two projects: `api` (request-only, backend e2e)
 // and `ui` (chromium, pages). Files are routed by suffix (*.api/*.ui.spec.ts).
 const baseURL = process.env.E2E_BASE_URL ?? "http://localhost:5001";
+const coreProjects = [
+  { name: "api", testMatch: /.*\.api\.spec\.ts/ },
+  { name: "ui", testMatch: /.*\.ui\.spec\.ts/, use: { ...devices["Desktop Chrome"] } },
+];
 
 export default defineConfig({
   testDir: ".",
@@ -18,8 +23,5 @@ export default defineConfig({
     trace: "on-first-retry",
     screenshot: "only-on-failure",
   },
-  projects: [
-    { name: "api", testMatch: /.*\.api\.spec\.ts/ },
-    { name: "ui", testMatch: /.*\.ui\.spec\.ts/, use: { ...devices["Desktop Chrome"] } },
-  ],
+  projects: [...coreProjects, ...loadPlaywrightProjects(coreProjects)],
 });

package/dist/templates/fullstack-nest-svelte/tests/playwright.extensions.ts

@@ -0,0 +1,44 @@
+import { existsSync } from "node:fs";
+import { createRequire } from "node:module";
+import { join } from "node:path";
+import type { TestConfig } from "@playwright/test";
+
+type Projects = NonNullable<TestConfig["projects"]>;
+
+const requireFromTests = createRequire(__filename);
+
+function projectName(project: unknown): string | null {
+  if (typeof project !== "object" || project === null || !("name" in project)) return null;
+  return typeof project.name === "string" && project.name.length > 0 ? project.name : null;
+}
+
+/**
+ * Merge application-owned Playwright projects into PodoKit's managed config.
+ * The optional CommonJS file stays owned so applications can add devices and
+ * browsers without creating a 3-way merge hotspot in playwright.config.ts.
+ */
+export function loadPlaywrightProjects(coreProjects: Projects): Projects {
+  const extensionPath = join(__dirname, "playwright.projects.cjs");
+  if (!existsSync(extensionPath)) return [];
+
+  const loaded = requireFromTests(extensionPath) as unknown;
+  if (!Array.isArray(loaded)) {
+    throw new Error("tests/playwright.projects.cjs must export an array of Playwright projects.");
+  }
+
+  const names = new Set(
+    coreProjects.map((project) => projectName(project)).filter((name): name is string => name !== null),
+  );
+  for (const project of loaded) {
+    const name = projectName(project);
+    if (!name) {
+      throw new Error("Every project in tests/playwright.projects.cjs must have a non-empty name.");
+    }
+    if (names.has(name)) {
+      throw new Error(`Duplicate Playwright project name: ${name}`);
+    }
+    names.add(name);
+  }
+
+  return loaded as Projects;
+}

package/dist/templates/modules/admin-dashboard/files/apps/web/src/lib/components/account-menu.svelte

@@ -7,12 +7,30 @@
   import LayoutDashboardIcon from "@lucide/svelte/icons/layout-dashboard";
   import LogOutIcon from "@lucide/svelte/icons/log-out";
   import UserIcon from "@lucide/svelte/icons/user";
+  import ChevronsUpDownIcon from "@lucide/svelte/icons/chevrons-up-down";
   import { api } from "$lib/api";
   import { getI18n } from "$lib/i18n";
+  import { cn } from "$lib/utils";
   import type { SessionUser } from "../../app.d.ts";
   import UserAvatar from "./user-avatar.svelte";
 
-  let { user }: { user: SessionUser | null } = $props();
+  type MenuSide = "top" | "right" | "bottom" | "left";
+  type MenuAlign = "start" | "center" | "end";
+  type Props = {
+    user: SessionUser | null;
+    variant?: "avatar" | "identity";
+    side?: MenuSide;
+    align?: MenuAlign;
+    class?: string;
+  };
+
+  let {
+    user,
+    variant = "avatar",
+    side = "bottom",
+    align = "end",
+    class: className,
+  }: Props = $props();
   const i18n = getI18n();
   const loginHref = $derived(withAuthRedirect("/login", currentPath(page.url)));
 
@@ -27,12 +45,25 @@
   <DropdownMenu.Root>
     <DropdownMenu.Trigger
       data-testid="account-menu"
-      class="hover:bg-muted focus-visible:border-ring focus-visible:ring-ring/50 inline-flex size-8 items-center justify-center rounded-full outline-none focus-visible:ring-3"
+      class={cn(
+        "hover:bg-muted focus-visible:border-ring focus-visible:ring-ring/50 outline-none focus-visible:ring-3",
+        variant === "avatar"
+          ? "inline-flex size-8 items-center justify-center rounded-full"
+          : "flex w-full items-center gap-2 rounded-md p-2 text-left",
+        className,
+      )}
       aria-label={i18n.t.nav.account}
     >
       <UserAvatar {user} class="size-8" />
+      {#if variant === "identity"}
+        <div class="min-w-0 flex-1 text-sm leading-tight">
+          <span class="block truncate font-medium">{user.name}</span>
+          <span class="text-muted-foreground block truncate text-xs">{user.email}</span>
+        </div>
+        <ChevronsUpDownIcon class="size-4 shrink-0" />
+      {/if}
     </DropdownMenu.Trigger>
-    <DropdownMenu.Content align="end" class="w-56">
+    <DropdownMenu.Content {align} {side} class="w-56">
       <DropdownMenu.Label>
         <span class="block truncate font-medium">{user.name}</span>
         <span class="text-muted-foreground block truncate text-xs font-normal">{user.email}</span>
@@ -47,5 +78,5 @@
     </DropdownMenu.Content>
   </DropdownMenu.Root>
 {:else}
-  <Button data-testid="sign-in-link" href={loginHref} variant="ghost">{i18n.t.auth.signIn}</Button>
+  <Button data-testid="sign-in-link" href={loginHref} variant="ghost" class={className}>{i18n.t.auth.signIn}</Button>
 {/if}

package/dist/templates/modules/admin-dashboard/files/apps/web/src/lib/components/data-table.svelte

@@ -1,14 +1,34 @@
 <script lang="ts" module>
+  import { cn } from "$lib/utils";
+
+  export type DataTableBreakpoint = "sm" | "md" | "lg" | "xl";
   export type DataTableColumn<Row> = {
     key: string;
     label: string;
     sortable?: boolean;
     class?: string;
+    hideBelow?: DataTableBreakpoint;
     // Value used for client-side sorting (defaults to row[key]). Use for nested
     // or derived fields, e.g. (s) => s.user.email.
     value?: (row: Row) => string | number | boolean | Date | null | undefined;
   };
   export type SortState = { key: string; dir: "asc" | "desc" };
+  export type DataTableRowContext = {
+    cellClass: (columnKey: string) => string | undefined;
+  };
+
+  const HIDE_BELOW_CLASS: Record<DataTableBreakpoint, string> = {
+    sm: "max-sm:hidden",
+    md: "max-md:hidden",
+    lg: "max-lg:hidden",
+    xl: "max-xl:hidden",
+  };
+
+  export function getDataTableColumnClass<Row>(
+    column: DataTableColumn<Row>,
+  ): string | undefined {
+    return cn(column.class, column.hideBelow ? HIDE_BELOW_CLASS[column.hideBelow] : undefined);
+  }
 
   // Shared page size for all admin tables — sized so a desktop viewport shows a
   // full list at a glance (rather than the old 5-row pages). Change it here to
@@ -33,9 +53,10 @@
   type Props = {
     columns: DataTableColumn<Row>[];
     rows: Row[];
-    row: Snippet<[Row]>; // renders the <Table.Cell>s for one row
+    row: Snippet<[Row, DataTableRowContext]>; // renders the <Table.Cell>s for one row
     getKey?: (row: Row, index: number) => string | number;
     empty?: string;
+    ariaLabel?: string;
     sort?: SortState | null;
     manualSort?: boolean;
     page?: number;
@@ -51,6 +72,7 @@
     row,
     getKey = (_r, i) => i,
     empty = "No data.",
+    ariaLabel,
     sort = $bindable(null),
     manualSort = false,
     page = $bindable(1),
@@ -71,6 +93,13 @@
     onChange?.({ sort, page });
   }
 
+  function cellClass(columnKey: string): string | undefined {
+    const column = columns.find((candidate) => candidate.key === columnKey);
+    return column ? getDataTableColumnClass(column) : undefined;
+  }
+
+  const rowContext: DataTableRowContext = { cellClass };
+
   function cmp(a: unknown, b: unknown): number {
     if (a == null && b == null) return 0;
     if (a == null) return -1;
@@ -95,12 +124,12 @@
 </script>
 
 <div class="rounded-md border">
-  <Table.Root>
+  <Table.Root aria-label={ariaLabel}>
     <Table.Header>
       <Table.Row>
         {#each columns as col (col.key)}
           <Table.Head
-            class={col.class}
+            class={getDataTableColumnClass(col)}
             aria-sort={sort?.key === col.key ? (sort.dir === "asc" ? "ascending" : "descending") : undefined}
           >
             {#if col.sortable}
@@ -121,7 +150,7 @@
     </Table.Header>
     <Table.Body>
       {#each view as r, i (getKey(r, i))}
-        <Table.Row>{@render row(r)}</Table.Row>
+        <Table.Row>{@render row(r, rowContext)}</Table.Row>
       {:else}
         <Table.Row>
           <Table.Cell colspan={columns.length} class="text-muted-foreground py-8 text-center">{empty}</Table.Cell>

package/dist/templates/modules/admin-dashboard/files/apps/web/src/routes/(admin)/admin/users/+page.svelte

@@ -16,6 +16,7 @@
   import { toast } from "svelte-sonner";
   import { api } from "$lib/api";
   import { getI18n, fmt, formatDateTime } from "$lib/i18n";
+  import { cn } from "$lib/utils";
   import type { PageData } from "./$types";
 
   let { data }: { data: PageData } = $props();
@@ -58,9 +59,15 @@
   const columns = $derived<DataTableColumn<Row>[]>([
     { key: "name", label: i18n.t.users.name, sortable: true },
     { key: "email", label: i18n.t.users.email, sortable: true },
-    { key: "role", label: i18n.t.users.role, sortable: true },
-    { key: "status", label: i18n.t.users.status },
-    { key: "createdAt", label: i18n.t.users.joined, sortable: true, value: (u) => (u.createdAt ? new Date(u.createdAt).getTime() : 0) },
+    { key: "role", label: i18n.t.users.role, sortable: true, hideBelow: "md" },
+    { key: "status", label: i18n.t.users.status, hideBelow: "lg" },
+    {
+      key: "createdAt",
+      label: i18n.t.users.joined,
+      sortable: true,
+      hideBelow: "lg",
+      value: (u) => (u.createdAt ? new Date(u.createdAt).getTime() : 0),
+    },
     { key: "actions", label: "", class: "w-10" },
   ]);
   const filters = $derived<ToolbarFilter[]>([
@@ -380,13 +387,14 @@
     bind:sort
     bind:page
     perPage={PAGE_SIZE}
+    ariaLabel={i18n.t.users.title}
     label={fmt(i18n.t.users.total, { count: filtered.length })}
   >
-    {#snippet row(user)}
-      <Table.Cell class="font-medium">{user.name}</Table.Cell>
-      <Table.Cell class="text-muted-foreground">{user.email}</Table.Cell>
-      <Table.Cell><Badge variant={user.role === "admin" ? "default" : "secondary"}>{user.role ?? "user"}</Badge></Table.Cell>
-      <Table.Cell>
+    {#snippet row(user, { cellClass })}
+      <Table.Cell class={cn(cellClass("name"), "font-medium")}>{user.name}</Table.Cell>
+      <Table.Cell class={cn(cellClass("email"), "text-muted-foreground")}>{user.email}</Table.Cell>
+      <Table.Cell class={cellClass("role")}><Badge variant={user.role === "admin" ? "default" : "secondary"}>{user.role ?? "user"}</Badge></Table.Cell>
+      <Table.Cell class={cellClass("status")}>
         <div class="flex flex-wrap gap-1">
           {#if user.signupApproved === false}
             <Badge variant="secondary">{i18n.t.users.pendingApproval}</Badge>
@@ -400,8 +408,8 @@
           {/if}
         </div>
       </Table.Cell>
-      <Table.Cell class="text-muted-foreground">{user.createdAt ? formatDateTime(user.createdAt) : "—"}</Table.Cell>
-      <Table.Cell>
+      <Table.Cell class={cn(cellClass("createdAt"), "text-muted-foreground")}>{user.createdAt ? formatDateTime(user.createdAt) : "—"}</Table.Cell>
+      <Table.Cell class={cellClass("actions")}>
         <DropdownMenu.Root>
           <DropdownMenu.Trigger>
             {#snippet child({ props })}

package/dist/templates/modules/admin-dashboard/files/dot-claude/skills/podokit-data-table/SKILL.md

@@ -13,19 +13,20 @@ put pagination outside the table.
 ```svelte
 <script lang="ts">
   import DataTable from "$lib/components/data-table.svelte";
+  import { cn } from "$lib/utils";
   const columns = [
     { key: "name", label: "Name", sortable: true },
     { key: "email", label: "Email", sortable: true },
-    { key: "role", label: "Role", sortable: true },     // action/status columns: no `sortable`
+    { key: "role", label: "Role", sortable: true, hideBelow: "md" },
   ];
   let { rows } = $props();   // Svelte 5 runes only
 </script>
 
-<DataTable {columns} {rows} label="{rows.length} users">
-  {#snippet row(item)}
-    <Table.Cell>{item.name}</Table.Cell>
-    <Table.Cell>{item.email}</Table.Cell>
-    <Table.Cell>{item.role}</Table.Cell>
+<DataTable {columns} {rows} ariaLabel="Users" label="{rows.length} users">
+  {#snippet row(item, { cellClass })}
+    <Table.Cell class={cellClass("name")}>{item.name}</Table.Cell>
+    <Table.Cell class={cellClass("email")}>{item.email}</Table.Cell>
+    <Table.Cell class={cn(cellClass("role"), "text-muted-foreground")}>{item.role}</Table.Cell>
   {/snippet}
 </DataTable>
 ```
@@ -34,6 +35,10 @@ put pagination outside the table.
 - **Server data** (huge lists): use `manualSort` + `manualPagination` + `total`
   + `onChange` (re-fetch with `sortBy`/`sortDirection`/`page`).
 - Nested/derived sort keys: give the column a `value` accessor.
+- Responsive columns: set `hideBelow` to `sm`, `md`, `lg`, or `xl`, then apply
+  `cellClass(columnKey)` to the matching `Table.Cell`. Never repeat the
+  responsive class by hand; the shared class keeps headers and cells aligned.
+- Give each table an `ariaLabel` and scope Playwright locators to that table.
 - No footer needed: `perPage={0}`.
 - **Search & filters**: put the shared `table-toolbar.svelte` (`TableToolbar`)
   above the DataTable. Filters + search apply together on the Search button/Enter

package/dist/templates/modules/admin-dashboard/files/tests/api/audit.api.spec.ts

@@ -1,4 +1,4 @@
-import { expect, test } from "@playwright/test";
+import { expect, test } from "../helpers/disposable-users";
 import { ADMIN, USER } from "../helpers/accounts";
 
 const base = process.env.E2E_BASE_URL ?? "http://localhost:5001";
@@ -13,7 +13,7 @@ async function signedIn(
   return ctx;
 }
 
-test("audit log records auth/admin actions", async ({ playwright }) => {
+test("audit log records auth/admin actions", async ({ playwright, disposableUsers }) => {
   const admin = await signedIn(playwright, ADMIN);
   const probe = await admin.get("/api/audit-logs");
   test.skip(probe.status() === 404, "audit-log module not installed");
@@ -24,7 +24,7 @@ test("audit log records auth/admin actions", async ({ playwright }) => {
     data: { email, password: "Podokit3e-Str0ng!pw", name: "Audit", role: "user" },
   });
   expect(created.ok()).toBeTruthy();
-  const userId = (await created.json())?.user?.id as string;
+  const userId = await disposableUsers.trackResponse(created);
 
   const res = await admin.get("/api/audit-logs");
   expect(res.ok()).toBeTruthy();
@@ -34,6 +34,7 @@ test("audit log records auth/admin actions", async ({ playwright }) => {
   expect(entry?.actorEmail, "audit entry records the acting admin").toBe(ADMIN.email);
 
   await admin.post("/api/auth/admin/remove-user", { data: { userId } });
+  disposableUsers.forget(userId);
   await admin.dispose();
 });
 
@@ -47,11 +48,14 @@ test("the audit log is admin-only", async ({ playwright }) => {
   await user.dispose();
 });
 
-test("sending a verification email is audited", async ({ playwright }) => {
+test("sending a verification email is audited", async ({ playwright, disposableUsers }) => {
   const admin = await signedIn(playwright, ADMIN);
   test.skip((await admin.get("/api/audit-logs")).status() === 404, "audit-log module not installed");
   const email = `verif-audit-${Date.now()}@example.com`;
-  await admin.post("/api/auth/admin/create-user", { data: { email, password: "Podokit3e-Str0ng!pw", name: "VA", role: "user" } });
+  const created = await admin.post("/api/auth/admin/create-user", {
+    data: { email, password: "Podokit3e-Str0ng!pw", name: "VA", role: "user" },
+  });
+  await disposableUsers.trackResponse(created);
   await admin.post("/api/auth/send-verification-email", { data: { email, callbackURL: `${base}/admin` } });
   const entries = (await (await admin.get("/api/audit-logs")).json()) as Array<{ action: string; targetLabel: string | null }>;
   expect(entries.some((e) => e.action === "auth.verification_sent"), "verification send should be audited").toBeTruthy();
@@ -60,7 +64,7 @@ test("sending a verification email is audited", async ({ playwright }) => {
 
 // Audit logging is a DB-backed on/off toggle (auth_config `server`, applied live).
 // Runs after the recording tests and restores the flag so nothing else is affected.
-test("audit logging honours the DB on/off toggle @smoke", async ({ playwright }) => {
+test("audit logging honours the DB on/off toggle @smoke", async ({ playwright, disposableUsers }) => {
   const admin = await signedIn(playwright, ADMIN);
   test.skip((await admin.get("/api/audit-logs")).status() === 404, "audit-log module not installed");
   const auditLog = async () => (await (await admin.get("/api/account/capabilities")).json()).auditLog as boolean;
@@ -68,8 +72,12 @@ test("audit logging honours the DB on/off toggle @smoke", async ({ playwright })
     ((await (await admin.get("/api/audit-logs")).json()) as Array<{ action: string; targetLabel: string | null }>).some(
       (e) => e.action === "user.create" && e.targetLabel === label,
     );
-  const createUser = async (email: string) =>
-    (await (await admin.post("/api/auth/admin/create-user", { data: { email, password: "Podokit3e-Str0ng!pw", name: "T", role: "user" } })).json())?.user?.id as string;
+  const createUser = async (email: string): Promise<string> => {
+    const response = await admin.post("/api/auth/admin/create-user", {
+      data: { email, password: "Podokit3e-Str0ng!pw", name: "T", role: "user" },
+    });
+    return disposableUsers.trackResponse(response);
+  };
 
   try {
     // OFF → the action is not recorded. Wait past the config-store cache TTL so the
@@ -81,6 +89,7 @@ test("audit logging honours the DB on/off toggle @smoke", async ({ playwright })
     const offId = await createUser(offEmail);
     expect(await recorded(offEmail), "no audit entry while disabled").toBe(false);
     await admin.post("/api/auth/admin/remove-user", { data: { userId: offId } });
+    disposableUsers.forget(offId);
 
     // ON → recording resumes.
     await admin.put("/api/account/auth-config", { data: { server: { auditLog: true } } });
@@ -90,6 +99,7 @@ test("audit logging honours the DB on/off toggle @smoke", async ({ playwright })
     const onId = await createUser(onEmail);
     expect(await recorded(onEmail), "audit entry recorded once re-enabled").toBe(true);
     await admin.post("/api/auth/admin/remove-user", { data: { userId: onId } });
+    disposableUsers.forget(onId);
   } finally {
     await admin.put("/api/account/auth-config", { data: { server: { auditLog: true } } });
     await admin.dispose();

package/dist/templates/modules/admin-dashboard/files/tests/api/users-admin.api.spec.ts

@@ -1,4 +1,4 @@
-import { expect, test } from "@playwright/test";
+import { expect, test } from "../helpers/disposable-users";
 import { ADMIN, USER } from "../helpers/accounts";
 
 const base = process.env.E2E_BASE_URL ?? "http://localhost:5001";
@@ -13,7 +13,7 @@ async function signedIn(
   return ctx;
 }
 
-test("admin can create a user, set its password, and remove it", async ({ playwright }) => {
+test("admin can create a user, set its password, and remove it", async ({ playwright, disposableUsers }) => {
   const admin = await signedIn(playwright, ADMIN);
   const email = `api-crud-${Date.now()}@example.com`;
 
@@ -21,7 +21,7 @@ test("admin can create a user, set its password, and remove it", async ({ playwr
     data: { email, password: "Podokit3e-Str0ng!pw", name: "API CRUD", role: "user" },
   });
   expect(created.ok()).toBeTruthy();
-  const id = (await created.json())?.user?.id as string;
+  const id = await disposableUsers.trackResponse(created);
   expect(id).toBeTruthy();
 
   const setPw = await admin.post("/api/auth/admin/set-user-password", {
@@ -37,6 +37,7 @@ test("admin can create a user, set its password, and remove it", async ({ playwr
 
   const removed = await admin.post("/api/auth/admin/remove-user", { data: { userId: id } });
   expect(removed.ok()).toBeTruthy();
+  disposableUsers.forget(id);
   await admin.dispose();
 });
 
@@ -49,13 +50,13 @@ test("a normal user cannot create users (403)", async ({ playwright }) => {
   await user.dispose();
 });
 
-test("admin can list and revoke a user's sessions", async ({ playwright }) => {
+test("admin can list and revoke a user's sessions", async ({ playwright, disposableUsers }) => {
   const admin = await signedIn(playwright, ADMIN);
   const email = `api-sess-${Date.now()}@example.com`;
   const created = await admin.post("/api/auth/admin/create-user", {
     data: { email, password: "Podokit3e-Str0ng!pw", name: "API Sess", role: "user" },
   });
-  const userId = (await created.json())?.user?.id as string;
+  const userId = await disposableUsers.trackResponse(created);
 
   // the user signs in -> creates a session
   const theirs = await playwright.request.newContext({ baseURL: base, extraHTTPHeaders: origin });
@@ -69,14 +70,18 @@ test("admin can list and revoke a user's sessions", async ({ playwright }) => {
   const revoked = await admin.post("/api/auth/admin/revoke-user-sessions", { data: { userId } });
   expect(revoked.ok()).toBeTruthy();
   await admin.post("/api/auth/admin/remove-user", { data: { userId } });
+  disposableUsers.forget(userId);
   await admin.dispose();
 });
 
-test("revokeOtherSessions keeps the current session valid", async ({ playwright }) => {
+test("revokeOtherSessions keeps the current session valid", async ({ playwright, disposableUsers }) => {
   // Use a throwaway account so we don't revoke the shared USER's ui storageState.
   const admin = await signedIn(playwright, ADMIN);
   const email = `api-revoke-others-${Date.now()}@example.com`;
-  await admin.post("/api/auth/admin/create-user", { data: { email, password: "Podokit3e-Str0ng!pw", name: "RO", role: "user" } });
+  const created = await admin.post("/api/auth/admin/create-user", {
+    data: { email, password: "Podokit3e-Str0ng!pw", name: "RO", role: "user" },
+  });
+  await disposableUsers.trackResponse(created);
   await admin.dispose();
 
   const ctx = await playwright.request.newContext({ baseURL: base, extraHTTPHeaders: origin });
@@ -109,13 +114,13 @@ test("account capabilities reports optional-feature flags", async ({ playwright
   await ctx.dispose();
 });
 
-test("admin can update a user and impersonate them", async ({ playwright }) => {
+test("admin can update a user and impersonate them", async ({ playwright, disposableUsers }) => {
   const admin = await signedIn(playwright, ADMIN);
   const email = `api-edit-${Date.now()}@example.com`;
   const created = await admin.post("/api/auth/admin/create-user", {
     data: { email, password: "Podokit3e-Str0ng!pw", name: "Edit Me", role: "user" },
   });
-  const userId = (await created.json())?.user?.id as string;
+  const userId = await disposableUsers.trackResponse(created);
 
   const updated = await admin.post("/api/auth/admin/update-user", { data: { userId, data: { name: "Updated" } } });
   expect(updated.ok()).toBeTruthy();
@@ -131,5 +136,6 @@ test("admin can update a user and impersonate them", async ({ playwright }) => {
   await imp.dispose();
 
   await admin.post("/api/auth/admin/remove-user", { data: { userId } });
+  disposableUsers.forget(userId);
   await admin.dispose();
 });

package/dist/templates/modules/admin-dashboard/files/tests/helpers/accounts.ts

@@ -3,4 +3,5 @@ export const ADMIN = { name: "Admin", email: "admin@example.com", password: "Pod
 export const USER = { name: "Normal User", email: "user@example.com", password: "Podokit3e-Str0ng!pw" };
 export const adminState = "playwright/.auth/admin.json";
 export const userState = "playwright/.auth/user.json";
+export const userBaselineState = "playwright/.auth/user-baseline.json";
 export const anonState = { cookies: [], origins: [] } as const;

package/dist/templates/modules/admin-dashboard/files/tests/helpers/disposable-users.ts

@@ -0,0 +1,83 @@
+import {
+  expect,
+  test as base,
+  type APIResponse,
+} from "@playwright/test";
+
+const baseURL = process.env.E2E_BASE_URL ?? "http://localhost:5001";
+const origin = { origin: baseURL };
+
+type CreateUserInput = {
+  email: string;
+  password?: string;
+  name?: string;
+  role?: string;
+};
+
+export type DisposableUsers = {
+  create(input: CreateUserInput): Promise<string>;
+  trackResponse(response: APIResponse): Promise<string>;
+  track(userId: string): void;
+  forget(userId: string): void;
+};
+
+async function readCreatedUserId(response: APIResponse): Promise<string> {
+  expect(response.ok()).toBeTruthy();
+  const body = (await response.json()) as { user?: { id?: unknown } };
+  expect(typeof body.user?.id).toBe("string");
+  return body.user?.id as string;
+}
+
+export const test = base.extend<{ disposableUsers: DisposableUsers }>({
+  disposableUsers: async ({ context }, use) => {
+    // Reuse the browser context's storageState-backed request client. Creating
+    // a second admin login here can revoke the browser session in applications
+    // that enforce a single concurrent session.
+    const request = context.request;
+    const userIds = new Set<string>();
+
+    const disposableUsers: DisposableUsers = {
+      async create(input): Promise<string> {
+        const response = await request.post("/api/auth/admin/create-user", {
+          headers: origin,
+          data: {
+            password: "Podokit3e-Str0ng!pw",
+            name: "Throwaway",
+            role: "user",
+            ...input,
+          },
+        });
+        const userId = await readCreatedUserId(response);
+        userIds.add(userId);
+        return userId;
+      },
+      async trackResponse(response): Promise<string> {
+        const userId = await readCreatedUserId(response);
+        userIds.add(userId);
+        return userId;
+      },
+      track(userId): void {
+        userIds.add(userId);
+      },
+      forget(userId): void {
+        userIds.delete(userId);
+      },
+    };
+
+    try {
+      await use(disposableUsers);
+    } finally {
+      for (const userId of userIds) {
+        const response = await request.post("/api/auth/admin/remove-user", {
+          headers: origin,
+          data: { userId },
+        });
+        if (!response.ok() && response.status() !== 404) {
+          throw new Error(`Failed to remove disposable user ${userId}: HTTP ${response.status()}`);
+        }
+      }
+    }
+  },
+});
+
+export { expect };

package/dist/templates/modules/admin-dashboard/files/tests/playwright.config.ts

@@ -1,9 +1,21 @@
 import { defineConfig, devices } from "@playwright/test";
+import { loadPlaywrightProjects } from "./playwright.extensions";
 
 // admin-dashboard overlay: adds a `setup` project that seeds admin/user sessions
 // (storageState) which the `ui` project reuses. Serial + single worker because
 // tests share one backend/DB. Runs against a live stack on E2E_BASE_URL.
 const baseURL = process.env.E2E_BASE_URL ?? "http://localhost:5001";
+const coreProjects = [
+  { name: "api", testMatch: /.*\.api\.spec\.ts/, dependencies: ["setup"] },
+  { name: "setup", testMatch: /.*\.setup\.ts/, teardown: "cleanup" },
+  { name: "cleanup", testMatch: /.*\.teardown\.ts/ },
+  {
+    name: "ui",
+    testMatch: /.*\.ui\.spec\.ts/,
+    dependencies: ["setup"],
+    use: { ...devices["Desktop Chrome"], storageState: "playwright/.auth/admin.json" },
+  },
+];
 
 export default defineConfig({
   testDir: ".",
@@ -13,14 +25,5 @@ export default defineConfig({
   workers: 1,
   reporter: [["list"], ["html", { open: "never" }]],
   use: { baseURL, trace: "on-first-retry", screenshot: "only-on-failure" },
-  projects: [
-    { name: "api", testMatch: /.*\.api\.spec\.ts/, dependencies: ["setup"] },
-    { name: "setup", testMatch: /.*\.setup\.ts/ },
-    {
-      name: "ui",
-      testMatch: /.*\.ui\.spec\.ts/,
-      dependencies: ["setup"],
-      use: { ...devices["Desktop Chrome"], storageState: "playwright/.auth/admin.json" },
-    },
-  ],
+  projects: [...coreProjects, ...loadPlaywrightProjects(coreProjects)],
 });

package/dist/templates/modules/admin-dashboard/files/tests/seed.setup.ts

@@ -1,10 +1,46 @@
 import { test as setup, expect } from "@playwright/test";
-import { ADMIN, USER, adminState, userState, type Account } from "./helpers/accounts";
+import { mkdirSync, writeFileSync } from "node:fs";
+import { dirname } from "node:path";
+import {
+  ADMIN,
+  USER,
+  adminState,
+  userState,
+  userBaselineState,
+  type Account,
+} from "./helpers/accounts";
 
 const base = process.env.E2E_BASE_URL ?? "http://localhost:5001";
+mkdirSync(dirname(adminState), { recursive: true });
+
+type StorageState = Awaited<
+  ReturnType<import("@playwright/test").APIRequestContext["storageState"]>
+>;
+
+function withTestLocale(state: StorageState): StorageState {
+  const url = new URL(base);
+  return {
+    ...state,
+    cookies: [
+      ...state.cookies.filter((cookie) => cookie.name !== "locale"),
+      {
+        name: "locale",
+        value: "en",
+        domain: url.hostname,
+        path: "/",
+        expires: -1,
+        httpOnly: false,
+        secure: url.protocol === "https:",
+        sameSite: "Lax",
+      },
+    ],
+  };
+}
 
 // Seed a session via the API (reliable, no UI hydration races) and save its
-// cookies as storageState for the browser `ui` project to reuse.
+// cookies as storageState for the browser `ui` project to reuse. Pin the suite
+// locale because UI locators use the generated English catalog and must not
+// inherit an application's configured default language.
 async function seedSession(
   playwright: import("@playwright/test").PlaywrightWorkerArgs["playwright"],
   account: Account,
@@ -26,7 +62,7 @@ async function seedSession(
     if (!Array.isArray(sessions) || sessions.length <= 1) break;
     expect((await ctx.post("/api/auth/revoke-other-sessions")).ok(), `clear old sessions for ${account.email}`).toBeTruthy();
   }
-  await ctx.storageState({ path });
+  writeFileSync(path, `${JSON.stringify(withTestLocale(await ctx.storageState()), null, 2)}\n`);
   await ctx.dispose();
 }
 
@@ -48,3 +84,33 @@ setup("enable optional features", async ({ playwright }) => {
 setup("seed user session", async ({ playwright }) => {
   await seedSession(playwright, USER, userState);
 });
+
+setup("capture the user cleanup baseline", async ({ playwright }) => {
+  const ctx = await playwright.request.newContext({
+    baseURL: base,
+    extraHTTPHeaders: { origin: base },
+  });
+  try {
+    const signIn = await ctx.post("/api/auth/sign-in/email", {
+      data: { email: ADMIN.email, password: ADMIN.password },
+    });
+    expect(signIn.ok(), "sign in before capturing the user baseline").toBeTruthy();
+    const ids: string[] = [];
+    const limit = 100;
+    for (let offset = 0; ; offset += limit) {
+      const response = await ctx.get(`/api/auth/admin/list-users?limit=${limit}&offset=${offset}`);
+      expect(response.ok(), "list users before the suite").toBeTruthy();
+      const body = (await response.json()) as { users?: Array<{ id?: unknown }> };
+      const page = body.users ?? [];
+      ids.push(
+        ...page
+          .map((user) => user.id)
+          .filter((id): id is string => typeof id === "string"),
+      );
+      if (page.length < limit) break;
+    }
+    writeFileSync(userBaselineState, `${JSON.stringify(ids, null, 2)}\n`);
+  } finally {
+    await ctx.dispose();
+  }
+});

package/dist/templates/modules/admin-dashboard/files/tests/seed.teardown.ts

@@ -0,0 +1,46 @@
+import { existsSync, readFileSync } from "node:fs";
+import { expect, test as cleanup } from "@playwright/test";
+import { ADMIN, userBaselineState } from "./helpers/accounts";
+
+const base = process.env.E2E_BASE_URL ?? "http://localhost:5001";
+
+type ListedUser = {
+  id: string;
+};
+
+cleanup("remove users created by the suite", async ({ playwright }) => {
+  if (!existsSync(userBaselineState)) return;
+  const baseline = new Set(JSON.parse(readFileSync(userBaselineState, "utf8")) as string[]);
+  const ctx = await playwright.request.newContext({
+    baseURL: base,
+    extraHTTPHeaders: { origin: base },
+  });
+
+  try {
+    const signIn = await ctx.post("/api/auth/sign-in/email", {
+      data: { email: ADMIN.email, password: ADMIN.password },
+    });
+    expect(signIn.ok(), "sign in before cleaning users").toBeTruthy();
+
+    const users: ListedUser[] = [];
+    const limit = 100;
+    for (let offset = 0; ; offset += limit) {
+      const response = await ctx.get(`/api/auth/admin/list-users?limit=${limit}&offset=${offset}`);
+      expect(response.ok(), "list users during cleanup").toBeTruthy();
+      const body = (await response.json()) as { users?: ListedUser[] };
+      const page = body.users ?? [];
+      users.push(...page);
+      if (page.length < limit) break;
+    }
+
+    for (const user of users) {
+      if (baseline.has(user.id)) continue;
+      const response = await ctx.post("/api/auth/admin/remove-user", {
+        data: { userId: user.id },
+      });
+      expect(response.ok(), `remove disposable user ${user.id}`).toBeTruthy();
+    }
+  } finally {
+    await ctx.dispose();
+  }
+});

package/dist/templates/modules/admin-dashboard/files/tests/ui/data-table.ui.spec.ts

@@ -30,3 +30,16 @@ test("audit table sorts client-side", async ({ page }) => {
   await page.getByRole("button", { name: "When" }).click(); // default desc -> asc
   await expect(page.getByRole("columnheader", { name: /When/ })).toHaveAttribute("aria-sort", "ascending");
 });
+
+test("users table keeps responsive headers and cells aligned", async ({ page }) => {
+  await page.setViewportSize({ width: 390, height: 844 });
+  await ready(page, "/admin/users");
+  const table = page.getByRole("table", { name: "Users" });
+  const visibleHeaders = table.locator("thead th:visible");
+  const visibleCells = table.locator("tbody tr").first().locator("td:visible");
+
+  await expect(table.getByRole("columnheader", { name: "Role" })).toBeHidden();
+  await expect(table.getByRole("columnheader", { name: "Status" })).toBeHidden();
+  await expect(table.getByRole("columnheader", { name: "Joined" })).toBeHidden();
+  expect(await visibleHeaders.count()).toBe(await visibleCells.count());
+});

package/dist/templates/modules/admin-dashboard/files/tests/ui/email-admin.ui.spec.ts

@@ -1,4 +1,4 @@
-import { expect, test } from "@playwright/test";
+import { expect, test } from "../helpers/disposable-users";
 import { ready } from "../helpers/hydration";
 import { clearMailpit, mailpitReachable, waitForLink } from "../helpers/mailpit";
 
@@ -17,14 +17,11 @@ test("verification badges stay hidden when the feature is off", async ({ page })
 });
 
 // Admin can trigger a password-reset email for a user (not verification-gated).
-test("admin sends a password reset email to a user", async ({ page }) => {
+test("admin sends a password reset email to a user", async ({ page, disposableUsers }) => {
   test.skip(!(await mailpitReachable()), "Mailpit not available");
   await ready(page, "/admin/users");
   const email = `admin-reset-${Date.now()}@example.com`;
-  await page.request.post("/api/auth/admin/create-user", {
-    headers: { origin: base },
-    data: { email, password: "Podokit3e-Str0ng!pw", name: "AR", role: "user" },
-  });
+  await disposableUsers.create({ email, name: "AR" });
   await clearMailpit();
   await page.locator("#toolbar-search").fill(email);
   await page.getByRole("button", { name: "Search", exact: true }).click();

package/dist/templates/modules/admin-dashboard/files/tests/ui/users-crud.ui.spec.ts

@@ -1,16 +1,13 @@
-import { expect, test, type Page } from "@playwright/test";
+import { type Page } from "@playwright/test";
+import { expect, test, type DisposableUsers } from "../helpers/disposable-users";
 import { ready } from "../helpers/hydration";
 
 const base = process.env.E2E_BASE_URL ?? "http://localhost:5001";
 
 // Seed a throwaway user via the API (admin cookies come from storageState) so
 // the mutating UI tests don't touch the shared admin/user seed accounts.
-async function seedUser(page: Page, email: string): Promise<void> {
-  const res = await page.request.post("/api/auth/admin/create-user", {
-    headers: { origin: base },
-    data: { email, password: "Podokit3e-Str0ng!pw", name: "Throwaway", role: "user" },
-  });
-  expect(res.ok()).toBeTruthy();
+async function seedUser(disposableUsers: DisposableUsers, email: string): Promise<string> {
+  return disposableUsers.create({ email });
 }
 
 // Open the Manage two-pane modal for a seeded user.
@@ -21,7 +18,7 @@ async function openManage(page: Page, email: string): Promise<void> {
   await page.getByRole("menuitem", { name: "Manage" }).click();
 }
 
-test("admin can create a user via the dialog @smoke", async ({ page }) => {
+test("admin can create a user via the dialog @smoke", async ({ page, disposableUsers }) => {
   await ready(page, "/admin/users");
   const email = `ui-create-${Date.now()}@example.com`;
   await page.getByRole("button", { name: "Add user" }).click();
@@ -30,7 +27,13 @@ test("admin can create a user via the dialog @smoke", async ({ page }) => {
   await dialog.getByLabel("Email").fill(email);
   await dialog.getByLabel("Password", { exact: true }).fill("Podokit3e-Str0ng!pw");
   await dialog.getByLabel("Confirm password").fill("Podokit3e-Str0ng!pw");
+  const created = page.waitForResponse(
+    (response) =>
+      response.url().endsWith("/api/auth/admin/create-user") &&
+      response.request().method() === "POST",
+  );
   await dialog.getByRole("button", { name: "Create" }).click();
+  await disposableUsers.trackResponse(await created);
   // Wait for the create to settle (dialog closes + list reloads) before searching,
   // otherwise the search input can be refilled by the post-create reload.
   await expect(page.getByRole("dialog")).toBeHidden();
@@ -51,10 +54,10 @@ test("create rejects mismatched passwords", async ({ page }) => {
   await expect(dialog.getByText("Passwords do not match")).toBeVisible();
 });
 
-test("manage: edit profile name", async ({ page }) => {
+test("manage: edit profile name", async ({ page, disposableUsers }) => {
   await ready(page, "/admin/users");
   const email = `ui-edit-${Date.now()}@example.com`;
-  await seedUser(page, email);
+  await seedUser(disposableUsers, email);
   await openManage(page, email);
   const dialog = page.getByRole("dialog");
   await dialog.getByLabel("Name").fill("Edited Name");
@@ -62,10 +65,10 @@ test("manage: edit profile name", async ({ page }) => {
   await expect(page.getByText("User updated")).toBeVisible();
 });
 
-test("manage: set a password (and reject mismatch)", async ({ page }) => {
+test("manage: set a password (and reject mismatch)", async ({ page, disposableUsers }) => {
   await ready(page, "/admin/users");
   const email = `ui-setpw-${Date.now()}@example.com`;
-  await seedUser(page, email);
+  await seedUser(disposableUsers, email);
   await openManage(page, email);
   const dialog = page.getByRole("dialog");
   await dialog.getByRole("button", { name: "Security" }).click();
@@ -78,10 +81,10 @@ test("manage: set a password (and reject mismatch)", async ({ page }) => {
   await expect(page.getByText("Password updated")).toBeVisible();
 });
 
-test("manage: ban a user with a reason", async ({ page }) => {
+test("manage: ban a user with a reason", async ({ page, disposableUsers }) => {
   await ready(page, "/admin/users");
   const email = `ui-ban-${Date.now()}@example.com`;
-  await seedUser(page, email);
+  await seedUser(disposableUsers, email);
   await openManage(page, email);
   const dialog = page.getByRole("dialog");
   await dialog.getByRole("button", { name: "Security" }).click();
@@ -90,10 +93,10 @@ test("manage: ban a user with a reason", async ({ page }) => {
   await expect(page.getByText("User banned", { exact: true })).toBeVisible();
 });
 
-test("manage: revoke a user's session", async ({ page, playwright }) => {
+test("manage: revoke a user's session", async ({ page, playwright, disposableUsers }) => {
   await ready(page, "/admin/users");
   const email = `ui-sess-${Date.now()}@example.com`;
-  await seedUser(page, email);
+  await seedUser(disposableUsers, email);
   // create a session for the user in an isolated context (don't touch the admin cookie)
   const uctx = await playwright.request.newContext({ baseURL: base, extraHTTPHeaders: { origin: base } });
   expect((await uctx.post("/api/auth/sign-in/email", { data: { email, password: "Podokit3e-Str0ng!pw" } })).ok()).toBeTruthy();
@@ -105,39 +108,42 @@ test("manage: revoke a user's session", async ({ page, playwright }) => {
   await expect(page.getByText("Session revoked")).toBeVisible();
 });
 
-test("manage: delete a user from the danger zone", async ({ page }) => {
+test("manage: delete a user from the danger zone", async ({ page, disposableUsers }) => {
   await ready(page, "/admin/users");
   const email = `ui-delete-${Date.now()}@example.com`;
-  await seedUser(page, email);
+  const userId = await seedUser(disposableUsers, email);
   await openManage(page, email);
   const dialog = page.getByRole("dialog");
   await dialog.getByRole("button", { name: "Danger zone" }).click();
   await dialog.getByRole("button", { name: "Delete" }).click(); // arm
   await dialog.getByRole("button", { name: "Delete" }).click(); // confirm
   await expect(page.getByText("User deleted")).toBeVisible();
+  disposableUsers.forget(userId);
   await page.locator("#toolbar-search").fill(email);
   await page.getByRole("button", { name: "Search", exact: true }).click();
   await expect(page.getByRole("cell", { name: email })).toHaveCount(0);
 });
 
-test("users list shows pagination beyond one page", async ({ page }) => {
+test("users list shows pagination beyond one page", async ({ page, disposableUsers }) => {
   await ready(page, "/admin/users");
-  for (let i = 0; i < 6; i += 1) {
-    await page.request.post("/api/auth/admin/create-user", {
-      headers: { origin: base },
-      data: { email: `pg-${Date.now()}-${i}@example.com`, password: "Podokit3e-Str0ng!pw", name: `Pg${i}`, role: "user" },
+  const prefix = `pg-${Date.now()}`;
+  for (let i = 0; i < 16; i += 1) {
+    await disposableUsers.create({
+      email: `${prefix}-${i}@example.com`,
+      name: `Page user ${i}`,
     });
   }
-  await page.reload();
-  const nav = page.getByRole("navigation", { name: "pagination" });
+  await page.locator("#toolbar-search").fill(prefix);
+  await page.getByRole("button", { name: "Search", exact: true }).click();
+  const nav = page.getByRole("navigation", { name: "pagination" }).first();
   await expect(nav).toBeVisible();
-  await expect(nav.getByRole("button", { name: "Page 2" })).toBeVisible();
+  await expect(nav.getByRole("button", { name: "Page 2", exact: true }).first()).toBeVisible();
 });
 
-test("manage modal closes from its footer", async ({ page }) => {
+test("manage modal closes from its footer", async ({ page, disposableUsers }) => {
   await ready(page, "/admin/users");
   const email = `ui-close-${Date.now()}@example.com`;
-  await seedUser(page, email);
+  await seedUser(disposableUsers, email);
   await openManage(page, email);
   // footer Close (a visible button, distinct from the header X) dismisses the modal
   await page.getByRole("dialog").getByRole("button", { name: "Close", exact: true }).last().click();

package/dist/templates/modules/admin-dashboard/files/tests/ui/users.ui.spec.ts

@@ -1,9 +1,9 @@
-import { expect, test } from "@playwright/test";
+import { expect, test } from "../helpers/disposable-users";
 import { ready } from "../helpers/hydration";
 
 const base = process.env.E2E_BASE_URL ?? "http://localhost:5001";
 
-test("admin can create a user with a custom role", async ({ page }) => {
+test("admin can create a user with a custom role", async ({ page, disposableUsers }) => {
   await ready(page, "/admin/users");
   await page.getByRole("button", { name: "Add user" }).click();
   const role = page.locator("#c-role");
@@ -16,7 +16,13 @@ test("admin can create a user with a custom role", async ({ page }) => {
   // pick the Moderator role from the select
   await role.click();
   await page.getByRole("option", { name: "Moderator" }).click();
+  const created = page.waitForResponse(
+    (response) =>
+      response.url().endsWith("/api/auth/admin/create-user") &&
+      response.request().method() === "POST",
+  );
   await page.getByRole("button", { name: "Create", exact: true }).click();
+  await disposableUsers.trackResponse(await created);
   await expect(page.getByText("User created")).toBeVisible();
   // it appears in the list, filterable by the Moderator role
   await page.locator("#toolbar-search").fill(email);
@@ -52,43 +58,27 @@ test("row menu exposes admin actions", async ({ page }) => {
   await expect(page.getByRole("menuitem", { name: "Impersonate" })).toBeVisible();
 });
 
-test("admin can approve a pending registration from the user list", async ({ page }) => {
+test("admin can approve a pending registration from the user list", async ({ page, disposableUsers }) => {
   const email = `pending-ui-${Date.now()}@example.com`;
-  const created = await page.request.post("/api/auth/admin/create-user", {
-    headers: { origin: base },
-    data: { email, password: "Podokit3e-Str0ng!pw", name: "Pending UI", role: "user" },
-  });
-  expect(created.ok()).toBeTruthy();
-  const userId = ((await created.json()).user?.id ?? "") as string;
+  const userId = await disposableUsers.create({ email, name: "Pending UI" });
+  expect(
+    (await page.request.post("/api/auth/admin/update-user", {
+      headers: { origin: base },
+      data: { userId, data: { signupApproved: false } },
+    })).ok(),
+  ).toBeTruthy();
 
-  try {
-    expect(userId).toBeTruthy();
-    expect(
-      (await page.request.post("/api/auth/admin/update-user", {
-        headers: { origin: base },
-        data: { userId, data: { signupApproved: false } },
-      })).ok(),
-    ).toBeTruthy();
-
-    await ready(page, "/admin/users");
-    await page.locator("#toolbar-search").fill(email);
-    await page.getByRole("button", { name: "Search", exact: true }).click();
-    const row = page.getByRole("row", { name: new RegExp(email) });
-    await expect(row.getByText("Pending approval")).toBeVisible();
-    await row.getByRole("button").click();
-    const response = page.waitForResponse(
-      (res) => res.url().endsWith("/api/auth/admin/update-user") && res.request().method() === "POST",
-    );
-    await page.getByRole("menuitem", { name: "Approve sign-up" }).click();
-    expect((await response).ok()).toBeTruthy();
-    await expect(page.getByText("Sign-up approved")).toBeVisible();
-    await expect(row.getByText("Active")).toBeVisible();
-  } finally {
-    if (userId) {
-      await page.request.post("/api/auth/admin/remove-user", {
-        headers: { origin: base },
-        data: { userId },
-      });
-    }
-  }
+  await ready(page, "/admin/users");
+  await page.locator("#toolbar-search").fill(email);
+  await page.getByRole("button", { name: "Search", exact: true }).click();
+  const row = page.getByRole("row", { name: new RegExp(email) });
+  await expect(row.getByText("Pending approval")).toBeVisible();
+  await row.getByRole("button").click();
+  const response = page.waitForResponse(
+    (res) => res.url().endsWith("/api/auth/admin/update-user") && res.request().method() === "POST",
+  );
+  await page.getByRole("menuitem", { name: "Approve sign-up" }).click();
+  expect((await response).ok()).toBeTruthy();
+  await expect(page.getByText("Sign-up approved")).toBeVisible();
+  await expect(row.getByText("Active")).toBeVisible();
 });

package/dist/templates/modules/admin-dashboard/module.manifest.json

@@ -119,7 +119,7 @@
       "file": "AGENTS.md",
       "marker": "<!-- podokit:end:agents-modules -->",
       "optional": true,
-      "text": "### admin-dashboard\n- The `(admin)` route group and `admin-sidebar.svelte` are the admin-console shell for `/admin/*` only. Put signed-in product pages in `(app)` or in a separate route group with its own layout; do not place them under `(admin)`.\n- Admin console lives at `/admin/*` (users, sessions, organizations, audit, settings, account). Set `ADMIN_EMAILS`, then create or verify the initial account with `npm run admin:bootstrap -w <app>-api`; never commit or persist `ADMIN_BOOTSTRAP_PASSWORD`. When sign-up approval is enabled, self-registered users stay pending until an administrator approves them on `/admin/users`; administrator-created users bypass the queue.\n- Signed-in users can upload, replace, or remove their profile image from `/account` or `/admin/account`. Keep the shared policy visible in custom account UI: PNG, JPEG, or WebP; at most 2 MB and 2048 by 2048 pixels. Use the managed `/api/account/profile-image` endpoints instead of writing directly to storage or `user.image`.\n- Custom protected server layouts must call `requireBackendAvailable(locals)` from `$lib/server/guards` before redirecting anonymous users. This preserves sessions and returns 503 when authentication or maintenance policy cannot be checked.\n- **Every list/table MUST use the shared `$lib/components/data-table.svelte` (`DataTable`)** \u2014 it gives sortable headers + a footer pagination. Add search/filters with `$lib/components/table-toolbar.svelte`. Never assemble `Table.Root`/`Table.Header`/`Table.Body` by hand.\n"
+      "text": "### admin-dashboard\n- The `(admin)` route group and `admin-sidebar.svelte` are the admin-console shell for `/admin/*` only. Put signed-in product pages in `(app)` or in a separate route group with its own layout; do not place them under `(admin)`.\n- Admin console lives at `/admin/*` (users, sessions, organizations, audit, settings, account). Set `ADMIN_EMAILS`, then create or verify the initial account with `npm run admin:bootstrap -w <app>-api`; never commit or persist `ADMIN_BOOTSTRAP_PASSWORD`. When sign-up approval is enabled, self-registered users stay pending until an administrator approves them on `/admin/users`; administrator-created users bypass the queue.\n- Signed-in users can upload, replace, or remove their profile image from `/account` or `/admin/account`. Keep the shared policy visible in custom account UI: PNG, JPEG, or WebP; at most 2 MB and 2048 by 2048 pixels. Use the managed `/api/account/profile-image` endpoints instead of writing directly to storage or `user.image`.\n- `sidebar-user-menu.svelte` is specific to the admin sidebar. For a product shell outside `Sidebar.Provider`, use the managed `<AccountMenu {user} variant=\"identity\" side=\"top\" />` component.\n- Custom protected server layouts must call `requireBackendAvailable(locals)` from `$lib/server/guards` before redirecting anonymous users. This preserves sessions and returns 503 when authentication or maintenance policy cannot be checked.\n- **Every list/table MUST use the shared `$lib/components/data-table.svelte` (`DataTable`)** \u2014 it gives sortable headers + a footer pagination. Add search/filters with `$lib/components/table-toolbar.svelte`. Never assemble `Table.Root`/`Table.Header`/`Table.Body` by hand. For responsive columns, use `hideBelow` and apply the row context's `cellClass(columnKey)` to the matching cell.\n"
     },
     {
       "file": "apps/api/src/app.module.ts",

package/dist/templates/todo/tests/playwright.config.ts

@@ -1,10 +1,15 @@
 import { defineConfig, devices } from "@playwright/test";
+import { loadPlaywrightProjects } from "./playwright.extensions";
 
 // The suite runs against a live stack: web on E2E_BASE_URL (proxying /api/* to
 // the API). Start it first (see docs/testing.md) — locally via the dev harness,
 // in CI via scripts/e2e-ci.mjs. Two projects: `api` (request-only, backend e2e)
 // and `ui` (chromium, pages). Files are routed by suffix (*.api/*.ui.spec.ts).
 const baseURL = process.env.E2E_BASE_URL ?? "http://localhost:5001";
+const coreProjects = [
+  { name: "api", testMatch: /.*\.api\.spec\.ts/ },
+  { name: "ui", testMatch: /.*\.ui\.spec\.ts/, use: { ...devices["Desktop Chrome"] } },
+];
 
 export default defineConfig({
   testDir: ".",
@@ -18,8 +23,5 @@ export default defineConfig({
     trace: "on-first-retry",
     screenshot: "only-on-failure",
   },
-  projects: [
-    { name: "api", testMatch: /.*\.api\.spec\.ts/ },
-    { name: "ui", testMatch: /.*\.ui\.spec\.ts/, use: { ...devices["Desktop Chrome"] } },
-  ],
+  projects: [...coreProjects, ...loadPlaywrightProjects(coreProjects)],
 });

package/dist/templates/todo/tests/playwright.extensions.ts

@@ -0,0 +1,44 @@
+import { existsSync } from "node:fs";
+import { createRequire } from "node:module";
+import { join } from "node:path";
+import type { TestConfig } from "@playwright/test";
+
+type Projects = NonNullable<TestConfig["projects"]>;
+
+const requireFromTests = createRequire(__filename);
+
+function projectName(project: unknown): string | null {
+  if (typeof project !== "object" || project === null || !("name" in project)) return null;
+  return typeof project.name === "string" && project.name.length > 0 ? project.name : null;
+}
+
+/**
+ * Merge application-owned Playwright projects into PodoKit's managed config.
+ * The optional CommonJS file stays owned so applications can add devices and
+ * browsers without creating a 3-way merge hotspot in playwright.config.ts.
+ */
+export function loadPlaywrightProjects(coreProjects: Projects): Projects {
+  const extensionPath = join(__dirname, "playwright.projects.cjs");
+  if (!existsSync(extensionPath)) return [];
+
+  const loaded = requireFromTests(extensionPath) as unknown;
+  if (!Array.isArray(loaded)) {
+    throw new Error("tests/playwright.projects.cjs must export an array of Playwright projects.");
+  }
+
+  const names = new Set(
+    coreProjects.map((project) => projectName(project)).filter((name): name is string => name !== null),
+  );
+  for (const project of loaded) {
+    const name = projectName(project);
+    if (!name) {
+      throw new Error("Every project in tests/playwright.projects.cjs must have a non-empty name.");
+    }
+    if (names.has(name)) {
+      throw new Error(`Duplicate Playwright project name: ${name}`);
+    }
+    names.add(name);
+  }
+
+  return loaded as Projects;
+}

package/dist/update.js

@@ -91,20 +91,24 @@ function planUpdate(projectRoot, templatesDir) {
         const locked = lock.files[path];
         const newText = treeText(newTree, path);
         const disk = diskContent(projectRoot, path);
-        // A newer module can explicitly take responsibility for a path that older
-        // projects classified under a broad owned glob (notably generated skills).
-        const managedByTarget = managedOverrides.some((glob) => (0, lockfile_1.matchGlob)(path, glob));
-        const ownedByTarget = ownedGlobs.some((glob) => (0, lockfile_1.matchGlob)(path, glob));
-        const tier = managedByTarget
-            ? "managed"
-            : ownedByTarget
-                ? "owned"
-                : locked?.tier ??
-                    (newText !== null
-                        ? (0, lockfile_1.classifyTier)(path, newText, ownedGlobs, managedOverrides)
-                        : "managed");
+        // Use the same ownership precedence as lockfile classification. In
+        // particular, an exact path recorded by `podo eject` must keep winning over
+        // a module's managed override, while managed overrides may still reclaim a
+        // path covered only by a broad owned glob.
+        const controlledByTarget = managedOverrides.some((glob) => (0, lockfile_1.matchGlob)(path, glob)) ||
+            ownedGlobs.some((glob) => (0, lockfile_1.matchGlob)(path, glob));
+        const classified = (0, lockfile_1.classifyTier)(path, newText ?? disk ?? "", ownedGlobs, managedOverrides);
+        const tier = controlledByTarget ? classified : locked?.tier ?? classified;
         if (tier === "owned") {
-            changes.push({ path, tier, action: "skip", note: "owned — never modified" });
+            const explicitlyOwned = ownedGlobs.some((glob) => !glob.includes("*") && (0, lockfile_1.matchGlob)(path, glob));
+            changes.push({
+                path,
+                tier,
+                action: "skip",
+                note: explicitlyOwned && disk === null && newText !== null
+                    ? "explicitly owned — missing or relocated; not restored"
+                    : "owned — never modified",
+            });
             continue;
         }
         // File removed upstream.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@podosoft/podokit",
-  "version": "0.14.0",
+  "version": "0.15.0",
   "description": "An opinionated but extensible starter toolkit and CLI for full-stack TypeScript apps with NestJS, SvelteKit, TailwindCSS, shadcn-svelte, Docker, and k3s.",
   "license": "Apache-2.0",
   "repository": {