@podosoft/podokit 1.0.2 → 1.1.4

package/dist/templates/modules/jobs-local/files/apps/api/src/jobs-local/local-job.queue.ts

@@ -0,0 +1,212 @@
+import type { SQL } from "bun";
+import {
+  type EnqueueOptions,
+  type JobHandler,
+  type JobQueue,
+  type JobReference,
+  type JobSnapshot,
+  type JobStatus,
+  type Unsubscribe,
+} from "@podosoft/podokit-runtime";
+
+interface JobRow {
+  id: string;
+  name: string;
+  payload: string;
+  status: JobStatus;
+  attempts: number;
+  maxAttempts: number;
+  availableAt: number;
+  createdAt: number;
+  updatedAt: number;
+  error: string | null;
+}
+
+export interface LocalJobQueueOptions {
+  pollIntervalMs?: number;
+  now?: () => number;
+}
+
+export class LocalJobQueue implements JobQueue {
+  private readonly handlers = new Map<string, JobHandler>();
+  private readonly pollIntervalMs: number;
+  private readonly now: () => number;
+  private timer?: ReturnType<typeof setTimeout>;
+  private started = false;
+  private initialized?: Promise<void>;
+
+  constructor(
+    private readonly sql: SQL,
+    options: LocalJobQueueOptions = {},
+  ) {
+    this.pollIntervalMs = options.pollIntervalMs ?? 250;
+    if (!Number.isSafeInteger(this.pollIntervalMs) || this.pollIntervalMs < 10) {
+      throw new Error("pollIntervalMs must be an integer of at least 10");
+    }
+    this.now = options.now ?? Date.now;
+  }
+
+  initialize(): Promise<void> {
+    this.initialized ??= (async () => {
+      await this.sql`
+        CREATE TABLE IF NOT EXISTS "podokit_job" (
+          "id" text PRIMARY KEY,
+          "name" text NOT NULL,
+          "payload" text NOT NULL,
+          "status" text NOT NULL,
+          "attempts" integer NOT NULL,
+          "maxAttempts" integer NOT NULL,
+          "availableAt" bigint NOT NULL,
+          "createdAt" bigint NOT NULL,
+          "updatedAt" bigint NOT NULL,
+          "error" text
+        )
+      `;
+      await this.sql`
+        CREATE INDEX IF NOT EXISTS "podokit_job_pending"
+        ON "podokit_job" ("status", "availableAt", "createdAt")
+      `;
+    })();
+    return this.initialized;
+  }
+
+  async start(): Promise<void> {
+    if (this.started) return;
+    await this.initialize();
+    this.started = true;
+    this.schedule(0);
+  }
+
+  async enqueue(
+    name: string,
+    payload: unknown,
+    options: EnqueueOptions = {},
+  ): Promise<JobReference> {
+    await this.initialize();
+    const encoded = JSON.stringify(payload);
+    if (encoded === undefined) throw new Error("Job payload must be JSON serializable");
+    const now = this.now();
+    const id = options.deduplicationKey
+      ? `${name}:${options.deduplicationKey}`
+      : crypto.randomUUID();
+    const attempts = options.attempts ?? 1;
+    const delayMs = options.delayMs ?? 0;
+    if (!Number.isSafeInteger(attempts) || attempts < 1) {
+      throw new Error("attempts must be a positive integer");
+    }
+    if (!Number.isSafeInteger(delayMs) || delayMs < 0) {
+      throw new Error("delayMs must be a non-negative integer");
+    }
+    await this.sql`
+      INSERT INTO "podokit_job" (
+        "id", "name", "payload", "status", "attempts", "maxAttempts",
+        "availableAt", "createdAt", "updatedAt", "error"
+      ) VALUES (
+        ${id}, ${name}, ${encoded}, 'waiting', 0, ${attempts},
+        ${now + delayMs}, ${now}, ${now}, NULL
+      )
+      ON CONFLICT ("id") DO NOTHING
+    `;
+    return { id, name };
+  }
+
+  async get(id: string): Promise<JobSnapshot | null> {
+    await this.initialize();
+    const rows = await this.sql<JobRow[]>`
+      SELECT "id", "name", "payload", "status", "attempts", "maxAttempts",
+             "availableAt", "createdAt", "updatedAt", "error"
+      FROM "podokit_job" WHERE "id" = ${id}
+    `;
+    const row = rows[0];
+    return row ? this.snapshot(row) : null;
+  }
+
+  process(name: string, handler: JobHandler): Promise<Unsubscribe> {
+    if (this.handlers.has(name)) throw new Error(`A handler is already registered for job ${name}`);
+    this.handlers.set(name, handler);
+    return Promise.resolve(() => {
+      this.handlers.delete(name);
+    });
+  }
+
+  async runOnce(): Promise<boolean> {
+    await this.initialize();
+    const now = this.now();
+    const rows = await this.sql<JobRow[]>`
+      UPDATE "podokit_job"
+      SET "status" = 'active', "attempts" = "attempts" + 1, "updatedAt" = ${now}
+      WHERE "id" = (
+        SELECT "id" FROM "podokit_job"
+        WHERE "status" = 'waiting' AND "availableAt" <= ${now}
+        ORDER BY "createdAt" ASC LIMIT 1
+      ) AND "status" = 'waiting'
+      RETURNING "id", "name", "payload", "status", "attempts", "maxAttempts",
+                "availableAt", "createdAt", "updatedAt", "error"
+    `;
+    const row = rows[0];
+    if (!row) return false;
+    const handler = this.handlers.get(row.name);
+    if (!handler) {
+      await this.fail(row, new Error(`No handler is registered for job ${row.name}`));
+      return true;
+    }
+    try {
+      await handler(JSON.parse(row.payload) as unknown, { id: row.id, name: row.name });
+      const completedAt = this.now();
+      await this.sql`
+        UPDATE "podokit_job"
+        SET "status" = 'completed', "updatedAt" = ${completedAt}, "error" = NULL
+        WHERE "id" = ${row.id}
+      `;
+    } catch (error) {
+      await this.fail(row, error);
+    }
+    return true;
+  }
+
+  close(): void {
+    this.started = false;
+    if (this.timer) clearTimeout(this.timer);
+    this.timer = undefined;
+    this.handlers.clear();
+  }
+
+  private schedule(delay: number): void {
+    if (!this.started) return;
+    this.timer = setTimeout(() => {
+      void this.runOnce()
+        .catch((error: unknown) => {
+          const message = error instanceof Error ? error.message : String(error);
+          process.stderr.write(`Process local job failed: ${message}\n`);
+        })
+        .finally(() => this.schedule(this.pollIntervalMs));
+    }, delay);
+    this.timer.unref?.();
+  }
+
+  private async fail(row: JobRow, error: unknown): Promise<void> {
+    const failedAt = this.now();
+    const message = error instanceof Error ? error.message : String(error);
+    const retry = row.attempts < row.maxAttempts;
+    await this.sql`
+      UPDATE "podokit_job"
+      SET "status" = ${retry ? "waiting" : "failed"},
+          "availableAt" = ${retry ? failedAt + this.pollIntervalMs : failedAt},
+          "updatedAt" = ${failedAt},
+          "error" = ${message.slice(0, 2_000)}
+      WHERE "id" = ${row.id}
+    `;
+  }
+
+  private snapshot(row: JobRow): JobSnapshot {
+    return {
+      id: row.id,
+      name: row.name,
+      status: row.status,
+      attempts: row.attempts,
+      createdAt: Number(row.createdAt),
+      updatedAt: Number(row.updatedAt),
+      ...(row.error ? { error: row.error } : {}),
+    };
+  }
+}

package/dist/templates/modules/jobs-local/module.manifest.json

@@ -0,0 +1,34 @@
+{
+  "manifestVersion": 3,
+  "name": "jobs-local",
+  "description": "Database-persistent local job queue with an embedded single-process worker.",
+  "provides": { "jobs": "local" },
+  "runtimeConstraints": { "maxApiReplicas": 1, "embeddedWorker": true },
+  "requiredProjectFiles": [
+    "apps/api/src/config/providers.ts",
+    "apps/api/src/database/database.ts"
+  ],
+  "managedGlobs": [
+    "apps/api/src/jobs-local/**"
+  ],
+  "targetApp": "api",
+  "env": [
+    "LOCAL_JOBS_POLL_INTERVAL_MS=250"
+  ],
+  "inject": [
+    {
+      "file": "apps/api/src/app.ts",
+      "marker": "// podokit:end:imports",
+      "text": "import { jobsLocalModule } from \"./jobs-local/jobs-local.module\";"
+    },
+    {
+      "file": "apps/api/src/app.ts",
+      "marker": "// podokit:end:modules",
+      "text": "jobsLocalModule,"
+    }
+  ],
+  "instructions": [
+    "The local worker runs inside the API process and persists jobs in the selected database.",
+    "Keep the API at one replica or select the BullMQ jobs provider."
+  ]
+}

package/dist/templates/modules/mailer/files/apps/api/src/mail/mailer.ts

@@ -1,5 +1,4 @@
 import nodemailer, { type Transporter } from "nodemailer";
-import { pool } from "./db";
 import { createConfigStore, type SmtpConfig } from "@podosoft/podokit-auth";
 
 // Reusable email sending. SMTP is resolved in priority order, applied live (short
@@ -10,9 +9,14 @@ import { createConfigStore, type SmtpConfig } from "@podosoft/podokit-auth";
 //   3. none → a JSON transport that logs the message so dev links are grabbable.
 // The whole transport can also be overridden from app code (setMailTransport),
 // e.g. from apps/api/src/app.extensions.ts, to plug in a provider SDK.
-const store = createConfigStore(pool);
+type MailConfigStore = Pick<ReturnType<typeof createConfigStore>, "smtpConfig">;
+let store: MailConfigStore | undefined;
 const TTL_MS = 3_000;
 
+export function setMailConfigStore(configStore: MailConfigStore): void {
+  store = configStore;
+}
+
 function envSmtp(): SmtpConfig | null {
   if (!process.env.SMTP_HOST) return null;
   return {
@@ -28,7 +32,7 @@ function envSmtp(): SmtpConfig | null {
 async function resolveSmtp(): Promise<SmtpConfig | null> {
   try {
     // Reads auth_config and falls back to env internally when auth is installed.
-    return await store.smtpConfig();
+    return store ? await store.smtpConfig() : envSmtp();
   } catch {
     // No auth_config table (auth not installed) — use env directly.
     return envSmtp();

package/dist/templates/modules/mailer/module.manifest.json

@@ -5,12 +5,10 @@
   "targetApp": "api",
   "dependencies": {
     "nodemailer": "^9.0.5",
-    "@podosoft/podokit-auth": "^0.3.0",
-    "pg": "^8.12.0"
+    "@podosoft/podokit-auth": "^0.4.0"
   },
   "devDependencies": {
-    "@types/nodemailer": "^8.0.1",
-    "@types/pg": "^8.11.10"
+    "@types/nodemailer": "^8.0.1"
   },
   "env": [
     "# ── Mailer (SMTP) — optional ──",

package/dist/templates/modules/object-storage-local/files/apps/api/src/storage-local/storage-local.module.spec.ts

@@ -0,0 +1,25 @@
+import { afterEach, describe, expect, it } from "bun:test";
+import { mkdtemp, rm } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { LocalObjectStore } from "@podosoft/podokit-runtime";
+
+let root: string | undefined;
+
+afterEach(async () => {
+  if (root) await rm(root, { recursive: true, force: true });
+  root = undefined;
+});
+
+describe("local object storage provider", () => {
+  it("stores and reads an object without allowing traversal", async () => {
+    root = await mkdtemp(join(tmpdir(), "podokit-storage-"));
+    const storage = new LocalObjectStore({ rootDirectory: root });
+    await storage.put("uploads/hello.txt", "hello", { contentType: "text/plain" });
+    expect(await storage.exists("uploads/hello.txt")).toBe(true);
+    expect(await storage.getDownloadUrl("uploads/hello.txt")).toBe(
+      "/files/content/uploads/hello.txt",
+    );
+    await expect(storage.put("../outside.txt", "no")).rejects.toThrow("safe relative path");
+  });
+});

package/dist/templates/modules/object-storage-local/files/apps/api/src/storage-local/storage-local.module.ts

@@ -0,0 +1,60 @@
+import {
+  LocalObjectStore,
+  OBJECT_STORAGE,
+  type ObjectData,
+} from "@podosoft/podokit-runtime";
+import { Elysia, t } from "elysia";
+import { resolve } from "node:path";
+import type { AppPlugin, PodokitModule } from "../core/services";
+import { PROVIDERS } from "../config/providers";
+
+function responseBody(object: ObjectData): ReadableStream<Uint8Array> {
+  const iterator = object.body[Symbol.asyncIterator]();
+  return new ReadableStream<Uint8Array>({
+    async pull(controller): Promise<void> {
+      const next = await iterator.next();
+      if (next.done) controller.close();
+      else controller.enqueue(next.value);
+    },
+    async cancel(): Promise<void> {
+      await iterator.return?.();
+    },
+  });
+}
+
+const localStoragePlugin: AppPlugin = ({ services }) => {
+  if (PROVIDERS["object-storage"] !== "local") {
+    return new Elysia({ name: "podokit.storage-local.inactive" });
+  }
+  const storage = services.resolve(OBJECT_STORAGE);
+  return new Elysia({ name: "podokit.storage-local" })
+    .get("/files/content/*", async ({ params, set }) => {
+      const object = await storage.get(params["*"]);
+      if (object.contentType) set.headers["content-type"] = object.contentType;
+      set.headers["content-length"] = String(object.size);
+      return new Response(responseBody(object));
+    }, {
+      detail: { tags: ["files"], summary: "Read a local object" },
+    })
+    .put("/storage/:key", async ({ params, body }) => {
+      await storage.put(params.key, body.content, { contentType: "text/plain" });
+      return { key: params.key };
+    }, {
+      params: t.Object({ key: t.String({ minLength: 1 }) }),
+      body: t.Object({ content: t.String() }),
+      detail: { tags: ["storage"], summary: "Store an object" },
+    });
+};
+
+export const storageLocalModule: PodokitModule = {
+  name: "object-storage-local",
+  configure: (_env, services): void => {
+    if (PROVIDERS["object-storage"] !== "local") return;
+    const storage = new LocalObjectStore({
+      rootDirectory: resolve(process.env.LOCAL_STORAGE_PATH ?? "./data/files"),
+      publicBaseUrl: "/files/content",
+    });
+    services.register(OBJECT_STORAGE, storage, () => storage.close());
+  },
+  plugin: localStoragePlugin,
+};

package/dist/templates/modules/object-storage-local/module.manifest.json

@@ -0,0 +1,34 @@
+{
+  "manifestVersion": 3,
+  "name": "object-storage-local",
+  "description": "Atomic path-confined local filesystem object storage for desktop and single-host applications.",
+  "provides": { "object-storage": "local" },
+  "runtimeConstraints": { "maxApiReplicas": 1 },
+  "requiredProjectFiles": [
+    "apps/api/src/config/providers.ts"
+  ],
+  "managedGlobs": [
+    "apps/api/src/storage-local/**"
+  ],
+  "targetApp": "api",
+  "env": [
+    "# Local object storage root. Use an absolute path in production and desktop packaging.",
+    "LOCAL_STORAGE_PATH=./data/files"
+  ],
+  "inject": [
+    {
+      "file": "apps/api/src/app.ts",
+      "marker": "// podokit:end:imports",
+      "text": "import { storageLocalModule } from \"./storage-local/storage-local.module\";"
+    },
+    {
+      "file": "apps/api/src/app.ts",
+      "marker": "// podokit:end:modules",
+      "text": "storageLocalModule,"
+    }
+  ],
+  "instructions": [
+    "Local object storage is single-host. Back up LOCAL_STORAGE_PATH together with the database.",
+    "Keep the API at one replica or select the S3 provider."
+  ]
+}

package/dist/templates/modules/object-storage-s3/files/apps/api/src/storage/s3-object.store.ts

@@ -0,0 +1,50 @@
+import type {
+  DownloadUrlOptions,
+  ObjectBody,
+  ObjectData,
+  ObjectStore,
+  PutObjectOptions,
+  StoredObject,
+} from "@podosoft/podokit-runtime";
+import type { StorageService } from "./storage.service";
+
+async function bodyBytes(body: ObjectBody): Promise<Uint8Array> {
+  if (typeof body === "string") return Buffer.from(body);
+  if (body instanceof Uint8Array) return body;
+  const chunks: Uint8Array[] = [];
+  for await (const chunk of body) chunks.push(chunk);
+  return Buffer.concat(chunks);
+}
+
+async function* oneChunk(body: Uint8Array): AsyncGenerator<Uint8Array> {
+  yield body;
+}
+
+export class S3ObjectStore implements ObjectStore {
+  constructor(private readonly storage: StorageService) {}
+
+  async put(key: string, body: ObjectBody, options: PutObjectOptions = {}): Promise<StoredObject> {
+    const bytes = await bodyBytes(body);
+    await this.storage.put(key, bytes, options.contentType);
+    return { key, size: bytes.byteLength, ...options };
+  }
+
+  async get(key: string): Promise<ObjectData> {
+    const bytes = await this.storage.get(key);
+    return { key, size: bytes.byteLength, body: oneChunk(bytes) };
+  }
+
+  exists(key: string): Promise<boolean> {
+    return this.storage.exists(key);
+  }
+
+  delete(key: string): Promise<void> {
+    return this.storage.delete(key);
+  }
+
+  getDownloadUrl(key: string, options: DownloadUrlOptions = {}): Promise<string> {
+    return this.storage.presignedGetUrl(key, options.expiresInSeconds);
+  }
+
+  close(): void {}
+}

package/dist/templates/modules/object-storage-s3/files/apps/api/src/storage/storage.module.ts

@@ -1,4 +1,6 @@
 import { Elysia, t } from "elysia";
+import { OBJECT_STORAGE } from "@podosoft/podokit-runtime";
+import { PROVIDERS } from "../config/providers";
 import {
   type AppPlugin,
   type PodokitModule,
@@ -6,10 +8,14 @@ import {
   type ServiceKey,
 } from "../core/services";
 import { StorageService } from "./storage.service";
+import { S3ObjectStore } from "./s3-object.store";
 
 export const STORAGE = Symbol("storage") as ServiceKey<StorageService>;
 
 const storagePlugin: AppPlugin = ({ services }) => {
+  if (PROVIDERS["object-storage"] !== "s3") {
+    return new Elysia({ name: "podokit.storage-s3.inactive" });
+  }
   const storage = services.resolve(STORAGE);
   return new Elysia({ name: "podokit.storage" })
     .put("/storage/:key", async ({ params, body }) => {
@@ -38,8 +44,10 @@ const storagePlugin: AppPlugin = ({ services }) => {
 export const storageModule: PodokitModule = {
   name: "object-storage-s3",
   configure: (_env, services): void => {
+    if (PROVIDERS["object-storage"] !== "s3") return;
     const storage = new StorageService(services.resolve(READINESS));
     services.register(STORAGE, storage, () => storage.close());
+    services.register(OBJECT_STORAGE, new S3ObjectStore(storage));
   },
   plugin: storagePlugin,
 };

package/dist/templates/modules/object-storage-s3/files/infra/docker/minio.compose.yml

@@ -1,4 +1,4 @@
-# MinIO for local S3-compatible object storage — development only (in production
+# Silo for local S3-compatible object storage — development only (in production
 # point S3_* at a real S3-compatible service). Part of the `dev` profile; add it with:
 #
 #   docker compose -f infra/docker/docker-compose.yml -f infra/docker/minio.compose.yml --profile dev up -d
@@ -6,7 +6,7 @@
 # Console: http://localhost:9001  (S3 API: http://localhost:9000)
 services:
   minio:
-    image: minio/minio:latest
+    image: pgsty/silo:RELEASE.2026-09-16T00-00-00Z@sha256:635197cb9f36d01bee221d34d1c7d7960f6a95c48b0b6c01d99cd13bdae51a46
     profiles: ["dev"]
     command: server /data --console-address ":9001"
     environment:
@@ -18,9 +18,9 @@ services:
     volumes:
       - minio-data:/data
 
-  # Waits for MinIO, then creates the bucket and exits.
+  # Waits for object storage, then creates the bucket and exits.
   minio-init:
-    image: minio/mc:latest
+    image: pgsty/mc:RELEASE.2026-09-16T00-00-00Z@sha256:cfc83108c3abb371f8fb84d99c1fdc88f8c237e022409b0081fb7c0a3be634dd
     profiles: ["dev"]
     depends_on:
       - minio

package/dist/templates/modules/object-storage-s3/files/tests/api/storage.api.spec.ts

@@ -3,7 +3,7 @@ import { expect, test } from "@playwright/test";
 const base = process.env.E2E_BASE_URL ?? "http://localhost:5001";
 const origin = { origin: base };
 
-async function session(playwright: import("@playwright/test").PlaywrightWorkerArgs["playwright"]) {
+async function session(playwright: import("@playwright/test").PlaywrightWorkerArgs["playwright"]): Promise<import("@playwright/test").APIRequestContext> {
   const ctx = await playwright.request.newContext({ baseURL: base, extraHTTPHeaders: origin });
   const email = `storage-${Date.now()}-${Math.random().toString(36).slice(2, 8)}@example.com`;
   await ctx.post("/api/auth/sign-up/email", { data: { email, password: "Podokit3e-Str0ng!pw", name: "S" } }).catch(() => undefined);
@@ -12,17 +12,25 @@ async function session(playwright: import("@playwright/test").PlaywrightWorkerAr
 
 test("object storage: put, get, and presign @smoke", async ({ playwright }) => {
   const ctx = await session(playwright);
-  const key = `obj-${Date.now()}`;
-  const put = await ctx.put(`/api/storage/${key}`, { data: { content: "hello world" } });
-  test.skip(put.status() >= 500, "object storage (MinIO/S3) not reachable");
-  expect(put.ok()).toBeTruthy();
-  expect(await put.json()).toMatchObject({ key });
+  const key = `obj-${Date.now()}-${Math.random().toString(36).slice(2, 8)}`;
+  try {
+    const put = await ctx.put(`/api/storage/${key}`, { data: { content: "hello world" } });
+    test.skip(!process.env.S3_ENDPOINT && put.status() >= 500, "optional S3-compatible service not configured");
+    expect(put.ok()).toBeTruthy();
+    expect(await put.json()).toMatchObject({ key });
 
-  const got = await (await ctx.get(`/api/storage/${key}`)).json();
-  expect(got).toMatchObject({ key, content: "hello world" });
+    const read = await ctx.get(`/api/storage/${key}`);
+    expect(read.ok()).toBeTruthy();
+    expect(await read.json()).toMatchObject({ key, content: "hello world" });
 
-  const pre = await (await ctx.get(`/api/storage/${key}/presigned`)).json();
-  expect(String(pre.url)).toContain(key);
-
-  await ctx.dispose();
+    const presigned = await ctx.get(`/api/storage/${key}/presigned`);
+    expect(presigned.ok()).toBeTruthy();
+    const pre = await presigned.json() as { url: string };
+    expect(new URL(pre.url).pathname).toContain(key);
+    const download = await ctx.get(pre.url);
+    expect(download.ok()).toBeTruthy();
+    expect(await download.text()).toBe("hello world");
+  } finally {
+    await ctx.dispose();
+  }
 });

package/dist/templates/modules/object-storage-s3/module.manifest.json

@@ -1,7 +1,9 @@
 {
+  "manifestVersion": 3,
   "name": "object-storage-s3",
-  "description": "Bun-native S3-compatible object storage for AWS S3 or MinIO with a StorageService and presigned URLs.",
+  "description": "Bun-native S3-compatible object storage for AWS S3 or MinIO-compatible services with a StorageService and presigned URLs.",
   "requires": [],
+  "provides": { "object-storage": "s3" },
   "requiredProjectFiles": [
     "apps/api/src/health/readiness.service.ts"
   ],
@@ -21,7 +23,7 @@
     { "file": "apps/api/src/app.ts", "marker": "// podokit:end:modules", "text": "storageModule," }
   ],
   "instructions": [
-    "Start MinIO for local dev:  docker compose -f infra/docker/docker-compose.yml -f infra/docker/minio.compose.yml up -d",
+    "Start Silo for local dev:  docker compose -f infra/docker/docker-compose.yml -f infra/docker/minio.compose.yml up -d",
     "Store an object:  curl -XPUT localhost:5002/storage/hello -H 'content-type: application/json' -d '{\"content\":\"hi\"}'",
     "Read it back:     curl localhost:5002/storage/hello",
     "Presigned URL:    curl localhost:5002/storage/hello/presigned",

package/dist/templates/modules/rate-limit/files/apps/api/src/rate-limit/rate-limit.module.spec.ts

@@ -1,7 +1,8 @@
 import { describe, expect, mock, test } from "bun:test";
 import type { RequestGuardContext } from "../core/services";
 import type { RateLimitIdentity } from "./rate-limit.identity";
-import { RateLimiter, type RateLimitStorage } from "./rate-limit.module";
+import { CacheRateLimitStorage, RateLimiter, type RateLimitStorage } from "./rate-limit.module";
+import { MemoryCacheStore } from "@podosoft/podokit-runtime";
 
 const config = {
   keyPrefix: "podokit:test:rate-limit",
@@ -32,6 +33,15 @@ function context(path: string, method = "GET"): {
 }
 
 describe("RateLimiter", () => {
+  test("uses the selected cache fixed-window primitive", async () => {
+    let now = 1_000;
+    const storage = new CacheRateLimitStorage(new MemoryCacheStore({ now: () => now }));
+    expect(await storage.increment("user", 60)).toMatchObject({ count: 1 });
+    expect(await storage.increment("user", 60)).toMatchObject({ count: 2 });
+    now += 60_000;
+    expect(await storage.increment("user", 60)).toMatchObject({ count: 1 });
+  });
+
   test("applies general, authentication, and runtime profiles", async () => {
     const increment = mock(async (_key: string, _ttlSeconds: number) => ({
       count: 1,
@@ -44,17 +54,20 @@ describe("RateLimiter", () => {
     );
     await limiter.enforce(context("/ordinary").value);
     await limiter.enforce(context("/api/auth/sign-in", "POST").value);
+    await limiter.enforce(context("/api/auth/get-session").value);
     await limiter.enforce(context("/site/settings").value);
 
     expect(increment.mock.calls.map((call) => call.slice(1))).toEqual([
       [60],
       [60],
       [60],
+      [60],
     ]);
     expect(increment.mock.calls.map((call) => call[0])).toEqual([
       "podokit:test:rate-limit:general:user:test",
       "podokit:test:rate-limit:auth:user:test",
       "podokit:test:rate-limit:runtime:user:test",
+      "podokit:test:rate-limit:runtime:user:test",
     ]);
   });