create-lego-one 2.0.10 → 2.0.13

package/template/CLAUDE.md

@@ -0,0 +1,634 @@
+# AI Workflow for Lego-One Development
+
+> **Lego-One**: Modular SaaS boilerplate with microkernel architecture using Modern.js + Garfish + PocketBase
+
+---
+
+## AUTOMATIC CONTEXT INGESTION
+
+**WHEN THIS SESSION STARTS:**
+
+You MUST automatically read and ingest the following files in order:
+
+1. **`CLAUDE.md`** (this file) - Core workflow and architecture rules
+2. **`PROMPT.md`** (if provided by user) - Session-specific task context
+3. **`/docs/framework/setup/00-index.md`** - AI documentation index
+4. **Relevant documentation files** based on task type
+
+**DO NOT START CODING** until you have read these files.
+
+---
+
+## CRITICAL RULES
+
+### 0. UPDATE README.md WHEN CODE CHANGES ⚠️
+
+**IMPORTANT:** When making any code changes that affect:
+- Project structure or file locations
+- New features or capabilities
+- API changes or new endpoints
+- Configuration changes
+- New commands or scripts
+- Documentation paths or locations
+- Any user-facing functionality
+
+**YOU MUST UPDATE THE README.md FILE** to reflect these changes. The README.md is the primary source of information for users, and it must stay current with the actual codebase.
+
+**Before completing any task:**
+1. Review what changed in the codebase
+2. Check if README.md needs updates
+3. Update README.md sections that are affected
+4. Ensure examples, paths, and instructions are accurate
+
+**DO NOT** leave README.md outdated - users rely on it for accurate information.
+
+---
+
+### 1. MICROKERNEL ARCHITECTURE ENFORCEMENT ⚠️
+
+**STRICT SEPARATION BETWEEN KERNEL AND APPLICATION:**
+
+```
+┌─────────────────────────────────────────────────────────────┐
+│              HOST/FRAMEWORK (KERNEL)                         │
+│  Core System: host/src/kernel/                              │
+│  - Authentication, RBAC, State Management                   │
+│  - Plugin Loader, Slot Injection System                     │
+│  - Shared UI Components, Layout                             │
+│  - Window Bridge, Channel Bus                               │
+└─────────────────────────────────────────────────────────────┘
+                              │
+                    ══════════════════════════
+                    PLUGIN BOUNDARY (Garfish)
+                    ══════════════════════════
+                              │
+┌─────────────────────────────────────────────────────────────┐
+│              APPLICATION PLUGINS                             │
+│  Feature Modules: packages/plugins/@lego/                   │
+│  - Dashboard, Todo, Custom Features                         │
+│  - Plugin-specific UI, Logic, Data                          │
+└─────────────────────────────────────────────────────────────┘
+```
+
+**RULES YOU MUST FOLLOW:**
+
+| Scenario | Action |
+|----------|--------|
+| **Working on Application Plugin** | Implement ALL logic within the plugin. Use window bridge for kernel communication. |
+| **Task Requires Kernel Modification** | **STOP IMMEDIATELY**. Follow "Framework Change Protocol" below. |
+| **Uncertain Where Code Belongs** | Ask user for clarification before proceeding. |
+
+**FRAMEWORK CHANGE PROTOCOL:**
+
+When a task CANNOT be achieved without modifying the core Framework/Kernel:
+
+1. **STOP IMMEDIATELY** - Do not write any kernel code
+2. **INFORM THE USER** with this message:
+   > "⚠️ This task requires changes to the core Framework/Kernel. Modifying the kernel directly is not recommended as it may affect future framework updates."
+3. **REQUEST PERMISSION** - Ask: "Do you want me to proceed with kernel modifications?"
+4. **IF PERMISSION GRANTED:**
+   - Make kernel changes first
+   - Document the changes in a checkpoint
+   - Inform user they should update framework and run `pnpm update` in dependent applications
+5. **IF PERMISSION DENIED:**
+   - Suggest alternative approaches using existing kernel features
+   - Implement feature within plugin constraints only
+
+**WHAT CONSTITUTES A KERNEL CHANGE:**
+
+- ❌ Modifying files in `host/src/kernel/`
+- ❌ Adding new shared dependencies
+- ❌ Changing the slot injection system
+- ❌ Modifying window bridge structure
+- ❌ Changing authentication/RBAC core logic
+
+**WHAT DOES NOT REQUIRE KERNEL CHANGES:**
+
+- ✅ Creating new plugins
+- ✅ Adding features within existing plugins
+- ✅ Using existing slots for UI injection
+- ✅ Using window bridge to read kernel state
+- ✅ Using channel bus for events
+- ✅ Creating PocketBase collections (application-level)
+
+**ENFORCEMENT:**
+
+Before making ANY changes to `host/src/kernel/`, ask yourself:
+
+1. Is this change absolutely necessary?
+2. Can this be achieved through plugin configuration?
+3. Can I use window bridge instead of direct imports?
+4. Have I informed the user and received permission?
+
+**IF ANSWER IS NO TO ANY QUESTION** - Do not proceed.
+
+---
+
+### 2. READ DOCUMENTATION FIRST
+
+**Before starting ANY code:**
+
+1. **ALWAYS read** `/docs/framework/setup/00-index.md` for the complete AI documentation index
+2. **Read relevant files** based on your task type:
+   - Creating plugin → Read `07-plugin-development.md`
+   - Adding feature → Read relevant files from index
+   - Fixing bug → Read `02-development-workflow.md` troubleshooting section
+3. **Follow established patterns** - Consistency is critical
+
+**DO NOT skip documentation to "save time"** - This causes bugs and inconsistencies.
+
+### 3. WRITE CHECKPOINTS FOR ALL WORK
+
+**For EVERY task, bugfix, or feature:**
+
+1. **Create a checkpoint file** in the appropriate directory:
+   - Bugfixes → `/docs/checkpoints/bugfixes/<title>.md`
+   - Features → `/docs/checkpoints/features/<title>.md`
+   - Enhancements → `/docs/checkpoints/enhancements/<title>.md`
+
+2. **Use the template** from `/docs/checkpoints/.template.md`
+
+3. **Update the checkpoint** as you progress:
+   - Document what you're doing
+   - List files modified/created
+   - Note issues encountered and solutions
+   - Mark status (In Progress → Completed)
+
+4. **Mark complete** when the task is done
+
+**Why checkpoints matter:**
+- They track progress over time
+- They help debug future issues
+- They document what works and what doesn't
+- They enable knowledge sharing
+
+---
+
+## Architecture Overview
+
+```
+┌─────────────────────────────────────────────────────────────┐
+│                      HOST (KERNEL)                          │
+│  ┌─────────────────────────────────────────────────────┐   │
+│  │  Core Infrastructure                                 │   │
+│  │  - Authentication (PocketBase SDK)                  │   │
+│  │  - Global Layout (Sidebar, Topbar, Toasts)          │   │
+│  │  - Router (React Router v6 via Modern.js)           │   │
+│  │  - State Bus (Zustand + Garfish Channel)           │   │
+│  │  - Plugin Loader (saas.config.ts reader)            │   │
+│  └─────────────────────────────────────────────────────┘   │
+│                                                             │
+│  ┌─────────────────────────────────────────────────────┐   │
+│  │  SHARED DEPENDENCIES (externals via Garfish)        │   │
+│  │  - React, ReactDOM - Zustand Store Bridge           │   │
+│  │  - UI Primitives (Radix, Shadcn)                    │   │
+│  │  - TanStack Query v5 (shared QueryClient)           │   │
+│  └─────────────────────────────────────────────────────┘   │
+└─────────────────────────────────────────────────────────────┘
+                              │
+                    Plugin Boundary (Garfish.loadApp)
+                              │
+┌─────────────────────────────────────────────────────────────┐
+│  PLUGINS (Feature Modules)                                  │
+│  ┌──────────┐ ┌──────────┐ ┌──────────┐ ┌──────────┐       │
+│  │Dashboard │ │   Todo   │ │ Billing  │ │ Custom   │       │
+│  │ (:3001)  │ │ (:3002)  │ │ (:3003)  │ │ (:3004)  │       │
+│  └──────────┘ └──────────┘ └──────────┘ └──────────┘       │
+└─────────────────────────────────────────────────────────────┘
+```
+
+---
+
+## Documentation Index
+
+**PRIMARY: AI Documentation (Read Sequentially)**
+
+| # | File | Purpose |
+|---|------|---------|
+| 00 | `docs/framework/setup/00-index.md` | **START HERE** - Complete AI documentation index |
+| 01 | `docs/framework/setup/01-framework-structure.md` | Project structure and architecture |
+| 02 | `docs/framework/setup/02-development-workflow.md` | How to work on this framework |
+| 03 | `docs/framework/setup/03-environment-setup.md` | Environment setup and prerequisites |
+| 04 | `docs/framework/setup/04-kernel-architecture.md` | Host/kernel system overview and architecture |
+| 05 | `docs/framework/setup/05-plugin-system.md` | Plugin architecture, loading, and slot injection |
+| 06 | `docs/framework/setup/06-communication-patterns.md` | Window bridge and channel bus for plugin-host communication |
+| 07 | `docs/framework/setup/07-plugin-development.md` | Complete plugin creation guide |
+| 08 | `docs/framework/setup/08-component-library.md` | UI components, styling, and design system |
+| 09 | `docs/framework/setup/09-data-integration.md` | PocketBase, multi-tenancy, and data fetching patterns |
+| 10 | `docs/framework/setup/10-auth-rbac.md` | Authentication, authorization, and permission management |
+| 11 | `docs/framework/setup/11-hooks-api.md` | All kernel hooks documented |
+| 12 | `docs/framework/setup/12-components-api.md` | UI component library API reference |
+| 13 | `docs/framework/setup/13-deployment-guide.md` | Production deployment instructions |
+
+**SUPPORTING: Implementation Plans**
+
+| Phase | Document | Description |
+|-------|----------|-------------|
+| 1 | `docs/framework/plans/01-infrastructure-setup.md` | Monorepo, dependencies, tooling |
+| 2 | `docs/framework/plans/02-pocketbase-setup.md` | PocketBase collections, API rules |
+| 3 | `docs/framework/plans/03-host-kernel.md` | Host app, shared state, layout |
+| 4 | `docs/framework/plans/04-auth-system.md` | Authentication, login/logout |
+| 5 | `docs/framework/plans/05-multitenancy-rbac.md` | Organizations, users, roles |
+| 6 | `docs/framework/plans/06-ui-components.md` | UI component library |
+| 7 | `docs/framework/plans/07-communication-system.md` | Channel bus, toast system |
+| 8 | `docs/framework/plans/08-plugin-system.md` | Plugin architecture, slots |
+| 9 | `docs/framework/plans/09-dashboard-plugin.md` | Dashboard plugin |
+| 10 | `docs/framework/plans/10-todo-plugin.md` | Todo plugin with CRUD |
+| 11 | `docs/framework/plans/11-testing.md` | Unit, component, E2E tests |
+| 12 | `docs/framework/plans/12-deployment.md` | Build, deploy, CI/CD |
+
+---
+
+## Key File Locations
+
+| Purpose | Path |
+|---------|------|
+| **AI Documentation** | `docs/framework/setup/` |
+| **Implementation Plans** | `docs/framework/plans/` |
+| **Checkpoints** | `docs/checkpoints/` |
+| Host Kernel | `host/src/kernel/` |
+| Host Routes | `host/src/routes/` |
+| Plugins | `packages/plugins/@lego/` |
+| PocketBase Data | `pocketbase/pb_data/` |
+| Plugin Config | `host/saas.config.ts` |
+
+---
+
+## 2. Follow Established Patterns
+
+### When Working on HOST (Kernel):
+
+**File Structure:**
+```
+host/src/
+├── kernel/
+│   ├── shared-state/     # Zustand store + window bridge
+│   ├── providers/        # PocketBase, Query, Theme
+│   ├── plugins/          # Plugin system, slots
+│   ├── channels/         # Garfish channel bus
+│   ├── auth/             # Authentication logic
+│   ├── rbac/             # Multitenancy, permissions
+│   ├── lib/              # Utilities (cn, formatDate)
+│   └── components/       # Shared UI components
+├── layout/               # Shell, Sidebar, Topbar
+├── routes/               # File-based routing
+├── bootstrap.tsx         # App entry point
+├── modern.runtime.ts     # Garfish plugin config
+└── saas.config.ts        # Plugin enable/disable
+```
+
+**Key Patterns:**
+- Use `window.__LEGO_KERNEL_STATE__` for shared state bridge
+- Use Garfish channel for inter-plugin communication
+- Slots in layout: `sidebar:nav`, `sidebar:top`, `sidebar:bottom`, `topbar:left`, `topbar:right`, `topbar:center`
+- Always use `usePocketBase()` hook for API access
+- Use `useGlobalKernelState()` for auth/user/org context
+
+### When Creating PLUGINS:
+
+**Standard Plugin Structure:**
+```
+packages/plugins/@lego/plugin-<name>/
+├── package.json
+├── tsconfig.json
+├── modern.config.ts      # Dev port, microFrontend: true
+├── plugin.config.ts      # Plugin manifest, slots, routes
+├── tailwind.config.ts
+└── src/
+    ├── global.css
+    ├── App.tsx           # Plugin root
+    ├── plugin.ts         # Entry export
+    ├── types.ts          # TypeScript interfaces
+    ├── schemas.ts        # Zod validation
+    ├── pages/            # Route components
+    ├── components/       # UI components
+    │   └── slots/        # Slot injection components
+    └── hooks/            # Custom hooks
+```
+
+**Plugin Registration Checklist:**
+1. Add to `host/src/modern.runtime.ts` (dev entry URL, prod dynamic import, activeWhen path)
+2. Add to `host/saas.config.ts` (name, enabled: true)
+3. Assign unique dev port (:3001, :3002, :3003, etc.)
+4. Create `plugin.config.ts` with slots for sidebar navigation
+5. Export `pluginConfig` and `App` from `plugin.ts`
+
+### Slot Injection Pattern:
+
+```typescript
+// In plugin.config.ts
+export const pluginConfig: PluginConfig = {
+  manifest: {
+    name: '@lego/plugin-<name>',
+    version: '1.0.0',
+    displayName: '<Display Name>',
+    description: '<Description>',
+  },
+  enabled: true,
+  slots: [
+    {
+      slot: 'sidebar:nav',
+      component: () => import('./components/slots/SidebarWidget').then(m => m.default),
+      order: 100,
+    },
+  ],
+  routes: [
+    {
+      path: '/<route>',
+      component: () => import('./pages/<Plugin>Page').then(m => m.default),
+      protected: true,
+    },
+  ],
+};
+```
+
+---
+
+## 3. Development vs Production Mode
+
+**CRITICAL DISTINCTION:**
+
+| Mode | Plugin Entry | How it Works |
+|------|--------------|--------------|
+| **Development** | `'http://localhost:3001'` | Each plugin runs on separate dev server |
+| **Production** | `() => import('@lego/plugin-dashboard')` | Plugins bundled into host dist |
+
+**Development Workflow:**
+```bash
+# Terminal 1: Host
+cd host && pnpm run dev  # :8080
+
+# Terminal 2: Plugin
+cd packages/plugins/@lego/plugin-dashboard && pnpm run dev  # :3001
+
+# OR use root script:
+pnpm run dev:all
+```
+
+**Production Build:**
+```bash
+pnpm run build  # Single bundle in host/dist/
+```
+
+---
+
+## 4. PocketBase Integration Patterns
+
+### Multi-Tenancy API Rules Pattern:
+
+All plugin collections MUST include:
+```javascript
+{
+  name: '<collection>',
+  fields: [
+    { name: 'organizationId', type: 'relation', required: true },
+    { name: 'ownerId', type: 'relation', required: true },
+    // ... your fields
+  ],
+  // Multi-tenancy isolation
+  listRule: '@request.auth.id != "" && organizationId = @request.auth.membership.organizations',
+  viewRule: '@request.auth.id != "" && organizationId = @request.auth.membership.organizations',
+  createRule: '@request.auth.id != "" && organizationId = @request.auth.membership.organizations',
+  updateRule: '@request.auth.id != "" && organizationId = @request.auth.membership.organizations && ownerId = @request.auth.id',
+  deleteRule: '@request.auth.id != "" && organizationId = @request.auth.membership.organizations && ownerId = @request.auth.id',
+}
+```
+
+### Data Fetching in Plugins:
+
+```typescript
+export function useEntities() {
+  const pb = usePocketBase();
+  const kernelState = window.__LEGO_KERNEL_STATE__;
+  const orgId = kernelState?.useGlobalKernelState.getState().organization?.id;
+
+  return useQuery({
+    queryKey: ['entities', orgId],
+    queryFn: async () => {
+      if (!pb || !orgId) throw new Error('Not initialized');
+
+      const result = await pb.collection('entities').getList(1, 50, {
+        filter: `organizationId = "${orgId}"`,
+        sort: '-created',
+      });
+
+      return result.items;
+    },
+    enabled: !!pb && !!orgId,
+  });
+}
+```
+
+---
+
+## 5. Communication Between Apps
+
+### Bus Events (Garfish Channel):
+
+**Available Event Types:**
+- `auth:login` - User logged in
+- `auth:logout` - User logged out
+- `toast:show` - Show toast notification
+- `theme:change` - Theme changed
+- `navigation:goto` - Navigate to path
+
+**Emit from Plugin:**
+```typescript
+const bus = Garfish.channel;
+bus.emit('toast:show', { message: 'Success!', variant: 'success' });
+```
+
+**Listen in Plugin:**
+```typescript
+useEffect(() => {
+  const handler = (data) => console.log('Auth:', data);
+  Garfish.channel.on('auth:login', handler);
+  return () => Garfish.channel.off('auth:login', handler);
+}, []);
+```
+
+---
+
+## 6. Component and Styling Guidelines
+
+### UI Components:
+- Use Shadcn UI components from `host/src/kernel/components/ui/`
+- Import as `import { Button } from '@/components/ui/button'`
+- For plugins, use `import { Button } from '@lego/kernel/components/ui/button'`
+
+### Styling:
+- Use Tailwind utility classes
+- Use `cn()` helper for conditional classes
+- Follow design tokens in `host/tailwind.config.ts`
+- Dark mode: `dark:` prefix
+
+### Icons:
+- Use `lucide-react` for icons
+- Import: `import { IconName } from 'lucide-react'`
+
+---
+
+## 7. Error Handling and Edge Cases
+
+### Plugin Loading Failures:
+- Show user-friendly error message
+- Log error to console with plugin name
+- Allow plugin to be disabled via config
+
+### Authentication Required:
+- Check `isAuthenticated` from `useGlobalKernelState()`
+- Redirect to `/login` if not authenticated
+- Show loading state while checking auth
+
+### PocketBase Errors:
+- Handle 404 (not found) gracefully
+- Handle 400 (validation) with field-level errors
+- Handle 401/403 (auth/permissions) with redirect
+
+---
+
+## 8. Testing Requirements
+
+When implementing features, include:
+
+**Unit Tests** (`*.test.ts`):
+- Pure functions (utilities, validators)
+- Custom hooks logic
+- Component rendering
+
+**Component Tests** (`*.component.test.tsx`):
+- User interactions
+- Form submissions
+- Navigation
+
+**E2E Tests** (`*.e2e.ts`):
+- Critical user flows
+- Cross-plugin interactions
+- Auth flows
+
+---
+
+## 9. Common Tasks
+
+### Create a New Plugin:
+1. Read `docs/framework/setup/plugin-development.md`
+2. Use existing plugins (Dashboard, Todo) as reference
+3. Follow standard plugin structure
+4. Register with host (`modern.runtime.ts`, `saas.config.ts`)
+5. Assign unique dev port
+6. Create PocketBase collections if needed
+7. Test in both dev and production modes
+
+### Add a New Collection to PocketBase:
+1. Define in `pocketbase/migrations/` following `02-pocketbase-setup.md` pattern
+2. Include `organizationId` and `ownerId` for multi-tenancy
+3. Set API rules for organization isolation
+4. Add index file with seed data if needed
+
+### Add a New Slot Location:
+1. Add enum to `host/src/kernel/plugins/types.ts`
+2. Add `<Slot>` component in layout (`Sidebar.tsx`, `Topbar.tsx`)
+3. Document in plugin development guide
+
+### Debug Plugin Not Loading:
+1. Check plugin dev server is running
+2. Verify `activeWhen` matches route path
+3. Check browser console for errors
+4. Verify `deploy.microFrontend: true` in plugin config
+5. Check `window.__LEGO_KERNEL_STATE__` exists
+
+---
+
+## 2. Learn and adapt when things fail
+
+When you hit an error:
+
+* Read the full error message and stack trace
+* Check the implementation plan document for the section you're working on
+* Verify all prerequisites are complete (each plan document lists them)
+* Fix the code and retest
+* Document what you learned in this workflow (Garfish quirks, PocketBase timing, slot injection gotchas)
+* Example: You get a "module not found" error for a plugin, so you check that the dev server is running on the correct port, verify the entry URL in `modern.runtime.ts`, discover the activeWhen path needs to match exactly, fix it, verify it works, then note this in the workflow
+
+---
+
+## 3. Keep workflows current
+
+Workflows should evolve as you learn. When you find better methods, discover constraints, or encounter recurring issues, update this workflow. That said, don't create or overwrite workflows without asking unless I explicitly tell you to. These are your instructions and need to be preserved and refined, not tossed after one use.
+
+**CRITICAL: Workflow File Synchronization**
+
+This workflow file (`CLAUDE.md`) must stay **perfectly synchronized** with `.cursor/rules/rules.mdc`. When you update this file:
+
+1. **ALWAYS update BOTH files** - `CLAUDE.md` AND `.cursor/rules/rules.mdc`
+2. **Keep them identical** - Both files must contain the exact same content
+3. **If updating CLAUDE.md** - Also update `.cursor/rules/rules.mdc` to match
+4. **If updating rules.mdc** - Also update `CLAUDE.md` to match
+
+This ensures both Cursor AI and Claude AI have the same instructions and improvements are shared across both AI assistants.
+
+---
+
+## The Self-Improvement Loop
+
+Every failure is a chance to make the system stronger:
+
+1. Identify what broke
+2. Fix the bug
+3. Verify the fix works
+4. Update the workflow with the new approach - **MUST update BOTH `CLAUDE.md` AND `.cursor/rules/rules.mdc` to keep them synchronized**
+5. Move on with a more robust system
+
+This loop is how the framework improves over time.
+
+**Remember:** When updating the workflow in step 4, you must update both workflow files to maintain synchronization between Cursor AI and Claude AI.
+
+---
+
+## Bottom Line
+
+You sit between what I want (implementation plans in `docs/framework/plans/`) and what actually gets built (host kernel + plugins). Your job is to:
+
+1. **Read the plan** - Each document in `docs/framework/plans/` contains exact file paths, code, and commands
+2. **Follow the sequence** - Documents are numbered 01-12 for a reason
+3. **Match existing patterns** - Look at Dashboard/Todo plugins for reference
+4. **Use the slot system** - Plugins extend host via slot injection, not direct imports
+5. **Respect dev vs prod** - Dev uses separate servers; prod bundles everything
+6. **Recover from errors** - Fix, verify, document, continue
+
+Stay pragmatic. Stay reliable. Keep learning.
+
+---
+
+## Quick Command Reference
+
+```bash
+# Development
+pnpm run dev:all              # Start host + all plugins
+cd host && pnpm run dev       # Start host only (:8080)
+cd packages/plugins/@lego/plugin-<name> && pnpm run dev  # Start plugin
+
+# Building
+pnpm run build                # Build entire project
+cd host && pnpm run build     # Build host only
+
+# PocketBase
+cd pocketbase && ./pocketbase serve  # Start PocketBase (:8090)
+
+# Testing
+pnpm run test                 # Run all tests
+pnpm run test:e2e             # Run E2E tests
+```
+
+---
+
+## Documentation Reference
+
+| Document | Purpose |
+|----------|---------|
+| `docs/framework/plans/00-index.md` | Implementation overview and order |
+| `docs/framework/research/01-system-blueprint.md` | Architecture overview |
+| `docs/framework/research/04-plugin-architecture.md` | Plugin patterns |
+| `docs/framework/research/05-slot-injection-pattern.md` | Slot injection details |
+| `docs/framework/setup/plugin-development.md` | Plugin creation guide |
+| `docs/framework/setup/api-reference.md` | API documentation |

package/template/Dockerfile

@@ -0,0 +1,67 @@
+# Multi-stage build for Lego-One SaaS Boilerplate
+
+# Stage 1: Build host application
+FROM node:20-alpine AS host-builder
+
+WORKDIR /app
+
+# Install dependencies
+COPY package.json pnpm-lock.yaml ./
+RUN npm install -g pnpm@latest && pnpm install --frozen-lockfile
+
+# Copy host application
+COPY host ./host
+COPY packages ./packages
+
+# Build host
+WORKDIR /app/host
+RUN pnpm build
+
+# Stage 2: Build plugins
+FROM node:20-alpine AS plugin-builder
+
+WORKDIR /app
+
+# Install dependencies
+COPY package.json pnpm-lock.yaml ./
+RUN npm install -g pnpm@latest && pnpm install --frozen-lockfile
+
+# Copy and build plugins
+COPY packages ./packages
+
+# Build dashboard plugin
+WORKDIR /app/packages/plugins/@lego/plugin-dashboard
+RUN pnpm build
+
+# Build todo plugin
+WORKDIR /app/packages/plugins/@lego/plugin-todo
+RUN pnpm build
+
+# Stage 3: Production image with Nginx
+FROM nginx:alpine AS production
+
+# Install PocketBase
+RUN apk add --no-cache curl \
+    && curl -L https://github.com/pocketbase/pocketbase/releases/download/v0.22.0/pocketbase_0.22.0_linux_amd64.zip -o /tmp/pb.zip \
+    && unzip /tmp/pb.zip -d /usr/local/bin/ \
+    && rm /tmp/pb.zip
+
+# Copy built files
+COPY --from=host-builder /app/host/dist /usr/share/nginx/html
+COPY --from=plugin-builder /app/packages/plugins/@lego/plugin-dashboard/dist /usr/share/nginx/html/plugins/dashboard
+COPY --from=plugin-builder /app/packages/plugins/@lego/plugin-todo/dist /usr/share/nginx/html/plugins/todo
+
+# Copy nginx configuration
+COPY nginx.conf /etc/nginx/nginx.conf
+
+# Create PocketBase data directory
+RUN mkdir -p /data/pb
+
+# Expose ports
+EXPOSE 80 8090
+
+# Start script
+COPY docker-entrypoint.sh /
+RUN chmod +x /docker-entrypoint.sh
+
+ENTRYPOINT ["/docker-entrypoint.sh"]