@bardioc/create-bardioc-app 0.4.0 → 0.5.2

package/README.md

@@ -22,20 +22,14 @@ You can also run it without a global install:
 npm exec --yes @bardioc/create-bardioc-app my-app -- --port 3005
 ```
 
-Or with pnpm:
-
-```bash
-pnpm dlx @bardioc/create-bardioc-app my-app --port 3005
-```
-
 ## Quick start
 
 ```bash
 create-bardioc-app my-app --port 3005
-cd apps/my-app
-pnpm install
+cd my-app
+npm install
 bardioc login
-pnpm dev
+npm run dev
 ```
 
 ## Generated app
@@ -55,7 +49,7 @@ Every scaffolded app ships a lightweight versioning toolkit:
 
 - **Changesets** (`.changeset/` + `changeset`/`release:*` scripts) for semver-versioning the app
 - **`scripts/stamp-manifest.mjs`** — folds `package.json`'s version into the built `app-manifest.json`
-  so the WebOS app store shows the real release version (wired into `pnpm build` / `pnpm bundle`)
+  so the WebOS app store shows the real release version (wired into `npm run build` / `npm run bundle`)
 - Two Claude skills under `.claude/commands/`: **`/changeset-app`** (bump locally) and
   **`/refresh-bundle`** (rebuild the zip and swap it into a WebOS host checkout)
 
@@ -79,11 +73,11 @@ Generated apps can opt into the same host-backed standalone dev-session flow use
 3. Run `bardioc login` once for that host
 4. Set `VITE_ENABLE_DEV_AUTH=true`
 
-Important: standalone login will not start unless `VITE_ENABLE_DEV_AUTH=true` is present in `.env`. Running `pnpm dev` with only `VITE_APP_NAME` and `VITE_APP_ID` is not enough.
+Important: standalone login will not start unless `VITE_ENABLE_DEV_AUTH=true` is present in `.env`. Running `npm run dev` with only `VITE_APP_NAME` and `VITE_APP_ID` is not enough.
 
-When enabled, running `pnpm dev` outside the host iframe will use your stored CLI login to mint a fresh host dev session before the dev server starts, then route SDK transport calls through the local proxy into the host transport. `DEV_SESSION_KEY` no longer needs to be copied manually. If a request needs a specific scope, pass `scopeId` on that request.
+When enabled, running `npm run dev` outside the host iframe will use your stored CLI login to mint a fresh host dev session before the dev server starts, then route SDK transport calls through the local proxy into the host transport. `DEV_SESSION_KEY` no longer needs to be copied manually. If a request needs a specific scope, pass `scopeId` on that request.
 
-For public testing, run `pnpm dev:live` and use the emitted tunnel URL as the app's live URL in the host App Store configuration.
+For public testing, run `npm run dev:live` and use the emitted tunnel URL as the app's live URL in the host App Store configuration.
 
 ## Options
 

package/bin/create.mjs

@@ -47,7 +47,7 @@ const { name, port, template, withPipeline, withLink } = argsResult;
 const destBase = resolve(process.cwd());
 const templateDir = join(TEMPLATES_DIR, template);
 
-console.log(`\nCreating apps/${name}/ with ${template} template...\n`);
+console.log(`\nCreating ${name}/ with ${template} template...\n`);
 
 const result = scaffoldApp({
   name,
@@ -65,12 +65,8 @@ if (!result.success) {
 }
 
 console.log(`  Done! Next steps:\n`);
-console.log(`    cd apps/${name}`);
-console.log(`    pnpm install`);
-console.log(`    bardioc login`);
-console.log(`    pnpm dev\n`);
+console.log(`    cd ${name}`);
+console.log(`    npm install`);
+console.log(`    npm run dev\n`);
 console.log(`  Open http://localhost:${port} to see your app.`);
-console.log(
-  `  Standalone host-backed auth now refreshes automatically from your CLI login during pnpm dev.`
-);
 console.log(`  Use "pnpm dev:live" for a public tunnel/live URL.\n`);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bardioc/create-bardioc-app",
-  "version": "0.4.0",
+  "version": "0.5.2",
   "description": "Scaffold a Bardioc app with framework templates (vite, react, vue, angular, svelte, solid, preact, nextjs)",
   "license": "MIT",
   "private": false,

package/src/scaffold.js

@@ -338,10 +338,10 @@ export function scaffoldApp({
   withPipeline = false,
   withLink = false,
 }) {
-  const dest = join(destBase, 'apps', name);
+  const dest = join(destBase, name);
 
   if (existsSync(dest)) {
-    return { success: false, error: `directory "apps/${name}" already exists` };
+    return { success: false, error: `directory "${name}" already exists` };
   }
 
   const vars = {

package/templates/_base/.changeset/README.md

@@ -3,15 +3,15 @@
 This app versions itself with [Changesets](https://github.com/changesets/changesets) — the same flow
 as the `@bardioc/*` libraries.
 
-**To cut a release: run the `/changeset-app` skill** (or `pnpm changeset`) — it picks the semver bump
-and applies it locally (`pnpm release:version`), so `package.json`'s `version` always reflects the
+**To cut a release: run the `/changeset-app` skill** (or `npm run changeset`) — it picks the semver bump
+and applies it locally (`npm run release:version`), so `package.json`'s `version` always reflects the
 release. Commit the result with your PR; merging to `dev` runs the publish step in the pipeline.
 
 The skill is named `changeset-app` (not `changeset`) to avoid clashing with the `/changeset` command
 in `bardioc-desktop-frontend` when both repos are open in one workspace. It's app-agnostic — it reads
 the published package name from `package.json` — so the same skill file works in any app repo.
 
-> **This app ships private + unscoped, so publishing is dormant.** `pnpm changeset publish` no-ops on
+> **This app ships private + unscoped, so publishing is dormant.** `npm run changeset publish` no-ops on
 > a private package — versioning works, but nothing is pushed to a registry. To actually publish to
 > Nexus, scope the name (e.g. `@bardioc/<app>`), set `"private": false`, and add a
 > `publishConfig.registry`; then the pipeline's publish step starts shipping the built `dist/`.

package/templates/_base/.claude/commands/changeset-app.md

@@ -8,7 +8,7 @@ argument-hint: "[optional: summary, and/or 'minor'/'major' to override the bump]
 
 This is a **single-package hosted-app repo**: it publishes exactly one package (read its name from
 this repo's `package.json` `name` field). This skill writes the `.changeset/*.md`, picks the **bump**,
-and **applies it** (`pnpm release:version`), so `package.json`'s `version` always reflects the
+and **applies it** (`npm run release:version`), so `package.json`'s `version` always reflects the
 release. The result is committed with your PR; the pipeline only publishes.
 
 > Named `changeset-app` (not `changeset`) on purpose: `bardioc-desktop-frontend` ships its own
@@ -72,7 +72,7 @@ Write `.changeset/<short-kebab-slug>.md` using **this repo's** package name (fro
 Then apply the version bump locally:
 
 ```bash
-pnpm release:version    # = changeset version && pnpm install --lockfile-only
+npm run release:version    # = changeset version && npm install
 ```
 
 This rewrites `package.json`'s `version`, updates `CHANGELOG.md`, syncs the lockfile, and
@@ -89,16 +89,16 @@ manifest note below) — a bump alone does not update the zip.
 
 - **App-store version is auto-stamped — never hand-edit the manifest.** This app stamps its
   `public/app-manifest.json` version from `package.json` at bundle time (via
-  `scripts/stamp-manifest.mjs`, wired into `pnpm bundle`/`pnpm build`), so the WebOS app store reads
+  `scripts/stamp-manifest.mjs`, wired into `npm run bundle`/`npm run build`), so the WebOS app store reads
   that stamped version, and this skill's `package.json` bump is the _only_ edit needed. It reaches
   the store only after a **re-bundle**: run **`/refresh-bundle`** after bumping (before merging) to
   rebuild the zip and swap it into the host's `apps/webos-host/public/_apps/`. The committed
   `app-manifest.json` `version` is just a seed — the stamp overwrites it in the build output, so
   don't sync it by hand.
 - **Bump before merging to `dev`** so the release carries a fresh version. There is **no
-  release gate**: if you forget, `pnpm changeset publish` just no-ops (green, "No unpublished
+  release gate**: if you forget, `npm run changeset publish` just no-ops (green, "No unpublished
   projects") rather than failing — the merge succeeds but publishes nothing until you bump. (While
   the package is private, publish always no-ops regardless.)
 - Bumping locally is why CI needs **no git-write token** — the version is already in the PR;
-  the pipeline only runs `pnpm changeset publish` (which publishes only if the version isn't on
+  the pipeline only runs `npm run changeset publish` (which publishes only if the version isn't on
   Nexus yet and the package is publishable).

package/templates/_base/.claude/commands/refresh-bundle.md

@@ -1,6 +1,6 @@
 ---
 name: refresh-bundle
-description: Rebuild this app's zip and replace the committed copy in the WebOS host's apps/webos-host/public/_apps/. Removes the stale zip first, runs `pnpm bundle`, then copies the fresh zip over.
+description: Rebuild this app's zip and replace the committed copy in the WebOS host's apps/webos-host/public/_apps/. Removes the stale zip first, runs `npm run bundle`, then copies the fresh zip over.
 argument-hint: '[absolute path to the bardioc-desktop-frontend (WebOS host) checkout]'
 ---
 
@@ -12,7 +12,7 @@ Re-bundle **this** standalone hosted app and swap the fresh zip into the WebOS h
 The flow, end to end:
 
 1. **Remove** the stale zip in this app repo (forces a clean rebundle, never copies a stale artifact).
-2. **Bundle** via this repo's `pnpm bundle` script (`<build> && node scripts/stamp-manifest.mjs && zip → <app>.zip`).
+2. **Bundle** via this repo's `npm run bundle` script (`<build> && node scripts/stamp-manifest.mjs && zip → <app>.zip`).
 3. **Replace** `<host>/apps/webos-host/public/_apps/<app>.zip` with the freshly built one.
 
 ## Arguments
@@ -60,7 +60,7 @@ rm -f "$REPO/$ZIP"
 ## Step 3 — Bundle in this repo
 
 ```bash
-cd "$REPO" && pnpm bundle
+cd "$REPO" && npm run bundle
 ```
 
 Then verify the artifact was actually produced:
@@ -69,7 +69,7 @@ Then verify the artifact was actually produced:
 test -f "$REPO/$ZIP" && ls -l "$REPO/$ZIP" || { echo "Bundle did not produce $ZIP"; exit 1; }
 ```
 
-If `pnpm bundle` fails (build errors), **stop and report the real failure** — do not copy anything.
+If `npm run bundle` fails (build errors), **stop and report the real failure** — do not copy anything.
 You may fix an obvious issue and retry once; on a second failure, report it truthfully and ask the
 user how to proceed.
 
@@ -94,7 +94,7 @@ Do **not** commit unless the user asks.
 ## Notes
 
 - This app is decoupled from the host's workspace (its own `pnpm-lock.yaml`). Always run
-  `pnpm bundle` from inside `REPO`, never from the host root.
+  `npm run bundle` from inside `REPO`, never from the host root.
 - Removing the repo zip first (Step 2) is deliberate: it guarantees the copy in Step 4 is a
   brand-new build, never a leftover artifact.
 - The `public/_apps/<app>.zip` is git-tracked in the host repo, so the previous bundle is always

package/templates/_base/README.md

@@ -7,18 +7,18 @@ app.
 ## Install
 
 ```bash
-pnpm install
+npm install
 ```
 
 ## Develop
 
 ```bash
-pnpm dev              # http://localhost:{{PORT}}
-pnpm dev:live         # public tunnel (BARDIOC_TUNNEL=1)
+npm run dev              # http://localhost:{{PORT}}
+npm run dev:live         # public tunnel (BARDIOC_TUNNEL=1)
 ```
 
-Run `bardioc login` once; `pnpm dev` then mints and refreshes the standalone dev session
-automatically. See `.env.example` for the required variables.
+`npm run dev` runs plain Vite as a local preview shell — live SDK data comes only when the app is
+opened inside the host. See `.env.example` for the required variables.
 
 ## Develop against `@bardioc/*` source (optional)
 
@@ -54,8 +54,8 @@ resolves from Nexus. No overlay or CI-only workspace file needed.
 ## Build & Bundle
 
 ```bash
-pnpm build            # type-check + build (+ stamp the manifest version) → output dir
-pnpm bundle           # build + zip → {{APP_NAME}}.zip
+npm run build            # type-check + build (+ stamp the manifest version) → output dir
+npm run bundle           # build + zip → {{APP_NAME}}.zip
 ```
 
 `scripts/stamp-manifest.mjs` folds `package.json`'s `version` into the built `app-manifest.json` so
@@ -74,14 +74,14 @@ forgotten bump just publishes nothing rather than failing the deploy.
 
 **To cut a release:**
 
-1. On your feature branch, run the **`/changeset-app`** skill (or `pnpm changeset`) — it picks the
-   semver bump, writes `.changeset/*.md`, and applies it locally (`pnpm release:version`). Commit the
+1. On your feature branch, run the **`/changeset-app`** skill (or `npm run changeset`) — it picks the
+   semver bump, writes `.changeset/*.md`, and applies it locally (`npm run release:version`). Commit the
    result with your PR. Then run **`/refresh-bundle`** so the new version reaches the shipped zip.
 2. Open a PR. The PR pipeline runs `check-types`, `build`, and `audit` in parallel. No publish.
 3. Merge to `dev`. CI runs again, then the publish step runs.
 
 > **Publishing is dormant by default.** This app ships `"private": true` with an unscoped name, so
-> `pnpm changeset publish` cleanly no-ops. To publish to Nexus, scope the package name
+> `npm run changeset publish` cleanly no-ops. To publish to Nexus, scope the package name
 > (e.g. `@bardioc/{{APP_NAME}}`), set `"private": false`, and add a `publishConfig.registry` — then
 > the pipeline's publish step ships the built output (set `"files": ["<output-dir>"]` accordingly).
 >

package/templates/angular/package.json

@@ -5,20 +5,20 @@
   "scripts": {
     "sync:runtime-env": "node ./scripts/sync-runtime-env.mjs",
     "ng": "ng",
-    "predev": "pnpm sync:runtime-env",
+    "predev": "npm run sync:runtime-env",
     "dev": "node ./scripts/dev-auth-proxy.mjs --app-port {{PORT}} & PROXY_PID=$!; ng serve --port {{PORT}}; EXIT_CODE=$?; kill $PROXY_PID; exit $EXIT_CODE",
-    "predev:live": "pnpm sync:runtime-env",
+    "predev:live": "npm run sync:runtime-env",
     "dev:live": "node ./scripts/dev-auth-proxy.mjs --app-port {{PORT}} & PROXY_PID=$!; BARDIOC_TUNNEL=1 ng serve --port {{PORT}}; EXIT_CODE=$?; kill $PROXY_PID; exit $EXIT_CODE",
-    "prebuild": "pnpm sync:runtime-env",
+    "prebuild": "npm run sync:runtime-env",
     "build": "ng build && node scripts/stamp-manifest.mjs dist/{{APP_NAME}}/browser",
     "bundle": "ng build && node scripts/stamp-manifest.mjs dist/{{APP_NAME}}/browser && cd dist/{{APP_NAME}}/browser && zip -r ../../../{{APP_NAME}}.zip .",
-    "prewatch": "pnpm sync:runtime-env",
+    "prewatch": "npm run sync:runtime-env",
     "watch": "ng build --watch --configuration development",
-    "precheck-types": "pnpm sync:runtime-env",
+    "precheck-types": "npm run sync:runtime-env",
     "check-types": "ng build --configuration development",
     "changeset": "changeset",
     "release:status": "changeset status --verbose",
-    "release:version": "changeset version && pnpm install --lockfile-only",
+    "release:version": "changeset version && npm install",
     "release:publish": "changeset publish"
   },
   "dependencies": {

package/templates/nextjs/.env.example

@@ -3,6 +3,6 @@ NEXT_PUBLIC_APP_ID=your-app-client-id-here
 NEXT_PUBLIC_ENABLE_DEV_AUTH=false
 
 # Required host URL for standalone dev auth. Run `bardioc login` once, then
-# `pnpm dev` will refresh DEV_SESSION_KEY automatically before Next starts.
+# `npm run dev` will refresh DEV_SESSION_KEY automatically before Next starts.
 DEV_AUTH_HOST_URL=
 DEV_SESSION_KEY=

package/templates/nextjs/package.json

@@ -11,7 +11,7 @@
     "check-types": "tsc --noEmit",
     "changeset": "changeset",
     "release:status": "changeset status --verbose",
-    "release:version": "changeset version && pnpm install --lockfile-only",
+    "release:version": "changeset version && npm install",
     "release:publish": "changeset publish"
   },
   "dependencies": {

package/templates/preact/package.json

@@ -12,7 +12,7 @@
     "check-types": "tsc --noEmit",
     "changeset": "changeset",
     "release:status": "changeset status --verbose",
-    "release:version": "changeset version && pnpm install --lockfile-only",
+    "release:version": "changeset version && npm install",
     "release:publish": "changeset publish"
   },
   "dependencies": {

package/templates/solid/package.json

@@ -12,7 +12,7 @@
     "check-types": "tsc --noEmit",
     "changeset": "changeset",
     "release:status": "changeset status --verbose",
-    "release:version": "changeset version && pnpm install --lockfile-only",
+    "release:version": "changeset version && npm install",
     "release:publish": "changeset publish"
   },
   "dependencies": {

package/templates/svelte/package.json

@@ -12,7 +12,7 @@
     "check-types": "svelte-check",
     "changeset": "changeset",
     "release:status": "changeset status --verbose",
-    "release:version": "changeset version && pnpm install --lockfile-only",
+    "release:version": "changeset version && npm install",
     "release:publish": "changeset publish"
   },
   "dependencies": {

package/templates/vite/.env.example

@@ -9,6 +9,6 @@ VITE_APP_ID=your-app-client-id-here
 VITE_ENABLE_DEV_AUTH=false
 
 # Required host URL for standalone dev auth. Run `bardioc login` once, then
-# `pnpm dev` will refresh DEV_SESSION_KEY automatically before Vite starts.
+# `npm run dev` will refresh DEV_SESSION_KEY automatically before Vite starts.
 DEV_AUTH_HOST_URL=
 DEV_SESSION_KEY=