codebyplan 1.5.1 → 1.9.0

package/templates/skills/cbp-ship/reference/versioning.md

@@ -0,0 +1,116 @@
+# Versioning Rules
+
+How `/cbp-ship` decides which version a surface ships at.
+
+## Three modes (per surface, configured per-package)
+
+| Mode | Trigger | Best for |
+|---|---|---|
+| `manual` | User bumps `package.json` / `tauri.conf.json` / `app.json` version themselves before checkpoint shipment | Apps with infrequent releases; small teams |
+| `release-please` | GH Actions opens version-bump PRs based on conventional commit messages on the watched branch; merge the PR before shipment | npm packages with frequent releases; multi-contributor repos |
+| `changesets` | Devs add `.changeset/*.md` entries in feature branches; an aggregator PR collects them | Monorepos with many independent packages |
+
+Mode is set per-surface in `.codebyplan/shipment.json`:
+
+```json
+{
+  "surfaces": {
+    "npm-package": {
+      "packages/codebyplan-package": { "versioning": "release-please" }
+    },
+    "tauri-desktop": { "versioning": "manual" },
+    "expo-mobile": { "versioning": "auto-build-number" }
+  }
+}
+```
+
+## Auto-bumping where possible
+
+These bumps happen automatically — never user-prompted:
+
+| Surface | Field | Bump rule |
+|---|---|---|
+| `expo-mobile` | `expo.ios.buildNumber` | `eas.json` `autoIncrement: "buildNumber"` — handled by EAS |
+| `expo-mobile` | `expo.android.versionCode` | `eas.json` `autoIncrement: "versionCode"` — handled by EAS |
+| `vercel-web` | n/a | Vercel uses commit SHA; no semver bump needed |
+
+## Semver bump rules (manual or release-please modes)
+
+When the orchestrator detects a version change is needed but mode is `manual`, it suggests a bump based on commit messages since the last release:
+
+| Commit message pattern | Suggested bump |
+|---|---|
+| Has `BREAKING CHANGE:` in footer OR `feat!:`/`fix!:` prefix | major |
+| Any `feat:` prefix | minor |
+| Otherwise | patch |
+
+The user can override the suggestion. The orchestrator NEVER auto-bumps without confirmation in `manual` mode.
+
+## release-please conventions
+
+Conventional Commits are the trigger:
+
+| Prefix | Action |
+|---|---|
+| `feat:` | Minor bump in next release-please PR |
+| `fix:` | Patch bump |
+| `feat!:` / `fix!:` / `BREAKING CHANGE:` | Major bump |
+| `chore:`, `docs:`, `refactor:`, `test:`, `style:`, `perf:`, `ci:` | No bump |
+
+The release-please workflow lives at `.github/workflows/release-please.yml` (scaffolded by `/cbp-ship-configure`).
+
+## changesets conventions
+
+A changeset is a markdown file describing the change:
+
+```markdown
+---
+"@scope/pkg-a": minor
+"@scope/pkg-b": patch
+---
+
+Add new export `foo` and fix bug in `bar`.
+```
+
+Changesets are committed alongside feature work. The aggregator PR (`changeset-release/main`) collects pending changesets and bumps versions when merged.
+
+`/cbp-ship-configure` scaffolds `.changeset/config.json` and the GH Actions workflow.
+
+## Pre-release versions
+
+When the version contains a pre-release identifier (`-alpha.N`, `-beta.N`, `-rc.N`), the surface deploy uses the appropriate dist-tag:
+
+| Surface | Pre-release handling |
+|---|---|
+| `npm-package` | `npm publish --tag <pre-id>` (never promotes to `latest`) |
+| `vscode-ext` | `vsce publish --pre-release` |
+| `tauri-desktop` | Tag pushed normally; users opt into pre-release via Tauri config |
+| `expo-mobile` | TestFlight internal/external groups handle pre-release semantics naturally |
+| `vercel-web` | Use Vercel preview branches for pre-release URLs |
+
+## Coordinated bumps in monorepos
+
+When multiple surfaces ship together, bumps may need to coordinate:
+
+- **Tauri desktop bump → updater manifest** — desktop bump triggers a `latest.json` update; users get prompted at next launch. Only push tauri tag at planned release boundaries.
+- **npm package bump → consumer apps' `pnpm.overrides`** — if a sibling package consumes the bumped one, decide if you want apps pinned to the prior version (no override change) or rolled forward (override updated).
+- **Mobile build number auto-increment** — EAS bumps independently; the user-facing `expo.version` (semver) is bumped only when the user explicitly changes it.
+
+## What NOT to do
+
+- Don't manually edit `package.json` version inside `/cbp-ship` — versioning happens before shipment, not during
+- Don't auto-bump in `manual` mode without confirmation — the user owns the bump
+- Don't squash changeset commits — release-please / changesets need each conventional commit visible
+- Don't tag a Tauri release before the version commit is on PRODUCTION branch — the tag locks the shipped version
+
+## Decision: which mode to pick when configuring a new surface
+
+| Question | If yes |
+|---|---|
+| Is this an npm package with multiple authors? | release-please |
+| Is this a monorepo with 3+ published packages? | changesets |
+| Is this a single app with infrequent releases? | manual |
+| Is this a mobile app? | manual for semver + auto for build numbers |
+| Is this Tauri desktop? | manual (tags drive the release) |
+| Is this VS Code extension? | manual |
+| Is this Vercel web? | n/a — Vercel uses SHA not semver |

package/templates/skills/cbp-ship/scripts/detect-surfaces.sh

@@ -0,0 +1,217 @@
+#!/usr/bin/env bash
+# Detect shipment surfaces in the current repo.
+# Emits JSON to stdout: { "surfaces": [ { id, instance, configured, reason } ] }
+# Usage: detect-surfaces.sh [--filter=<id>]
+
+set -euo pipefail
+
+REPO_ROOT="$(git rev-parse --show-toplevel 2>/dev/null || pwd)"
+cd "$REPO_ROOT"
+
+FILTER=""
+for arg in "$@"; do
+  case "$arg" in
+    --filter=*) FILTER="${arg#--filter=}" ;;
+  esac
+done
+
+# Load shipment config from .codebyplan/shipment.json (if present)
+DISABLED_JSON="[]"
+SURFACES_JSON="{}"
+if [ -f .codebyplan/shipment.json ]; then
+  DISABLED_JSON=$(jq -r '.disabled // [] | tostring' .codebyplan/shipment.json 2>/dev/null || echo "[]")
+  SURFACES_JSON=$(jq -r '.surfaces // {} | tostring' .codebyplan/shipment.json 2>/dev/null || echo "{}")
+fi
+
+is_disabled() {
+  local id="$1"
+  echo "$DISABLED_JSON" | jq -e --arg id "$id" 'index($id)' >/dev/null 2>&1
+}
+
+emit() {
+  # Emit one JSON line per surface; we'll wrap in array at end
+  local id="$1" instance="$2" configured="$3" reason="$4"
+  if [ -n "$FILTER" ] && [ "$FILTER" != "$id" ]; then
+    return
+  fi
+  if is_disabled "$id"; then
+    return
+  fi
+  jq -nc \
+    --arg id "$id" --arg instance "$instance" \
+    --argjson configured "$configured" --arg reason "$reason" \
+    '{id: $id, instance: $instance, configured: $configured, reason: $reason}'
+}
+
+# ============ vercel-web ============
+detect_vercel() {
+  # Look at every package.json and decide if it's a web app
+  while IFS= read -r pkg; do
+    local app_path
+    app_path=$(dirname "$pkg")
+    [ "$app_path" = "." ] && continue
+    [[ "$app_path" =~ /node_modules/ ]] && continue
+
+    # Has Next or is explicitly Vercel-flagged?
+    local has_next has_vercel_json has_vercel_link
+    has_next=$(jq -e '.dependencies.next // .devDependencies.next' "$pkg" >/dev/null 2>&1 && echo y || echo n)
+    has_vercel_json=$([ -f "$app_path/vercel.json" ] && echo y || echo n)
+    has_vercel_link=$([ -f "$app_path/.vercel/project.json" ] && echo y || echo n)
+
+    if [ "$has_next" = "y" ] || [ "$has_vercel_json" = "y" ] || [ "$has_vercel_link" = "y" ]; then
+      if [ "$has_vercel_link" = "y" ]; then
+        emit "vercel-web" "$app_path" true "vercel.json + .vercel/project.json present"
+      else
+        emit "vercel-web" "$app_path" false "Next.js detected but .vercel/project.json missing — run /cbp-ship-configure"
+      fi
+    fi
+  done < <(find apps -maxdepth 3 -name package.json 2>/dev/null; [ -f package.json ] && echo "./package.json")
+}
+
+# ============ expo-mobile ============
+detect_expo() {
+  while IFS= read -r app; do
+    local app_path
+    app_path=$(dirname "$app")
+    [[ "$app_path" =~ /node_modules/ ]] && continue
+
+    local has_eas
+    has_eas=$([ -f "$app_path/eas.json" ] && echo y || echo n)
+
+    if [ "$has_eas" = "y" ]; then
+      emit "expo-mobile" "$app_path" true "app.json + eas.json present"
+    else
+      emit "expo-mobile" "$app_path" false "app.json present but eas.json missing — run /cbp-ship-configure"
+    fi
+  done < <(find . -maxdepth 4 -name "app.json" -not -path "*/node_modules/*" 2>/dev/null \
+    | xargs -I{} sh -c 'jq -e ".expo" "{}" >/dev/null 2>&1 && echo "{}"' 2>/dev/null)
+}
+
+# ============ tauri-desktop ============
+detect_tauri() {
+  while IFS= read -r conf; do
+    local app_path
+    app_path=$(dirname "$(dirname "$conf")")
+    [[ "$app_path" =~ /node_modules/ ]] && continue
+
+    local has_workflow
+    has_workflow=$(find .github/workflows -maxdepth 1 -name "*.yml" 2>/dev/null \
+      | xargs grep -l "tauri-action" 2>/dev/null | head -1)
+
+    if [ -n "$has_workflow" ]; then
+      emit "tauri-desktop" "$app_path" true "src-tauri/ + tauri-action workflow present"
+    else
+      emit "tauri-desktop" "$app_path" false "src-tauri/ present but no release workflow — run /cbp-ship-configure"
+    fi
+  done < <(find . -maxdepth 4 -name "tauri.conf.json" -not -path "*/node_modules/*" -not -path "*/target/*" 2>/dev/null)
+}
+
+# ============ npm-package ============
+detect_npm() {
+  while IFS= read -r pkg; do
+    local pkg_path
+    pkg_path=$(dirname "$pkg")
+    [ "$pkg_path" = "." ] && continue
+    [[ "$pkg_path" =~ /node_modules/ ]] && continue
+    [[ "$pkg_path" =~ ^./apps/ ]] && continue  # apps don't publish
+
+    local is_private name
+    is_private=$(jq -r '.private // false' "$pkg")
+    name=$(jq -r '.name // ""' "$pkg")
+
+    [ "$is_private" = "true" ] && continue
+    [ -z "$name" ] && continue
+
+    emit "npm-package" "$pkg_path" true "publishable package: $name"
+  done < <(find packages -maxdepth 2 -name package.json 2>/dev/null)
+}
+
+# ============ vscode-ext ============
+detect_vscode() {
+  while IFS= read -r pkg; do
+    local pkg_path
+    pkg_path=$(dirname "$pkg")
+    [[ "$pkg_path" =~ /node_modules/ ]] && continue
+
+    local has_engine has_publisher
+    has_engine=$(jq -e '.engines.vscode' "$pkg" >/dev/null 2>&1 && echo y || echo n)
+    has_publisher=$(jq -e '.publisher' "$pkg" >/dev/null 2>&1 && echo y || echo n)
+
+    if [ "$has_engine" = "y" ] && [ "$has_publisher" = "y" ]; then
+      emit "vscode-ext" "$pkg_path" true "engines.vscode + publisher set"
+    elif [ "$has_engine" = "y" ]; then
+      emit "vscode-ext" "$pkg_path" false "engines.vscode set but publisher missing — run /cbp-ship-configure"
+    fi
+  done < <(find apps packages -maxdepth 3 -name package.json 2>/dev/null)
+}
+
+# ============ railway-backend ============
+detect_railway() {
+  # Direct signal: railway config
+  while IFS= read -r conf; do
+    local app_path
+    app_path=$(dirname "$conf")
+    [[ "$app_path" =~ /node_modules/ ]] && continue
+    emit "railway-backend" "$app_path" true "railway.toml/json present"
+  done < <(find . -maxdepth 4 \( -name "railway.toml" -o -name "railway.json" \) -not -path "*/node_modules/*" 2>/dev/null)
+
+  # Indirect: Dockerfile + non-frontend package.json
+  while IFS= read -r dockerfile; do
+    local app_path
+    app_path=$(dirname "$dockerfile")
+    [[ "$app_path" =~ /node_modules/ ]] && continue
+    [ -f "$app_path/railway.toml" ] || [ -f "$app_path/railway.json" ] && continue  # already emitted above
+
+    local pkg="$app_path/package.json"
+    [ -f "$pkg" ] || continue
+    local is_frontend
+    is_frontend=$(jq -e '.dependencies.next // .dependencies."react-native" // .dependencies.expo' "$pkg" >/dev/null 2>&1 && echo y || echo n)
+    [ "$is_frontend" = "y" ] && continue
+
+    emit "railway-backend" "$app_path" false "Dockerfile present but Railway not linked — run /cbp-ship-configure"
+  done < <(find . -maxdepth 3 -name "Dockerfile" -not -path "*/node_modules/*" 2>/dev/null)
+}
+
+# ============ supabase ============
+detect_supabase() {
+  if [ -d supabase/migrations ] || find apps -maxdepth 3 -type d -name "supabase" 2>/dev/null | head -1 | grep -q .; then
+    local migration_dir
+    if [ -d supabase/migrations ]; then
+      migration_dir="supabase/migrations"
+    else
+      migration_dir=$(find apps -maxdepth 3 -type d -path "*/supabase/migrations" | head -1)
+    fi
+
+    [ -z "$migration_dir" ] && return
+
+    # Pending count = files newer than last_shipped_migration_version
+    local last_version pending_count
+    last_version=$(echo "$SURFACES_JSON" | jq -r '."supabase".last_shipped_migration_version // ""' 2>/dev/null)
+    if [ -n "$last_version" ]; then
+      pending_count=$(find "$migration_dir" -name "*.sql" -newer "$migration_dir/$last_version" 2>/dev/null | wc -l | tr -d ' ')
+    else
+      pending_count=$(find "$migration_dir" -name "*.sql" 2>/dev/null | wc -l | tr -d ' ')
+    fi
+
+    if [ "$pending_count" -gt 0 ]; then
+      local has_link
+      has_link=$([ -f supabase/.temp/project-ref ] && echo y || echo n)
+      if [ "$has_link" = "y" ]; then
+        emit "supabase" "$migration_dir" true "$pending_count migrations pending"
+      else
+        emit "supabase" "$migration_dir" false "$pending_count migrations but project not linked — run /cbp-ship-configure"
+      fi
+    fi
+  fi
+}
+
+# ============ Run all detectors and wrap in array ============
+{
+  detect_vercel
+  detect_expo
+  detect_tauri
+  detect_npm
+  detect_vscode
+  detect_railway
+  detect_supabase
+} | jq -s '{surfaces: .}'

package/templates/skills/cbp-ship/scripts/verify-expo-eas.sh

@@ -0,0 +1,35 @@
+#!/usr/bin/env bash
+# Verify an EAS build + submission landed.
+# Usage: verify-expo-eas.sh <build-id> [<submission-platform>]
+# Exit: 0 ok, 1 fail, 2 verification_pending
+
+set -euo pipefail
+BUILD_ID="$1"
+PLATFORM="${2:-ios}"
+
+STATUS=$(eas build:view "$BUILD_ID" --json 2>/dev/null | jq -r '.status // "UNKNOWN"')
+
+case "$STATUS" in
+  FINISHED)
+    SUBMISSION=$(eas submit:list --status finished --json 2>/dev/null \
+      | jq -r --arg b "$BUILD_ID" '.[] | select(.buildId == $b) | .status' | head -1)
+    if [ "$SUBMISSION" = "finished" ]; then
+      echo "OK build=$BUILD_ID submission=finished"
+      exit 0
+    fi
+    echo "PENDING: build done; submission=$SUBMISSION (TestFlight/Play processing)"
+    exit 2
+    ;;
+  IN_QUEUE|IN_PROGRESS)
+    echo "PENDING: $STATUS"
+    exit 2
+    ;;
+  ERRORED|CANCELED)
+    echo "FAIL: build $STATUS"
+    exit 1
+    ;;
+  *)
+    echo "PENDING: unknown state $STATUS"
+    exit 2
+    ;;
+esac

package/templates/skills/cbp-ship/scripts/verify-npm.sh

@@ -0,0 +1,21 @@
+#!/usr/bin/env bash
+# Verify an npm package version is published.
+# Usage: verify-npm.sh <package-name> <version>
+# Exit: 0 ok, 1 fail
+
+set -euo pipefail
+PKG="$1"
+VERSION="$2"
+
+RESOLVED=$(npm view "$PKG@$VERSION" version 2>/dev/null || echo "")
+[ "$RESOLVED" = "$VERSION" ] || { echo "FAIL: $PKG@$VERSION not on registry"; exit 1; }
+
+# Provenance attestation (bonus check)
+ATT=$(npm view "$PKG@$VERSION" --json 2>/dev/null | jq -r '.dist.attestations // empty')
+[ -n "$ATT" ] && PROV="yes" || PROV="no"
+
+# Tarball SRI
+SRI=$(npm view "$PKG@$VERSION" dist.integrity 2>/dev/null || echo "")
+[ -n "$SRI" ] || echo "WARN: no integrity hash"
+
+echo "OK $PKG@$VERSION provenance=$PROV"

package/templates/skills/cbp-ship/scripts/verify-railway.sh

@@ -0,0 +1,41 @@
+#!/usr/bin/env bash
+# Verify a Railway deployment is SUCCESS and the service responds.
+# Usage: verify-railway.sh <deployment-id> [<url>]
+# Exit: 0 ok, 1 fail, 2 pending
+
+set -euo pipefail
+DEPLOY_ID="$1"
+URL="${2:-}"
+
+STATUS=$(railway deployment status "$DEPLOY_ID" --json 2>/dev/null | jq -r '.status // "UNKNOWN"')
+
+case "$STATUS" in
+  SUCCESS|DEPLOYED)
+    if [ -n "$URL" ]; then
+      HEALTH=$(curl -sIm 10 "https://$URL/health" 2>/dev/null | head -1 | awk '{print $2}' || echo "")
+      if [ "$HEALTH" = "200" ]; then
+        echo "OK deploy=$DEPLOY_ID health=200"
+        exit 0
+      fi
+      ROOT=$(curl -sIm 10 "https://$URL" 2>/dev/null | head -1 | awk '{print $2}' || echo "")
+      case "$ROOT" in
+        2*|3*) echo "OK deploy=$DEPLOY_ID root=$ROOT (no /health endpoint)"; exit 0 ;;
+        *) echo "FAIL: deploy succeeded but service unreachable ($ROOT)"; exit 1 ;;
+      esac
+    fi
+    echo "OK deploy=$DEPLOY_ID (no URL to probe)"
+    exit 0
+    ;;
+  BUILDING|DEPLOYING|QUEUED|WAITING)
+    echo "PENDING: $STATUS"
+    exit 2
+    ;;
+  FAILED|CRASHED)
+    echo "FAIL: deploy $STATUS"
+    exit 1
+    ;;
+  *)
+    echo "PENDING: unknown state $STATUS"
+    exit 2
+    ;;
+esac

package/templates/skills/cbp-ship/scripts/verify-supabase.sh

@@ -0,0 +1,19 @@
+#!/usr/bin/env bash
+# Verify Supabase migrations applied successfully.
+# Usage: verify-supabase.sh <expected-last-migration-version>
+# Exit: 0 ok, 1 fail
+
+set -euo pipefail
+EXPECTED="$1"
+
+# Migration appears in remote-applied list
+APPLIED=$(supabase migration list --linked 2>/dev/null | grep -F "$EXPECTED" | wc -l | tr -d ' ')
+[ "$APPLIED" -gt 0 ] || { echo "FAIL: migration $EXPECTED not found on remote"; exit 1; }
+
+# No drift between local migrations and remote schema
+DRIFT_LINES=$(supabase db diff --use-migra 2>/dev/null | grep -v "^--" | grep -v "^$" | wc -l | tr -d ' ')
+if [ "$DRIFT_LINES" -gt 0 ]; then
+  echo "WARN: $DRIFT_LINES lines of drift detected (run: supabase db diff --use-migra)"
+fi
+
+echo "OK migration=$EXPECTED drift_lines=$DRIFT_LINES"

package/templates/skills/cbp-ship/scripts/verify-tauri.sh

@@ -0,0 +1,24 @@
+#!/usr/bin/env bash
+# Verify a Tauri desktop release was tagged + published with assets.
+# Usage: verify-tauri.sh <version-without-v-prefix>
+# Exit: 0 ok, 1 fail
+
+set -euo pipefail
+VERSION="$1"
+TAG="v$VERSION"
+
+git fetch origin --tags >/dev/null 2>&1
+git rev-parse "$TAG" >/dev/null 2>&1 || { echo "FAIL: tag $TAG missing locally"; exit 1; }
+git ls-remote --tags origin "$TAG" | grep -q . || { echo "FAIL: tag $TAG not pushed"; exit 1; }
+
+PUBLISHED=$(gh release view "$TAG" --json publishedAt -q .publishedAt 2>/dev/null || echo "")
+[ -n "$PUBLISHED" ] || { echo "FAIL: release $TAG not published"; exit 1; }
+
+ASSETS=$(gh release view "$TAG" --json assets -q '.assets | length' 2>/dev/null)
+[ "${ASSETS:-0}" -ge 1 ] || { echo "FAIL: release $TAG has no assets"; exit 1; }
+
+# Tauri auto-update needs latest.json
+HAS_MANIFEST=$(gh release view "$TAG" --json assets -q '.assets[].name' | grep -c "latest.json" || true)
+[ "$HAS_MANIFEST" -gt 0 ] || echo "WARN: latest.json missing — auto-update may not work"
+
+echo "OK tag=$TAG assets=$ASSETS published=$PUBLISHED"

package/templates/skills/cbp-ship/scripts/verify-vercel.sh

@@ -0,0 +1,32 @@
+#!/usr/bin/env bash
+# Verify a Vercel deployment is READY and reachable.
+# Usage: verify-vercel.sh <deployment-id-or-url>
+# Exit: 0 ok, 1 fail, 2 verification_pending
+
+set -euo pipefail
+DEPLOY="$1"
+
+STATUS=$(vercel inspect "$DEPLOY" --json 2>/dev/null | jq -r '.readyState // "UNKNOWN"')
+
+case "$STATUS" in
+  READY)
+    URL=$(vercel inspect "$DEPLOY" --json | jq -r '.alias[0] // .url')
+    HTTP=$(curl -sIm 30 "https://$URL" 2>/dev/null | head -1 | awk '{print $2}')
+    case "$HTTP" in
+      200|301|302|401) echo "OK $URL ($HTTP)"; exit 0 ;;
+      *) echo "FAIL: HTTP $HTTP for $URL"; exit 1 ;;
+    esac
+    ;;
+  BUILDING|QUEUED|INITIALIZING)
+    echo "PENDING: build still in progress ($STATUS)"
+    exit 2
+    ;;
+  ERROR|CANCELED)
+    echo "FAIL: deployment $STATUS"
+    exit 1
+    ;;
+  *)
+    echo "PENDING: unknown state $STATUS"
+    exit 2
+    ;;
+esac

package/templates/skills/cbp-ship/scripts/verify-vscode-ext.sh

@@ -0,0 +1,25 @@
+#!/usr/bin/env bash
+# Verify a VS Code extension version is on the Marketplace.
+# Usage: verify-vscode-ext.sh <publisher.name> <version>
+# Exit: 0 ok, 1 fail, 2 pending (marketplace lag)
+
+set -euo pipefail
+EXT_ID="$1"
+VERSION="$2"
+
+RESOLVED=$(npx --yes @vscode/vsce show "$EXT_ID" --json 2>/dev/null | jq -r '.versions[0].version // ""')
+
+if [ "$RESOLVED" = "$VERSION" ]; then
+  EVENTS=$(npx --yes @vscode/vsce show "$EXT_ID" --json | jq -r '.activationEvents | length // 0')
+  [ "$EVENTS" -gt 0 ] || echo "WARN: no activation events declared"
+  echo "OK $EXT_ID@$VERSION"
+  exit 0
+fi
+
+if [ -z "$RESOLVED" ]; then
+  echo "FAIL: extension $EXT_ID not found on marketplace"
+  exit 1
+fi
+
+echo "PENDING: marketplace shows $RESOLVED, expected $VERSION (1-5min propagation lag possible)"
+exit 2

package/templates/skills/cbp-ship/templates/eas.json

@@ -0,0 +1,66 @@
+{
+  "cli": {
+    "version": ">= 5.0.0"
+  },
+  "build": {
+    "development": {
+      "developmentClient": true,
+      "distribution": "internal",
+      "ios": {
+        "simulator": false,
+        "resourceClass": "m-medium"
+      },
+      "android": {
+        "buildType": "apk"
+      },
+      "channel": "development"
+    },
+    "preview": {
+      "distribution": "internal",
+      "ios": {
+        "simulator": false,
+        "resourceClass": "m-medium"
+      },
+      "android": {
+        "buildType": "apk"
+      },
+      "channel": "preview",
+      "autoIncrement": "buildNumber"
+    },
+    "production": {
+      "ios": {
+        "resourceClass": "m-medium"
+      },
+      "android": {
+        "buildType": "app-bundle"
+      },
+      "channel": "production",
+      "autoIncrement": "buildNumber"
+    }
+  },
+  "submit": {
+    "production": {
+      "ios": {
+        "appleId": "REPLACE_WITH_APPLE_ID_EMAIL",
+        "ascAppId": "REPLACE_WITH_APP_STORE_CONNECT_APP_ID",
+        "appleTeamId": "REPLACE_WITH_APPLE_TEAM_ID"
+      },
+      "android": {
+        "serviceAccountKeyPath": "./google-play-service-account.json",
+        "track": "internal",
+        "releaseStatus": "draft"
+      }
+    },
+    "preview": {
+      "ios": {
+        "appleId": "REPLACE_WITH_APPLE_ID_EMAIL",
+        "ascAppId": "REPLACE_WITH_APP_STORE_CONNECT_APP_ID",
+        "appleTeamId": "REPLACE_WITH_APPLE_TEAM_ID"
+      },
+      "android": {
+        "serviceAccountKeyPath": "./google-play-service-account.json",
+        "track": "internal"
+      }
+    }
+  }
+}

package/templates/skills/cbp-ship/templates/railway.toml

@@ -0,0 +1,15 @@
+# Railway service configuration
+# Reference: https://docs.railway.app/reference/config-as-code
+
+[build]
+builder = "DOCKERFILE"
+dockerfilePath = "Dockerfile"
+
+[deploy]
+startCommand = "pnpm start"
+healthcheckPath = "/health"
+healthcheckTimeout = 30
+restartPolicyType = "ON_FAILURE"
+restartPolicyMaxRetries = 3
+numReplicas = 1
+sleepApplication = false

package/templates/skills/cbp-ship/templates/release-please-config.json

@@ -0,0 +1,17 @@
+{
+  "$schema": "https://raw.githubusercontent.com/googleapis/release-please/main/schemas/config.json",
+  "release-type": "node",
+  "include-component-in-tag": false,
+  "bump-minor-pre-major": true,
+  "bump-patch-for-minor-pre-major": false,
+  "draft": false,
+  "prerelease": false,
+  "packages": {
+    ".": {
+      "package-name": "REPLACE_WITH_PACKAGE_NAME",
+      "changelog-path": "CHANGELOG.md",
+      "release-type": "node",
+      "extra-files": []
+    }
+  }
+}

package/templates/skills/cbp-ship/templates/vercel.json

@@ -0,0 +1,19 @@
+{
+  "$schema": "https://openapi.vercel.sh/vercel.json",
+  "framework": "nextjs",
+  "buildCommand": "cd ../.. && pnpm turbo build --filter=REPLACE_WITH_APP_NAME",
+  "installCommand": "cd ../.. && pnpm install --frozen-lockfile",
+  "outputDirectory": ".next",
+  "regions": ["iad1"],
+  "headers": [
+    {
+      "source": "/(.*)",
+      "headers": [
+        { "key": "X-Frame-Options", "value": "SAMEORIGIN" },
+        { "key": "X-Content-Type-Options", "value": "nosniff" },
+        { "key": "Referrer-Policy", "value": "strict-origin-when-cross-origin" },
+        { "key": "Permissions-Policy", "value": "camera=(), microphone=(), geolocation=()" }
+      ]
+    }
+  ]
+}