@bardioc/create-bardioc-app 0.4.0

package/templates/_base/.claude/commands/changeset-app.md

@@ -0,0 +1,104 @@
+---
+name: changeset-app
+description: Write a changeset for this app repo's single published package, pick the semver bump (default patch, major on breaking change), and apply the bump locally — keeping package.json's version in step with the release.
+argument-hint: "[optional: summary, and/or 'minor'/'major' to override the bump]"
+---
+
+# /changeset-app — Author + bump locally
+
+This is a **single-package hosted-app repo**: it publishes exactly one package (read its name from
+this repo's `package.json` `name` field). This skill writes the `.changeset/*.md`, picks the **bump**,
+and **applies it** (`pnpm release:version`), so `package.json`'s `version` always reflects the
+release. The result is committed with your PR; the pipeline only publishes.
+
+> Named `changeset-app` (not `changeset`) on purpose: `bardioc-desktop-frontend` ships its own
+> `/changeset`, and project commands don't namespace across repos — a shared name would collide
+> when an app repo and the frontend are open in one workspace. Caveat: if you open **two app
+> repos** at once they both expose `changeset-app`; in practice you work on one app at a time
+> alongside the frontend, so this is fine.
+
+## Step 0 — Identify the package
+
+Read the published package name from this repo's `package.json` `name` field. This is the **only**
+app-specific value — use it verbatim in the changeset frontmatter (Step 2). Everything else below is
+identical across app repos.
+
+## Arguments
+
+The user invoked this with: `$ARGUMENTS`
+
+- If it contains `major` / `minor` / `patch` → use that as the **bump override**.
+- Otherwise treat it as the **one-line summary**. If empty, draft the summary from the diff.
+
+## Step 1 — Decide the bump
+
+**Default: `patch`.** Then escalate based on what changed:
+
+- **`major`** — a **breaking** change for consumers / the host integration. Signals:
+  - a public export, prop, type, or `bridge.*` contract that **existed is removed or renamed**,
+  - behavior changed in a way that breaks an embedding host or a saved session,
+  - a required new input where there wasn't one.
+- **`minor`** — a notable backward-compatible **addition** (new feature/export). Optional;
+  purely additive props may stay `patch`.
+- **`patch`** — fixes, internal refactors, additive optional props. **This is the default.**
+
+`$ARGUMENTS` override wins. When genuinely unsure between patch and major, **choose major**
+(under-bumping silently breaks consumers) and say why in one line.
+
+> 0.x caret trap: on `^0.x.y`, a **minor** bump (`0.2→0.3`) breaks a consumer's `^` range and
+> forces a manual cross-repo update, while a **patch** (`0.0.3→0.0.4`) is picked up
+> automatically. Prefer `patch` for backward-compatible changes while pre-1.0.
+
+### Bumped a `@bardioc/*` dependency that the app needs? Bump the app too.
+
+If this change raises a `@bardioc/*` dependency in `package.json` (e.g. `@bardioc/ui` ↑ because
+the app now uses a new component/prop/type from it), that is a **release-relevant change**:
+write a changeset so the app's **own** version bumps as well. The published app version must
+move whenever its required dependency set moves — otherwise the package.json version no longer
+identifies a distinct release.
+
+## Step 2 — Write the changeset, then apply the bump
+
+Write `.changeset/<short-kebab-slug>.md` using **this repo's** package name (from Step 0):
+
+```markdown
+---
+'<package-name-from-package.json>': patch
+---
+
+<one-line consumer-facing summary>
+```
+
+Then apply the version bump locally:
+
+```bash
+pnpm release:version    # = changeset version && pnpm install --lockfile-only
+```
+
+This rewrites `package.json`'s `version`, updates `CHANGELOG.md`, syncs the lockfile, and
+consumes the changeset file.
+
+## Step 3 — Report
+
+Tell the user: from → to version, the bump level + one-line reasoning. Leave the changes
+**uncommitted** — they ride along with the PR commit (don't commit unless asked). Then remind
+them to run **`/refresh-bundle`** so the new version reaches the shipped artifact (see the
+manifest note below) — a bump alone does not update the zip.
+
+## Notes
+
+- **App-store version is auto-stamped — never hand-edit the manifest.** This app stamps its
+  `public/app-manifest.json` version from `package.json` at bundle time (via
+  `scripts/stamp-manifest.mjs`, wired into `pnpm bundle`/`pnpm build`), so the WebOS app store reads
+  that stamped version, and this skill's `package.json` bump is the _only_ edit needed. It reaches
+  the store only after a **re-bundle**: run **`/refresh-bundle`** after bumping (before merging) to
+  rebuild the zip and swap it into the host's `apps/webos-host/public/_apps/`. The committed
+  `app-manifest.json` `version` is just a seed — the stamp overwrites it in the build output, so
+  don't sync it by hand.
+- **Bump before merging to `dev`** so the release carries a fresh version. There is **no
+  release gate**: if you forget, `pnpm changeset publish` just no-ops (green, "No unpublished
+  projects") rather than failing — the merge succeeds but publishes nothing until you bump. (While
+  the package is private, publish always no-ops regardless.)
+- Bumping locally is why CI needs **no git-write token** — the version is already in the PR;
+  the pipeline only runs `pnpm changeset publish` (which publishes only if the version isn't on
+  Nexus yet and the package is publishable).

package/templates/_base/.claude/commands/refresh-bundle.md

@@ -0,0 +1,101 @@
+---
+name: refresh-bundle
+description: Rebuild this app's zip and replace the committed copy in the WebOS host's apps/webos-host/public/_apps/. Removes the stale zip first, runs `pnpm bundle`, then copies the fresh zip over.
+argument-hint: '[absolute path to the bardioc-desktop-frontend (WebOS host) checkout]'
+---
+
+# /refresh-bundle — Rebuild & Replace this Hosted App Bundle
+
+Re-bundle **this** standalone hosted app and swap the fresh zip into the WebOS host's
+`public/_apps/` so the running shell serves the latest build.
+
+The flow, end to end:
+
+1. **Remove** the stale zip in this app repo (forces a clean rebundle, never copies a stale artifact).
+2. **Bundle** via this repo's `pnpm bundle` script (`<build> && node scripts/stamp-manifest.mjs && zip → <app>.zip`).
+3. **Replace** `<host>/apps/webos-host/public/_apps/<app>.zip` with the freshly built one.
+
+## Arguments
+
+The user invoked this command with: `$ARGUMENTS`
+
+`REPO` below = **this** app repo (the directory this skill runs in — use `pwd`).
+`HOST` = the WebOS host checkout (`bardioc-desktop-frontend`), resolved from `$ARGUMENTS`:
+
+- **An absolute path** that exists → use it as `HOST`.
+- **Empty** → **ask the user for the host repo path.** Do not guess — the app does not know where
+  the host is checked out.
+
+## Step 1 — Resolve the zip filename
+
+The zip name is **not** hardcoded — derive it from this repo so the skill works for any app:
+
+```bash
+test -f "$REPO/package.json" || { echo "No package.json at $REPO"; exit 1; }
+grep -E '"bundle"' "$REPO/package.json"
+```
+
+Parse the `*.zip` filename out of the `bundle` script and take its **basename** — strip any leading
+directory / `../` segments so you get the bare `<slug>.zip` the bundle writes to the repo root.
+(Most templates zip from `dist/` via `zip -r ../<slug>.zip`, but Angular zips from
+`dist/<slug>/browser/` via `zip -r ../../../<slug>.zip` — the basename is `<slug>.zip` in every
+case.) Call it `ZIP`.
+
+Sanity-check the target exists so we know we're replacing, not silently adding:
+
+```bash
+ls -l "$HOST/apps/webos-host/public/_apps/$ZIP"
+```
+
+- If it **exists** → this is a replace (the normal case). Note its current byte size.
+- If it **does NOT exist** → this would be an _add_, not a replace. Stop and confirm with the user
+  that adding a new entry to the host is intended before continuing.
+
+## Step 2 — Remove the stale zip in this repo
+
+```bash
+rm -f "$REPO/$ZIP"
+```
+
+## Step 3 — Bundle in this repo
+
+```bash
+cd "$REPO" && pnpm bundle
+```
+
+Then verify the artifact was actually produced:
+
+```bash
+test -f "$REPO/$ZIP" && ls -l "$REPO/$ZIP" || { echo "Bundle did not produce $ZIP"; exit 1; }
+```
+
+If `pnpm bundle` fails (build errors), **stop and report the real failure** — do not copy anything.
+You may fix an obvious issue and retry once; on a second failure, report it truthfully and ask the
+user how to proceed.
+
+## Step 4 — Replace the bundle in the host's public/\_apps
+
+```bash
+cp -f "$REPO/$ZIP" "$HOST/apps/webos-host/public/_apps/$ZIP"
+ls -l "$HOST/apps/webos-host/public/_apps/$ZIP"
+```
+
+## Step 5 — Wrap up
+
+Report in one block:
+
+- App + the resolved `ZIP` filename, and the `HOST` path used.
+- Old vs new byte size of `public/_apps/$ZIP` (so the user sees the swap actually happened).
+- `git -C "$HOST" status --short apps/webos-host/public/_apps/` to confirm the tracked zip is now
+  modified, ready to commit **in the host repo**.
+
+Do **not** commit unless the user asks.
+
+## Notes
+
+- This app is decoupled from the host's workspace (its own `pnpm-lock.yaml`). Always run
+  `pnpm bundle` from inside `REPO`, never from the host root.
+- Removing the repo zip first (Step 2) is deliberate: it guarantees the copy in Step 4 is a
+  brand-new build, never a leftover artifact.
+- The `public/_apps/<app>.zip` is git-tracked in the host repo, so the previous bundle is always
+  recoverable via git if a refresh goes wrong.

package/templates/_base/README.md

@@ -0,0 +1,89 @@
+# {{DISPLAY_NAME}}
+
+A Bardioc hosted app, scaffolded with `@bardioc/create-bardioc-app`. Runs standalone (not as a
+workspace member of `bardioc-desktop-frontend`) so it can be bundled and shipped as a hosted Bardioc
+app.
+
+## Install
+
+```bash
+pnpm install
+```
+
+## Develop
+
+```bash
+pnpm dev              # http://localhost:{{PORT}}
+pnpm dev:live         # public tunnel (BARDIOC_TUNNEL=1)
+```
+
+Run `bardioc login` once; `pnpm dev` then mints and refreshes the standalone dev session
+automatically. See `.env.example` for the required variables.
+
+## Develop against `@bardioc/*` source (optional)
+
+> Available only if you scaffolded with `--with-link` (adds `scripts/link-source.mjs`,
+> `pnpm-workspace.yaml`, and `.npmrc`). Otherwise this section does not apply — every `@bardioc/*`
+> dep resolves from Nexus.
+
+By default, every `@bardioc/*` dependency comes from Nexus. To develop against a local source
+checkout instead — for example, to edit `@bardioc/ui` and see HMR in this app — symlink the source
+repo into `.linked/`:
+
+```bash
+pnpm link:source <path-to-source-repo>     # e.g. ../bardioc-desktop-frontend
+pnpm install
+```
+
+The link name is derived from the path's basename, so this creates
+`.linked/<name> → <path>` (`.linked/` is gitignored). `pnpm-workspace.yaml`'s `./.linked/*/packages/*`
+glob picks it up; the dev server serves the linked source and HMR fires on edits. If the linked
+source uses pnpm catalogs, `link:source` copies its `catalog:` / `catalogs:` blocks into a managed
+block at the bottom of `pnpm-workspace.yaml` (don't hand-edit it — re-run `link:source` to refresh).
+
+```bash
+pnpm link:source ../frontend-experiment --as bardioc-desktop-frontend   # custom name
+pnpm unlink:source <name>                                               # remove a link
+```
+
+### CI / Docker
+
+No `.linked/` directory exists, so the workspace glob matches nothing and `@bardioc/*` always
+resolves from Nexus. No overlay or CI-only workspace file needed.
+
+## Build & Bundle
+
+```bash
+pnpm build            # type-check + build (+ stamp the manifest version) → output dir
+pnpm bundle           # build + zip → {{APP_NAME}}.zip
+```
+
+`scripts/stamp-manifest.mjs` folds `package.json`'s `version` into the built `app-manifest.json` so
+the WebOS app store shows the real release version. `{{APP_NAME}}.zip` is the deliverable uploaded
+to the Bardioc host as a hosted app. To swap a fresh build into a local WebOS host checkout, run the
+**`/refresh-bundle`** skill.
+
+## Release & Publishing
+
+This app is versioned with [Changesets](https://github.com/changesets/changesets). **The version
+bump is done locally** (so CI needs no git-write token), and there is **no release gate** — a
+forgotten bump just publishes nothing rather than failing the deploy.
+
+> The CI pipeline below (PR checks + the publish step) is present only if you scaffolded with
+> `--with-pipeline`. Without it, version locally with the steps below and bundle/ship by hand.
+
+**To cut a release:**
+
+1. On your feature branch, run the **`/changeset-app`** skill (or `pnpm changeset`) — it picks the
+   semver bump, writes `.changeset/*.md`, and applies it locally (`pnpm release:version`). Commit the
+   result with your PR. Then run **`/refresh-bundle`** so the new version reaches the shipped zip.
+2. Open a PR. The PR pipeline runs `check-types`, `build`, and `audit` in parallel. No publish.
+3. Merge to `dev`. CI runs again, then the publish step runs.
+
+> **Publishing is dormant by default.** This app ships `"private": true` with an unscoped name, so
+> `pnpm changeset publish` cleanly no-ops. To publish to Nexus, scope the package name
+> (e.g. `@bardioc/{{APP_NAME}}`), set `"private": false`, and add a `publishConfig.registry` — then
+> the pipeline's publish step ships the built output (set `"files": ["<output-dir>"]` accordingly).
+>
+> **CI prerequisite** (set as a Bitbucket repo/workspace variable, not in the repo):
+> `NEXUS_REPO_USER` / `NEXUS_REPO_PASS` — an account with `npm-releases` deploy rights.

package/templates/_base/public/app-manifest.json

@@ -0,0 +1,10 @@
+{
+  "manifestVersion": 2,
+  "id": "{{APP_NAME}}",
+  "name": "{{DISPLAY_NAME}}",
+  "description": "{{DISPLAY_NAME}} — a Bardioc hosted app",
+  "version": "0.0.1",
+  "entry": "index.html",
+  "icon": "icon.svg",
+  "permissions": ["notify", "transport"]
+}

package/templates/_base/scripts/stamp-manifest.mjs

@@ -0,0 +1,17 @@
+// Folds package.json's version into the built app-manifest.json so the WebOS app store (name +
+// description only) shows the release version. Output dir comes from argv (defaults to dist). Idempotent.
+import { readFileSync, writeFileSync } from 'node:fs';
+
+const root = new URL('..', import.meta.url);
+const outDir = process.argv[2] ?? 'dist';
+const { version } = JSON.parse(readFileSync(new URL('package.json', root), 'utf8'));
+
+const url = new URL(`${outDir}/app-manifest.json`, root);
+const manifest = JSON.parse(readFileSync(url, 'utf8'));
+const base = (manifest.description ?? '').replace(/\s*\(v[^)]*\)\s*$/, '').trim();
+
+manifest.version = version;
+manifest.description = base ? `${base} (v${version})` : `v${version}`;
+
+writeFileSync(url, `${JSON.stringify(manifest, null, 2)}\n`);
+console.log(`[stamp-manifest] ${version} → ${outDir}/app-manifest.json`);

package/templates/_opt-link/_npmrc

@@ -0,0 +1,2 @@
+link-workspace-packages=true
+prefer-workspace-packages=true

package/templates/_opt-link/pnpm-workspace.yaml

@@ -0,0 +1,3 @@
+packages:
+  - '.'
+  - './.linked/*/packages/*'

package/templates/_opt-link/scripts/link-source.mjs

@@ -0,0 +1,188 @@
+#!/usr/bin/env node
+// Symlinks a local @bardioc/* source checkout into .linked/ and syncs its pnpm catalogs into
+// pnpm-workspace.yaml. Without a link the workspace glob matches nothing and deps resolve from Nexus.
+//   node link-source.mjs <path> [--as <name>]   link (name defaults to basename)
+//   node link-source.mjs --remove <name>        remove a link
+
+import {
+  existsSync,
+  lstatSync,
+  mkdirSync,
+  readdirSync,
+  readFileSync,
+  rmSync,
+  symlinkSync,
+  writeFileSync,
+} from 'node:fs';
+import { basename, resolve } from 'node:path';
+
+const LINK_DIR = '.linked';
+const WORKSPACE_FILE = 'pnpm-workspace.yaml';
+const MARKER_BEGIN = '# BEGIN linked-catalogs (managed by link:source — do not edit)';
+const MARKER_END = '# END linked-catalogs';
+
+const argv = process.argv.slice(2);
+
+if (argv[0] === '--remove') {
+  const name = argv[1];
+  if (!name) fail('Usage: pnpm unlink:source <name>');
+  const link = `${LINK_DIR}/${name}`;
+  if (!exists(link)) fail(`No link at ${link}`);
+  rmSync(link);
+  console.log(`✓ unlinked ${name}`);
+  syncCatalogs();
+  process.exit(0);
+}
+
+let target = null;
+let customName = null;
+for (let i = 0; i < argv.length; i++) {
+  if (argv[i] === '--as') customName = argv[++i];
+  else if (!argv[i].startsWith('--')) target = argv[i];
+}
+
+if (!target) fail('Usage: pnpm link:source <path-to-source-repo> [--as <name>]');
+
+const abs = resolve(target);
+if (!existsSync(`${abs}/packages`)) fail(`No packages/ at ${abs} — wrong path?`);
+
+const name = customName ?? basename(abs);
+if (!name) fail('Could not derive name from path — pass --as <name>');
+
+mkdirSync(LINK_DIR, { recursive: true });
+const link = `${LINK_DIR}/${name}`;
+if (exists(link)) rmSync(link);
+symlinkSync(abs, link, 'junction');
+console.log(`✓ linked ${name} → ${abs}`);
+
+syncCatalogs();
+
+console.log('Next: pnpm install');
+
+// ── helpers ──────────────────────────────────────────────────────────
+
+function exists(path) {
+  try {
+    lstatSync(path);
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+function fail(msg) {
+  console.error(msg);
+  process.exit(1);
+}
+
+function syncCatalogs() {
+  if (!existsSync(WORKSPACE_FILE)) return;
+  const sources = collectCatalogSources();
+  assertSingleSource(sources);
+  const marker = buildMarkerBlock(sources);
+  rewriteWorkspaceMarker(marker, sources);
+}
+
+function collectCatalogSources() {
+  if (!existsSync(LINK_DIR)) return [];
+  const sources = [];
+  for (const linkName of readdirSync(LINK_DIR).sort()) {
+    const linkedFile = `${LINK_DIR}/${linkName}/${WORKSPACE_FILE}`;
+    if (!existsSync(linkedFile)) continue;
+    const extracted = extractCatalogs(readFileSync(linkedFile, 'utf-8'));
+    if (extracted) sources.push({ name: linkName, content: extracted });
+  }
+  return sources;
+}
+
+function assertSingleSource(sources) {
+  if (sources.length > 1) {
+    const names = sources.map(s => s.name).join(', ');
+    fail(
+      `Multiple linked sources define catalogs (${names}). ` +
+        `pnpm requires a single catalog block — merge manually or unlink all but one.`
+    );
+  }
+}
+
+function buildMarkerBlock(sources) {
+  if (sources.length !== 1) return '';
+  const { name: sourceName, content } = sources[0];
+  return `${MARKER_BEGIN}\n# from .linked/${sourceName}\n${content}\n${MARKER_END}\n`;
+}
+
+function rewriteWorkspaceMarker(marker, sources) {
+  let workspace = readFileSync(WORKSPACE_FILE, 'utf-8');
+  const beginIdx = workspace.indexOf(MARKER_BEGIN);
+  const endIdx = workspace.indexOf(MARKER_END);
+  const hasExistingBlock = beginIdx >= 0 && endIdx > beginIdx;
+
+  if (hasExistingBlock) {
+    workspace = replaceMarkerBlock(workspace, beginIdx, endIdx, marker);
+  } else if (marker) {
+    workspace = workspace.replace(/\n*$/, '\n\n') + marker;
+  } else {
+    return;
+  }
+
+  writeFileSync(WORKSPACE_FILE, workspace);
+  logSyncOutcome(sources);
+}
+
+function replaceMarkerBlock(workspace, beginIdx, endIdx, marker) {
+  const before = workspace.slice(0, beginIdx).replace(/\n+$/, '\n');
+  const afterStart = endIdx + MARKER_END.length;
+  const afterRaw = workspace.slice(afterStart).replace(/^\n+/, '');
+  const after = afterRaw ? '\n' + afterRaw : '';
+  if (marker) return `${before}\n${marker}${after}`;
+  return `${before}${after}`;
+}
+
+function logSyncOutcome(sources) {
+  if (sources.length === 1) {
+    console.log(`✓ synced catalogs from .linked/${sources[0].name} into ${WORKSPACE_FILE}`);
+  } else {
+    console.log(`✓ removed managed catalogs block from ${WORKSPACE_FILE}`);
+  }
+}
+
+// Extracts top-level `catalog:` and `catalogs:` blocks from a pnpm-workspace.yaml.
+// Line-based, no YAML parser. Assumes block headers start at column 0 and
+// content is indented (spaces or tabs).
+export function extractCatalogs(yamlContent) {
+  const lines = yamlContent.split('\n');
+  const out = [];
+  let i = 0;
+  while (i < lines.length) {
+    if (!/^(catalog|catalogs):\s*$/.test(lines[i])) {
+      i++;
+      continue;
+    }
+    const start = i;
+    i = consumeIndentedLines(lines, i + 1);
+    out.push(lines.slice(start, trimTrailingBlanks(lines, start, i)).join('\n'));
+  }
+  return out.length > 0 ? stripComments(out.join('\n\n')) : null;
+}
+
+function stripComments(yaml) {
+  return yaml
+    .split('\n')
+    .filter(line => !/^\s*#/.test(line))
+    .join('\n')
+    .replace(/\n{3,}/g, '\n\n');
+}
+
+function consumeIndentedLines(lines, from) {
+  let i = from;
+  while (i < lines.length && (lines[i] === '' || /^[ \t]/.test(lines[i]))) {
+    i++;
+  }
+  return i;
+}
+
+function trimTrailingBlanks(lines, start, end) {
+  let trimmed = end;
+  while (trimmed > start && lines[trimmed - 1] === '') trimmed--;
+  return trimmed;
+}

package/templates/_opt-pipeline/bitbucket-pipelines.yml

@@ -0,0 +1,100 @@
+image: node:24
+
+options:
+  max-time: 15
+
+definitions:
+  caches:
+    pnpm: .pnpm-store
+
+  steps:
+    - step: &check-types
+        name: Check types
+        runs-on: ['almai', 'self.hosted', 'linux']
+        caches:
+          - pnpm
+        script:
+          - corepack enable && corepack prepare pnpm@10.33.0 --activate
+          - pnpm config set store-dir .pnpm-store
+          - npm config set @bardioc:registry http://nexus.almato.com/repository/npm-group/
+          - echo "//nexus.almato.com/repository/npm-group/:_auth=$(echo -n ${NEXUS_REPO_USER}:${NEXUS_REPO_PASS} | base64)" >> ~/.npmrc
+          - pnpm install --frozen-lockfile
+          - pnpm check-types
+
+    - step: &build
+        name: Build
+        runs-on: ['almai', 'self.hosted', 'linux']
+        caches:
+          - pnpm
+        script:
+          - corepack enable && corepack prepare pnpm@10.33.0 --activate
+          - pnpm config set store-dir .pnpm-store
+          - npm config set @bardioc:registry http://nexus.almato.com/repository/npm-group/
+          - echo "//nexus.almato.com/repository/npm-group/:_auth=$(echo -n ${NEXUS_REPO_USER}:${NEXUS_REPO_PASS} | base64)" >> ~/.npmrc
+          - pnpm install --frozen-lockfile
+          - export {{BUILD_ENV}}={{APP_NAME}}
+          - pnpm build
+        artifacts:
+          - {{OUT_DIR}}/**
+
+    - step: &audit
+        name: Security audit
+        runs-on: ['almai', 'self.hosted', 'linux']
+        caches:
+          - pnpm
+        script:
+          - corepack enable && corepack prepare pnpm@10.33.0 --activate
+          - pnpm config set store-dir .pnpm-store
+          - npm config set @bardioc:registry http://nexus.almato.com/repository/npm-group/
+          - echo "//nexus.almato.com/repository/npm-group/:_auth=$(echo -n ${NEXUS_REPO_USER}:${NEXUS_REPO_PASS} | base64)" >> ~/.npmrc
+          - pnpm install --frozen-lockfile
+          - pnpm audit --audit-level=high
+
+    # Publishes any version not yet on Nexus. The bump is done locally (pnpm release:version) and merged
+    # in the PR — no git write token, no release gate. Dormant while the app is `"private": true` +
+    # unscoped (changeset publish no-ops). To enable: scope the name, set private:false, add
+    # publishConfig.registry, and set `files` to the build output.
+    - step: &publish
+        name: Publish package to Nexus
+        runs-on: ['almai', 'self.hosted', 'linux']
+        caches:
+          - pnpm
+        script:
+          - corepack enable && corepack prepare pnpm@10.33.0 --activate
+          - pnpm config set store-dir .pnpm-store
+          - npm config set @bardioc:registry http://nexus.almato.com/repository/npm-group/
+          - echo "//nexus.almato.com/repository/npm-group/:_auth=$(echo -n ${NEXUS_REPO_USER}:${NEXUS_REPO_PASS} | base64)" >> ~/.npmrc
+          # npm publish auth must live in $HOME/.npmrc — changeset publish runs npm publish from the package dir.
+          - echo "//nexus.almato.com/repository/npm-releases/:_auth=$(echo -n ${NEXUS_REPO_USER}:${NEXUS_REPO_PASS} | base64)" >> "$HOME/.npmrc"
+          - echo "//nexus.almato.com/repository/npm-releases/:always-auth=true" >> "$HOME/.npmrc"
+          - pnpm install --frozen-lockfile
+          - export {{BUILD_ENV}}={{APP_NAME}}
+          - pnpm build
+          # Switch @bardioc to the writable npm-releases repo (npm-group is read-only; @scope:registry wins over publishConfig).
+          - npm config set @bardioc:registry http://nexus.almato.com/repository/npm-releases/
+          - pnpm changeset publish
+
+pipelines:
+  # PRs (and pushes to a PR's source branch) run everything except publish.
+  pull-requests:
+    '**':
+      - parallel:
+          - step: *check-types
+          - step: *build
+          - step: *audit
+
+  # Commits to `dev` run CI then publish. No gate: changeset publish no-ops when nothing is new.
+  branches:
+    dev:
+      - parallel:
+          - step: *check-types
+          - step: *build
+          - step: *audit
+      - step:
+          <<: *publish
+          trigger: automatic
+
+  custom:
+    # On-demand publish — re-run if a publish failed.
+    publish-package:
+      - step: *publish

package/templates/angular/.env.example

@@ -0,0 +1,5 @@
+VITE_APP_NAME={{APP_NAME}}
+VITE_APP_ID=your-app-client-id-here
+VITE_ENABLE_DEV_AUTH=false
+DEV_AUTH_HOST_URL=
+DEV_SESSION_KEY=

package/templates/angular/_gitignore

@@ -0,0 +1,7 @@
+.angular
+.env
+.env.local
+dist
+node_modules
+*.zip
+.linked/