@bardioc/app-sdk 0.4.2 → 0.4.3

package/README.md

@@ -56,7 +56,7 @@ createRoot(document.getElementById('root')!).render(
 | --------------------------- | ------------------------------------------- |
 | `@bardioc/app-sdk`          | `createHostBridge`, errors, types, manifest |
 | `@bardioc/app-sdk/react`    | `AppSdkProvider`, hooks (`useSdk`, etc.)    |
-| `@bardioc/app-sdk/dev`      | host-backed standalone dev-session helpers  |
+| `@bardioc/app-sdk/dev`      | standalone dev bridge helpers               |
 | `@bardioc/app-sdk/types`    | Type-only TypeScript exports                |
 | `@bardioc/app-sdk/protocol` | `SDK_MSG` constants, wire format types      |
 | `@bardioc/app-sdk/vite`     | `bardiocApp()` Vite plugin                  |
@@ -91,12 +91,10 @@ import {
   useSdk,
   useNotify,
   useSendToKernel,
-  useStandaloneDevLogout,
 } from '@bardioc/app-sdk/react';
 
 // Standalone dev helpers
 import {
-  ensureDevAuthSession,
   installDevBridge,
   isDevStandalone,
   isInsideIframe,
@@ -137,12 +135,10 @@ New apps scaffolded with `create-bardioc-app` include the `<link>` already.
 
 Standalone local development is host-backed only.
 
-1. Create or open the app in the host App Store so you have its `VITE_APP_ID`.
-2. In the host App Store, open the app details and use `Copy Dev Session`.
-3. Paste the snippet into your local `.env`.
-4. Set `VITE_ENABLE_DEV_AUTH=true` and run `pnpm dev`.
+1. Set `DEV_SECRET` and `API_BASE_URL` in your local `.env`.
+2. Run `pnpm dev`.
 
-That flow stores a host-issued dev session locally and routes transport calls through the host `/api/transport` endpoint. There is no separate local token exchange mode anymore.
+The Vite plugin proxies `/rest/*` requests to `API_BASE_URL` with the `X-Dev-Secret` header, and `installDevBridge()` handles SDK messages when running in standalone dev.
 
 For public testing against a live URL, run `pnpm dev:live` and use the emitted tunnel URL as the app's live URL in the host App Store configuration.
 
@@ -151,7 +147,6 @@ For public testing against a live URL, run `pnpm dev:live` and use the emitted t
 - `useSdk()` — raw bridge instance
 - `useNotify()` — fire-and-forget toast
 - `useSendToKernel()` — proxy a whitelisted message to the OS service worker
-- `useStandaloneDevLogout()` — clear standalone dev auth state and reload the page
 
 ### IndexedDB persistence
 

package/dist/dev-auth-vite.d.ts

@@ -1,15 +1,10 @@
 import type { IncomingMessage, ServerResponse } from 'node:http';
+import { type DevAuthProxyOptions } from './dev-proxy.js';
 type VitePlugin = {
     name: string;
     apply?: 'serve' | 'build';
     enforce?: 'pre' | 'post';
     configureServer?: (server: ViteDevServerLike) => void;
-    transformIndexHtml?: () => Array<{
-        tag: string;
-        attrs?: Record<string, string>;
-        children?: string;
-        injectTo?: 'head' | 'body' | 'head-prepend' | 'body-prepend';
-    }> | void;
 };
 interface ViteDevServerLike {
     config: {
@@ -28,7 +23,8 @@ interface ViteDevServerLike {
 }
 export interface BardiocDevAuthOptions {
     appName: string;
-    sessionStorageKey?: string;
+    /** Optional explicit proxy options. If omitted, DEV_SECRET and API_BASE_URL are read from env. */
+    proxy?: DevAuthProxyOptions;
 }
 export declare function bardiocDevAuth(options: BardiocDevAuthOptions): VitePlugin;
 export {};

package/dist/dev-auth-vite.js

@@ -1,221 +1,79 @@
 import { existsSync } from 'node:fs';
 import { resolve } from 'node:path';
-import { forwardDevAuthProxyRequest, readJsonBody, sendJson, } from './dev-auth-proxy-core.js';
+import { createDevAuthProxyHandler } from './dev-proxy.js';
 import { readDotEnvFile } from './dot-env.js';
-function resolveSessionStorageKey(options) {
-    return options.sessionStorageKey ?? `bardioc.dev.auth.${options.appName}`;
-}
 function readRuntimeEnv(server) {
     const envDir = server.config.envDir ?? server.config.root;
     const mode = server.config.mode?.trim();
-    const envFileNames = [
+    const env = {};
+    for (const fileName of [
         '.env',
         '.env.local',
         mode ? `.env.${mode}` : null,
         mode ? `.env.${mode}.local` : null,
-    ];
-    const env = {};
-    for (const fileName of envFileNames) {
-        if (!fileName) {
+    ]) {
+        if (!fileName)
             continue;
-        }
         const filePath = resolve(envDir, fileName);
-        if (!existsSync(filePath)) {
-            continue;
+        if (existsSync(filePath)) {
+            Object.assign(env, readDotEnvFile(filePath));
         }
-        Object.assign(env, readDotEnvFile(filePath));
     }
     for (const [key, value] of Object.entries(process.env)) {
         if (typeof value === 'string') {
             env[key] = value;
         }
     }
-    return env;
-}
-function readDevAuthEnv(server, options) {
-    const env = readRuntimeEnv(server);
-    const hostUrl = env.DEV_AUTH_HOST_URL?.trim().replace(/\/$/, '');
-    const devSessionKey = env.DEV_SESSION_KEY?.trim();
-    const exchangeAppId = env.VITE_APP_ID?.trim();
-    if (!hostUrl || !devSessionKey || !exchangeAppId) {
-        return null;
-    }
     return {
-        exchangeAppId,
-        hostUrl,
-        devSessionKey,
-        sessionStorageKey: resolveSessionStorageKey(options),
-    };
-}
-function getRequestPathname(req) {
-    const originalUrl = req.__bardiocOriginalUrl;
-    return new URL(originalUrl ?? req.url ?? '/', `http://${req.headers.host ?? 'localhost'}`)
-        .pathname;
-}
-function getBasePath(req, routePath) {
-    const pathname = getRequestPathname(req);
-    if (pathname.endsWith(routePath)) {
-        const basePath = pathname.slice(0, -routePath.length);
-        return basePath || '/';
-    }
-    return '/';
-}
-function buildAppPath(basePath, path) {
-    const normalizedBase = basePath === '/' ? '' : basePath.replace(/\/$/, '');
-    const normalizedPath = path.startsWith('/') ? path : `/${path}`;
-    return `${normalizedBase}${normalizedPath}`;
-}
-function sendHtml(res, status, html) {
-    res.statusCode = status;
-    res.setHeader('Content-Type', 'text/html; charset=utf-8');
-    res.setHeader('Cache-Control', 'no-store');
-    res.end(html);
-}
-function renderLoginHtml(session, basePath, sessionStorageKey) {
-    const payload = JSON.stringify(JSON.stringify(session))
-        .replace(/</g, '\\u003c')
-        .replace(/>/g, '\\u003e')
-        .replace(/&/g, '\\u0026');
-    const redirectPath = buildAppPath(basePath, '/');
-    return `<!doctype html>
-<html lang="en">
-  <head>
-    <meta charset="utf-8" />
-    <meta name="viewport" content="width=device-width, initial-scale=1" />
-    <title>Signing in...</title>
-  </head>
-  <body>
-    <script>
-      window.localStorage.removeItem('${sessionStorageKey.replace('bardioc.dev.auth.', '')}.dev.auth');
-      window.localStorage.setItem('${sessionStorageKey}', ${payload});
-      window.location.replace(${JSON.stringify(redirectPath)});
-    </script>
-  </body>
-</html>`;
-}
-function createLoginHandler(env) {
-    return async (req, res) => {
-        const basePath = getBasePath(req, '/login');
-        sendHtml(res, 200, renderLoginHtml({
-            sessionKey: env.devSessionKey,
-            hostUrl: env.hostUrl,
-            scopeId: null,
-        }, basePath, env.sessionStorageKey));
-    };
-}
-function createProxyHandler(options) {
-    return async (req, res) => {
-        const payload = await readJsonBody(req);
-        if (!payload?.path) {
-            sendJson(res, 400, { error: 'invalid_payload' });
-            return;
-        }
-        try {
-            const transportResponse = await forwardDevAuthProxyRequest(payload, {
-                appId: options.appId,
-                hostUrl: options.env.hostUrl,
-                devSessionKey: options.env.devSessionKey,
-            });
-            const responseText = await transportResponse.text();
-            res.statusCode = transportResponse.status;
-            const contentType = transportResponse.headers.get('content-type');
-            if (contentType) {
-                res.setHeader('Content-Type', contentType);
-            }
-            res.setHeader('Cache-Control', 'no-store');
-            res.end(responseText);
-        }
-        catch (error) {
-            if (error instanceof Error && error.message === 'missing_dev_session') {
-                sendJson(res, 400, { error: 'missing_dev_session' });
-                return;
-            }
-            sendJson(res, 502, { error: 'host_transport_failed' });
-        }
-    };
-}
-function createDevAuthRouter(options) {
-    const handleLogin = createLoginHandler(options.env);
-    const handleProxy = createProxyHandler(options);
-    const handlers = {
-        'GET /login': handleLogin,
-        'POST /proxy': handleProxy,
-    };
-    return async (req, res) => {
-        const url = new URL(req.url ?? '/', `http://${req.headers.host ?? 'localhost'}`);
-        const key = `${req.method ?? 'GET'} ${url.pathname}`;
-        const handler = handlers[key];
-        if (!handler) {
-            sendJson(res, 404, { error: 'not_found' });
-            return;
-        }
-        await handler(req, res);
+        DEV_SECRET: env.DEV_SECRET?.trim(),
+        API_BASE_URL: env.API_BASE_URL?.trim().replace(/\/$/, ''),
     };
 }
 export function bardiocDevAuth(options) {
-    let runtimeConfig = null;
+    let proxyOptions = options.proxy ?? null;
     return {
         name: 'bardioc-dev-auth',
         apply: 'serve',
         enforce: 'pre',
         configureServer(server) {
-            runtimeConfig = readDevAuthEnv(server, options);
-            if (!runtimeConfig) {
-                server.config.logger.warn(`[bardioc-dev-auth] DEV_AUTH_HOST_URL + DEV_SESSION_KEY, plus VITE_APP_ID, are required in env files — dev auth disabled for appName="${options.appName}".`);
-                return;
+            if (!proxyOptions) {
+                const env = readRuntimeEnv(server);
+                if (!env.DEV_SECRET || !env.API_BASE_URL) {
+                    server.config.logger.warn(`[bardioc-dev-auth] DEV_SECRET and API_BASE_URL are required for dev auth — disabled for appName="${options.appName}".`);
+                    return;
+                }
+                proxyOptions = {
+                    apiBaseUrl: env.API_BASE_URL,
+                    devSecret: env.DEV_SECRET,
+                };
             }
-            const env = {
-                hostUrl: runtimeConfig.hostUrl,
-                devSessionKey: runtimeConfig.devSessionKey,
-                sessionStorageKey: runtimeConfig.sessionStorageKey,
-            };
-            const router = createDevAuthRouter({ appId: runtimeConfig.exchangeAppId, env });
-            server.config.logger.info(`[bardioc-dev-auth] enabled for appName="${options.appName}" appId="${runtimeConfig.exchangeAppId}" → ${runtimeConfig.hostUrl}/api/transport`);
+            const handler = createDevAuthProxyHandler(proxyOptions);
             const basePath = server.config.base.endsWith('/')
                 ? server.config.base.slice(0, -1)
                 : server.config.base;
+            server.config.logger.info(`[bardioc-dev-auth] proxying /rest/* → ${proxyOptions.apiBaseUrl} for appName="${options.appName}"`);
             server.middlewares.use(async (req, res, next) => {
                 const originalUrl = req.url ?? '';
-                const devAuthReq = req;
                 const parsed = new URL(originalUrl, 'http://localhost');
                 const pathname = parsed.pathname;
                 const routePath = pathname.startsWith(basePath)
                     ? pathname.slice(basePath.length) || '/'
                     : pathname;
-                const shouldHandle = routePath === '/login' || routePath === '/proxy';
-                if (shouldHandle) {
-                    try {
-                        devAuthReq.__bardiocOriginalUrl = originalUrl;
-                        req.url = `${routePath}${parsed.search}`;
-                        await router(req, res);
-                    }
-                    catch (error) {
-                        next(error);
-                    }
-                    finally {
-                        req.url = originalUrl;
-                        delete devAuthReq.__bardiocOriginalUrl;
-                    }
-                }
-                else {
+                if (!routePath.startsWith('/rest/')) {
                     next();
+                    return;
+                }
+                try {
+                    req.url = `${routePath}${parsed.search}`;
+                    await handler(req, res);
+                }
+                catch (error) {
+                    next(error);
+                }
+                finally {
+                    req.url = originalUrl;
                 }
             });
         },
-        transformIndexHtml() {
-            if (!runtimeConfig) {
-                return;
-            }
-            return [
-                {
-                    tag: 'script',
-                    injectTo: 'head',
-                    children: `window.__BARDIOC_DEV_AUTH__ = ${JSON.stringify({
-                        hostUrl: runtimeConfig.hostUrl,
-                        sessionKey: runtimeConfig.devSessionKey,
-                    })};`,
-                },
-            ];
-        },
     };
 }

package/dist/dev-proxy.d.ts

@@ -1,8 +1,17 @@
 import type { IncomingMessage, ServerResponse } from 'node:http';
 export interface DevAuthProxyOptions {
-    appId: string;
-    hostUrl: string;
-    devSessionKey: string;
+    /** Upstream BFF base URL (e.g. `https://your-bff-host`). */
+    apiBaseUrl: string;
+    /** Dev secret copied from the backend. */
+    devSecret: string;
+    /** Optional CORS origin (e.g. `*`). */
     allowOrigin?: string;
 }
+interface SendJsonOptions {
+    allowOrigin?: string;
+}
+export declare function readRequestBody(req: IncomingMessage): Promise<Buffer>;
+export declare function applyCors(res: ServerResponse, allowOrigin?: string): void;
+export declare function sendJson(res: ServerResponse, status: number, body: unknown, options?: SendJsonOptions): void;
 export declare function createDevAuthProxyHandler(options: DevAuthProxyOptions): (req: IncomingMessage, res: ServerResponse) => Promise<void>;
+export {};

package/dist/dev-proxy.js

@@ -1,40 +1,99 @@
-import { applyCors, forwardDevAuthProxyRequest, readJsonBody, sendJson, } from './dev-auth-proxy-core.js';
+export async function readRequestBody(req) {
+    return new Promise((resolve, reject) => {
+        const chunks = [];
+        req.on('data', (chunk) => chunks.push(chunk));
+        req.on('end', () => resolve(Buffer.concat(chunks)));
+        req.on('error', reject);
+    });
+}
+export function applyCors(res, allowOrigin) {
+    if (!allowOrigin) {
+        return;
+    }
+    res.setHeader('Access-Control-Allow-Origin', allowOrigin);
+    res.setHeader('Access-Control-Allow-Methods', 'GET,POST,PUT,PATCH,DELETE,OPTIONS');
+    res.setHeader('Access-Control-Allow-Headers', 'Content-Type, X-Scope-ID');
+}
+export function sendJson(res, status, body, options = {}) {
+    applyCors(res, options.allowOrigin);
+    res.statusCode = status;
+    res.setHeader('Content-Type', 'application/json');
+    res.setHeader('Cache-Control', 'no-store');
+    res.end(JSON.stringify(body));
+}
+function normalizeApiBaseUrl(value) {
+    return value.trim().replace(/\/$/, '');
+}
+function addDevSecretHeader(req, headers, devSecret) {
+    const url = req.url ?? '/';
+    if (url.startsWith('/rest/') && !url.startsWith('/rest/auth/local-dev-secret')) {
+        headers.set('X-Dev-Secret', devSecret);
+    }
+    return headers;
+}
 export function createDevAuthProxyHandler(options) {
+    const apiBaseUrl = normalizeApiBaseUrl(options.apiBaseUrl);
+    const { devSecret, allowOrigin } = options;
     return async (req, res) => {
-        const pathname = new URL(req.url ?? '/', `http://${req.headers.host ?? 'localhost'}`).pathname;
+        const url = new URL(req.url ?? '/', `http://${req.headers.host ?? 'localhost'}`);
         if (req.method === 'OPTIONS') {
-            applyCors(res, options.allowOrigin);
+            applyCors(res, allowOrigin);
             res.statusCode = 204;
             res.end();
             return;
         }
-        if (req.method !== 'POST' || pathname !== '/proxy') {
-            sendJson(res, 404, { error: 'not_found' }, { allowOrigin: options.allowOrigin });
+        if (!url.pathname.startsWith('/rest/')) {
+            sendJson(res, 404, { error: 'not_found' }, { allowOrigin });
             return;
         }
-        const payload = await readJsonBody(req);
-        if (!payload?.path) {
-            sendJson(res, 400, { error: 'invalid_payload' }, { allowOrigin: options.allowOrigin });
+        const upstreamPath = url.pathname.slice('/rest'.length) + url.search;
+        const upstreamUrl = `${apiBaseUrl}${upstreamPath}`;
+        const headers = new Headers();
+        const contentType = req.headers['content-type'];
+        if (contentType) {
+            headers.set('Content-Type', contentType);
+        }
+        addDevSecretHeader(req, headers, devSecret);
+        // Forward a few useful headers from the browser.
+        const forwardedHeaders = ['accept', 'accept-language', 'x-scope-id'];
+        for (const name of forwardedHeaders) {
+            const value = req.headers[name];
+            if (typeof value === 'string') {
+                headers.set(name, value);
+            }
+            else if (Array.isArray(value)) {
+                for (const v of value) {
+                    headers.append(name, v);
+                }
+            }
+        }
+        let body;
+        try {
+            body = await readRequestBody(req);
+        }
+        catch {
+            sendJson(res, 400, { error: 'invalid_body' }, { allowOrigin });
             return;
         }
         try {
-            const transportResponse = await forwardDevAuthProxyRequest(payload, options);
-            const responseText = await transportResponse.text();
-            applyCors(res, options.allowOrigin);
-            res.statusCode = transportResponse.status;
+            const upstreamRes = await fetch(upstreamUrl, {
+                method: req.method ?? 'GET',
+                headers,
+                body: body.length > 0 ? new Uint8Array(body) : undefined,
+                cache: 'no-store',
+            });
+            applyCors(res, allowOrigin);
+            res.statusCode = upstreamRes.status;
             res.setHeader('Cache-Control', 'no-store');
-            const contentType = transportResponse.headers.get('content-type');
-            if (contentType) {
-                res.setHeader('Content-Type', contentType);
+            const upstreamContentType = upstreamRes.headers.get('content-type');
+            if (upstreamContentType) {
+                res.setHeader('Content-Type', upstreamContentType);
             }
-            res.end(responseText);
+            const responseBody = Buffer.from(await upstreamRes.arrayBuffer());
+            res.end(responseBody);
         }
-        catch (error) {
-            if (error instanceof Error && error.message === 'missing_dev_session') {
-                sendJson(res, 400, { error: 'missing_dev_session' }, { allowOrigin: options.allowOrigin });
-                return;
-            }
-            sendJson(res, 502, { error: 'host_transport_failed' }, { allowOrigin: options.allowOrigin });
+        catch {
+            sendJson(res, 502, { error: 'upstream_unavailable' }, { allowOrigin });
         }
     };
 }

package/dist/dev.d.ts

@@ -1,33 +1,8 @@
-export interface InjectedDevAuthConfig {
-    hostUrl?: string;
-    sessionKey?: string;
-    proxyUrl?: string;
-}
-export interface DevAuthSession {
-    sessionKey?: string;
-    hostUrl?: string;
-    scopeId: string | null;
-}
-export interface DevAuthStorageOptions {
-    appId: string;
-    appName?: string;
-    storageKey?: string;
-}
-export interface EnsureDevAuthSessionOptions extends DevAuthStorageOptions {
-    baseUrl?: string;
-    loginPath?: string;
-    redirect?: (url: string) => void;
-}
-export interface DevBridgeOptions extends DevAuthStorageOptions {
+export interface DevBridgeOptions {
+    /** Base URL prepended to SDK transport paths. Defaults to `/rest`. */
+    apiBaseUrl?: string;
     debug?: boolean;
-    baseUrl?: string;
-    proxyPath?: string;
 }
-export declare function getInjectedDevAuthConfig(): InjectedDevAuthConfig | null;
 export declare function isInsideIframe(): boolean;
 export declare function isDevStandalone(): boolean;
-export declare function getDevSession(options: DevAuthStorageOptions): DevAuthSession | null;
-export declare function getDevScopeId(options: DevAuthStorageOptions): string | null;
-export declare function clearDevAuthSession(options: DevAuthStorageOptions): void;
-export declare function ensureDevAuthSession(options: EnsureDevAuthSessionOptions): Promise<void>;
-export declare function installDevBridge(options: DevBridgeOptions): () => void;
+export declare function installDevBridge(options?: DevBridgeOptions): () => void;

package/dist/dev.js

@@ -1,47 +1,6 @@
 import { SDK_MSG } from './protocol.js';
 function getBaseUrl(baseUrl) {
-    const metaEnv = import.meta.env;
-    return baseUrl ?? metaEnv?.BASE_URL ?? '/';
-}
-function resolveStorageKey(options) {
-    return options.storageKey ?? `bardioc.dev.auth.${options.appName ?? options.appId}`;
-}
-function writeDevSession(storageKey, session) {
-    localStorage.setItem(storageKey, JSON.stringify(session));
-}
-export function getInjectedDevAuthConfig() {
-    const config = globalThis.__BARDIOC_DEV_AUTH__;
-    if (!config?.hostUrl || !config?.sessionKey) {
-        return null;
-    }
-    return {
-        hostUrl: config.hostUrl,
-        sessionKey: config.sessionKey,
-        proxyUrl: typeof config.proxyUrl === 'string' ? config.proxyUrl : undefined,
-    };
-}
-function readStoredSession(storageKey) {
-    const raw = localStorage.getItem(storageKey);
-    if (!raw) {
-        return null;
-    }
-    try {
-        const parsed = JSON.parse(raw);
-        const hasHostSession = typeof parsed.sessionKey === 'string' && typeof parsed.hostUrl === 'string';
-        if (!hasHostSession) {
-            localStorage.removeItem(storageKey);
-            return null;
-        }
-        return {
-            sessionKey: typeof parsed.sessionKey === 'string' ? parsed.sessionKey : undefined,
-            hostUrl: typeof parsed.hostUrl === 'string' ? parsed.hostUrl : undefined,
-            scopeId: typeof parsed.scopeId === 'string' ? parsed.scopeId : null,
-        };
-    }
-    catch {
-        localStorage.removeItem(storageKey);
-        return null;
-    }
+    return baseUrl ?? '/rest';
 }
 export function isInsideIframe() {
     const currentWindow = globalThis;
@@ -51,57 +10,16 @@ export function isDevStandalone() {
     const metaEnv = import.meta.env;
     return Boolean(metaEnv?.DEV) && !isInsideIframe();
 }
-export function getDevSession(options) {
-    return readStoredSession(resolveStorageKey(options));
-}
-export function getDevScopeId(options) {
-    return getDevSession(options)?.scopeId ?? null;
-}
-export function clearDevAuthSession(options) {
-    localStorage.removeItem(resolveStorageKey(options));
-}
-export async function ensureDevAuthSession(options) {
-    const storageKey = resolveStorageKey(options);
-    const url = new URL(window.location.href);
-    const authError = url.searchParams.get('auth_error');
-    if (authError) {
-        console.error('[dev-auth] Authentication failed:', authError);
-        url.searchParams.delete('auth_error');
-        window.history.replaceState({}, '', url.toString());
-        throw new Error(`Authentication failed: ${authError}`);
-    }
-    const injectedConfig = getInjectedDevAuthConfig();
-    if (injectedConfig) {
-        const storedSession = readStoredSession(storageKey);
-        if (storedSession?.hostUrl !== injectedConfig.hostUrl ||
-            storedSession?.sessionKey !== injectedConfig.sessionKey) {
-            writeDevSession(storageKey, {
-                hostUrl: injectedConfig.hostUrl,
-                sessionKey: injectedConfig.sessionKey,
-                scopeId: null,
-            });
-        }
-        return;
-    }
-    const session = readStoredSession(storageKey);
-    if (session?.sessionKey) {
-        return;
+function shouldForwardScope(policy, scopeId) {
+    if (policy === 'required') {
+        return true;
     }
-    const loginPath = options.loginPath ?? 'login';
-    const loginUrl = new URL(loginPath, window.location.origin + getBaseUrl(options.baseUrl)).toString();
-    console.info('[dev-auth] redirecting browser to login', {
-        currentUrl: url.toString(),
-        baseUrl: getBaseUrl(options.baseUrl),
-        loginUrl,
-    });
-    (options.redirect ?? ((nextUrl) => window.location.replace(nextUrl)))(loginUrl);
-    await new Promise(() => { });
+    return policy === 'optional' && scopeId !== undefined;
 }
-export function installDevBridge(options) {
-    const { appId, debug = false } = options;
+export function installDevBridge(options = {}) {
+    const apiBaseUrl = getBaseUrl(options.apiBaseUrl);
+    const debug = options.debug ?? false;
     const origin = window.location.origin;
-    const proxyUrl = new URL(options.proxyPath ?? 'proxy', window.location.origin + getBaseUrl(options.baseUrl)).toString();
-    const readSession = () => getDevSession(options);
     const log = (...args) => {
         if (debug) {
             console.log('[bardioc-dev-bridge]', ...args);
@@ -117,71 +35,48 @@ export function installDevBridge(options) {
         window.postMessage({ type: SDK_MSG.INIT_ACK, id, payload }, origin);
     }
     async function handleTransport(payload) {
-        const session = readSession();
-        if (!session?.sessionKey) {
-            throw new Error('No auth session available');
+        const headers = new Headers();
+        const body = payload.body == null
+            ? undefined
+            : payload.contentType === 'application/json'
+                ? JSON.stringify(payload.body)
+                : payload.body;
+        if (body && payload.contentType) {
+            headers.set('Content-Type', payload.contentType);
+        }
+        if (shouldForwardScope(payload.scopePolicy, payload.scopeId)) {
+            headers.set('X-Scope-ID', payload.scopeId ?? '');
         }
-        const shouldForwardScope = payload.scopePolicy === 'optional' || payload.scopePolicy === 'required';
-        const forwardedScopeId = shouldForwardScope
-            ? (payload.scopeId ?? session.scopeId ?? null)
-            : null;
-        console.info('[bardioc-dev-bridge][1/2] sending dev session to local proxy', {
-            proxyUrl,
-            appId,
-            path: payload.path,
+        const url = `${apiBaseUrl}${payload.path}`;
+        log('[transport]', payload.method ?? 'GET', url);
+        const response = await fetch(url, {
             method: payload.method ?? 'GET',
-            scopePolicy: payload.scopePolicy ?? 'none',
-            forwardedScopeId,
-            hasDevSessionKey: !!session.sessionKey,
-            nextStep: 'local_proxy_relays_to_host_transport',
-        });
-        const response = await fetch(proxyUrl, {
-            method: 'POST',
-            headers: { 'Content-Type': 'application/json' },
-            body: JSON.stringify({
-                sessionKey: session.sessionKey,
-                hostUrl: session.hostUrl,
-                scopeId: forwardedScopeId,
-                path: payload.path,
-                method: payload.method ?? 'GET',
-                body: payload.body,
-                contentType: payload.contentType,
-                scopePolicy: payload.scopePolicy,
-            }),
+            headers,
+            body,
+            credentials: 'include',
             cache: 'no-store',
         });
+        const contentType = response.headers.get('content-type') ?? '';
         const text = await response.text();
-        let data = null;
-        if (text) {
-            try {
-                data = JSON.parse(text);
-            }
-            catch {
-                data = text;
-            }
-        }
         if (!response.ok) {
-            console.error('[bardioc-dev-bridge] proxy request failed', {
-                proxyUrl,
-                path: payload.path,
-                method: payload.method ?? 'GET',
-                status: response.status,
-                failureStage: response.headers.get('X-Bardioc-Dev-Auth-Stage'),
-                responsePayload: data,
-            });
+            const responsePayload = contentType.includes('application/json')
+                ? JSON.parse(text)
+                : text;
             const err = new Error(`Transport ${payload.path} failed: ${response.status}`);
-            Object.assign(err, { status: response.status, responsePayload: data });
+            Object.assign(err, { status: response.status, responsePayload });
             throw err;
         }
-        return data;
+        if (!text) {
+            return null;
+        }
+        return contentType.includes('application/json') ? JSON.parse(text) : text;
     }
     async function handleKernelProxy(payload) {
         if (payload.kernelType === 'PING') {
             return { pong: true };
         }
         if (payload.kernelType === 'GET_SESSION_STATE') {
-            const session = readSession();
-            return { authenticated: !!session?.sessionKey };
+            return { authenticated: true };
         }
         throw new Error(`Kernel message ${payload.kernelType} not supported in dev bridge`);
     }
@@ -200,7 +95,7 @@ export function installDevBridge(options) {
         try {
             switch (data.type) {
                 case SDK_MSG.INIT:
-                    ack(data.id, { appId, instanceId: null });
+                    ack(data.id, { appId: null, instanceId: null });
                     return;
                 case SDK_MSG.NOTIFY:
                     return;

package/dist/host-bridge.js

@@ -1,4 +1,3 @@
-import { getInjectedDevAuthConfig } from './dev.js';
 import { SDK_MSG } from './protocol.js';
 import { GraphTransport } from './transports/graph-transport.js';
 import { OsTransport } from './transports/os-transport.js';
@@ -36,10 +35,6 @@ export function createHostBridge(config) {
             console.log('[app-sdk]', ...args);
     }
     log('createHostBridge', { appId: hintAppId, targetOrigin, isInsideIframe });
-    const standaloneDevAuthActive = !isInsideIframe && !!getInjectedDevAuthConfig();
-    if (!isInsideIframe && !standaloneDevAuthActive) {
-        console.warn('[app-sdk] NOT inside an iframe — bridge will not work standalone.');
-    }
     let _connected = false;
     let _context = null;
     let _destroyed = false;

package/dist/react.d.ts

@@ -1,5 +1,4 @@
 import { type ReactNode } from 'react';
-import { type DevAuthStorageOptions } from './dev.js';
 import type { GraphEvent, HostBridge, HostBridgeConfig, NotifyLevel, OsConfig, SdkCommandDefinition, SdkCommandHandler, SdkMenuRoot } from './types.js';
 export interface AppSdkProviderProps extends HostBridgeConfig {
     children: ReactNode;
@@ -30,5 +29,3 @@ export declare function useOsConfig(): OsConfig | null;
 export declare function useGraphEvents(options: {
     types: string[];
 }, handler: (event: GraphEvent) => void, deps?: React.DependencyList): void;
-/** Returns a stable callback that clears standalone dev auth state and reloads the page. */
-export declare function useStandaloneDevLogout(options: DevAuthStorageOptions): () => void;

package/dist/react.js

@@ -1,6 +1,5 @@
 import { jsx as _jsx } from "react/jsx-runtime";
 import { createContext, useCallback, useContext, useEffect, useRef, useState, } from 'react';
-import { clearDevAuthSession } from './dev.js';
 import { createHostBridge } from './host-bridge.js';
 const SdkContext = createContext(null);
 const SYSTEM_SIZE_CLASS_NAMES = ['text-sm', 'text-base', 'text-lg', 'text-xl'];
@@ -215,10 +214,3 @@ export function useGraphEvents(options, handler, deps = []) {
         // eslint-disable-next-line react-hooks/exhaustive-deps
     }, [bridge, typesKey, ...deps]);
 }
-/** Returns a stable callback that clears standalone dev auth state and reloads the page. */
-export function useStandaloneDevLogout(options) {
-    return useCallback(() => {
-        clearDevAuthSession(options);
-        window.location.reload();
-    }, [options]);
-}

package/dist/vite.js

@@ -3,7 +3,6 @@ import { execSync, spawn } from 'node:child_process';
 import { existsSync, readFileSync } from 'node:fs';
 import { resolve, sep } from 'node:path';
 import { fileURLToPath } from 'node:url';
-import { readDotEnvValue } from './dot-env.js';
 import { MANIFEST_FILENAME, validateManifest } from './manifest.js';
 export { bardiocDevAuth } from './dev-auth-vite.js';
 function hasCommand(cmd) {
@@ -91,8 +90,6 @@ function devProxy(opts) {
             }
             server.httpServer?.on('listening', async () => {
                 const manifestPath = resolve(process.cwd(), 'public', MANIFEST_FILENAME);
-                const envPath = resolve(process.cwd(), '.env');
-                const envAppId = existsSync(envPath) ? readDotEnvValue(envPath, 'VITE_APP_ID') : null;
                 if (!existsSync(manifestPath)) {
                     console.warn(`[bardioc] public/${MANIFEST_FILENAME} not found`);
                     return;
@@ -114,14 +111,12 @@ function devProxy(opts) {
                     }
                     console.log(`[bardioc] Use this live URL in the host App Store app configuration:`);
                     console.log(`[bardioc]   App Name: ${manifestId}`);
-                    console.log(`[bardioc]   App ID: ${envAppId || '<from .env VITE_APP_ID>'}`);
                     console.log(`[bardioc]   Live URL: https://${tunnelHost}`);
                 }
                 else {
                     console.log(`[bardioc] Dev server ready: http://localhost:${port}`);
-                    console.log(`[bardioc] For standalone host-backed auth, open this app in the host App Store and use "Copy Dev Session".`);
+                    console.log(`[bardioc] For standalone dev auth, set DEV_SECRET and API_BASE_URL in .env.`);
                     console.log(`[bardioc]   App Name: ${manifestId}`);
-                    console.log(`[bardioc]   App ID: ${envAppId || '<from .env VITE_APP_ID>'}`);
                     console.log(`[bardioc]   URL: http://localhost:${port}`);
                 }
             });

package/package.json

@@ -1,13 +1,10 @@
 {
   "name": "@bardioc/app-sdk",
-  "version": "0.4.2",
+  "version": "0.4.3",
   "description": "SDK for building apps for the Bardioc OS",
   "license": "MIT",
   "private": false,
   "type": "module",
-  "bin": {
-    "bardioc-dev-session": "./dist/dev-session-cli.js"
-  },
   "publishConfig": {
     "registry": "https://registry.npmjs.org/",
     "access": "public"
@@ -44,10 +41,6 @@
       "types": "./dist/dev-proxy.d.ts",
       "default": "./dist/dev-proxy.js"
     },
-    "./dev-session-cli": {
-      "types": "./dist/dev-session-cli.d.ts",
-      "default": "./dist/dev-session-cli.js"
-    },
     "./types": {
       "types": "./dist/types.d.ts"
     }