v1.0.0

Version 1.0.0 is the first release of the starter under the fork-distribution model, and it consolidates everything merged since 1.0.0-beta.3. It replaces .env files with a validated environment contract, completes the password flows, adds a user detail page, a public landing page and end-to-end coverage of the reference app, and makes the dashboard usable on phones. Many of these changes ask something of every fork: read Fork migration below before merging.

The first area is environment configuration. Every backend variable is now declared in one of six Zod-validated schemas under src/api/config/ and read through a <domain>Env object such as dbEnv.PG_CONNECTION_STRING; a missing or invalid value stops the process at start-up with a clear message (#354). The work landed in steps: configuration is injected where tests need other values (#440), every production read moves to the new objects (#441), the database scripts and drizzle-kit read them too (#442), and the old validation code is removed (#443). A lint rule now rejects any other process.env read (#444), and a guard fails the commit hook and npm run ci when a .env* file is in the tree (#354). @resetshop/hono-core no longer carries app-specific configuration (#258). The token-cleanup interval is now a duration string such as 24h, like the other time settings (#259), and the production build no longer fails because a rate limiter read the configuration too early (#450).

The second is authentication. Users flagged to change their password are sent to a change-password page before they reach the dashboard (#388). A user who forgot their password can request a single-use reset link by email (#428). The request answers the same way, and just as fast, whether or not the account exists (#433), and its confirmation no longer lingers when the user comes back to the page (#434). The login and reset pages show a countdown while an account is locked or requests are rate-limited (#436). The login response now carries the user's roles and permissions, so permission-gated navigation is right from the first page (#322). Behind these, AuthService is split into focused services (#420) and password hashing sits behind one module (#385). Generating a temporary password no longer fails in development (#371) or makes a test fail at random (#429).

The third is user and role administration. Admins can reset a user's password; the new temporary password is emailed, never returned or logged (#214). Editing a user moves from a drawer to a detail page at /dashboard/users/:id, which stops admins from removing their own admin role (#212). The user API moves to plural paths, /api/users*, like its siblings (#455). Creating a user writes the identity, the password and the roles in one transaction, so a failure leaves nothing half-created (#387). Row actions move into a ⋮ menu (#401), and actions an admin cannot take on their own account are hidden (#389). The Spanish copy of the welcome email and the interface is corrected (#251).

The fourth is navigation and feedback. The root path / now serves a public, server-rendered landing page instead of redirecting to the login page (#19), and its unreachable "Go to dashboard" link is removed (#468). The placeholder Welcome page is removed (#458). A user denied a page sees a toast that says why, and a user with no permissions sees an explanation instead of an empty dashboard (#323). The deny toast now appears exactly once (#471), the 403 toast appears on every page (#480), and the sidebar no longer flickers on logout (#325).

The fifth is responsive layout. The dashboard now works on phones. Form inputs no longer trigger the iOS zoom and touch targets reach 44 px (#338), the auth pages fill the screen (#339), the sidebar behaves as an overlay (#340), and data tables switch to cards on narrow screens, with an optional table/cards toggle (#341). Pagination (#342, #366), page layout and breadcrumbs (#343, #368), and drawers, dialogs, toasts and dropdowns (#344) are sized for small screens. Shared packages/ui components show English text when no translations are loaded, as in Storybook (#363), and the reason ToastNotification has no unit test is documented (#369).

The sixth is end-to-end testing. The reference app gains a Playwright suite that runs against a seeded test database (#261). It covers authentication (#459), the landing page (#460), the dashboard shell and permission filtering (#461), users (#462), roles (#463), permissions (#464), theme and language (#465) and the health page (#466). It runs with npm run test:e2e and in its own CI job, outside npm run ci.

The seventh is toolchain and CI. Nx moves to 22.7.5 and Angular to 21.2 (#424). Integration tests no longer need Docker: they start an embedded Postgres 17 when no test database is configured (#321). npm run ci now checks formatting first (#374), and npm run ci:verify runs the same checks through the Nx cache for repeated runs (#404). CI uses the Nx Cloud remote cache (#406), reads its test-database settings from repository Variables, and runs test, lint and a new type-check job over every project (#319). Bugs left over from the monorepo restructure, including stale README paths, are fixed (#313, #315).

The last is generators, agents and documentation. A new ui-component generator scaffolds shared components, and a lint rule requires every Storybook story to show its source (#348). The drizzle-schema and page generators write kebab-case paths (#330, #331), every generator has unit tests (#317), and the generators are documented for people and agents (#333). The /issue-workflow skill takes an issue from branch to pull request, and npm install offers to install the Angular agent skill (#349). The agents load their references in parallel and only as needed (#407, #410), run independent advisors in parallel (#408), verify with the cached CI (#405), and review with a new maintainability lens (#409). The domain-model reference gains strategic DDD patterns and corrected examples (#207, #380), and the Bruno error cases use cookie authentication (#384).

Fork migration

Every fork:

• #354, #441, #444 - Copy apps/reference-app/src/api/config/ (the db, auth, email, http, app and cron *.env.ts files and env-utils.ts) into your app, add "@config/*": ["src/api/config/*"] to its tsconfig.json and tsconfig.spec.json, and add '@config': '/src/api/config' to the resolve.alias of its vitest.config.ts. Then replace every process.env read outside src/api/config/, src/test-setup.ts and src/api/integration/ with the matching <domain>Env.<VAR>, for example httpEnv.CORS_ORIGIN, httpEnv.CORS_MAX_AGE and httpEnv.PORT in server.ts. npm run lint now fails on every such read, not only on new ones.
• #258, #441, #443 - @resetshop/hono-core no longer exports environment, isServerless or EnvironmentConfig, and your app imports them in cron-jobs.ts, refresh-token.repository.ts, helpers/drizzle-postgres-connector.ts, db/seed.ts and db/sync-permissions.ts. Import isServerless from @config/http.env, replace environment.database.pg.connectionString with dbEnv.PG_CONNECTION_STRING (@config/db.env) and environment.basePath with httpEnv.BASE_HREF (@config/http.env), and use DbEnv, HttpEnv or AuthEnv where you typed EnvironmentConfig.
• #354 - Move every .env* file out of the repository root and out of apps/<your-app>/: the pre-commit hook, npm run ci and npm run ci:verify fail while one exists. Deliver values with an env file outside the repository and Node's --env-file, an IDE run configuration, a shell export or direnv, as docs/environment-variables.md describes. That document also lists every variable, replacing the deleted .env.example.
• #259 - Rename TOKEN_CLEANUP_INTERVAL_MS to TOKEN_CLEANUP_INTERVAL and give it a duration string (86400000 becomes 24h) wherever you set it (your env file outside the repository, CI variables, deployment). If only the old name is set, the cleanup job silently uses the 24-hour default.
• #428 - Run npm run drizzle:push-migrations against each database (npm install also runs it) to create the new password_reset_token table.
• #319, #459 - In your repository's Settings → Secrets and variables → Actions → Variables, add PG_TEST_CONNECTION_STRING = postgresql://postgres:postgres@localhost:5432/test_db and INTEGRATION_TEST_ADMIN_PASSWORD = any test-only password. The test-integration and e2e jobs in ci.yml read them as vars.*. Then delete the Secrets of the same names.
• #406 - In nx.json, replace nxCloudId with your own Nx Cloud workspace and add its token, copied verbatim from the dashboard, as the NX_CLOUD_ACCESS_TOKEN Actions secret, or leave the secret unset to use only the local cache. A token that does not match the workspace makes the cacheable CI jobs fail with 401.
• #325 - In your app's app.config.ts, replace the inline NAVIGATION_PERMISSION_CHECK provider with provideAuth(withNavigationPermissionCheck()), copying withNavigationPermissionCheck() from the reference app's providers/auth/auth.provider.ts. The inline provider makes the sidebar flicker on logout.
• #348 - Add parameters: { docs: { canvas: { sourceState: 'shown' } } } to the default export of every *.stories.ts in your app; npm run lint fails on stories without it.
• #424 - In your app's vitest.config.ts, set server.fs.allow to [searchForWorkspaceRoot(process.cwd())], imported from vite. Under Angular 21.2, specs that render packages/ui components otherwise fail with Denied ID …?raw.
• #321 - In your app's project.json, remove node scripts/skip-if-no-db.mjs && from the test-integration command; the script is deleted. To run without Docker as the reference app does, copy src/api/integration/setup/embedded-pg-test-db.ts and the embedded-Postgres branch of global-setup.ts.
• #319 - In your app's playwright.config.ts, set webServer.command to nx run <your-app>:serve --port=3000; the copied nx run app:serve names a project that does not exist.
• #374 - Expect npm run ci to fail on any file Prettier would reformat; run npm run format once.
• #321 - Expect npm run ci and npm run test:integration to run the reference app's integration tests against an embedded Postgres 17 instead of skipping them when PG_TEST_CONNECTION_STRING is unset. Export INTEGRATION_TEST_ADMIN_PASSWORD in your shell, or the run fails.
• #319 - Expect GitHub CI's test and lint jobs, and the new typecheck job, to run over every project, including your own app, on your first run.

If your fork ships its own language files (the TranslationSchema type-check lists every missing or unknown key):

• #388, #428, #436 - Add AUTH.CHANGE_PASSWORD.*, AUTH.RESET_PASSWORD.{DESCRIPTION,CONFIRMATION}, AUTH.RESET_PASSWORD_CONFIRM.* and AUTH.ERRORS.{OLD_PASSWORD_MISMATCH,RESET_TOKEN_INVALID,ACCOUNT_LOCKED_UNTIL,RATE_LIMITED_UNTIL}.
• #19, #323 - Add LANDING.*, PERMISSIONS.ERRORS.ACCESS_DENIED and DASHBOARD.HOME.NO_ACCESS_{TITLE,MESSAGE}.
• #214, #212 - Add USERS.PAGE.RESET_PASSWORD_BUTTON, USERS.PAGE.RESET_PASSWORD_DIALOG.{TITLE,MESSAGE}, USERS.RESET_PASSWORD_TOAST and USERS.DETAIL.*, and remove USERS.EDIT_DRAWER.*.
• #341, #342, #401 - Add DATA_TABLE.TOGGLE.{TABLE,CARDS,GROUP_LABEL}, PAGINATION.PAGE_OF and ROW_ACTIONS.TRIGGER_LABEL.
• #458 - Remove DASHBOARD.HOME.NAV and DASHBOARD.HOME.DESCRIPTIONS.WELCOME. Your app's Welcome page and its welcome navigation entry use them: remove both, or give them keys of your own.
• #212, #458 - Search your templates (| translate) and navigation names for USERS.EDIT_DRAWER.*, DASHBOARD.HOME.NAV and DASHBOARD.HOME.DESCRIPTIONS.WELCOME. Those uses compile, and render the raw key.
• #19, #212, #214, #323, #341, #342, #388, #401, #428, #436 - Copy the matching entries into your translation.mock.ts for every key your specs assert. It is an open Record, so the type-check does not report missing entries.

If your fork changed or reuses any of the following:

• #455 - Calls to the reference app's /api/user* endpoints (scripts, your Bruno collection, other clients): use /api/users*; the old paths have no alias. To align your own app, change its mount in src/api/routes.ts from /user to /users together with its HttpUsersApi base path.
• #212 - The edit-user drawer: it is replaced by the user detail page at /dashboard/users/:id (pages/dashboard/users/user-detail-page/). Move your changes there.
• #471, #480 - provideToast() or forbiddenInterceptor: copy the reference app's components/toast/toast.provider.ts and toast-bridge.service.ts. provideToast() now only activates the root ToastBridgeService and no longer lists provideToastConfig, NgpToastManager or ToastBridgeService, which rendered a deny toast twice; the bridge passes placement, duration and dismissal to each show(). In forbiddenInterceptor, call injector.get(ToastBridgeService) in the 403 branch before showNotification, so the toast also renders on routes that never call provideToast().
• #371 - Your app's password generation (src/api/utils/password.ts): import the word lists with ?raw and add wordlists.d.ts, as the reference app does, then delete the copy-server-assets target from your project.json. The file-system loader fails with Word list file not found when a user is created.
• #420, #385, #387, #322 - Code that constructs AuthService or UserManagementService outside the container: AuthService also takes userRoleService and authPasswordService. Build the latter as new AuthPasswordService({ authRepository, verifyPassword, hashPassword }), with verifyPassword from createPasswordVerifier() and hashPassword from createPasswordHasher(), both in services/password/password-hasher.ts. Token cleanup moved from AuthService to TokenMaintenanceService, which takes { refreshTokenRepository }. UserManagementService also takes userRoleRepository, authRepository and hashPassword (from createPasswordHasher()), which replaces the no-longer-exported getBcryptSaltRounds. UserManagementRepository.create takes the identity-only CreateUserIdentityParams ({ email, firstName, lastName }) instead of CreateUserWithHashedPasswordParams; write the password with AuthenticationRepository.createInitialPassword(...).
• #440 - Code that constructs PasetoService or imports drizzlePgConnector: pass { pasetoConfig: createPasetoConfig() } to new PasetoService(), and call createDrizzlePgConnector() instead of importing the connector.
• #442 - Scripts that run drizzle-kit generate or push outside npm run drizzle:create-migrations and drizzle:push-migrations: run them as tsx --tsconfig apps/<your-app>/tsconfig.json ./node_modules/drizzle-kit/bin.cjs <command>, so the @config/* import in drizzle.config.ts resolves, and deliver PG_CONNECTION_STRING first.
• #401 - Specs in your app that render RowActionsMenu or another ng-primitives overlay: add the Element.prototype.getAnimations polyfill from the reference app's src/test-setup.ts to your app's test setup.
• #363 - Specs that use TranslationMock from @resetshop/angular-core: the packages/ui Pagination, DataTable and FormField components now show their English fallback text under it instead of the raw key, so update assertions that expect keys. The reference app's provideTranslationMock is unchanged.

Behaviour that changes with no action needed:

• #19 - The reference app serves a public landing page at /; before, / redirected to /auth/login. Your own app keeps its routes.
• #322, #388 - POST /api/auth/login returns the user's roles and permissions, like GET /api/auth/me, and /me adds mustChangePassword. Users with that flag are sent to /auth/change-password.
• #436 - The login 401 ACCOUNT_LOCKED response adds lockedUntil.
• #428 - The reset link in the forgot-password email is built from CORS_ORIGIN, falling back to http://localhost:4200.
• #387 - POST /api/users answers 400 instead of 500 for unknown role ids.
• #212 - The temporary-password email of an admin reset is sent after the response.
• #313 - LoadingSpinnerComponent shows "Loading..." instead of "Cargando..."; bind [message] for localized text.
• #349 - npm install offers to clone the Angular Claude Code skill into .claude/skills/angular. Non-interactive installs clone it by default, and a failed clone does not fail the install.

Full changes

See every merged pull request in v1.0.0.

Changes

Environment configuration

• #354 - Replaces .env files with six Zod-validated environment schemas read through @config/<domain>.env, and fails the commit hook and npm run ci when a .env* file is in the tree.
• #440 - Injects the PASETO, authentication and database configuration so tests can supply their own values.
• #441 - Moves every production process.env read to the <domain>Env objects.
• #442 - Runs the database scripts and drizzle-kit against the validated configuration, so they stop at start-up when PG_CONNECTION_STRING is missing.
• #443 - Removes the old environment validation code and updates the configuration documentation.
• #444 - Adds a lint rule that rejects process.env reads outside the configuration modules and test setup.
• #258 - Moves app-specific configuration out of @resetshop/hono-core.
• #259 - Replaces the remaining millisecond constants with duration strings and renames TOKEN_CLEANUP_INTERVAL_MS to TOKEN_CLEANUP_INTERVAL.
• #450 - Fixes the production build, which failed because a rate limiter read the configuration when its module loaded.

Authentication

• #388 - Sends users flagged with mustChangePassword through a change-password page after login.
• #428 - Adds the self-service forgot-password flow with single-use, hashed reset tokens.
• #433 - Answers forgot-password requests immediately and identically, so response time no longer reveals whether an account exists.
• #434 - Clears the password-reset confirmation and errors when the user returns to the reset pages.
• #436 - Shows a countdown and disables submit while an account is locked or requests are rate-limited.
• #322 - Returns the user's roles and permissions from POST /api/auth/login.
• #420 - Splits AuthService into AuthService, AuthPasswordService and TokenMaintenanceService.
• #385 - Injects password hashing into UserManagementService through createPasswordHasher().
• #371 - Embeds the password word lists at build time, so generating a temporary password no longer fails in development.
• #429 - Removes hyphenated words from the English password word list, which made a test fail at random.

User and role administration

• #214 - Adds admin-initiated password resets that email a new temporary password.
• #212 - Replaces the edit-user drawer with a user detail page at /dashboard/users/:id.
• #455 - Moves the user API from /api/user* to /api/users*.
• #387 - Moves password and role writes out of the user-management repository and creates a user in one transaction.
• #401 - Replaces inline row action buttons with a ⋮ row actions menu.
• #389 - Hides the Delete action on the signed-in user's own row and adds a shared CurrentUser service.
• #251 - Corrects the Spanish copy of the welcome email and interface labels.

Navigation and feedback

• #19 - Adds a public, server-rendered landing page at /.
• #468 - Removes the landing header's unreachable "Go to dashboard" link.
• #458 - Removes the placeholder /dashboard/welcome page.
• #323 - Shows a toast when a route denies access, and explains an empty dashboard to users without permissions.
• #471 - Shows the access-denied toast once when a detail route is deep-linked.
• #480 - Shows the 403 toast on routes that never set up toasts.
• #325 - Stops the sidebar navigation from flickering on logout.

Responsive layout

• #338 - Stops the iOS zoom on form inputs and adds a 44 px touch-target utility.
• #339 - Makes the auth pages full-screen on mobile with the new ImmersivePanel.
• #340 - Fixes the sidebar's mobile behaviour, overlay width and brand truncation.
• #341 - Adds a card display mode to DataTable, with breakpoint switching and a table/cards toggle.
• #342 - Stacks pagination on mobile and shows a "Page N of M" indicator.
• #366 - Refines pagination page windowing and ellipses.
• #343 - Adapts page padding, headings, breadcrumbs and action bars to small screens.
• #368 - Truncates long breadcrumb segments on mobile.
• #344 - Sizes drawers, toasts, the confirm dialog and select dropdowns for small screens.
• #363 - Gives shared packages/ui components English fallback text when no translations are loaded.
• #369 - Documents why ToastNotification has no unit test.

End-to-end testing

• #261 - Completes the end-to-end epic with a Playwright suite for every page of the reference app.
• #459 - Adds the Playwright harness, the seeded test database and authentication coverage.
• #460 - Covers the landing page.
• #461 - Covers the dashboard shell, permission filtering and the access-denied flow.
• #462 - Covers the users list, the create drawer and the user detail page.
• #463 - Covers role management.
• #464 - Covers the permissions list.
• #465 - Covers theme and language switching.
• #466 - Covers the health page.

Toolchain and CI

• #424 - Updates Nx to 22.7.5 and Angular to 21.2.
• #321 - Runs integration tests against an embedded Postgres 17 when no test database is configured.
• #319 - Fixes the seed script aliases and the CI workflow, and reads the CI test-database settings from repository Variables.
• #374 - Adds a Prettier check to npm run ci.
• #404 - Adds npm run ci:verify, which runs the CI checks through the Nx cache.
• #406 - Enables the Nx Cloud remote cache in CI.
• #313 - Fixes bugs left over from the monorepo restructure, including the spinner's hard-coded Spanish text.
• #315 - Corrects stale file paths in the README.

Generators, agents and documentation

• #348 - Adds the ui-component generator and a lint rule that requires stories to show their source.
• #330 - Makes the drizzle-schema generator write kebab-case file names.
• #331 - Makes the page generator write kebab-case directories.
• #317 - Adds unit tests for every generator.
• #333 - Documents the generators in the README and for agents.
• #349 - Adds the /issue-workflow skill and a postinstall step that installs the Angular agent skill.
• #405 - Makes the code-reviewer agent verify with npm run ci:verify.
• #407 - Loads each agent's references in one parallel batch.
• #408 - Runs independent advisor agents in parallel.
• #409 - Adds a maintainability review lens to the code-reviewer and refactoring-specialist agents.
• #410 - Loads the planning agents' references according to the diff.
• #207 - Adds strategic DDD patterns to the domain-model reference.
• #380 - Fixes stale examples in the domain-model reference.
• #384 - Switches the Bruno error-case requests to cookie authentication.

What's Changed

• [#61] - Add rate limiting to login and refresh auth endpoints by @rolivencia in #242
• [#243] - Add date input support to app-form-field by @rolivencia in #245
• [#79] - Add audit logging for sensitive RBAC and user management operations by @rolivencia in #244
• [#246] - Pass actorId to all RBAC mutation service methods for audit traceability by @rolivencia in #247
• [#248] - Add audit history tables for auth/authz entities by @rolivencia in #249
• [#159] - Full English/Spanish i18n with runtime language switching by @rolivencia in #250
• [#254] - Replace set-environment.ts with Angular builder define option by @rolivencia in #255
• [#256] - Embed wordlists as TypeScript constants, remove copy-server-assets by @rolivencia in #257
• [#262] - Add coding agent collaboration policies by @rolivencia in #295
• [#265] - Step 1: Prepare workspace root for monorepo structure by @rolivencia in #296
• [#266] - Step 2: Create @resetshop/util package by @rolivencia in #297
• [#298] - PR 1.1.5: Remove dead @libs/* aliases and tsconfig paths duplication by @rolivencia in #299
• [#269] - PR 1.5: Create @resetshop/hono-core package by @rolivencia in #300
• [#268] - PR 1.4: Create @resetshop/angular-core package (boundary-decoupled from day one) by @rolivencia in #301
• [#267] - PR 1.3: Create @resetshop/ui package with 14 generic components by @rolivencia in #302
• [#275] - PR 1.6: Create @resetshop/generators package (6 working generators + app stub) by @rolivencia in #303
• [#273] - PR 1.7: Create apps/reference-app with full app code consolidated under src/ by @rolivencia in #304
• [#285][#286] - PR 1.12+1.13: Add skip-if-no-db.mjs + uniform typecheck targets by @rolivencia in #305
• [#290] - PR 2.1: Add @resetshop/generators:app schematic by @rolivencia in #306
• [#307] - Fix-up: Address retrospective code review findings on PRs 299-306 by @rolivencia in #308
• [#291] - PR 2.2: Add docs/forking.md + CHANGELOG.md + README forking section by @rolivencia in #309
• [#292] - PR 2.3: Enforce starter/app boundary via Nx tags + ESLint + nx.json cleanup by @rolivencia in #310
• [#293] - PR 2.4: Add upstream CI guards (boundary + changelog) and PR template by @rolivencia in #311
• [#294] - PR 2.5: Holistic cross-cutting fix-up (final Epic 2 PR) by @rolivencia in #312
• #313 - Audit fix-up: real bugs from review-file audit + tag all Discovered statuses by @rolivencia in #314
• #315 - README: fix 8 stale file paths from pre-restructure single-app layout by @rolivencia in #316
• #319 - Fix drizzle:seed tsx alias resolution and align local CI with GitHub Actions by @rolivencia in #320
• [Milestone] - Monorepo restructure + fork distribution by @rolivencia in #318
• #322 - Login response includes user roles + permissions; collapse meResponseSchema into authUserSchema by @rolivencia in #324
• [HF] - Sidebar logout flicker: opt-in withNavigationPermissionCheck() feature on provideAuth() by @rolivencia in #325
• #323 - permissionGuard deny toast + dashboard-home no-module-access alert by @rolivencia in #326
• #321 - Add embedded-postgres for zero-config local integration tests by @rolivencia in #329
• #317 - Add unit test coverage for store, page, api-provider, backend-module, drizzle-schema generators by @rolivencia in #332
• #330 - Fix drizzle-schema generator to write kebab-case filenames by @rolivencia in #334
• #331 - Fix page generator inner name-list/ directory to use kebab-case by @rolivencia in #335
• #333 - Document generators for humans (README) and agents (.claude/references) by @rolivencia in #336
• #259 - Migrate hardcoded millisecond constants to duration string utilities by @rolivencia in #337
• #338 - Mobile form interaction quality: iOS zoom fix, data-touch-target utility, selector layout, drawer responsiveness by @rolivencia in #345
• #339 - Fix auth pages overflow on mobile with ImmersivePanel layout by @rolivencia in #347
• #349 - Add /issue-workflow skill and postinstall hook for third-party skill auto-installation by @rolivencia in #350
• #348 - Add ui-component generator with Storybook sourceState enforcement by @rolivencia in #352
• #340 - Responsiveness — C: Sidebar mobile semantics, overlay width, brand truncation by @rolivencia in #353
• #341 - Responsiveness D iteration 2: built-in viewport detection, display-mode toggle, grouped card rendering, per-list card components by @rolivencia in #359
• #341 - Responsiveness — D: Data-table card display mode, cell whitespace, row action labels by @rolivencia in #358
• [hotfix] - Remove Translation from Storybook stories by @rolivencia in #362
• [hotfix] - Storybook: scan packages/ui stories and remove app-level duplicates by @rolivencia in #364
• #342 - Responsiveness E: Pagination single-row mobile layout, native select font size, DataTable+Pagination story coverage, and CardView render fix by @rolivencia in #365
• #343 - Responsiveness F: Page-level layout chrome (header, breadcrumb, main, page-shell, action bars, card) by @rolivencia in #367
• [hotfix] - Embed password wordlists at build time, remove runtime filesystem read by @rolivencia in #371
• #344 - Responsiveness G: Modal-stack mobile sizing (drawer, toast, confirm-dialog, select dropdown) by @rolivencia in #370
• #363 - Responsiveness H: Default fallback strings for reusable components when Translation is unavailable by @rolivencia in #372
• #369 - Document decision to skip unit test for ToastNotification by @rolivencia in #376
• #366 - Responsiveness I: pagination page-number windowing and ellipsis by @rolivencia in #375
• #368 - Responsiveness — J: Breadcrumb long-segment overflow on mobile by @rolivencia in #373
• #374 - Add format:check step to npm run ci to catch Prettier drift by @rolivencia in #377
• #251 - Review email template text copies and translations by @rolivencia in #379
• #214 - Add password reset feature for admin-initiated resets by @rolivencia in #383
• #207 - Enrich domain-model.md with strategic DDD patterns from ddd-by-examples/library by @rolivencia in #382
• #389 - Hide Delete user button on self-row in users-list and user-card by @rolivencia in #391
• #380 - Fix stale code examples in domain-model.md tactical sections by @rolivencia in #396
• #384 - Align Bruno error-case docs to auth: none cookie convention by @rolivencia in #397
• #258 - [hono-core] Split environment.ts: separate isServerless() from app-specific environment constant by @rolivencia in #398
• #385 - Hide bcrypt salt rounds behind a hashPassword helper at the service layer by @rolivencia in #400
• #401 - Replace inline data-table row actions with a vertical ellipsis (⋮) row-actions menu (NgpMenu) by @rolivencia in #402
• #404 - Leverage Nx local cache in npm run ci (cache-aware ci:verify) by @rolivencia in #411
• #405 - Cache-aware code-reviewer CI (B2) by @rolivencia in #412
• feat: set up nx workspace by @rolivencia in #421
• #406 - Enable Nx Cloud remote caching + DTE evaluation (runbook) by @rolivencia in #413
• #387 - Decouple User-management from authentication and authorization writes by @rolivencia in #418
• #407 - Parallelize reference-file loading in agents (D-parallel) by @rolivencia in #414
• #410 - Conditional reference loading for planning agents (D-conditional) by @rolivencia in #415
• #408 - Parallelize independent advisor agents in the documented pipelines by @rolivencia in #416
• #409 - Evaluate /thermo-nuclear-code-quality-review for the code-reviewer agent + references by @rolivencia in #417
• #424 - Update Nx to 22.7.5 and Angular to 21.2 by @rolivencia in #425
• #19 - Add SSR Landing Page with public access and login entry point by @rolivencia in #426
• #420 - Decompose AuthService into AuthService + TokenMaintenanceService + AuthPasswordService by @rolivencia in #423
• #388 - Forced password change flow after login (mustChangePassword: true) by @rolivencia in #427
• #429 - Fix flaky generatePassword ASCII-words test by @rolivencia in #430
• #428 - Self-service forgot-password / reset flow (request + token reset) by @rolivencia in #431
• #433 - Forgot-password flow leaks account existence via response timing by @rolivencia in #435
• #434 - Fix stale password-reset confirmation persisting across navigation by @rolivencia in #437
• #436 - Timer-based lockout & rate-limit countdown UX for the auth pages by @rolivencia in #438
• #354 - Add env sub-schema modules + createEnvHandler factory + CI guard against .env* files (PR A) by @rolivencia in #357
• #440 - Introduce DI patterns enabling per-test env values (PasetoConfig, AuthConfig.cronSecret, DrizzlePgConnector factory, cors deferral) — #354 PR B1 by @rolivencia in #445
• #441 - Migrate production consumers to Env + delete src/api/environment.ts + collapse duplicate isServerless() — #354 PR B2 by @rolivencia in #446
• #442 - Gate entry-point scripts and drizzle-kit on @config/* via tsx wrap — #354 PR B3 by @rolivencia in #447
• #443 - Delete legacy env-handling code and update consumer docs (validateEnvironment, EnvironmentConfig, AUTHENTICATION.md, README) — #354 PR B4 by @rolivencia in #448
• #444 - Enforce no-process-env via ESLint with @config-only allowlist (FINAL) — #354 PR B5 by @rolivencia in #449
• #450 - Defer changePasswordRateLimiter env read so the SSR prerender worker can import the server env-less by @rolivencia in #451
• [hotfix] - Guide users to EMAIL_PROVIDER=ethereal when SMTP credentials are missing by @rolivencia in #452
• #212 - Migrate Edit User from drawer to full detail page by @rolivencia in #439
• #455 - Align user API to plural collection routes (/api/user -> /api/users) by @rolivencia in #456
• #459 - E2E foundation + Auth coverage (Playwright base config, fixtures, CI) by @rolivencia in #467
• #460 - E2E Landing page coverage by @rolivencia in #469
• #461 - E2E Dashboard shell coverage by @rolivencia in #470
• #462 - E2E Users coverage (list, create drawer, detail page) by @rolivencia in #472
• #463 - E2E Roles CRUD coverage by @rolivencia in #473
• #464 - E2E Permissions read-only coverage by @rolivencia in #474
• #465 - E2E Theme and i18n coverage by @rolivencia in #475
• #466 - E2E Health page coverage by @rolivencia in #476
• #468 - Remove unreachable 'Go to dashboard' link from the public landing header by @rolivencia in #477
• #471 - Fix permission deny toast firing twice when deep-linking a gated detail route by @rolivencia in #478
• #480 - Activate the toast bridge on demand so forbiddenInterceptor 403 toasts render on any route by @rolivencia in #481
• #458 - Remove the placeholder /dashboard/welcome route and Welcome component by @rolivencia in #483
• [hotfix] - Regroup dashboard nav (Settings under Settings & Maintenance) + add Dashboard home link by @rolivencia in #484
• [#485] - Cut the 1.0.0 release: changelog, GitHub release notes, and the first v1.0.0 tag by @rolivencia in #487
• [#508] - Source INTEGRATION_TEST_ADMIN_PASSWORD from a Secret in CI by @rolivencia in https://github.com/ResetShop/angular-nx-standalone-starter/pull/#501

Full Changelog: https://github.com/ResetShop/angular-nx-standalone-starter/commits/v1.0.0