@bardioc/app-sdk 0.4.2 → 0.4.4

package/README.md

@@ -56,7 +56,7 @@ createRoot(document.getElementById('root')!).render(
 | --------------------------- | ------------------------------------------- |
 | `@bardioc/app-sdk`          | `createHostBridge`, errors, types, manifest |
 | `@bardioc/app-sdk/react`    | `AppSdkProvider`, hooks (`useSdk`, etc.)    |
-| `@bardioc/app-sdk/dev`      | host-backed standalone dev-session helpers  |
+| `@bardioc/app-sdk/dev`      | standalone dev bridge helpers               |
 | `@bardioc/app-sdk/types`    | Type-only TypeScript exports                |
 | `@bardioc/app-sdk/protocol` | `SDK_MSG` constants, wire format types      |
 | `@bardioc/app-sdk/vite`     | `bardiocApp()` Vite plugin                  |
@@ -86,21 +86,10 @@ import {
 } from '@bardioc/app-sdk';
 
 // React hooks
-import {
-  AppSdkProvider,
-  useSdk,
-  useNotify,
-  useSendToKernel,
-  useStandaloneDevLogout,
-} from '@bardioc/app-sdk/react';
+import { AppSdkProvider, useSdk, useNotify, useSendToKernel } from '@bardioc/app-sdk/react';
 
 // Standalone dev helpers
-import {
-  ensureDevAuthSession,
-  installDevBridge,
-  isDevStandalone,
-  isInsideIframe,
-} from '@bardioc/app-sdk/dev';
+import { installDevBridge, isDevStandalone, isInsideIframe } from '@bardioc/app-sdk/dev';
 ```
 
 ## Vite plugin
@@ -137,12 +126,10 @@ New apps scaffolded with `create-bardioc-app` include the `<link>` already.
 
 Standalone local development is host-backed only.
 
-1. Create or open the app in the host App Store so you have its `VITE_APP_ID`.
-2. In the host App Store, open the app details and use `Copy Dev Session`.
-3. Paste the snippet into your local `.env`.
-4. Set `VITE_ENABLE_DEV_AUTH=true` and run `pnpm dev`.
+1. Set `DEV_SECRET` and `API_BASE_URL` in your local `.env`.
+2. Run `pnpm dev`.
 
-That flow stores a host-issued dev session locally and routes transport calls through the host `/api/transport` endpoint. There is no separate local token exchange mode anymore.
+The Vite plugin proxies `/rest/*` requests to `API_BASE_URL` with the `X-Dev-Secret` header, and `installDevBridge()` handles SDK messages when running in standalone dev.
 
 For public testing against a live URL, run `pnpm dev:live` and use the emitted tunnel URL as the app's live URL in the host App Store configuration.
 
@@ -151,7 +138,6 @@ For public testing against a live URL, run `pnpm dev:live` and use the emitted t
 - `useSdk()` — raw bridge instance
 - `useNotify()` — fire-and-forget toast
 - `useSendToKernel()` — proxy a whitelisted message to the OS service worker
-- `useStandaloneDevLogout()` — clear standalone dev auth state and reload the page
 
 ### IndexedDB persistence
 

package/dist/dev-proxy.d.ts

@@ -1,8 +1,19 @@
 import type { IncomingMessage, ServerResponse } from 'node:http';
 export interface DevAuthProxyOptions {
-    appId: string;
-    hostUrl: string;
-    devSessionKey: string;
+    /** Upstream BFF base URL (e.g. `https://your-bff-host`). */
+    apiBaseUrl: string;
+    /** Dev secret copied from the backend. */
+    devSecret: string;
+    /** App slug stamped as `X-App-ID`, mirroring how the host identifies iframe apps. */
+    appId?: string;
+    /** Optional CORS origin (e.g. `*`). */
     allowOrigin?: string;
 }
+interface SendJsonOptions {
+    allowOrigin?: string;
+}
+export declare function readRequestBody(req: IncomingMessage): Promise<Buffer>;
+export declare function applyCors(res: ServerResponse, allowOrigin?: string): void;
+export declare function sendJson(res: ServerResponse, status: number, body: unknown, options?: SendJsonOptions): void;
 export declare function createDevAuthProxyHandler(options: DevAuthProxyOptions): (req: IncomingMessage, res: ServerResponse) => Promise<void>;
+export {};

package/dist/dev-proxy.js

@@ -1,40 +1,106 @@
-import { applyCors, forwardDevAuthProxyRequest, readJsonBody, sendJson, } from './dev-auth-proxy-core.js';
+export async function readRequestBody(req) {
+    return new Promise((resolve, reject) => {
+        const chunks = [];
+        req.on('data', (chunk) => chunks.push(chunk));
+        req.on('end', () => resolve(Buffer.concat(chunks)));
+        req.on('error', reject);
+    });
+}
+export function applyCors(res, allowOrigin) {
+    if (!allowOrigin) {
+        return;
+    }
+    res.setHeader('Access-Control-Allow-Origin', allowOrigin);
+    res.setHeader('Access-Control-Allow-Methods', 'GET,POST,PUT,PATCH,DELETE,OPTIONS');
+    res.setHeader('Access-Control-Allow-Headers', 'Content-Type, X-Scope-ID, X-Requested-With');
+}
+export function sendJson(res, status, body, options = {}) {
+    applyCors(res, options.allowOrigin);
+    res.statusCode = status;
+    res.setHeader('Content-Type', 'application/json');
+    res.setHeader('Cache-Control', 'no-store');
+    res.end(JSON.stringify(body));
+}
+function normalizeApiBaseUrl(value) {
+    return value.trim().replace(/\/$/, '');
+}
+function addDevSecretHeader(req, headers, devSecret) {
+    const url = req.url ?? '/';
+    if (url.startsWith('/rest/') && !url.startsWith('/rest/auth/local-dev-secret')) {
+        headers.set('X-Dev-Secret', devSecret);
+    }
+    return headers;
+}
 export function createDevAuthProxyHandler(options) {
+    const apiBaseUrl = normalizeApiBaseUrl(options.apiBaseUrl);
+    const { devSecret, allowOrigin, appId } = options;
     return async (req, res) => {
-        const pathname = new URL(req.url ?? '/', `http://${req.headers.host ?? 'localhost'}`).pathname;
+        const url = new URL(req.url ?? '/', `http://${req.headers.host ?? 'localhost'}`);
         if (req.method === 'OPTIONS') {
-            applyCors(res, options.allowOrigin);
+            applyCors(res, allowOrigin);
             res.statusCode = 204;
             res.end();
             return;
         }
-        if (req.method !== 'POST' || pathname !== '/proxy') {
-            sendJson(res, 404, { error: 'not_found' }, { allowOrigin: options.allowOrigin });
+        if (!url.pathname.startsWith('/rest/')) {
+            sendJson(res, 404, { error: 'not_found' }, { allowOrigin });
             return;
         }
-        const payload = await readJsonBody(req);
-        if (!payload?.path) {
-            sendJson(res, 400, { error: 'invalid_payload' }, { allowOrigin: options.allowOrigin });
+        const upstreamPath = url.pathname.slice('/rest'.length) + url.search;
+        const upstreamUrl = `${apiBaseUrl}${upstreamPath}`;
+        const headers = new Headers();
+        const contentType = req.headers['content-type'];
+        if (contentType) {
+            headers.set('Content-Type', contentType);
+        }
+        addDevSecretHeader(req, headers, devSecret);
+        // The host stamps X-App-ID from its own registration data, never from the app — the
+        // dev proxy does the same with the configured app slug.
+        if (appId) {
+            headers.set('X-App-ID', appId);
+        }
+        // BFF rejects /bardioc/ calls without this CSRF marker header; stamp it like the host does.
+        headers.set('X-Requested-With', 'XMLHttpRequest');
+        // Forward a few useful headers from the browser.
+        const forwardedHeaders = ['accept', 'accept-language', 'x-scope-id'];
+        for (const name of forwardedHeaders) {
+            const value = req.headers[name];
+            if (typeof value === 'string') {
+                headers.set(name, value);
+            }
+            else if (Array.isArray(value)) {
+                for (const v of value) {
+                    headers.append(name, v);
+                }
+            }
+        }
+        let body;
+        try {
+            body = await readRequestBody(req);
+        }
+        catch {
+            sendJson(res, 400, { error: 'invalid_body' }, { allowOrigin });
             return;
         }
         try {
-            const transportResponse = await forwardDevAuthProxyRequest(payload, options);
-            const responseText = await transportResponse.text();
-            applyCors(res, options.allowOrigin);
-            res.statusCode = transportResponse.status;
+            const upstreamRes = await fetch(upstreamUrl, {
+                method: req.method ?? 'GET',
+                headers,
+                body: body.length > 0 ? new Uint8Array(body) : undefined,
+                cache: 'no-store',
+            });
+            applyCors(res, allowOrigin);
+            res.statusCode = upstreamRes.status;
             res.setHeader('Cache-Control', 'no-store');
-            const contentType = transportResponse.headers.get('content-type');
-            if (contentType) {
-                res.setHeader('Content-Type', contentType);
+            const upstreamContentType = upstreamRes.headers.get('content-type');
+            if (upstreamContentType) {
+                res.setHeader('Content-Type', upstreamContentType);
             }
-            res.end(responseText);
+            const responseBody = Buffer.from(await upstreamRes.arrayBuffer());
+            res.end(responseBody);
         }
-        catch (error) {
-            if (error instanceof Error && error.message === 'missing_dev_session') {
-                sendJson(res, 400, { error: 'missing_dev_session' }, { allowOrigin: options.allowOrigin });
-                return;
-            }
-            sendJson(res, 502, { error: 'host_transport_failed' }, { allowOrigin: options.allowOrigin });
+        catch {
+            sendJson(res, 502, { error: 'upstream_unavailable' }, { allowOrigin });
         }
     };
 }

package/dist/dev.d.ts

@@ -1,33 +1,8 @@
-export interface InjectedDevAuthConfig {
-    hostUrl?: string;
-    sessionKey?: string;
-    proxyUrl?: string;
-}
-export interface DevAuthSession {
-    sessionKey?: string;
-    hostUrl?: string;
-    scopeId: string | null;
-}
-export interface DevAuthStorageOptions {
-    appId: string;
-    appName?: string;
-    storageKey?: string;
-}
-export interface EnsureDevAuthSessionOptions extends DevAuthStorageOptions {
-    baseUrl?: string;
-    loginPath?: string;
-    redirect?: (url: string) => void;
-}
-export interface DevBridgeOptions extends DevAuthStorageOptions {
+export interface DevBridgeOptions {
+    /** Base URL prepended to SDK transport paths. Defaults to `/rest`. */
+    apiBaseUrl?: string;
     debug?: boolean;
-    baseUrl?: string;
-    proxyPath?: string;
 }
-export declare function getInjectedDevAuthConfig(): InjectedDevAuthConfig | null;
 export declare function isInsideIframe(): boolean;
 export declare function isDevStandalone(): boolean;
-export declare function getDevSession(options: DevAuthStorageOptions): DevAuthSession | null;
-export declare function getDevScopeId(options: DevAuthStorageOptions): string | null;
-export declare function clearDevAuthSession(options: DevAuthStorageOptions): void;
-export declare function ensureDevAuthSession(options: EnsureDevAuthSessionOptions): Promise<void>;
-export declare function installDevBridge(options: DevBridgeOptions): () => void;
+export declare function installDevBridge(options?: DevBridgeOptions): () => void;

package/dist/dev.js

@@ -1,47 +1,6 @@
 import { SDK_MSG } from './protocol.js';
 function getBaseUrl(baseUrl) {
-    const metaEnv = import.meta.env;
-    return baseUrl ?? metaEnv?.BASE_URL ?? '/';
-}
-function resolveStorageKey(options) {
-    return options.storageKey ?? `bardioc.dev.auth.${options.appName ?? options.appId}`;
-}
-function writeDevSession(storageKey, session) {
-    localStorage.setItem(storageKey, JSON.stringify(session));
-}
-export function getInjectedDevAuthConfig() {
-    const config = globalThis.__BARDIOC_DEV_AUTH__;
-    if (!config?.hostUrl || !config?.sessionKey) {
-        return null;
-    }
-    return {
-        hostUrl: config.hostUrl,
-        sessionKey: config.sessionKey,
-        proxyUrl: typeof config.proxyUrl === 'string' ? config.proxyUrl : undefined,
-    };
-}
-function readStoredSession(storageKey) {
-    const raw = localStorage.getItem(storageKey);
-    if (!raw) {
-        return null;
-    }
-    try {
-        const parsed = JSON.parse(raw);
-        const hasHostSession = typeof parsed.sessionKey === 'string' && typeof parsed.hostUrl === 'string';
-        if (!hasHostSession) {
-            localStorage.removeItem(storageKey);
-            return null;
-        }
-        return {
-            sessionKey: typeof parsed.sessionKey === 'string' ? parsed.sessionKey : undefined,
-            hostUrl: typeof parsed.hostUrl === 'string' ? parsed.hostUrl : undefined,
-            scopeId: typeof parsed.scopeId === 'string' ? parsed.scopeId : null,
-        };
-    }
-    catch {
-        localStorage.removeItem(storageKey);
-        return null;
-    }
+    return baseUrl ?? '/rest';
 }
 export function isInsideIframe() {
     const currentWindow = globalThis;
@@ -51,57 +10,10 @@ export function isDevStandalone() {
     const metaEnv = import.meta.env;
     return Boolean(metaEnv?.DEV) && !isInsideIframe();
 }
-export function getDevSession(options) {
-    return readStoredSession(resolveStorageKey(options));
-}
-export function getDevScopeId(options) {
-    return getDevSession(options)?.scopeId ?? null;
-}
-export function clearDevAuthSession(options) {
-    localStorage.removeItem(resolveStorageKey(options));
-}
-export async function ensureDevAuthSession(options) {
-    const storageKey = resolveStorageKey(options);
-    const url = new URL(window.location.href);
-    const authError = url.searchParams.get('auth_error');
-    if (authError) {
-        console.error('[dev-auth] Authentication failed:', authError);
-        url.searchParams.delete('auth_error');
-        window.history.replaceState({}, '', url.toString());
-        throw new Error(`Authentication failed: ${authError}`);
-    }
-    const injectedConfig = getInjectedDevAuthConfig();
-    if (injectedConfig) {
-        const storedSession = readStoredSession(storageKey);
-        if (storedSession?.hostUrl !== injectedConfig.hostUrl ||
-            storedSession?.sessionKey !== injectedConfig.sessionKey) {
-            writeDevSession(storageKey, {
-                hostUrl: injectedConfig.hostUrl,
-                sessionKey: injectedConfig.sessionKey,
-                scopeId: null,
-            });
-        }
-        return;
-    }
-    const session = readStoredSession(storageKey);
-    if (session?.sessionKey) {
-        return;
-    }
-    const loginPath = options.loginPath ?? 'login';
-    const loginUrl = new URL(loginPath, window.location.origin + getBaseUrl(options.baseUrl)).toString();
-    console.info('[dev-auth] redirecting browser to login', {
-        currentUrl: url.toString(),
-        baseUrl: getBaseUrl(options.baseUrl),
-        loginUrl,
-    });
-    (options.redirect ?? ((nextUrl) => window.location.replace(nextUrl)))(loginUrl);
-    await new Promise(() => { });
-}
-export function installDevBridge(options) {
-    const { appId, debug = false } = options;
+export function installDevBridge(options = {}) {
+    const apiBaseUrl = getBaseUrl(options.apiBaseUrl);
+    const debug = options.debug ?? false;
     const origin = window.location.origin;
-    const proxyUrl = new URL(options.proxyPath ?? 'proxy', window.location.origin + getBaseUrl(options.baseUrl)).toString();
-    const readSession = () => getDevSession(options);
     const log = (...args) => {
         if (debug) {
             console.log('[bardioc-dev-bridge]', ...args);
@@ -117,71 +29,62 @@ export function installDevBridge(options) {
         window.postMessage({ type: SDK_MSG.INIT_ACK, id, payload }, origin);
     }
     async function handleTransport(payload) {
-        const session = readSession();
-        if (!session?.sessionKey) {
-            throw new Error('No auth session available');
+        const headers = new Headers();
+        const body = payload.body == null
+            ? undefined
+            : payload.contentType === 'application/json'
+                ? JSON.stringify(payload.body)
+                : payload.body;
+        if (body && payload.contentType) {
+            headers.set('Content-Type', payload.contentType);
+        }
+        // BFF rejects /bardioc/ calls without this CSRF marker header.
+        headers.set('X-Requested-With', 'XMLHttpRequest');
+        // Mirror the host bridge: a required scope without an id is rejected locally, and a
+        // resolved scope id is always forwarded regardless of policy. Standalone has no
+        // instance, so there is no instance-based fallback here.
+        const resolvedScopeId = payload.scopeId;
+        if (payload.scopePolicy === 'required' && !resolvedScopeId) {
+            throw new Error('Scope ID is required');
+        }
+        if (resolvedScopeId) {
+            headers.set('X-Scope-ID', resolvedScopeId);
         }
-        const shouldForwardScope = payload.scopePolicy === 'optional' || payload.scopePolicy === 'required';
-        const forwardedScopeId = shouldForwardScope
-            ? (payload.scopeId ?? session.scopeId ?? null)
-            : null;
-        console.info('[bardioc-dev-bridge][1/2] sending dev session to local proxy', {
-            proxyUrl,
-            appId,
-            path: payload.path,
+        const url = `${apiBaseUrl}${payload.path}`;
+        log('[transport]', payload.method ?? 'GET', url);
+        const response = await fetch(url, {
             method: payload.method ?? 'GET',
-            scopePolicy: payload.scopePolicy ?? 'none',
-            forwardedScopeId,
-            hasDevSessionKey: !!session.sessionKey,
-            nextStep: 'local_proxy_relays_to_host_transport',
-        });
-        const response = await fetch(proxyUrl, {
-            method: 'POST',
-            headers: { 'Content-Type': 'application/json' },
-            body: JSON.stringify({
-                sessionKey: session.sessionKey,
-                hostUrl: session.hostUrl,
-                scopeId: forwardedScopeId,
-                path: payload.path,
-                method: payload.method ?? 'GET',
-                body: payload.body,
-                contentType: payload.contentType,
-                scopePolicy: payload.scopePolicy,
-            }),
+            headers,
+            body,
+            credentials: 'include',
             cache: 'no-store',
         });
-        const text = await response.text();
-        let data = null;
-        if (text) {
-            try {
-                data = JSON.parse(text);
-            }
-            catch {
-                data = text;
-            }
-        }
+        const contentType = response.headers.get('content-type') ?? '';
         if (!response.ok) {
-            console.error('[bardioc-dev-bridge] proxy request failed', {
-                proxyUrl,
-                path: payload.path,
-                method: payload.method ?? 'GET',
-                status: response.status,
-                failureStage: response.headers.get('X-Bardioc-Dev-Auth-Stage'),
-                responsePayload: data,
-            });
+            const text = await response.text();
+            const responsePayload = contentType.includes('application/json') && text ? JSON.parse(text) : text;
             const err = new Error(`Transport ${payload.path} failed: ${response.status}`);
-            Object.assign(err, { status: response.status, responsePayload: data });
+            Object.assign(err, { status: response.status, responsePayload });
             throw err;
         }
-        return data;
+        // Same response typing as the host: JSON is parsed, empty/plain text becomes a string,
+        // anything binary (zip, octet-stream, images/svg, …) round-trips as a Blob.
+        if (contentType.includes('application/json')) {
+            const text = await response.text();
+            return text ? JSON.parse(text) : null;
+        }
+        if (contentType === '' || contentType.startsWith('text/')) {
+            const text = await response.text();
+            return text || null;
+        }
+        return response.blob();
     }
     async function handleKernelProxy(payload) {
         if (payload.kernelType === 'PING') {
             return { pong: true };
         }
         if (payload.kernelType === 'GET_SESSION_STATE') {
-            const session = readSession();
-            return { authenticated: !!session?.sessionKey };
+            return { authenticated: true };
         }
         throw new Error(`Kernel message ${payload.kernelType} not supported in dev bridge`);
     }
@@ -200,7 +103,7 @@ export function installDevBridge(options) {
         try {
             switch (data.type) {
                 case SDK_MSG.INIT:
-                    ack(data.id, { appId, instanceId: null });
+                    ack(data.id, { appId: null, instanceId: null });
                     return;
                 case SDK_MSG.NOTIFY:
                     return;

package/dist/dot-env.d.ts

@@ -1,2 +1 @@
 export declare function readDotEnvFile(filePath: string): Record<string, string>;
-export declare function readDotEnvValue(filePath: string, key: string): string | null;

package/dist/dot-env.js

@@ -17,6 +17,3 @@ export function readDotEnvFile(filePath) {
     }
     return env;
 }
-export function readDotEnvValue(filePath, key) {
-    return readDotEnvFile(filePath)[key] ?? null;
-}

package/dist/host-bridge.js

@@ -1,4 +1,3 @@
-import { getInjectedDevAuthConfig } from './dev.js';
 import { SDK_MSG } from './protocol.js';
 import { GraphTransport } from './transports/graph-transport.js';
 import { OsTransport } from './transports/os-transport.js';
@@ -36,10 +35,6 @@ export function createHostBridge(config) {
             console.log('[app-sdk]', ...args);
     }
     log('createHostBridge', { appId: hintAppId, targetOrigin, isInsideIframe });
-    const standaloneDevAuthActive = !isInsideIframe && !!getInjectedDevAuthConfig();
-    if (!isInsideIframe && !standaloneDevAuthActive) {
-        console.warn('[app-sdk] NOT inside an iframe — bridge will not work standalone.');
-    }
     let _connected = false;
     let _context = null;
     let _destroyed = false;

package/dist/react.d.ts

@@ -1,5 +1,4 @@
 import { type ReactNode } from 'react';
-import { type DevAuthStorageOptions } from './dev.js';
 import type { GraphEvent, HostBridge, HostBridgeConfig, NotifyLevel, OsConfig, SdkCommandDefinition, SdkCommandHandler, SdkMenuRoot } from './types.js';
 export interface AppSdkProviderProps extends HostBridgeConfig {
     children: ReactNode;
@@ -30,5 +29,3 @@ export declare function useOsConfig(): OsConfig | null;
 export declare function useGraphEvents(options: {
     types: string[];
 }, handler: (event: GraphEvent) => void, deps?: React.DependencyList): void;
-/** Returns a stable callback that clears standalone dev auth state and reloads the page. */
-export declare function useStandaloneDevLogout(options: DevAuthStorageOptions): () => void;

package/dist/react.js

@@ -1,6 +1,5 @@
 import { jsx as _jsx } from "react/jsx-runtime";
 import { createContext, useCallback, useContext, useEffect, useRef, useState, } from 'react';
-import { clearDevAuthSession } from './dev.js';
 import { createHostBridge } from './host-bridge.js';
 const SdkContext = createContext(null);
 const SYSTEM_SIZE_CLASS_NAMES = ['text-sm', 'text-base', 'text-lg', 'text-xl'];
@@ -9,7 +8,12 @@ function applyOsConfigToDocument(osConfig) {
         return;
     }
     const root = document.documentElement;
-    root.classList.toggle('dark', osConfig.theme === 'dark');
+    const isDark = osConfig.theme === 'dark';
+    root.classList.toggle('dark', isDark);
+    // Advertise the resolved theme to the UA so externally-referenced SVGs (app icon.svg
+    // via <img>, favicons) theme-switch through @media (prefers-color-scheme). Mirrors
+    // webos-host (next-themes enableColorScheme) and Storybook's preview decorator.
+    root.style.colorScheme = isDark ? 'dark' : 'light';
     if (osConfig.language) {
         root.lang = osConfig.language;
     }
@@ -215,10 +219,3 @@ export function useGraphEvents(options, handler, deps = []) {
         // eslint-disable-next-line react-hooks/exhaustive-deps
     }, [bridge, typesKey, ...deps]);
 }
-/** Returns a stable callback that clears standalone dev auth state and reloads the page. */
-export function useStandaloneDevLogout(options) {
-    return useCallback(() => {
-        clearDevAuthSession(options);
-        window.location.reload();
-    }, [options]);
-}

package/dist/vite.d.ts

@@ -1,9 +1,27 @@
 /** Vite plugin for Bardioc iframe apps. Usage: `bardiocApp({ appName, port })` */
-export { bardiocDevAuth, type BardiocDevAuthOptions } from './dev-auth-vite.js';
+import { type DevAuthProxyOptions } from './dev-proxy.js';
 export interface BardiocAppOptions {
     appName?: string;
     port: number;
     previewPort?: number;
 }
+type VitePlugin = {
+    name: string;
+    apply?: 'serve' | 'build';
+    enforce?: 'pre' | 'post';
+    config?: (config: any, env: {
+        command: string;
+    }) => any;
+    configureServer?: (server: any) => void;
+    transformIndexHtml?: () => Promise<any[] | undefined> | any[] | undefined;
+    closeBundle?: () => void;
+};
+export interface BardiocDevAuthOptions {
+    appName: string;
+    /** Optional explicit proxy options. If omitted, DEV_SECRET and API_BASE_URL are read from env. */
+    proxy?: DevAuthProxyOptions;
+}
+export declare function bardiocDevAuth(options: BardiocDevAuthOptions): VitePlugin;
 /** Returns an array of Vite plugins for a Bardioc iframe app. */
 export declare function bardiocApp(opts: BardiocAppOptions): any[];
+export {};

package/dist/vite.js

@@ -3,9 +3,9 @@ import { execSync, spawn } from 'node:child_process';
 import { existsSync, readFileSync } from 'node:fs';
 import { resolve, sep } from 'node:path';
 import { fileURLToPath } from 'node:url';
-import { readDotEnvValue } from './dot-env.js';
+import { createDevAuthProxyHandler } from './dev-proxy.js';
+import { readDotEnvFile } from './dot-env.js';
 import { MANIFEST_FILENAME, validateManifest } from './manifest.js';
-export { bardiocDevAuth } from './dev-auth-vite.js';
 function hasCommand(cmd) {
     try {
         execSync(`which ${cmd}`, { stdio: 'ignore' });
@@ -91,8 +91,6 @@ function devProxy(opts) {
             }
             server.httpServer?.on('listening', async () => {
                 const manifestPath = resolve(process.cwd(), 'public', MANIFEST_FILENAME);
-                const envPath = resolve(process.cwd(), '.env');
-                const envAppId = existsSync(envPath) ? readDotEnvValue(envPath, 'VITE_APP_ID') : null;
                 if (!existsSync(manifestPath)) {
                     console.warn(`[bardioc] public/${MANIFEST_FILENAME} not found`);
                     return;
@@ -114,14 +112,12 @@ function devProxy(opts) {
                     }
                     console.log(`[bardioc] Use this live URL in the host App Store app configuration:`);
                     console.log(`[bardioc]   App Name: ${manifestId}`);
-                    console.log(`[bardioc]   App ID: ${envAppId || '<from .env VITE_APP_ID>'}`);
                     console.log(`[bardioc]   Live URL: https://${tunnelHost}`);
                 }
                 else {
                     console.log(`[bardioc] Dev server ready: http://localhost:${port}`);
-                    console.log(`[bardioc] For standalone host-backed auth, open this app in the host App Store and use "Copy Dev Session".`);
+                    console.log(`[bardioc] For standalone dev auth, set DEV_SECRET and API_BASE_URL in .env.`);
                     console.log(`[bardioc]   App Name: ${manifestId}`);
-                    console.log(`[bardioc]   App ID: ${envAppId || '<from .env VITE_APP_ID>'}`);
                     console.log(`[bardioc]   URL: http://localhost:${port}`);
                 }
             });
@@ -221,6 +217,82 @@ function manifestCheck() {
         },
     };
 }
+function readRuntimeEnv(server) {
+    const envDir = server.config.envDir ?? server.config.root;
+    const mode = server.config.mode?.trim();
+    const env = {};
+    for (const fileName of [
+        '.env',
+        '.env.local',
+        mode ? `.env.${mode}` : null,
+        mode ? `.env.${mode}.local` : null,
+    ]) {
+        if (!fileName)
+            continue;
+        const filePath = resolve(envDir, fileName);
+        if (existsSync(filePath)) {
+            Object.assign(env, readDotEnvFile(filePath));
+        }
+    }
+    for (const [key, value] of Object.entries(process.env)) {
+        if (typeof value === 'string') {
+            env[key] = value;
+        }
+    }
+    return {
+        DEV_SECRET: env.DEV_SECRET?.trim(),
+        API_BASE_URL: env.API_BASE_URL?.trim().replace(/\/$/, ''),
+    };
+}
+export function bardiocDevAuth(options) {
+    let proxyOptions = options.proxy ?? null;
+    return {
+        name: 'bardioc-dev-auth',
+        apply: 'serve',
+        enforce: 'pre',
+        configureServer(server) {
+            if (!proxyOptions) {
+                const env = readRuntimeEnv(server);
+                if (!env.DEV_SECRET || !env.API_BASE_URL) {
+                    server.config.logger.warn(`[bardioc-dev-auth] DEV_SECRET and API_BASE_URL are required for dev auth — disabled for appName="${options.appName}".`);
+                    return;
+                }
+                proxyOptions = {
+                    apiBaseUrl: env.API_BASE_URL,
+                    devSecret: env.DEV_SECRET,
+                    appId: options.appName,
+                };
+            }
+            const handler = createDevAuthProxyHandler(proxyOptions);
+            const basePath = server.config.base.endsWith('/')
+                ? server.config.base.slice(0, -1)
+                : server.config.base;
+            server.config.logger.info(`[bardioc-dev-auth] proxying /rest/* → ${proxyOptions.apiBaseUrl} for appName="${options.appName}"`);
+            server.middlewares.use(async (req, res, next) => {
+                const originalUrl = req.url ?? '';
+                const parsed = new URL(originalUrl, 'http://localhost');
+                const pathname = parsed.pathname;
+                const routePath = pathname.startsWith(basePath)
+                    ? pathname.slice(basePath.length) || '/'
+                    : pathname;
+                if (!routePath.startsWith('/rest/')) {
+                    next();
+                    return;
+                }
+                try {
+                    req.url = `${routePath}${parsed.search}`;
+                    await handler(req, res);
+                }
+                catch (error) {
+                    next(error);
+                }
+                finally {
+                    req.url = originalUrl;
+                }
+            });
+        },
+    };
+}
 /** Returns an array of Vite plugins for a Bardioc iframe app. */
 export function bardiocApp(opts) {
     const { port, previewPort } = opts;

package/package.json

@@ -1,13 +1,10 @@
 {
   "name": "@bardioc/app-sdk",
-  "version": "0.4.2",
+  "version": "0.4.4",
   "description": "SDK for building apps for the Bardioc OS",
   "license": "MIT",
   "private": false,
   "type": "module",
-  "bin": {
-    "bardioc-dev-session": "./dist/dev-session-cli.js"
-  },
   "publishConfig": {
     "registry": "https://registry.npmjs.org/",
     "access": "public"
@@ -44,10 +41,6 @@
       "types": "./dist/dev-proxy.d.ts",
       "default": "./dist/dev-proxy.js"
     },
-    "./dev-session-cli": {
-      "types": "./dist/dev-session-cli.d.ts",
-      "default": "./dist/dev-session-cli.js"
-    },
     "./types": {
       "types": "./dist/types.d.ts"
     }
@@ -76,16 +69,15 @@
     }
   },
   "devDependencies": {
-    "@vitest/coverage-v8": "4.1.5",
-    "@types/node": "^25.6.0",
-    "@types/react": "^19.2.14",
-    "@testing-library/jest-dom": "6.9.1",
+    "@vitest/coverage-v8": "^4.1.8",
+    "@types/node": "^25.9.1",
+    "@types/react": "19.1.16",
     "@testing-library/react": "16.3.2",
     "jsdom": "29.1.0",
-    "react": "19.2.5",
-    "react-dom": "19.2.5",
-    "typescript": "^5.9.3",
-    "vitest": "4.1.5"
+    "react": "19.2.6",
+    "react-dom": "19.2.6",
+    "typescript": "6.0.3",
+    "vitest": "^4.1.8"
   },
   "scripts": {
     "build": "tsc",

package/dist/dev-auth-proxy-core.d.ts

@@ -1,24 +0,0 @@
-import type { IncomingMessage, ServerResponse } from 'node:http';
-export type ProxyPayload = {
-    sessionKey?: string;
-    hostUrl?: string;
-    scopeId?: string | null;
-    scopePolicy?: 'none' | 'optional' | 'required';
-    path: string;
-    method?: 'GET' | 'POST' | 'PUT' | 'PATCH' | 'DELETE';
-    body?: unknown;
-    contentType?: string;
-};
-interface ProxyTransportOptions {
-    appId: string;
-    hostUrl: string;
-    devSessionKey: string;
-}
-interface SendJsonOptions {
-    allowOrigin?: string;
-}
-export declare function readJsonBody<T = unknown>(req: IncomingMessage): Promise<T | null>;
-export declare function applyCors(res: ServerResponse, allowOrigin?: string): void;
-export declare function sendJson(res: ServerResponse, status: number, body: unknown, options?: SendJsonOptions): void;
-export declare function forwardDevAuthProxyRequest(payload: ProxyPayload, options: ProxyTransportOptions): Promise<Response>;
-export {};

package/dist/dev-auth-proxy-core.js

@@ -1,59 +0,0 @@
-export async function readJsonBody(req) {
-    return new Promise(resolveBody => {
-        const chunks = [];
-        req.on('data', (chunk) => chunks.push(chunk));
-        req.on('end', () => {
-            const buffer = Buffer.concat(chunks);
-            if (buffer.length === 0) {
-                resolveBody(null);
-                return;
-            }
-            try {
-                resolveBody(JSON.parse(buffer.toString('utf8')));
-            }
-            catch {
-                resolveBody(null);
-            }
-        });
-        req.on('error', () => resolveBody(null));
-    });
-}
-export function applyCors(res, allowOrigin) {
-    if (!allowOrigin) {
-        return;
-    }
-    res.setHeader('Access-Control-Allow-Origin', allowOrigin);
-    res.setHeader('Access-Control-Allow-Methods', 'POST,OPTIONS');
-    res.setHeader('Access-Control-Allow-Headers', 'Content-Type');
-}
-export function sendJson(res, status, body, options = {}) {
-    applyCors(res, options.allowOrigin);
-    res.statusCode = status;
-    res.setHeader('Content-Type', 'application/json');
-    res.setHeader('Cache-Control', 'no-store');
-    res.end(JSON.stringify(body));
-}
-export async function forwardDevAuthProxyRequest(payload, options) {
-    const hostUrl = payload.hostUrl ?? options.hostUrl;
-    const sessionKey = payload.sessionKey ?? options.devSessionKey;
-    if (!hostUrl || !sessionKey) {
-        throw new Error('missing_dev_session');
-    }
-    return fetch(`${hostUrl.replace(/\/$/, '')}/api/transport`, {
-        method: 'POST',
-        headers: {
-            'Content-Type': 'application/json',
-            'X-Dev-Session-Key': sessionKey,
-        },
-        body: JSON.stringify({
-            appId: options.appId,
-            path: payload.path,
-            method: payload.method ?? 'GET',
-            body: payload.body,
-            contentType: payload.contentType,
-            scopePolicy: payload.scopePolicy,
-            scopeId: payload.scopeId ?? null,
-        }),
-        cache: 'no-store',
-    });
-}

package/dist/dev-auth-vite.d.ts

@@ -1,34 +0,0 @@
-import type { IncomingMessage, ServerResponse } from 'node:http';
-type VitePlugin = {
-    name: string;
-    apply?: 'serve' | 'build';
-    enforce?: 'pre' | 'post';
-    configureServer?: (server: ViteDevServerLike) => void;
-    transformIndexHtml?: () => Array<{
-        tag: string;
-        attrs?: Record<string, string>;
-        children?: string;
-        injectTo?: 'head' | 'body' | 'head-prepend' | 'body-prepend';
-    }> | void;
-};
-interface ViteDevServerLike {
-    config: {
-        root: string;
-        envDir?: string;
-        mode?: string;
-        base: string;
-        logger: {
-            warn: (message: string) => void;
-            info: (message: string) => void;
-        };
-    };
-    middlewares: {
-        use: (handler: (req: IncomingMessage, res: ServerResponse, next: (error?: unknown) => void) => void) => void;
-    };
-}
-export interface BardiocDevAuthOptions {
-    appName: string;
-    sessionStorageKey?: string;
-}
-export declare function bardiocDevAuth(options: BardiocDevAuthOptions): VitePlugin;
-export {};

package/dist/dev-auth-vite.js

@@ -1,221 +0,0 @@
-import { existsSync } from 'node:fs';
-import { resolve } from 'node:path';
-import { forwardDevAuthProxyRequest, readJsonBody, sendJson, } from './dev-auth-proxy-core.js';
-import { readDotEnvFile } from './dot-env.js';
-function resolveSessionStorageKey(options) {
-    return options.sessionStorageKey ?? `bardioc.dev.auth.${options.appName}`;
-}
-function readRuntimeEnv(server) {
-    const envDir = server.config.envDir ?? server.config.root;
-    const mode = server.config.mode?.trim();
-    const envFileNames = [
-        '.env',
-        '.env.local',
-        mode ? `.env.${mode}` : null,
-        mode ? `.env.${mode}.local` : null,
-    ];
-    const env = {};
-    for (const fileName of envFileNames) {
-        if (!fileName) {
-            continue;
-        }
-        const filePath = resolve(envDir, fileName);
-        if (!existsSync(filePath)) {
-            continue;
-        }
-        Object.assign(env, readDotEnvFile(filePath));
-    }
-    for (const [key, value] of Object.entries(process.env)) {
-        if (typeof value === 'string') {
-            env[key] = value;
-        }
-    }
-    return env;
-}
-function readDevAuthEnv(server, options) {
-    const env = readRuntimeEnv(server);
-    const hostUrl = env.DEV_AUTH_HOST_URL?.trim().replace(/\/$/, '');
-    const devSessionKey = env.DEV_SESSION_KEY?.trim();
-    const exchangeAppId = env.VITE_APP_ID?.trim();
-    if (!hostUrl || !devSessionKey || !exchangeAppId) {
-        return null;
-    }
-    return {
-        exchangeAppId,
-        hostUrl,
-        devSessionKey,
-        sessionStorageKey: resolveSessionStorageKey(options),
-    };
-}
-function getRequestPathname(req) {
-    const originalUrl = req.__bardiocOriginalUrl;
-    return new URL(originalUrl ?? req.url ?? '/', `http://${req.headers.host ?? 'localhost'}`)
-        .pathname;
-}
-function getBasePath(req, routePath) {
-    const pathname = getRequestPathname(req);
-    if (pathname.endsWith(routePath)) {
-        const basePath = pathname.slice(0, -routePath.length);
-        return basePath || '/';
-    }
-    return '/';
-}
-function buildAppPath(basePath, path) {
-    const normalizedBase = basePath === '/' ? '' : basePath.replace(/\/$/, '');
-    const normalizedPath = path.startsWith('/') ? path : `/${path}`;
-    return `${normalizedBase}${normalizedPath}`;
-}
-function sendHtml(res, status, html) {
-    res.statusCode = status;
-    res.setHeader('Content-Type', 'text/html; charset=utf-8');
-    res.setHeader('Cache-Control', 'no-store');
-    res.end(html);
-}
-function renderLoginHtml(session, basePath, sessionStorageKey) {
-    const payload = JSON.stringify(JSON.stringify(session))
-        .replace(/</g, '\\u003c')
-        .replace(/>/g, '\\u003e')
-        .replace(/&/g, '\\u0026');
-    const redirectPath = buildAppPath(basePath, '/');
-    return `<!doctype html>
-<html lang="en">
-  <head>
-    <meta charset="utf-8" />
-    <meta name="viewport" content="width=device-width, initial-scale=1" />
-    <title>Signing in...</title>
-  </head>
-  <body>
-    <script>
-      window.localStorage.removeItem('${sessionStorageKey.replace('bardioc.dev.auth.', '')}.dev.auth');
-      window.localStorage.setItem('${sessionStorageKey}', ${payload});
-      window.location.replace(${JSON.stringify(redirectPath)});
-    </script>
-  </body>
-</html>`;
-}
-function createLoginHandler(env) {
-    return async (req, res) => {
-        const basePath = getBasePath(req, '/login');
-        sendHtml(res, 200, renderLoginHtml({
-            sessionKey: env.devSessionKey,
-            hostUrl: env.hostUrl,
-            scopeId: null,
-        }, basePath, env.sessionStorageKey));
-    };
-}
-function createProxyHandler(options) {
-    return async (req, res) => {
-        const payload = await readJsonBody(req);
-        if (!payload?.path) {
-            sendJson(res, 400, { error: 'invalid_payload' });
-            return;
-        }
-        try {
-            const transportResponse = await forwardDevAuthProxyRequest(payload, {
-                appId: options.appId,
-                hostUrl: options.env.hostUrl,
-                devSessionKey: options.env.devSessionKey,
-            });
-            const responseText = await transportResponse.text();
-            res.statusCode = transportResponse.status;
-            const contentType = transportResponse.headers.get('content-type');
-            if (contentType) {
-                res.setHeader('Content-Type', contentType);
-            }
-            res.setHeader('Cache-Control', 'no-store');
-            res.end(responseText);
-        }
-        catch (error) {
-            if (error instanceof Error && error.message === 'missing_dev_session') {
-                sendJson(res, 400, { error: 'missing_dev_session' });
-                return;
-            }
-            sendJson(res, 502, { error: 'host_transport_failed' });
-        }
-    };
-}
-function createDevAuthRouter(options) {
-    const handleLogin = createLoginHandler(options.env);
-    const handleProxy = createProxyHandler(options);
-    const handlers = {
-        'GET /login': handleLogin,
-        'POST /proxy': handleProxy,
-    };
-    return async (req, res) => {
-        const url = new URL(req.url ?? '/', `http://${req.headers.host ?? 'localhost'}`);
-        const key = `${req.method ?? 'GET'} ${url.pathname}`;
-        const handler = handlers[key];
-        if (!handler) {
-            sendJson(res, 404, { error: 'not_found' });
-            return;
-        }
-        await handler(req, res);
-    };
-}
-export function bardiocDevAuth(options) {
-    let runtimeConfig = null;
-    return {
-        name: 'bardioc-dev-auth',
-        apply: 'serve',
-        enforce: 'pre',
-        configureServer(server) {
-            runtimeConfig = readDevAuthEnv(server, options);
-            if (!runtimeConfig) {
-                server.config.logger.warn(`[bardioc-dev-auth] DEV_AUTH_HOST_URL + DEV_SESSION_KEY, plus VITE_APP_ID, are required in env files — dev auth disabled for appName="${options.appName}".`);
-                return;
-            }
-            const env = {
-                hostUrl: runtimeConfig.hostUrl,
-                devSessionKey: runtimeConfig.devSessionKey,
-                sessionStorageKey: runtimeConfig.sessionStorageKey,
-            };
-            const router = createDevAuthRouter({ appId: runtimeConfig.exchangeAppId, env });
-            server.config.logger.info(`[bardioc-dev-auth] enabled for appName="${options.appName}" appId="${runtimeConfig.exchangeAppId}" → ${runtimeConfig.hostUrl}/api/transport`);
-            const basePath = server.config.base.endsWith('/')
-                ? server.config.base.slice(0, -1)
-                : server.config.base;
-            server.middlewares.use(async (req, res, next) => {
-                const originalUrl = req.url ?? '';
-                const devAuthReq = req;
-                const parsed = new URL(originalUrl, 'http://localhost');
-                const pathname = parsed.pathname;
-                const routePath = pathname.startsWith(basePath)
-                    ? pathname.slice(basePath.length) || '/'
-                    : pathname;
-                const shouldHandle = routePath === '/login' || routePath === '/proxy';
-                if (shouldHandle) {
-                    try {
-                        devAuthReq.__bardiocOriginalUrl = originalUrl;
-                        req.url = `${routePath}${parsed.search}`;
-                        await router(req, res);
-                    }
-                    catch (error) {
-                        next(error);
-                    }
-                    finally {
-                        req.url = originalUrl;
-                        delete devAuthReq.__bardiocOriginalUrl;
-                    }
-                }
-                else {
-                    next();
-                }
-            });
-        },
-        transformIndexHtml() {
-            if (!runtimeConfig) {
-                return;
-            }
-            return [
-                {
-                    tag: 'script',
-                    injectTo: 'head',
-                    children: `window.__BARDIOC_DEV_AUTH__ = ${JSON.stringify({
-                        hostUrl: runtimeConfig.hostUrl,
-                        sessionKey: runtimeConfig.devSessionKey,
-                    })};`,
-                },
-            ];
-        },
-    };
-}

package/dist/dev-session-cli.d.ts

@@ -1,34 +0,0 @@
-import { spawn } from 'node:child_process';
-interface CliConfig {
-    hostUrl?: string;
-    cliAccessToken?: string;
-    cliAccessTokenExpiresAt?: number;
-}
-interface RuntimeEnv {
-    VITE_ENABLE_DEV_AUTH?: string;
-    VITE_APP_ID?: string;
-    DEV_AUTH_HOST_URL?: string;
-}
-interface DevSessionResponse {
-    sessionKey: string;
-    hostUrl: string;
-    appId: string;
-}
-interface CliMainRuntime {
-    argv?: string[];
-    cwd?: () => string;
-    env?: NodeJS.ProcessEnv;
-    platform?: NodeJS.Platform;
-    spawnCommand?: typeof spawn;
-    stdout?: Pick<NodeJS.WriteStream, 'write'>;
-    stderr?: Pick<NodeJS.WriteStream, 'write'>;
-    exit?: (code: number) => void;
-    readCliConfig?: () => CliConfig | null;
-}
-export declare function readLayeredEnv(cwd: string, runtimeEnv?: NodeJS.ProcessEnv): RuntimeEnv;
-export declare function readCliConfigFromFile(configPath: string): CliConfig | null;
-export declare function normalizeHostUrl(hostUrl: string): string;
-export declare function assertCliConfig(config: CliConfig | null, hostUrl: string): asserts config is CliConfig;
-export declare function fetchDevSession(hostUrl: string, cliAccessToken: string, appId: string): Promise<DevSessionResponse>;
-export declare function main(runtime?: CliMainRuntime): Promise<void>;
-export {};

package/dist/dev-session-cli.js

@@ -1,125 +0,0 @@
-import { spawn } from 'node:child_process';
-import { existsSync, readFileSync, realpathSync } from 'node:fs';
-import { homedir } from 'node:os';
-import { resolve } from 'node:path';
-import { fileURLToPath } from 'node:url';
-import { readDotEnvFile } from './dot-env.js';
-export function readLayeredEnv(cwd, runtimeEnv = process.env) {
-    const env = {};
-    for (const fileName of ['.env', '.env.local']) {
-        const filePath = resolve(cwd, fileName);
-        if (!existsSync(filePath)) {
-            continue;
-        }
-        Object.assign(env, readDotEnvFile(filePath));
-    }
-    for (const [key, value] of Object.entries(runtimeEnv)) {
-        if (typeof value === 'string') {
-            env[key] = value;
-        }
-    }
-    return env;
-}
-export function readCliConfigFromFile(configPath) {
-    if (!existsSync(configPath)) {
-        return null;
-    }
-    const parsed = JSON.parse(readFileSync(configPath, 'utf8'));
-    return parsed;
-}
-function readCliConfig() {
-    return readCliConfigFromFile(resolve(homedir(), '.bardioc', 'config.json'));
-}
-export function normalizeHostUrl(hostUrl) {
-    return hostUrl.trim().replace(/\/$/, '');
-}
-export function assertCliConfig(config, hostUrl) {
-    if (!config?.hostUrl || !config.cliAccessToken) {
-        throw new Error('Missing CLI login. Run `bardioc login` first.');
-    }
-    if (normalizeHostUrl(config.hostUrl) !== normalizeHostUrl(hostUrl)) {
-        throw new Error(`CLI login host ${normalizeHostUrl(config.hostUrl)} does not match DEV_AUTH_HOST_URL ${normalizeHostUrl(hostUrl)}.`);
-    }
-    if (typeof config.cliAccessTokenExpiresAt === 'number' &&
-        config.cliAccessTokenExpiresAt > 0 &&
-        config.cliAccessTokenExpiresAt * 1000 <= Date.now()) {
-        throw new Error('Stored CLI login is expired. Run `bardioc login` again.');
-    }
-}
-export async function fetchDevSession(hostUrl, cliAccessToken, appId) {
-    const response = await fetch(`${normalizeHostUrl(hostUrl)}/api/auth/dev-session`, {
-        method: 'POST',
-        headers: {
-            'Content-Type': 'application/json',
-            Authorization: `Bearer ${cliAccessToken}`,
-        },
-        body: JSON.stringify({ appId }),
-        cache: 'no-store',
-    });
-    if (!response.ok) {
-        const data = (await response.json().catch(() => ({})));
-        throw new Error(data.error ?? `Dev session failed (${response.status})`);
-    }
-    return (await response.json());
-}
-export async function main(runtime = {}) {
-    const argv = runtime.argv ?? process.argv;
-    const currentEnv = runtime.env ?? process.env;
-    const currentCwd = runtime.cwd ?? (() => process.cwd());
-    const spawnCommand = runtime.spawnCommand ?? spawn;
-    const stdout = runtime.stdout ?? process.stdout;
-    const stderr = runtime.stderr ?? process.stderr;
-    const exit = runtime.exit ?? process.exit;
-    const separatorIndex = argv.indexOf('--');
-    const commandArgs = separatorIndex >= 0 ? argv.slice(separatorIndex + 1) : [];
-    if (commandArgs.length === 0) {
-        throw new Error('Missing command after `--`. Example: bardioc-dev-session -- vite');
-    }
-    const cwd = currentCwd();
-    const env = readLayeredEnv(cwd, currentEnv);
-    const devAuthEnabled = env.VITE_ENABLE_DEV_AUTH === 'true';
-    const childEnv = { ...currentEnv };
-    const [command, ...commandRestArgs] = commandArgs;
-    if (!command) {
-        throw new Error('Missing command after `--`. Example: bardioc-dev-session -- vite');
-    }
-    if (devAuthEnabled) {
-        const appId = env.VITE_APP_ID?.trim();
-        const hostUrl = env.DEV_AUTH_HOST_URL?.trim();
-        if (!appId) {
-            throw new Error('Missing VITE_APP_ID for standalone dev auth.');
-        }
-        if (!hostUrl) {
-            throw new Error('Missing DEV_AUTH_HOST_URL for standalone dev auth.');
-        }
-        const cliConfig = (runtime.readCliConfig ?? readCliConfig)();
-        assertCliConfig(cliConfig, hostUrl);
-        const devSession = await fetchDevSession(hostUrl, cliConfig.cliAccessToken, appId);
-        childEnv.DEV_AUTH_HOST_URL = normalizeHostUrl(devSession.hostUrl);
-        childEnv.DEV_SESSION_KEY = devSession.sessionKey;
-        stdout.write(`[bardioc-dev-session] Refreshed dev session for appId="${devSession.appId}" via ${childEnv.DEV_AUTH_HOST_URL}\n`);
-    }
-    const child = spawnCommand(command, commandRestArgs, {
-        stdio: 'inherit',
-        env: childEnv,
-        shell: (runtime.platform ?? process.platform) === 'win32',
-    });
-    child.on('exit', (code) => {
-        exit(code ?? 0);
-    });
-    child.on('error', (error) => {
-        stderr.write(`${error.message}\n`);
-        exit(1);
-    });
-}
-const isDirectRun = process.argv[1]
-    ? realpathSync.native(resolve(process.argv[1])) ===
-        realpathSync.native(fileURLToPath(import.meta.url))
-    : false;
-if (isDirectRun) {
-    void main().catch(error => {
-        const message = error instanceof Error ? error.message : String(error);
-        process.stderr.write(`[bardioc-dev-session] ${message}\n`);
-        process.exit(1);
-    });
-}