@podosoft/podokit 0.17.3 → 1.0.1

package/dist/templates/modules/admin-dashboard/files/apps/web/src/routes/account/+page.svelte

@@ -1,23 +1,27 @@
 <script lang="ts">
-  import AccountPage from "$lib/components/account-page.svelte";
-  import LanguageSwitch from "$lib/components/language-switch.svelte";
-  import SiteFooter from "$lib/components/site-footer.svelte";
-  import ThemeToggle from "$lib/components/theme-toggle.svelte";
-  import { Button } from "$lib/components/ui/button";
-  import { Toaster } from "$lib/components/ui/sonner";
-  import { getI18n } from "$lib/i18n";
+  import AccountPage from "#lib/components/account-page.svelte";
+  import ImpersonationBanner from "#lib/components/impersonation-banner.svelte";
+  import LanguageSwitch from "#lib/components/language-switch.svelte";
+  import SiteFooter from "#lib/components/site-footer.svelte";
+  import ThemeToggle from "#lib/components/theme-toggle.svelte";
+  import { Button } from "#lib/components/ui/button/index.js";
+  import { Toaster } from "#lib/components/ui/sonner/index.js";
+  import { getI18n } from "#lib/i18n/index.js";
   import type { Capabilities } from "@podosoft/podokit-api-client";
   import type { SessionUser } from "../../app.d.ts";
 
   let {
     data,
   }: {
-    data: { user: SessionUser; currentSessionId: string | null; capabilities: Capabilities };
+    data: { user: SessionUser; currentSessionId: string | null; capabilities: Capabilities; impersonating: boolean };
   } = $props();
   const i18n = getI18n();
 </script>
 
 <div class="flex min-h-svh flex-col">
+  {#if data.impersonating}
+    <ImpersonationBanner email={data.user.email} />
+  {/if}
   <header class="flex h-14 items-center gap-2 border-b px-4">
     <Button href="/" variant="ghost">{i18n.t.nav.home}</Button>
     <div class="flex-1"></div>

package/dist/templates/modules/admin-dashboard/files/apps/web/src/routes/maintenance/+page.svelte

@@ -1,10 +1,10 @@
 <script lang="ts">
   // Shown to non-admin visitors while maintenance mode is on (see +layout.server.ts).
   // Admins are never redirected here and can sign in to turn it off.
-  import { Button } from "$lib/components/ui/button";
-  import LanguageSwitch from "$lib/components/language-switch.svelte";
-  import ThemeToggle from "$lib/components/theme-toggle.svelte";
-  import { getI18n } from "$lib/i18n";
+  import { Button } from "#lib/components/ui/button/index.js";
+  import LanguageSwitch from "#lib/components/language-switch.svelte";
+  import ThemeToggle from "#lib/components/theme-toggle.svelte";
+  import { getI18n } from "#lib/i18n/index.js";
 
   const i18n = getI18n();
 </script>

package/dist/templates/modules/admin-dashboard/files/apps/web/src/routes/oauth2/consent/+page.svelte

@@ -1,8 +1,8 @@
 <script lang="ts">
   import { page } from "$app/state";
-  import { Button } from "$lib/components/ui/button";
-  import * as Card from "$lib/components/ui/card";
-  import { getI18n } from "$lib/i18n";
+  import { Button } from "#lib/components/ui/button/index.js";
+  import * as Card from "#lib/components/ui/card/index.js";
+  import { getI18n } from "#lib/i18n/index.js";
 
   const i18n = getI18n();
   // The OAuth provider redirects here with the authorization request in the query

package/dist/templates/modules/admin-dashboard/files/apps/web/src/routes/setup-2fa/+page.server.ts

@@ -1,6 +1,6 @@
 import { redirect } from "@sveltejs/kit";
 import type { PageServerLoad } from "./$types";
-import { requireBackendAvailable } from "$lib/server/guards";
+import { requireBackendAvailable } from "#lib/server/guards.js";
 
 // The mandatory two-factor enrolment page (reached via the require-2fa gate).
 // Must be signed in; already-enrolled users have nothing to do here.
@@ -8,6 +8,6 @@ export const load: PageServerLoad = ({ locals }) => {
   requireBackendAvailable(locals);
   if (!locals.user) redirect(302, "/login");
   const user = locals.user as App.Locals["user"] & { twoFactorEnabled?: boolean };
-  if (user.twoFactorEnabled) redirect(302, "/admin");
+  if (user.twoFactorEnabled) redirect(302, "/account");
   return { user: locals.user };
 };

package/dist/templates/modules/admin-dashboard/files/apps/web/src/routes/setup-2fa/+page.svelte

@@ -1,14 +1,14 @@
 <script lang="ts">
   import { goto } from "$app/navigation";
   import QRCode from "qrcode";
-  import { Button } from "$lib/components/ui/button";
-  import { Input } from "$lib/components/ui/input";
-  import { Label } from "$lib/components/ui/label";
-  import { Checkbox } from "$lib/components/ui/checkbox";
-  import * as Card from "$lib/components/ui/card";
-  import * as Alert from "$lib/components/ui/alert";
-  import { api } from "$lib/api";
-  import { getI18n } from "$lib/i18n";
+  import { Button } from "#lib/components/ui/button/index.js";
+  import { Input } from "#lib/components/ui/input/index.js";
+  import { Label } from "#lib/components/ui/label/index.js";
+  import { Checkbox } from "#lib/components/ui/checkbox/index.js";
+  import * as Card from "#lib/components/ui/card/index.js";
+  import * as Alert from "#lib/components/ui/alert/index.js";
+  import { api } from "#lib/api.js";
+  import { getI18n } from "#lib/i18n/index.js";
 
   const i18n = getI18n();
   let password = $state("");
@@ -39,7 +39,11 @@
       error = e.code === "INVALID_PASSWORD" ? i18n.t.setup2fa.wrongPassword : i18n.t.setup2fa.enableFailed;
       return;
     }
-    setup = { totpURI: data?.totpURI ?? "", backupCodes: (data?.backupCodes ?? []) as string[] };
+    if (!data?.totpURI || !Array.isArray(data.backupCodes)) {
+      error = i18n.t.setup2fa.enableFailed;
+      return;
+    }
+    setup = { totpURI: data.totpURI, backupCodes: data.backupCodes };
   }
 
   async function activate(): Promise<void> {
@@ -51,7 +55,7 @@
       error = i18n.t.auth.twoFactorInvalidCode;
       return;
     }
-    await goto("/admin", { invalidateAll: true });
+    await goto("/account", { invalidateAll: true });
   }
 
   function downloadCodes(): void {

package/dist/templates/modules/admin-dashboard/files/dot-claude/skills/podokit-data-table/SKILL.md

@@ -5,15 +5,15 @@ description: Use when building ANY list or table view in this project (users, se
 
 # Build a list with the shared DataTable
 
-**Every** list/table in this project must use `$lib/components/data-table.svelte`
+**Every** list/table in this project must use `#lib/components/data-table.svelte`
 (`DataTable`) — it provides sortable headers and a footer pagination, consistently.
 Do **not** assemble `Table.Root` / `Table.Header` / `Table.Body` by hand, and don't
 put pagination outside the table.
 
 ```svelte
 <script lang="ts">
-  import DataTable from "$lib/components/data-table.svelte";
-  import { cn } from "$lib/utils";
+  import DataTable from "#lib/components/data-table.svelte";
+  import { cn } from "#lib/utils.js";
   const columns = [
     { key: "name", label: "Name", sortable: true },
     { key: "email", label: "Email", sortable: true },

package/dist/templates/modules/admin-dashboard/files/tests/helpers/accounts.ts

@@ -13,7 +13,7 @@ export type Account = { name: string; email: string; password: string };
  * So the constant is a DEFAULT and the environment wins:
  *
  * ```bash
- * E2E_BASE_URL=https://app.example.com E2E_ADMIN_PASSWORD='…' npx playwright test …
+ * E2E_BASE_URL=https://app.example.com E2E_ADMIN_PASSWORD='…' {{packageExecutor}} playwright test …
  * ```
  *
  * Without the override the run fails with `INVALID_EMAIL_OR_PASSWORD`, which is the correct
@@ -29,4 +29,19 @@ export const USER = { name: "Normal User", email: "user@example.com", password:
 export const adminState = "playwright/.auth/admin.json";
 export const userState = "playwright/.auth/user.json";
 export const userBaselineState = "playwright/.auth/user-baseline.json";
-export const anonState = { cookies: [], origins: [] } as const;
+const testUrl = new URL(process.env.E2E_BASE_URL ?? "http://localhost:5001");
+export const anonState = {
+  cookies: [
+    {
+      name: "locale",
+      value: "en",
+      domain: testUrl.hostname,
+      path: "/",
+      expires: -1,
+      httpOnly: false,
+      secure: testUrl.protocol === "https:",
+      sameSite: "Lax" as const,
+    },
+  ],
+  origins: [],
+};

package/dist/templates/modules/admin-dashboard/files/tests/helpers/disposable-users.ts

@@ -3,6 +3,7 @@ import {
   test as base,
   type APIResponse,
 } from "@playwright/test";
+import { ADMIN } from "./accounts";
 
 const baseURL = process.env.E2E_BASE_URL ?? "http://localhost:5001";
 const origin = { origin: baseURL };
@@ -29,11 +30,23 @@ async function readCreatedUserId(response: APIResponse): Promise<string> {
 }
 
 export const test = base.extend<{ disposableUsers: DisposableUsers }>({
-  disposableUsers: async ({ context }, use) => {
-    // Reuse the browser context's storageState-backed request client. Creating
-    // a second admin login here can revoke the browser session in applications
-    // that enforce a single concurrent session.
-    const request = context.request;
+  disposableUsers: async ({ context, playwright }, use, testInfo) => {
+    // API projects do not inherit the UI project's admin storageState, while a
+    // second admin sign-in can invalidate the shared UI session. Authenticate an
+    // isolated request context only for API tests and reuse browser cookies for UI.
+    let request = context.request;
+    let ownsRequest = false;
+    if (testInfo.project.name === "api") {
+      request = await playwright.request.newContext({
+        baseURL,
+        extraHTTPHeaders: origin,
+      });
+      ownsRequest = true;
+      const signIn = await request.post("/api/auth/sign-in/email", {
+        data: { email: ADMIN.email, password: ADMIN.password },
+      });
+      expect(signIn.ok(), "sign in disposable user fixture").toBeTruthy();
+    }
     const userIds = new Set<string>();
 
     const disposableUsers: DisposableUsers = {
@@ -67,14 +80,18 @@ export const test = base.extend<{ disposableUsers: DisposableUsers }>({
     try {
       await use(disposableUsers);
     } finally {
-      for (const userId of userIds) {
-        const response = await request.post("/api/auth/admin/remove-user", {
-          headers: origin,
-          data: { userId },
-        });
-        if (!response.ok() && response.status() !== 404) {
-          throw new Error(`Failed to remove disposable user ${userId}: HTTP ${response.status()}`);
+      try {
+        for (const userId of userIds) {
+          const response = await request.post("/api/auth/admin/remove-user", {
+            headers: origin,
+            data: { userId },
+          });
+          if (!response.ok() && response.status() !== 404) {
+            throw new Error(`Failed to remove disposable user ${userId}: HTTP ${response.status()}`);
+          }
         }
+      } finally {
+        if (ownsRequest) await request.dispose();
       }
     }
   },

package/dist/templates/modules/admin-dashboard/files/tests/helpers/hydration.ts

@@ -1,9 +1,9 @@
 import type { Page } from "@playwright/test";
 
-// SvelteKit dev hydration can attach event handlers slightly after load;
-// wait for the page to settle before driving client-only interactions.
+// Wait for SvelteKit to attach client event handlers before driving forms. The
+// root layout adds this marker from onMount, so no fixed timing assumption is
+// needed even while the development server compiles a route for the first time.
 export async function ready(page: Page, path: string): Promise<void> {
   await page.goto(path);
-  await page.waitForLoadState("load");
-  await page.waitForTimeout(400);
+  await page.locator('html[data-hydrated="true"]').waitFor();
 }

package/dist/templates/modules/admin-dashboard/files/tests/ui/account-flows.ui.spec.ts

@@ -15,11 +15,13 @@ async function loginFresh(page: import("@playwright/test").Page, playwright: imp
   const api = await playwright.request.newContext({ baseURL: base, extraHTTPHeaders: origin });
   await api.post("/api/auth/sign-up/email", { data: { email, password: PW, name: "Acc" } });
   await api.dispose();
-  await ready(page, `/login?redirect=${encodeURIComponent("/admin/account")}`);
+  await ready(page, `/login?redirect=${encodeURIComponent("/account")}`);
   await page.locator("#email").fill(email);
   await page.locator("#password").fill(PW);
   await page.getByRole("button", { name: "Sign in", exact: true }).click();
-  await expect(page).toHaveURL(/\/admin\/account/);
+  await expect(page).toHaveURL((url) => url.pathname === "/account");
+  await expect(page.getByRole("heading", { name: "Account" })).toBeVisible();
+  await expect(page.getByLabel("Name", { exact: true })).toBeVisible();
 }
 
 test("account: register and verify a phone number", async ({ page, playwright }) => {

package/dist/templates/modules/admin-dashboard/files/tests/ui/account.ui.spec.ts

@@ -226,6 +226,57 @@ test("account nav shows the core sections", async ({ page }) => {
   await expect(page.getByRole("button", { name: "Sessions" })).toBeVisible();
 });
 
+test("connected account unlink uses the local account row id @smoke", async ({ page }) => {
+  const provider = "google";
+  let unlinkBody: unknown;
+  await page.route("**/api/auth/list-accounts", (route) =>
+    route.fulfill({
+      status: 200,
+      contentType: "application/json",
+      body: JSON.stringify([
+        { id: "local-account-id", providerId: provider, accountId: "provider-subject" },
+      ]),
+    }),
+  );
+  await page.route("**/api/auth/unlink-account", async (route) => {
+    unlinkBody = route.request().postDataJSON();
+    await route.fulfill({ status: 200, contentType: "application/json", body: "{}" });
+  });
+
+  try {
+    const enabled = await page.request.put("/api/account/auth-config", {
+      data: {
+        social: {
+          [provider]: {
+            enabled: true,
+            clientId: "podokit",
+            clientSecret: "podokit",
+          },
+        },
+      },
+    });
+    expect(enabled.ok()).toBeTruthy();
+    await expect
+      .poll(async () => {
+        const response = await page.request.get("/api/account/capabilities");
+        const body = (await response.json()) as { providers?: string[] };
+        return body.providers ?? [];
+      }, { timeout: 8_000 })
+      .toContain(provider);
+
+    await ready(page, "/admin/account");
+    await page.getByRole("button", { name: "Connected", exact: true }).click();
+    await page.getByRole("button", { name: "Disconnect", exact: true }).click();
+
+    await expect.poll(() => unlinkBody).toEqual({ accountId: "local-account-id" });
+    await expect(page.getByText("Disconnected", { exact: true })).toBeVisible();
+  } finally {
+    await page.request.put("/api/account/auth-config", {
+      data: { social: { [provider]: { enabled: false } } },
+    });
+  }
+});
+
 test("two-factor setup shows a scannable QR code when enabled", async ({ page }) => {
   await ready(page, "/admin/account");
   await page.getByRole("button", { name: "Security" }).click();

package/dist/templates/modules/admin-dashboard/files/tests/ui/auth.ui.spec.ts

@@ -9,7 +9,7 @@ const base = process.env.E2E_BASE_URL ?? "http://localhost:5001";
 
 test("login page renders @smoke", async ({ page }) => {
   await page.goto("/login");
-  await expect(page.getByLabel("Email")).toBeVisible();
+  await expect(page.getByRole("textbox", { name: /Email(?: or username)?/ })).toBeVisible();
   await expect(page.getByLabel("Password")).toBeVisible();
   await expect(page.getByRole("button", { name: "Sign in", exact: true })).toBeVisible();
   await expect(page.getByRole("link", { name: "Sign up" })).toBeVisible();
@@ -18,7 +18,7 @@ test("login page renders @smoke", async ({ page }) => {
 
 test("invalid credentials show an error", async ({ page }) => {
   await ready(page, "/login");
-  await page.getByLabel("Email").fill("nobody@example.com");
+  await page.getByRole("textbox", { name: /Email(?: or username)?/ }).fill("nobody@example.com");
   await page.getByLabel("Password").fill("wrong-password");
   await page.getByRole("button", { name: "Sign in", exact: true }).click();
   await expect(page.getByRole("alert")).toBeVisible();

package/dist/templates/modules/admin-dashboard/files/tests/ui/impersonation.ui.spec.ts

@@ -13,11 +13,13 @@ test("admin can impersonate a user and stop", async ({ page }) => {
   await row.getByRole("button").click();
   await page.getByRole("menuitem", { name: "Impersonate" }).click();
 
-  // Impersonating drops us into the app with a banner offering to stop.
-  await expect(page).toHaveURL(/\/admin(\/|$)/);
+  // Impersonating a normal user leaves the admin-only route group and keeps a
+  // visible route back to the original administrator session.
+  await expect(page).toHaveURL(/\/account(\/|$)/);
   const stop = page.getByRole("button", { name: "Stop impersonating" });
   await expect(stop).toBeVisible();
 
   await stop.click();
+  await expect(page).toHaveURL(/\/admin(\/|$)/);
   await expect(page.getByRole("button", { name: "Stop impersonating" })).toHaveCount(0);
 });

package/dist/templates/modules/admin-dashboard/files/tests/ui/oidc.ui.spec.ts

@@ -3,7 +3,9 @@ import { createHash, randomBytes } from "node:crypto";
 
 // admin storageState (project default) — the admin is the resource owner.
 const b64url = (b: Buffer): string => b.toString("base64url");
-const REDIRECT = "http://localhost:9999/callback";
+// This front-channel test stops at consent, so use the HTTPS callback required
+// for a web client without depending on a live relying-party callback server.
+const REDIRECT = "https://example.com/callback";
 
 // Verifies the provider is correctly configured end to end on the front channel:
 // signed discovery + JWKS, dynamic client registration, and an authorize request
@@ -30,12 +32,13 @@ test("OIDC provider: discovery, JWKS, client registration, authorize handoff", a
     // the provider is enabled the auth instance may still be rebuilding.
     let reg: { client_id?: string; client_secret?: string } = {};
     await expect(async () => {
-      reg = await (
-        await page.request.post("/api/auth/oauth2/create-client", {
-          data: { client_name: "E2E RP", redirect_uris: [REDIRECT] },
-          headers,
-        })
-      ).json();
+      const response = await page.request.post("/api/auth/oauth2/create-client", {
+        data: { client_name: "E2E RP", redirect_uris: [REDIRECT] },
+        headers,
+      });
+      const body = await response.text();
+      expect(response.ok(), body).toBeTruthy();
+      reg = JSON.parse(body) as typeof reg;
       expect(reg.client_id).toBeTruthy();
     }).toPass({ timeout: 8000 });
     expect(reg.client_secret).toBeTruthy();
@@ -48,12 +51,14 @@ test("OIDC provider: discovery, JWKS, client registration, authorize handoff", a
       `/api/auth/oauth2/authorize?client_id=${reg.client_id}&redirect_uri=${encodeURIComponent(REDIRECT)}` +
       `&response_type=code&scope=${encodeURIComponent("openid profile email")}&state=st` +
       `&code_challenge=${challenge}&code_challenge_method=S256`;
-    const authz = await (await page.request.get(authorizeUrl, { headers })).json();
-    expect(String(authz.url)).toContain("/oauth2/consent");
-    expect(String(authz.url)).toContain("client_id=");
+    const authz = await page.request.get(authorizeUrl, { headers, maxRedirects: 0 });
+    expect(authz.status()).toBe(302);
+    const consentUrl = authz.headers().location ?? "";
+    expect(consentUrl).toContain("/oauth2/consent");
+    expect(consentUrl).toContain("client_id=");
 
     // The consent page renders (reached in a real browser navigation).
-    await page.goto(authz.url);
+    await page.goto(consentUrl);
     await expect(page.getByRole("button", { name: "Allow" })).toBeVisible();
   } finally {
     await page.request.put("/api/account/settings", { data: { oidcProvider: false }, headers });

package/dist/templates/modules/admin-dashboard/files/tests/ui/passkey.ui.spec.ts

@@ -1,8 +1,9 @@
 import { expect, test } from "@playwright/test";
+import { anonState } from "../helpers/accounts";
 import { ready } from "../helpers/hydration";
 
 // Full passkey round trip on a throwaway account — never touches the shared admin.
-test.use({ storageState: { cookies: [], origins: [] } });
+test.use({ storageState: anonState });
 
 test("register a passkey and sign in with it", async ({ page, baseURL }) => {
   const origin = { origin: baseURL ?? "" };
@@ -20,7 +21,7 @@ test("register a passkey and sign in with it", async ({ page, baseURL }) => {
   const signup = await page.context().request.post("/api/auth/sign-up/email", { data: { email, password: pw, name: "PK" }, headers: origin });
   expect(signup.ok(), await signup.text()).toBeTruthy();
 
-  await ready(page, "/admin/account");
+  await ready(page, "/account");
   await page.getByRole("button", { name: "Security" }).click();
   const addBtn = page.getByRole("button", { name: "Add passkey" });
   test.skip((await addBtn.count()) === 0, "passkeys not enabled");

package/dist/templates/modules/admin-dashboard/files/tests/ui/two-factor.ui.spec.ts

@@ -15,6 +15,12 @@ async function openHydratedLogin(page: Page, redirect?: string): Promise<void> {
   await page.waitForLoadState("networkidle");
 }
 
+async function expectAccountPage(page: Page): Promise<void> {
+  await expect(page).toHaveURL((url) => url.pathname === "/account");
+  await expect(page.getByRole("heading", { name: "Account" })).toBeVisible();
+  await expect(page.getByLabel("Name", { exact: true })).toBeVisible();
+}
+
 // A disposable account (never the shared admin/user) so enabling 2FA here can't
 // invalidate the seeded sessions the other auth specs rely on.
 test("two-factor: sign in with a backup code from the login page", async ({ page, playwright }) => {
@@ -31,7 +37,7 @@ test("two-factor: sign in with a backup code from the login page", async ({ page
   await api.dispose();
 
   // Password sign-in hands off to the second-factor step (no session yet).
-  await openHydratedLogin(page, "/admin/account");
+  await openHydratedLogin(page, "/account");
   await page.getByLabel("Email").fill(email);
   await page.getByLabel("Password").fill(pw);
   await page.getByRole("button", { name: "Sign in", exact: true }).click();
@@ -52,7 +58,30 @@ test("two-factor: sign in with a backup code from the login page", async ({ page
   // The real code completes the login.
   await page.getByLabel("Backup code").fill(backupCode);
   await page.getByRole("button", { name: "Verify", exact: true }).click();
-  await expect(page).toHaveURL(/\/admin\/account/);
+  await expectAccountPage(page);
+});
+
+test("two-factor: sign in with an authenticator code from the login page", async ({ page, playwright }) => {
+  const api = await playwright.request.newContext({ baseURL: base, extraHTTPHeaders: origin });
+  const caps = await (await api.get("/api/account/capabilities")).json();
+  test.skip(!caps?.twoFactor, "two-factor not enabled");
+
+  const email = `tf-totp-ui-${Date.now()}@example.com`;
+  const pw = "Podokit3e-Str0ng!pw";
+  await api.post("/api/auth/sign-up/email", { data: { email, password: pw, name: "UI" } });
+  const enable = await (await api.post("/api/auth/two-factor/enable", { data: { password: pw } })).json();
+  await api.post("/api/auth/two-factor/verify-totp", { data: { code: totpCode(enable.totpURI) } });
+  await api.dispose();
+
+  await openHydratedLogin(page, "/account");
+  await page.getByLabel("Email").fill(email);
+  await page.getByLabel("Password").fill(pw);
+  await page.getByRole("button", { name: "Sign in", exact: true }).click();
+  await expect(page.getByTestId("two-factor-step")).toBeVisible();
+  await page.getByLabel("Authentication code").fill(totpCode(enable.totpURI));
+  await page.getByRole("button", { name: "Verify", exact: true }).click();
+
+  await expectAccountPage(page);
 });
 
 test("require-2fa: a new sign-up is forced through the enrolment page", async ({ page, playwright }) => {
@@ -74,7 +103,7 @@ test("require-2fa: a new sign-up is forced through the enrolment page", async ({
     await probe.dispose();
 
     // Signing in toward a protected route lands on the mandatory enrolment page.
-    await openHydratedLogin(page, "/admin");
+    await openHydratedLogin(page, "/account");
     await page.getByLabel("Email").fill(email);
     await page.getByLabel("Password").fill(pw);
     await page.getByRole("button", { name: "Sign in", exact: true }).click();
@@ -91,8 +120,12 @@ test("require-2fa: a new sign-up is forced through the enrolment page", async ({
     await page.getByLabel("3. Enter the 6-digit code").fill(totpCode(uri));
     await page.getByRole("button", { name: "Activate and continue" }).click();
 
-    // Enrolled → the gate lets them into the app (no longer bounced to /setup-2fa).
-    await expect(page).toHaveURL(/\/admin/);
+    // Enrolled → the gate lets the regular user into their account page.
+    await expectAccountPage(page);
+
+    // An enrolled user who revisits setup is returned to the same non-admin page.
+    await page.goto("/setup-2fa");
+    await expectAccountPage(page);
   } finally {
     await admin.put("/api/account/settings", { data: { require2fa: false } });
     await expect(async () => {
@@ -119,14 +152,14 @@ test("account: regenerate backup codes shows a fresh set", async ({ page, playwr
   await api.dispose();
 
   // Sign in (backup-code path) straight to the account page.
-  await openHydratedLogin(page, "/admin/account");
+  await openHydratedLogin(page, "/account");
   await page.getByLabel("Email").fill(email);
   await page.getByLabel("Password").fill(pw);
   await page.getByRole("button", { name: "Sign in", exact: true }).click();
   await page.getByRole("button", { name: "Use a backup code instead" }).click();
   await page.getByLabel("Backup code").fill(backupCode);
   await page.getByRole("button", { name: "Verify", exact: true }).click();
-  await expect(page).toHaveURL(/\/admin\/account/);
+  await expectAccountPage(page);
 
   // Security → regenerate backup codes → a fresh set is shown.
   await page.getByRole("button", { name: "Security" }).click();

package/dist/templates/modules/admin-dashboard/module.manifest.json

@@ -35,13 +35,13 @@
   "packageOverlays": {
     "api": {
       "dependencies": {
-        "image-size": "^2.0.2"
+        "probe-image-size": "^7.4.0"
       },
       "devDependencies": {
-        "@types/multer": "^1.4.12"
+        "@types/probe-image-size": "^7.2.5"
       },
       "scripts": {
-        "admin:bootstrap": "node scripts/bootstrap-admin.mjs"
+        "admin:bootstrap": "bun scripts/bootstrap-admin.mjs"
       }
     }
   },
@@ -75,8 +75,8 @@
         },
         {
           "path": "apps/web/src/routes/(admin)/+layout.svelte",
-          "from": "$lib/components/app-sidebar.svelte",
-          "to": "$lib/components/admin-sidebar.svelte",
+          "from": "#lib/components/app-sidebar.svelte",
+          "to": "#lib/components/admin-sidebar.svelte",
           "expected": 1
         }
       ]
@@ -87,7 +87,7 @@
       "file": "apps/web/src/routes/+page.svelte",
       "marker": "// podokit:end:landing-imports",
       "optional": true,
-      "text": "import { page } from \"$app/state\";\n  import AccountMenu from \"$lib/components/account-menu.svelte\";\n  import LanguageSwitch from \"$lib/components/language-switch.svelte\";\n  import ThemeToggle from \"$lib/components/theme-toggle.svelte\";"
+      "text": "import { page } from \"$app/state\";\n  import AccountMenu from \"#lib/components/account-menu.svelte\";\n  import LanguageSwitch from \"#lib/components/language-switch.svelte\";\n  import ThemeToggle from \"#lib/components/theme-toggle.svelte\";"
     },
     {
       "file": "apps/web/src/routes/+page.svelte",
@@ -119,32 +119,22 @@
       "file": "AGENTS.md",
       "marker": "<!-- podokit:end:agents-modules -->",
       "optional": true,
-      "text": "### admin-dashboard\n- The `(admin)` route group and `admin-sidebar.svelte` are the admin-console shell for `/admin/*` only. Put signed-in product pages in `(app)` or in a separate route group with its own layout; do not place them under `(admin)`.\n- Admin console lives at `/admin/*` (users, sessions, organizations, audit, settings, account). Set `ADMIN_EMAILS`, then create or verify the initial account with `npm run admin:bootstrap -w <app>-api`; never commit or persist `ADMIN_BOOTSTRAP_PASSWORD`. When sign-up approval is enabled, self-registered users stay pending until an administrator approves them on `/admin/users`; administrator-created users bypass the queue.\n- Signed-in users can upload, replace, or remove their profile image from `/account` or `/admin/account`. Keep the shared policy visible in custom account UI: PNG, JPEG, or WebP; at most 2 MB and 2048 by 2048 pixels. Use the managed `/api/account/profile-image` endpoints instead of writing directly to storage or `user.image`.\n- `sidebar-user-menu.svelte` is specific to the admin sidebar. For a product shell outside `Sidebar.Provider`, use the managed `<AccountMenu {user} variant=\"identity\" side=\"top\" />` component.\n- Custom protected server layouts must call `requireBackendAvailable(locals)` from `$lib/server/guards` before redirecting anonymous users. This preserves sessions and returns 503 when authentication or maintenance policy cannot be checked.\n- **Every list/table MUST use the shared `$lib/components/data-table.svelte` (`DataTable`)** \u2014 it gives sortable headers + a footer pagination. Add search/filters with `$lib/components/table-toolbar.svelte`. Never assemble `Table.Root`/`Table.Header`/`Table.Body` by hand. For responsive columns, use `hideBelow` and apply the row context's `cellClass(columnKey)` to the matching cell.\n"
+      "text": "### admin-dashboard\n- The `(admin)` route group and `admin-sidebar.svelte` are the admin-console shell for `/admin/*` only. Put signed-in product pages in `(app)` or in a separate route group with its own layout; do not place them under `(admin)`.\n- Admin console lives at `/admin/*` (users, sessions, organizations, audit, settings, account). Set `ADMIN_EMAILS`, then create or verify the initial account with `{{apiRun}} admin:bootstrap{{apiWorkspaceArg}}`; never commit or persist `ADMIN_BOOTSTRAP_PASSWORD`. When sign-up approval is enabled, self-registered users stay pending until an administrator approves them on `/admin/users`; administrator-created users bypass the queue.\n- Signed-in users can upload, replace, or remove their profile image from `/account` or `/admin/account`. Keep the shared policy visible in custom account UI: PNG, JPEG, or WebP; at most 2 MB and 2048 by 2048 pixels. Use the managed `/api/account/profile-image` endpoints instead of writing directly to storage or `user.image`.\n- `sidebar-user-menu.svelte` is specific to the admin sidebar. For a product shell outside `Sidebar.Provider`, use the managed `<AccountMenu {user} variant=\"identity\" side=\"top\" />` component.\n- Custom protected server layouts must call `requireBackendAvailable(locals)` from `#lib/server/guards.js` before redirecting anonymous users. This preserves sessions and returns 503 when authentication or maintenance policy cannot be checked.\n- **Every list/table MUST use the shared `#lib/components/data-table.svelte` (`DataTable`)** \u2014 it gives sortable headers + a footer pagination. Add search/filters with `#lib/components/table-toolbar.svelte`. Never assemble `Table.Root`/`Table.Header`/`Table.Body` by hand. For responsive columns, use `hideBelow` and apply the row context's `cellClass(columnKey)` to the matching cell.\n"
     },
     {
-      "file": "apps/api/src/app.module.ts",
+      "file": "apps/api/src/app.ts",
       "marker": "// podokit:end:imports",
-      "text": "import { SiteSettingsModule } from \"./site-settings/site-settings.module\";"
+      "text": "import { adminModule } from \"./admin.module\";"
     },
     {
-      "file": "apps/api/src/app.module.ts",
-      "marker": "// podokit:end:imports",
-      "text": "import { ProfileImageModule } from \"./profile-image/profile-image.module\";"
-    },
-    {
-      "file": "apps/api/src/app.module.ts",
-      "marker": "// podokit:end:module-imports",
-      "text": "SiteSettingsModule,"
-    },
-    {
-      "file": "apps/api/src/app.module.ts",
-      "marker": "// podokit:end:module-imports",
-      "text": "ProfileImageModule,"
+      "file": "apps/api/src/app.ts",
+      "marker": "// podokit:end:modules",
+      "text": "adminModule,"
     }
   ],
   "instructions": [
-    "Set ADMIN_EMAILS in .env (comma-separated). After building and migrating, inject ADMIN_BOOTSTRAP_EMAIL and ADMIN_BOOTSTRAP_PASSWORD for one command only, then run npm run admin:bootstrap -w <app>-api. The command creates a verified, approved admin or safely verifies an existing one.",
-    "Re-run the auth migration to add the admin and sign-up approval columns:  npx @better-auth/cli migrate -y --config apps/api/src/auth/auth.ts",
+    "Set ADMIN_EMAILS in .env (comma-separated). After building and migrating, inject ADMIN_BOOTSTRAP_EMAIL and ADMIN_BOOTSTRAP_PASSWORD for one command only, then run {{apiRun}} admin:bootstrap{{apiWorkspaceArg}}. The command creates a verified, approved admin or safely verifies an existing one.",
+    "Run all migrations to add the admin and sign-up approval columns: bun run --cwd apps/api migrate:all",
     "Remove ADMIN_BOOTSTRAP_PASSWORD from the environment after bootstrap. Keep ADMIN_EMAILS so matching future sign-ups are promoted consistently.",
     "Admin pages: /admin/users (list, approve pending registrations, ban, set role, revoke sessions). Signed-in users manage their profile, profile image, and security at /account; /admin/account remains available in the admin shell. Profile images accept PNG, JPEG, and WebP up to 2 MB and 2048 by 2048 pixels. Admin, account, authentication, maintenance, and API responses include X-Robots-Tag: noindex, nofollow by default.",
     "Password reset emails go through the mailer module (installed automatically with auth); in dev without SMTP they are logged to the API console. Configure SMTP in admin settings or via SMTP_* env for production."

package/dist/templates/modules/api-key-auth/files/apps/api/src/api-key/api-key-verifier.spec.ts

@@ -1,4 +1,4 @@
-import { afterEach, describe, expect, it } from "@jest/globals";
+import { afterEach, describe, expect, it } from "bun:test";
 import { ApiKeyVerifier } from "./api-key-verifier";
 
 const originalApiKeys = process.env.API_KEYS;