@podosoft/podokit 0.2.0 → 0.3.0

package/dist/templates/modules/api-key-auth/files/apps/api/src/api-key/api-key.module.ts

@@ -0,0 +1,9 @@
+import { Module } from "@nestjs/common";
+import { MachineController } from "../machine/machine.controller";
+import { ApiKeyGuard } from "./api-key.guard";
+
+@Module({
+  controllers: [MachineController],
+  providers: [ApiKeyGuard],
+})
+export class ApiKeyModule {}

package/dist/templates/modules/api-key-auth/files/apps/api/src/machine/machine.controller.ts

@@ -0,0 +1,14 @@
+import { Controller, Get } from "@nestjs/common";
+import { ApiTags } from "@nestjs/swagger";
+import { ApiKeyProtected } from "../api-key/api-key.decorator";
+
+@ApiTags("machine")
+@Controller("machine")
+export class MachineController {
+  // Reachable with a valid X-API-Key, no user session required.
+  @ApiKeyProtected()
+  @Get("ping")
+  ping(): { ok: true; via: "api-key" } {
+    return { ok: true, via: "api-key" };
+  }
+}

package/dist/templates/modules/api-key-auth/module.manifest.json

@@ -0,0 +1,19 @@
+{
+  "name": "api-key-auth",
+  "description": "API-key auth for machine/service clients (X-API-Key), separate from user sessions. Provides an ApiKeyGuard and @ApiKeyProtected() to open a route to key holders. Requires auth.",
+  "requires": ["auth"],
+  "targetApp": "api",
+  "env": [
+    "# api keys for machine clients (comma-separated)",
+    "API_KEYS=dev-key-please-change"
+  ],
+  "inject": [
+    { "file": "apps/api/src/app.module.ts", "marker": "// podokit:imports", "text": "import { ApiKeyModule } from \"./api-key/api-key.module\";" },
+    { "file": "apps/api/src/app.module.ts", "marker": "// podokit:module-imports", "text": "ApiKeyModule," }
+  ],
+  "instructions": [
+    "Set API_KEYS in .env (comma-separated).",
+    "Protect a route for machine clients with @ApiKeyProtected() (bypasses the user session, requires X-API-Key).",
+    "Call it:  curl -H 'x-api-key: dev-key-please-change' localhost:3000/machine/ping"
+  ]
+}

package/dist/templates/modules/audit-log/files/apps/api/src/audit/audit-log.entity.ts

@@ -0,0 +1,25 @@
+import { Column, CreateDateColumn, Entity, PrimaryGeneratedColumn } from "typeorm";
+
+@Entity("audit_logs")
+export class AuditLog {
+  @PrimaryGeneratedColumn("uuid")
+  id!: string;
+
+  @Column({ type: "varchar", nullable: true })
+  userId!: string | null;
+
+  @Column({ type: "varchar", length: 10 })
+  method!: string;
+
+  @Column({ type: "varchar", length: 2048 })
+  path!: string;
+
+  @Column({ type: "int" })
+  statusCode!: number;
+
+  @Column({ type: "varchar", nullable: true })
+  ip!: string | null;
+
+  @CreateDateColumn({ type: "timestamptz" })
+  createdAt!: Date;
+}

package/dist/templates/modules/audit-log/files/apps/api/src/audit/audit.controller.ts

@@ -0,0 +1,16 @@
+import { Controller, Get } from "@nestjs/common";
+import { InjectRepository } from "@nestjs/typeorm";
+import { ApiTags } from "@nestjs/swagger";
+import { Repository } from "typeorm";
+import { AuditLog } from "./audit-log.entity";
+
+@ApiTags("audit")
+@Controller("audit-logs")
+export class AuditController {
+  constructor(@InjectRepository(AuditLog) private readonly logs: Repository<AuditLog>) {}
+
+  @Get()
+  recent(): Promise<AuditLog[]> {
+    return this.logs.find({ order: { createdAt: "DESC" }, take: 50 });
+  }
+}

package/dist/templates/modules/audit-log/files/apps/api/src/audit/audit.interceptor.ts

@@ -0,0 +1,39 @@
+import { type CallHandler, type ExecutionContext, Injectable, type NestInterceptor } from "@nestjs/common";
+import { InjectRepository } from "@nestjs/typeorm";
+import { fromNodeHeaders } from "better-auth/node";
+import type { Request, Response } from "express";
+import { type Observable, tap } from "rxjs";
+import { Repository } from "typeorm";
+import { auth } from "../auth/auth";
+import { AuditLog } from "./audit-log.entity";
+
+const AUDITED_METHODS = new Set(["POST", "PUT", "PATCH", "DELETE"]);
+
+// Records who performed each mutating request. Skips the auth endpoints.
+@Injectable()
+export class AuditInterceptor implements NestInterceptor {
+  constructor(@InjectRepository(AuditLog) private readonly logs: Repository<AuditLog>) {}
+
+  intercept(context: ExecutionContext, next: CallHandler): Observable<unknown> {
+    const req = context.switchToHttp().getRequest<Request>();
+    const path = req.originalUrl ?? req.url;
+    if (!AUDITED_METHODS.has(req.method) || path.startsWith("/api/auth")) {
+      return next.handle();
+    }
+    const res = context.switchToHttp().getResponse<Response>();
+    return next.handle().pipe(tap(() => void this.record(req, res, path)));
+  }
+
+  private async record(req: Request, res: Response, path: string): Promise<void> {
+    let userId: string | null = null;
+    try {
+      const session = await auth.api.getSession({ headers: fromNodeHeaders(req.headers) });
+      userId = session?.user?.id ?? null;
+    } catch {
+      userId = null;
+    }
+    await this.logs.save(
+      this.logs.create({ userId, method: req.method, path, statusCode: res.statusCode, ip: req.ip ?? null }),
+    );
+  }
+}

package/dist/templates/modules/audit-log/files/apps/api/src/audit/audit.module.ts

@@ -0,0 +1,13 @@
+import { Module } from "@nestjs/common";
+import { APP_INTERCEPTOR } from "@nestjs/core";
+import { TypeOrmModule } from "@nestjs/typeorm";
+import { AuditController } from "./audit.controller";
+import { AuditInterceptor } from "./audit.interceptor";
+import { AuditLog } from "./audit-log.entity";
+
+@Module({
+  imports: [TypeOrmModule.forFeature([AuditLog])],
+  controllers: [AuditController],
+  providers: [{ provide: APP_INTERCEPTOR, useClass: AuditInterceptor }],
+})
+export class AuditModule {}

package/dist/templates/modules/audit-log/files/apps/api/src/migrations/1720300000000-InitAuditLogs.ts

@@ -0,0 +1,25 @@
+import type { MigrationInterface, QueryRunner } from "typeorm";
+
+export class InitAuditLogs1720300000000 implements MigrationInterface {
+  name = "InitAuditLogs1720300000000";
+
+  async up(queryRunner: QueryRunner): Promise<void> {
+    await queryRunner.query(`CREATE EXTENSION IF NOT EXISTS "pgcrypto"`);
+    await queryRunner.query(`
+      CREATE TABLE "audit_logs" (
+        "id" uuid NOT NULL DEFAULT gen_random_uuid(),
+        "userId" character varying,
+        "method" character varying(10) NOT NULL,
+        "path" character varying(2048) NOT NULL,
+        "statusCode" integer NOT NULL,
+        "ip" character varying,
+        "createdAt" TIMESTAMP WITH TIME ZONE NOT NULL DEFAULT now(),
+        CONSTRAINT "PK_audit_logs_id" PRIMARY KEY ("id")
+      )
+    `);
+  }
+
+  async down(queryRunner: QueryRunner): Promise<void> {
+    await queryRunner.query(`DROP TABLE "audit_logs"`);
+  }
+}

package/dist/templates/modules/audit-log/module.manifest.json

@@ -0,0 +1,16 @@
+{
+  "name": "audit-log",
+  "description": "Audit logging: a global interceptor records who did each mutating request (who/method/path/status) to an audit_logs table. Requires auth.",
+  "requires": ["auth"],
+  "targetApp": "api",
+  "env": [],
+  "inject": [
+    { "file": "apps/api/src/app.module.ts", "marker": "// podokit:imports", "text": "import { AuditModule } from \"./audit/audit.module\";" },
+    { "file": "apps/api/src/app.module.ts", "marker": "// podokit:module-imports", "text": "AuditModule," }
+  ],
+  "instructions": [
+    "Run migrations to create the audit_logs table:  npm run migration:run -w <app>-api",
+    "Mutating requests (POST/PUT/PATCH/DELETE) are recorded with the acting user.",
+    "List recent entries (requires a session):  curl -b cookies.txt localhost:3000/audit-logs"
+  ]
+}

package/dist/templates/modules/auth/files/apps/api/src/account/account.controller.ts

@@ -0,0 +1,13 @@
+import { Controller, Get } from "@nestjs/common";
+import { Session, type UserSession } from "@thallesp/nestjs-better-auth";
+import { ApiTags } from "@nestjs/swagger";
+
+// Protected by the global AuthGuard. Use @Session() to read the current user.
+@ApiTags("account")
+@Controller("account")
+export class AccountController {
+  @Get("me")
+  me(@Session() session: UserSession) {
+    return session.user;
+  }
+}

package/dist/templates/modules/auth/files/apps/api/src/account/account.module.ts

@@ -0,0 +1,5 @@
+import { Module } from "@nestjs/common";
+import { AccountController } from "./account.controller";
+
+@Module({ controllers: [AccountController] })
+export class AccountModule {}

package/dist/templates/modules/auth/files/apps/api/src/auth/auth.ts

@@ -0,0 +1,36 @@
+import { betterAuth, type BetterAuthOptions } from "better-auth";
+import { twoFactor } from "better-auth/plugins";
+import { Pool } from "pg";
+
+// OAuth providers are enabled only when their credentials are present.
+function socialProviders(): NonNullable<BetterAuthOptions["socialProviders"]> {
+  const providers: NonNullable<BetterAuthOptions["socialProviders"]> = {};
+  if (process.env.GOOGLE_CLIENT_ID && process.env.GOOGLE_CLIENT_SECRET) {
+    providers.google = {
+      clientId: process.env.GOOGLE_CLIENT_ID,
+      clientSecret: process.env.GOOGLE_CLIENT_SECRET,
+    };
+  }
+  if (process.env.GITHUB_CLIENT_ID && process.env.GITHUB_CLIENT_SECRET) {
+    providers.github = {
+      clientId: process.env.GITHUB_CLIENT_ID,
+      clientSecret: process.env.GITHUB_CLIENT_SECRET,
+    };
+  }
+  return providers;
+}
+
+export const auth = betterAuth({
+  database: new Pool({
+    host: process.env.POSTGRES_HOST ?? "localhost",
+    port: Number(process.env.POSTGRES_PORT ?? 5432),
+    user: process.env.POSTGRES_USER ?? "podokit",
+    password: process.env.POSTGRES_PASSWORD ?? "podokit",
+    database: process.env.POSTGRES_DB ?? "podokit",
+  }),
+  emailAndPassword: { enabled: true },
+  socialProviders: socialProviders(),
+  plugins: process.env.AUTH_TWO_FACTOR === "true" ? [twoFactor()] : [],
+  secret: process.env.BETTER_AUTH_SECRET ?? "change-me-in-production-min-32-characters",
+  baseURL: process.env.BETTER_AUTH_URL ?? "http://localhost:3000",
+});

package/dist/templates/modules/auth/files/apps/api/src/health/health.controller.ts

@@ -0,0 +1,26 @@
+import { Controller, Get } from "@nestjs/common";
+import { InjectDataSource } from "@nestjs/typeorm";
+import { DataSource } from "typeorm";
+import { Public } from "@thallesp/nestjs-better-auth";
+
+// Health checks stay public under the global auth guard.
+@Public()
+@Controller("health")
+export class HealthController {
+  constructor(@InjectDataSource() private readonly dataSource: DataSource) {}
+
+  @Get()
+  liveness(): { status: string; uptime: number; timestamp: string } {
+    return { status: "ok", uptime: process.uptime(), timestamp: new Date().toISOString() };
+  }
+
+  @Get("ready")
+  async readiness(): Promise<{ status: string; db: string }> {
+    try {
+      await this.dataSource.query("SELECT 1");
+      return { status: "ready", db: "up" };
+    } catch {
+      return { status: "degraded", db: "down" };
+    }
+  }
+}

package/dist/templates/modules/auth/module.manifest.json

@@ -0,0 +1,70 @@
+{
+  "name": "auth",
+  "description": "Full authentication (better-auth): email/password, sessions, and \u2014 via config \u2014 OAuth and 2FA. Installs a global guard so the API is secure by default; health and /api/auth stay public.",
+  "requires": [],
+  "targetApp": "api",
+  "dependencies": {
+    "better-auth": "^1.6.23",
+    "@thallesp/nestjs-better-auth": "^2.7.0",
+    "pg": "^8.12.0"
+  },
+  "devDependencies": {
+    "@types/pg": "^8.11.10"
+  },
+  "env": [
+    "# auth (better-auth) \u2014 set a strong secret (>= 32 chars) in production",
+    "BETTER_AUTH_SECRET=change-me-in-production-min-32-characters",
+    "BETTER_AUTH_URL=http://localhost:3000",
+    "# 2FA (TOTP): set true to enable the plugin",
+    "AUTH_TWO_FACTOR=false",
+    "# OAuth (optional) \u2014 set a provider's id+secret to enable it",
+    "# GOOGLE_CLIENT_ID=",
+    "# GOOGLE_CLIENT_SECRET=",
+    "# GITHUB_CLIENT_ID=",
+    "# GITHUB_CLIENT_SECRET="
+  ],
+  "inject": [
+    {
+      "file": "apps/api/src/app.module.ts",
+      "marker": "// podokit:imports",
+      "text": "import { APP_GUARD } from \"@nestjs/core\";"
+    },
+    {
+      "file": "apps/api/src/app.module.ts",
+      "marker": "// podokit:imports",
+      "text": "import { AuthModule, AuthGuard } from \"@thallesp/nestjs-better-auth\";"
+    },
+    {
+      "file": "apps/api/src/app.module.ts",
+      "marker": "// podokit:imports",
+      "text": "import { auth } from \"./auth/auth\";"
+    },
+    {
+      "file": "apps/api/src/app.module.ts",
+      "marker": "// podokit:imports",
+      "text": "import { AccountModule } from \"./account/account.module\";"
+    },
+    {
+      "file": "apps/api/src/app.module.ts",
+      "marker": "// podokit:module-imports",
+      "text": "AuthModule.forRoot(auth),"
+    },
+    {
+      "file": "apps/api/src/app.module.ts",
+      "marker": "// podokit:module-imports",
+      "text": "AccountModule,"
+    },
+    {
+      "file": "apps/api/src/app.module.ts",
+      "marker": "// podokit:providers",
+      "text": "{ provide: APP_GUARD, useClass: AuthGuard },"
+    }
+  ],
+  "instructions": [
+    "Set BETTER_AUTH_SECRET in .env (>= 32 chars).",
+    "Create the auth tables:  npx @better-auth/cli migrate -y --config apps/api/src/auth/auth.ts",
+    "Sign up:  curl -c cookies.txt -XPOST localhost:3000/api/auth/sign-up/email -H 'content-type: application/json' -d '{\"email\":\"a@example.com\",\"password\":\"password123\",\"name\":\"A\"}'",
+    "Call a protected route with the session:  curl -b cookies.txt localhost:3000/account/me",
+    "Everything is now protected by default; mark public routes with @Public(). Enable OAuth by setting a provider's env vars; enable 2FA with AUTH_TWO_FACTOR=true."
+  ]
+}

package/dist/templates/modules/bullmq/module.manifest.json

@@ -4,7 +4,7 @@
   "requires": [],
   "targetApp": "api",
   "dependencies": {
-    "@nestjs/bullmq": "^10.2.0",
+    "@nestjs/bullmq": "^11.0.4",
     "bullmq": "^5.34.0"
   },
   "scripts": {
@@ -15,8 +15,16 @@
     "# bullmq uses REDIS_HOST / REDIS_PORT (already defined above)"
   ],
   "inject": [
-    { "file": "apps/api/src/app.module.ts", "marker": "// podokit:imports", "text": "import { JobsModule } from \"./jobs/jobs.module\";" },
-    { "file": "apps/api/src/app.module.ts", "marker": "// podokit:module-imports", "text": "JobsModule," }
+    {
+      "file": "apps/api/src/app.module.ts",
+      "marker": "// podokit:imports",
+      "text": "import { JobsModule } from \"./jobs/jobs.module\";"
+    },
+    {
+      "file": "apps/api/src/app.module.ts",
+      "marker": "// podokit:module-imports",
+      "text": "JobsModule,"
+    }
   ],
   "instructions": [
     "Ensure Redis is running:  docker compose -f infra/docker/docker-compose.yml up -d",

package/dist/templates/modules/logging/files/apps/api/src/logging/logging.module.ts

@@ -0,0 +1,29 @@
+import { Module } from "@nestjs/common";
+import { randomUUID } from "node:crypto";
+import type { IncomingMessage, ServerResponse } from "node:http";
+import { LoggerModule } from "nestjs-pino";
+
+const isProduction = process.env.NODE_ENV === "production";
+
+// Structured request logging with a correlation id. Importing this module
+// installs the pino-http middleware for all routes.
+@Module({
+  imports: [
+    LoggerModule.forRoot({
+      pinoHttp: {
+        level: process.env.LOG_LEVEL ?? "info",
+        // Pretty, single-line logs in dev; JSON in production.
+        transport: isProduction ? undefined : { target: "pino-pretty", options: { singleLine: true } },
+        autoLogging: true,
+        // One id per request; honor an inbound x-request-id and echo it back.
+        genReqId: (req: IncomingMessage, res: ServerResponse): string => {
+          const header = req.headers["x-request-id"];
+          const id = (Array.isArray(header) ? header[0] : header) ?? randomUUID();
+          res.setHeader("x-request-id", id);
+          return id;
+        },
+      },
+    }),
+  ],
+})
+export class LoggingModule {}

package/dist/templates/modules/logging/module.manifest.json

@@ -0,0 +1,27 @@
+{
+  "name": "logging",
+  "description": "Structured request logging (nestjs-pino) with a per-request correlation id (x-request-id). Pretty in dev, JSON in production.",
+  "requires": [],
+  "targetApp": "api",
+  "dependencies": {
+    "nestjs-pino": "^4.3.0",
+    "pino-http": "^10.3.0"
+  },
+  "devDependencies": {
+    "pino-pretty": "^13.0.0"
+  },
+  "env": [
+    "# logging",
+    "LOG_LEVEL=info"
+  ],
+  "inject": [
+    { "file": "apps/api/src/app.module.ts", "marker": "// podokit:imports", "text": "import { LoggingModule } from \"./logging/logging.module\";" },
+    { "file": "apps/api/src/app.module.ts", "marker": "// podokit:module-imports", "text": "LoggingModule," }
+  ],
+  "instructions": [
+    "Every HTTP request is now logged as structured JSON with a correlation id.",
+    "Make a request and watch the API logs:  curl localhost:3000/health",
+    "Set LOG_LEVEL (debug|info|warn|error) in .env. Logs are pretty in dev and JSON when NODE_ENV=production.",
+    "To route Nest's own logs through pino too, add to main.ts: NestFactory.create(AppModule, { bufferLogs: true }) then app.useLogger(app.get(Logger))."
+  ]
+}

package/dist/templates/modules/rate-limit/files/apps/api/src/rate-limit/rate-limit.module.ts

@@ -0,0 +1,26 @@
+import { Module } from "@nestjs/common";
+import { APP_GUARD } from "@nestjs/core";
+import { ThrottlerGuard, ThrottlerModule } from "@nestjs/throttler";
+import { ThrottlerStorageRedisService } from "@nest-lab/throttler-storage-redis";
+import Redis from "ioredis";
+
+const ttlSeconds = Number(process.env.RATE_LIMIT_TTL ?? 60);
+const limit = Number(process.env.RATE_LIMIT_MAX ?? 100);
+
+// Distributed rate limiting: the counter lives in Redis, so the limit holds
+// across API replicas. Registers a global guard (429 when exceeded).
+@Module({
+  imports: [
+    ThrottlerModule.forRoot({
+      throttlers: [{ ttl: ttlSeconds * 1000, limit }],
+      storage: new ThrottlerStorageRedisService(
+        new Redis({
+          host: process.env.REDIS_HOST ?? "localhost",
+          port: Number(process.env.REDIS_PORT ?? 6379),
+        }),
+      ),
+    }),
+  ],
+  providers: [{ provide: APP_GUARD, useClass: ThrottlerGuard }],
+})
+export class RateLimitModule {}

package/dist/templates/modules/rate-limit/module.manifest.json

@@ -0,0 +1,25 @@
+{
+  "name": "rate-limit",
+  "description": "Rate limiting with @nestjs/throttler backed by Redis (correct across API replicas). Installs a global throttler guard; configurable via env.",
+  "requires": ["redis"],
+  "targetApp": "api",
+  "dependencies": {
+    "@nestjs/throttler": "^6.5.0",
+    "@nest-lab/throttler-storage-redis": "^1.2.0"
+  },
+  "env": [
+    "# rate limit (window in seconds, max requests per window per client)",
+    "RATE_LIMIT_TTL=60",
+    "RATE_LIMIT_MAX=100"
+  ],
+  "inject": [
+    { "file": "apps/api/src/app.module.ts", "marker": "// podokit:imports", "text": "import { RateLimitModule } from \"./rate-limit/rate-limit.module\";" },
+    { "file": "apps/api/src/app.module.ts", "marker": "// podokit:module-imports", "text": "RateLimitModule," }
+  ],
+  "instructions": [
+    "Ensure Redis is running:  docker compose -f infra/docker/docker-compose.yml up -d",
+    "Tune RATE_LIMIT_TTL / RATE_LIMIT_MAX in .env.",
+    "Exceeding the limit returns HTTP 429. Skip a route with @SkipThrottle() or tune it with @Throttle().",
+    "The limit is shared across API replicas because it is stored in Redis."
+  ]
+}

package/dist/templates/todo/apps/api/package.json

@@ -14,12 +14,12 @@
     "migration:generate": "npm run typeorm -- migration:generate"
   },
   "dependencies": {
-    "@nestjs/common": "^10.4.0",
-    "@nestjs/config": "^3.2.3",
-    "@nestjs/core": "^10.4.0",
-    "@nestjs/platform-express": "^10.4.0",
-    "@nestjs/swagger": "^7.4.0",
-    "@nestjs/typeorm": "^10.0.2",
+    "@nestjs/common": "^11.1.27",
+    "@nestjs/config": "^4.0.4",
+    "@nestjs/core": "^11.1.27",
+    "@nestjs/platform-express": "^11.1.27",
+    "@nestjs/swagger": "^11.4.5",
+    "@nestjs/typeorm": "^11.0.3",
     "class-transformer": "^0.5.1",
     "class-validator": "^0.14.1",
     "dotenv": "^16.4.5",
@@ -30,9 +30,9 @@
     "zod": "^3.23.8"
   },
   "devDependencies": {
-    "@nestjs/cli": "^10.4.0",
-    "@nestjs/testing": "^10.4.0",
-    "@types/express": "^4.17.21",
+    "@nestjs/cli": "^11.0.23",
+    "@nestjs/testing": "^11.1.27",
+    "@types/express": "^5.0.1",
     "@types/node": "^20.17.0",
     "@types/supertest": "^6.0.2",
     "jest": "^29.7.0",

package/dist/templates/todo/apps/api/src/app.module.ts

@@ -15,5 +15,8 @@ import { TodosModule } from "./todos/todos.module";
     TodosModule,
     // podokit:module-imports
   ],
+  providers: [
+    // podokit:providers
+  ],
 })
 export class AppModule {}

package/dist/templates/todo/apps/web/package.json

@@ -11,13 +11,14 @@
     "test": "echo \"add Playwright tests here\" && exit 0"
   },
   "dependencies": {
-    "mode-watcher": "^0.5.0",
+    "@internationalized/date": "^3.12.2",
+    "@lucide/svelte": "^1.23.0",
     "bits-ui": "^2.18.1",
     "clsx": "^2.1.1",
+    "mode-watcher": "^1.1.0",
+    "svelte-sonner": "^1.1.1",
     "tailwind-merge": "^3.6.0",
-    "tailwind-variants": "^3.2.2",
-    "@lucide/svelte": "^1.23.0",
-    "@internationalized/date": "^3.12.2"
+    "tailwind-variants": "^3.2.2"
   },
   "devDependencies": {
     "@sveltejs/adapter-node": "^5.2.0",

package/dist/templates/todo/apps/web/src/lib/components/ui/alert/alert-action.svelte

@@ -0,0 +1,20 @@
+<script lang="ts">
+	import type { HTMLAttributes } from "svelte/elements";
+	import { cn, type WithElementRef } from "$lib/utils.js";
+
+	let {
+		ref = $bindable(null),
+		class: className,
+		children,
+		...restProps
+	}: WithElementRef<HTMLAttributes<HTMLDivElement>> = $props();
+</script>
+
+<div
+	bind:this={ref}
+	data-slot="alert-action"
+	class={cn("absolute top-2 right-2", className)}
+	{...restProps}
+>
+	{@render children?.()}
+</div>

package/dist/templates/todo/apps/web/src/lib/components/ui/alert/alert-description.svelte

@@ -0,0 +1,23 @@
+<script lang="ts">
+	import type { HTMLAttributes } from "svelte/elements";
+	import { cn, type WithElementRef } from "$lib/utils.js";
+
+	let {
+		ref = $bindable(null),
+		class: className,
+		children,
+		...restProps
+	}: WithElementRef<HTMLAttributes<HTMLDivElement>> = $props();
+</script>
+
+<div
+	bind:this={ref}
+	data-slot="alert-description"
+	class={cn(
+		"text-muted-foreground text-sm text-balance md:text-pretty [&_p:not(:last-child)]:mb-4 [&_a]:hover:text-foreground [&_a]:underline [&_a]:underline-offset-3",
+		className
+	)}
+	{...restProps}
+>
+	{@render children?.()}
+</div>

package/dist/templates/todo/apps/web/src/lib/components/ui/alert/alert-title.svelte

@@ -0,0 +1,23 @@
+<script lang="ts">
+	import type { HTMLAttributes } from "svelte/elements";
+	import { cn, type WithElementRef } from "$lib/utils.js";
+
+	let {
+		ref = $bindable(null),
+		class: className,
+		children,
+		...restProps
+	}: WithElementRef<HTMLAttributes<HTMLDivElement>> = $props();
+</script>
+
+<div
+	bind:this={ref}
+	data-slot="alert-title"
+	class={cn(
+		"font-medium group-has-[>svg]/alert:col-start-2 [&_a]:hover:text-foreground [&_a]:underline [&_a]:underline-offset-3",
+		className
+	)}
+	{...restProps}
+>
+	{@render children?.()}
+</div>