@podosoft/podokit 0.17.4 → 1.0.2

package/dist/templates/fullstack-nest-svelte/apps/web/src/lib/server/ws-upgrade.js

@@ -1,267 +0,0 @@
-/**
- * WebSocket upgrades, proxied by the web server itself.
- *
- * WHY THIS EXISTS: a SvelteKit server route cannot serve a WebSocket upgrade.
- * `+server.ts` handlers answer HTTP requests and never see an `upgrade` event, and
- * the `/api/*` proxy is HTTP-only for the same reason — `fetch` cannot carry a 101.
- * Meanwhile a deployment routes all public traffic to the web app, so an API
- * WebSocket gateway has no path to reach at all. Development hides this, because
- * Vite proxies upgrades; the feature then dies silently once deployed.
- *
- * ⚠ NOTHING IS FORWARDED BY DEFAULT. `WS_PROXY_PATHS` names the exact paths that may
- * upgrade, comma-separated, and anything else is destroyed rather than proxied. A
- * relay that forwards any path is an open tunnel to every private route on the API,
- * reachable from the public origin without a session. Adding a path is a security
- * decision, not a routing tweak — the API must authorise that socket at handshake
- * time, from the session cookie or its own credential.
- *
- * This file is plain JavaScript on purpose: `server.js` imports `./build/`, which
- * only exists after a build, so the entry point cannot be type-checked. Everything
- * with a decision in it lives here, where it is unit-tested.
- */
-import http from "node:http";
-import https from "node:https";
-
-/** @typedef {Record<string, string | string[] | undefined>} Headers */
-/** @typedef {{ kind: "proxy", path: string } | { kind: "reject", reason: string }} UpgradeDecision */
-
-/**
- * The upgrade paths this deployment allows, matched whole — never as a prefix, a
- * wildcard, or a pattern.
- *
- * @returns {ReadonlySet<string>}
- */
-export function relayPaths() {
-  return new Set(
-    (process.env.WS_PROXY_PATHS ?? "")
-      .split(",")
-      .map((entry) => entry.trim())
-      .filter((entry) => entry.startsWith("/")),
-  );
-}
-
-/** Where upgrades are sent. Same target the HTTP proxy uses. */
-export function backendBaseUrl() {
-  return process.env.BACKEND_INTERNAL_URL ?? "http://localhost:5002";
-}
-
-/**
- * Normalize a client address for the forwarded header: map loopback to a clean IPv4
- * value and unwrap IPv4-mapped addresses.
- *
- * @param {string | undefined} address
- * @returns {string | undefined}
- */
-export function normalizeClientIp(address) {
-  if (!address) return undefined;
-  if (address === "::1" || address === "::") return "127.0.0.1";
-  if (address.startsWith("::ffff:")) return address.slice("::ffff:".length);
-  return address;
-}
-
-/**
- * Should this upgrade be forwarded, and under which normalized path?
- *
- * The path is re-serialised from `URL` rather than echoed, so a target that only
- * looks like an allowed path after resolving `..` cannot reach anything else. A
- * request target carrying its own authority is refused outright.
- *
- * @param {string | undefined} url `req.url`, an origin-form request target
- * @param {Headers} headers
- * @param {ReadonlySet<string>} [allowed]
- * @returns {UpgradeDecision}
- */
-export function decideUpgrade(url, headers, allowed = relayPaths()) {
-  const upgrade = String(headers.upgrade ?? "").toLowerCase();
-  if (upgrade !== "websocket") return { kind: "reject", reason: "not a websocket upgrade" };
-  if (!url || !url.startsWith("/") || url.startsWith("//")) {
-    return { kind: "reject", reason: "not an origin-form request target" };
-  }
-  let parsed;
-  try {
-    parsed = new URL(url, "http://upgrade.invalid");
-  } catch {
-    return { kind: "reject", reason: "unparsable request target" };
-  }
-  if (!allowed.has(parsed.pathname)) return { kind: "reject", reason: "not an allowed upgrade path" };
-  return { kind: "proxy", path: `${parsed.pathname}${parsed.search}` };
-}
-
-/**
- * What the API is told about the request.
- *
- * Handshake headers and the session cookie pass through untouched — the API
- * authorises the socket from them, so dropping either turns every connection into a
- * 401. The `x-forwarded-*` trio is appended rather than replaced: behind another
- * proxy this server is one hop in a chain, and overwriting it reports the wrong
- * client upstream.
- *
- * @param {Headers} headers
- * @param {{ remoteAddress?: string, encrypted?: boolean }} socket
- * @returns {Headers}
- */
-export function upstreamHeaders(headers, socket) {
-  /** @type {Headers} */
-  const forwarded = {};
-  for (const [name, value] of Object.entries(headers)) {
-    if (value === undefined) continue;
-    if (name === "x-forwarded-for" || name === "x-forwarded-proto" || name === "x-forwarded-host") {
-      continue;
-    }
-    forwarded[name] = value;
-  }
-
-  const client = normalizeClientIp(socket.remoteAddress);
-  const chain = [headers["x-forwarded-for"], client]
-    .flat()
-    .filter((entry) => typeof entry === "string" && entry.length > 0);
-  if (chain.length > 0) forwarded["x-forwarded-for"] = chain.join(", ");
-
-  forwarded["x-forwarded-proto"] = headers["x-forwarded-proto"] ?? (socket.encrypted ? "https" : "http");
-  const host = headers["x-forwarded-host"] ?? headers.host;
-  if (host !== undefined) forwarded["x-forwarded-host"] = host;
-
-  return forwarded;
-}
-
-/**
- * @param {string} path
- * @param {Headers} headers
- */
-export function upstreamOptions(path, headers) {
-  const base = new URL(backendBaseUrl());
-  return {
-    protocol: base.protocol,
-    hostname: base.hostname,
-    port: base.port || (base.protocol === "https:" ? "443" : "80"),
-    path,
-    headers,
-  };
-}
-
-/**
- * @param {string} statusLine
- * @param {Headers} headers
- * @returns {string}
- */
-function rawHead(statusLine, headers) {
-  const lines = [statusLine];
-  for (const [name, value] of Object.entries(headers)) {
-    if (value === undefined) continue;
-    if (Array.isArray(value)) for (const item of value) lines.push(`${name}: ${item}`);
-    else lines.push(`${name}: ${value}`);
-  }
-  return `${lines.join("\r\n")}\r\n\r\n`;
-}
-
-/**
- * Streaming sockets carry many small frames, so Nagle's algorithm adds latency to
- * every one, and the default timeout would cut an idle-but-attached connection.
- *
- * @param {{ setTimeout?: Function, setNoDelay?: Function, setKeepAlive?: Function }} socket
- */
-function tune(socket) {
-  socket.setTimeout?.(0);
-  socket.setNoDelay?.(true);
-  socket.setKeepAlive?.(true, 0);
-}
-
-/** The real transport: one upstream HTTP request carrying the upgrade. */
-const nodeConnect = (options, hooks) => {
-  const transport = options.protocol === "https:" ? https : http;
-  const upstream = transport.request({
-    protocol: options.protocol,
-    hostname: options.hostname,
-    port: options.port,
-    path: options.path,
-    method: "GET",
-    headers: options.headers,
-  });
-  upstream.on("upgrade", (response, socket, head) => {
-    hooks.onUpgrade(response.statusCode ?? 101, response.headers, socket, head);
-  });
-  upstream.on("response", (response) => {
-    hooks.onResponse(response.statusCode ?? 502, response.statusMessage ?? "", response.headers);
-    response.resume(); // Drain, or the socket is never released.
-  });
-  upstream.on("error", (error) => hooks.onError(error.message));
-  upstream.end();
-  return { abort: () => upstream.destroy() };
-};
-
-/**
- * @typedef {object} UpstreamHooks
- * @property {(status: number, headers: Headers, socket: any, head: Uint8Array | null) => void} onUpgrade
- * @property {(status: number, statusMessage: string, headers: Headers) => void} onResponse
- * @property {(reason: string) => void} onError
- */
-
-/** @typedef {(options: ReturnType<typeof upstreamOptions>, hooks: UpstreamHooks) => { abort: () => void }} Connect */
-
-/**
- * Build the `upgrade` listener the built server mounts.
- *
- * The transport is injected so the decisions here are testable without a socket.
- *
- * @param {{ connect?: Connect, allowed?: ReadonlySet<string> }} [options]
- */
-export function createUpgradeProxy(options = {}) {
-  const connect = options.connect ?? nodeConnect;
-  const allowed = options.allowed ?? relayPaths();
-
-  return function onUpgrade(request, socket, head) {
-    const decision = decideUpgrade(request.url, request.headers, allowed);
-    if (decision.kind === "reject") {
-      socket.destroy();
-      return;
-    }
-
-    tune(socket);
-    // Bytes the client already sent belong to the stream: push them back so the pipe
-    // below carries them upstream in order.
-    if (head && head.length > 0) socket.unshift(head);
-
-    let clientGone = false;
-    const upstream = connect(
-      upstreamOptions(decision.path, upstreamHeaders(request.headers, socket)),
-      {
-        onUpgrade(status, headers, upstreamSocket, upstreamHead) {
-          if (clientGone) {
-            upstreamSocket.destroy();
-            return;
-          }
-          if (upstreamHead && upstreamHead.length > 0) upstreamSocket.unshift(upstreamHead);
-          tune(upstreamSocket);
-          socket.write(rawHead(`HTTP/1.1 ${status} Switching Protocols`, headers));
-          // A client that hangs forever is worse than one told it lost the relay, so
-          // either end closing takes the other down.
-          upstreamSocket.on("error", () => socket.destroy());
-          upstreamSocket.on("close", () => socket.end());
-          upstreamSocket.pipe(socket);
-          socket.pipe(upstreamSocket);
-        },
-        onResponse(status, statusMessage, headers) {
-          // The API refused the handshake. Relaying ITS answer is what turns "the
-          // socket vanished" into a diagnosable failure in the browser.
-          socket.write(
-            rawHead(`HTTP/1.1 ${status} ${statusMessage}`.trim(), {
-              ...headers,
-              connection: "close",
-            }),
-          );
-          socket.end();
-        },
-        onError() {
-          socket.write(rawHead("HTTP/1.1 502 Bad Gateway", { connection: "close" }));
-          socket.end();
-        },
-      },
-    );
-
-    socket.on("error", () => upstream.abort());
-    socket.on("close", () => {
-      clientGone = true;
-      upstream.abort();
-    });
-  };
-}

package/dist/templates/fullstack-nest-svelte/apps/web/src/lib/server/ws-upgrade.test.js

@@ -1,134 +0,0 @@
-import { PassThrough } from "node:stream";
-import { describe, expect, it } from "vitest";
-import { createUpgradeProxy, decideUpgrade, upstreamHeaders } from "./ws-upgrade.js";
-
-const allowed = new Set(["/events/ws"]);
-const handshake = { upgrade: "websocket", connection: "Upgrade", host: "app.example.com" };
-
-describe("decideUpgrade", () => {
-  it("forwards an allowed path", () => {
-    expect(decideUpgrade("/events/ws", handshake, allowed)).toEqual({
-      kind: "proxy",
-      path: "/events/ws",
-    });
-  });
-
-  it("keeps the query string", () => {
-    expect(decideUpgrade("/events/ws?room=1", handshake, allowed)).toEqual({
-      kind: "proxy",
-      path: "/events/ws?room=1",
-    });
-  });
-
-  it.each([
-    ["/events/wsx", "a path that only starts the same"],
-    ["/events/ws/", "a trailing slash"],
-    ["/admin/secrets", "an unrelated path"],
-    ["/events/../admin/secrets", "traversal that resolves elsewhere"],
-    ["//evil.example.com/events/ws", "a protocol-relative target"],
-    ["http://evil.example.com/events/ws", "an absolute target"],
-  ])("rejects %s (%s)", (url) => {
-    expect(decideUpgrade(url, handshake, allowed).kind).toBe("reject");
-  });
-
-  it("rejects a request that is not a websocket upgrade", () => {
-    expect(decideUpgrade("/events/ws", { ...handshake, upgrade: "h2c" }, allowed).kind).toBe(
-      "reject",
-    );
-  });
-
-  it("forwards nothing when no path is configured", () => {
-    expect(decideUpgrade("/events/ws", handshake, new Set()).kind).toBe("reject");
-  });
-});
-
-describe("upstreamHeaders", () => {
-  it("passes the handshake and cookie through", () => {
-    const headers = upstreamHeaders(
-      { ...handshake, cookie: "session=abc", "sec-websocket-key": "k" },
-      {},
-    );
-    expect(headers.cookie).toBe("session=abc");
-    expect(headers["sec-websocket-key"]).toBe("k");
-    expect(headers.upgrade).toBe("websocket");
-  });
-
-  it("appends to an existing forwarded chain rather than replacing it", () => {
-    const headers = upstreamHeaders(
-      { ...handshake, "x-forwarded-for": "203.0.113.7" },
-      { remoteAddress: "::ffff:10.0.0.2" },
-    );
-    expect(headers["x-forwarded-for"]).toBe("203.0.113.7, 10.0.0.2");
-  });
-
-  it("reports the scheme the client actually used", () => {
-    expect(upstreamHeaders(handshake, { encrypted: true })["x-forwarded-proto"]).toBe("https");
-    expect(upstreamHeaders(handshake, {})["x-forwarded-proto"]).toBe("http");
-  });
-});
-
-describe("createUpgradeProxy", () => {
-  function socket() {
-    const stream = new PassThrough();
-    stream.destroy = () => {
-      stream.destroyed = true;
-      return stream;
-    };
-    return stream;
-  }
-
-  it("destroys a rejected upgrade without contacting the API", () => {
-    let called = false;
-    const proxy = createUpgradeProxy({ allowed, connect: () => ((called = true), { abort() {} }) });
-    const client = socket();
-    proxy({ url: "/admin/secrets", headers: handshake }, client, null);
-    expect(called).toBe(false);
-    expect(client.destroyed).toBe(true);
-  });
-
-  it("relays the API's refusal instead of dropping the socket", () => {
-    const proxy = createUpgradeProxy({
-      allowed,
-      connect: (_options, hooks) => {
-        hooks.onResponse(401, "Unauthorized", { "content-length": "0" });
-        return { abort() {} };
-      },
-    });
-    const client = socket();
-    /** @type {string[]} */
-    const written = [];
-    client.on("data", (chunk) => written.push(chunk.toString()));
-    proxy({ url: "/events/ws", headers: handshake }, client, null);
-    expect(written.join("")).toContain("HTTP/1.1 401 Unauthorized");
-  });
-
-  it("answers 502 when the API cannot be reached", () => {
-    const proxy = createUpgradeProxy({
-      allowed,
-      connect: (_options, hooks) => (hooks.onError("ECONNREFUSED"), { abort() {} }),
-    });
-    const client = socket();
-    /** @type {string[]} */
-    const written = [];
-    client.on("data", (chunk) => written.push(chunk.toString()));
-    proxy({ url: "/events/ws", headers: handshake }, client, null);
-    expect(written.join("")).toContain("HTTP/1.1 502 Bad Gateway");
-  });
-
-  it("writes the 101 and pipes both directions once upstream upgrades", () => {
-    const upstream = socket();
-    const proxy = createUpgradeProxy({
-      allowed,
-      connect: (_options, hooks) => {
-        hooks.onUpgrade(101, { upgrade: "websocket" }, upstream, null);
-        return { abort() {} };
-      },
-    });
-    const client = socket();
-    /** @type {string[]} */
-    const written = [];
-    client.on("data", (chunk) => written.push(chunk.toString()));
-    proxy({ url: "/events/ws", headers: handshake }, client, null);
-    expect(written.join("")).toContain("HTTP/1.1 101 Switching Protocols");
-  });
-});

package/dist/templates/fullstack-nest-svelte/apps/web/src/routes/+layout.svelte

@@ -1,9 +0,0 @@
-<script lang="ts">
-  import "../app.css";
-  import SiteRuntime from "$lib/components/site-runtime.svelte";
-
-  let { children } = $props();
-</script>
-
-<SiteRuntime />
-{@render children()}

package/dist/templates/fullstack-nest-svelte/apps/web/src/routes/api/[...path]/+server.ts

@@ -1,16 +0,0 @@
-import type { RequestHandler } from "@sveltejs/kit";
-import { backendBaseUrl, proxyRequest, resolveClientIp } from "$lib/server/backend-proxy";
-
-// Proxy the app's REST API, stripping the /api prefix (backend routes are at root).
-const handler: RequestHandler = ({ request, params, url, getClientAddress }) =>
-  proxyRequest(
-    request,
-    `${backendBaseUrl()}/${params.path}${url.search}`,
-    resolveClientIp(getClientAddress),
-  );
-
-export const GET = handler;
-export const POST = handler;
-export const PUT = handler;
-export const PATCH = handler;
-export const DELETE = handler;

package/dist/templates/fullstack-nest-svelte/apps/web/svelte.config.js

@@ -1,15 +0,0 @@
-import adapter from "@sveltejs/adapter-node";
-import { vitePreprocess } from "@sveltejs/vite-plugin-svelte";
-
-/** @type {import('@sveltejs/kit').Config} */
-const config = {
-  preprocess: vitePreprocess(),
-  kit: {
-    adapter: adapter(),
-    alias: {
-      $i18n: "src/lib/i18n",
-    },
-  },
-};
-
-export default config;

package/dist/templates/fullstack-nest-svelte/apps/web/tsconfig.json

@@ -1,9 +0,0 @@
-{
-  "extends": "./.svelte-kit/tsconfig.json",
-  "compilerOptions": {
-    "strict": true,
-    "moduleResolution": "bundler",
-    "esModuleInterop": true,
-    "skipLibCheck": true
-  }
-}

package/dist/templates/fullstack-nest-svelte/apps/web/vite.config.ts

@@ -1,29 +0,0 @@
-import { sveltekit } from "@sveltejs/kit/vite";
-import tailwindcss from "@tailwindcss/vite";
-import { defineConfig } from "vite";
-
-// Inside the dev container, bind to all interfaces and accept local gateway or
-// HTTPS tunnel hostnames. Vite derives HMR's protocol, host, and port from the
-// browser origin so the same configuration works for both entry points.
-const inDocker = process.env.VITE_DOCKER === "1";
-
-// Dev parity for WebSocket upgrades. In production `server.js` proxies these paths to
-// the API; without the same allowlist here, a feature would work in one and not the
-// other -- which is exactly how a WebSocket gateway used to reach production dead.
-// Set WS_PROXY_PATHS in the shell that runs vite; a .env file cannot reach this file.
-const wsProxyPaths = (process.env.WS_PROXY_PATHS ?? "")
-  .split(",")
-  .map((entry) => entry.trim())
-  .filter((entry) => entry.startsWith("/"));
-const backendTarget = process.env.BACKEND_INTERNAL_URL ?? "http://localhost:5002";
-const wsProxy = Object.fromEntries(
-  wsProxyPaths.map((path) => [path, { target: backendTarget, ws: true, changeOrigin: false }]),
-);
-
-export default defineConfig({
-  plugins: [tailwindcss(), sveltekit()],
-  server: {
-    ...(inDocker ? { host: true, port: 5001, allowedHosts: true } : {}),
-    ...(wsProxyPaths.length ? { proxy: wsProxy } : {}),
-  },
-});

package/dist/templates/fullstack-nest-svelte/compose.dev.yaml

@@ -1,162 +0,0 @@
-# Containerized development environment.
-#
-#   podo dev watch   # installed modules activate their required profiles
-#
-# A user-level PodoKit gateway owns loopback :80 and routes each *.localhost host
-# to this stack. The legacy per-project Traefik service is opt-in only.
-# api/postgres/redis/minio have NO published ports — they talk by service name
-# on the internal network, so this stack never collides with other projects.
-#
-# Core services (traefik, web, api, postgres) always run. PodoKit activates
-# module-specific profiles from .podokit/manifest.json:
-#   --profile cache    redis    (redis / rate-limit / bullmq modules)
-#   --profile storage  minio    (object-storage-s3 / file-upload modules)
-#   --profile queue    worker   (bullmq / job-progress modules)
-#
-# `watch` syncs your edits into the containers: the web has instant vite HMR;
-# an API source change restarts the api service (~5s), which is the stable
-# approach for nest inside a container.
-name: {{projectName}}-dev
-
-services:
-  traefik:
-    profiles: [podokit-legacy-proxy]
-    image: traefik:v3.5
-    command:
-      - --providers.file.filename=/etc/traefik/dynamic.yml
-      - --providers.file.watch=true
-      - --entrypoints.web.address=:80
-      - --api.dashboard=true
-      - --api.insecure=true
-    ports:
-      - "${TRAEFIK_PORT:-80}:80"
-      - "127.0.0.1:${TRAEFIK_DASHBOARD_PORT:-8080}:8080" # Traefik dashboard (dev only)
-    volumes:
-      - ./infra/traefik/dynamic.yml:/etc/traefik/dynamic.yml:ro
-    networks: [podokit]
-
-  web:
-    build:
-      context: .
-      dockerfile: Dockerfile.dev
-      args:
-        PODOKIT_NPM_REGISTRY: ${PODOKIT_NPM_REGISTRY:-}
-    command: npm run dev -w {{projectName}}-web -- --host 0.0.0.0
-    working_dir: /app
-    env_file: .env.docker
-    environment:
-      - VITE_DOCKER=1
-      - BACKEND_INTERNAL_URL=http://api:5002
-      # One trusted Traefik proxy sits in front of SvelteKit. This keeps
-      # getClientAddress() tied to the visitor instead of the proxy container.
-      - ADDRESS_HEADER=x-forwarded-for
-      - XFF_DEPTH=1
-    depends_on: [api]
-    networks: [podokit]
-    develop:
-      watch:
-        - { action: sync, path: ./apps/web/src, target: /app/apps/web/src }
-        - { action: sync, path: ./apps/web/static, target: /app/apps/web/static }
-        - { action: sync+restart, path: ./apps/web/vite.config.ts, target: /app/apps/web/vite.config.ts }
-        - { action: rebuild, path: ./apps/web/package.json }
-
-  api:
-    build:
-      context: .
-      dockerfile: Dockerfile.dev
-      args:
-        PODOKIT_NPM_REGISTRY: ${PODOKIT_NPM_REGISTRY:-}
-    init: true
-    command: npm run dev -w {{projectName}}-api
-    working_dir: /app
-    env_file: .env.docker
-    depends_on:
-      postgres: { condition: service_healthy }
-    networks: [podokit]
-    develop:
-      watch:
-        # nest-cli's in-container watch does not reliably respawn the app process,
-        # so restart the service on an API source change (~5s). The Docker docs'
-        # sync+restart is the stable, recommended approach; the web keeps instant
-        # HMR via plain sync.
-        - { action: sync+restart, path: ./apps/api/src, target: /app/apps/api/src }
-        - { action: sync, path: ./apps/api/scripts, target: /app/apps/api/scripts }
-        - { action: rebuild, path: ./apps/api/package.json }
-
-  worker:
-    # started only with the bullmq / job-progress modules: --profile queue
-    profiles: [queue]
-    build:
-      context: .
-      dockerfile: Dockerfile.dev
-      args:
-        PODOKIT_NPM_REGISTRY: ${PODOKIT_NPM_REGISTRY:-}
-    init: true
-    command: npm run dev:worker -w {{projectName}}-api
-    working_dir: /app
-    env_file: .env.docker
-    depends_on:
-      redis: { condition: service_started }
-    networks: [podokit]
-    develop:
-      watch:
-        # nest-cli's in-container watch does not reliably respawn the app process,
-        # so restart the service on an API source change (~5s). The Docker docs'
-        # sync+restart is the stable, recommended approach; the web keeps instant
-        # HMR via plain sync.
-        - { action: sync+restart, path: ./apps/api/src, target: /app/apps/api/src }
-        - { action: sync, path: ./apps/api/scripts, target: /app/apps/api/scripts }
-        - { action: rebuild, path: ./apps/api/package.json }
-
-  postgres:
-    image: postgres:16-alpine
-    environment:
-      POSTGRES_USER: podokit
-      POSTGRES_PASSWORD: podokit
-      POSTGRES_DB: podokit
-    healthcheck:
-      test: ["CMD-SHELL", "pg_isready -U podokit"]
-      interval: 3s
-      timeout: 3s
-      retries: 20
-    volumes:
-      - pgdata:/var/lib/postgresql/data
-    networks: [podokit] # no published ports — internal only
-
-  redis:
-    # started only with the redis / rate-limit / bullmq modules: --profile cache
-    profiles: [cache]
-    image: redis:7-alpine
-    networks: [podokit] # internal only
-
-  minio:
-    # started only with the object-storage-s3 / file-upload modules: --profile storage
-    profiles: [storage]
-    image: minio/minio:latest
-    command: server /data --console-address ":9001"
-    environment:
-      MINIO_ROOT_USER: podokit
-      MINIO_ROOT_PASSWORD: podokitsecret
-    volumes:
-      - miniodata:/data
-    networks: [podokit] # internal only
-
-  minio-init:
-    profiles: [storage]
-    image: minio/mc:latest
-    depends_on:
-      minio: { condition: service_started }
-    entrypoint:
-      - sh
-      - -c
-      - |
-        until mc alias set loc http://minio:9000 podokit podokitsecret; do sleep 1; done
-        mc mb -p loc/podokit || true
-    networks: [podokit]
-
-networks:
-  podokit: {}
-
-volumes:
-  pgdata: {}
-  miniodata: {}

package/dist/templates/fullstack-nest-svelte/dot-claude/skills/podokit-add-module/SKILL.md

@@ -1,27 +0,0 @@
----
-name: podokit-add-module
-description: Use when the user wants a feature that a PodoKit module already provides (authentication, an admin dashboard, Redis, background jobs/queues, object storage, file uploads, SSE, rate limiting, logging). Prefer adding the module over hand-writing it.
----
-
-# Add a PodoKit module
-
-Before building auth, an admin panel, queues, storage, etc. by hand, check
-whether a module provides it — modules wire themselves into the app correctly.
-
-```bash
-podo add                 # list available modules
-podo add <module>        # e.g. auth, admin-dashboard, redis, bullmq, file-upload
-npm install              # install newly-added dependencies
-```
-
-Common modules: `auth` (better-auth: email/password, sessions, OAuth, 2FA,
-secure-by-default), `admin-dashboard` (user/session/org management + audit +
-runtime settings, requires auth), `redis`, `bullmq` (queue + worker),
-`job-progress` (SSE progress), `object-storage-s3`, `file-upload`, `sse`,
-`rate-limit`, `logging`, `api-key-auth`.
-
-Notes:
-- A module auto-adds its required modules (e.g. `admin-dashboard` adds `auth`).
-- After adding, follow the printed next steps (often DB migrations, e.g.
-  `npx @better-auth/cli migrate -y --config apps/api/src/auth/auth.ts`).
-- Module wiring lands inside `// podokit:` fenced regions — don't hand-edit those.