@podosoft/podokit 0.17.4 → 1.0.2

package/dist/templates/{todo → fullstack}/compose.dev.yaml

@@ -1,21 +1,4 @@
-# Containerized development environment.
-#
-#   podo dev watch   # installed modules activate their required profiles
-#
-# A user-level PodoKit gateway owns loopback :80 and routes each *.localhost host
-# to this stack. The legacy per-project Traefik service is opt-in only.
-# api/postgres/redis/minio have NO published ports — they talk by service name
-# on the internal network, so this stack never collides with other projects.
-#
-# Core services (traefik, web, api, postgres) always run. PodoKit activates
-# module-specific profiles from .podokit/manifest.json:
-#   --profile cache    redis    (redis / rate-limit / bullmq modules)
-#   --profile storage  minio    (object-storage-s3 / file-upload modules)
-#   --profile queue    worker   (bullmq / job-progress modules)
-#
-# `watch` syncs your edits into the containers: the web has instant vite HMR;
-# an API source change restarts the api service (~5s), which is the stable
-# approach for nest inside a container.
+# Containerized Bun development environment.
 name: {{projectName}}-dev
 
 services:
@@ -30,7 +13,7 @@ services:
       - --api.insecure=true
     ports:
       - "${TRAEFIK_PORT:-80}:80"
-      - "127.0.0.1:${TRAEFIK_DASHBOARD_PORT:-8080}:8080" # Traefik dashboard (dev only)
+      - "127.0.0.1:${TRAEFIK_DASHBOARD_PORT:-8080}:8080"
     volumes:
       - ./infra/traefik/dynamic.yml:/etc/traefik/dynamic.yml:ro
     networks: [podokit]
@@ -41,14 +24,12 @@ services:
       dockerfile: Dockerfile.dev
       args:
         PODOKIT_NPM_REGISTRY: ${PODOKIT_NPM_REGISTRY:-}
-    command: npm run dev -w {{projectName}}-web -- --host 0.0.0.0
+    command: bun run --cwd apps/web dev -- --host 0.0.0.0
     working_dir: /app
     env_file: .env.docker
     environment:
       - VITE_DOCKER=1
       - BACKEND_INTERNAL_URL=http://api:5002
-      # One trusted Traefik proxy sits in front of SvelteKit. This keeps
-      # getClientAddress() tied to the visitor instead of the proxy container.
       - ADDRESS_HEADER=x-forwarded-for
       - XFF_DEPTH=1
     depends_on: [api]
@@ -67,7 +48,7 @@ services:
       args:
         PODOKIT_NPM_REGISTRY: ${PODOKIT_NPM_REGISTRY:-}
     init: true
-    command: npm run dev -w {{projectName}}-api
+    command: bun run --cwd apps/api dev
     working_dir: /app
     env_file: .env.docker
     depends_on:
@@ -75,16 +56,11 @@ services:
     networks: [podokit]
     develop:
       watch:
-        # nest-cli's in-container watch does not reliably respawn the app process,
-        # so restart the service on an API source change (~5s). The Docker docs'
-        # sync+restart is the stable, recommended approach; the web keeps instant
-        # HMR via plain sync.
         - { action: sync+restart, path: ./apps/api/src, target: /app/apps/api/src }
         - { action: sync, path: ./apps/api/scripts, target: /app/apps/api/scripts }
         - { action: rebuild, path: ./apps/api/package.json }
 
   worker:
-    # started only with the bullmq / job-progress modules: --profile queue
     profiles: [queue]
     build:
       context: .
@@ -92,7 +68,7 @@ services:
       args:
         PODOKIT_NPM_REGISTRY: ${PODOKIT_NPM_REGISTRY:-}
     init: true
-    command: npm run dev:worker -w {{projectName}}-api
+    command: bun run --cwd apps/api dev:worker
     working_dir: /app
     env_file: .env.docker
     depends_on:
@@ -100,10 +76,6 @@ services:
     networks: [podokit]
     develop:
       watch:
-        # nest-cli's in-container watch does not reliably respawn the app process,
-        # so restart the service on an API source change (~5s). The Docker docs'
-        # sync+restart is the stable, recommended approach; the web keeps instant
-        # HMR via plain sync.
         - { action: sync+restart, path: ./apps/api/src, target: /app/apps/api/src }
         - { action: sync, path: ./apps/api/scripts, target: /app/apps/api/scripts }
         - { action: rebuild, path: ./apps/api/package.json }
@@ -121,16 +93,14 @@ services:
       retries: 20
     volumes:
       - pgdata:/var/lib/postgresql/data
-    networks: [podokit] # no published ports — internal only
+    networks: [podokit]
 
   redis:
-    # started only with the redis / rate-limit / bullmq modules: --profile cache
     profiles: [cache]
     image: redis:7-alpine
-    networks: [podokit] # internal only
+    networks: [podokit]
 
   minio:
-    # started only with the object-storage-s3 / file-upload modules: --profile storage
     profiles: [storage]
     image: minio/minio:latest
     command: server /data --console-address ":9001"
@@ -139,7 +109,7 @@ services:
       MINIO_ROOT_PASSWORD: podokitsecret
     volumes:
       - miniodata:/data
-    networks: [podokit] # internal only
+    networks: [podokit]
 
   minio-init:
     profiles: [storage]

package/dist/templates/{fullstack-nest-svelte → fullstack}/dot-agents/skills/podokit-deploy/SKILL.md

@@ -13,15 +13,15 @@ Read the profile's `driver` first and say which one you are operating.
 | `kubernetes-helm` | a cluster context and namespace | you already run a cluster, or you need more than one node, cluster-managed rollouts, or per-workload scaling |
 | `docker-compose` | one Docker host, local or over `ssh://` | one machine is the whole deployment and a reverse proxy in front of it terminates TLS |
 
-1. Run `npx @podosoft/podokit status`, `npx @podosoft/podokit diff`, and `npx @podosoft/podokit doctor`. Stop if managed-file conflicts or unsupported framework versions could make the image unreliable.
+1. Run `{{packageExecutor}} @podosoft/podokit status`, `{{packageExecutor}} @podosoft/podokit diff`, and `{{packageExecutor}} @podosoft/podokit doctor`. Stop if managed-file conflicts or unsupported framework versions could make the image unreliable.
 2. Read [references/profile.md](references/profile.md) before creating or changing a deployment profile.
 3. Make sure the images exist for that tag. Read [references/release.md](references/release.md): tagging `vX.Y.Z` runs the release workflow, which builds and pushes both images and stops there. Never apply a release whose images were not published.
-4. Run `npx @podosoft/podokit deploy doctor --profile <name>`. Resolve every failure without printing secret values.
-5. Run `npx @podosoft/podokit deploy plan --profile <name> --release <stable-semver> --json`.
+4. Run `{{packageExecutor}} @podosoft/podokit deploy doctor --profile <name>`. Resolve every failure without printing secret values.
+5. Run `{{packageExecutor}} @podosoft/podokit deploy plan --profile <name> --release <stable-semver> --json`.
 6. Show the user the driver, the target (context plus namespace and Helm release, or Docker context plus Compose project), the fingerprint result, the exact image digests, the current revision, the actions, the migration warning, and the plan hash.
 7. Do not apply until the user explicitly approves that exact plan.
-8. Apply with `npx @podosoft/podokit deploy apply --profile <name> --release <stable-semver> --confirm <plan-hash>`.
-9. Run `npx @podosoft/podokit deploy status --profile <name> --json` and `npx @podosoft/podokit deploy verify --profile <name> --json`.
+8. Apply with `{{packageExecutor}} @podosoft/podokit deploy apply --profile <name> --release <stable-semver> --confirm <plan-hash>`.
+9. Run `{{packageExecutor}} @podosoft/podokit deploy status --profile <name> --json` and `{{packageExecutor}} @podosoft/podokit deploy verify --profile <name> --json`.
 10. Report the exact images, the revision, running replicas, restart totals, and the verification result. Report `syncDrift` too: a non-empty value means containers are running locally synced artifacts and the release tag does not describe what is serving.
 
 ## Iterating against a deployment is a different command

package/dist/templates/{fullstack-nest-svelte → fullstack}/dot-agents/skills/podokit-deploy/references/profile.md

@@ -9,14 +9,16 @@ document.
 Initialize it with an explicit kubeconfig context:
 
 ```bash
-npx @podosoft/podokit deploy init --profile production --context production --host app.example.com
+{{packageExecutor}} @podosoft/podokit deploy init --profile production --context production --host app.example.com
 ```
 
 Review these fields before planning:
 
 - `target`: context, cluster fingerprint, namespace, release
 - `release`: API/web repositories and stable SemVer tag pattern
-- `exposure`: Ingress or NodePort; Ingress routes every public path to web
+- `exposure`: Ingress or NodePort. Ingress routes `/` to web and routes only the
+  exact paths in `webSocketPaths` directly to API. The list is empty by default;
+  root, prefixes, patterns, queries, encoded separators, and traversal are invalid.
 - `workloads`: API/web replicas and resources plus an optional worker
 - `dependencies`: PostgreSQL, Redis, and object storage mode, image, Secret name, and storage
 - `secrets`: API/optional web Secret names and required key names, plus image-pull Secret
@@ -47,7 +49,7 @@ and it is pinned by a fingerprint of the endpoint plus the daemon ID, so repoint
 it at a different host invalidates the profile instead of deploying somewhere else.
 
 ```bash
-npx @podosoft/podokit deploy init \
+{{packageExecutor}} @podosoft/podokit deploy init \
   --profile production \
   --driver docker-compose \
   --context production \

package/dist/templates/{fullstack-nest-svelte → fullstack}/dot-agents/skills/podokit-deploy/references/rollback.md

@@ -3,14 +3,14 @@
 Inspect status and Helm history before choosing a revision:
 
 ```bash
-npx @podosoft/podokit deploy status --profile production --json
+{{packageExecutor}} @podosoft/podokit deploy status --profile production --json
 helm history <release> --namespace <namespace> --kube-context <context>
 ```
 
 Preview a rollback:
 
 ```bash
-npx @podosoft/podokit deploy rollback --profile production --revision <number>
+{{packageExecutor}} @podosoft/podokit deploy rollback --profile production --revision <number>
 ```
 
 Show the target revision, current revision, context, namespace, warning, and generated plan hash. Obtain explicit approval, then pass that exact hash with `--confirm`.

package/dist/templates/{fullstack-nest-svelte → fullstack}/dot-agents/skills/podokit-deploy-fast/SKILL.md

@@ -11,7 +11,7 @@ already running and restarts them. `docker-compose` driver only — read the pro
 to reach every node and would stop being a shortcut.
 
 ```bash
-npx @podosoft/podokit deploy sync --profile <name> --build
+{{packageExecutor}} @podosoft/podokit deploy sync --profile <name> --build
 ```
 
 ## Say what this does before doing it
@@ -36,7 +36,7 @@ cannot detect, which is why they are your job.
 
 | Situation | Why |
 | --- | --- |
-| runtime dependencies changed | the container's `node_modules` was installed `--omit=dev` from the old manifest, so the new code imports something that is not there |
+| API/worker runtime dependencies changed | those containers installed the old dependency graph, so the new code imports something that is not there; the bundled web build carries its own dependencies |
 | a release holds the deployment lock | an apply is in progress |
 | nothing is running for that project | there is no container to copy into |
 | **the change needs a migration** | sync never migrates, and a migration belongs with the release whose code needs it |
@@ -61,7 +61,7 @@ cannot detect, which is why they are your job.
 ## Restoring the image
 
 ```bash
-npx @podosoft/podokit deploy sync --profile <name> --revert
+{{packageExecutor}} @podosoft/podokit deploy sync --profile <name> --revert
 ```
 
 This recreates the containers from the Compose project **already on the target**,

package/dist/templates/{todo → fullstack}/dot-claude/skills/podokit-add-module/SKILL.md

@@ -11,7 +11,7 @@ whether a module provides it — modules wire themselves into the app correctly.
 ```bash
 podo add                 # list available modules
 podo add <module>        # e.g. auth, admin-dashboard, redis, bullmq, file-upload
-npm install              # install newly-added dependencies
+{{packageManager}} install              # install newly-added dependencies
 ```
 
 Common modules: `auth` (better-auth: email/password, sessions, OAuth, 2FA,
@@ -23,5 +23,5 @@ runtime settings, requires auth), `redis`, `bullmq` (queue + worker),
 Notes:
 - A module auto-adds its required modules (e.g. `admin-dashboard` adds `auth`).
 - After adding, follow the printed next steps (often DB migrations, e.g.
-  `npx @better-auth/cli migrate -y --config apps/api/src/auth/auth.ts`).
+  `bun run --cwd apps/api migrate:all`).
 - Module wiring lands inside `// podokit:` fenced regions — don't hand-edit those.

package/dist/templates/fullstack/dot-claude/skills/podokit-elysia-endpoint/SKILL.md

@@ -0,0 +1,27 @@
+---
+name: podokit-elysia-endpoint
+description: Use when adding or changing an Elysia REST endpoint in apps/api. Covers typed validation, access policy, the standard error envelope, OpenAPI, and Bun tests.
+---
+
+# Add an Elysia endpoint
+
+1. Create or extend an `Elysia` plugin under `apps/api/src/<feature>/`. Export a
+   module descriptor with `plugin`, optional startup `configure`, and optional
+   OpenAPI contribution. Wire it in `apps/api/src/app.ts` inside the
+   `// podokit:begin:imports` and `// podokit:begin:modules` fences.
+2. Validate path, query, headers, and bodies with Elysia `t` schemas. Keep
+   TypeScript strict, avoid `any`, and declare function return types.
+   Use the same parameter name at the same structural route position throughout
+   one application: `/hosts/:hostId` and `/hosts/:hostId/files` are compatible,
+   while `/hosts/:id` and `/hosts/:hostId/files` are not.
+3. Throw `AppException("STABLE_CODE", "message", statusCode)` for domain
+   failures. The global handler renders
+   `{ success: false, error: { code, message, statusCode, path, timestamp } }`.
+4. APIs are authenticated by default when auth is installed. Register an
+   explicit `public`, `session`, `admin`, or `api-key` policy for every route.
+5. Add route detail and response schemas so the endpoint is present in the
+   merged OpenAPI document at `/api-docs-json`.
+6. Add a `bun:test` unit or integration test beside the feature. Verify with
+   `bun run lint`, `bun test`, `bun run build`, and
+   `bun run --cwd apps/api contract` without starting a dev server. The contract
+   gate assembles every plugin and rejects conflicting route parameter names.

package/dist/templates/{todo → fullstack}/dot-claude/skills/podokit-sveltekit-route/SKILL.md

@@ -8,16 +8,16 @@ description: Use when adding or changing a SvelteKit page/route in apps/web —
 1. **Route**: add a folder under `apps/web/src/routes/`. Load data in
    `+page.server.ts` / `+layout.server.ts` (SSR), not in the browser.
 2. **Call the API only through the server proxy** — never a direct browser
-   `fetch` to `:5002`. Use the app's `ApiClient`: `$lib/api.ts` (browser,
-   same-origin `/api/*` proxy) and `$lib/server/api.ts` (SSR, internal URL +
+   `fetch` to `:5002`. Use the app's `ApiClient`: `#lib/api.js` (browser,
+   same-origin `/api/*` proxy) and `#lib/server/api.js` (SSR, internal URL +
    cookie forwarding). It throws `ApiError` — branch on `err.code`.
 3. **Svelte 5 runes only**: `$state`, `$derived`, `$effect`, `$props`. Never `$:`.
-4. **UI**: use shadcn-svelte components (`$lib/components/ui/*`) over raw HTML.
+4. **UI**: use shadcn-svelte components (`#lib/components/ui/*/index.js`) over raw HTML.
    Do **not** edit `ui/**` — wrap it if you need to customize. Semantic Tailwind
    classes (`bg-background`, `text-foreground`); responsive (`sm:`/`md:`/`lg:`).
    For any list/table, use the shared `DataTable` (see the podokit-data-table
    skill, added with the admin-dashboard module).
 5. **i18n**: no hardcoded user-facing strings — add keys to
    `apps/web/src/lib/i18n/messages.ts` for **every** locale.
-6. **Verify**: `npm run build -w {{projectName}}-web` (includes `svelte-check`)
+6. **Verify**: `{{webRun}} build` (includes `svelte-check`)
    and add/adjust a Playwright test in `tests/`.

package/dist/templates/{fullstack-nest-svelte → fullstack}/dot-claude/skills/podokit-update/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: podokit-update
-description: Use when the user wants to update the project to a newer PodoKit version, pull in template/module improvements, check what they've changed vs the generated code, or take ownership of a managed file. Covers podo status/diff/doctor/update/eject.
+description: Use when the user wants to update a Bun-based project to a newer PodoKit v1 version, pull in template/module improvements, check local edits, or take ownership of a managed file. Covers podo status/diff/doctor/update/eject.
 ---
 
 # Keep a PodoKit project up to date
@@ -24,3 +24,5 @@ Rules to respect:
   the `// podokit:begin…end` fences.
 - Run `podo update` (dry-run) first and read the plan before `--apply`. Commit or
   stash your work beforehand so a merge is easy to review.
+- PodoKit v1 projects are Bun-only. A PodoKit 0.x project must keep using its
+  pinned 0.x CLI; there is no in-place NestJS/Node conversion path.

package/dist/templates/{todo → fullstack}/dot-devcontainer/devcontainer.json

@@ -16,5 +16,5 @@
     }
   },
   "forwardPorts": [],
-  "remoteUser": "node"
+  "remoteUser": "{{runtime}}"
 }

package/dist/templates/{fullstack-nest-svelte → fullstack}/dot-env.example

@@ -13,14 +13,8 @@ POSTGRES_DB=podokit
 # Web -> API boundary (server-side only; not exposed to the browser)
 BACKEND_INTERNAL_URL=http://localhost:5002
 
-# Exact paths the web server may proxy as WebSocket upgrades to the API, comma
-# separated. Empty means none: a SvelteKit route cannot answer an upgrade, so a
-# WebSocket gateway on the API is unreachable until it is named here. Each path is
-# matched whole and must be authorised by the API at handshake time -- a relay that
-# forwards anything is an open tunnel to every private route.
-WS_PROXY_PATHS=
 CORS_ORIGIN=http://localhost:5001
-# adapter-node request limit; leave room for a 2 MiB multipart upload
+# Web request limit; leave room for a 2 MiB multipart upload
 BODY_SIZE_LIMIT=3M
 
 # ── Optional / development ───────────────────────────────────────────

package/dist/templates/{todo → fullstack}/dot-github/workflows/release.yml

@@ -60,22 +60,19 @@ jobs:
     steps:
       - uses: actions/checkout@v5
 
-      - uses: actions/setup-node@v6
-        with:
-          node-version: 22
-          cache: npm
+      {{ciSetup}}
 
-      - run: npm ci --no-audit --no-fund
+      - run: {{ciInstallCommand}}
 
       # Verify before publishing. An image built from a commit that never passed is
       # indistinguishable from one that did, once it is in the registry.
-      - run: npm run lint
-      - run: npm test
+      - run: {{ciLintCommand}}
+      - run: {{ciTestCommand}}
 
       - name: Read the release target from the deployment profile
         id: profile
         run: |
-          node --input-type=module -e '
+          {{profileRuntime}} -e '
             import { readFileSync } from "node:fs";
             const name = process.env.PROFILE || "production";
             const path = `.podokit/deploy/${name}.json`;

package/dist/templates/fullstack/dot-mcp.json

@@ -0,0 +1,8 @@
+{
+  "mcpServers": {
+    "podokit": {
+      "command": "{{packageExecutorCommand}}",
+      "args": [{{packageExecutorArgs}}"@podosoft/podokit-mcp"]
+    }
+  }
+}

package/dist/templates/fullstack/dot-podokit/dev.json

@@ -0,0 +1,5 @@
+{
+  "schemaVersion": 1,
+  "hostname": "{{projectName}}.localhost",
+  "webSocketPaths": []
+}

package/dist/templates/{fullstack-nest-svelte → fullstack}/infra/docker/docker-compose.yml

@@ -47,9 +47,9 @@ services:
   # Local SMS catcher (the "Mailpit for SMS"): the app posts outgoing SMS here via
   # SMS_WEBHOOK_URL and tests read them over REST. Development only.
   sms-sink:
-    image: node:20-alpine
+    image: oven/bun:1.4.0-alpine
     profiles: ["dev"]
-    command: ["node", "/app/sms-sink.mjs"]
+    command: ["bun", "/app/sms-sink.mjs"]
     environment:
       PORT: "8095"
     ports:

package/dist/templates/{fullstack-nest-svelte → fullstack}/infra/docker/sms-sink.mjs

@@ -1,7 +1,8 @@
 // Dev/test SMS sink — the "Mailpit for SMS". The app posts outgoing SMS here
 // (via SMS_WEBHOOK_URL) instead of a real provider, and tests read them back
 // over REST. Development only; never runs in production (see the `dev` profile
-// in docker-compose.yml). Uses only Node built-ins, run on a stock node image.
+// in docker-compose.yml). It uses Bun-compatible standard library APIs and runs
+// on the same pinned Bun Alpine runtime as generated applications.
 import { createServer } from "node:http";
 
 const PORT = Number(process.env.PORT ?? 8095);

package/dist/templates/{fullstack-nest-svelte → fullstack}/infra/k3s/README.md

@@ -16,3 +16,8 @@ the directory if you deploy with `podo deploy`. If you do apply them by hand, re
 every `example.com` and `ghcr.io/example/...` placeholder first, and note that the
 image tags below are placeholders too: the deployment tooling rejects `latest`,
 branch tags, and empty tags, and so should you.
+
+For a hand-managed API WebSocket endpoint, add a `pathType: Exact` Ingress path to
+the API service before the existing `/` web path. Do not route a prefix or the root
+to API. Deployment profiles express the same rule with
+`exposure.webSocketPaths` and validate it before rendering.

package/dist/templates/{fullstack-nest-svelte → fullstack}/infra/k3s/configmap.yaml

@@ -9,5 +9,7 @@ data:
   CORS_ORIGIN: "https://example.com"
   BACKEND_INTERNAL_URL: "http://api:3000"
   BODY_SIZE_LIMIT: "3M"
+  PROTOCOL_HEADER: "x-forwarded-proto"
+  HOST_HEADER: "x-forwarded-host"
   ADDRESS_HEADER: "x-forwarded-for"
   XFF_DEPTH: "1"

package/dist/templates/fullstack/package.json

@@ -0,0 +1,27 @@
+{
+  "name": "{{projectName}}",
+  "version": "0.0.0",
+  "private": true,
+  "packageManager": "bun@1.4.0",
+  "engines": {
+    "bun": "1.4.0"
+  },
+  "workspaces": [
+    "apps/*",
+    "tests"
+  ],
+  "overrides": {
+    "@sveltejs/kit": {
+      "cookie": "2.0.1"
+    }
+  },
+  "scripts": {
+    "dev": "bun run --workspaces --if-present dev",
+    "build": "bun run --workspaces --if-present build",
+    "lint": "bun run --workspaces --if-present lint",
+    "test": "bun run --workspaces --if-present test",
+    "test:e2e": "bun run --cwd tests test:e2e",
+    "test:e2e:ui": "bun run --cwd tests test:e2e:ui",
+    "test:e2e:api": "bun run --cwd tests test:e2e:api"
+  }
+}

package/dist/templates/{fullstack-nest-svelte → fullstack}/tests/README.md

@@ -3,19 +3,19 @@
 End-to-end tests for this app, run with [`@playwright/test`](https://playwright.dev):
 
 ```bash
-npm run test:e2e         # all specs (api + ui)
-npm run test:e2e:api     # backend endpoints (request-only)
-npm run test:e2e:ui      # pages (chromium)
-npm run test:e2e:report  # open the HTML report
+{{rootRun}} test:e2e         # all specs (api + ui)
+{{rootRun}} test:e2e:api     # backend endpoints (request-only)
+{{rootRun}} test:e2e:ui      # pages (chromium)
+{{rootRun}} test:e2e:report  # open the HTML report
 ```
 
 The suite runs against a live stack (web on `E2E_BASE_URL`, proxying `/api/*` to
 the API). With the recommended containerized loop, start `podo dev watch` and run:
 
 ```bash
-E2E_BASE_URL=http://{{projectName}}.localhost npm run test:e2e
+E2E_BASE_URL=http://{{projectName}}.localhost {{rootRun}} test:e2e
 ```
 
-The default `http://localhost:5001` is for the alternative `npm run dev`
+The default `http://localhost:5001` is for the alternative `{{rootRun}} dev`
 host-process loop. Files ending in `*.api.spec.ts` run in the request-only `api`
 project; `*.ui.spec.ts` run in the chromium `ui` project.

package/dist/templates/fullstack/tests/package.json

@@ -0,0 +1,15 @@
+{
+  "name": "{{projectName}}-tests",
+  "version": "0.0.0",
+  "private": true,
+  "scripts": {
+    "test:e2e": "bunx playwright test",
+    "test:e2e:ui": "bunx playwright test --project=ui",
+    "test:e2e:api": "bunx playwright test --project=api",
+    "test:e2e:report": "bunx playwright show-report"
+  },
+  "devDependencies": {
+    "@playwright/test": "^1.61.1",
+    "otpauth": "^9.5.1"
+  }
+}

package/dist/templates/{fullstack-nest-svelte → fullstack}/tests/ui/smoke.ui.spec.ts

@@ -4,5 +4,6 @@ import { expect, test } from "@playwright/test";
 test("app is reachable @smoke", async ({ page }) => {
   const res = await page.goto("/");
   expect(res?.status()).toBeLessThan(400);
-  await expect(page.locator("body")).toBeVisible();
+  await expect(page.locator("main")).toBeVisible();
+  await expect(page.getByRole("heading", { level: 1 })).toBeVisible();
 });

package/dist/templates/modules/admin-dashboard/files/apps/api/scripts/bootstrap-admin.mjs

@@ -1,4 +1,4 @@
-#!/usr/bin/env node
+#!/usr/bin/env bun
 
 import { pathToFileURL } from "node:url";
 
@@ -17,9 +17,9 @@ function usage() {
   console.log(`Create or verify the initial PodoKit administrator.
 
 Usage:
-  npm run admin:bootstrap -w <app>-api
-  npm run admin:bootstrap -w <app>-api -- --dry-run
-  npm run admin:bootstrap -w <app>-api -- --check-only
+  {{apiRun}} admin:bootstrap
+  {{apiRun}} admin:bootstrap -- --dry-run
+  {{apiRun}} admin:bootstrap -- --check-only
 
 Required environment:
   ADMIN_EMAILS               Allowed administrator emails (comma-separated)