robodev 0.47.3 → 0.49.0

package/templates/povio/ROBODEV.md

@@ -0,0 +1,84 @@
+# Robodev
+
+Use this file for Robodev and SDK facts. Do not web-search the SDK.
+
+## defineApi (copy-paste)
+
+`db`, `email`, `storage`, and `env` are injected. Never `import { db } from "@robodev-ai/sdk"`.
+The SDK is not installed in the runner. Do not `import("@robodev-ai/sdk")`. Do not search `/opt`, `node_modules`, or grok/gemini home for it.
+
+```ts
+import { defineApi, z } from "@robodev-ai/sdk";
+
+export const get = defineApi({
+  response: z.object({ ok: z.literal(true) }),
+  handler: async ({ db, email, storage, env }) => {
+    void db;
+    void email;
+    void storage;
+    void env;
+    return { ok: true as const };
+  },
+});
+```
+
+Method exports: one export per method — `get` / `post` / `put` / `patch` / `delete`. `delete` is a reserved word — write `export const del = ...` or `export { remove as delete }`; both serve DELETE.
+
+`ctx.user.id` is a string like `usr_abc123`, not a UUID. Type user id columns as `text`, never `uuid`.
+
+Throw an Error with an integer `statusCode` (400-599) to answer with that status: `throw Object.assign(new Error("Not found"), { statusCode: 404 })`. Any other throw is a generic 500.
+
+## Hard rules
+
+- Do not run npm, pnpm, or yarn install.
+- Do not start npm run dev, vite, or any local server.
+- Do not run tsc (node_modules is not installed in this runner).
+- Do not port-scan or curl/fetch localhost.
+- Preview is the WebContainer. Live APIs exist only after `robodev-publish be`.
+- Publish backend after a batch of file edits, not after every file.
+- Do not publish the frontend.
+
+## Auth and product data
+
+Persist primary product data with `defineApi` and `robodev-publish be`. Do not use localStorage as the product store unless the user asked for a public, static, or no-account page. Auth is on by default: add login and register and protect routes unless the product is public or unauthenticated. Use `auth: "required"` and `ctx.user.id`. Call reserved `/api/user/auth/*` — do not implement `api/user/**`. Tiny and Shadcn: reuse seed login/register and AuthGuard. Empty and legacy: create login/register with `@robodev-ai/client` tokens. A missing `.rulesync` skill is not a reason to skip APIs. Do not require `robodev-auth set` every run.
+
+## Backend
+
+- Auth: robodev-auth get / set / users / users-delete. Do not invent control-plane HTTP.
+- Secrets: robodev-secret list / set / delete. Use env.NAME in defineApi. List names only.
+- SQL: psql or robodev-sql for DML, SELECT, and seed only. Never print DATABASE_URL. Never run DDL.
+- Publish backend only with robodev-publish be. Do not publish the frontend.
+- Email settings: robodev-email get / set / validate / logs.
+
+## Email templates
+
+Hosted mail is the Email page. Changes apply immediately through these helpers — no Code save or deploy.
+
+- `robodev-email templates list`
+- `robodev-email templates get --slug <slug>`
+- `robodev-email templates set --slug <slug> [--subject] [--html] [--text]`
+
+`set` edits an existing slug. If the slug is missing and is a custom slug (`^[a-z][a-z0-9-]{0,62}$`, not `auth.*`), `set` creates it.
+
+System slugs: `auth.welcome` (`{{email}}`, `{{name}}`), `auth.magic-link` (`{{link}}`, `{{email}}`, `{{name}}`, `{{appUrl}}`), `auth.forgot-password` (`{{link}}`, `{{code}}`, `{{email}}`, `{{name}}`, `{{appUrl}}`). Keep placeholders exact. Do not delete system templates. Do not invent `auth.*` slugs.
+
+Send with `ctx.email.send({ template: "<slug>", to, vars })`.
+
+Do not write `robodev/emails/*.html` or `robodev/emails/*.json` for hosted templates. Those files do not update the live project.
+
+Never write `.env` or secrets. Never write `.robodev`.
+
+## Layout
+
+CLI Tiny-family: `robodev/database.ts` + `robodev/api/**`, Povio UI in `apps/fe`. Keep that layout. This is a blank seed — no sample features.
+
+- Schema: `robodev/database.ts` (`defineDatabase` from `@robodev-ai/sdk`; placeholder `items` table + `media`)
+- HTTP handlers: `robodev/api/**/*.ts` (`GET /api/health` is seeded; shared helpers in `robodev/api/_lib.ts`)
+- Optional jobs / sockets / hooks under `robodev/`
+- Frontend: `apps/fe` (real `@povio/ui` kit, TanStack Router + Query, generated `@/openapi` client). Seeded: login/register (`(guest)`), Home and profile (`(private)`). Reuse the seeded auth — never rebuild token handling.
+- After schema or API changes, update root `openapi.json` and regenerate the client (`cd apps/fe && bun openapi:gen`), then `robodev-publish be`.
+- Add new pages under `apps/fe/src/pages/(private)/` and link them in `AppHeader.tsx` / `MobileNavigation.tsx`.
+- Auth is reserved at `/api/user/*`. Do not add `robodev/api/user/**`.
+- AI rules live in `.rulesync/` — read `.rulesync/rules/project-overview.md` first.
+
+Allowed paths: `robodev/database.ts`, `robodev/api/**/*.ts`, `robodev/jobs/**/*.ts`, `robodev/sockets/**/*.ts`, `robodev/hooks/**/*.ts`, `robodev/package.json`, `apps/fe/**`, `.rulesync/**`, `openapi.json`, `package.json`, `README.md`, `ROBODEV.md`, `.gitignore`.

package/templates/povio/apps/fe/index.html

@@ -0,0 +1,24 @@
+<!doctype html>
+<html lang="en">
+  <head>
+    <meta charset="UTF-8" />
+    <link
+      rel="icon"
+      type="image/svg+xml"
+      href="/favicon.svg"
+    />
+    <meta
+      name="viewport"
+      content="width=device-width, initial-scale=1.0"
+    />
+    <title>Povio UI</title>
+  </head>
+
+  <body class="bg-elevation-fill-default-2 text-text-default-1">
+    <div id="app"></div>
+    <script
+      type="module"
+      src="/src/main.tsx"
+    ></script>
+  </body>
+</html>

package/templates/povio/apps/fe/openapi-codegen.config.ts

@@ -0,0 +1,72 @@
+/* oxlint-disable import/no-nodejs-modules */
+import type { OpenAPICodegenConfig } from "@povio/openapi-codegen-cli";
+import { resolveConfigSync } from "@povio/resolve-config";
+import { readFileSync } from "node:fs";
+import { join, resolve } from "node:path";
+
+const COMPACT_OPENAPI_INPUT = "../../openapi.json";
+const repoRoot = resolve(process.cwd(), "../..");
+
+function readDotEnvKey(root: string, key: string): string | undefined {
+  try {
+    const content = readFileSync(join(root, ".env"), "utf8");
+    const line = content.split(/\r?\n/).find((row) => row.startsWith(`${key}=`));
+    const value = line?.slice(key.length + 1).trim();
+    return value || undefined;
+  } catch {
+    return undefined;
+  }
+}
+
+function loadResolvedSpaEnv(cwd: string): Record<string, string | undefined> {
+  try {
+    const resolved = resolveConfigSync({ cwd, module: "spa", target: "resolved" });
+    if (resolved && typeof resolved === "object") {
+      return resolved as Record<string, string | undefined>;
+    }
+  } catch {
+    // unnamed or missing spa manifest
+  }
+  return {};
+}
+
+const env = loadResolvedSpaEnv(repoRoot);
+
+function fallbackApiUrl(): string {
+  return (
+    env.VITE_PUBLIC_API_URL ||
+    process.env.VITE_PUBLIC_API_URL ||
+    readDotEnvKey(repoRoot, "VITE_PUBLIC_API_URL") ||
+    "http://localhost:4000"
+  );
+}
+
+function resolveLiveOpenApiInput(apiUrl = fallbackApiUrl()) {
+  const usable = apiUrl.trim();
+  if (!usable) return COMPACT_OPENAPI_INPUT;
+  return `${usable.replace(/\/+$/, "")}/openapi.json`;
+}
+
+export function resolveOpenApiInput() {
+  if (process.env.OPENAPI_INPUT) return process.env.OPENAPI_INPUT;
+  if (process.env.OPENAPI_LIVE === "true") return resolveLiveOpenApiInput();
+  return COMPACT_OPENAPI_INPUT;
+}
+
+const config: OpenAPICodegenConfig = {
+  input: resolveOpenApiInput(),
+  output: "src/openapi",
+  tsPath: "@/openapi",
+  restClientImportPath: "@/clients/app-rest-client",
+  clearOutput: true,
+  excludeRedundantZodSchemas: false,
+  checkAcl: false,
+  acl: false,
+  replaceOptionalWithNullish: true,
+  infiniteQueries: true,
+  mutationDefaultOnError: true,
+  modelsInCommon: true,
+  axiosRequestConfig: true,
+};
+
+export default config;

package/templates/povio/apps/fe/package.json

@@ -0,0 +1,71 @@
+{
+  "name": "fe",
+  "version": "0.0.0",
+  "private": true,
+  "description": "Povio UI starter frontend",
+  "type": "module",
+  "scripts": {
+    "dev": "vite --host",
+    "build": "bun run openapi:gen && bunx --bun vite build",
+    "clean": "rimraf dist src/openapi",
+    "lint": "oxlint --type-aware . ../../robodev/api ../../robodev/database.ts --fix",
+    "lint:check": "oxlint --type-aware . ../../robodev/api ../../robodev/database.ts --quiet",
+    "format": "oxfmt -c \"../../oxfmt.config.js\" . ../../robodev/api ../../robodev/database.ts",
+    "format:check": "oxfmt -c \"../../oxfmt.config.js\" --check . ../../robodev/api ../../robodev/database.ts",
+    "ts:check": "tsc -b --noEmit",
+    "test": "vitest run --passWithNoTests",
+    "check": "bun ts:check && bun lint:check && bun format:check",
+    "openapi:gen": "openapi-codegen generate && oxfmt -c \"../../oxfmt.config.js\" ./src/openapi",
+    "openapi:check": "openapi-codegen check"
+  },
+  "dependencies": {
+    "@casl/ability": "^6.8.1",
+    "@casl/react": "^5.0.1",
+    "@fontsource-variable/inter": "^5.2.8",
+    "@hookform/resolvers": "^5.2.2",
+    "@internationalized/date": "^3.11.0",
+    "@povio/openapi-codegen-cli": "3.1.0",
+    "@povio/resolve-config": "1.3.0",
+    "@povio/ui": "3.4.0-rc.12",
+    "@tanstack/react-form": "^1.33.2",
+    "@tanstack/react-query": "^5.90.21",
+    "@tanstack/react-router": "^1.136.8",
+    "@tanstack/react-table": "^8.21.3",
+    "@tanstack/router-plugin": "^1.136.8",
+    "axios": "^1.13.2",
+    "class-variance-authority": "^0.7.1",
+    "clsx": "^2.1.1",
+    "i18next": "^25.7.3",
+    "loglevel": "^1.9.2",
+    "lucide-react": "^1.28.0",
+    "luxon": "^3.7.2",
+    "react": "19.2.4",
+    "react-aria": "^3.46.0",
+    "react-aria-components": "^1.15.1",
+    "react-dom": "19.2.4",
+    "react-hook-form": "^7.65.0",
+    "react-i18next": "^16.5.1",
+    "zod": "^4.4.3"
+  },
+  "devDependencies": {
+    "@tailwindcss/vite": "^4.2.1",
+    "@types/luxon": "^3.7.1",
+    "@types/node": "^24.10.9",
+    "@types/react": "^19.2.7",
+    "@types/react-dom": "^19.2.3",
+    "@typescript/native": "npm:typescript@^7.0.2",
+    "@vitejs/plugin-react": "^5.1.2",
+    "babel-plugin-react-compiler": "1.0.0",
+    "oxfmt": "^0.45.0",
+    "oxlint": "1.60.0",
+    "oxlint-tsgolint": "0.21.0",
+    "react-icons-sprite": "^1.1.1",
+    "rimraf": "^6.1.2",
+    "tailwindcss": "^4.2.4",
+    "tailwindcss-react-aria-components": "^2.1.0",
+    "tsx": "^4.22.1",
+    "typescript": "npm:@typescript/typescript6@^6.0.2",
+    "vite": "^8.0.0",
+    "vitest": "^3.2.4"
+  }
+}

package/templates/povio/apps/fe/public/favicon.svg

@@ -0,0 +1,3 @@
+<svg xmlns="http://www.w3.org/2000/svg" version="1.1" xmlns:xlink="http://www.w3.org/1999/xlink" width="239.36" height="239.36"><svg xmlns="http://www.w3.org/2000/svg" version="1.1" xmlns:xlink="http://www.w3.org/1999/xlink" width="239.36" height="239.36"><svg id="Layer_1" data-name="Layer 1" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" viewBox="0 0 239.36 239.36"><defs><style>.cls-1{fill:#3c60ad;}.cls-2{fill:none;}.cls-3{clip-path:url(#clip-path);}.cls-4{mask:url(#mask);}.cls-5{fill:#fff;}</style><clipPath id="clip-path"><rect class="cls-2" width="239.36" height="239.36"></rect></clipPath><mask id="mask" x="0" y="0" width="239.36" height="239.36" maskUnits="userSpaceOnUse"><g id="mask0_21778_2258" data-name="mask0 21778 2258"><path class="cls-1" d="M0,29.92A29.93,29.93,0,0,1,29.92,0H209.44a29.93,29.93,0,0,1,29.92,29.92V209.44a29.93,29.93,0,0,1-29.92,29.92H29.92A29.93,29.93,0,0,1,0,209.44Z"></path></g></mask></defs><g class="cls-3"><g class="cls-4"><path class="cls-5" d="M0,29.92A29.93,29.93,0,0,1,29.92,0H209.44a29.93,29.93,0,0,1,29.92,29.92V209.44a29.93,29.93,0,0,1-29.92,29.92H29.92A29.93,29.93,0,0,1,0,209.44Z"></path><path d="M119.8,49.55c26.68,0,48.41,22.8,48.5,50.63,0,28.18-21.73,51.06-48.5,51.06A46.64,46.64,0,0,1,83.31,133.4v56.54h-12V100.27C71.29,72.35,93,49.55,119.8,49.55Zm0,12.29c-20.15,0-36.49,17.22-36.49,38.43,0,21.46,16.34,39,36.49,39s36.39-17.5,36.48-39C156.28,79.06,139.94,61.84,119.8,61.84Z"></path></g></g></svg></svg><style>@media (prefers-color-scheme: light) { :root { filter: none; } }
+@media (prefers-color-scheme: dark) { :root { filter: none; } }
+</style></svg>

package/templates/povio/apps/fe/public/site.webmanifest

@@ -0,0 +1,21 @@
+{
+  "name": "Povio",
+  "short_name": "Povio",
+  "icons": [
+    {
+      "src": "/web-app-manifest-192x192.png",
+      "sizes": "192x192",
+      "type": "image/png",
+      "purpose": "maskable"
+    },
+    {
+      "src": "/web-app-manifest-512x512.png",
+      "sizes": "512x512",
+      "type": "image/png",
+      "purpose": "maskable"
+    }
+  ],
+  "theme_color": "#ffffff",
+  "background_color": "#ffffff",
+  "display": "standalone"
+}

package/templates/povio/apps/fe/src/assets/locales/en/translation.json

@@ -0,0 +1,166 @@
+{
+  "appName": "Tiny Template",
+  "appDescription": "A template for building web applications",
+  "shared": {
+    "notFound": {
+      "head": {
+        "title": "Page not found",
+        "description": "The page you are looking for doesn't exist."
+      },
+      "heading": "Page not found",
+      "subheading": "The page you are looking for doesn't exist.",
+      "homeBtn": "Go to home"
+    },
+    "errorFallback": {
+      "heading": "Something went wrong",
+      "subheading": "Error: {{error}}",
+      "retryBtn": "Try again"
+    },
+    "apiErrors": {
+      "requestFailed": "Request failed: {{error}}",
+      "unknown": "An unknown error occurred."
+    },
+    "seedData": {
+      "actionButton": "Reset seed data",
+      "confirmation": {
+        "heading": "Reset seed data?",
+        "description": "This will reset all local data to the initial seed state.",
+        "confirm": "Reset",
+        "cancel": "Cancel"
+      }
+    },
+    "actions": {
+      "back": "Back"
+    }
+  },
+  "auth": {
+    "wrapper": {
+      "title": "Administration portal",
+      "description": "Tiny",
+      "watermark": "© {{year}} Tiny • Developed and maintained by Povio"
+    },
+    "shared": {
+      "errors": {
+        "invalidCredentials": "Invalid email or password.",
+        "userAlreadyExists": "An account with this email already exists.",
+        "identityNotFound": "We could not find this account.",
+        "notConfirmed": "This account has not been confirmed yet."
+      }
+    },
+    "login": {
+      "head": {
+        "title": "Login",
+        "description": "Login to your account"
+      },
+      "form": {
+        "title": "Login",
+        "email": "Email",
+        "emailPlaceholder": "Enter your email",
+        "password": "Password",
+        "passwordPlaceholder": "Enter your password",
+        "submit": "Login",
+        "submitLoading": "Logging in...",
+        "demoLogin": "Login as demo user",
+        "noAccount": "Don't have an account?",
+        "registerLink": "Register",
+        "loginFailed": "Login failed",
+        "resetSeedData": "Reset seed data"
+      },
+      "confirmations": {
+        "resetSeed": {
+          "heading": "Reset seed data?",
+          "description": "This will reset all local data to the initial seed state.",
+          "confirm": "Reset",
+          "cancel": "Cancel"
+        }
+      }
+    },
+    "register": {
+      "head": {
+        "title": "Register",
+        "description": "Create a new account"
+      },
+      "form": {
+        "title": "Register",
+        "description": "Create a new account",
+        "email": "Email",
+        "emailPlaceholder": "Enter your email",
+        "name": "Name",
+        "namePlaceholder": "Enter your name",
+        "password": "Password",
+        "passwordPlaceholder": "Enter your password",
+        "confirmPassword": "Confirm password",
+        "confirmPasswordPlaceholder": "Confirm your password",
+        "confirmPasswordRequired": "Confirm password is required",
+        "passwordsDoNotMatch": "Passwords do not match",
+        "passwordRequirements": "Password must be at least 12 characters long.",
+        "submit": "Register",
+        "registrationFailed": "Registration failed",
+        "hasAccount": "Already have an account?",
+        "loginLink": "Login"
+      }
+    },
+    "setPassword": {
+      "form": {
+        "title": "Set your password",
+        "welcome": "Welcome, {{firstName}} {{lastName}}. Please set your password to complete your account.",
+        "tokenNote": "Enter the invitation token you received by email.",
+        "token": "Invitation token",
+        "tokenPlaceholder": "Enter your invitation token",
+        "tokenChecking": "Checking token...",
+        "tokenError": "{{error}}",
+        "invalidToken": "Invalid or expired token",
+        "email": "Email",
+        "password": "Password",
+        "passwordPlaceholder": "Enter your password",
+        "confirmPassword": "Confirm password",
+        "confirmPasswordPlaceholder": "Confirm your password",
+        "passwordRequirements": "Password must be at least 8 characters long.",
+        "submit": "Set password",
+        "setPasswordFailed": "Setting password failed",
+        "hasPassword": "Already have a password?",
+        "loginLink": "Login"
+      }
+    }
+  },
+  "layout": {
+    "header": {
+      "logo": "Tiny",
+      "openMenu": "Open menu",
+      "closeMenu": "Close menu",
+      "nav": {
+        "home": "Home"
+      },
+      "profile": "Profile",
+      "logout": "Logout"
+    }
+  },
+  "home": {
+    "head": {
+      "title": "Home",
+      "description": "Welcome to the app!"
+    },
+    "title": "Home",
+    "message": "Welcome to the app!"
+  },
+  "profile": {
+    "head": {
+      "title": "Profile",
+      "description": "Your profile"
+    },
+    "form": {
+      "title": "Profile",
+      "description": "Update your profile details",
+      "email": "Email",
+      "emailPlaceholder": "Enter your email",
+      "name": "Name",
+      "namePlaceholder": "Enter your name",
+      "submit": "Save",
+      "submitLoading": "Saving...",
+      "notifications": {
+        "success": "Profile updated",
+        "error": "Failed to update profile"
+      }
+    }
+  }
+}

package/templates/povio/apps/fe/src/clients/app-rest-client.ts

@@ -0,0 +1,15 @@
+import { RestClient } from "@povio/openapi-codegen-cli";
+
+import { AuthorizationHeaderInterceptor } from "@/clients/rest/interceptors/authorization-header.interceptor";
+import { RefreshTokenInterceptor } from "@/clients/rest/interceptors/refresh-token.interceptor";
+import { ResponseInterceptor } from "@/clients/rest/interceptors/response.interceptor";
+import { AppConfig } from "@/config/app.config";
+import { AppErrorHandler } from "@/clients/rest/app-error-handler";
+
+export const AppRestClient = new RestClient({
+  config: {
+    baseURL: AppConfig.api.url,
+  },
+  errorHandler: AppErrorHandler,
+  interceptors: [AuthorizationHeaderInterceptor, RefreshTokenInterceptor, ResponseInterceptor],
+});

package/templates/povio/apps/fe/src/clients/auth-token-store.ts

@@ -0,0 +1,101 @@
+import { ACCESS_TOKEN_KEY, REFRESH_TOKEN_KEY } from "@/config/jwt.config";
+
+type TokenListener = () => void;
+
+const listeners = new Set<TokenListener>();
+let storageListenerCount = 0;
+
+const isBrowser = () => typeof window !== "undefined";
+
+const readToken = (key: string) => {
+  if (!isBrowser()) {
+    return null;
+  }
+
+  try {
+    return window.localStorage.getItem(key);
+  } catch {
+    return null;
+  }
+};
+
+const writeToken = (key: string, token: string | null) => {
+  if (!isBrowser()) {
+    return;
+  }
+
+  try {
+    if (token) {
+      window.localStorage.setItem(key, token);
+    } else {
+      window.localStorage.removeItem(key);
+    }
+  } catch {
+    // Keep in-memory auth subscribers in sync even if storage is unavailable.
+  }
+};
+
+const emitChange = () => {
+  for (const listener of listeners) {
+    listener();
+  }
+};
+
+const onStorageChange = (event: StorageEvent) => {
+  if (event.storageArea !== window.localStorage) {
+    return;
+  }
+
+  if (event.key === ACCESS_TOKEN_KEY || event.key === REFRESH_TOKEN_KEY || event.key === null) {
+    emitChange();
+  }
+};
+
+export const authTokenStore = {
+  getAccessToken: () => readToken(ACCESS_TOKEN_KEY),
+  getRefreshToken: () => readToken(REFRESH_TOKEN_KEY),
+  getServerSnapshot: () => null,
+  subscribe: (listener: TokenListener) => {
+    listeners.add(listener);
+
+    if (isBrowser()) {
+      if (storageListenerCount === 0) {
+        window.addEventListener("storage", onStorageChange);
+      }
+      storageListenerCount += 1;
+    }
+
+    return () => {
+      listeners.delete(listener);
+
+      if (isBrowser()) {
+        storageListenerCount -= 1;
+        if (storageListenerCount === 0) {
+          window.removeEventListener("storage", onStorageChange);
+        }
+      }
+    };
+  },
+  setAccessToken: (token: string | null) => {
+    writeToken(ACCESS_TOKEN_KEY, token);
+    emitChange();
+  },
+  setRefreshToken: (token: string | null) => {
+    writeToken(REFRESH_TOKEN_KEY, token);
+    emitChange();
+  },
+  setTokens: (accessToken: string | null, refreshToken?: string | null) => {
+    writeToken(ACCESS_TOKEN_KEY, accessToken);
+
+    if (refreshToken !== undefined) {
+      writeToken(REFRESH_TOKEN_KEY, refreshToken);
+    }
+
+    emitChange();
+  },
+  clear: () => {
+    writeToken(ACCESS_TOKEN_KEY, null);
+    writeToken(REFRESH_TOKEN_KEY, null);
+    emitChange();
+  },
+};

package/templates/povio/apps/fe/src/clients/rest/app-error-handler.ts

@@ -0,0 +1,31 @@
+import { type ErrorEntry, ErrorHandler } from "@povio/openapi-codegen-cli";
+
+export enum AuthErrorCodes {
+  InvalidCredentials = "invalid-credentials",
+  LocalAuthnIdentityExists = "identity-already-exists",
+  IdentityNotFound = "identity-not-found",
+  NotConfirmed = "identity-not-confirmed",
+}
+
+const authErrors: ErrorEntry<AuthErrorCodes>[] = [
+  {
+    code: AuthErrorCodes.InvalidCredentials,
+    getMessage: (t) => t("auth.shared.errors.invalidCredentials"),
+  },
+  {
+    code: AuthErrorCodes.LocalAuthnIdentityExists,
+    getMessage: (t) => t("auth.shared.errors.userAlreadyExists"),
+  },
+  {
+    code: AuthErrorCodes.IdentityNotFound,
+    getMessage: (t) => t("auth.shared.errors.identityNotFound"),
+  },
+  {
+    code: AuthErrorCodes.NotConfirmed,
+    getMessage: (t) => t("auth.shared.errors.notConfirmed"),
+  },
+];
+
+const entries = [...authErrors];
+
+export const AppErrorHandler = new ErrorHandler({ entries });

package/templates/povio/apps/fe/src/clients/rest/interceptors/authorization-header.interceptor.ts

@@ -0,0 +1,15 @@
+import { RestInterceptor } from "@povio/openapi-codegen-cli";
+
+import { authTokenStore } from "@/clients/auth-token-store";
+
+export const AuthorizationHeaderInterceptor = new RestInterceptor((client) => {
+  return client.interceptors.request.use(async (config) => {
+    const accessToken = authTokenStore.getAccessToken();
+    if (accessToken != null) {
+      // oxlint-disable-next-line no-param-reassign
+      config.headers.Authorization = `Bearer ${accessToken}`;
+    }
+
+    return config;
+  });
+});

package/templates/povio/apps/fe/src/clients/rest/interceptors/refresh-token.interceptor.ts

@@ -0,0 +1,45 @@
+import { RestInterceptor } from "@povio/openapi-codegen-cli";
+
+import { AuthErrorCodes } from "@/clients/rest/app-error-handler";
+import { UserAuthApi } from "@/openapi/userAuth/userAuth.api";
+import { authTokenStore } from "@/clients/auth-token-store";
+
+const REFRESH_PATH = "/api/user/auth/refresh";
+
+export const RefreshTokenInterceptor = new RestInterceptor((client) => {
+  return client.interceptors.response.use(
+    (response) => response,
+    // oxlint-disable-next-line promise/prefer-await-to-callbacks
+    async (error) => {
+      const originalRequest = error.config;
+
+      if (error.response?.data?.code === AuthErrorCodes.InvalidCredentials) {
+        return Promise.reject(error);
+      }
+
+      // The refresh call itself must not trigger another refresh: a 401 from it would otherwise
+      // re-enter this interceptor and loop until the tab is closed.
+      const isRefreshCall = typeof originalRequest?.url === "string" && originalRequest.url.includes(REFRESH_PATH);
+
+      if (error.response?.status === 401 && !originalRequest._retry && !isRefreshCall) {
+        originalRequest._retry = true;
+        const refreshToken = authTokenStore.getRefreshToken();
+        if (!refreshToken) {
+          authTokenStore.clear();
+          return Promise.reject(error);
+        }
+        try {
+          const { accessToken, refreshToken: newRefreshToken } = await UserAuthApi.accessToken({ refreshToken });
+          authTokenStore.setTokens(accessToken, newRefreshToken || null);
+
+          originalRequest.headers.Authorization = `Bearer ${accessToken}`;
+
+          return client(originalRequest);
+        } catch {
+          authTokenStore.clear();
+        }
+      }
+      return Promise.reject(error);
+    },
+  );
+});