@podosoft/podokit 0.17.4 → 1.0.2

package/dist/templates/modules/audit-log/files/apps/api/src/audit/audit-log.entity.ts

@@ -1,46 +0,0 @@
-import { Column, CreateDateColumn, Entity, Index, PrimaryGeneratedColumn } from "typeorm";
-
-// An append-only audit trail. Fields follow the actor / action / target model:
-// who did what, to which resource, when — with human-readable labels stored
-// inline so entries stay meaningful even after users are renamed or deleted.
-@Entity("audit_logs")
-export class AuditLog {
-  @PrimaryGeneratedColumn("uuid")
-  id!: string;
-
-  // A stable, semantic action code, e.g. "user.create", "auth.login".
-  @Index()
-  @Column({ type: "varchar", length: 128 })
-  action!: string;
-
-  // Who performed it (denormalized display fields + id).
-  @Column({ type: "varchar", nullable: true })
-  actorId!: string | null;
-
-  @Column({ type: "varchar", nullable: true })
-  actorName!: string | null;
-
-  @Column({ type: "varchar", nullable: true })
-  actorEmail!: string | null;
-
-  // What it acted on (optional).
-  @Column({ type: "varchar", nullable: true })
-  targetType!: string | null;
-
-  @Column({ type: "varchar", nullable: true })
-  targetId!: string | null;
-
-  @Column({ type: "varchar", nullable: true })
-  targetLabel!: string | null;
-
-  @Column({ type: "varchar", nullable: true })
-  ip!: string | null;
-
-  // Free-form context for custom events.
-  @Column({ type: "jsonb", nullable: true })
-  metadata!: Record<string, unknown> | null;
-
-  @Index()
-  @CreateDateColumn({ type: "timestamptz" })
-  createdAt!: Date;
-}

package/dist/templates/modules/audit-log/files/apps/api/src/audit/audit.controller.ts

@@ -1,21 +0,0 @@
-import { Controller, ForbiddenException, Get } from "@nestjs/common";
-import { InjectRepository } from "@nestjs/typeorm";
-import { Session, type UserSession } from "@thallesp/nestjs-better-auth";
-import { ApiTags } from "@nestjs/swagger";
-import { Repository } from "typeorm";
-import { AuditLog } from "./audit-log.entity";
-
-@ApiTags("audit")
-@Controller("audit-logs")
-export class AuditController {
-  constructor(@InjectRepository(AuditLog) private readonly logs: Repository<AuditLog>) {}
-
-  // Audit entries are sensitive — admins only.
-  @Get()
-  recent(@Session() session: UserSession): Promise<AuditLog[]> {
-    if ((session.user as { role?: string | null }).role !== "admin") {
-      throw new ForbiddenException("Admins only");
-    }
-    return this.logs.find({ order: { createdAt: "DESC" }, take: 50 });
-  }
-}

package/dist/templates/modules/audit-log/files/apps/api/src/audit/audit.decorator.ts

@@ -1,23 +0,0 @@
-import { SetMetadata } from "@nestjs/common";
-import type { Request } from "express";
-
-export const AUDIT_KEY = "podokit:audit";
-
-// Optionally derive the target (and extra metadata) from the request + handler
-// result, e.g. (req, result) => ({ type: "todo", id: result.id, label: result.title }).
-export type AuditTarget = {
-  type?: string;
-  id?: string;
-  label?: string;
-  metadata?: Record<string, unknown>;
-};
-export type AuditMeta = {
-  action: string;
-  resolve?: (req: Request, result: unknown) => AuditTarget | undefined;
-};
-
-// Mark a controller handler to be audited under a semantic action code:
-//   @Audit("todo.create", (_req, todo) => ({ type: "todo", id: todo.id, label: todo.title }))
-export function Audit(action: string, resolve?: AuditMeta["resolve"]): MethodDecorator {
-  return SetMetadata(AUDIT_KEY, { action, resolve } satisfies AuditMeta);
-}

package/dist/templates/modules/audit-log/files/apps/api/src/audit/audit.interceptor.ts

@@ -1,56 +0,0 @@
-import { type CallHandler, type ExecutionContext, Injectable, type NestInterceptor } from "@nestjs/common";
-import { Reflector } from "@nestjs/core";
-import { fromNodeHeaders } from "better-auth/node";
-import type { Request } from "express";
-import { type Observable, tap } from "rxjs";
-import { auth } from "../auth/auth";
-import { AUDIT_KEY, type AuditMeta } from "./audit.decorator";
-import { AuditService } from "./audit.service";
-import { auditEnabled } from "./audit-enabled";
-
-// Records handlers explicitly marked with @Audit(...). Nothing is logged unless
-// you opt a route in, so the trail stays meaningful (semantic actions, not raw
-// HTTP). Auth/admin actions are recorded separately by the better-auth hook.
-@Injectable()
-export class AuditInterceptor implements NestInterceptor {
-  constructor(
-    private readonly reflector: Reflector,
-    private readonly audit: AuditService,
-  ) {}
-
-  intercept(context: ExecutionContext, next: CallHandler): Observable<unknown> {
-    const meta = this.reflector.get<AuditMeta | undefined>(AUDIT_KEY, context.getHandler());
-    if (!meta) return next.handle();
-    const req = context.switchToHttp().getRequest<Request>();
-    return next.handle().pipe(tap((result) => void this.log(meta, req, result)));
-  }
-
-  private async log(meta: AuditMeta, req: Request, result: unknown): Promise<void> {
-    if (!(await auditEnabled())) return;
-    let actorId: string | null = null;
-    let actorName: string | null = null;
-    let actorEmail: string | null = null;
-    try {
-      const session = await auth.api.getSession({ headers: fromNodeHeaders(req.headers) });
-      if (session?.user) {
-        actorId = session.user.id;
-        actorName = session.user.name ?? null;
-        actorEmail = session.user.email ?? null;
-      }
-    } catch {
-      /* unauthenticated */
-    }
-    const target = meta.resolve?.(req, result);
-    await this.audit.record({
-      action: meta.action,
-      actorId,
-      actorName,
-      actorEmail,
-      targetType: target?.type ?? null,
-      targetId: target?.id ?? null,
-      targetLabel: target?.label ?? null,
-      ip: req.ip ?? null,
-      metadata: target?.metadata ?? null,
-    });
-  }
-}

package/dist/templates/modules/auth/files/apps/api/src/account/account.controller.ts

@@ -1,101 +0,0 @@
-import { Body, Controller, ForbiddenException, Get, Post, Put, Req } from "@nestjs/common";
-import type { Request } from "express";
-import { fromNodeHeaders } from "better-auth/node";
-import { Public, Session, type UserSession } from "@thallesp/nestjs-better-auth";
-import { ApiTags } from "@nestjs/swagger";
-import { FEATURE_FLAGS, SettingsService, type FeatureFlag } from "../settings/settings.service";
-import { ROLE_NAMES } from "../auth/permissions";
-import { auth } from "../auth/auth";
-import { authConfigStore } from "../auth/auth-config-store";
-import type { Capabilities } from "@podosoft/podokit-contracts";
-
-function isAdmin(session: UserSession): boolean {
-  const role = session.user?.role;
-  const roles = Array.isArray(role) ? role : (role ?? "").split(",").map((r: string) => r.trim());
-  return roles.includes("admin");
-}
-
-@ApiTags("account")
-@Controller("account")
-export class AccountController {
-  constructor(private readonly settings: SettingsService) {}
-
-  @Get("me")
-  me(@Session() session: UserSession) {
-    return session.user;
-  }
-
-  // The "require two-factor" policy, for the web enrolment gate. Kept out of the
-  // typed Capabilities (that lives in a published package); allow-listed in
-  // TwoFactorRequiredGuard so a not-yet-enrolled user can still read it.
-  @Get("require-2fa")
-  requireTwoFactor(): { require2fa: boolean } {
-    return { require2fa: this.settings.getBool("require2fa") };
-  }
-
-  // Which optional auth features are enabled, so the UI can show/hide sections.
-  // Public so the login page (unauthenticated) can offer available sign-in methods.
-  @Public()
-  @Get("capabilities")
-  async capabilities(): Promise<Capabilities> {
-    const flags = this.settings.flags();
-    // OAuth providers + server-enforced toggles are DB-backed (env fallback) and
-    // applied live, so read them from the config store rather than process.env.
-    const snapshot = await authConfigStore.capabilitiesSnapshot();
-    return {
-      twoFactor: flags.twoFactor,
-      magicLink: flags.magicLink,
-      emailOtp: flags.emailOtp,
-      username: flags.username,
-      multiSession: flags.multiSession,
-      phoneNumber: flags.phoneNumber,
-      apiKey: flags.apiKey,
-      passkey: flags.passkey,
-      organization: flags.organization,
-      oidcProvider: flags.oidcProvider,
-      providers: snapshot.providers,
-      deleteAccount: snapshot.allowDelete,
-      emailVerification: snapshot.requireEmailVerification,
-      signupApprovalRequired: snapshot.requireSignupApproval,
-      passwordBreachCheck: snapshot.passwordBreachCheck,
-      auditLog: snapshot.auditLog,
-      sessionIdleTimeoutMinutes: snapshot.sessionIdleTimeoutMinutes,
-      roles: ROLE_NAMES,
-    };
-  }
-
-  // Admin-only: toggle feature flags. Stored in the DB and reflected immediately in
-  // capabilities (UI). Server-enforced behaviours (email verification, breach check)
-  // are read by the auth server at startup, so those take effect on the next restart.
-  @Put("settings")
-  async updateSettings(
-    @Session() session: UserSession,
-    @Body() body: Partial<Record<FeatureFlag, boolean>>,
-  ): Promise<Record<FeatureFlag, boolean>> {
-    if (!isAdmin(session)) throw new ForbiddenException("Admins only");
-    const update: Partial<Record<FeatureFlag, boolean>> = {};
-    for (const flag of FEATURE_FLAGS) {
-      if (typeof body?.[flag] === "boolean") update[flag] = body[flag];
-    }
-    return this.settings.setMany(update);
-  }
-
-  // Add an existing user to an organization with a role (e.g. "manager"), so several
-  // members can hold it. better-auth's addMember is server-only; this exposes it and
-  // delegates org-level authorization to better-auth via the caller's session headers.
-  @Post("org-member")
-  async addOrgMember(
-    @Req() req: Request,
-    @Body() body: { organizationId: string; userId: string; role: string },
-  ): Promise<unknown> {
-    // addMember is a server-only better-auth endpoint (not on the typed public api);
-    // it exists at runtime, so reach it through a narrow cast.
-    const api = auth.api as unknown as {
-      addMember: (opts: { body: { organizationId: string; userId: string; role: string }; headers: Headers }) => Promise<unknown>;
-    };
-    return api.addMember({
-      body: { organizationId: body.organizationId, userId: body.userId, role: body.role },
-      headers: fromNodeHeaders(req.headers),
-    });
-  }
-}

package/dist/templates/modules/auth/files/apps/api/src/account/account.module.ts

@@ -1,6 +0,0 @@
-import { Module } from "@nestjs/common";
-import { SettingsModule } from "../settings/settings.module";
-import { AccountController } from "./account.controller";
-
-@Module({ imports: [SettingsModule], controllers: [AccountController] })
-export class AccountModule {}

package/dist/templates/modules/auth/files/apps/api/src/auth/two-factor-required.guard.ts

@@ -1,68 +0,0 @@
-import { type CanActivate, type ExecutionContext, Injectable } from "@nestjs/common";
-import type { Request } from "express";
-import { fromNodeHeaders } from "better-auth/node";
-import { AppException } from "@podosoft/podokit-contracts";
-import { FLAG_DEFAULTS } from "../settings/flag-defaults";
-import { pool } from "./db";
-import { auth } from "./auth";
-
-/**
- * Enforces the "require two-factor" policy (admin Settings): while it is on, a
- * signed-in user who has not enrolled in 2FA is blocked from every app route
- * until they do — the security boundary behind the web enrolment gate (the web
- * redirect is only UX).
- *
- * Registered after the better-auth AuthGuard. Requests with no user session
- * (unauthenticated, or machine api-key/bearer calls) are not gated here — the
- * auth guard owns authentication. A short allow-list keeps the endpoints needed
- * to read the policy and enrol reachable; the 2FA enrol/verify endpoints live
- * under /api/auth/two-factor (better-auth), never behind this guard.
- *
- * `require2fa` is read from app_setting through a small TTL cache (self-contained,
- * so this global guard needs no DI), the same way auth/feature-gate.ts reads flags.
- */
-@Injectable()
-export class TwoFactorRequiredGuard implements CanActivate {
-  // Reachable while gated: read the policy/capabilities, and — break-glass — the
-  // admin-only flag toggle, so an admin who turned the policy on (and isn't yet
-  // enrolled) can still turn it back off instead of being hard-locked.
-  private static readonly ALLOW = [
-    "/account/capabilities",
-    "/account/require-2fa",
-    "/account/settings",
-    "/health",
-  ];
-  private static readonly TTL_MS = 3_000;
-  private cached = FLAG_DEFAULTS.require2fa;
-  private fetchedAt = 0;
-
-  private async enforced(): Promise<boolean> {
-    if (Date.now() - this.fetchedAt < TwoFactorRequiredGuard.TTL_MS) return this.cached;
-    try {
-      const res = await pool.query<{ value: string }>(
-        'SELECT "value" FROM "app_setting" WHERE "key" = $1',
-        ["require2fa"],
-      );
-      this.cached = res.rows[0]?.value === "true";
-    } catch {
-      this.cached = FLAG_DEFAULTS.require2fa;
-    }
-    this.fetchedAt = Date.now();
-    return this.cached;
-  }
-
-  async canActivate(context: ExecutionContext): Promise<boolean> {
-    if (context.getType() !== "http") return true;
-    const req = context.switchToHttp().getRequest<Request>();
-    const path = req.path || req.url || "";
-    if (TwoFactorRequiredGuard.ALLOW.some((p) => path === p || path.startsWith(`${p}/`))) return true;
-    if (!(await this.enforced())) return true;
-
-    const session = await auth.api.getSession({ headers: fromNodeHeaders(req.headers) });
-    const user = session?.user as { twoFactorEnabled?: boolean } | undefined;
-    if (!user) return true; // unauthenticated or non-session (machine) request
-    if (user.twoFactorEnabled) return true;
-
-    throw new AppException("TWO_FACTOR_REQUIRED", "Two-factor enrolment is required.", 403);
-  }
-}

package/dist/templates/modules/auth/files/apps/api/src/auth-config/auth-config.controller.ts

@@ -1,33 +0,0 @@
-import { Body, Controller, ForbiddenException, Get, Put } from "@nestjs/common";
-import { Session, type UserSession } from "@thallesp/nestjs-better-auth";
-import { ApiTags } from "@nestjs/swagger";
-import { AuthConfigService, type AuthConfigView, type AuthConfigUpdate } from "./auth-config.service";
-
-function isAdmin(session: UserSession): boolean {
-  const role = session.user?.role;
-  const roles = Array.isArray(role) ? role : (role ?? "").split(",").map((r: string) => r.trim());
-  return roles.includes("admin");
-}
-
-// Admin-only management of DB-backed auth config (OAuth providers, SMTP,
-// server-enforced toggles). GET returns non-secret fields + `hasSecret`; PUT
-// encrypts and stores secrets, and the change applies live (the auth instance
-// rebuilds on the next request — see auth/auth-provider.ts). Secrets are never
-// returned to the client.
-@ApiTags("account")
-@Controller("account")
-export class AuthConfigController {
-  constructor(private readonly service: AuthConfigService) {}
-
-  @Get("auth-config")
-  async get(@Session() session: UserSession): Promise<AuthConfigView> {
-    if (!isAdmin(session)) throw new ForbiddenException("Admins only");
-    return this.service.describe();
-  }
-
-  @Put("auth-config")
-  async put(@Session() session: UserSession, @Body() body: AuthConfigUpdate): Promise<AuthConfigView> {
-    if (!isAdmin(session)) throw new ForbiddenException("Admins only");
-    return this.service.update(body);
-  }
-}

package/dist/templates/modules/auth/files/apps/api/src/auth-config/auth-config.entity.ts

@@ -1,26 +0,0 @@
-import { Column, Entity, PrimaryColumn, UpdateDateColumn } from "typeorm";
-
-/** Admin-managed auth configuration, one row per section: one `social.<id>` row
- *  per configured OAuth provider (added/removed dynamically — "social.google",
- *  "social.github", "social.apple", …), plus "smtp" and "server". Non-secret
- *  fields live in `config` (jsonb); secrets (OAuth client secret, SMTP password)
- *  are stored encrypted in `secret` (AES-256-GCM envelope — see auth/secret.ts).
- *  The runtime reads this table through auth/config-store.ts (raw pool) to
- *  (re)build better-auth. */
-@Entity({ name: "auth_config" })
-export class AuthConfigRow {
-  @PrimaryColumn({ type: "text" })
-  key!: string;
-
-  @Column({ type: "boolean", default: false })
-  enabled!: boolean;
-
-  @Column({ type: "jsonb", default: {} })
-  config!: Record<string, unknown>;
-
-  @Column({ type: "text", nullable: true })
-  secret!: string | null;
-
-  @UpdateDateColumn()
-  updatedAt!: Date;
-}

package/dist/templates/modules/auth/files/apps/api/src/auth-config/auth-config.module.ts

@@ -1,12 +0,0 @@
-import { Module } from "@nestjs/common";
-import { TypeOrmModule } from "@nestjs/typeorm";
-import { AuthConfigRow } from "./auth-config.entity";
-import { AuthConfigService } from "./auth-config.service";
-import { AuthConfigController } from "./auth-config.controller";
-
-@Module({
-  imports: [TypeOrmModule.forFeature([AuthConfigRow])],
-  controllers: [AuthConfigController],
-  providers: [AuthConfigService],
-})
-export class AuthConfigModule {}

package/dist/templates/modules/auth/files/apps/api/src/health/health.controller.ts

@@ -1,41 +0,0 @@
-import { Controller, Get, ServiceUnavailableException } from "@nestjs/common";
-import { InjectDataSource } from "@nestjs/typeorm";
-import { DataSource } from "typeorm";
-import { Public } from "@thallesp/nestjs-better-auth";
-import { ReadinessService, type ReadinessStatus } from "./readiness.service";
-
-interface ReadinessResponse {
-  status: "ready";
-  db: "up";
-  checks: Record<string, ReadinessStatus>;
-}
-
-// Health checks stay public under the global auth guard.
-@Public()
-@Controller("health")
-export class HealthController {
-  constructor(
-    @InjectDataSource() private readonly dataSource: DataSource,
-    private readonly readinessService: ReadinessService,
-  ) {}
-
-  @Get()
-  liveness(): { status: string; uptime: number; timestamp: string } {
-    return { status: "ok", uptime: process.uptime(), timestamp: new Date().toISOString() };
-  }
-
-  @Get("ready")
-  async readiness(): Promise<ReadinessResponse> {
-    let db: ReadinessStatus = "up";
-    try {
-      await this.dataSource.query("SELECT 1");
-    } catch {
-      db = "down";
-    }
-    const checks = await this.readinessService.run();
-    if (db === "down" || Object.values(checks).includes("down")) {
-      throw new ServiceUnavailableException({ status: "degraded", db, checks });
-    }
-    return { status: "ready", db: "up", checks };
-  }
-}

package/dist/templates/modules/auth/files/apps/api/src/settings/app-setting.entity.ts

@@ -1,16 +0,0 @@
-import { Column, Entity, PrimaryColumn, UpdateDateColumn } from "typeorm";
-
-/** A single admin-editable application setting, stored as a string key/value.
- *  Feature flags (twoFactor, magicLink, ...) live here so an admin can change
- *  them from the UI instead of editing environment variables. */
-@Entity({ name: "app_setting" })
-export class AppSetting {
-  @PrimaryColumn({ type: "text" })
-  key!: string;
-
-  @Column({ type: "text" })
-  value!: string;
-
-  @UpdateDateColumn()
-  updatedAt!: Date;
-}

package/dist/templates/modules/auth/files/apps/api/src/settings/settings.module.ts

@@ -1,11 +0,0 @@
-import { Module } from "@nestjs/common";
-import { TypeOrmModule } from "@nestjs/typeorm";
-import { AppSetting } from "./app-setting.entity";
-import { SettingsService } from "./settings.service";
-
-@Module({
-  imports: [TypeOrmModule.forFeature([AppSetting])],
-  providers: [SettingsService],
-  exports: [SettingsService],
-})
-export class SettingsModule {}

package/dist/templates/modules/bullmq/files/apps/api/src/jobs/dto/create-job.dto.ts

@@ -1,9 +0,0 @@
-import { ApiProperty } from "@nestjs/swagger";
-import { IsNotEmpty, IsString } from "class-validator";
-
-export class CreateJobDto {
-  @ApiProperty({ example: "hello" })
-  @IsString()
-  @IsNotEmpty()
-  text!: string;
-}

package/dist/templates/modules/bullmq/files/apps/api/src/jobs/jobs.controller.ts

@@ -1,29 +0,0 @@
-import { Body, Controller, Get, NotFoundException, Param, Post } from "@nestjs/common";
-import { InjectQueue } from "@nestjs/bullmq";
-import { ApiTags } from "@nestjs/swagger";
-import { Queue } from "bullmq";
-import { CreateJobDto } from "./dto/create-job.dto";
-import { DEMO_QUEUE } from "./queue";
-
-@ApiTags("jobs")
-@Controller("jobs")
-export class JobsController {
-  constructor(@InjectQueue(DEMO_QUEUE) private readonly queue: Queue) {}
-
-  @Post()
-  async enqueue(@Body() dto: CreateJobDto): Promise<{ id: string | undefined }> {
-    const job = await this.queue.add("demo", { text: dto.text });
-    return { id: job.id };
-  }
-
-  @Get(":id")
-  async status(
-    @Param("id") id: string,
-  ): Promise<{ id: string | undefined; state: string; result: unknown }> {
-    const job = await this.queue.getJob(id);
-    if (!job) {
-      throw new NotFoundException(`Job ${id} not found`);
-    }
-    return { id: job.id, state: await job.getState(), result: job.returnvalue ?? null };
-  }
-}

package/dist/templates/modules/file-upload/files/apps/api/src/files/files.controller.ts

@@ -1,32 +0,0 @@
-// The API tsconfig restricts `types` to ["node"], which suppresses @types/multer's
-// global augmentation of Express.Multer.File. Load it explicitly so the type resolves.
-/// <reference types="multer" />
-import { BadRequestException, Controller, Get, Param, Post, UploadedFile, UseInterceptors } from "@nestjs/common";
-import { FileInterceptor } from "@nestjs/platform-express";
-import { ApiConsumes, ApiTags } from "@nestjs/swagger";
-import { randomUUID } from "node:crypto";
-import { StorageService } from "../storage/storage.service";
-
-@ApiTags("files")
-@Controller("files")
-export class FilesController {
-  constructor(private readonly storage: StorageService) {}
-
-  @Post()
-  @ApiConsumes("multipart/form-data")
-  @UseInterceptors(FileInterceptor("file"))
-  async upload(@UploadedFile() file?: Express.Multer.File): Promise<{ key: string; url: string }> {
-    if (!file) {
-      throw new BadRequestException("A file field is required (multipart/form-data)");
-    }
-    const safeName = file.originalname.replace(/[^\w.-]+/g, "_");
-    const key = `uploads/${randomUUID()}-${safeName}`;
-    await this.storage.put(key, file.buffer, file.mimetype);
-    return { key, url: await this.storage.presignedGetUrl(key) };
-  }
-
-  @Get(":key/url")
-  async url(@Param("key") key: string): Promise<{ url: string }> {
-    return { url: await this.storage.presignedGetUrl(key) };
-  }
-}

package/dist/templates/modules/job-progress/files/apps/api/src/progress/dto/start-job.dto.ts

@@ -1,11 +0,0 @@
-import { ApiPropertyOptional } from "@nestjs/swagger";
-import { IsInt, IsOptional, Max, Min } from "class-validator";
-
-export class StartJobDto {
-  @ApiPropertyOptional({ example: 5, description: "Number of progress steps" })
-  @IsOptional()
-  @IsInt()
-  @Min(1)
-  @Max(100)
-  steps?: number;
-}

package/dist/templates/modules/job-progress/files/apps/api/src/progress/progress.controller.ts

@@ -1,17 +0,0 @@
-import { Body, Controller, Post } from "@nestjs/common";
-import { InjectQueue } from "@nestjs/bullmq";
-import { ApiTags } from "@nestjs/swagger";
-import { Queue } from "bullmq";
-import { StartJobDto } from "./dto/start-job.dto";
-
-@ApiTags("progress")
-@Controller("progress")
-export class ProgressController {
-  constructor(@InjectQueue("progress") private readonly queue: Queue) {}
-
-  @Post()
-  async start(@Body() dto: StartJobDto): Promise<{ jobId: string | undefined }> {
-    const job = await this.queue.add("progress", { steps: dto.steps ?? 5 });
-    return { jobId: job.id };
-  }
-}

package/dist/templates/modules/object-storage-s3/files/apps/api/src/storage/dto/put-object.dto.ts

@@ -1,8 +0,0 @@
-import { ApiProperty } from "@nestjs/swagger";
-import { IsString } from "class-validator";
-
-export class PutObjectDto {
-  @ApiProperty({ example: "hello world" })
-  @IsString()
-  content!: string;
-}

package/dist/templates/modules/object-storage-s3/files/apps/api/src/storage/storage.controller.ts

@@ -1,29 +0,0 @@
-import { Body, Controller, Get, Param, Put } from "@nestjs/common";
-import { ApiTags } from "@nestjs/swagger";
-import { StorageService } from "./storage.service";
-import { PutObjectDto } from "./dto/put-object.dto";
-
-// Demo endpoints — replace with your own. See the file-upload module for
-// multipart uploads built on this service.
-@ApiTags("storage")
-@Controller("storage")
-export class StorageController {
-  constructor(private readonly storage: StorageService) {}
-
-  @Put(":key")
-  async put(@Param("key") key: string, @Body() dto: PutObjectDto): Promise<{ key: string }> {
-    await this.storage.put(key, dto.content, "text/plain");
-    return { key };
-  }
-
-  @Get(":key")
-  async get(@Param("key") key: string): Promise<{ key: string; content: string }> {
-    const buffer = await this.storage.get(key);
-    return { key, content: buffer.toString("utf8") };
-  }
-
-  @Get(":key/presigned")
-  async presigned(@Param("key") key: string): Promise<{ url: string }> {
-    return { url: await this.storage.presignedGetUrl(key) };
-  }
-}

package/dist/templates/modules/object-storage-s3/files/apps/api/src/storage/storage.service.spec.ts

@@ -1,35 +0,0 @@
-import { HeadBucketCommand } from "@aws-sdk/client-s3";
-import { describe, expect, it, jest } from "@jest/globals";
-import type { ReadinessService } from "../health/readiness.service";
-import { StorageService } from "./storage.service";
-
-describe("StorageService readiness", () => {
-  it("registers a bucket probe and releases resources on shutdown", async () => {
-    const unregister = jest.fn();
-    const register = jest.fn<
-      (name: string, check: () => Promise<void>) => () => void
-    >(() => unregister);
-    const service = new StorageService({ register } as unknown as ReadinessService);
-    const send = jest
-      .fn<(...arguments_: unknown[]) => Promise<unknown>>()
-      .mockResolvedValue({});
-    const destroy = jest.fn();
-    Object.defineProperty(service, "client", {
-      value: { send, destroy },
-    });
-
-    service.onModuleInit();
-    expect(register).toHaveBeenCalledWith("object-storage", expect.any(Function));
-    const probe = register.mock.calls[0]?.[1];
-    expect(probe).toBeDefined();
-    await probe?.();
-    expect(send).toHaveBeenCalledWith(
-      expect.any(HeadBucketCommand),
-      expect.objectContaining({ abortSignal: expect.any(AbortSignal) }),
-    );
-
-    service.onModuleDestroy();
-    expect(unregister).toHaveBeenCalledTimes(1);
-    expect(destroy).toHaveBeenCalledTimes(1);
-  });
-});