@podosoft/podokit 0.5.1 → 0.7.0

package/dist/templates/modules/auth/files/apps/api/src/auth/feature-gate.ts

@@ -45,7 +45,34 @@ export function createFeatureGate(pool: Pool) {
     return cache;
   }
 
+  // Registration can be closed from the admin Settings ("Allow sign-up"). It is a
+  // site setting (`site.allowSignup`), so the row is absent until an admin turns
+  // it off — a missing/any-non-"false" value means open, matching the shipped
+  // default. Cached the same way as the feature flags.
+  let signupOpen = true;
+  let signupFetchedAt = 0;
+  async function isSignupOpen(): Promise<boolean> {
+    if (Date.now() - signupFetchedAt < CACHE_TTL_MS) return signupOpen;
+    try {
+      const res = await pool.query<{ value: string }>(
+        'SELECT "value" FROM "app_setting" WHERE "key" = $1',
+        ["site.allowSignup"],
+      );
+      signupOpen = res.rows[0]?.value !== "false";
+    } catch {
+      signupOpen = true;
+    }
+    signupFetchedAt = Date.now();
+    return signupOpen;
+  }
+
   return createAuthMiddleware(async (ctx) => {
+    // Block email/password registration when sign-up is closed. Social/invite
+    // flows are unaffected; admins create users from the dashboard.
+    if (ctx.path === "/sign-up/email" || ctx.path.startsWith("/sign-up/")) {
+      if (!(await isSignupOpen())) throw new APIError("FORBIDDEN", { message: "Sign-up is disabled." });
+      return;
+    }
     const feature = FEATURE_PATHS.find((f) =>
       f.prefixes.some((p) => ctx.path === p || ctx.path.startsWith(p)),
     );

package/dist/templates/modules/auth/module.manifest.json

@@ -1,7 +1,7 @@
 {
   "name": "auth",
   "description": "Full authentication (better-auth): email/password, sessions, and \u2014 via config \u2014 OAuth and 2FA. Installs a global guard so the API is secure by default; health and /api/auth stay public.",
-  "requires": [],
+  "requires": ["mailer"],
   "targetApp": "api",
   "dependencies": {
     "@podosoft/podokit-auth": "^0.1.0",
@@ -9,14 +9,12 @@
     "better-auth": "^1.6.23",
     "@thallesp/nestjs-better-auth": "^2.7.0",
     "pg": "^8.12.0",
-    "nodemailer": "^7.0.9",
     "@better-auth/api-key": "^1.6.23",
     "@better-auth/passkey": "^1.6.23",
     "@better-auth/oauth-provider": "^1.6.23"
   },
   "devDependencies": {
-    "@types/pg": "^8.11.10",
-    "@types/nodemailer": "^7.0.4"
+    "@types/pg": "^8.11.10"
   },
   "env": [
     "# \u2500\u2500 Auth (better-auth) \u2014 the only required secrets \u2500\u2500",
@@ -32,10 +30,7 @@
     "# override (e.g. for secrets-manager injection in production); the DB takes",
     "# precedence when set.",
     "# --- Optional overrides / local development ---",
-    "# Email (Mailpit in local dev: docker compose --profile dev up \u2192 http://localhost:8025)",
-    "# SMTP_HOST=localhost",
-    "# SMTP_PORT=1025",
-    "# MAIL_FROM=PodoKit <no-reply@example.com>",
+    "# Email/SMTP is provided by the mailer module (see its .env block).",
     "# Phone-number SMS webhook (dev: SMS sink on port 8095)",
     "# SMS_WEBHOOK_URL=http://localhost:8095/sms",
     "# AUTH_HIBP=false",
@@ -91,6 +86,12 @@
       "file": "apps/api/src/app.module.ts",
       "marker": "// podokit:end:providers",
       "text": "{ provide: APP_GUARD, useClass: AuthGuard },"
+    },
+    {
+      "file": "AGENTS.md",
+      "marker": "<!-- podokit:end:agents-modules -->",
+      "optional": true,
+      "text": "### auth (better-auth)\n- The API is **secure by default**: every route needs a session except `/health` and `/api/auth/*`. Opt a route out with `@Public()`; read the user with `@Session()`.\n- Configure OAuth providers, SMTP, and the server toggles on the admin **Settings** page (DB-backed, applied live \u2014 not via env). Only `BETTER_AUTH_SECRET` and `BETTER_AUTH_URL` are required env vars.\n- Create the auth tables: `npx @better-auth/cli migrate -y --config apps/api/src/auth/auth.ts`.\n"
     }
   ],
   "instructions": [

package/dist/templates/modules/bullmq/module.manifest.json

@@ -9,7 +9,7 @@
   },
   "scripts": {
     "start:worker": "node dist/main-worker",
-    "dev:worker": "nest start --watch --entryFile main-worker"
+    "dev:worker": "nest start --watch --builder swc --entryFile main-worker"
   },
   "env": [
     "# bullmq uses REDIS_HOST / REDIS_PORT (already defined above)"

package/dist/templates/modules/file-upload/files/apps/api/src/files/files.controller.ts

@@ -1,3 +1,6 @@
+// The API tsconfig restricts `types` to ["node"], which suppresses @types/multer's
+// global augmentation of Express.Multer.File. Load it explicitly so the type resolves.
+/// <reference types="multer" />
 import { BadRequestException, Controller, Get, Param, Post, UploadedFile, UseInterceptors } from "@nestjs/common";
 import { FileInterceptor } from "@nestjs/platform-express";
 import { ApiConsumes, ApiTags } from "@nestjs/swagger";

package/dist/templates/modules/mailer/files/apps/api/src/mail/db.ts

@@ -0,0 +1,13 @@
+import { Pool } from "pg";
+
+// The mailer's own pg pool, in its own module so the mailer stays independent of
+// any other module. Used only to read the optional admin-configured SMTP settings
+// from `auth_config` when the auth module is present; with no such table the read
+// fails softly and the mailer falls back to SMTP_* env (see mailer.ts).
+export const pool = new Pool({
+  host: process.env.POSTGRES_HOST ?? "localhost",
+  port: Number(process.env.POSTGRES_PORT ?? 5432),
+  user: process.env.POSTGRES_USER ?? "podokit",
+  password: process.env.POSTGRES_PASSWORD ?? "podokit",
+  database: process.env.POSTGRES_DB ?? "podokit",
+});

package/dist/templates/modules/{auth → mailer}/files/apps/api/src/mail/mailer.ts

@@ -1,14 +1,40 @@
 import nodemailer, { type Transporter } from "nodemailer";
-import { pool } from "../auth/db";
+import { pool } from "./db";
 import { createConfigStore, type SmtpConfig } from "@podosoft/podokit-auth";
 
-// SMTP is admin-configurable in the DB (auth_config), falling back to SMTP_* env,
-// and applied live: the transport is rebuilt when the config changes (short TTL),
-// so no restart is needed. With neither DB nor env config, fall back to a transport
-// that just logs the message so nothing crashes for lack of mail config.
+// Reusable email sending. SMTP is resolved in priority order, applied live (short
+// TTL) so no restart is needed:
+//   1. admin-configured DB settings (auth_config) — only when the auth module is
+//      installed; read via the config store, which decrypts the SMTP password;
+//   2. SMTP_* env (fallback / production secrets-manager injection);
+//   3. none → a JSON transport that logs the message so dev links are grabbable.
+// The whole transport can also be overridden from app code (setMailTransport),
+// e.g. from apps/api/src/app.extensions.ts, to plug in a provider SDK.
 const store = createConfigStore(pool);
 const TTL_MS = 3_000;
 
+function envSmtp(): SmtpConfig | null {
+  if (!process.env.SMTP_HOST) return null;
+  return {
+    host: process.env.SMTP_HOST,
+    port: Number(process.env.SMTP_PORT ?? 1025),
+    secure: process.env.SMTP_SECURE === "true",
+    user: process.env.SMTP_USER,
+    pass: process.env.SMTP_PASS,
+    from: process.env.MAIL_FROM,
+  };
+}
+
+async function resolveSmtp(): Promise<SmtpConfig | null> {
+  try {
+    // Reads auth_config and falls back to env internally when auth is installed.
+    return await store.smtpConfig();
+  } catch {
+    // No auth_config table (auth not installed) — use env directly.
+    return envSmtp();
+  }
+}
+
 function buildTransport(smtp: SmtpConfig | null): Transporter {
   if (!smtp) return nodemailer.createTransport({ jsonTransport: true });
   return nodemailer.createTransport({
@@ -24,12 +50,20 @@ let transportFrom = process.env.MAIL_FROM ?? "PodoKit <no-reply@example.com>";
 let hasSmtp = false;
 let checkedAt = 0;
 let signature = "";
+let override: Transporter | null = null;
+
+/** Override the transport from app code (e.g. a provider SDK). Pass null to
+ *  restore the config-driven transport. Set this from app.extensions.ts. */
+export function setMailTransport(custom: Transporter | null): void {
+  override = custom;
+}
 
 async function getTransport(): Promise<Transporter> {
+  if (override) return override;
   if (checkedAt !== 0 && Date.now() - checkedAt < TTL_MS) return transport;
   checkedAt = Date.now();
   try {
-    const smtp = await store.smtpConfig();
+    const smtp = await resolveSmtp();
     const next = JSON.stringify(smtp ?? null);
     if (next !== signature) {
       transport = buildTransport(smtp);
@@ -48,7 +82,7 @@ export type Mail = { to: string; subject: string; text: string; html?: string };
 export async function sendMail(mail: Mail): Promise<void> {
   const t = await getTransport();
   const info = await t.sendMail({ from: transportFrom, ...mail });
-  if (!hasSmtp) {
+  if (!override && !hasSmtp) {
     // JSON transport: surface the message so the link is grabbable from logs.
     console.log(`[mailer] no SMTP configured; message not delivered:\n${info.message as string}`);
   }

package/dist/templates/modules/mailer/module.manifest.json

@@ -0,0 +1,38 @@
+{
+  "name": "mailer",
+  "description": "Reusable email sending (nodemailer). Resolves SMTP from the admin-configured DB settings when auth is installed, else SMTP_* env, else logs to the console. Used by auth and contact-form; the transport is overridable from app.extensions.ts.",
+  "requires": [],
+  "targetApp": "api",
+  "dependencies": {
+    "nodemailer": "^7.0.9",
+    "@podosoft/podokit-auth": "^0.1.0",
+    "pg": "^8.12.0"
+  },
+  "devDependencies": {
+    "@types/nodemailer": "^7.0.4",
+    "@types/pg": "^8.11.10"
+  },
+  "env": [
+    "# ── Mailer (SMTP) — optional ──",
+    "# With auth installed, configure SMTP on the admin Settings page (stored",
+    "# encrypted in the DB, applied live). These env vars are a fallback/override;",
+    "# with no SMTP configured at all the mailer logs messages to the console.",
+    "# Local dev uses Mailpit: docker compose --profile dev up → http://localhost:8025",
+    "# SMTP_HOST=localhost",
+    "# SMTP_PORT=1025",
+    "# MAIL_FROM=PodoKit <no-reply@example.com>"
+  ],
+  "inject": [
+    {
+      "file": "AGENTS.md",
+      "marker": "<!-- podokit:end:agents-modules -->",
+      "optional": true,
+      "text": "### mailer\n- Send email with `import { sendMail, actionEmail } from \"../mail/mailer\"` (path relative to your file). `sendMail({ to, subject, text, html? })`.\n- SMTP comes from the admin Settings page (when auth is installed) or `SMTP_*` env; with neither, messages are logged to the console (dev links are grabbable from logs).\n- To use a provider SDK instead of SMTP, call `setMailTransport(...)` from `apps/api/src/app.extensions.ts`.\n"
+    }
+  ],
+  "instructions": [
+    "Send mail from anywhere in the API:  import { sendMail } from \"../mail/mailer\"  then  await sendMail({ to, subject, text }).",
+    "SMTP is optional: with auth installed, configure it on the admin Settings page (DB, applied live); otherwise set SMTP_HOST/SMTP_PORT/MAIL_FROM in .env. With none set, messages are logged to the console.",
+    "To send through a provider SDK, override the transport in apps/api/src/app.extensions.ts:  import { setMailTransport } from \"./mail/mailer\";  setMailTransport(myTransport)."
+  ]
+}

package/dist/templates/todo/AGENTS.md

@@ -0,0 +1,80 @@
+# AGENTS.md — {{projectName}}
+
+Guidance for AI coding agents (Claude Code, Codex, Cursor, Copilot, …) working in
+this repository. It was generated by [PodoKit](https://github.com/podosoft-dev/podokit).
+Follow it so your changes match the project's conventions.
+
+## Project overview
+
+A full-stack TypeScript monorepo (npm workspaces):
+
+- `apps/api` — **NestJS** backend (`{{projectName}}-api`), TypeORM + PostgreSQL, Swagger at `/api-docs`.
+- `apps/web` — **SvelteKit** frontend (`{{projectName}}-web`), Tailwind v4 + shadcn-svelte + typesafe-i18n.
+- `infra/` — Docker Compose (PostgreSQL/Redis) and example k3s manifests.
+- `.podokit/` — PodoKit's generation lockfile (see "PodoKit tooling" below). Do not edit by hand.
+- **Todo example**: `apps/api/src/todos/` (controller/service/entity/DTO + migration) and the todo UI in `apps/web/src/routes/` show the end-to-end patterns to follow.
+
+## Setup & commands
+
+```bash
+npm install
+cp .env.example .env
+docker compose -f infra/docker/docker-compose.yml up -d   # PostgreSQL (+ Redis)
+npm run dev        # api on http://localhost:5002, web on http://localhost:5001
+```
+
+- **Ports: web = 5001, api = 5002.** The web app reaches the API only through its
+  SvelteKit server proxy (`/api/*`), never with a direct browser `fetch`.
+- Build: `npm run build`  ·  Type-check/lint: `npm run lint`  ·  Unit tests: `npm test`
+- Per workspace: `npm run build -w {{projectName}}-api` / `-w {{projectName}}-web`.
+- DB migrations (TypeORM): `npm run migration:run -w {{projectName}}-api`.
+- e2e (Playwright, ships in `tests/`): `npm run test:e2e`.
+
+**Always** verify a change by building the affected workspace (and `svelte-check`
+for web) before considering it done. UI changes need a Playwright test; API
+changes need an e2e/unit test.
+
+## Code style
+
+### TypeScript (both apps)
+- `strict` mode. **No `any`** — use `unknown` + narrowing. **No `@ts-ignore`/`@ts-expect-error`** and no `eslint-disable`.
+- Explicit function return types. DTOs use `class-validator` decorators.
+- Keep `noUnusedLocals`, `noUnusedParameters`, `noImplicitReturns`, `noUncheckedIndexedAccess`.
+
+### Svelte 5 (web)
+- **Runes only**: `$state()`, `$derived()`, `$effect()`, `$props()`. **Never** use `$:` (deprecated).
+- Reactive stores go in `.svelte.ts` files; don't destructure a getter-exported rune (it loses reactivity) — wrap in `$derived`.
+
+### UI — Tailwind + shadcn-svelte (web)
+- Prefer **shadcn-svelte components** over raw HTML (`<button>`, `<input>`, `<select>`, …).
+- **Do not edit `src/lib/components/ui/**`** (the shadcn primitives). Customize in a separate wrapper.
+- Tailwind v4 (CSS-first, no `tailwind.config`). Use semantic classes: `bg-background`, `text-foreground`, `border-border`. Dark mode via `mode-watcher`. Responsive (`sm:`/`md:`/`lg:`).
+
+### i18n & errors
+- **Every user-facing string goes through i18n** (`src/lib/i18n/messages.ts`) — no hardcoded text. Add keys to **all** locales at once.
+- The backend returns a stable **error envelope**: `{ success: false, error: { code, message, statusCode, path, timestamp, details? } }`. Throw `AppException("SOME_CODE", ...)` on the backend; **branch on `error.code`, not the message,** on the frontend.
+- Logging is structured; no emojis/icons. Start messages with an action verb.
+
+## PodoKit tooling & file ownership
+
+This project is managed by the `podo` CLI. Files have an ownership tier recorded
+in `.podokit/files.lock` — respect it:
+
+- **owned** (your code: `apps/web/src/routes/**`, your components/services, `apps/api/src/app.extensions.ts`, and this `AGENTS.md`) — edit freely. To add or override Nest providers/modules, use `app.extensions.ts` (spread into `AppModule` after the module-wired providers, so a same-token override wins) rather than editing `app.module.ts`.
+- **assembled** (e.g. `apps/api/src/app.module.ts`, `auth.ts`) — contain `// podokit:begin:… / …:end` fenced regions that the toolkit recomputes. Edit outside the fences only; **never hand-edit inside the fences**.
+- **managed** (bootstrap/config like `main.ts`) — the toolkit may update these; avoid gratuitous edits.
+
+Useful commands:
+
+- `podo add <module>` — add a feature (auth, admin-dashboard, redis, bullmq, …). It wires itself into the app; run `podo add` with no argument to list modules.
+- `podo status` / `podo diff` — see your local edits vs. what PodoKit generated.
+- `podo update` — pull in template/module improvements (3-way merges your edits; never touches owned files).
+
+## Commit conventions
+
+Conventional Commits (`feat|fix|docs|refactor|test|chore`), imperative mood,
+≤50-char subject, no trailing period, no emojis. One logical change per commit.
+
+<!-- podokit:begin:agents-modules -->
+<!-- Module-specific guidance is injected here by `podo add`. -->
+<!-- podokit:end:agents-modules -->

package/dist/templates/todo/CLAUDE.md

@@ -0,0 +1,6 @@
+# CLAUDE.md
+
+Agent guidance for this project lives in [AGENTS.md](./AGENTS.md). It is imported
+below so Claude Code loads the same rules the other AI tools read.
+
+@AGENTS.md

package/dist/templates/todo/Dockerfile.dev

@@ -0,0 +1,25 @@
+# Development image for the PodoKit monorepo (web + api).
+# Dependencies and source are baked in; `docker compose watch` syncs your
+# edits into the running container so the native file watchers fire.
+FROM node:22-bookworm-slim
+
+# git for the toolchain (editors, AI agents); build tools for native modules.
+RUN apt-get update \
+  && apt-get install -y --no-install-recommends git python3 make g++ ca-certificates \
+  && rm -rf /var/lib/apt/lists/*
+
+WORKDIR /app
+
+# Install workspace dependencies (cached unless a package.json changes).
+# NB: the host package-lock.json is intentionally NOT copied — a lockfile
+# generated on macOS/Windows prunes platform-specific optional deps and can drop
+# packages (e.g. @swc/cli) on linux. Resolving fresh in-container avoids that.
+COPY package.json ./
+COPY apps/api/package.json ./apps/api/package.json
+COPY apps/web/package.json ./apps/web/package.json
+RUN npm install
+
+# Baked source (kept in sync during development by `docker compose watch`).
+COPY . .
+
+EXPOSE 5001 5002

package/dist/templates/todo/apps/api/package.json

@@ -3,7 +3,7 @@
   "version": "0.0.0",
   "private": true,
   "scripts": {
-    "dev": "nest start --watch",
+    "dev": "nest start --watch --builder swc",
     "build": "nest build",
     "start": "node dist/main",
     "lint": "tsc -p tsconfig.json --noEmit",
@@ -40,7 +40,9 @@
     "supertest": "^7.0.0",
     "ts-jest": "^29.2.5",
     "ts-node": "^10.9.2",
-    "typescript": "^6.0.3"
+    "typescript": "^6.0.3",
+    "@swc/core": "^1.7.0",
+    "@swc/cli": "^0.4.0"
   },
   "jest": {
     "moduleFileExtensions": [

package/dist/templates/todo/apps/api/src/app.extensions.ts

@@ -0,0 +1,21 @@
+import type { DynamicModule, Provider, Type } from "@nestjs/common";
+
+// Owned extension slot for the Nest app. This file is yours — PodoKit never
+// writes to it, so `podo update` leaves it alone. Use it to add your own modules
+// or providers, or to override a PodoKit-provided provider without editing
+// managed code. Because these are spread in *after* the module-wired providers,
+// an override here takes precedence.
+//
+// Example — override a provider with your own implementation:
+//   import { SomeService } from "./some/some.service";
+//   import { MyService } from "./my-service";
+//   export const extensionProviders: Provider[] = [
+//     { provide: SomeService, useClass: MyService },
+//   ];
+
+/** Extra modules to import into AppModule (or DynamicModule overrides). */
+export const extensionImports: (Type | DynamicModule)[] = [];
+
+/** Extra or overriding providers for AppModule. Same-token providers listed here
+ *  win over the ones PodoKit modules registered. */
+export const extensionProviders: Provider[] = [];

package/dist/templates/todo/apps/api/src/app.module.ts

@@ -5,6 +5,7 @@ import { validateEnv } from "./config/env.validation";
 import { dataSourceOptions } from "./database/data-source";
 import { HealthModule } from "./health/health.module";
 import { TodosModule } from "./todos/todos.module";
+import { extensionImports, extensionProviders } from "./app.extensions";
 // podokit:begin:imports
 // podokit:end:imports
 
@@ -16,10 +17,12 @@ import { TodosModule } from "./todos/todos.module";
     TodosModule,
     // podokit:begin:module-imports
     // podokit:end:module-imports
+    ...extensionImports,
   ],
   providers: [
     // podokit:begin:providers
     // podokit:end:providers
+    ...extensionProviders,
   ],
 })
 export class AppModule {}

package/dist/templates/todo/apps/web/src/app.html

@@ -3,6 +3,8 @@
   <head>
     <meta charset="utf-8" />
     <meta name="viewport" content="width=device-width, initial-scale=1" />
+    <title>{{projectName}}</title>
+    <link rel="icon" href="/favicon.svg" type="image/svg+xml" />
     %sveltekit.head%
   </head>
   <body data-sveltekit-preload-data="hover" class="h-full">

package/dist/templates/todo/apps/web/src/lib/components/ui/tabs/index.ts

@@ -1,6 +1,6 @@
 import Root from "./tabs.svelte";
 import Content from "./tabs-content.svelte";
-import List, { tabsListVariants, type TabsListVariant } from "./tabs-list.svelte";
+import List from "./tabs-list.svelte";
 import Trigger from "./tabs-trigger.svelte";
 
 export {
@@ -8,8 +8,6 @@ export {
 	Content,
 	List,
 	Trigger,
-	tabsListVariants,
-	type TabsListVariant,
 	//
 	Root as Tabs,
 	Content as TabsContent,

package/dist/templates/todo/apps/web/src/lib/components/ui/tabs/tabs-content.svelte

@@ -12,6 +12,6 @@
 <TabsPrimitive.Content
 	bind:ref
 	data-slot="tabs-content"
-	class={cn("text-sm flex-1 outline-none", className)}
+	class={cn("flex-1 outline-none", className)}
 	{...restProps}
 />

package/dist/templates/todo/apps/web/src/lib/components/ui/tabs/tabs-list.svelte

@@ -1,40 +1,20 @@
-<script lang="ts" module>
-	import { tv, type VariantProps } from "tailwind-variants";
-
-	export const tabsListVariants = tv({
-		base: "rounded-lg p-[3px] group-data-horizontal/tabs:h-8 data-[variant=line]:rounded-none group/tabs-list text-muted-foreground inline-flex w-fit items-center justify-center group-data-[orientation=vertical]/tabs:h-fit group-data-[orientation=vertical]/tabs:flex-col",
-		variants: {
-			variant: {
-				default: "cn-tabs-list-variant-default bg-muted",
-				line: "cn-tabs-list-variant-line gap-1 bg-transparent",
-			},
-		},
-		defaultVariants: {
-			variant: "default",
-		},
-	});
-
-	export type TabsListVariant = VariantProps<typeof tabsListVariants>["variant"];
-</script>
-
 <script lang="ts">
 	import { Tabs as TabsPrimitive } from "bits-ui";
 	import { cn } from "$lib/utils.js";
 
 	let {
 		ref = $bindable(null),
-		variant = "default",
 		class: className,
 		...restProps
-	}: TabsPrimitive.ListProps & {
-		variant?: TabsListVariant;
-	} = $props();
+	}: TabsPrimitive.ListProps = $props();
 </script>
 
 <TabsPrimitive.List
 	bind:ref
 	data-slot="tabs-list"
-	data-variant={variant}
-	class={cn(tabsListVariants({ variant }), className)}
+	class={cn(
+		"bg-muted text-muted-foreground inline-flex h-9 w-fit items-center justify-center rounded-lg p-[3px]",
+		className
+	)}
 	{...restProps}
 />

package/dist/templates/todo/apps/web/src/lib/components/ui/tabs/tabs-trigger.svelte

@@ -13,10 +13,7 @@
 	bind:ref
 	data-slot="tabs-trigger"
 	class={cn(
-		"gap-1.5 rounded-md border border-transparent px-1.5 py-0.5 text-sm font-medium has-data-[icon=inline-end]:pr-1 has-data-[icon=inline-start]:pl-1 group-data-[variant=default]/tabs-list:data-active:shadow-sm group-data-[variant=line]/tabs-list:data-active:shadow-none [&_svg:not([class*='size-'])]:size-4 focus-visible:border-ring focus-visible:ring-ring/50 focus-visible:outline-ring text-foreground/60 hover:text-foreground dark:text-muted-foreground dark:hover:text-foreground relative inline-flex h-[calc(100%-1px)] flex-1 items-center justify-center whitespace-nowrap transition-all group-data-[orientation=vertical]/tabs:w-full group-data-[orientation=vertical]/tabs:justify-start focus-visible:ring-[3px] focus-visible:outline-1 disabled:pointer-events-none disabled:opacity-50 [&_svg]:pointer-events-none [&_svg]:shrink-0",
-		"group-data-[variant=line]/tabs-list:bg-transparent group-data-[variant=line]/tabs-list:data-active:bg-transparent dark:group-data-[variant=line]/tabs-list:data-active:border-transparent dark:group-data-[variant=line]/tabs-list:data-active:bg-transparent",
-		"data-active:bg-background dark:data-active:text-foreground dark:data-active:border-input dark:data-active:bg-input/30 data-active:text-foreground",
-		"after:bg-foreground after:absolute after:opacity-0 after:transition-opacity group-data-[orientation=horizontal]/tabs:after:inset-x-0 group-data-[orientation=horizontal]/tabs:after:bottom-[-5px] group-data-[orientation=horizontal]/tabs:after:h-0.5 group-data-[orientation=vertical]/tabs:after:inset-y-0 group-data-[orientation=vertical]/tabs:after:-right-1 group-data-[orientation=vertical]/tabs:after:w-0.5 group-data-[variant=line]/tabs-list:data-active:after:opacity-100",
+		"data-[state=active]:bg-background dark:data-[state=active]:text-foreground focus-visible:border-ring focus-visible:ring-ring/50 focus-visible:outline-ring dark:data-[state=active]:border-input dark:data-[state=active]:bg-input/30 text-foreground dark:text-muted-foreground inline-flex h-[calc(100%-1px)] flex-1 items-center justify-center gap-1.5 rounded-md border border-transparent px-2 py-1 text-sm font-medium whitespace-nowrap transition-[color,box-shadow] focus-visible:ring-[3px] focus-visible:outline-1 disabled:pointer-events-none disabled:opacity-50 data-[state=active]:shadow-sm [&_svg]:pointer-events-none [&_svg]:shrink-0 [&_svg:not([class*='size-'])]:size-4",
 		className
 	)}
 	{...restProps}

package/dist/templates/todo/apps/web/src/lib/components/ui/tabs/tabs.svelte

@@ -14,6 +14,6 @@
 	bind:ref
 	bind:value
 	data-slot="tabs"
-	class={cn("gap-2 group/tabs flex data-[orientation=horizontal]:flex-col", className)}
+	class={cn("flex flex-col gap-2", className)}
 	{...restProps}
 />

package/dist/templates/todo/apps/web/static/favicon.svg

@@ -0,0 +1,13 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 64 64" role="img" aria-label="PodoKit">
+  <defs>
+    <linearGradient id="pk" x1="0" y1="0" x2="1" y2="1">
+      <stop offset="0" stop-color="#8b5cf6"/>
+      <stop offset="1" stop-color="#4f46e5"/>
+    </linearGradient>
+  </defs>
+  <rect width="64" height="64" rx="15" fill="url(#pk)"/>
+  <!-- layered stack: full-stack toolkit -->
+  <path d="M32 14 50 25 32 36 14 25Z" fill="#fff" fill-opacity="0.96"/>
+  <path d="M16 31 32 40.5 48 31" fill="none" stroke="#fff" stroke-opacity="0.78" stroke-width="3.4" stroke-linecap="round" stroke-linejoin="round"/>
+  <path d="M16 38 32 47.5 48 38" fill="none" stroke="#fff" stroke-opacity="0.5" stroke-width="3.4" stroke-linecap="round" stroke-linejoin="round"/>
+</svg>

package/dist/templates/todo/apps/web/vite.config.ts

@@ -2,6 +2,18 @@ import { sveltekit } from "@sveltejs/kit/vite";
 import tailwindcss from "@tailwindcss/vite";
 import { defineConfig } from "vite";
 
+// Inside the dev container (compose.dev.yaml sets VITE_DOCKER=1): bind to all
+// interfaces, allow the Traefik hostname, and route HMR through Traefik on :80.
+const inDocker = process.env.VITE_DOCKER === "1";
+
 export default defineConfig({
   plugins: [tailwindcss(), sveltekit()],
+  server: inDocker
+    ? {
+        host: true,
+        port: 5001,
+        allowedHosts: true,
+        hmr: { clientPort: 80 },
+      }
+    : undefined,
 });