@podosoft/podokit 0.4.0 → 0.5.0

package/dist/lockfile.js

@@ -0,0 +1,193 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DEFAULT_OWNED_GLOBS = exports.LOCK_SCHEMA_VERSION = void 0;
+exports.manifestPath = manifestPath;
+exports.filesLockPath = filesLockPath;
+exports.readManifest = readManifest;
+exports.writeManifest = writeManifest;
+exports.writeFilesLock = writeFilesLock;
+exports.podokitVersion = podokitVersion;
+exports.matchGlob = matchGlob;
+exports.classifyTier = classifyTier;
+exports.walkFiles = walkFiles;
+exports.computeFilesLock = computeFilesLock;
+exports.readFilesLock = readFilesLock;
+exports.computeDrift = computeDrift;
+exports.initLockfile = initLockfile;
+exports.recordModules = recordModules;
+const node_fs_1 = require("node:fs");
+const node_path_1 = require("node:path");
+const podokit_template_engine_1 = require("@podosoft/podokit-template-engine");
+/**
+ * The generation lockfile (`.podokit/`) records how a project was assembled so
+ * `podo update` can rebuild the same inputs and detect user edits. See
+ * ADR-0009 (update mechanism) and ADR-0010 (ownership model).
+ */
+exports.LOCK_SCHEMA_VERSION = 1;
+const PODOKIT_DIR = ".podokit";
+const MANIFEST_FILE = "manifest.json";
+const FILES_LOCK_FILE = "files.lock";
+/** Marker that flags a file as assembled from base + module injections. */
+const INJECTION_MARKER = "// podokit:";
+/** Directories that never belong in the lockfile (generated / vendored). */
+const WALK_IGNORE = new Set([
+    "node_modules",
+    ".git",
+    PODOKIT_DIR,
+    "dist",
+    "build",
+    ".svelte-kit",
+    ".turbo",
+    "coverage",
+]);
+/** Default user-owned globs seeded into a new project. See ADR-0010. */
+exports.DEFAULT_OWNED_GLOBS = [
+    "apps/web/src/routes/**",
+    "apps/web/src/lib/components/ui/**",
+];
+const TEXT_EXT = /\.(json|md|ts|tsx|js|mjs|cjs|css|html|yml|yaml|txt|env|svelte|gitignore|example)$/i;
+function podokitDir(projectRoot) {
+    return (0, node_path_1.join)(projectRoot, PODOKIT_DIR);
+}
+function manifestPath(projectRoot) {
+    return (0, node_path_1.join)(podokitDir(projectRoot), MANIFEST_FILE);
+}
+function filesLockPath(projectRoot) {
+    return (0, node_path_1.join)(podokitDir(projectRoot), FILES_LOCK_FILE);
+}
+function readManifest(projectRoot) {
+    const file = manifestPath(projectRoot);
+    return (0, node_fs_1.existsSync)(file) ? JSON.parse((0, node_fs_1.readFileSync)(file, "utf8")) : null;
+}
+function writeManifest(projectRoot, manifest) {
+    (0, node_fs_1.mkdirSync)(podokitDir(projectRoot), { recursive: true });
+    (0, node_fs_1.writeFileSync)(manifestPath(projectRoot), `${JSON.stringify(manifest, null, 2)}\n`);
+}
+function writeFilesLock(projectRoot, lock) {
+    (0, node_fs_1.mkdirSync)(podokitDir(projectRoot), { recursive: true });
+    (0, node_fs_1.writeFileSync)(filesLockPath(projectRoot), `${JSON.stringify(lock, null, 2)}\n`);
+}
+/** Read the PodoKit CLI's own version to stamp into the manifest. */
+function podokitVersion() {
+    try {
+        const pkg = JSON.parse((0, node_fs_1.readFileSync)((0, node_path_1.join)(__dirname, "..", "package.json"), "utf8"));
+        return pkg.version ?? "0.0.0";
+    }
+    catch {
+        return "0.0.0";
+    }
+}
+/** Match a POSIX relative path against a simple glob supporting `*` and `**`. */
+function matchGlob(path, glob) {
+    const escaped = glob.replace(/[.+^${}()|[\]\\]/g, "\\$&");
+    // Single pass so replacement output is never re-scanned.
+    const pattern = escaped.replace(/\/\*\*$|\*\*\/|\*\*|\*/g, (token) => {
+        if (token === "/**")
+            return "(?:/.*)?"; // trailing `/**`: the dir itself or anything under it
+        if (token === "**/")
+            return "(?:.*/)?"; // `**/`: zero or more leading segments
+        if (token === "**")
+            return ".*"; // `**`: any characters
+        return "[^/]*"; // `*`: within a single segment
+    });
+    return new RegExp(`^${pattern}$`).test(path);
+}
+function isTextPath(relPath) {
+    return relPath.startsWith("dot-") || TEXT_EXT.test(relPath);
+}
+/** Classify a file's ownership tier. See ADR-0010 priority order. */
+function classifyTier(relPath, content, ownedGlobs) {
+    if (ownedGlobs.some((glob) => matchGlob(relPath, glob)))
+        return "owned";
+    if (isTextPath(relPath) && content.toString("utf8").includes(INJECTION_MARKER))
+        return "assembled";
+    return "managed";
+}
+/** List project files as POSIX-relative paths, skipping generated/vendored dirs. */
+function walkFiles(projectRoot, prefix = "") {
+    const out = [];
+    for (const entry of (0, node_fs_1.readdirSync)((0, node_path_1.join)(projectRoot, prefix))) {
+        if (WALK_IGNORE.has(entry))
+            continue;
+        const rel = prefix ? `${prefix}/${entry}` : entry;
+        if ((0, node_fs_1.statSync)((0, node_path_1.join)(projectRoot, rel)).isDirectory()) {
+            out.push(...walkFiles(projectRoot, rel));
+        }
+        else {
+            out.push(rel);
+        }
+    }
+    return out;
+}
+/** Recompute the files.lock by hashing and classifying every project file. */
+function computeFilesLock(projectRoot, ownedGlobs) {
+    const files = {};
+    for (const rel of walkFiles(projectRoot).sort()) {
+        const content = (0, node_fs_1.readFileSync)((0, node_path_1.join)(projectRoot, rel));
+        files[rel] = { tier: classifyTier(rel, content, ownedGlobs), outHash: (0, podokit_template_engine_1.hashContent)(content) };
+    }
+    return { schemaVersion: exports.LOCK_SCHEMA_VERSION, files };
+}
+function readFilesLock(projectRoot) {
+    const file = filesLockPath(projectRoot);
+    return (0, node_fs_1.existsSync)(file) ? JSON.parse((0, node_fs_1.readFileSync)(file, "utf8")) : null;
+}
+/**
+ * Compare the current disk against the lock: report managed/assembled files the
+ * user has edited (hash mismatch) or deleted. Owned files are never reported —
+ * they belong to the user. Returns empty drift when there is no lock.
+ */
+function computeDrift(projectRoot) {
+    const lock = readFilesLock(projectRoot);
+    const drifted = [];
+    const missing = [];
+    if (!lock)
+        return { drifted, missing };
+    for (const [rel, entry] of Object.entries(lock.files)) {
+        if (entry.tier === "owned")
+            continue;
+        const abs = (0, node_path_1.join)(projectRoot, rel);
+        if (!(0, node_fs_1.existsSync)(abs)) {
+            missing.push(rel);
+            continue;
+        }
+        if ((0, podokit_template_engine_1.hashContent)((0, node_fs_1.readFileSync)(abs)) !== entry.outHash)
+            drifted.push(rel);
+    }
+    return { drifted: drifted.sort(), missing: missing.sort() };
+}
+/** Write the initial `.podokit/` lockfile for a freshly created project. */
+function initLockfile(projectRoot, options) {
+    const ownedGlobs = options.ownedGlobs ?? exports.DEFAULT_OWNED_GLOBS;
+    const manifest = {
+        schemaVersion: exports.LOCK_SCHEMA_VERSION,
+        podokitVersion: options.version ?? podokitVersion(),
+        template: options.template,
+        packageManager: options.packageManager,
+        answers: options.answers,
+        modules: [],
+        ownedGlobs,
+    };
+    writeManifest(projectRoot, manifest);
+    writeFilesLock(projectRoot, computeFilesLock(projectRoot, ownedGlobs));
+}
+/**
+ * Record applied modules in the manifest and recompute the files.lock. Modules
+ * already present are left in place (idempotent); the lock always reflects disk.
+ * No-op on projects without a manifest (pre-lockfile projects; see `podo adopt`).
+ */
+function recordModules(projectRoot, moduleNames, version) {
+    const manifest = readManifest(projectRoot);
+    if (!manifest)
+        return;
+    const stampedWith = version ?? podokitVersion();
+    const known = new Set(manifest.modules.map((m) => m.name));
+    for (const name of moduleNames) {
+        if (known.has(name))
+            continue;
+        manifest.modules.push({ name, order: manifest.modules.length, addedWith: stampedWith });
+        known.add(name);
+    }
+    writeManifest(projectRoot, manifest);
+    writeFilesLock(projectRoot, computeFilesLock(projectRoot, manifest.ownedGlobs));
+}

package/dist/templates/base/dot-env.example

@@ -1,15 +1,20 @@
 # Copy to .env and adjust. Never commit real secrets.
+
+# ── Required (runtime) ───────────────────────────────────────────────
 POSTGRES_HOST=localhost
 POSTGRES_PORT=5432
 POSTGRES_USER=podokit
 POSTGRES_PASSWORD=podokit
 POSTGRES_DB=podokit
 
+APP_BASE_URL=http://localhost:5001
+API_BASE_URL=http://localhost:5002
+BACKEND_INTERNAL_URL=http://localhost:5002
+CORS_ORIGIN=http://localhost:5001
+PORT=5002
+
+# ── Optional / development ───────────────────────────────────────────
+# Redis — only needed by cache/queue modules. Start it with:
+# docker compose --profile cache up
 REDIS_HOST=localhost
 REDIS_PORT=6379
-
-APP_BASE_URL=http://localhost:5173
-API_BASE_URL=http://localhost:3000
-BACKEND_INTERNAL_URL=http://localhost:3000
-CORS_ORIGIN=http://localhost:5173
-PORT=3000

package/dist/templates/fullstack-nest-svelte/README.md

@@ -18,8 +18,8 @@ docker compose -f infra/docker/docker-compose.yml up -d
 {{packageManager}} run dev
 ```
 
-- API: http://localhost:3000 — health at `/health`, docs at `/api-docs`
-- Web: http://localhost:5173
+- API: http://localhost:5002 — health at `/health`, docs at `/api-docs`
+- Web: http://localhost:5001
 
 ## Database & migrations
 

package/dist/templates/fullstack-nest-svelte/apps/api/package.json

@@ -14,6 +14,7 @@
     "migration:generate": "npm run typeorm -- migration:generate"
   },
   "dependencies": {
+    "@podosoft/podokit-contracts": "^0.1.0",
     "@nestjs/common": "^11.1.27",
     "@nestjs/config": "^4.0.4",
     "@nestjs/core": "^11.1.27",

package/dist/templates/fullstack-nest-svelte/apps/api/src/app.module.ts

@@ -4,17 +4,20 @@ import { TypeOrmModule } from "@nestjs/typeorm";
 import { validateEnv } from "./config/env.validation";
 import { dataSourceOptions } from "./database/data-source";
 import { HealthModule } from "./health/health.module";
-// podokit:imports
+// podokit:begin:imports
+// podokit:end:imports
 
 @Module({
   imports: [
     ConfigModule.forRoot({ isGlobal: true, validate: validateEnv }),
     TypeOrmModule.forRoot(dataSourceOptions),
     HealthModule,
-    // podokit:module-imports
+    // podokit:begin:module-imports
+    // podokit:end:module-imports
   ],
   providers: [
-    // podokit:providers
+    // podokit:begin:providers
+    // podokit:end:providers
   ],
 })
 export class AppModule {}

package/dist/templates/fullstack-nest-svelte/apps/api/src/common/app-exception.ts

@@ -1,12 +1,4 @@
-// Stable, language-independent error codes. The frontend branches on `code`,
-// not on the human-readable message.
-export class AppException extends Error {
-  constructor(
-    readonly code: string,
-    message: string,
-    readonly statusCode = 400,
-  ) {
-    super(message);
-    this.name = "AppException";
-  }
-}
+// AppException is a shared contract (stable, language-independent error `code`
+// the frontend branches on). Re-exported from @podosoft/podokit-contracts so the
+// backend and any other layer reference one definition.
+export { AppException } from "@podosoft/podokit-contracts";

package/dist/templates/fullstack-nest-svelte/apps/api/src/config/env.validation.ts

@@ -3,7 +3,7 @@ import { z } from "zod";
 // Schema-validated environment. Fails fast at boot if something is wrong.
 const schema = z.object({
   NODE_ENV: z.string().default("development"),
-  PORT: z.coerce.number().default(3000),
+  PORT: z.coerce.number().default(5002),
   CORS_ORIGIN: z.string().optional(),
   POSTGRES_HOST: z.string().default("localhost"),
   POSTGRES_PORT: z.coerce.number().default(5432),

package/dist/templates/fullstack-nest-svelte/apps/api/src/main.ts

@@ -22,7 +22,7 @@ async function bootstrap(): Promise<void> {
     .build();
   SwaggerModule.setup("api-docs", app, SwaggerModule.createDocument(app, config));
 
-  const port = Number(process.env.PORT ?? 3000);
+  const port = Number(process.env.PORT ?? 5002);
   await app.listen(port);
 }
 

package/dist/templates/fullstack-nest-svelte/apps/web/package.json

@@ -4,7 +4,7 @@
   "private": true,
   "type": "module",
   "scripts": {
-    "dev": "vite dev --port 5173",
+    "dev": "vite dev --port 5001",
     "build": "vite build",
     "preview": "vite preview",
     "lint": "svelte-check --tsconfig ./tsconfig.json",
@@ -13,7 +13,7 @@
   "dependencies": {
     "@internationalized/date": "^3.12.2",
     "@lucide/svelte": "^1.23.0",
-    "@podosoft/podokit-api-client": "^0.4.0",
+    "@podosoft/podokit-api-client": "^0.5.0",
     "bits-ui": "^2.18.1",
     "clsx": "^2.1.1",
     "mode-watcher": "^1.1.0",

package/dist/templates/fullstack-nest-svelte/apps/web/src/lib/components/ui/select/select-content.svelte

@@ -27,7 +27,7 @@
 		{preventScroll}
 		data-slot="select-content"
 		class={cn(
-			"bg-popover text-popover-foreground data-open:animate-in data-closed:animate-out data-closed:fade-out-0 data-open:fade-in-0 data-closed:zoom-out-95 data-open:zoom-in-95 data-[side=bottom]:slide-in-from-top-2 data-[side=left]:slide-in-from-right-2 data-[side=right]:slide-in-from-left-2 data-[side=top]:slide-in-from-bottom-2 ring-foreground/10 min-w-36 rounded-lg shadow-md ring-1 duration-100 data-[side=inline-start]:slide-in-from-right-2 data-[side=inline-end]:slide-in-from-left-2 relative isolate z-50 overflow-x-hidden overflow-y-auto",
+			"bg-popover text-popover-foreground data-open:animate-in data-closed:animate-out data-closed:fade-out-0 data-open:fade-in-0 data-closed:zoom-out-95 data-open:zoom-in-95 data-[side=bottom]:slide-in-from-top-2 data-[side=left]:slide-in-from-right-2 data-[side=right]:slide-in-from-left-2 data-[side=top]:slide-in-from-bottom-2 ring-foreground/10 min-w-36 rounded-lg p-1 shadow-md ring-1 duration-100 data-[side=inline-start]:slide-in-from-right-2 data-[side=inline-end]:slide-in-from-left-2 relative isolate z-50 max-h-96 overflow-x-hidden overflow-y-auto",
 			className
 		)}
 		{...restProps}

package/dist/templates/fullstack-nest-svelte/apps/web/src/lib/components/ui/select/select-item.svelte

@@ -26,7 +26,7 @@
 	{#snippet children({ selected, highlighted })}
 		<span class="absolute end-2 flex size-3.5 items-center justify-center">
 			{#if selected}
-				<CheckIcon class="cn-select-item-indicator-icon" />
+				<CheckIcon class="size-3.5" />
 			{/if}
 		</span>
 		<span class="flex flex-1 gap-2 shrink-0 whitespace-nowrap">

package/dist/templates/fullstack-nest-svelte/apps/web/src/lib/components/ui/switch/index.ts

@@ -0,0 +1,7 @@
+import Root from "./switch.svelte";
+
+export {
+	Root,
+	//
+	Root as Switch,
+};

package/dist/templates/fullstack-nest-svelte/apps/web/src/lib/components/ui/switch/switch.svelte

@@ -0,0 +1,29 @@
+<script lang="ts">
+	import { Switch as SwitchPrimitive } from "bits-ui";
+	import { cn, type WithoutChildrenOrChild } from "$lib/utils.js";
+
+	let {
+		ref = $bindable(null),
+		checked = $bindable(false),
+		class: className,
+		...restProps
+	}: WithoutChildrenOrChild<SwitchPrimitive.RootProps> = $props();
+</script>
+
+<SwitchPrimitive.Root
+	bind:ref
+	data-slot="switch"
+	class={cn(
+		"peer focus-visible:border-ring focus-visible:ring-ring/50 data-[state=checked]:bg-primary data-[state=unchecked]:bg-input inline-flex h-[1.15rem] w-8 shrink-0 items-center rounded-full border border-transparent shadow-xs transition-all outline-none focus-visible:ring-[3px] disabled:cursor-not-allowed disabled:opacity-50",
+		className
+	)}
+	bind:checked
+	{...restProps}
+>
+	<SwitchPrimitive.Thumb
+		data-slot="switch-thumb"
+		class={cn(
+			"bg-background pointer-events-none block size-4 rounded-full ring-0 transition-transform data-[state=checked]:translate-x-[calc(100%-2px)] data-[state=unchecked]:translate-x-0"
+		)}
+	/>
+</SwitchPrimitive.Root>

package/dist/templates/fullstack-nest-svelte/apps/web/src/lib/server/backend-proxy.ts

@@ -5,7 +5,7 @@ const FORWARDED_HEADERS = ["authorization", "cookie", "content-type", "accept",
 const RELAYED_RESPONSE_HEADERS = ["content-type", "location", "cache-control"];
 
 export function backendBaseUrl(): string {
-  return process.env.BACKEND_INTERNAL_URL ?? "http://localhost:3000";
+  return process.env.BACKEND_INTERNAL_URL ?? "http://localhost:5002";
 }
 
 // Normalize the resolved client IP for the forwarded header. better-auth stores

package/dist/templates/fullstack-nest-svelte/dot-env.example

@@ -1,6 +1,8 @@
 # Copy to .env and adjust. Never commit real secrets.
+
+# ── Required (runtime) ───────────────────────────────────────────────
 NODE_ENV=development
-PORT=3000
+PORT=5002
 
 POSTGRES_HOST=localhost
 POSTGRES_PORT=5432
@@ -8,9 +10,12 @@ POSTGRES_USER=podokit
 POSTGRES_PASSWORD=podokit
 POSTGRES_DB=podokit
 
+# Web -> API boundary (server-side only; not exposed to the browser)
+BACKEND_INTERNAL_URL=http://localhost:5002
+CORS_ORIGIN=http://localhost:5001
+
+# ── Optional / development ───────────────────────────────────────────
+# Redis — only needed by cache/queue modules (redis, bullmq, rate-limit,
+# job-progress, sse). Start it with: docker compose --profile cache up
 REDIS_HOST=localhost
 REDIS_PORT=6379
-
-# Web -> API boundary (server-side only; not exposed to the browser)
-BACKEND_INTERNAL_URL=http://localhost:3000
-CORS_ORIGIN=http://localhost:5173

package/dist/templates/fullstack-nest-svelte/infra/docker/docker-compose.yml

@@ -1,4 +1,5 @@
 services:
+  # --- Runtime (always started by `docker compose up`) ---
   postgres:
     image: postgres:16-alpine
     environment:
@@ -15,8 +16,11 @@ services:
       timeout: 5s
       retries: 5
 
+  # --- Runtime, but only needed by cache/queue modules (redis, bullmq,
+  #     rate-limit, job-progress, sse). Start with: docker compose --profile cache up
   redis:
     image: redis:7-alpine
+    profiles: ["cache"]
     ports:
       - "${REDIS_PORT:-6379}:6379"
     healthcheck:
@@ -25,5 +29,38 @@ services:
       timeout: 5s
       retries: 5
 
+  # --- Development / testing tools (NOT for production) ---
+  #     Start with: docker compose --profile dev up
+  # Local email catcher: SMTP on 1025, web UI + REST API on 8025 (http://localhost:8025).
+  mailpit:
+    image: axllent/mailpit:latest
+    profiles: ["dev"]
+    ports:
+      - "${SMTP_PORT:-1025}:1025"
+      - "${MAILPIT_UI_PORT:-8025}:8025"
+    healthcheck:
+      test: ["CMD", "wget", "-qO-", "http://localhost:8025/readyz"]
+      interval: 5s
+      timeout: 5s
+      retries: 5
+
+  # Local SMS catcher (the "Mailpit for SMS"): the app posts outgoing SMS here via
+  # SMS_WEBHOOK_URL and tests read them over REST. Development only.
+  sms-sink:
+    image: node:20-alpine
+    profiles: ["dev"]
+    command: ["node", "/app/sms-sink.mjs"]
+    environment:
+      PORT: "8095"
+    ports:
+      - "${SMS_SINK_PORT:-8095}:8095"
+    volumes:
+      - ./sms-sink.mjs:/app/sms-sink.mjs:ro
+    healthcheck:
+      test: ["CMD", "wget", "-qO-", "http://localhost:8095/readyz"]
+      interval: 5s
+      timeout: 5s
+      retries: 5
+
 volumes:
   pgdata:

package/dist/templates/fullstack-nest-svelte/infra/docker/sms-sink.mjs

@@ -0,0 +1,40 @@
+// Dev/test SMS sink — the "Mailpit for SMS". The app posts outgoing SMS here
+// (via SMS_WEBHOOK_URL) instead of a real provider, and tests read them back
+// over REST. Development only; never runs in production (see the `dev` profile
+// in docker-compose.yml). Uses only Node built-ins, run on a stock node image.
+import { createServer } from "node:http";
+
+const PORT = Number(process.env.PORT ?? 8095);
+/** @type {{to: string, body: string, receivedAt: string}[]} */
+let messages = [];
+
+const send = (res, status, body) => {
+  res.writeHead(status, { "content-type": "application/json" });
+  res.end(JSON.stringify(body));
+};
+
+createServer((req, res) => {
+  const { method, url } = req;
+  if (method === "GET" && url === "/readyz") return send(res, 200, { status: "ok" });
+  if (method === "GET" && url === "/messages") return send(res, 200, messages);
+  if (method === "DELETE" && url === "/messages") {
+    messages = [];
+    return send(res, 200, { cleared: true });
+  }
+  if (method === "POST" && url === "/sms") {
+    let raw = "";
+    req.on("data", (c) => (raw += c));
+    req.on("end", () => {
+      let payload = {};
+      try {
+        payload = raw ? JSON.parse(raw) : {};
+      } catch {
+        payload = { body: raw };
+      }
+      messages.unshift({ to: payload.to ?? payload.phoneNumber ?? "", body: payload.body ?? payload.code ?? raw, receivedAt: new Date().toISOString() });
+      send(res, 202, { accepted: true });
+    });
+    return;
+  }
+  send(res, 404, { error: "not found" });
+}).listen(PORT, () => console.log(`[sms-sink] listening on ${PORT}`));

package/dist/templates/fullstack-nest-svelte/tests/README.md

@@ -10,6 +10,6 @@ npm run test:e2e:report  # open the HTML report
 ```
 
 The suite runs against a live stack (web on `E2E_BASE_URL`, default
-`http://localhost:5173`, proxying `/api/*` to the API). Start PostgreSQL, run the
+`http://localhost:5001`, proxying `/api/*` to the API). Start PostgreSQL, run the
 auth migration, and start the API + web first. Files ending in `*.api.spec.ts` run
 in the request-only `api` project; `*.ui.spec.ts` run in the chromium `ui` project.

package/dist/templates/fullstack-nest-svelte/tests/package.json

@@ -9,6 +9,7 @@
     "test:e2e:report": "playwright show-report"
   },
   "devDependencies": {
-    "@playwright/test": "^1.61.1"
+    "@playwright/test": "^1.61.1",
+    "otpauth": "^9.5.1"
   }
 }

package/dist/templates/fullstack-nest-svelte/tests/playwright.config.ts

@@ -4,7 +4,7 @@ import { defineConfig, devices } from "@playwright/test";
 // the API). Start it first (see docs/testing.md) — locally via the dev harness,
 // in CI via scripts/e2e-ci.mjs. Two projects: `api` (request-only, backend e2e)
 // and `ui` (chromium, pages). Files are routed by suffix (*.api/*.ui.spec.ts).
-const baseURL = process.env.E2E_BASE_URL ?? "http://localhost:5173";
+const baseURL = process.env.E2E_BASE_URL ?? "http://localhost:5001";
 
 export default defineConfig({
   testDir: ".",

package/dist/templates/modules/admin-dashboard/files/apps/web/src/app.d.ts

@@ -8,6 +8,9 @@ export type SessionUser = {
   image?: string | null;
   emailVerified?: boolean;
   twoFactorEnabled?: boolean | null;
+  username?: string | null;
+  phoneNumber?: string | null;
+  phoneNumberVerified?: boolean | null;
 };
 
 declare global {

package/dist/templates/modules/admin-dashboard/files/apps/web/src/lib/components/app-sidebar.svelte

@@ -6,12 +6,14 @@
   import UsersIcon from "@lucide/svelte/icons/users";
   import MonitorSmartphoneIcon from "@lucide/svelte/icons/monitor-smartphone";
   import ScrollTextIcon from "@lucide/svelte/icons/scroll-text";
+  import Building2Icon from "@lucide/svelte/icons/building-2";
+  import SettingsIcon from "@lucide/svelte/icons/settings";
   import { getI18n } from "$lib/i18n";
   import type { SessionUser } from "../../app.d.ts";
   import type { Messages } from "$lib/i18n/messages";
   import type { Component } from "svelte";
 
-  let { user, capabilities }: { user: SessionUser; capabilities?: { auditLog?: boolean } } = $props();
+  let { user, capabilities }: { user: SessionUser; capabilities?: { auditLog?: boolean; organization?: boolean } } = $props();
   const i18n = getI18n();
 
   type NavItem = { href: string; key: keyof Messages["nav"]; icon: Component; adminOnly?: boolean };
@@ -19,9 +21,13 @@
     { href: "/admin", key: "overview", icon: LayoutDashboardIcon },
     { href: "/admin/users", key: "users", icon: UsersIcon, adminOnly: true },
     { href: "/admin/sessions", key: "sessions", icon: MonitorSmartphoneIcon, adminOnly: true },
+    ...(capabilities?.organization
+      ? [{ href: "/admin/organizations", key: "organizations", icon: Building2Icon, adminOnly: true } as NavItem]
+      : []),
     ...(capabilities?.auditLog
       ? [{ href: "/admin/audit", key: "audit", icon: ScrollTextIcon, adminOnly: true } as NavItem]
       : []),
+    { href: "/admin/settings", key: "settings", icon: SettingsIcon, adminOnly: true },
   ]);
   const visible = $derived(items.filter((item) => !item.adminOnly || user.role === "admin"));
 </script>