@smartsoft001-mobilems/claude-plugins 2.88.0 → 2.90.0

package/README.md

@@ -1,11 +1,36 @@
 # @smartsoft001-mobilems/claude-plugins
 
-Claude Code plugins for MobileMS / MuzaCMS projects. Ships three variants:
+Claude Code plugins for MobileMS / MuzaCMS projects. Ships four plugins:
 
-- `flow` — modern Angular 20+ projects (primary plugin)
+- `mobilems` — the museum scaffolding skills (see below)
+- `flow` — modern Angular 20+ projects (primary flow plugin)
 - `flow-legacy` — Angular 14 projects
 - `flow-external` — standalone Angular 6–11 projects
 
+The package's only TypeScript export is `CLAUDE_PLUGINS_VERSION`; the plugins themselves are the
+MD/JSON files under `src/plugins/**`, copied to `dist` as build assets.
+
+## `mobilems` skills
+
+Run them in this order for a new museum app — `/smart:scaffold-nx-workspace` →
+`mobilems-project-init` → the feature skills → `mobilems-devops-config`.
+
+| Skill | Builds |
+| --- | --- |
+| `mobilems-project-init` | The MobilEMS foundation: deps, Tailwind, runtime env, `app.config` providers, shared lib, static pages, app shell, `.claude`. No feature modules. |
+| `mobilems-objects` | `libs/museum-objects` + the `/obiekty` route |
+| `mobilems-object-collections` | `libs/museum-collections` + the `/kolekcje` route |
+| `mobilems-articles` | A parametrized (NAME + TEMPLATE) article module — news, education, … |
+| `mobilems-thematic-publications` | `libs/museum-thematic-paths` + the `/sciezki-tematyczne` route |
+| `mobilems-events` | `libs/museum-events` + the `/wydarzenia` route (booking flow) |
+| `mobilems-partners` | `libs/museum-partners` + the `/partnerzy` route |
+| `mobilems-devops-config` | The ops layer: Dockerfile, GitHub Actions, update tooling, env/lint/node, `.github` hygiene |
+| `mobilems-docs-reader` | Answers MuzaCMS indexer-API questions from a freshly fetched OpenAPI spec (read-only) |
+
+Every scaffolding skill opens with a **Framework first — MANDATORY** section pointing at the
+[framework API catalog](../angular/README.md); they reuse framework exports rather than
+re-implementing them.
+
 ## MuzaCMS API access (required for `mobilems-docs-reader` skill)
 
 The `mobilems-docs-reader` skill answers questions about the MuzaCMS / MobileMS indexer API by fetching its Swagger spec from a live MuzaCMS instance. The MuzaCMS docs page is behind a Symfony form-login, so the skill needs credentials. The refresh script lives next to the skill (`plugins/<variant>/skills/mobilems-docs-reader/refresh-mobilems-api-spec.sh`) and caches fetches per Claude Code session (with an 8-hour TTL) — see [Caching](#caching) below for details.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@smartsoft001-mobilems/claude-plugins",
-  "version": "2.88.0",
+  "version": "2.90.0",
   "publishConfig": {
     "access": "public"
   },

package/plugins/mobilems/.claude-plugin/README.md

@@ -1,14 +1,33 @@
 # Mobilems Plugin for Claude Code
 
-MobileMS-specific skills for the MuzaCMS / MobileMS indexer API. This plugin is a thin complement to the generic `flow@smart-pro` workflow plugins — it provides skills that are tied to the MobileMS backend.
+MobileMS-specific skills: the museum app scaffolding suite plus the MuzaCMS / MobileMS indexer API reader. This plugin complements the generic `flow@smart-pro` workflow plugins — it provides the skills tied to the MobileMS backend and to the museum app architecture.
 
 ## Contents
 
+### Scaffolding
+
+Run order for a new museum app: `/smart:scaffold-nx-workspace` → `mobilems-project-init` → the feature skills (any order, any subset) → `mobilems-devops-config`.
+
+| Type | Name | Purpose |
+|------|------|---------|
+| Skill | `mobilems-project-init` | The MobilEMS foundation — deps, Tailwind, SSR + translations runtime, `app.config` providers, shared lib, static pages, app shell, `.claude`. Produces NO feature modules |
+| Skill | `mobilems-objects` | Museum objects module — `libs/museum-objects` (domain + shell/angular) + the `/obiekty` route |
+| Skill | `mobilems-object-collections` | Collections module — `libs/museum-collections` + the `/kolekcje` route |
+| Skill | `mobilems-articles` | A parametrized (NAME + TEMPLATE) article-backed content module; run once per content type |
+| Skill | `mobilems-thematic-publications` | Thematic paths — `libs/museum-thematic-paths` + the `/sciezki-tematyczne` route |
+| Skill | `mobilems-events` | Events + booking flow — `libs/museum-events` + the `/wydarzenia` route |
+| Skill | `mobilems-partners` | Partners — `libs/museum-partners` + the `/partnerzy` route |
+| Skill | `mobilems-devops-config` | The ops layer — Dockerfile, GitHub Actions, update tooling, `.env.dev`/lint/node, `.github` hygiene |
+
+Each of these opens with a **Framework first — MANDATORY** section pointing at the [Framework API index](https://github.com/smartsoft001/mobilems-framework/blob/main/README.md#-framework-api): reuse framework exports (`MasonryGridComponent`, `FiltersBaseComponent` / `FiltersContext`, `FileUrlService`, `SeoService`, …) rather than re-implementing them. Their bundled `scripts/verify-*.sh` fail the run on hand-rolled masonry grids and on filters that bypass `FiltersBaseComponent`.
+
+### API docs
+
 | Type | Name | Purpose |
 |------|------|---------|
 | Skill | `mobilems-docs-reader` | Answer questions about the MuzaCMS / MobileMS indexer OpenAPI spec; fetches a fresh copy via the bundled refresh script |
 
-The skill ships with `scripts/refresh-mobilems-api-spec.sh`, which logs into `https://develop-indexer.mobilems.pl` using `MOBILEMS_LOGIN` / `MOBILEMS_PASSWORD` (read from env or `.env`) and writes the spec to `shared-assets/mobilems-api.json` inside the installed package. The script caches the fetched spec per Claude Code session (8h TTL).
+That skill ships with `scripts/refresh-mobilems-api-spec.sh`, which logs into `https://develop-indexer.mobilems.pl` using `MOBILEMS_LOGIN` / `MOBILEMS_PASSWORD` (read from env or `.env`) and writes the spec to `shared-assets/mobilems-api.json` inside the installed package. The script caches the fetched spec per Claude Code session (8h TTL).
 
 ## Installation
 

package/plugins/mobilems/.claude-plugin/plugin.json

@@ -1,5 +1,5 @@
 {
   "name": "mobilems",
   "description": "MobilEMS-specific Claude Code skills (MuzaCMS / MobileMS indexer API)",
-  "version": "2.88.0"
+  "version": "2.90.0"
 }

package/plugins/mobilems/skills/mobilems-articles/SKILL.md

@@ -39,9 +39,33 @@ gave them). The first two are the essentials:
 
 Run `scripts/detect-init.sh <workspace-root>`. It confirms the MobilEMS foundation is present
 (`SharedModule.forRoot` in `app.config.ts`, a populated shared-lib barrel). If not, tell the user to
-run `/mobilems:project-init` first. Hold `<PREFIX>` (from `tsconfig.base.json`; reference uses `@msr`)
+run `/mobilems:project-init` first. Hold `<PREFIX>` (from `tsconfig.base.json`)
 and the reference repo path (same one init used).
 
+## Framework first — MANDATORY
+
+Read these before writing ANY component, service, pipe, directive or helper, and reuse what they
+list — re-implementing framework code is a defect, not a shortcut:
+
+0. [**The Framework API index**](https://github.com/smartsoft001/mobilems-framework/blob/main/README.md#-framework-api) — the map of every package to
+   its catalog. Start here when you do not already know which package owns what.
+1. The framework API catalog — `packages/shared/angular/README.md` in this repo, installed as
+   `node_modules/@smartsoft001-mobilems/angular/README.md` in a museum app ([browse](https://github.com/smartsoft001/mobilems-framework/blob/main/packages/shared/angular/README.md)).
+   This is the path `scripts/verify-module.sh` names when it fails.
+2. [`packages/articles/README.md`](https://github.com/smartsoft001/mobilems-framework/blob/main/packages/articles/README.md) — this module's package catalog
+3. `libs/shared/angular/README.md` — the app's own shared lib (built by `mobilems-project-init`)
+
+| Do not hand-roll                                             | Use                                                                                                                                               |
+| ------------------------------------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------- |
+| a masonry grid (`new Masonry(...)`, per-page masonry JS/CSS) | `<smart-mobilems-masonry-grid>` (`MasonryGridComponent`) with a `#masonryContentTpl`; the `Masonry` provider only feeds it                        |
+| filter state / hand-built `query` arrays                     | `FiltersBaseComponent<Article>` + its `FiltersContext` accessors (`searchText`, `authors`, `cycles`, `publicationDateFrom/To`, `page`, `sort`, …) |
+| list/detail plumbing (facade wiring, id-from-route, PDF)     | the `ArticlesListComponent` / `ArticlesItemComponent` base classes                                                                                |
+| media URLs, meta/OG tags, filter dictionaries, modals, WCAG  | `FileUrlService`, `SeoService`/`MetaService`, `DictionaryService`, `ModalService`, `WcagService`                                                  |
+| a content-block renderer                                     | `WidgetComponent` + the `ArticleWidgetType` map                                                                                                   |
+
+Anything the framework genuinely lacks goes into `libs/shared/angular` **once** (and into its
+README) — never a per-module copy. `scripts/verify-module.sh` fails the run on hand-rolled masonry.
+
 ## Steps
 
 1. **Gather the parameters** above. Ask for the **name** and **template** at minimum; default `route`
@@ -54,11 +78,16 @@ and the reference repo path (same one init used).
    Also add any **extra third-party packages the copied pages import** that aren't already in the
    workspace — e.g. the reference list page uses `lodash-decorators` (`@debounce`); grep the pages you
    copy for non-`@angular`/`@smartsoft001` imports and add the missing ones.
-3. **Library** — create `libs/museum-<name>/{domain,shell/angular}` per `references/lib-contents.md`:
-   the thin domain entity (`Museum<Name> extends Article`), the shell (`Museum<Name>Module`, routes,
-   `pages/{list,item}`, services, and — if the module keeps feature state — `+state/<name>.reducer.ts`),
-   threading `<PREFIX>` and the chosen name/entity. Add the two `tsconfig.base.json` paths
-   (`@<PREFIX>/museum-<name>/domain` + `/shell/angular`).
+3. **Library** — scaffold `libs/museum-news` with this package's Nx generator (deterministic — do
+   NOT copy files by hand when the generator is available):
+   ```bash
+   npx nx g @smartsoft001-mobilems/articles-shell-angular:museum-module \
+     --referenceRoot=<reference-repo> --prefix=<PREFIX>
+   ```
+   It copies the lib from the reference, threads `@<PREFIX>/`, adds both `tsconfig.base.json`
+   paths, normalizes `project.json` paths and copies the module's translation groups (pl+en).
+   Fallback (older framework line without the generator): do the same by hand per
+   `references/lib-contents.md`. For a NON-news article module (different `<name>`/entity), the generator's `news` output is the starting point — rename per `references/lib-contents.md` after generating, or fall back to the manual path entirely.
 4. **Module + route** — see `references/module-and-routes.md`: `Museum<Name>Module` wraps
    `ArticlesSharedModule.forFeature` with `type: Article`, the chosen `entity`, and
    `baseQuery: [{ key: 'template', value: '<template>', type: '=', hidden: true }]`, plus the `Masonry`
@@ -71,29 +100,32 @@ and the reference repo path (same one init used).
    and list cards (`<name>-grid-item`, `<name>-list-item`) in `libs/shared/angular` and export them; if
    the module renders article-gallery content blocks, also build the article gallery widget and register
    it in the widget content-type map (build once, idempotent across article modules).
-6. **Verify** — run `scripts/verify-module.sh <workspace-root> <PREFIX> <name> [template]`: asserts the
+6. **Translations** — copy the module's translation groups (`NEWS` + `ARTICLES` for the aktualności instance (override with `TRANS_GROUPS` when the module uses different groups)) from the reference
+   repo's `apps/web/public/translations.json` into the app's file, for BOTH `pl` and `en`.
+   Complete group = every reference key present; every key referenced in the module's code
+   must exist in both languages — a raw `GROUP.key` rendered in the UI is a defect.
+7. **Verify** — run `REF_ROOT=<reference-repo> scripts/verify-module.sh <workspace-root> <PREFIX> <name> [template]`: asserts the
    library exists, the `forFeature` carries the chosen `entity` (and template, if given), the route is
    registered, and the article card shared components are built and exported. Fix and re-run.
 
-## Known QA pitfalls (from live deployments — fix while copying, not after)
+## Known pitfalls (fix while copying, not after)
 
-Each of these was a real Linear bug on a museum project built with this skill (Ostrowiec MOB-962,
-Tomaszów MOB-957/993). The cross-cutting rules live in `mobilems-project-init`
-`references/qa-hardening.md`; these are the article-module-specific ones:
+The cross-cutting rules live in `mobilems-project-init` `references/qa-hardening.md`; these are the
+article-module-specific ones:
 
 - **Author filter dictionary key is lowercase `authors`.** `dictionaryKey="authors"` routes to
   `api/article/authors/...`; `"Author"` silently falls through to `api/dictionary/Author/...` →
-  HTTP 409 and an empty options list (one-character bug that shipped to QA).
-- **alt from CMS titles must strip HTML.** The detail header image shipped with
+  HTTP 409 and an empty options list.
+- **alt from CMS titles must strip HTML.** Otherwise the detail header image gets
   `alt="<p>Tytuł</p>"` — pipe the title through `smartRemoveHtml` before binding it to `alt`.
-- **Detail page structure:** an `h1` (article title — copied reference had only `h2`), breadcrumbs
-  (`/ Artykuły / {tytuł}`), and gallery image captions rendered as text, NOT `h3` (an `h1 → h3`
-  jump is a recurring axe-core finding).
-- **List item field order per mockup:** date ABOVE the title (implementations kept shipping it at
-  the bottom), keywords as inline links styled per the design, and mockup-exact sort labels
+- **Detail page structure:** an `h1` (article title — a copied reference may have only `h2`),
+  breadcrumbs (`/ Artykuły / {tytuł}`), and gallery image captions rendered as text, NOT `h3` (an
+  `h1 → h3` jump is an axe-core finding).
+- **List item field order per mockup:** date ABOVE the title, keywords as inline links styled per
+  the design, and mockup-exact sort labels
   ("Sortowanie: Od najnowszych", not "Sortuj: Data publikacji - od najnowszych").
-- **List spacing:** in list view the items need a real gap (`gap-4` fixed the "too close together"
-  QA bug).
+- **List spacing:** in list view the items need a real gap (`gap-4`); without it they read as one
+  block.
 - **Search debounce 250 ms** (`@debounce(250)`), total count + shared `NextPageComponent` on the
   list — consistent with objects/collections.
 - **Warning-clean templates:** remove needless `?.` on non-nullable signals (NG8107) and unused

package/plugins/mobilems/skills/mobilems-articles/references/module-and-routes.md

@@ -61,6 +61,30 @@ import { routes } from './<name>.routes';
 export class Museum<Name>Module {}
 ```
 
+> **The `Masonry` provider exists only to feed the framework's `MasonryGridComponent`.** It is DI
+> plumbing, not a grid — never call `new Masonry(...)`, keep a `MasonryInstance`, or re-implement the
+> layout/`reloadItems` dance in a page component. A hand-rolled CSS-grid or column layout is the same
+> defect. `scripts/verify-module.sh` fails the run on both.
+
+The list page renders the grid like this — copy this shape, it is the required one:
+
+```html
+<smart-mobilems-masonry-grid [list]="list()" [options]="{ gutter: 24 }">
+  <ng-template #masonryContentTpl>
+    <div class="masonry-grid-sizer"></div>
+    @for (item of list(); track item.id) {
+      <div class="masonry-item"><smart-<name>-grid-item [item]="item" /></div>
+    }
+  </ng-template>
+</smart-mobilems-masonry-grid>
+```
+
+`.masonry-grid-sizer` and `.masonry-item` are required — they are the component's default
+`columnWidth` / `itemSelector`. The card (shared-components.md) is the only module-specific part. Inputs,
+public methods and the SSR provider are documented in the framework catalog,
+[`packages/shared/angular/README.md`](https://github.com/smartsoft001/mobilems-framework/blob/main/packages/shared/angular/README.md#masonrygridcomponent)
+(installed as `node_modules/@smartsoft001-mobilems/angular/README.md`).
+
 The **`baseQuery`** is what scopes the module to its content: `key` is always `'template'`, `type` is
 `'='`, `hidden` is `true`, and `value` is the module's `<template>` (the API then returns only records
 matching that template). Change only the `value` between modules.

package/plugins/mobilems/skills/mobilems-articles/scripts/check-translations.js

@@ -0,0 +1,90 @@
+#!/usr/bin/env node
+/**
+ * check-translations.js "<GROUP GROUP …>" [reference-root]
+ *
+ * Run from the workspace root (verify-module.sh cd's there). Verifies the
+ * module's translation groups in apps/web/public/translations.json:
+ *   1. each group exists and is non-empty in BOTH pl and en,
+ *   2. every literal GROUP.* key referenced in libs/ or apps/web/src exists
+ *      in both languages (dead references = defect),
+ *   3. with a reference root: every reference key of the group exists in the
+ *      generated file — missing keys are listed (the module is incomplete).
+ * Prints PASS/FAIL lines in the verify-module.sh idiom; exit 1 on any FAIL.
+ */
+const fs = require("fs");
+
+const [groupsArg, refRoot] = process.argv.slice(2);
+const groups = (groupsArg || "").split(/\s+/).filter(Boolean);
+if (!groups.length) { console.log("  FAIL: no translation groups given"); process.exit(1); }
+
+const TRANS = "apps/web/public/translations.json";
+let fail = 0;
+const pass = (m) => console.log(`  PASS: ${m}`);
+const bad = (m) => { console.log(`  FAIL: ${m}`); fail = 1; };
+
+const flat = (obj, prefix) => Object.entries(obj || {}).flatMap(([k, v]) =>
+  v && typeof v === "object" ? flat(v, `${prefix}.${k}`) : [`${prefix}.${k}`]);
+
+const readTrans = (p) => { try { return JSON.parse(fs.readFileSync(p, "utf8")).data.translations; } catch { return null; } };
+
+const gen = readTrans(TRANS);
+if (!gen) { bad(`cannot read ${TRANS}`); process.exit(1); }
+
+// 1. groups present + non-empty in both languages
+const genKeys = { pl: new Set(), en: new Set() };
+for (const lang of ["pl", "en"]) {
+  for (const g of groups) {
+    const keys = flat(gen[lang]?.[g], g);
+    keys.forEach((k) => genKeys[lang].add(k));
+    if (keys.length) pass(`${g} present in ${lang} (${keys.length} keys)`);
+    else bad(`${g} missing or empty in ${lang}`);
+  }
+}
+
+// 2. dead references — literal GROUP.* keys used in sources must exist.
+// Dynamic tails (`GROUP.${x}`) don't match the literal regex, and a matched
+// PREFIX that is a parent of existing keys counts as present.
+const walk = (dir) => {
+  let out = [];
+  for (const e of fs.readdirSync(dir, { withFileTypes: true })) {
+    if (e.name === "node_modules" || e.name.startsWith(".")) continue;
+    const p = `${dir}/${e.name}`;
+    if (e.isDirectory()) out = out.concat(walk(p));
+    else if (/\.(ts|html)$/.test(e.name)) out.push(p);
+  }
+  return out;
+};
+let src = "";
+for (const d of ["libs", "apps/web/src"]) {
+  if (fs.existsSync(d)) src += walk(d).map((f) => { try { return fs.readFileSync(f, "utf8"); } catch { return ""; } }).join("\n");
+}
+const re = new RegExp(`\\b(?:${groups.join("|")})(?:\\.[A-Za-z0-9_]+)+`, "g");
+const used = new Set(src.match(re) || []);
+const dead = { pl: [], en: [] };
+for (const key of used) {
+  for (const lang of ["pl", "en"]) {
+    const ks = genKeys[lang];
+    if (!ks.has(key) && ![...ks].some((k) => k.startsWith(`${key}.`))) dead[lang].push(key);
+  }
+}
+for (const lang of ["pl", "en"]) {
+  if (dead[lang].length) bad(`${lang}: keys referenced in code but missing in ${TRANS}: ${dead[lang].slice(0, 8).join(", ")}${dead[lang].length > 8 ? ` (+${dead[lang].length - 8})` : ""}`);
+  else pass(`no dead ${lang} references (${used.size} literal keys checked)`);
+}
+
+// 3. completeness vs reference
+if (refRoot) {
+  const ref = readTrans(`${refRoot}/apps/web/public/translations.json`);
+  if (!ref) bad(`cannot read reference translations under ${refRoot}`);
+  else {
+    for (const lang of ["pl", "en"]) {
+      const missing = groups.flatMap((g) => flat(ref[lang]?.[g], g)).filter((k) => !genKeys[lang].has(k));
+      if (missing.length) bad(`${lang}: ${missing.length} reference keys missing: ${missing.slice(0, 8).join(", ")}${missing.length > 8 ? " …" : ""}`);
+      else pass(`${lang}: all reference keys covered`);
+    }
+  }
+} else {
+  console.log("  SKIP: no reference root given — completeness vs reference not checked");
+}
+
+process.exit(fail);

package/plugins/mobilems/skills/mobilems-articles/scripts/verify-module.sh

@@ -11,6 +11,7 @@ ROOT="${1:?usage: verify-module.sh <workspace-root> <PREFIX> <name> [template]}"
 PREFIX="${2:?usage: verify-module.sh <workspace-root> <PREFIX> <name> [template]}"
 NAME="${3:?usage: verify-module.sh <workspace-root> <PREFIX> <name> [template]}"
 TEMPLATE="${4:-}"
+SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
 cd "$ROOT" 2>/dev/null || { echo "ERROR: no such dir: $ROOT" >&2; exit 2; }
 
 LIBF="museum-$NAME"
@@ -56,6 +57,58 @@ for p in articles-domain articles-shell-angular articles-shell-dtos; do
   grep -q "@smartsoft001-mobilems/$p" package.json && pass "$p dep" || bad "$p dep missing"
 done
 
+echo "== Framework first (packages/shared/angular/README.md) =="
+LIBDIR="libs/$LIBF/shell/angular/src/lib"
+# 1. masonry belongs to the framework's MasonryGridComponent — no module-level instances
+MAS="$(grep -rlnE "new Masonry\(|MasonryInstance" libs apps/web/src 2>/dev/null || true)"
+if [ -n "$MAS" ]; then
+  bad "hand-rolled masonry — render grids with <smart-mobilems-masonry-grid> (MasonryGridComponent):"
+  printf '        %s\n' $MAS >&2
+else
+  pass "no hand-rolled masonry instances"
+fi
+# 2. the Masonry provider exists ONLY to feed MasonryGridComponent. Providing it without ever
+#    rendering the component means the grid was hand-rolled some other way (CSS columns, flex, …),
+#    which the `new Masonry(` grep above cannot see.
+if grep -rq "provide: Masonry" "$LIBDIR" 2>/dev/null; then
+  if grep -rq "smart-mobilems-masonry-grid" "$LIBDIR" 2>/dev/null; then
+    pass "grids render via <smart-mobilems-masonry-grid>"
+  else
+    bad "module provides Masonry but never renders <smart-mobilems-masonry-grid> — hand-rolled grid"
+  fi
+fi
+# 3. a list page must render through the framework grid
+LISTP="$(find "$LIBDIR/pages" -maxdepth 1 -type d -name 'list*' 2>/dev/null || true)"
+if [ -n "$LISTP" ]; then
+  if grep -rq "smart-mobilems-masonry-grid" $LISTP 2>/dev/null; then
+    pass "list page renders via <smart-mobilems-masonry-grid>"
+  else
+    bad "list page does not render <smart-mobilems-masonry-grid> (README.md#masonrygridcomponent)"
+  fi
+fi
+# 4. filters must EXTEND the framework base class — `context.` alone proves nothing, and a
+#    differently-named dir must not silently skip the check
+FILT="$(find "$LIBDIR/components" -maxdepth 1 -type d \( -name 'filters*' -o -name 'search*' -o -name 'facet*' \) 2>/dev/null || true)"
+if [ -n "$FILT" ]; then
+  if grep -rqE "FiltersBaseComponent" $FILT 2>/dev/null; then
+    pass "filters use the framework filter API"
+  else
+    bad "filters do not extend FiltersBaseComponent — no ad-hoc query building:"
+    printf '        %s\n' $FILT >&2
+  fi
+else
+  pass "no filters component in this module"
+fi
+
+echo "== Translations (REF_ROOT=${REF_ROOT:-unset}) =="
+# Groups: present in pl+en, no dead references, complete vs the reference repo
+# (export REF_ROOT=<reference-repo-root> to enable the completeness diff).
+if node "$SCRIPT_DIR/check-translations.js" "${TRANS_GROUPS:-NEWS ARTICLES}" "${REF_ROOT:-}"; then
+  pass "translation groups complete"
+else
+  bad "translation gaps — fix the FAIL lines above"
+fi
+
 echo
 if [ "$fail" = 0 ]; then echo "VERIFY: all checks passed."; else echo "VERIFY: FAILED — fix the items above and re-run." >&2; fi
 exit "$fail"

package/plugins/mobilems/skills/mobilems-devops-config/SKILL.md

@@ -0,0 +1,141 @@
+---
+name: mobilems-devops-config
+description: Configure the ops / deployment layer of a MobilEMS museum web-app — Dockerfile, GitHub Actions CI/CD (development, e2e, push-to-client, ai-plan, ai-impl, cached-deps action), dependency-update tooling (tools/scripts/update.js + npm "update"), env/lint/node config (.env.dev, .eslintignore, .nvmrc), and .github hygiene (removing or relocating skills/agents/prompts that scaffolding left in .github). Use whenever the user wants to add / scaffold / fill in Docker, CI/CD, GitHub Actions, the deployment pipeline, or update tooling for a museum app, "skonfiguruj docker / github actions / ci dla projektu muzealnego", or bring an existing museum app's ops config up to standard. Idempotent — creates what's missing, reports drift, never silently overwrites. Requires the MobilEMS foundation (mobilems-project-init) to exist first. Does NOT touch SSR / translations / app.config (project-init's job) or feature modules.
+user-invocable: true
+allowed-tools: Bash, Read, Write, Edit, Glob, Grep, AskUserQuestion
+---
+
+# MobilEMS devops config
+
+Install the MobilEMS museum app **ops / deployment layer** — the configuration that lives outside
+the Angular app code: the Docker image, the GitHub Actions CI/CD pipeline, the dependency-update
+tooling, and the env / lint / node-version files. This is the layer that `scaffold-nx-workspace`
+(the generic Nx toolchain) and `mobilems-project-init` (the app-runtime foundation) leave out.
+
+This skill is **self-contained**: the canonical file contents live in `references/` and are
+written directly, so it works on a brand-new museum app (e.g. Łowicz) with no reference repo
+present. It is also **idempotent and additive** — it creates what is missing and, when a file
+already exists but differs from the canonical template, it reports the drift and asks before
+overwriting. It never silently clobbers a customized file.
+
+## Scope
+
+**In scope (this skill):**
+
+- `apps/web/Dockerfile` (+ a recommended `.dockerignore`)
+- `.github/workflows/`: `development.yml`, `e2e.yml`, `push-to-client.yml`, `ai-plan.yml`,
+  `ai-impl.yml`, `ci.yml.disabled`, and the `.github/actions/cached-deps/action.yml` composite
+- `.github` hygiene — agent config (`skills/`, `agents/`, `prompts/`, …) does not belong in
+  `.github`; this skill removes or relocates it
+- `tools/scripts/update.js` + the `package.json` `update` / `postinstall` scripts
+- `.env.dev`, `.eslintignore`, `.nvmrc` — and aligning the node version across `.nvmrc`,
+  `Dockerfile`, and the workflows
+
+**Out of scope (handled elsewhere):**
+
+- SSR (`server.ts`, `/env.js`, `/api/translations`), translations runtime, Tailwind, and
+  `app.config.ts` — these belong to **`mobilems-project-init`**. This skill only _verifies_ they
+  exist (precondition) and tells the user to run project-init if they don't.
+- Feature modules — the `mobilems-<module>` skills.
+- The companion **`<project>-deploy`** Kubernetes repo (scaffolded separately from
+  `mobilems-muzeum-template-deploy`). Mention it as a follow-up; do not create it here.
+
+## Steps
+
+### 0. Precondition — confirm a MobilEMS foundation
+
+Run `scripts/detect-foundation.sh <workspace-root>`. It checks this is a MobilEMS museum app:
+`apps/web` exists, SSR is set up (`apps/web/src/server.ts` with `/api/translations`),
+`@smartsoft001-mobilems/*` is in `package.json`, and `apps/web/public/translations.json` exists.
+If the SSR / translations foundation is missing, **stop** and tell the user to run
+`/mobilems:mobilems-project-init` first — this skill only adds the ops layer on top.
+
+### 1. Collect parameters (`AskUserQuestion`, with smart defaults)
+
+- **Node version** — default to the existing `.nvmrc` if present; otherwise read the node version
+  already used in `apps/web/Dockerfile` / workflows; otherwise prompt (fall back to the team
+  standard `24.5.0`). This one value threads into `.nvmrc`, the Dockerfile base image, and every
+  workflow's `node-version`.
+- **`.env.dev` values** — `API_URL`, `SITE_URL`, `MULTIMEDIA_URL` (and `APP_VERSION`). Read them
+  from an existing `.env` / `.env.dev`, or from `apps/web/src/environments/environment.prod.ts`
+  (`apiUrl` / `multimediaUrl`), or prompt. Never invent client URLs silently.
+
+### 2. Docker
+
+Per `references/docker.md`: write `apps/web/Dockerfile`, threading the node version into the base
+image (`node:<version>-alpine`). Add the recommended `.dockerignore` (the reference repo has none,
+but it keeps the buildx context small). If a Dockerfile already exists and differs, show a diff and
+ask before overwriting.
+
+### 3. GitHub Actions
+
+Per `references/workflows.md`: write each workflow and the composite action, threading the node
+version:
+
+- `.github/workflows/development.yml` — build + Docker buildx push to `dockerregistry.mobilems.pl`
+  - auto-commit/tag + dispatch `deploy.yml` to the deploy repo.
+- `.github/workflows/e2e.yml` — Playwright (chromium + webkit) + report artifact.
+- `.github/workflows/push-to-client.yml` — GitLab mirror push + OpenVPN + SSH `docker stack deploy`.
+- `.github/workflows/ai-plan.yml` / `ai-impl.yml` — call the shared
+  `smartsoft001/github-actions-shared` reusable workflows.
+- `.github/workflows/ci.yml.disabled` — Nx-Cloud lint/test/build/e2e template, kept disabled.
+- `.github/actions/cached-deps/action.yml` — composite: setup-node + cache `node_modules` + `npm ci`.
+
+Then **print the required GitHub secrets table** from `references/workflows.md` (GitLab registry,
+deploy dispatch, OpenVPN/SSH, Claude/Linear). These are configured in the repo's Actions settings,
+**never** committed.
+
+For each existing-but-divergent workflow (e.g. a stale Node-20 `ci.yml`), report it and ask before
+overwriting — do not silently replace a workflow the team may have customized.
+
+### 3b. `.github` hygiene — nothing but GitHub config in `.github`
+
+Per `references/github-hygiene.md`: `.github/skills/`, `.github/agents/`, `.github/prompts/`,
+`.github/instructions/`, `.github/chatmodes/` and `.github/copilot-instructions.md` are scaffolding
+leftovers in the Copilot layout — agent config targets the Claude Code architecture and belongs under
+`.claude/` (`skills/`, `agents/`, `commands/`, `settings.json`). Classify each entry, then:
+
+- **delete** what duplicates a plugin already enabled in `.claude/settings.json` — the whole `nx-*`
+  family and `monitor-ci` come from `nx@nx-claude-plugins`;
+- **move** anything genuinely project-specific into `.claude/` (`skills/`, `agents/`, `commands/`)
+  with `git mv`;
+- keep `workflows/`, `actions/` and GitHub's own metadata.
+
+Always show the delete/move plan and **ask before deleting**. Report what was removed or relocated in
+the final summary.
+
+### 4. Update tooling
+
+Per `references/tooling.md`: write `tools/scripts/update.js`; ensure `package.json` has
+`"update": "node ./tools/scripts/update.js"` and `"postinstall": "husky install"` (merge into the
+existing `scripts` block — do not drop existing scripts).
+
+### 5. Env / lint / node
+
+Per `references/env-and-lint.md`: write `.env.dev` (with the collected URLs), `.eslintignore`, and
+`.nvmrc`. Confirm the node version is identical across `.nvmrc`, `apps/web/Dockerfile`, and all
+workflows; fix any mismatch.
+
+### 6. Verify
+
+Run `scripts/verify-devops.sh <workspace-root> <NODE_VERSION>`. It asserts every artifact landed and
+that the node version is consistent across `.nvmrc` / Dockerfile / workflows. Fix and re-run until it
+passes. Print a final summary of what was **created** vs **already present** vs **drift reported**.
+Gate `npm install` behind an explicit ask — skip it during self-validation / eval.
+
+### 7. Follow-up note
+
+Remind the user that production deployment also needs the companion **`<project>-deploy`** repo
+(Kubernetes/Kustomize, from `mobilems-muzeum-template-deploy`) and the GitHub secrets from step 3 —
+both are separate, manual follow-ups outside this skill.
+
+## Notes
+
+- Docker-only deployment (no nginx / docker-compose); SSR served by `node server/server.mjs` on
+  port 80.
+- All client-specific values stay as **GitHub Actions secrets** — the workflow files contain only
+  `${{ secrets.* }}` references, never literals.
+- Bundled `references/` + `scripts/` ship automatically (the whole `src/plugins/**` tree is copied
+  to dist). Do NOT hand-edit `plugin.json` — the version is auto-synced at build.
+- Run order for a fresh app: `/smart:scaffold-nx-workspace` → `/mobilems:mobilems-project-init` →
+  feature skills → **`/mobilems:mobilems-devops-config`**.

package/plugins/mobilems/skills/mobilems-devops-config/references/docker.md

@@ -0,0 +1,58 @@
+# Docker
+
+Docker-only deployment (no nginx, no docker-compose). The image runs the Angular SSR server
+(`node server/server.mjs`) on port 80. The application is built in CI **before** the image is
+built; the Dockerfile only installs production deps and copies the prebuilt `dist/apps/web`.
+
+`{{NODE_VERSION}}` = the node version collected in step 1 (default from `.nvmrc`, else the team
+standard `24.5.0`). Keep it identical to `.nvmrc` and the workflows.
+
+## `apps/web/Dockerfile`
+
+```dockerfile
+FROM node:{{NODE_VERSION}}-alpine
+
+# Set working directory
+WORKDIR /app
+
+# Copy package files and install production dependencies
+COPY package.json package-lock.json ./
+RUN npm ci --omit=dev --ignore-scripts
+
+# Copy the built application from dist folder (already built in CI)
+COPY dist/apps/web ./
+
+# Build argument for version
+ARG VERSION
+ENV VERSION=$VERSION
+
+# Set environment variables
+ENV NODE_ENV=production
+ENV PORT=80
+
+# Expose the application port
+EXPOSE 80
+
+# Start the SSR server
+CMD ["node", "server/server.mjs"]
+```
+
+## `.dockerignore` (recommended — the reference repo has none)
+
+The `development.yml` build context is the whole repo (`docker buildx build ... .`). The Dockerfile
+only `COPY`s `package*.json` and `dist/apps/web`, so a `.dockerignore` doesn't change the image, but
+it keeps the build context small/fast. Add it unless the team objects:
+
+```gitignore
+node_modules
+.git
+.github
+.nx
+.angular
+coverage
+dist/.playwright
+**/*.spec.ts
+*.log
+```
+
+Note: do **not** ignore `dist/` — the build context must include `dist/apps/web`.