@bardioc/create-bardioc-app 0.5.5 → 0.5.8

package/README.md

@@ -72,9 +72,7 @@ Generated apps can run standalone with the `DEV_SECRET` dev-auth proxy.
 2. Fill in `VITE_APP_NAME`, `DEV_SECRET`, and `API_BASE_URL`
 3. Run `npm run dev`
 
-When running outside the host iframe, the Vite plugin proxies `/rest/*` to `API_BASE_URL` with the `X-Dev-Secret` header and `installDevBridge()` handles SDK messages.
-
-For public testing, run `npm run dev:live` and use the emitted tunnel URL as the app's live URL in the host App Store configuration.
+When running outside the host iframe, the SDK proxies `/rest/*` to `API_BASE_URL` with the `X-Dev-Secret` header and `installDevBridge()` handles SDK messages. Vite templates do this through the `bardiocDevAuth` plugin; the angular and nextjs templates run `scripts/dev.mjs`, which starts it alongside their dev server.
 
 ## Options
 

package/bin/create.mjs

@@ -1,14 +1,12 @@
 #!/usr/bin/env node
+/* eslint-disable no-console */
 
-import { readFileSync } from 'node:fs';
 import { join, resolve } from 'node:path';
 import { fileURLToPath } from 'node:url';
 import { getDefaultTemplate, listTemplates, parseArgs, scaffoldApp } from '../src/scaffold.js';
 
 const __dirname = fileURLToPath(new URL('.', import.meta.url));
 const TEMPLATES_DIR = join(__dirname, '..', 'templates');
-const packageJsonPath = join(__dirname, '..', 'package.json');
-const packageJson = JSON.parse(readFileSync(packageJsonPath, 'utf-8'));
 
 const args = process.argv.slice(2);
 
@@ -66,7 +64,7 @@ if (!result.success) {
 
 console.log(`  Done! Next steps:\n`);
 console.log(`    cd ${name}`);
+console.log(`    cp .env.example .env`);
 console.log(`    npm install`);
 console.log(`    npm run dev\n`);
 console.log(`  Open http://localhost:${port} to see your app.`);
-console.log(`  Use "pnpm dev:live" for a public tunnel/live URL.\n`);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bardioc/create-bardioc-app",
-  "version": "0.5.5",
+  "version": "0.5.8",
   "description": "Scaffold a Bardioc app with framework templates (vite, react, vue, angular, svelte, solid, preact, nextjs)",
   "license": "MIT",
   "private": false,

package/templates/_base/README.md

@@ -14,11 +14,25 @@ npm install
 
 ```bash
 npm run dev              # http://localhost:{{PORT}}
-npm run dev:live         # public tunnel (BARDIOC_TUNNEL=1)
 ```
 
-`npm run dev` runs plain Vite as a local preview shell — live SDK data comes only when the app is
-opened inside the host. See `.env.example` for the required variables.
+`npm run dev` starts the dev server as a local preview shell. Live SDK data comes when the app is
+opened inside the host, or standalone once `DEV_SECRET` and `API_BASE_URL` are set — the SDK then
+proxies `/rest/*` to the BFF (via the `bardiocDevAuth` Vite plugin, or `scripts/dev.mjs`
+in the angular and nextjs templates, which `npm run dev` starts alongside the dev server). See
+`.env.example` for the required variables.
+
+## Lint & format
+
+```bash
+npm run check-types      # TypeScript
+npm run lint             # ESLint
+npm run format           # Prettier (format:check to verify only)
+```
+
+ESLint, Prettier and the `tsconfig.json` base all come from the shared `@bardioc/configs` presets
+(`eslint.config.mjs`, `prettier.config.mjs`), so an app lints exactly like the SDK does. The angular
+template is the exception — Angular 19 pins TypeScript 5.8, which the presets do not support yet.
 
 ## Develop against `@bardioc/*` source (optional)
 

package/templates/_base/scripts/stamp-manifest.mjs

@@ -14,4 +14,4 @@ manifest.version = version;
 manifest.description = base ? `${base} (v${version})` : `v${version}`;
 
 writeFileSync(url, `${JSON.stringify(manifest, null, 2)}\n`);
-console.log(`[stamp-manifest] ${version} → ${outDir}/app-manifest.json`);
+process.stdout.write(`[stamp-manifest] ${version} → ${outDir}/app-manifest.json\n`);

package/templates/_opt-link/scripts/link-source.mjs

@@ -29,7 +29,7 @@ if (argv[0] === '--remove') {
   const link = `${LINK_DIR}/${name}`;
   if (!exists(link)) fail(`No link at ${link}`);
   rmSync(link);
-  console.log(`✓ unlinked ${name}`);
+  process.stdout.write(`✓ unlinked ${name}\n`);
   syncCatalogs();
   process.exit(0);
 }
@@ -53,11 +53,11 @@ mkdirSync(LINK_DIR, { recursive: true });
 const link = `${LINK_DIR}/${name}`;
 if (exists(link)) rmSync(link);
 symlinkSync(abs, link, 'junction');
-console.log(`✓ linked ${name} → ${abs}`);
+process.stdout.write(`✓ linked ${name} → ${abs}\n`);
 
 syncCatalogs();
 
-console.log('Next: pnpm install');
+process.stdout.write('Next: pnpm install\n');
 
 // ── helpers ──────────────────────────────────────────────────────────
 
@@ -140,9 +140,11 @@ function replaceMarkerBlock(workspace, beginIdx, endIdx, marker) {
 
 function logSyncOutcome(sources) {
   if (sources.length === 1) {
-    console.log(`✓ synced catalogs from .linked/${sources[0].name} into ${WORKSPACE_FILE}`);
+    process.stdout.write(
+      `✓ synced catalogs from .linked/${sources[0].name} into ${WORKSPACE_FILE}\n`
+    );
   } else {
-    console.log(`✓ removed managed catalogs block from ${WORKSPACE_FILE}`);
+    process.stdout.write(`✓ removed managed catalogs block from ${WORKSPACE_FILE}\n`);
   }
 }
 

package/templates/angular/.env.example

@@ -1,7 +1,12 @@
+# Hosted app slug used by local runtime/dev-auth wiring.
 VITE_APP_NAME={{APP_NAME}}
 
-# Dev auth proxy secret for local standalone development.
+# Paste the dev secret from the BardiocOS AppStore after registering your app.
+# Used by the dev-auth proxy (scripts/dev.mjs) to sign requests to the BFF.
 DEV_SECRET=
 
-# Base URL of the Bardioc API the dev auth proxy should forward to.
+# Base URL of the Bardioc BFF / backend-for-frontend (e.g. https://your-host).
 API_BASE_URL=
+
+# By default, the app will start on port {{PORT}}. Feel free to uncomment the following variable and change it to match your local setup preferences.
+#LOCALHOST_PORT={{PORT}}

package/templates/angular/_gitignore

@@ -5,3 +5,4 @@ dist
 node_modules
 *.zip
 .linked/
+.DS_Store

package/templates/angular/package.json

@@ -6,9 +6,7 @@
     "sync:runtime-env": "node ./scripts/sync-runtime-env.mjs",
     "ng": "ng",
     "predev": "npm run sync:runtime-env",
-    "dev": "node ./scripts/dev-auth-proxy.mjs --app-port {{PORT}} & PROXY_PID=$!; ng serve --port {{PORT}}; EXIT_CODE=$?; kill $PROXY_PID; exit $EXIT_CODE",
-    "predev:live": "npm run sync:runtime-env",
-    "dev:live": "node ./scripts/dev-auth-proxy.mjs --app-port {{PORT}} & PROXY_PID=$!; BARDIOC_TUNNEL=1 ng serve --port {{PORT}}; EXIT_CODE=$?; kill $PROXY_PID; exit $EXIT_CODE",
+    "dev": "node ./scripts/dev.mjs",
     "prebuild": "npm run sync:runtime-env",
     "build": "ng build && node scripts/stamp-manifest.mjs dist/{{APP_NAME}}/browser",
     "bundle": "ng build && node scripts/stamp-manifest.mjs dist/{{APP_NAME}}/browser && cd dist/{{APP_NAME}}/browser && zip -r ../../../{{APP_NAME}}.zip .",
@@ -30,7 +28,7 @@
     "@angular/platform-browser": "^19.2.12",
     "@angular/platform-browser-dynamic": "^19.2.12",
     "@angular/router": "^19.2.12",
-    "@bardioc/app-sdk": "latest",
+    "@bardioc/app-sdk": "^0.5.0",
     "rxjs": "~7.8.2",
     "tslib": "^2.8.1",
     "zone.js": "~0.15.1"

package/templates/angular/scripts/dev-env.mjs

@@ -0,0 +1,41 @@
+import { readFileSync } from 'node:fs';
+import { join } from 'node:path';
+
+// The port a scaffolded app defaults to. LOCALHOST_PORT overrides it, from .env or the shell.
+const DEFAULT_PORT = {{PORT}};
+
+// The dev-auth proxy answers on the app port plus this offset — the same origin the app points
+// installDevBridge at.
+export const PROXY_PORT_OFFSET = 100;
+
+// Neither Next nor Angular exposes import.meta.env to a node script, so dotenv values are read
+// here the way Vite's loadEnv does it: a shell value always wins over the files.
+export function readEnvValue(projectDir, key) {
+  let value;
+
+  for (const fileName of ['.env', '.env.local']) {
+    let source;
+    try {
+      source = readFileSync(join(projectDir, fileName), 'utf8');
+    } catch {
+      continue;
+    }
+
+    for (const rawLine of source.split(/\r?\n/)) {
+      const line = rawLine.trim();
+      if (!line.startsWith(`${key}=`)) {
+        continue;
+      }
+      value = line
+        .slice(key.length + 1)
+        .trim()
+        .replace(/^['"]|['"]$/g, '');
+    }
+  }
+
+  return process.env[key] ?? value;
+}
+
+export function resolveAppPort(projectDir) {
+  return Number(readEnvValue(projectDir, 'LOCALHOST_PORT')) || DEFAULT_PORT;
+}

package/templates/angular/scripts/dev.mjs

@@ -0,0 +1,27 @@
+#!/usr/bin/env node
+
+import { startDevAuthProxy } from '@bardioc/app-sdk/dev-proxy';
+import { spawn } from 'node:child_process';
+import { dirname, resolve } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { PROXY_PORT_OFFSET, resolveAppPort } from './dev-env.mjs';
+
+const projectDir = resolve(dirname(fileURLToPath(import.meta.url)), '..');
+const port = resolveAppPort(projectDir);
+
+// Angular's dev server cannot host the SDK Vite plugin, so the proxy runs beside it. Without a
+// DEV_SECRET / API_BASE_URL it stays unstarted and the dev server runs alone, matching how the
+// SDK Vite plugin disables itself.
+const proxy = await startDevAuthProxy({ projectDir, port: port + PROXY_PORT_OFFSET });
+
+// shell:true so npm's node_modules/.bin lookup works on Windows too, where the binary is a .cmd.
+const server = spawn('ng', ['serve', '--port', String(port)], { stdio: 'inherit', shell: true });
+
+for (const signal of ['SIGINT', 'SIGTERM']) {
+  process.on(signal, () => server.kill(signal));
+}
+
+server.on('exit', (code, signal) => {
+  proxy?.close();
+  process.exit(signal ? 1 : (code ?? 0));
+});

package/templates/angular/scripts/sync-runtime-env.mjs

@@ -1,15 +1,15 @@
 #!/usr/bin/env node
 
-import { mkdirSync, readFileSync, writeFileSync } from 'node:fs';
+import { mkdirSync, writeFileSync } from 'node:fs';
 import { dirname, join, resolve } from 'node:path';
 import { fileURLToPath } from 'node:url';
+import { readEnvValue } from './dev-env.mjs';
 
 const __dirname = dirname(fileURLToPath(import.meta.url));
 const projectRoot = resolve(__dirname, '..');
-const env = loadEnv(projectRoot);
 
 const runtimeEnv = {
-  VITE_APP_NAME: env.VITE_APP_NAME,
+  VITE_APP_NAME: readEnvValue(projectRoot, 'VITE_APP_NAME'),
 };
 
 const outputPath = join(projectRoot, 'public', 'runtime-env.js');
@@ -20,48 +20,3 @@ writeFileSync(
   'utf8'
 );
 
-function loadEnv(projectDir) {
-  const result = {};
-
-  for (const fileName of ['.env', '.env.local']) {
-    const filePath = join(projectDir, fileName);
-
-    try {
-      Object.assign(result, parseEnv(readFileSync(filePath, 'utf8')));
-    } catch {
-      // Ignore missing env files.
-    }
-  }
-
-  return result;
-}
-
-function parseEnv(source) {
-  const result = {};
-
-  for (const rawLine of source.split(/\r?\n/)) {
-    const line = rawLine.trim();
-    if (!line || line.startsWith('#')) {
-      continue;
-    }
-
-    const equalsIndex = line.indexOf('=');
-    if (equalsIndex <= 0) {
-      continue;
-    }
-
-    const key = line.slice(0, equalsIndex).trim();
-    let value = line.slice(equalsIndex + 1).trim();
-
-    if (
-      (value.startsWith('"') && value.endsWith('"')) ||
-      (value.startsWith("'") && value.endsWith("'"))
-    ) {
-      value = value.slice(1, -1);
-    }
-
-    result[key] = value;
-  }
-
-  return result;
-}

package/templates/angular/src/app/app.component.ts

@@ -15,7 +15,7 @@ type ResultState =
   standalone: true,
   imports: [JsonPipe],
   template: `
-    <div class="bg-background text-foreground min-h-screen">
+    <div class="bg-background text-foreground @container/app min-h-screen">
       @if (showSdkDemo) {
         <div class="mx-auto flex min-h-screen w-full max-w-3xl flex-col gap-3 p-4">
           <div class="flex flex-col gap-1">
@@ -64,7 +64,7 @@ type ResultState =
                   <div class="text-muted-foreground border-border border-b pb-2 font-mono text-xs">
                     {{ resultRequest() }}
                   </div>
-                  <div class="text-destructive whitespace-pre-wrap break-all">{{ resultMessage() }}</div>
+                  <div class="text-destructive break-all whitespace-pre-wrap">{{ resultMessage() }}</div>
                 </div>
               }
               @case ('success') {
@@ -82,7 +82,7 @@ type ResultState =
         <div class="mx-auto flex min-h-screen w-full max-w-3xl flex-col gap-4 p-4">
           <h1 class="m-0 text-2xl font-semibold">Hello Bardioc App</h1>
           <p class="text-muted-foreground m-0 max-w-2xl text-xs leading-5">
-            Open this app inside Bardioc OS to use transport requests and send host notifications.
+            Open this app inside Bardioc to use transport requests and send host notifications.
           </p>
           <div class="border-border bg-muted/20 rounded-xl border p-3 text-xs leading-5">
             Outside the host iframe this page is only a local preview shell.
@@ -107,12 +107,12 @@ export class AppComponent {
     this.result.set({ status: 'loading', request });
 
     const startTime = Date.now();
-    this.bridge.notify('Getting user profile', 'info');
+    this.bridge.notify('Getting user profile…', 'info');
 
     try {
       const data = await this.bridge.transport.os.profile.get();
       const duration = Date.now() - startTime;
-      this.bridge.notify(`Profile loaded (${duration}ms)`, 'success`);
+      this.bridge.notify(`Profile loaded (${duration}ms).`, 'success');
       this.result.set({ status: 'success', request, data });
     } catch (err) {
       const message = err instanceof Error ? err.message : String(err);
@@ -125,7 +125,7 @@ export class AppComponent {
 
   handleNotify(): void {
     if (!this.bridge) return;
-    this.bridge.notify('Hello from {{DISPLAY_NAME}}', 'info');
+    this.bridge.notify('Hello from {{DISPLAY_NAME}}.', 'info');
     this.result.set({
       status: 'success',
       request: 'SDK_NOTIFY',

package/templates/angular/src/styles.css

@@ -85,6 +85,10 @@ code {
     margin: 0;
 }
 
+.\@container\/app {
+    container: app / inline-size;
+}
+
 .flex {
     display: flex;
 }

package/templates/angular/tsconfig.json

@@ -7,6 +7,7 @@
     "noPropertyAccessFromIndexSignature": true,
     "noImplicitReturns": true,
     "noFallthroughCasesInSwitch": true,
+    "noUncheckedIndexedAccess": true,
     "skipLibCheck": true,
     "esModuleInterop": true,
     "sourceMap": true,

package/templates/nextjs/.env.example

@@ -1,7 +1,12 @@
+# Hosted app slug used by local runtime/dev-auth wiring.
 NEXT_PUBLIC_APP_NAME={{APP_NAME}}
 
-# Shared secret used for dev auth when proxying API requests through /rest.
+# Paste the dev secret from the BardiocOS AppStore after registering your app.
+# Used by the dev-auth proxy (scripts/dev.mjs) to sign requests to the BFF.
 DEV_SECRET=
 
-# Base URL of the Bardioc API backend to proxy /rest requests to.
+# Base URL of the Bardioc BFF / backend-for-frontend (e.g. https://your-host).
 API_BASE_URL=
+
+# By default, the app will start on port {{PORT}}. Feel free to uncomment the following variable and change it to match your local setup preferences.
+#LOCALHOST_PORT={{PORT}}

package/templates/nextjs/_gitignore

@@ -5,3 +5,4 @@ out
 node_modules
 *.zip
 .linked/
+.DS_Store

package/templates/nextjs/app/layout.tsx

@@ -9,6 +9,8 @@ export default function RootLayout({ children }: Readonly<{ children: React.Reac
   return (
     <html lang="en" className="dark" style={{ height: '100%', margin: 0 }}>
       <head>
+        {/* Platform font contract — a fixed absolute URL the host serves, not a bundled asset. */}
+        {/* eslint-disable-next-line @next/next/no-css-tags */}
         <link rel="stylesheet" href="/fonts/bardioc-fonts.css" />
       </head>
       <body style={{ height: '100%', margin: 0 }}>{children}</body>

package/templates/nextjs/app/page.tsx

@@ -12,6 +12,9 @@ type ResultState =
 
 const APP_NAME = process.env.NEXT_PUBLIC_APP_NAME?.trim();
 
+// The port the app falls back to when it is not being served over HTTP (LOCALHOST_PORT moves it).
+const DEFAULT_PORT = Number('{{PORT}}');
+
 function SdkDemo() {
   const bridge = useSdk();
   const notify = useNotify();
@@ -26,13 +29,13 @@ function SdkDemo() {
     setResult({ status: 'loading', request });
 
     const startTime = Date.now();
-    notify('Getting user profile', 'info');
+    notify('Getting user profile…', 'info');
 
     try {
       const data = await bridge.transport.os.profile.get();
 
       const duration = Date.now() - startTime;
-      notify(`Profile loaded (${duration}ms)`, 'success');
+      notify(`Profile loaded (${duration}ms).`, 'success');
       setResult({ status: 'success', request, data });
     } catch (err) {
       const message = err instanceof Error ? err.message : String(err);
@@ -44,7 +47,7 @@ function SdkDemo() {
   }
 
   function handleNotify() {
-    notify('Hello from {{DISPLAY_NAME}}', 'info');
+    notify('Hello from {{DISPLAY_NAME}}.', 'info');
     setResult({
       status: 'success',
       request: 'SDK_NOTIFY',
@@ -103,7 +106,7 @@ function SdkDemo() {
             <div className="text-muted-foreground border-border border-b pb-2 font-mono text-xs">
               {result.request}
             </div>
-            <div className="text-destructive whitespace-pre-wrap break-all">{result.message}</div>
+            <div className="text-destructive break-all whitespace-pre-wrap">{result.message}</div>
           </div>
         )}
         {result.status === 'success' && (
@@ -126,7 +129,7 @@ function PreviewShell() {
     <div className="mx-auto flex min-h-screen w-full max-w-3xl flex-col gap-4 p-4">
       <h1 className="m-0 text-2xl font-semibold">Hello Bardioc App</h1>
       <p className="text-muted-foreground m-0 max-w-2xl text-xs leading-5">
-        Open this app inside Bardioc OS to use transport requests and send host notifications.
+        Open this app inside Bardioc to use transport requests and send host notifications.
       </p>
       <div className="border-border bg-muted/20 rounded-xl border p-3 text-xs leading-5">
         Outside the host iframe this page is only a local preview shell.
@@ -144,12 +147,15 @@ export default function Page() {
 
   useEffect(() => {
     if (isDevStandalone()) {
-      installDevBridge();
+      // scripts/dev.mjs runs the dev-auth proxy on the app port + 100, so read the port the page
+      // is actually served on rather than the one baked in at scaffold time.
+      const appPort = Number(window.location.port) || DEFAULT_PORT;
+      installDevBridge({ apiBaseUrl: `http://127.0.0.1:${appPort + 100}/rest` });
     }
   }, []);
 
   return (
-    <div className="bg-background text-foreground min-h-screen">
+    <div className="bg-background text-foreground @container/app min-h-screen">
       {useSdkProvider ? (
         <AppSdkProvider appId={APP_NAME}>
           <SdkDemo />

package/templates/nextjs/eslint.config.mjs

@@ -0,0 +1,4 @@
+import { config } from '@bardioc/configs/eslint/next';
+
+// Static export output and Next's generated env types are not sources.
+export default [...config, { ignores: ['out/**', 'next-env.d.ts'] }];

package/templates/nextjs/next.config.ts

@@ -1,32 +1,13 @@
 import type { NextConfig } from 'next';
 
-const apiBaseUrl = process.env.API_BASE_URL?.replace(/\/$/, '');
-const devSecret = process.env.DEV_SECRET;
-
+// Standalone dev auth lives in scripts/dev.mjs (the SDK dev-auth proxy), not here:
+// the BFF needs Origin dropped and X-Requested-With stamped, which rewrites cannot do.
 const nextConfig: NextConfig = {
   output: 'export',
   images: {
     unoptimized: true,
   },
   trailingSlash: true,
-  async headers() {
-    if (!devSecret) return [];
-    return [
-      {
-        source: '/rest/:path*',
-        headers: [{ key: 'X-Dev-Secret', value: devSecret }],
-      },
-    ];
-  },
-  async rewrites() {
-    if (!apiBaseUrl) return [];
-    return [
-      {
-        source: '/rest/:path*',
-        destination: `${apiBaseUrl}/:path*`,
-      },
-    ];
-  },
 };
 
 export default nextConfig;

package/templates/nextjs/package.json

@@ -3,29 +3,34 @@
   "version": "0.0.1",
   "private": true,
   "scripts": {
-    "dev": "next dev --port {{PORT}}",
-    "dev:live": "BARDIOC_TUNNEL=1 next dev --port {{PORT}}",
+    "dev": "node ./scripts/dev.mjs",
     "build": "next build && node scripts/stamp-manifest.mjs out",
     "bundle": "next build && node scripts/stamp-manifest.mjs out && cd out && zip -r ../{{APP_NAME}}.zip .",
     "start": "next start",
     "check-types": "tsc --noEmit",
+    "lint": "eslint .",
+    "format": "prettier --write .",
+    "format:check": "prettier --check .",
     "changeset": "changeset",
     "release:status": "changeset status --verbose",
     "release:version": "changeset version && npm install",
     "release:publish": "changeset publish"
   },
   "dependencies": {
-    "@bardioc/app-sdk": "latest",
+    "@bardioc/app-sdk": "^0.5.0",
     "next": "^15.3.2",
     "react": "^19.2.5",
     "react-dom": "^19.2.5"
   },
   "devDependencies": {
+    "@bardioc/configs": "0.2.1",
     "@changesets/cli": "^2.31.0",
     "@tailwindcss/postcss": "^4.2.4",
     "@types/node": "^22.10.0",
     "@types/react": "^19.2.14",
     "@types/react-dom": "^19.2.3",
+    "eslint": "^10.0.0",
+    "prettier": "^3.6.2",
     "tailwindcss": "^4.2.4",
     "typescript": "^6.0.3"
   }

package/templates/nextjs/prettier.config.mjs

@@ -0,0 +1 @@
+export { default } from '@bardioc/configs/prettier';

package/templates/nextjs/scripts/dev-env.mjs

@@ -0,0 +1,41 @@
+import { readFileSync } from 'node:fs';
+import { join } from 'node:path';
+
+// The port a scaffolded app defaults to. LOCALHOST_PORT overrides it, from .env or the shell.
+const DEFAULT_PORT = {{PORT}};
+
+// The dev-auth proxy answers on the app port plus this offset — the same origin the app points
+// installDevBridge at.
+export const PROXY_PORT_OFFSET = 100;
+
+// Neither Next nor Angular exposes import.meta.env to a node script, so dotenv values are read
+// here the way Vite's loadEnv does it: a shell value always wins over the files.
+export function readEnvValue(projectDir, key) {
+  let value;
+
+  for (const fileName of ['.env', '.env.local']) {
+    let source;
+    try {
+      source = readFileSync(join(projectDir, fileName), 'utf8');
+    } catch {
+      continue;
+    }
+
+    for (const rawLine of source.split(/\r?\n/)) {
+      const line = rawLine.trim();
+      if (!line.startsWith(`${key}=`)) {
+        continue;
+      }
+      value = line
+        .slice(key.length + 1)
+        .trim()
+        .replace(/^['"]|['"]$/g, '');
+    }
+  }
+
+  return process.env[key] ?? value;
+}
+
+export function resolveAppPort(projectDir) {
+  return Number(readEnvValue(projectDir, 'LOCALHOST_PORT')) || DEFAULT_PORT;
+}

package/templates/nextjs/scripts/dev.mjs

@@ -0,0 +1,27 @@
+#!/usr/bin/env node
+
+import { startDevAuthProxy } from '@bardioc/app-sdk/dev-proxy';
+import { spawn } from 'node:child_process';
+import { dirname, resolve } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { PROXY_PORT_OFFSET, resolveAppPort } from './dev-env.mjs';
+
+const projectDir = resolve(dirname(fileURLToPath(import.meta.url)), '..');
+const port = resolveAppPort(projectDir);
+
+// `next dev` cannot host the SDK Vite plugin, so the proxy runs beside it. Without a
+// DEV_SECRET / API_BASE_URL it stays unstarted and the dev server runs alone, matching how the
+// SDK Vite plugin disables itself.
+const proxy = await startDevAuthProxy({ projectDir, port: port + PROXY_PORT_OFFSET });
+
+// shell:true so npm's node_modules/.bin lookup works on Windows too, where the binary is a .cmd.
+const server = spawn('next', ['dev', '--port', String(port)], { stdio: 'inherit', shell: true });
+
+for (const signal of ['SIGINT', 'SIGTERM']) {
+  process.on(signal, () => server.kill(signal));
+}
+
+server.on('exit', (code, signal) => {
+  proxy?.close();
+  process.exit(signal ? 1 : (code ?? 0));
+});

package/templates/nextjs/tsconfig.json

@@ -1,23 +1,8 @@
 {
+  "extends": "@bardioc/configs/typescript/nextjs.json",
   "compilerOptions": {
-    "target": "ES2022",
-    "lib": ["dom", "dom.iterable", "esnext"],
-    "allowJs": true,
-    "skipLibCheck": true,
-    "strict": true,
-    "noEmit": true,
-    "esModuleInterop": true,
-    "module": "esnext",
-    "moduleResolution": "bundler",
-    "resolveJsonModule": true,
-    "isolatedModules": true,
-    "jsx": "preserve",
-    "incremental": true,
-    "plugins": [
-      {
-        "name": "next"
-      }
-    ],
+    "declaration": false,
+    "declarationMap": false,
     "paths": {
       "@/*": ["./*"]
     }