@podosoft/podokit 0.17.4 → 1.0.2

package/dist/templates/modules/rate-limit/files/apps/api/src/rate-limit/rate-limit.module.integration.spec.ts

@@ -1,91 +0,0 @@
-import { Controller, Get, Global, Module } from "@nestjs/common";
-import { Test } from "@nestjs/testing";
-import { describe, it, jest } from "@jest/globals";
-import request from "supertest";
-import { AllExceptionsFilter } from "../common/all-exceptions.filter";
-import { ReadinessService } from "../health/readiness.service";
-
-jest.mock("../auth/auth-provider", () => ({
-  authRuntime: { api: { getSession: jest.fn() } },
-}));
-jest.mock("better-auth/node", () => ({
-  fromNodeHeaders: (headers: unknown) => headers,
-}));
-
-import { RateLimitModule } from "./rate-limit.module";
-
-@Global()
-@Module({
-  providers: [ReadinessService],
-  exports: [ReadinessService],
-})
-class TestReadinessModule {}
-
-@Controller()
-class TestController {
-  @Get("ordinary")
-  ordinary(): { ok: true } {
-    return { ok: true };
-  }
-
-  @Get("health")
-  health(): { ok: true } {
-    return { ok: true };
-  }
-}
-
-@Module({
-  imports: [TestReadinessModule, RateLimitModule],
-  controllers: [TestController],
-})
-class TestApplicationModule {}
-
-const redisUrl = process.env.REDIS_TEST_URL;
-const integrationTest = redisUrl ? it : it.skip;
-
-describe("RateLimitModule integration", () => {
-  integrationTest("shares counters across replicas and bypasses health probes", async () => {
-    const previousRedisUrl = process.env.REDIS_URL;
-    process.env.REDIS_URL = redisUrl;
-    const firstModule = await Test.createTestingModule({
-      imports: [TestApplicationModule],
-    }).compile();
-    const secondModule = await Test.createTestingModule({
-      imports: [TestApplicationModule],
-    }).compile();
-    const first = firstModule.createNestApplication();
-    const second = secondModule.createNestApplication();
-
-    try {
-      first.useGlobalFilters(new AllExceptionsFilter());
-      second.useGlobalFilters(new AllExceptionsFilter());
-      await Promise.all([first.init(), second.init()]);
-      const clientAddress = `198.51.100.${Math.floor(Math.random() * 200) + 1}`;
-      await request(first.getHttpServer())
-        .get("/ordinary")
-        .set("x-forwarded-for", clientAddress)
-        .expect(200);
-      const limited = await request(second.getHttpServer())
-        .get("/ordinary")
-        .set("x-forwarded-for", clientAddress)
-        .expect(429);
-      if (
-        limited.body?.error?.code !== "RATE_LIMIT_EXCEEDED" ||
-        !limited.headers["retry-after"]
-      ) {
-        throw new Error("Shared rate-limit response contract is invalid");
-      }
-
-      for (let index = 0; index < 3; index += 1) {
-        await request(index % 2 === 0 ? first.getHttpServer() : second.getHttpServer())
-          .get("/health")
-          .set("x-forwarded-for", clientAddress)
-          .expect(200);
-      }
-    } finally {
-      await Promise.all([first.close(), second.close()]);
-      if (previousRedisUrl === undefined) delete process.env.REDIS_URL;
-      else process.env.REDIS_URL = previousRedisUrl;
-    }
-  });
-});

package/dist/templates/modules/redis/files/apps/api/src/redis/cache.controller.ts

@@ -1,21 +0,0 @@
-import { Body, Controller, Get, Param, Put } from "@nestjs/common";
-import { ApiTags } from "@nestjs/swagger";
-import { RedisService } from "./redis.service";
-import { SetCacheDto } from "./dto/set-cache.dto";
-
-@ApiTags("cache")
-@Controller("cache")
-export class CacheController {
-  constructor(private readonly redis: RedisService) {}
-
-  @Put(":key")
-  async put(@Param("key") key: string, @Body() dto: SetCacheDto): Promise<{ key: string }> {
-    await this.redis.set(key, dto.value, dto.ttl);
-    return { key };
-  }
-
-  @Get(":key")
-  async get(@Param("key") key: string): Promise<{ key: string; value: string | null }> {
-    return { key, value: await this.redis.get(key) };
-  }
-}

package/dist/templates/modules/redis/files/apps/api/src/redis/dto/set-cache.dto.ts

@@ -1,14 +0,0 @@
-import { ApiProperty, ApiPropertyOptional } from "@nestjs/swagger";
-import { IsInt, IsOptional, IsString, Min } from "class-validator";
-
-export class SetCacheDto {
-  @ApiProperty({ example: "hello" })
-  @IsString()
-  value!: string;
-
-  @ApiPropertyOptional({ example: 60, description: "TTL in seconds" })
-  @IsOptional()
-  @IsInt()
-  @Min(1)
-  ttl?: number;
-}

package/dist/templates/modules/sse/files/apps/api/src/events/dto/publish-event.dto.ts

@@ -1,8 +0,0 @@
-import { ApiProperty } from "@nestjs/swagger";
-import { IsString } from "class-validator";
-
-export class PublishEventDto {
-  @ApiProperty({ example: "hello" })
-  @IsString()
-  message!: string;
-}

package/dist/templates/modules/sse/files/apps/api/src/events/events.controller.ts

@@ -1,39 +0,0 @@
-import {
-  Body,
-  Controller,
-  Post,
-  ServiceUnavailableException,
-  Sse,
-  type MessageEvent,
-} from "@nestjs/common";
-import { ApiTags } from "@nestjs/swagger";
-import { interval, map, merge, type Observable } from "rxjs";
-import { EventsService } from "./events.service";
-import { PublishEventDto } from "./dto/publish-event.dto";
-
-@ApiTags("events")
-@Controller("events")
-export class EventsController {
-  constructor(private readonly events: EventsService) {}
-
-  @Sse("stream")
-  stream(): Observable<MessageEvent> {
-    const heartbeat = interval(5000).pipe(
-      map((n): MessageEvent => ({ data: { type: "heartbeat", n } })),
-    );
-    return merge(this.events.asObservable(), heartbeat);
-  }
-
-  @Post()
-  async publish(@Body() dto: PublishEventDto): Promise<{ ok: true }> {
-    try {
-      await this.events.publishAsync({ type: "message", message: dto.message });
-    } catch {
-      throw new ServiceUnavailableException({
-        code: "EVENTS_TRANSPORT_UNAVAILABLE",
-        message: "Event transport is unavailable",
-      });
-    }
-    return { ok: true };
-  }
-}

package/dist/templates/modules/sse/files/apps/api/src/events/events.transport.redis.spec.ts

@@ -1,42 +0,0 @@
-import { describe, expect, it } from "@jest/globals";
-import { RedisEventsTransport } from "./events.transport";
-
-const redisUrl = process.env.REDIS_TEST_URL;
-const integrationTest = redisUrl ? it : it.skip;
-
-describe("RedisEventsTransport integration", () => {
-  integrationTest("delivers once to every connected replica", async () => {
-    const channel = `podokit:test:${Date.now()}:${Math.random().toString(36).slice(2)}`;
-    const env = {
-      REDIS_URL: redisUrl,
-      SSE_REDIS_CHANNEL: channel,
-      SSE_MAX_EVENT_BYTES: "1024",
-    };
-    const first = new RedisEventsTransport(env);
-    const second = new RedisEventsTransport(env);
-    const firstEvents: unknown[] = [];
-    const secondEvents: unknown[] = [];
-
-    try {
-      await first.connect((data) => firstEvents.push(data));
-      await second.connect((data) => secondEvents.push(data));
-      await first.publish({ type: "replica-test" });
-
-      const deadline = Date.now() + 3000;
-      while (
-        Date.now() < deadline &&
-        (firstEvents.length < 1 || secondEvents.length < 1)
-      ) {
-        await new Promise((resolve) => setTimeout(resolve, 20));
-      }
-      await new Promise((resolve) => setTimeout(resolve, 100));
-
-      expect(firstEvents).toEqual([{ type: "replica-test" }]);
-      expect(secondEvents).toEqual([{ type: "replica-test" }]);
-      await expect(first.ready()).resolves.toBeUndefined();
-      await expect(second.ready()).resolves.toBeUndefined();
-    } finally {
-      await Promise.all([first.close(), second.close()]);
-    }
-  });
-});

package/dist/templates/modules/sse/files/apps/api/src/events/events.transport.spec.ts

@@ -1,97 +0,0 @@
-import { describe, expect, it } from "@jest/globals";
-import {
-  MemoryEventsTransport,
-  RedisEventsTransport,
-  type RedisClientFactory,
-} from "./events.transport";
-import type { RedisConnectionOptions } from "../config/redis.connection";
-
-class FakeRedisClient {
-  status = "wait";
-  readonly published: Array<{ channel: string; message: string }> = [];
-  readonly subscriptions: string[] = [];
-  private messageListener?: (channel: string, message: string) => void;
-
-  connect(): Promise<void> {
-    this.status = "ready";
-    return Promise.resolve();
-  }
-
-  publish(channel: string, message: string): Promise<number> {
-    this.published.push({ channel, message });
-    return Promise.resolve(1);
-  }
-
-  subscribe(channel: string): Promise<number> {
-    this.subscriptions.push(channel);
-    return Promise.resolve(1);
-  }
-
-  ping(): Promise<string> {
-    return this.status === "ready" ? Promise.resolve("PONG") : Promise.reject(new Error("down"));
-  }
-
-  quit(): Promise<string> {
-    this.status = "end";
-    return Promise.resolve("OK");
-  }
-
-  on(_event: "message", listener: (channel: string, message: string) => void): this {
-    this.messageListener = listener;
-    return this;
-  }
-
-  off(_event: "message", listener: (channel: string, message: string) => void): this {
-    if (this.messageListener === listener) this.messageListener = undefined;
-    return this;
-  }
-
-  emit(channel: string, message: string): void {
-    this.messageListener?.(channel, message);
-  }
-}
-
-describe("events transports", () => {
-  it("delivers memory events through the configured handler", async () => {
-    const transport = new MemoryEventsTransport({ SSE_MAX_EVENT_BYTES: "128" });
-    const received: unknown[] = [];
-    await transport.connect((data) => received.push(data));
-    await transport.publish({ type: "changed" });
-    expect(received).toEqual([{ type: "changed" }]);
-  });
-
-  it("publishes Redis events only through the subscription echo", async () => {
-    const clients: FakeRedisClient[] = [];
-    const factory: RedisClientFactory = (_options: RedisConnectionOptions) => {
-      const client = new FakeRedisClient();
-      clients.push(client);
-      return client;
-    };
-    const transport = new RedisEventsTransport(
-      {
-        REDIS_URL: "redis://user:password@cache.example.com:6379/2",
-        SSE_REDIS_CHANNEL: "events:test",
-      },
-      factory,
-    );
-    const received: unknown[] = [];
-
-    await transport.connect((data) => received.push(data));
-    await transport.publish({ type: "changed" });
-    expect(received).toEqual([]);
-    expect(clients[0]?.published).toEqual([
-      { channel: "events:test", message: '{"type":"changed"}' },
-    ]);
-
-    clients[1]?.emit("events:test", '{"type":"changed"}');
-    expect(received).toEqual([{ type: "changed" }]);
-  });
-
-  it("rejects events larger than the configured limit", async () => {
-    const transport = new MemoryEventsTransport({ SSE_MAX_EVENT_BYTES: "8" });
-    await transport.connect(() => undefined);
-    await expect(transport.publish({ message: "too large" })).rejects.toThrow(
-      "Event data exceeds SSE_MAX_EVENT_BYTES",
-    );
-  });
-});

package/dist/templates/todo/CLAUDE.md

@@ -1,6 +0,0 @@
-# CLAUDE.md
-
-Agent guidance for this project lives in [AGENTS.md](./AGENTS.md). It is imported
-below so Claude Code loads the same rules the other AI tools read.
-
-@AGENTS.md

package/dist/templates/todo/Dockerfile.dev

@@ -1,58 +0,0 @@
-# Development image for the PodoKit monorepo (web + api).
-# Dependencies and source are baked in; `docker compose watch` syncs your
-# edits into the running container so the native file watchers fire.
-
-# Every workspace manifest, collected rather than listed.
-#
-# Listing them by hand only works for the workspaces this template starts with. A
-# project that adds `packages/*` then has workspace manifests that never reach the
-# image, so npm does not know those names are local and goes looking for them on the
-# public registry — `npm error 404 '@scope/thing' is not in this registry`, from an
-# install that succeeds on the developer's own machine. The production images
-# collect manifests for exactly this reason; this one was the exception until a
-# generated project with shared packages could not start its dev stack at all.
-FROM node:22-bookworm-slim AS manifests
-WORKDIR /src
-COPY . .
-RUN mkdir -p /app \
-    && cp package.json /app/ \
-    && find . -name package.json -not -path "*/node_modules/*" \
-         -exec sh -c 'mkdir -p "/app/$(dirname "$1")" && cp "$1" "/app/$1"' _ {} \;
-
-FROM node:22-bookworm-slim
-
-# git for the toolchain (editors, AI agents); build tools for native modules.
-RUN apt-get update \
-  && apt-get install -y --no-install-recommends git python3 make g++ ca-certificates \
-  && rm -rf /var/lib/apt/lists/*
-
-WORKDIR /app
-
-# Install workspace dependencies (cached unless a package.json changes).
-# NB: the host package-lock.json is intentionally NOT copied — a lockfile
-# generated on macOS/Windows prunes platform-specific optional deps and can drop
-# packages (e.g. @swc/cli) on linux. Resolving fresh in-container avoids that.
-COPY --from=manifests /app ./
-ARG PODOKIT_NPM_REGISTRY=""
-RUN if [ -n "$PODOKIT_NPM_REGISTRY" ]; then npm config set registry "$PODOKIT_NPM_REGISTRY"; fi \
-  && npm install
-
-# Baked source (kept in sync during development by `docker compose watch`).
-COPY . .
-
-# Workspace packages compile before the apps that import them. Apps import them by
-# their published entry point (`dist/index.js`), so without this the API starts and
-# dies on MODULE_NOT_FOUND for a package whose symlink is right there — the link
-# resolves, the built file behind it does not exist. `--if-present` keeps a project
-# with no packages, or one whose packages need no build, working unchanged.
-#
-# `docker compose watch` syncs app source only, so a change under packages/* needs
-# this image rebuilt rather than a container restart.
-RUN if [ -d packages ]; then \
-      for manifest in packages/*/package.json; do \
-        [ -e "$manifest" ] || continue; \
-        npm run build --if-present --workspace "$(dirname "$manifest")"; \
-      done; \
-    fi
-
-EXPOSE 5001 5002

package/dist/templates/todo/apps/api/Dockerfile

@@ -1,88 +0,0 @@
-# syntax=docker/dockerfile:1
-
-# The npm that reads package-lock.json must be the major that wrote it. node:22
-# bundles npm 10, and a lockfile written by npm 11 records platform-specific
-# packages as extraneous with no `optional` flag; npm 10 rejects those with
-# EBADPLATFORM instead of skipping them, so `npm ci` fails inside the image while
-# `npm install` on the developer's machine is fine. Keep this in step with the npm
-# the project is developed with.
-ARG NPM_VERSION=11.17.0
-
-# Every workspace manifest, and nothing else.
-#
-# Listing them by hand only works for the workspaces this template starts with: npm
-# does NOT fail when a workspace's package.json is absent, it silently installs a
-# tree without that package's dependencies. A project that adds packages/* then
-# builds against different versions than it resolves locally, and only inside the
-# image. Collecting them keeps `npm ci` correct whatever the workspace layout is,
-# and the stages below still cache on the manifests' content.
-FROM node:22-alpine AS manifests
-WORKDIR /src
-COPY . .
-RUN mkdir -p /app \
-    && cp package.json package-lock.json /app/ \
-    && find . -name package.json -not -path "*/node_modules/*" \
-         -exec sh -c 'mkdir -p "/app/$(dirname "$1")" && cp "$1" "/app/$1"' _ {} \;
-
-FROM node:22-alpine AS deps
-WORKDIR /app
-COPY --from=manifests /app ./
-ARG NPM_VERSION
-RUN npm i -g "npm@${NPM_VERSION}"
-RUN npm ci --no-audit --no-fund
-
-# Production dependencies only, resolved from the same lockfile. The runtime stage
-# copies node_modules from here and never from deps or build, so the shipped image
-# does not carry the TypeScript compiler, Vite, or the test tooling.
-FROM node:22-alpine AS prod-deps
-WORKDIR /app
-COPY --from=manifests /app ./
-ARG NPM_VERSION
-RUN npm i -g "npm@${NPM_VERSION}"
-# The runtime tree for this image only.
-#
-# Scoping to the one workspace matters: --omit=dev at the root still installs the
-# union of every workspace's production dependencies, so the API image carried Vite
-# and the web image carried Nest. Measured on a generated project, this is 198
-# packages instead of 283. TypeScript stays either way -- typeorm depends on ts-node,
-# which depends on it, so it is a production dependency and not bloat.
-RUN npm ci --omit=dev --no-audit --no-fund --workspace=apps/api --include-workspace-root
-
-FROM node:22-alpine AS build
-WORKDIR /app
-# Everything npm ci produced, not just the root node_modules: npm nests any
-# dependency it cannot hoist, and copying only the root directory leaves a workspace
-# package compiling against the wrong version of it.
-COPY --from=deps /app ./
-COPY . .
-# Local workspace packages compile before the app that imports them. Apps import
-# them by their published entry points and .dockerignore excludes dist, so nothing
-# here has compiled output until it is compiled here.
-RUN if [ -d packages ]; then \
-      for manifest in packages/*/package.json; do \
-        [ -e "$manifest" ] || continue; \
-        npm run build --if-present --workspace "$(dirname "$manifest")"; \
-      done; \
-    fi
-RUN npm run build --workspace=apps/api
-# The runtime needs the real workspace package directories, not just the symlinks
-# npm leaves in node_modules pointing at them. Without this the image boots and
-# dies on "Cannot find module <package>" -- a dangling link, at runtime only.
-# mkdir keeps the COPY valid for a project that has no packages/ at all.
-RUN mkdir -p /app/packages
-
-FROM node:22-alpine AS runtime
-WORKDIR /app
-ENV NODE_ENV=production
-RUN addgroup -S -g 101 app && adduser -S -D -H -u 100 -G app app
-COPY --from=prod-deps /app/node_modules ./node_modules
-COPY --from=manifests /app/apps/api ./apps/api
-COPY --from=build /app/packages ./packages
-COPY --from=build /app/apps/api/dist ./apps/api/dist
-COPY --from=build /app/apps/api/scripts ./apps/api/scripts
-WORKDIR /app/apps/api
-USER 100:101
-EXPOSE 3000
-HEALTHCHECK --interval=10s --timeout=5s --start-period=30s --retries=6 \
-  CMD node -e "fetch('http://127.0.0.1:3000/health/ready').then((r) => process.exit(r.ok ? 0 : 1)).catch(() => process.exit(1))"
-CMD ["node", "dist/main"]

package/dist/templates/todo/apps/api/nest-cli.json

@@ -1,5 +0,0 @@
-{
-  "$schema": "https://json.schemastore.org/nest-cli",
-  "collection": "@nestjs/schematics",
-  "sourceRoot": "src"
-}

package/dist/templates/todo/apps/api/package.json

@@ -1,66 +0,0 @@
-{
-  "name": "{{projectName}}-api",
-  "version": "0.0.0",
-  "private": true,
-  "scripts": {
-    "dev": "nest start --watch --builder swc",
-    "build": "nest build",
-    "start": "node dist/main",
-    "lint": "tsc -p tsconfig.json --noEmit",
-    "test": "jest --passWithNoTests",
-    "migrate:all": "node dist/database/migrate",
-    "typeorm": "typeorm-ts-node-commonjs -d src/database/data-source.ts",
-    "migration:run": "npm run typeorm -- migration:run",
-    "migration:revert": "npm run typeorm -- migration:revert",
-    "migration:generate": "npm run typeorm -- migration:generate"
-  },
-  "dependencies": {
-    "@podosoft/podokit-contracts": "^0.4.0",
-    "@nestjs/common": "^11.1.27",
-    "@nestjs/config": "^4.0.4",
-    "@nestjs/core": "^11.1.27",
-    "@nestjs/platform-express": "^11.1.27",
-    "@nestjs/swagger": "^11.4.5",
-    "@nestjs/typeorm": "^11.0.3",
-    "class-transformer": "^0.5.1",
-    "class-validator": "^0.14.1",
-    "dotenv": "^16.4.5",
-    "pg": "^8.12.0",
-    "reflect-metadata": "^0.2.2",
-    "rxjs": "^7.8.1",
-    "typeorm": "^0.3.20",
-    "zod": "^3.23.8"
-  },
-  "devDependencies": {
-    "@nestjs/cli": "^11.0.23",
-    "@nestjs/testing": "^11.1.27",
-    "@types/express": "^5.0.1",
-    "@types/node": "^20.17.0",
-    "@types/supertest": "^6.0.2",
-    "jest": "^29.7.0",
-    "supertest": "^7.0.0",
-    "ts-jest": "^29.2.5",
-    "ts-node": "^10.9.2",
-    "typescript": "^6.0.3",
-    "@swc/core": "^1.7.0",
-    "@swc/cli": "^0.4.0"
-  },
-  "jest": {
-    "moduleFileExtensions": [
-      "js",
-      "json",
-      "ts"
-    ],
-    "rootDir": "src",
-    "testRegex": ".*\\.spec\\.ts$",
-    "transform": {
-      "^.+\\.ts$": [
-        "ts-jest",
-        {
-          "tsconfig": "tsconfig.json"
-        }
-      ]
-    },
-    "testEnvironment": "node"
-  }
-}

package/dist/templates/todo/apps/api/scripts/.keep

@@ -1 +0,0 @@
-

package/dist/templates/todo/apps/api/src/app.extensions.ts

@@ -1,21 +0,0 @@
-import type { DynamicModule, Provider, Type } from "@nestjs/common";
-
-// Owned extension slot for the Nest app. This file is yours — PodoKit never
-// writes to it, so `podo update` leaves it alone. Use it to add your own modules
-// or providers, or to override a PodoKit-provided provider without editing
-// managed code. Because these are spread in *after* the module-wired providers,
-// an override here takes precedence.
-//
-// Example — override a provider with your own implementation:
-//   import { SomeService } from "./some/some.service";
-//   import { MyService } from "./my-service";
-//   export const extensionProviders: Provider[] = [
-//     { provide: SomeService, useClass: MyService },
-//   ];
-
-/** Extra modules to import into AppModule (or DynamicModule overrides). */
-export const extensionImports: (Type | DynamicModule)[] = [];
-
-/** Extra or overriding providers for AppModule. Same-token providers listed here
- *  win over the ones PodoKit modules registered. */
-export const extensionProviders: Provider[] = [];

package/dist/templates/todo/apps/api/src/app.module.ts

@@ -1,28 +0,0 @@
-import { Module } from "@nestjs/common";
-import { ConfigModule } from "@nestjs/config";
-import { TypeOrmModule } from "@nestjs/typeorm";
-import { validateEnv } from "./config/env.validation";
-import { dataSourceOptions } from "./database/data-source";
-import { HealthModule } from "./health/health.module";
-import { TodosModule } from "./todos/todos.module";
-import { extensionImports, extensionProviders } from "./app.extensions";
-// podokit:begin:imports
-// podokit:end:imports
-
-@Module({
-  imports: [
-    ConfigModule.forRoot({ isGlobal: true, validate: validateEnv }),
-    TypeOrmModule.forRoot(dataSourceOptions),
-    HealthModule,
-    TodosModule,
-    // podokit:begin:module-imports
-    // podokit:end:module-imports
-    ...extensionImports,
-  ],
-  providers: [
-    // podokit:begin:providers
-    // podokit:end:providers
-    ...extensionProviders,
-  ],
-})
-export class AppModule {}

package/dist/templates/todo/apps/api/src/common/all-exceptions.filter.ts

@@ -1,43 +0,0 @@
-import { ArgumentsHost, Catch, ExceptionFilter, HttpException, HttpStatus } from "@nestjs/common";
-import type { Request, Response } from "express";
-import { AppException } from "./app-exception";
-
-interface ErrorBody {
-  success: false;
-  error: {
-    code: string;
-    message: string;
-    statusCode: number;
-    path: string;
-    timestamp: string;
-  };
-}
-
-@Catch()
-export class AllExceptionsFilter implements ExceptionFilter {
-  catch(exception: unknown, host: ArgumentsHost): void {
-    const ctx = host.switchToHttp();
-    const response = ctx.getResponse<Response>();
-    const request = ctx.getRequest<Request>();
-
-    let statusCode = HttpStatus.INTERNAL_SERVER_ERROR;
-    let code = "INTERNAL_ERROR";
-    let message = "Internal server error";
-
-    if (exception instanceof AppException) {
-      statusCode = exception.statusCode;
-      code = exception.code;
-      message = exception.message;
-    } else if (exception instanceof HttpException) {
-      statusCode = exception.getStatus();
-      code = "HTTP_ERROR";
-      message = exception.message;
-    }
-
-    const body: ErrorBody = {
-      success: false,
-      error: { code, message, statusCode, path: request.url, timestamp: new Date().toISOString() },
-    };
-    response.status(statusCode).json(body);
-  }
-}

package/dist/templates/todo/apps/api/src/common/app-exception.ts

@@ -1,4 +0,0 @@
-// AppException is a shared contract (stable, language-independent error `code`
-// the frontend branches on). Re-exported from @podosoft/podokit-contracts so the
-// backend and any other layer reference one definition.
-export { AppException } from "@podosoft/podokit-contracts";

package/dist/templates/todo/apps/api/src/config/env.validation.ts

@@ -1,23 +0,0 @@
-import { z } from "zod";
-
-// Schema-validated environment. Fails fast at boot if something is wrong.
-const schema = z.object({
-  NODE_ENV: z.string().default("development"),
-  PORT: z.coerce.number().default(5002),
-  CORS_ORIGIN: z.string().optional(),
-  POSTGRES_HOST: z.string().default("localhost"),
-  POSTGRES_PORT: z.coerce.number().default(5432),
-  POSTGRES_USER: z.string().default("podokit"),
-  POSTGRES_PASSWORD: z.string().default("podokit"),
-  POSTGRES_DB: z.string().default("podokit"),
-});
-
-export type AppEnv = z.infer<typeof schema>;
-
-export function validateEnv(config: Record<string, unknown>): AppEnv {
-  const parsed = schema.safeParse(config);
-  if (!parsed.success) {
-    throw new Error(`Invalid environment:\n${parsed.error.toString()}`);
-  }
-  return parsed.data;
-}