@bardioc/create-bardioc-app 0.6.0 → 0.7.0

package/README.md

@@ -49,7 +49,11 @@ Every scaffolded app ships a lightweight versioning toolkit:
 
 - **Changesets** (`.changeset/` + `changeset`/`release:*` scripts) for semver-versioning the app
 - **`scripts/stamp-manifest.mjs`** — folds `package.json`'s version into the built `app-manifest.json`
-  so the WebOS app store shows the real release version (wired into `npm run build` / `npm run bundle`)
+  and `manifest.yaml` (wired into `npm run build` / `npm run bundle`)
+- **Compliance gate** (`scripts/compliance.mjs`, `audit.mjs`, `compliance-summary.mjs` + `sbom` /
+  `compliance` / `audit:security` / `compliance:all` scripts) — `npm run bundle` first writes a
+  CycloneDX SBOM, checks production licenses against an allow list and fails on high/critical audit
+  findings; the four reports land in `public/` and ship inside the zip
 - Two Claude skills under `.claude/commands/`: **`/changeset-app`** (bump locally) and
   **`/refresh-bundle`** (rebuild the zip and swap it into a WebOS host checkout)
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bardioc/create-bardioc-app",
-  "version": "0.6.0",
+  "version": "0.7.0",
   "description": "Scaffold a Bardioc app with framework templates (vite, react, vue, angular, svelte, solid, preact, nextjs)",
   "license": "MIT",
   "private": false,

package/templates/_base/.claude/commands/refresh-bundle.md

@@ -12,7 +12,7 @@ Re-bundle **this** standalone hosted app and swap the fresh zip into the WebOS h
 The flow, end to end:
 
 1. **Remove** the stale zip in this app repo (forces a clean rebundle, never copies a stale artifact).
-2. **Bundle** via this repo's `npm run bundle` script (`<build> && node scripts/stamp-manifest.mjs && zip → <app>.zip`).
+2. **Bundle** via this repo's `npm run bundle` script (`npm run compliance:all && <build> && node scripts/stamp-manifest.mjs && zip → <app>.zip`).
 3. **Replace** `<host>/apps/webos-host/public/_apps/<app>.zip` with the freshly built one.
 
 ## Arguments
@@ -69,7 +69,7 @@ Then verify the artifact was actually produced:
 test -f "$REPO/$ZIP" && ls -l "$REPO/$ZIP" || { echo "Bundle did not produce $ZIP"; exit 1; }
 ```
 
-If `npm run bundle` fails (build errors), **stop and report the real failure** — do not copy anything.
+If `npm run bundle` fails (compliance gate or build errors), **stop and report the real failure** — do not copy anything.
 You may fix an obvious issue and retry once; on a second failure, report it truthfully and ask the
 user how to proceed.
 

package/templates/_base/README.md

@@ -69,11 +69,14 @@ resolves from Nexus. No overlay or CI-only workspace file needed.
 
 ```bash
 npm run build            # type-check + build (+ stamp the manifest version) → output dir
-npm run bundle           # build + zip → {{APP_NAME}}.zip
+npm run bundle           # compliance gate + build + zip → {{APP_NAME}}.zip
+npm run compliance:all   # SBOM + license check + vulnerability audit → public/*.json
 ```
 
-`scripts/stamp-manifest.mjs` folds `package.json`'s `version` into the built `app-manifest.json` so
-the WebOS app store shows the real release version. `{{APP_NAME}}.zip` is the deliverable uploaded
+`scripts/stamp-manifest.mjs` folds `package.json`'s `version` into the built `app-manifest.json` and
+`manifest.yaml`. `npm run bundle` starts with the compliance gate: it stops on a production dependency
+whose license is not on the allow list in `scripts/compliance.mjs`, or on a high or critical audit
+finding, and ships the SBOM and the reports inside the zip. `{{APP_NAME}}.zip` is the deliverable uploaded
 to the Bardioc host as a hosted app. To swap a fresh build into a local WebOS host checkout, run the
 **`/refresh-bundle`** skill.
 

package/templates/_base/scripts/audit.mjs

@@ -0,0 +1,50 @@
+// Vulnerability gate: scans production dependencies via npm audit, fails on high/critical findings.
+import { spawnSync } from 'node:child_process';
+import { mkdirSync, writeFileSync } from 'node:fs';
+import { resolve } from 'node:path';
+
+const FAIL_SEVERITIES = ['high', 'critical'];
+
+const outDir = resolve(process.argv[2] ?? 'public');
+mkdirSync(outDir, { recursive: true });
+
+// npm audit exits non-zero when vulnerabilities exist, so exit code is not an error signal here.
+const res = spawnSync('npm', ['audit', '--omit=dev', '--json'], {
+  encoding: 'utf8',
+  maxBuffer: 64 * 1024 * 1024,
+});
+if (!res.stdout) {
+  console.error('npm audit produced no output:', res.stderr);
+  process.exit(1);
+}
+const audit = JSON.parse(res.stdout);
+const counts = audit.metadata?.vulnerabilities ?? {};
+
+const findings = Object.values(audit.vulnerabilities ?? {}).map(v => ({
+  name: v.name,
+  severity: v.severity,
+  range: v.range,
+  fixAvailable: v.fixAvailable,
+  advisories: (v.via ?? [])
+    .filter(x => typeof x === 'object')
+    .map(x => ({ title: x.title, url: x.url, severity: x.severity, cwe: x.cwe, cvss: x.cvss })),
+}));
+
+const blocking = findings.filter(f => FAIL_SEVERITIES.includes(f.severity));
+const report = {
+  generatedAt: new Date().toISOString(),
+  tool: 'npm audit (production dependencies)',
+  failOn: FAIL_SEVERITIES,
+  counts,
+  passed: blocking.length === 0,
+  findings,
+};
+writeFileSync(resolve(outDir, 'security-audit.json'), JSON.stringify(report, null, 2));
+
+console.log('Vulnerability scan:', JSON.stringify(counts));
+if (blocking.length > 0) {
+  console.error('Blocking vulnerabilities:');
+  for (const f of blocking) console.error(`  ${f.name} (${f.severity}) ${f.range}`);
+  process.exit(1);
+}
+console.log('No high/critical vulnerabilities.');

package/templates/_base/scripts/compliance-summary.mjs

@@ -0,0 +1,42 @@
+// Aggregates SBOM, license, and vulnerability reports into one verdict a reviewer or CI can read.
+import { readFileSync, writeFileSync } from 'node:fs';
+import { resolve } from 'node:path';
+
+const dir = resolve(process.argv[2] ?? 'public');
+const readJson = f => JSON.parse(readFileSync(resolve(dir, f), 'utf8'));
+
+const pkg = JSON.parse(readFileSync('package.json', 'utf8'));
+const sbom = readJson('sbom.cdx.json');
+const licenses = readJson('license-compliance.json');
+const audit = readJson('security-audit.json');
+
+const summary = {
+  app: { name: pkg.name, version: pkg.version },
+  generatedAt: new Date().toISOString(),
+  checks: {
+    sbom: {
+      passed: true,
+      format: `CycloneDX ${sbom.specVersion}`,
+      components: sbom.components?.length ?? 0,
+      report: 'sbom.cdx.json',
+    },
+    licenses: {
+      passed: licenses.violations.length === 0,
+      packagesScanned: licenses.totalPackages,
+      violations: licenses.violations.length,
+      allowedLicenses: licenses.allowedLicenses,
+      report: 'license-compliance.json',
+    },
+    vulnerabilities: {
+      passed: audit.passed,
+      counts: audit.counts,
+      failOn: audit.failOn,
+      report: 'security-audit.json',
+    },
+  },
+};
+summary.passed = Object.values(summary.checks).every(c => c.passed);
+
+writeFileSync(resolve(dir, 'compliance-summary.json'), JSON.stringify(summary, null, 2));
+console.log(`Compliance summary: ${summary.passed ? 'PASSED' : 'FAILED'}`);
+if (!summary.passed) process.exit(1);

package/templates/_base/scripts/compliance.mjs

@@ -0,0 +1,64 @@
+// License compliance gate: fails the build when a production dependency uses a non-allowed license.
+import { execFileSync } from 'node:child_process';
+import { mkdirSync, writeFileSync } from 'node:fs';
+import { resolve } from 'node:path';
+
+const ALLOWED_LICENSES = [
+  'MIT',
+  'ISC',
+  'Apache-2.0',
+  'BSD-2-Clause',
+  'BSD-3-Clause',
+  '0BSD',
+  'CC0-1.0',
+  'Unlicense',
+  // Permissive OSI license (PSF); argparse, a js-yaml dependency, ships under it.
+  'Python-2.0',
+];
+
+const outDir = resolve(process.argv[2] ?? 'dist/reports');
+mkdirSync(outDir, { recursive: true });
+
+const raw = execFileSync(
+  'npx',
+  ['license-checker-rseidelsohn', '--production', '--json', '--excludePrivatePackages'],
+  { encoding: 'utf8', maxBuffer: 64 * 1024 * 1024 }
+);
+const packages = JSON.parse(raw);
+
+// SPDX expressions: "A AND B" needs every part allowed, "A OR B" lets us pick an
+// allowed alternative (e.g. dompurify's "MPL-2.0 OR Apache-2.0").
+const isAllowed = licenses => {
+  const expr = String(licenses).replaceAll(/[()]/g, '');
+  const conjuncts = expr.split(/\s+AND\s+/);
+  return conjuncts.every(part =>
+    part.split(/\s+OR\s+/).some(l => ALLOWED_LICENSES.includes(l.trim()))
+  );
+};
+
+const violations = [];
+const summary = {};
+for (const [name, info] of Object.entries(packages)) {
+  const license = String(info.licenses);
+  summary[license] = (summary[license] ?? 0) + 1;
+  if (!isAllowed(license)) violations.push({ package: name, license, repository: info.repository });
+}
+
+const report = {
+  generatedAt: new Date().toISOString(),
+  allowedLicenses: ALLOWED_LICENSES,
+  totalPackages: Object.keys(packages).length,
+  licenseSummary: summary,
+  violations,
+  packages,
+};
+writeFileSync(resolve(outDir, 'license-compliance.json'), JSON.stringify(report, null, 2));
+
+console.log(`License compliance: ${report.totalPackages} packages scanned`);
+console.table(summary);
+if (violations.length > 0) {
+  console.error('License violations found:');
+  for (const v of violations) console.error(`  ${v.package}: ${v.license}`);
+  process.exit(1);
+}
+console.log('No license violations.');

package/templates/_base/scripts/stamp-manifest.mjs

@@ -1,5 +1,5 @@
-// Folds package.json's version into the built app-manifest.json so the WebOS app store (name +
-// description only) shows the release version. Output dir comes from argv (defaults to dist). Idempotent.
+// Folds package.json's version into the built app-manifest.json and manifest.yaml. Output dir comes
+// from argv (defaults to dist). Idempotent.
 import { readFileSync, writeFileSync } from 'node:fs';
 
 const root = new URL('..', import.meta.url);
@@ -8,10 +8,16 @@ const { version } = JSON.parse(readFileSync(new URL('package.json', root), 'utf8
 
 const url = new URL(`${outDir}/app-manifest.json`, root);
 const manifest = JSON.parse(readFileSync(url, 'utf8'));
-const base = (manifest.description ?? '').replace(/\s*\(v[^)]*\)\s*$/, '').trim();
 
 manifest.version = version;
-manifest.description = base ? `${base} (v${version})` : `v${version}`;
+// The version lives in its own field; a "(vX.Y.Z)" suffix left by an older stamp is dropped.
+if (manifest.description) {
+  manifest.description = manifest.description.replace(/\s*\(v[^)]*\)\s*$/, '').trim();
+}
 
 writeFileSync(url, `${JSON.stringify(manifest, null, 2)}\n`);
+
+// The legacy manifest.yaml carries the same version for the store's uploader.
+const yamlUrl = new URL(`${outDir}/manifest.yaml`, root);
+writeFileSync(yamlUrl, `name: ${manifest.id}\nversion: ${version}\n`);
 process.stdout.write(`[stamp-manifest] ${version} → ${outDir}/app-manifest.json\n`);

package/templates/angular/_gitignore

@@ -6,3 +6,9 @@ node_modules
 *.zip
 .linked/
 .DS_Store
+
+# Generated by `npm run compliance:all`, shipped inside the bundle.
+public/sbom.cdx.json
+public/license-compliance.json
+public/security-audit.json
+public/compliance-summary.json

package/templates/angular/package.json

@@ -9,7 +9,11 @@
     "dev": "node ./scripts/dev.mjs",
     "prebuild": "npm run sync:runtime-env",
     "build": "ng build && node scripts/stamp-manifest.mjs dist/{{APP_NAME}}/browser",
-    "bundle": "ng build && node scripts/stamp-manifest.mjs dist/{{APP_NAME}}/browser && cd dist/{{APP_NAME}}/browser && zip -r ../../../{{APP_NAME}}.zip .",
+    "bundle": "npm run compliance:all && ng build && node scripts/stamp-manifest.mjs dist/{{APP_NAME}}/browser && cd dist/{{APP_NAME}}/browser && zip -r ../../../{{APP_NAME}}.zip .",
+    "sbom": "cyclonedx-npm --omit dev --output-format json --output-reproducible --output-file public/sbom.cdx.json",
+    "compliance": "node scripts/compliance.mjs public",
+    "audit:security": "node scripts/audit.mjs public",
+    "compliance:all": "npm run sbom && npm run compliance && npm run audit:security && node scripts/compliance-summary.mjs public",
     "prewatch": "npm run sync:runtime-env",
     "watch": "ng build --watch --configuration development",
     "precheck-types": "npm run sync:runtime-env",
@@ -28,7 +32,7 @@
     "@angular/platform-browser": "^19.2.12",
     "@angular/platform-browser-dynamic": "^19.2.12",
     "@angular/router": "^19.2.12",
-    "@bardioc/app-sdk": "^1.0.0",
+    "@bardioc/app-sdk": "^1.0.1",
     "rxjs": "~7.8.2",
     "tslib": "^2.8.1",
     "zone.js": "~0.15.1"
@@ -38,8 +42,10 @@
     "@angular/cli": "^19.2.13",
     "@angular/compiler-cli": "^19.2.12",
     "@changesets/cli": "^2.31.0",
+    "@cyclonedx/cyclonedx-npm": "^6.0.1",
     "@tailwindcss/postcss": "^4.2.4",
     "autoprefixer": "^10.4.21",
+    "license-checker-rseidelsohn": "^5.0.1",
     "postcss": "^8.5.4",
     "tailwindcss": "^4.2.4",
     "typescript": "~5.8.3"

package/templates/angular/src/main.ts

@@ -25,7 +25,6 @@ const useSdkProvider = insideIframe || devStandalone;
 async function bootstrap() {
   if (devStandalone) {
     installDevHost({
-      appId: '{{APP_NAME}}',
       apiBaseUrl: `http://127.0.0.1:${proxyPort}/rest`,
     });
   }

package/templates/nextjs/_gitignore

@@ -6,3 +6,9 @@ node_modules
 *.zip
 .linked/
 .DS_Store
+
+# Generated by `npm run compliance:all`, shipped inside the bundle.
+public/sbom.cdx.json
+public/license-compliance.json
+public/security-audit.json
+public/compliance-summary.json

package/templates/nextjs/app/page.tsx

@@ -10,8 +10,6 @@ type ResultState =
   | { status: 'success'; request: string; data: unknown }
   | { status: 'error'; request: string; message: string };
 
-const APP_NAME = process.env.NEXT_PUBLIC_APP_NAME?.trim();
-
 // The port the app falls back to when it is not being served over HTTP (LOCALHOST_PORT moves it).
 const DEFAULT_PORT = Number('{{PORT}}');
 
@@ -141,16 +139,12 @@ function PreviewShell() {
 export default function Page() {
   const useSdkProvider = isInsideIframe() || isDevStandalone();
 
-  if (!APP_NAME) {
-    throw new Error('Missing NEXT_PUBLIC_APP_NAME for runtime');
-  }
-
   useEffect(() => {
     if (isDevStandalone()) {
       // scripts/dev.mjs runs the dev-auth proxy on the app port + 100, so read the port the page
       // is actually served on rather than the one baked in at scaffold time.
       const appPort = Number(window.location.port) || DEFAULT_PORT;
-      installDevHost({ appId: APP_NAME, apiBaseUrl: `http://127.0.0.1:${appPort + 100}/rest` });
+      installDevHost({ apiBaseUrl: `http://127.0.0.1:${appPort + 100}/rest` });
     }
   }, []);
 

package/templates/nextjs/package.json

@@ -5,7 +5,11 @@
   "scripts": {
     "dev": "node ./scripts/dev.mjs",
     "build": "next build && node scripts/stamp-manifest.mjs out",
-    "bundle": "next build && node scripts/stamp-manifest.mjs out && cd out && zip -r ../{{APP_NAME}}.zip .",
+    "bundle": "npm run compliance:all && next build && node scripts/stamp-manifest.mjs out && cd out && zip -r ../{{APP_NAME}}.zip .",
+    "sbom": "cyclonedx-npm --omit dev --output-format json --output-reproducible --output-file public/sbom.cdx.json",
+    "compliance": "node scripts/compliance.mjs public",
+    "audit:security": "node scripts/audit.mjs public",
+    "compliance:all": "npm run sbom && npm run compliance && npm run audit:security && node scripts/compliance-summary.mjs public",
     "start": "next start",
     "check-types": "tsc --noEmit",
     "lint": "eslint .",
@@ -17,7 +21,7 @@
     "release:publish": "changeset publish"
   },
   "dependencies": {
-    "@bardioc/app-sdk": "^1.0.0",
+    "@bardioc/app-sdk": "^1.0.1",
     "next": "^15.3.2",
     "react": "^19.2.5",
     "react-dom": "^19.2.5"
@@ -25,11 +29,13 @@
   "devDependencies": {
     "@bardioc/configs": "0.2.1",
     "@changesets/cli": "^2.31.0",
+    "@cyclonedx/cyclonedx-npm": "^6.0.1",
     "@tailwindcss/postcss": "^4.2.4",
     "@types/node": "^22.10.0",
     "@types/react": "^19.2.14",
     "@types/react-dom": "^19.2.3",
     "eslint": "^10.0.0",
+    "license-checker-rseidelsohn": "^5.0.1",
     "prettier": "^3.6.2",
     "tailwindcss": "^4.2.4",
     "typescript": "^6.0.3"

package/templates/preact/_gitignore

@@ -7,3 +7,9 @@ coverage/
 .env.*.local
 *.tsbuildinfo
 .linked/
+
+# Generated by `npm run compliance:all`, shipped inside the bundle.
+public/sbom.cdx.json
+public/license-compliance.json
+public/security-audit.json
+public/compliance-summary.json

package/templates/preact/package.json

@@ -6,7 +6,11 @@
   "scripts": {
     "dev": "vite",
     "build": "tsc && vite build && node scripts/stamp-manifest.mjs dist",
-    "bundle": "tsc && vite build && node scripts/stamp-manifest.mjs dist && cd dist && zip -r ../{{APP_NAME}}.zip .",
+    "bundle": "npm run compliance:all && tsc && vite build && node scripts/stamp-manifest.mjs dist && cd dist && zip -r ../{{APP_NAME}}.zip .",
+    "sbom": "cyclonedx-npm --omit dev --output-format json --output-reproducible --output-file public/sbom.cdx.json",
+    "compliance": "node scripts/compliance.mjs public",
+    "audit:security": "node scripts/audit.mjs public",
+    "compliance:all": "npm run sbom && npm run compliance && npm run audit:security && node scripts/compliance-summary.mjs public",
     "preview": "vite preview",
     "check-types": "tsc --noEmit",
     "lint": "eslint .",
@@ -18,16 +22,18 @@
     "release:publish": "changeset publish"
   },
   "dependencies": {
-    "@bardioc/app-sdk": "^1.0.0",
+    "@bardioc/app-sdk": "^1.0.1",
     "preact": "^10.26.7"
   },
   "devDependencies": {
     "@bardioc/configs": "0.2.1",
     "@changesets/cli": "^2.31.0",
+    "@cyclonedx/cyclonedx-npm": "^6.0.1",
     "@preact/preset-vite": "^2.10.6",
     "@tailwindcss/vite": "^4.3.0",
     "@types/node": "^22.19.19",
     "eslint": "^10.0.0",
+    "license-checker-rseidelsohn": "^5.0.1",
     "preact-render-to-string": "^6.6.1",
     "prettier": "^3.6.2",
     "tailwindcss": "4.3.0",

package/templates/preact/src/main.tsx

@@ -4,18 +4,12 @@ import { render } from 'preact';
 import { App } from './App';
 import './index.css';
 
-const APP_NAME = import.meta.env.VITE_APP_NAME?.trim();
-
-if (!APP_NAME) {
-  throw new Error('Missing VITE_APP_NAME for runtime');
-}
-
 const insideIframe = isInsideIframe();
 const devStandalone = isDevStandalone();
 const useSdkProvider = insideIframe || devStandalone;
 
 if (devStandalone) {
-  installDevHost({ appId: APP_NAME });
+  installDevHost();
 }
 
 render(

package/templates/solid/_gitignore

@@ -7,3 +7,9 @@ coverage/
 .env.*.local
 *.tsbuildinfo
 .linked/
+
+# Generated by `npm run compliance:all`, shipped inside the bundle.
+public/sbom.cdx.json
+public/license-compliance.json
+public/security-audit.json
+public/compliance-summary.json

package/templates/solid/package.json

@@ -6,7 +6,11 @@
   "scripts": {
     "dev": "vite",
     "build": "tsc && vite build && node scripts/stamp-manifest.mjs dist",
-    "bundle": "tsc && vite build && node scripts/stamp-manifest.mjs dist && cd dist && zip -r ../{{APP_NAME}}.zip .",
+    "bundle": "npm run compliance:all && tsc && vite build && node scripts/stamp-manifest.mjs dist && cd dist && zip -r ../{{APP_NAME}}.zip .",
+    "sbom": "cyclonedx-npm --omit dev --output-format json --output-reproducible --output-file public/sbom.cdx.json",
+    "compliance": "node scripts/compliance.mjs public",
+    "audit:security": "node scripts/audit.mjs public",
+    "compliance:all": "npm run sbom && npm run compliance && npm run audit:security && node scripts/compliance-summary.mjs public",
     "preview": "vite preview",
     "check-types": "tsc --noEmit",
     "lint": "eslint .",
@@ -18,15 +22,17 @@
     "release:publish": "changeset publish"
   },
   "dependencies": {
-    "@bardioc/app-sdk": "^1.0.0",
+    "@bardioc/app-sdk": "^1.0.1",
     "solid-js": "^1.9.7"
   },
   "devDependencies": {
     "@bardioc/configs": "0.2.1",
     "@changesets/cli": "^2.31.0",
+    "@cyclonedx/cyclonedx-npm": "^6.0.1",
     "@tailwindcss/vite": "^4.3.0",
     "@types/node": "^22.19.19",
     "eslint": "^10.0.0",
+    "license-checker-rseidelsohn": "^5.0.1",
     "prettier": "^3.6.2",
     "tailwindcss": "4.3.0",
     "typescript": "6.0.3",

package/templates/solid/src/main.tsx

@@ -5,18 +5,12 @@ import { App } from './App';
 import { AppSdkProvider } from './bardioc-sdk';
 import './index.css';
 
-const APP_NAME = import.meta.env.VITE_APP_NAME?.trim();
-
-if (!APP_NAME) {
-  throw new Error('Missing VITE_APP_NAME for runtime');
-}
-
 const insideIframe = isInsideIframe();
 const devStandalone = isDevStandalone();
 const useSdkProvider = insideIframe || devStandalone;
 
 if (devStandalone) {
-  installDevHost({ appId: APP_NAME });
+  installDevHost();
 }
 
 const root = document.getElementById('root')!;

package/templates/svelte/_gitignore

@@ -5,3 +5,9 @@ node_modules
 *.zip
 .linked/
 .DS_Store
+
+# Generated by `npm run compliance:all`, shipped inside the bundle.
+public/sbom.cdx.json
+public/license-compliance.json
+public/security-audit.json
+public/compliance-summary.json

package/templates/svelte/package.json

@@ -6,7 +6,11 @@
   "scripts": {
     "dev": "vite",
     "build": "svelte-check && vite build && node scripts/stamp-manifest.mjs dist",
-    "bundle": "svelte-check && vite build && node scripts/stamp-manifest.mjs dist && cd dist && zip -r ../{{APP_NAME}}.zip .",
+    "bundle": "npm run compliance:all && svelte-check && vite build && node scripts/stamp-manifest.mjs dist && cd dist && zip -r ../{{APP_NAME}}.zip .",
+    "sbom": "cyclonedx-npm --omit dev --output-format json --output-reproducible --output-file public/sbom.cdx.json",
+    "compliance": "node scripts/compliance.mjs public",
+    "audit:security": "node scripts/audit.mjs public",
+    "compliance:all": "npm run sbom && npm run compliance && npm run audit:security && node scripts/compliance-summary.mjs public",
     "preview": "vite preview",
     "check-types": "svelte-check",
     "lint": "eslint .",
@@ -18,16 +22,18 @@
     "release:publish": "changeset publish"
   },
   "dependencies": {
-    "@bardioc/app-sdk": "^1.0.0",
+    "@bardioc/app-sdk": "^1.0.1",
     "svelte": "^5.33.14"
   },
   "devDependencies": {
     "@bardioc/configs": "0.2.1",
     "@changesets/cli": "^2.31.0",
+    "@cyclonedx/cyclonedx-npm": "^6.0.1",
     "@sveltejs/vite-plugin-svelte": "^7.2.0",
     "@tailwindcss/vite": "^4.3.0",
     "@types/node": "^22.19.19",
     "eslint": "^10.0.0",
+    "license-checker-rseidelsohn": "^5.0.1",
     "prettier": "^3.6.2",
     "svelte-check": "^4.2.1",
     "tailwindcss": "4.3.0",

package/templates/svelte/src/main.ts

@@ -4,18 +4,12 @@ import { mount } from 'svelte';
 import App from './App.svelte';
 import './index.css';
 
-const APP_NAME = import.meta.env.VITE_APP_NAME?.trim();
-
-if (!APP_NAME) {
-  throw new Error('Missing VITE_APP_NAME for runtime');
-}
-
 const insideIframe = isInsideIframe();
 const devStandalone = isDevStandalone();
 const useSdkProvider = insideIframe || devStandalone;
 
 if (devStandalone) {
-  installDevHost({ appId: APP_NAME });
+  installDevHost();
 }
 
 const bardioc = useSdkProvider ? await connect() : null;

package/templates/vite/_gitignore

@@ -7,3 +7,9 @@ coverage/
 .env.*.local
 *.tsbuildinfo
 .linked/
+
+# Generated by `npm run compliance:all`, shipped inside the bundle.
+public/sbom.cdx.json
+public/license-compliance.json
+public/security-audit.json
+public/compliance-summary.json

package/templates/vite/package.json

@@ -6,7 +6,11 @@
   "scripts": {
     "dev": "vite",
     "build": "tsc && vite build && node scripts/stamp-manifest.mjs dist",
-    "bundle": "rm -f {{APP_NAME}}.zip && tsc && vite build && node scripts/stamp-manifest.mjs dist && cd dist && zip -r ../{{APP_NAME}}.zip .",
+    "bundle": "rm -f {{APP_NAME}}.zip && npm run compliance:all && tsc && vite build && node scripts/stamp-manifest.mjs dist && cd dist && zip -r ../{{APP_NAME}}.zip .",
+    "sbom": "cyclonedx-npm --omit dev --output-format json --output-reproducible --output-file public/sbom.cdx.json",
+    "compliance": "node scripts/compliance.mjs public",
+    "audit:security": "node scripts/audit.mjs public",
+    "compliance:all": "npm run sbom && npm run compliance && npm run audit:security && node scripts/compliance-summary.mjs public",
     "preview": "vite preview",
     "check-types": "tsc --noEmit",
     "lint": "eslint .",
@@ -18,7 +22,7 @@
     "release:publish": "changeset publish"
   },
   "dependencies": {
-    "@bardioc/app-sdk": "^1.0.0",
+    "@bardioc/app-sdk": "^1.0.1",
     "@bardioc/i18n-core": "^0.1.1",
     "@bardioc/ui": "^0.7.29",
     "lucide-react": "^0.544.0",
@@ -28,12 +32,14 @@
   "devDependencies": {
     "@bardioc/configs": "0.2.1",
     "@changesets/cli": "^2.31.0",
+    "@cyclonedx/cyclonedx-npm": "^6.0.1",
     "@tailwindcss/vite": "^4.3.0",
     "@types/node": "^22.19.19",
     "@types/react": "^19.2.14",
     "@types/react-dom": "^19.2.3",
     "@vitejs/plugin-react": "5.2.0",
     "eslint": "^10.0.0",
+    "license-checker-rseidelsohn": "^5.0.1",
     "prettier": "^3.6.2",
     "tailwindcss": "4.3.0",
     "typescript": "6.0.3",

package/templates/vite/src/main.tsx

@@ -6,18 +6,12 @@ import { App } from './App';
 import { AppI18nProvider } from './i18n';
 import './index.css';
 
-const APP_NAME = import.meta.env.VITE_APP_NAME?.trim();
-
-if (!APP_NAME) {
-  throw new Error('Missing VITE_APP_NAME for runtime');
-}
-
 const insideIframe = isInsideIframe();
 const devStandalone = isDevStandalone();
 const useSdkProvider = insideIframe || devStandalone;
 
 if (devStandalone) {
-  installDevHost({ appId: APP_NAME });
+  installDevHost();
 }
 
 createRoot(document.getElementById('root')!).render(

package/templates/vue/_gitignore

@@ -5,3 +5,9 @@ node_modules
 *.zip
 .linked/
 .DS_Store
+
+# Generated by `npm run compliance:all`, shipped inside the bundle.
+public/sbom.cdx.json
+public/license-compliance.json
+public/security-audit.json
+public/compliance-summary.json

package/templates/vue/package.json

@@ -6,7 +6,11 @@
   "scripts": {
     "dev": "vite",
     "build": "vue-tsc -b && vite build && node scripts/stamp-manifest.mjs dist",
-    "bundle": "vue-tsc -b && vite build && node scripts/stamp-manifest.mjs dist && cd dist && zip -r ../{{APP_NAME}}.zip .",
+    "bundle": "npm run compliance:all && vue-tsc -b && vite build && node scripts/stamp-manifest.mjs dist && cd dist && zip -r ../{{APP_NAME}}.zip .",
+    "sbom": "cyclonedx-npm --omit dev --output-format json --output-reproducible --output-file public/sbom.cdx.json",
+    "compliance": "node scripts/compliance.mjs public",
+    "audit:security": "node scripts/audit.mjs public",
+    "compliance:all": "npm run sbom && npm run compliance && npm run audit:security && node scripts/compliance-summary.mjs public",
     "preview": "vite preview",
     "check-types": "vue-tsc --noEmit",
     "lint": "eslint .",
@@ -18,16 +22,18 @@
     "release:publish": "changeset publish"
   },
   "dependencies": {
-    "@bardioc/app-sdk": "^1.0.0",
+    "@bardioc/app-sdk": "^1.0.1",
     "vue": "^3.5.16"
   },
   "devDependencies": {
     "@bardioc/configs": "0.2.1",
     "@changesets/cli": "^2.31.0",
+    "@cyclonedx/cyclonedx-npm": "^6.0.1",
     "@tailwindcss/vite": "^4.3.0",
     "@types/node": "^22.19.19",
     "@vitejs/plugin-vue": "^6.0.8",
     "eslint": "^10.0.0",
+    "license-checker-rseidelsohn": "^5.0.1",
     "prettier": "^3.6.2",
     "tailwindcss": "4.3.0",
     "typescript": "6.0.3",

package/templates/vue/src/main.ts

@@ -5,18 +5,12 @@ import App from './App.vue';
 import { BARDIOC_KEY } from './bardioc-sdk';
 import './index.css';
 
-const APP_NAME = import.meta.env.VITE_APP_NAME?.trim();
-
-if (!APP_NAME) {
-  throw new Error('Missing VITE_APP_NAME for runtime');
-}
-
 const insideIframe = isInsideIframe();
 const devStandalone = isDevStandalone();
 const useSdkProvider = insideIframe || devStandalone;
 
 if (devStandalone) {
-  installDevHost({ appId: APP_NAME });
+  installDevHost();
 }
 
 const app = createApp(App);