@podosoft/podokit 0.17.4 → 1.0.2

package/dist/templates/modules/auth/files/apps/api/src/settings/settings.service.ts

@@ -1,55 +1,51 @@
-import { Injectable, type OnModuleInit } from "@nestjs/common";
-import { InjectRepository } from "@nestjs/typeorm";
-import { Repository } from "typeorm";
-import { AppSetting } from "./app-setting.entity";
-
+import type { SQL } from "bun";
 import { FLAG_DEFAULTS, FEATURE_FLAGS, type FeatureFlag } from "./flag-defaults";
 
-/** Admin-editable feature flags — the DB (app_setting) is the single source of
- *  truth. Defaults are seeded by the InitAppSettings migration and changed live
- *  from the admin Settings page. Only features whose plugin can be mounted
- *  unconditionally live here; their endpoints are blocked server-side when off
- *  (see auth/feature-gate.ts). Server-enforced flags (email verification, breach
- *  check, self-deletion) and secrets/infra stay in the environment. */
 export { FEATURE_FLAGS, type FeatureFlag };
 
-@Injectable()
-export class SettingsService implements OnModuleInit {
-  private cache = new Map<string, string>();
+interface AppSettingRow {
+  key: string;
+  value: string;
+}
 
-  constructor(@InjectRepository(AppSetting) private readonly repo: Repository<AppSetting>) {}
+/** DB-backed feature flags with migration defaults as the source of truth. */
+export class SettingsService {
+  private cache = new Map<string, string>();
 
-  async onModuleInit(): Promise<void> {
-    await this.refresh();
-  }
+  constructor(private readonly sql: SQL) {}
 
-  private async refresh(): Promise<void> {
+  async refresh(): Promise<void> {
     try {
-      const rows = await this.repo.find();
-      this.cache = new Map(rows.map((r) => [r.key, r.value]));
+      const rows = await this.sql<AppSettingRow[]>`
+        SELECT "key", "value" FROM "app_setting"
+      `;
+      this.cache = new Map(rows.map((row) => [row.key, row.value]));
     } catch {
-      // Table not migrated yet — fall back to the shipped defaults until it exists.
       this.cache = new Map();
     }
   }
 
-  /** DB value (migration-seeded or admin-set); shipped default if the row is missing. */
   getBool(flag: FeatureFlag): boolean {
     const stored = this.cache.get(flag);
-    if (stored !== undefined) return stored === "true";
-    return FLAG_DEFAULTS[flag];
+    return stored === undefined ? FLAG_DEFAULTS[flag] : stored === "true";
   }
 
   flags(): Record<FeatureFlag, boolean> {
-    return Object.fromEntries(FEATURE_FLAGS.map((f) => [f, this.getBool(f)])) as Record<FeatureFlag, boolean>;
+    return Object.fromEntries(
+      FEATURE_FLAGS.map((flag) => [flag, this.getBool(flag)]),
+    ) as Record<FeatureFlag, boolean>;
   }
 
   async setMany(update: Partial<Record<FeatureFlag, boolean>>): Promise<Record<FeatureFlag, boolean>> {
     for (const flag of FEATURE_FLAGS) {
-      const next = update[flag];
-      if (typeof next === "boolean") {
-        await this.repo.save({ key: flag, value: String(next) });
-      }
+      const value = update[flag];
+      if (typeof value !== "boolean") continue;
+      await this.sql`
+        INSERT INTO "app_setting" ("key", "value", "updatedAt")
+        VALUES (${flag}, ${String(value)}, CURRENT_TIMESTAMP)
+        ON CONFLICT ("key") DO UPDATE
+        SET "value" = EXCLUDED."value", "updatedAt" = CURRENT_TIMESTAMP
+      `;
     }
     await this.refresh();
     return this.flags();

package/dist/templates/modules/auth/files/dot-claude/skills/podokit-configure-auth/SKILL.md

@@ -22,7 +22,7 @@ Use the generated `auth:configure` command so credentials enter the encrypted `a
 3. Run Better Auth and TypeORM migrations before configuring a new app:
 
    ```bash
-   npm run migrate:all -w <app>-api
+   {{apiRun}} migrate:all
    ```
 
 4. Create or verify the initial administrator with `admin:bootstrap` before enabling mandatory email verification or other runtime authentication settings.
@@ -53,8 +53,8 @@ credentials for `auth:configure`:
 
 ```bash
 export ADMIN_EMAILS="admin@example.com"
-npm run admin:bootstrap -w <app>-api -- --dry-run
-npm run admin:bootstrap -w <app>-api
+{{apiRun}} admin:bootstrap -- --dry-run
+{{apiRun}} admin:bootstrap
 ```
 
 Unset sensitive variables when finished:
@@ -68,13 +68,13 @@ unset AUTH_SETUP_ADMIN_PASSWORD OAUTH_CLIENT_SECRET SMTP_PASS
 Preview a redacted plan first:
 
 ```bash
-npm run auth:configure -w <app>-api -- --provider google --require-signup-approval --dry-run
+{{apiRun}} auth:configure -- --provider google --require-signup-approval --dry-run
 ```
 
 Apply OAuth credentials and the approval policy:
 
 ```bash
-npm run auth:configure -w <app>-api -- --provider google --require-signup-approval
+{{apiRun}} auth:configure -- --provider google --require-signup-approval
 ```
 
 Configure SMTP separately or in the same run. Passwordless IP-based relays may omit `SMTP_USER` and `SMTP_PASS`.
@@ -84,7 +84,7 @@ export SMTP_HOST="smtp-relay.example.com"
 export SMTP_PORT="587"
 export SMTP_SECURE="false"
 export MAIL_FROM="Example <noreply@example.com>"
-npm run auth:configure -w <app>-api -- --smtp
+{{apiRun}} auth:configure -- --smtp
 ```
 
 ## Verify
@@ -92,7 +92,7 @@ npm run auth:configure -w <app>-api -- --smtp
 1. Check the public capability snapshot:
 
    ```bash
-   npm run auth:configure -w <app>-api -- --provider google --check-only
+   {{apiRun}} auth:configure -- --provider google --check-only
    ```
 
 2. Open `/login` and confirm the provider button appears.

package/dist/templates/modules/auth/files/dot-claude/skills/podokit-configure-auth/references/bootstrap-admin.md

@@ -30,9 +30,9 @@ fallbacks so the same ephemeral values can immediately configure OAuth and SMTP.
 ## Preview, create, and verify
 
 ```bash
-npm run admin:bootstrap -w <app>-api -- --dry-run
-npm run admin:bootstrap -w <app>-api
-npm run admin:bootstrap -w <app>-api -- --check-only
+{{apiRun}} admin:bootstrap -- --dry-run
+{{apiRun}} admin:bootstrap
+{{apiRun}} admin:bootstrap -- --check-only
 ```
 
 The create path writes `role=admin`, `emailVerified=true`, and

package/dist/templates/modules/auth/files/dot-claude/skills/podokit-configure-auth/references/google.md

@@ -34,8 +34,8 @@ preview deployment. Use a separate Google Cloud project and Web client for devel
    export AUTH_SETUP_ADMIN_PASSWORD="<from-secret-manager>"
    export OAUTH_CLIENT_ID="<google-client-id>"
    export OAUTH_CLIENT_SECRET="<from-secret-manager>"
-   npm run auth:configure -w <app>-api -- --provider google --dry-run
-   npm run auth:configure -w <app>-api -- --provider google
+   {{apiRun}} auth:configure -- --provider google --dry-run
+   {{apiRun}} auth:configure -- --provider google
    ```
 
    If only an existing callback is stale, keep the stored client ID, client
@@ -43,7 +43,7 @@ preview deployment. Use a separate Google Cloud project and Web client for devel
 
    ```bash
    AUTH_SETUP_ORIGIN=https://app-dev.example.com \
-     npm run auth:configure -w <app>-api -- --provider google --redirect-only
+     {{apiRun}} auth:configure -- --provider google --redirect-only
    ```
 
 5. Start and finish Google sign-in through the HTTPS origin. Do not mix it with

package/dist/templates/modules/auth/module.manifest.json

@@ -1,6 +1,6 @@
 {
   "name": "auth",
-  "description": "Full authentication (better-auth): email/password, sessions, and \u2014 via config \u2014 OAuth and 2FA. Installs a global guard so the API is secure by default; health and /api/auth stay public.",
+  "description": "Full authentication with Better Auth on Elysia: email/password, sessions, OAuth, organizations, passkeys, API keys, and optional two-factor policies. Installs a secure-by-default request guard.",
   "requires": ["mailer"],
   "targetApp": "api",
   "managedOverrides": [
@@ -9,36 +9,29 @@
   "dependencies": {
     "@podosoft/podokit-auth": "^0.3.0",
     "@podosoft/podokit-contracts": "^0.4.0",
-    "better-auth": "^1.6.23",
-    "@thallesp/nestjs-better-auth": "^2.7.0",
+    "better-auth": "^1.7.1",
     "pg": "^8.12.0",
-    "@better-auth/api-key": "^1.6.23",
-    "@better-auth/passkey": "^1.6.23",
-    "@better-auth/oauth-provider": "^1.6.23"
+    "@better-auth/api-key": "^1.7.1",
+    "@better-auth/passkey": "^1.7.1",
+    "@better-auth/oauth-provider": "^1.7.1"
   },
   "devDependencies": {
     "@types/pg": "^8.11.10"
   },
   "scripts": {
-    "migrate:all": "node dist/migrate",
-    "auth:configure": "node scripts/configure-auth.mjs"
+    "migrate:all": "bun scripts/run-migrations.mjs",
+    "auth:configure": "bun scripts/configure-auth.mjs"
   },
   "env": [
-    "# \u2500\u2500 Auth (better-auth) \u2014 the only required secrets \u2500\u2500",
+    "# ── Auth (Better Auth) — required secrets ──",
     "# BETTER_AUTH_SECRET also derives the key that encrypts config secrets stored in the",
     "# DB (OAuth client secrets, SMTP password). Keep it stable and secret; rotating it",
-    "# makes previously-saved DB secrets undecryptable.",
+    "# makes previously saved DB secrets undecryptable.",
     "BETTER_AUTH_SECRET=change-me-in-production-min-32-characters",
     "BETTER_AUTH_URL=http://localhost:5002",
-    "# Everything below is OPTIONAL. OAuth providers, SMTP, and the server-enforced",
-    "# toggles (email verification, sign-up approval, breached-password check, self-delete) \u2014 plus the",
-    "# feature flags \u2014 are configured on the admin Settings page, stored encrypted in",
-    "# the DB and applied live (no restart). These env vars still work as a fallback/",
-    "# override (e.g. for secrets-manager injection in production); the DB takes",
-    "# precedence when set.",
-    "# --- Optional overrides / local development ---",
+    "# Everything below is optional. OAuth providers, SMTP, and server-enforced",
+    "# toggles are configured on the admin Settings page and applied without restart.",
     "# Email/SMTP is provided by the mailer module (see its .env block).",
-    "# Phone-number SMS webhook (dev: SMS sink on port 8095)",
     "# SMS_WEBHOOK_URL=http://localhost:8095/sms",
     "# AUTH_HIBP=false",
     "# AUTH_EMAIL_VERIFICATION=false",
@@ -52,75 +45,29 @@
   ],
   "inject": [
     {
-      "file": "apps/api/src/app.module.ts",
+      "file": "apps/api/src/app.ts",
       "marker": "// podokit:end:imports",
-      "text": "import { APP_GUARD } from \"@nestjs/core\";"
+      "text": "import { authModule } from \"./auth/auth.module\";"
     },
     {
-      "file": "apps/api/src/app.module.ts",
-      "marker": "// podokit:end:imports",
-      "text": "import { AuthModule, AuthGuard } from \"@thallesp/nestjs-better-auth\";"
-    },
-    {
-      "file": "apps/api/src/app.module.ts",
-      "marker": "// podokit:end:imports",
-      "text": "import { authRuntime } from \"./auth/auth-provider\";"
-    },
-    {
-      "file": "apps/api/src/app.module.ts",
-      "marker": "// podokit:end:imports",
-      "text": "import { AccountModule } from \"./account/account.module\";"
-    },
-    {
-      "file": "apps/api/src/app.module.ts",
-      "marker": "// podokit:end:imports",
-      "text": "import { AuthConfigModule } from \"./auth-config/auth-config.module\";"
-    },
-    {
-      "file": "apps/api/src/app.module.ts",
-      "marker": "// podokit:end:imports",
-      "text": "import { TwoFactorRequiredGuard } from \"./auth/two-factor-required.guard\";"
-    },
-    {
-      "file": "apps/api/src/app.module.ts",
-      "marker": "// podokit:end:module-imports",
-      "text": "AuthModule.forRoot(authRuntime),"
-    },
-    {
-      "file": "apps/api/src/app.module.ts",
-      "marker": "// podokit:end:module-imports",
-      "text": "AccountModule,"
-    },
-    {
-      "file": "apps/api/src/app.module.ts",
-      "marker": "// podokit:end:module-imports",
-      "text": "AuthConfigModule,"
-    },
-    {
-      "file": "apps/api/src/app.module.ts",
-      "marker": "// podokit:end:providers",
-      "text": "{ provide: APP_GUARD, useClass: AuthGuard },"
-    },
-    {
-      "file": "apps/api/src/app.module.ts",
-      "marker": "// podokit:end:providers",
-      "text": "{ provide: APP_GUARD, useClass: TwoFactorRequiredGuard },"
+      "file": "apps/api/src/app.ts",
+      "marker": "// podokit:end:modules",
+      "text": "authModule,"
     },
     {
       "file": "AGENTS.md",
       "marker": "<!-- podokit:end:agents-modules -->",
       "optional": true,
-      "text": "### auth (better-auth)\n- The API is **secure by default**: every route needs a session except `/health` and `/api/auth/*`. Opt a route out with `@Public()`; read the user with `@Session()`.\n- Configure OAuth providers, SMTP, sign-up approval, automatic logout, and the other server toggles on the admin **Settings** page (DB-backed, applied live \u2014 not via env). Only `BETTER_AUTH_SECRET` and `BETTER_AUTH_URL` are required env vars.\n- Use `npm run auth:configure -w <app>-api -- ...` and `.claude/skills/podokit-configure-auth` to apply OAuth/SMTP credentials without committing secrets. The sign-up approval gate is provider-independent; do not add provider-specific approval checks.\n- Development setup: create auth tables with `npx @better-auth/cli migrate -y --config apps/api/src/auth/auth.ts`, then run TypeORM migrations. Production images can run both from compiled output with `npm run migrate:all`.\n"
+      "text": "### auth (Better Auth + Elysia)\n- The API is secure by default: every application route needs a session except health, OpenAPI, `/api/auth/*`, and routes explicitly registered in `ACCESS_POLICY`.\n- Register a public route during module configuration with `services.resolve(ACCESS_POLICY).register(\"GET\", \"/path\", \"public\")`; use `AUTH` and `AuthService.requireSession()` or `requireAdmin()` when a handler needs the current user.\n- Configure OAuth providers, SMTP, sign-up approval, automatic logout, and server toggles on the admin Settings page. Only `BETTER_AUTH_SECRET` and `BETTER_AUTH_URL` are required environment variables.\n- Use `{{apiRun}} auth:configure{{apiWorkspaceArg}} -- ...` and `.claude/skills/podokit-configure-auth` to apply OAuth/SMTP credentials without committing secrets.\n- Run `bun run --cwd apps/api migrate:all` in development and production so Better Auth and application migrations use the versions installed by the app.\n"
     }
   ],
   "instructions": [
-    "Set BETTER_AUTH_SECRET in .env (>= 32 chars). This also derives the key that encrypts config secrets stored in the DB, so keep it stable and secret.",
-    "Create the auth tables:  npx @better-auth/cli migrate -y --config apps/api/src/auth/auth.ts",
-    "Create the app tables (auth_config, app_setting):  npm run migration:run",
-    "After building a production image, run all Better Auth and TypeORM migrations:  npm run migrate:all",
-    "Sign up:  curl -c cookies.txt -XPOST localhost:5002/api/auth/sign-up/email -H 'content-type: application/json' -d '{\"email\":\"a@example.com\",\"password\":\"password123\",\"name\":\"A\"}'",
-    "Call a protected route with the session:  curl -b cookies.txt localhost:5002/account/me",
-    "Use npm run auth:configure -w <app>-api -- --help for redacted OAuth, SMTP, and sign-up approval automation.",
-    "Everything is protected by default; mark public routes with @Public(). Configure OAuth providers, SMTP, automatic logout, and server-enforced toggles on the admin Settings page \u2014 stored in the DB and applied live (no restart). Environment variables (GOOGLE_CLIENT_*, SMTP_*, AUTH_*) still work as an optional fallback/override."
+    "Set BETTER_AUTH_SECRET in .env (at least 32 characters). Keep it stable because it also protects encrypted DB configuration secrets.",
+    "Create the Better Auth and application tables: bun run --cwd apps/api migrate:all",
+    "Run the same migration command after building a production image: bun run --cwd apps/api migrate:all",
+    "Sign up: curl -c cookies.txt -XPOST localhost:5002/api/auth/sign-up/email -H 'content-type: application/json' -d '{\"email\":\"a@example.com\",\"password\":\"password123\",\"name\":\"A\"}'",
+    "Call a protected route with the session: curl -b cookies.txt localhost:5002/account/me",
+    "Use {{apiRun}} auth:configure{{apiWorkspaceArg}} -- --help for redacted OAuth, SMTP, and sign-up approval automation.",
+    "Routes are protected by default. Register intentional public or API-key routes in ACCESS_POLICY during module configuration."
   ]
 }

package/dist/templates/modules/bullmq/files/apps/api/src/jobs/demo.processor.spec.ts

@@ -0,0 +1,10 @@
+import { describe, expect, it } from "bun:test";
+import type { Job } from "bullmq";
+import { processDemoJob } from "./demo.processor";
+
+describe("processDemoJob", () => {
+  it("returns upper-case text", async () => {
+    const job = { data: { text: "hello" } } as Job<{ text: string }>;
+    await expect(processDemoJob(job)).resolves.toEqual({ upper: "HELLO" });
+  });
+});

package/dist/templates/modules/bullmq/files/apps/api/src/jobs/demo.processor.ts

@@ -1,12 +1,6 @@
-import { Processor, WorkerHost } from "@nestjs/bullmq";
 import type { Job } from "bullmq";
-import { DEMO_QUEUE } from "./queue";
 
-@Processor(DEMO_QUEUE)
-export class DemoProcessor extends WorkerHost {
-  async process(job: Job<{ text: string }>): Promise<{ upper: string }> {
-    // Simulate work.
-    await new Promise((resolve) => setTimeout(resolve, 500));
-    return { upper: String(job.data.text ?? "").toUpperCase() };
-  }
+export async function processDemoJob(job: Job<{ text: string }>): Promise<{ upper: string }> {
+  await Bun.sleep(500);
+  return { upper: String(job.data.text ?? "").toUpperCase() };
 }

package/dist/templates/modules/bullmq/files/apps/api/src/jobs/jobs.module.ts

@@ -1,15 +1,37 @@
-import { Module } from "@nestjs/common";
-import { BullModule } from "@nestjs/bullmq";
-import { JobsController } from "./jobs.controller";
+import { AppException } from "@podosoft/podokit-contracts";
+import { Queue } from "bullmq";
+import { Elysia, t } from "elysia";
+import type { AppPlugin, PodokitModule, ServiceKey } from "../core/services";
 import { DEMO_QUEUE, redisConnection } from "./queue";
 
-// Producer side: registers the queue and exposes enqueue/status endpoints.
-// The processor runs in a separate worker process (see main-worker.ts).
-@Module({
-  imports: [
-    BullModule.forRoot({ connection: redisConnection() }),
-    BullModule.registerQueue({ name: DEMO_QUEUE }),
-  ],
-  controllers: [JobsController],
-})
-export class JobsModule {}
+export const JOB_QUEUE = Symbol("job-queue") as ServiceKey<Queue>;
+
+const jobsPlugin: AppPlugin = ({ services }) => {
+  const queue = services.resolve(JOB_QUEUE);
+  return new Elysia({ name: "podokit.jobs" })
+    .post("/jobs", async ({ body, set }) => {
+      const job = await queue.add("demo", { text: body.text });
+      set.status = 201;
+      return { id: job.id };
+    }, {
+      body: t.Object({ text: t.String({ minLength: 1 }) }),
+      detail: { tags: ["jobs"], summary: "Enqueue a job" },
+    })
+    .get("/jobs/:id", async ({ params }) => {
+      const job = await queue.getJob(params.id);
+      if (!job) throw new AppException("JOB_NOT_FOUND", `Job ${params.id} not found`, 404);
+      return { id: job.id, state: await job.getState(), result: job.returnvalue ?? null };
+    }, {
+      params: t.Object({ id: t.String({ minLength: 1 }) }),
+      detail: { tags: ["jobs"], summary: "Read job status" },
+    });
+};
+
+export const jobsModule: PodokitModule = {
+  name: "bullmq",
+  configure: (_env, services): void => {
+    const queue = new Queue(DEMO_QUEUE, { connection: redisConnection() });
+    services.register(JOB_QUEUE, queue, () => queue.close());
+  },
+  plugin: jobsPlugin,
+};

package/dist/templates/modules/bullmq/files/apps/api/src/jobs/worker.module.ts

@@ -1,23 +1,22 @@
-import { Module } from "@nestjs/common";
-import { BullModule } from "@nestjs/bullmq";
-import { DemoProcessor } from "./demo.processor";
+import { Worker, type Processor } from "bullmq";
+import { processDemoJob } from "./demo.processor";
 import { DEMO_QUEUE, redisConnection } from "./queue";
 // podokit:begin:worker-imports
 // podokit:end:worker-imports
 
-// Consumer side: runs BullMQ processors. Bootstrapped by main-worker.ts as a
-// separate process so workers scale independently of the API.
-@Module({
-  imports: [
-    BullModule.forRoot({ connection: redisConnection() }),
-    BullModule.registerQueue({ name: DEMO_QUEUE }),
-    // podokit:begin:worker-queues
-    // podokit:end:worker-queues
-  ],
-  providers: [
-    DemoProcessor,
-    // podokit:begin:worker-providers
-    // podokit:end:worker-providers
-  ],
-})
-export class WorkerModule {}
+interface WorkerDefinition {
+  queue: string;
+  processor: Processor;
+}
+
+const definitions: WorkerDefinition[] = [
+  { queue: DEMO_QUEUE, processor: processDemoJob },
+  // podokit:begin:worker-processors
+  // podokit:end:worker-processors
+];
+
+export function startWorkers(): Worker[] {
+  return definitions.map(({ queue, processor }) =>
+    new Worker(queue, processor, { connection: redisConnection() })
+  );
+}

package/dist/templates/modules/bullmq/files/apps/api/src/main-worker.ts

@@ -1,14 +1,16 @@
 import "dotenv/config";
-import { NestFactory } from "@nestjs/core";
-import { WorkerModule } from "./jobs/worker.module";
+import { startWorkers } from "./jobs/worker.module";
 
-// Runs BullMQ processors in their own process (no HTTP server).
-async function bootstrap(): Promise<void> {
-  const app = await NestFactory.createApplicationContext(WorkerModule);
-  await app.init();
-  // Keep the process alive to consume jobs.
-  process.on("SIGINT", () => void app.close().then(() => process.exit(0)));
-  process.on("SIGTERM", () => void app.close().then(() => process.exit(0)));
+const workers = startWorkers();
+
+for (const worker of workers) {
+  worker.on("failed", (job, error) => {
+    process.stderr.write(`Process job failed: ${job?.id ?? "unknown"} ${error.message}\n`);
+  });
 }
 
-void bootstrap();
+for (const signal of ["SIGINT", "SIGTERM"] as const) {
+  process.once(signal, () => {
+    void Promise.all(workers.map((worker) => worker.close())).finally(() => process.exit(0));
+  });
+}

package/dist/templates/modules/bullmq/files/infra/docker/worker.compose.example.yml

@@ -10,7 +10,7 @@ services:
     build:
       context: ../..
       dockerfile: apps/api/Dockerfile
-    command: ["node", "dist/main-worker"]
+    command: ["{{runtimeCommand}}", "dist/main-worker.js"]
     environment:
       REDIS_HOST: redis
       REDIS_PORT: "6379"

package/dist/templates/modules/bullmq/files/infra/k3s/worker-deployment.yaml

@@ -17,7 +17,7 @@ spec:
       containers:
         - name: worker
           image: ghcr.io/example/podokit-api:v0.0.0
-          command: ["node", "dist/main-worker"]
+          command: ["{{runtimeCommand}}", "dist/main-worker.js"]
           envFrom:
             - configMapRef: { name: app-config }
             - secretRef: { name: app-secrets }

package/dist/templates/modules/bullmq/module.manifest.json

@@ -7,31 +7,30 @@
   ],
   "targetApp": "api",
   "dependencies": {
-    "@nestjs/bullmq": "^11.0.4",
     "bullmq": "^5.34.0"
   },
   "scripts": {
-    "start:worker": "node dist/main-worker",
-    "dev:worker": "nest start --watch --builder swc --entryFile main-worker"
+    "start:worker": "bun dist/main-worker.js",
+    "dev:worker": "bun --watch src/main-worker.ts"
   },
   "env": [
     "# bullmq uses REDIS_URL or the individual Redis settings defined above"
   ],
   "inject": [
     {
-      "file": "apps/api/src/app.module.ts",
+      "file": "apps/api/src/app.ts",
       "marker": "// podokit:end:imports",
-      "text": "import { JobsModule } from \"./jobs/jobs.module\";"
+      "text": "import { jobsModule } from \"./jobs/jobs.module\";"
     },
     {
-      "file": "apps/api/src/app.module.ts",
-      "marker": "// podokit:end:module-imports",
-      "text": "JobsModule,"
+      "file": "apps/api/src/app.ts",
+      "marker": "// podokit:end:modules",
+      "text": "jobsModule,"
     }
   ],
   "instructions": [
     "Ensure Redis is running:  docker compose -f infra/docker/docker-compose.yml up -d",
-    "Run the worker in a separate terminal:  npm run dev:worker -w <app>-api",
+    "Run the worker in a separate terminal:  {{apiRun}} dev:worker{{apiWorkspaceArg}}",
     "Enqueue a job:  curl -XPOST localhost:5002/jobs -H 'content-type: application/json' -d '{\"text\":\"hello\"}'",
     "Check status:   curl localhost:5002/jobs/<id>  (state goes waiting -> active -> completed)",
     "Deploy the worker as its own process: k3s manifest added at infra/k3s/worker-deployment.yaml; Docker Compose example at infra/docker/worker.compose.example.yml"

package/dist/templates/modules/file-upload/files/apps/api/src/files/files.module.ts

@@ -1,9 +1,29 @@
-import { Module } from "@nestjs/common";
-import { FilesController } from "./files.controller";
+import { Elysia, t } from "elysia";
+import type { AppPlugin, PodokitModule } from "../core/services";
+import { STORAGE } from "../storage/storage.module";
 
-// Uploads are stored through StorageService, provided globally by the
-// object-storage-s3 module.
-@Module({
-  controllers: [FilesController],
-})
-export class FilesModule {}
+const filesPlugin: AppPlugin = ({ services }) => {
+  const storage = services.resolve(STORAGE);
+  return new Elysia({ name: "podokit.files" })
+    .post("/files", async ({ body, set }) => {
+      const safeName = body.file.name.replace(/[^\w.-]+/g, "_");
+      const key = `uploads/${crypto.randomUUID()}-${safeName}`;
+      await storage.put(key, new Uint8Array(await body.file.arrayBuffer()), body.file.type);
+      set.status = 201;
+      return { key, url: await storage.presignedGetUrl(key) };
+    }, {
+      body: t.Object({ file: t.File() }),
+      detail: { tags: ["files"], summary: "Upload a file" },
+    })
+    .get("/files/:key/url", async ({ params }) => ({
+      url: await storage.presignedGetUrl(params.key),
+    }), {
+      params: t.Object({ key: t.String({ minLength: 1 }) }),
+      detail: { tags: ["files"], summary: "Presign a file download" },
+    });
+};
+
+export const filesModule: PodokitModule = {
+  name: "file-upload",
+  plugin: filesPlugin,
+};

package/dist/templates/modules/file-upload/files/tests/api/files.api.spec.ts

@@ -15,11 +15,16 @@ test("file upload: multipart upload returns a key and url @smoke", async ({ play
   const res = await ctx.post("/api/files", {
     multipart: { file: { name: "hello.txt", mimeType: "text/plain", buffer: Buffer.from("hi there") } },
   });
+  const responseText = await res.text();
   test.skip(res.status() >= 500, "object storage (MinIO/S3) not reachable");
-  expect(res.ok()).toBeTruthy();
-  const body = await res.json();
-  expect(typeof body.key).toBe("string");
-  expect(String(body.url)).toContain("http");
+  expect(res.ok(), `upload returned ${res.status()}: ${responseText}`).toBeTruthy();
+  const body = JSON.parse(responseText) as unknown;
+  expect(typeof body).toBe("object");
+  expect(body).not.toBeNull();
+  if (typeof body !== "object" || body === null) throw new Error("upload response must be an object");
+  const response = body as Record<string, unknown>;
+  expect(typeof response.key).toBe("string");
+  expect(String(response.url)).toContain("http");
   await ctx.dispose();
 });
 

package/dist/templates/modules/file-upload/module.manifest.json

@@ -3,13 +3,10 @@
   "description": "Multipart file upload endpoint that stores files via object storage and returns a presigned URL.",
   "requires": ["object-storage-s3"],
   "targetApp": "api",
-  "devDependencies": {
-    "@types/multer": "^1.4.12"
-  },
   "env": [],
   "inject": [
-    { "file": "apps/api/src/app.module.ts", "marker": "// podokit:end:imports", "text": "import { FilesModule } from \"./files/files.module\";" },
-    { "file": "apps/api/src/app.module.ts", "marker": "// podokit:end:module-imports", "text": "FilesModule," }
+    { "file": "apps/api/src/app.ts", "marker": "// podokit:end:imports", "text": "import { filesModule } from \"./files/files.module\";" },
+    { "file": "apps/api/src/app.ts", "marker": "// podokit:end:modules", "text": "filesModule," }
   ],
   "instructions": [
     "Start MinIO (or configure AWS S3):  docker compose -f infra/docker/docker-compose.yml -f infra/docker/minio.compose.yml up -d",