@bardioc/app-sdk 0.4.3 → 0.4.5

package/README.md

@@ -86,19 +86,10 @@ import {
 } from '@bardioc/app-sdk';
 
 // React hooks
-import {
-  AppSdkProvider,
-  useSdk,
-  useNotify,
-  useSendToKernel,
-} from '@bardioc/app-sdk/react';
+import { AppSdkProvider, useSdk, useNotify, useSendToKernel } from '@bardioc/app-sdk/react';
 
 // Standalone dev helpers
-import {
-  installDevBridge,
-  isDevStandalone,
-  isInsideIframe,
-} from '@bardioc/app-sdk/dev';
+import { installDevBridge, isDevStandalone, isInsideIframe } from '@bardioc/app-sdk/dev';
 ```
 
 ## Vite plugin

package/dist/dev-proxy.d.ts

@@ -4,6 +4,8 @@ export interface DevAuthProxyOptions {
     apiBaseUrl: string;
     /** Dev secret copied from the backend. */
     devSecret: string;
+    /** App slug stamped as `X-App-ID`, mirroring how the host identifies iframe apps. */
+    appId?: string;
     /** Optional CORS origin (e.g. `*`). */
     allowOrigin?: string;
 }

package/dist/dev-proxy.js

@@ -12,7 +12,7 @@ export function applyCors(res, allowOrigin) {
     }
     res.setHeader('Access-Control-Allow-Origin', allowOrigin);
     res.setHeader('Access-Control-Allow-Methods', 'GET,POST,PUT,PATCH,DELETE,OPTIONS');
-    res.setHeader('Access-Control-Allow-Headers', 'Content-Type, X-Scope-ID');
+    res.setHeader('Access-Control-Allow-Headers', 'Content-Type, X-Scope-ID, X-Requested-With');
 }
 export function sendJson(res, status, body, options = {}) {
     applyCors(res, options.allowOrigin);
@@ -33,7 +33,7 @@ function addDevSecretHeader(req, headers, devSecret) {
 }
 export function createDevAuthProxyHandler(options) {
     const apiBaseUrl = normalizeApiBaseUrl(options.apiBaseUrl);
-    const { devSecret, allowOrigin } = options;
+    const { devSecret, allowOrigin, appId } = options;
     return async (req, res) => {
         const url = new URL(req.url ?? '/', `http://${req.headers.host ?? 'localhost'}`);
         if (req.method === 'OPTIONS') {
@@ -54,6 +54,13 @@ export function createDevAuthProxyHandler(options) {
             headers.set('Content-Type', contentType);
         }
         addDevSecretHeader(req, headers, devSecret);
+        // The host stamps X-App-ID from its own registration data, never from the app — the
+        // dev proxy does the same with the configured app slug.
+        if (appId) {
+            headers.set('X-App-ID', appId);
+        }
+        // BFF rejects /bardioc/ calls without this CSRF marker header; stamp it like the host does.
+        headers.set('X-Requested-With', 'XMLHttpRequest');
         // Forward a few useful headers from the browser.
         const forwardedHeaders = ['accept', 'accept-language', 'x-scope-id'];
         for (const name of forwardedHeaders) {

package/dist/dev.js

@@ -10,12 +10,6 @@ export function isDevStandalone() {
     const metaEnv = import.meta.env;
     return Boolean(metaEnv?.DEV) && !isInsideIframe();
 }
-function shouldForwardScope(policy, scopeId) {
-    if (policy === 'required') {
-        return true;
-    }
-    return policy === 'optional' && scopeId !== undefined;
-}
 export function installDevBridge(options = {}) {
     const apiBaseUrl = getBaseUrl(options.apiBaseUrl);
     const debug = options.debug ?? false;
@@ -44,8 +38,17 @@ export function installDevBridge(options = {}) {
         if (body && payload.contentType) {
             headers.set('Content-Type', payload.contentType);
         }
-        if (shouldForwardScope(payload.scopePolicy, payload.scopeId)) {
-            headers.set('X-Scope-ID', payload.scopeId ?? '');
+        // BFF rejects /bardioc/ calls without this CSRF marker header.
+        headers.set('X-Requested-With', 'XMLHttpRequest');
+        // Mirror the host bridge: a required scope without an id is rejected locally, and a
+        // resolved scope id is always forwarded regardless of policy. Standalone has no
+        // instance, so there is no instance-based fallback here.
+        const resolvedScopeId = payload.scopeId;
+        if (payload.scopePolicy === 'required' && !resolvedScopeId) {
+            throw new Error('Scope ID is required');
+        }
+        if (resolvedScopeId) {
+            headers.set('X-Scope-ID', resolvedScopeId);
         }
         const url = `${apiBaseUrl}${payload.path}`;
         log('[transport]', payload.method ?? 'GET', url);
@@ -57,19 +60,24 @@ export function installDevBridge(options = {}) {
             cache: 'no-store',
         });
         const contentType = response.headers.get('content-type') ?? '';
-        const text = await response.text();
         if (!response.ok) {
-            const responsePayload = contentType.includes('application/json')
-                ? JSON.parse(text)
-                : text;
+            const text = await response.text();
+            const responsePayload = contentType.includes('application/json') && text ? JSON.parse(text) : text;
             const err = new Error(`Transport ${payload.path} failed: ${response.status}`);
             Object.assign(err, { status: response.status, responsePayload });
             throw err;
         }
-        if (!text) {
-            return null;
+        // Same response typing as the host: JSON is parsed, empty/plain text becomes a string,
+        // anything binary (zip, octet-stream, images/svg, …) round-trips as a Blob.
+        if (contentType.includes('application/json')) {
+            const text = await response.text();
+            return text ? JSON.parse(text) : null;
+        }
+        if (contentType === '' || contentType.startsWith('text/')) {
+            const text = await response.text();
+            return text || null;
         }
-        return contentType.includes('application/json') ? JSON.parse(text) : text;
+        return response.blob();
     }
     async function handleKernelProxy(payload) {
         if (payload.kernelType === 'PING') {

package/dist/dot-env.d.ts

@@ -1,2 +1 @@
 export declare function readDotEnvFile(filePath: string): Record<string, string>;
-export declare function readDotEnvValue(filePath: string, key: string): string | null;

package/dist/dot-env.js

@@ -17,6 +17,3 @@ export function readDotEnvFile(filePath) {
     }
     return env;
 }
-export function readDotEnvValue(filePath, key) {
-    return readDotEnvFile(filePath)[key] ?? null;
-}

package/dist/react.js

@@ -8,7 +8,12 @@ function applyOsConfigToDocument(osConfig) {
         return;
     }
     const root = document.documentElement;
-    root.classList.toggle('dark', osConfig.theme === 'dark');
+    const isDark = osConfig.theme === 'dark';
+    root.classList.toggle('dark', isDark);
+    // Advertise the resolved theme to the UA so externally-referenced SVGs (app icon.svg
+    // via <img>, favicons) theme-switch through @media (prefers-color-scheme). Mirrors
+    // webos-host (next-themes enableColorScheme) and Storybook's preview decorator.
+    root.style.colorScheme = isDark ? 'dark' : 'light';
     if (osConfig.language) {
         root.lang = osConfig.language;
     }

package/dist/vite.d.ts

@@ -1,9 +1,27 @@
 /** Vite plugin for Bardioc iframe apps. Usage: `bardiocApp({ appName, port })` */
-export { bardiocDevAuth, type BardiocDevAuthOptions } from './dev-auth-vite.js';
+import { type DevAuthProxyOptions } from './dev-proxy.js';
 export interface BardiocAppOptions {
     appName?: string;
     port: number;
     previewPort?: number;
 }
+type VitePlugin = {
+    name: string;
+    apply?: 'serve' | 'build';
+    enforce?: 'pre' | 'post';
+    config?: (config: any, env: {
+        command: string;
+    }) => any;
+    configureServer?: (server: any) => void;
+    transformIndexHtml?: () => Promise<any[] | undefined> | any[] | undefined;
+    closeBundle?: () => void;
+};
+export interface BardiocDevAuthOptions {
+    appName: string;
+    /** Optional explicit proxy options. If omitted, DEV_SECRET and API_BASE_URL are read from env. */
+    proxy?: DevAuthProxyOptions;
+}
+export declare function bardiocDevAuth(options: BardiocDevAuthOptions): VitePlugin;
 /** Returns an array of Vite plugins for a Bardioc iframe app. */
 export declare function bardiocApp(opts: BardiocAppOptions): any[];
+export {};

package/dist/vite.js

@@ -3,8 +3,9 @@ import { execSync, spawn } from 'node:child_process';
 import { existsSync, readFileSync } from 'node:fs';
 import { resolve, sep } from 'node:path';
 import { fileURLToPath } from 'node:url';
+import { createDevAuthProxyHandler } from './dev-proxy.js';
+import { readDotEnvFile } from './dot-env.js';
 import { MANIFEST_FILENAME, validateManifest } from './manifest.js';
-export { bardiocDevAuth } from './dev-auth-vite.js';
 function hasCommand(cmd) {
     try {
         execSync(`which ${cmd}`, { stdio: 'ignore' });
@@ -216,6 +217,82 @@ function manifestCheck() {
         },
     };
 }
+function readRuntimeEnv(server) {
+    const envDir = server.config.envDir ?? server.config.root;
+    const mode = server.config.mode?.trim();
+    const env = {};
+    for (const fileName of [
+        '.env',
+        '.env.local',
+        mode ? `.env.${mode}` : null,
+        mode ? `.env.${mode}.local` : null,
+    ]) {
+        if (!fileName)
+            continue;
+        const filePath = resolve(envDir, fileName);
+        if (existsSync(filePath)) {
+            Object.assign(env, readDotEnvFile(filePath));
+        }
+    }
+    for (const [key, value] of Object.entries(process.env)) {
+        if (typeof value === 'string') {
+            env[key] = value;
+        }
+    }
+    return {
+        DEV_SECRET: env.DEV_SECRET?.trim(),
+        API_BASE_URL: env.API_BASE_URL?.trim().replace(/\/$/, ''),
+    };
+}
+export function bardiocDevAuth(options) {
+    let proxyOptions = options.proxy ?? null;
+    return {
+        name: 'bardioc-dev-auth',
+        apply: 'serve',
+        enforce: 'pre',
+        configureServer(server) {
+            if (!proxyOptions) {
+                const env = readRuntimeEnv(server);
+                if (!env.DEV_SECRET || !env.API_BASE_URL) {
+                    server.config.logger.warn(`[bardioc-dev-auth] DEV_SECRET and API_BASE_URL are required for dev auth — disabled for appName="${options.appName}".`);
+                    return;
+                }
+                proxyOptions = {
+                    apiBaseUrl: env.API_BASE_URL,
+                    devSecret: env.DEV_SECRET,
+                    appId: options.appName,
+                };
+            }
+            const handler = createDevAuthProxyHandler(proxyOptions);
+            const basePath = server.config.base.endsWith('/')
+                ? server.config.base.slice(0, -1)
+                : server.config.base;
+            server.config.logger.info(`[bardioc-dev-auth] proxying /rest/* → ${proxyOptions.apiBaseUrl} for appName="${options.appName}"`);
+            server.middlewares.use(async (req, res, next) => {
+                const originalUrl = req.url ?? '';
+                const parsed = new URL(originalUrl, 'http://localhost');
+                const pathname = parsed.pathname;
+                const routePath = pathname.startsWith(basePath)
+                    ? pathname.slice(basePath.length) || '/'
+                    : pathname;
+                if (!routePath.startsWith('/rest/')) {
+                    next();
+                    return;
+                }
+                try {
+                    req.url = `${routePath}${parsed.search}`;
+                    await handler(req, res);
+                }
+                catch (error) {
+                    next(error);
+                }
+                finally {
+                    req.url = originalUrl;
+                }
+            });
+        },
+    };
+}
 /** Returns an array of Vite plugins for a Bardioc iframe app. */
 export function bardiocApp(opts) {
     const { port, previewPort } = opts;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bardioc/app-sdk",
-  "version": "0.4.3",
+  "version": "0.4.5",
   "description": "SDK for building apps for the Bardioc OS",
   "license": "MIT",
   "private": false,
@@ -69,16 +69,15 @@
     }
   },
   "devDependencies": {
-    "@vitest/coverage-v8": "4.1.5",
-    "@types/node": "^25.6.0",
-    "@types/react": "^19.2.14",
-    "@testing-library/jest-dom": "6.9.1",
+    "@vitest/coverage-v8": "^4.1.8",
+    "@types/node": "^25.9.1",
+    "@types/react": "19.1.16",
     "@testing-library/react": "16.3.2",
     "jsdom": "29.1.0",
-    "react": "19.2.5",
-    "react-dom": "19.2.5",
-    "typescript": "^5.9.3",
-    "vitest": "4.1.5"
+    "react": "19.2.6",
+    "react-dom": "19.2.6",
+    "typescript": "6.0.3",
+    "vitest": "^4.1.8"
   },
   "scripts": {
     "build": "tsc",

package/dist/dev-auth-proxy-core.d.ts

@@ -1,24 +0,0 @@
-import type { IncomingMessage, ServerResponse } from 'node:http';
-export type ProxyPayload = {
-    sessionKey?: string;
-    hostUrl?: string;
-    scopeId?: string | null;
-    scopePolicy?: 'none' | 'optional' | 'required';
-    path: string;
-    method?: 'GET' | 'POST' | 'PUT' | 'PATCH' | 'DELETE';
-    body?: unknown;
-    contentType?: string;
-};
-interface ProxyTransportOptions {
-    appId: string;
-    hostUrl: string;
-    devSessionKey: string;
-}
-interface SendJsonOptions {
-    allowOrigin?: string;
-}
-export declare function readJsonBody<T = unknown>(req: IncomingMessage): Promise<T | null>;
-export declare function applyCors(res: ServerResponse, allowOrigin?: string): void;
-export declare function sendJson(res: ServerResponse, status: number, body: unknown, options?: SendJsonOptions): void;
-export declare function forwardDevAuthProxyRequest(payload: ProxyPayload, options: ProxyTransportOptions): Promise<Response>;
-export {};

package/dist/dev-auth-proxy-core.js

@@ -1,59 +0,0 @@
-export async function readJsonBody(req) {
-    return new Promise(resolveBody => {
-        const chunks = [];
-        req.on('data', (chunk) => chunks.push(chunk));
-        req.on('end', () => {
-            const buffer = Buffer.concat(chunks);
-            if (buffer.length === 0) {
-                resolveBody(null);
-                return;
-            }
-            try {
-                resolveBody(JSON.parse(buffer.toString('utf8')));
-            }
-            catch {
-                resolveBody(null);
-            }
-        });
-        req.on('error', () => resolveBody(null));
-    });
-}
-export function applyCors(res, allowOrigin) {
-    if (!allowOrigin) {
-        return;
-    }
-    res.setHeader('Access-Control-Allow-Origin', allowOrigin);
-    res.setHeader('Access-Control-Allow-Methods', 'POST,OPTIONS');
-    res.setHeader('Access-Control-Allow-Headers', 'Content-Type');
-}
-export function sendJson(res, status, body, options = {}) {
-    applyCors(res, options.allowOrigin);
-    res.statusCode = status;
-    res.setHeader('Content-Type', 'application/json');
-    res.setHeader('Cache-Control', 'no-store');
-    res.end(JSON.stringify(body));
-}
-export async function forwardDevAuthProxyRequest(payload, options) {
-    const hostUrl = payload.hostUrl ?? options.hostUrl;
-    const sessionKey = payload.sessionKey ?? options.devSessionKey;
-    if (!hostUrl || !sessionKey) {
-        throw new Error('missing_dev_session');
-    }
-    return fetch(`${hostUrl.replace(/\/$/, '')}/api/transport`, {
-        method: 'POST',
-        headers: {
-            'Content-Type': 'application/json',
-            'X-Dev-Session-Key': sessionKey,
-        },
-        body: JSON.stringify({
-            appId: options.appId,
-            path: payload.path,
-            method: payload.method ?? 'GET',
-            body: payload.body,
-            contentType: payload.contentType,
-            scopePolicy: payload.scopePolicy,
-            scopeId: payload.scopeId ?? null,
-        }),
-        cache: 'no-store',
-    });
-}

package/dist/dev-auth-vite.d.ts

@@ -1,30 +0,0 @@
-import type { IncomingMessage, ServerResponse } from 'node:http';
-import { type DevAuthProxyOptions } from './dev-proxy.js';
-type VitePlugin = {
-    name: string;
-    apply?: 'serve' | 'build';
-    enforce?: 'pre' | 'post';
-    configureServer?: (server: ViteDevServerLike) => void;
-};
-interface ViteDevServerLike {
-    config: {
-        root: string;
-        envDir?: string;
-        mode?: string;
-        base: string;
-        logger: {
-            warn: (message: string) => void;
-            info: (message: string) => void;
-        };
-    };
-    middlewares: {
-        use: (handler: (req: IncomingMessage, res: ServerResponse, next: (error?: unknown) => void) => void) => void;
-    };
-}
-export interface BardiocDevAuthOptions {
-    appName: string;
-    /** Optional explicit proxy options. If omitted, DEV_SECRET and API_BASE_URL are read from env. */
-    proxy?: DevAuthProxyOptions;
-}
-export declare function bardiocDevAuth(options: BardiocDevAuthOptions): VitePlugin;
-export {};

package/dist/dev-auth-vite.js

@@ -1,79 +0,0 @@
-import { existsSync } from 'node:fs';
-import { resolve } from 'node:path';
-import { createDevAuthProxyHandler } from './dev-proxy.js';
-import { readDotEnvFile } from './dot-env.js';
-function readRuntimeEnv(server) {
-    const envDir = server.config.envDir ?? server.config.root;
-    const mode = server.config.mode?.trim();
-    const env = {};
-    for (const fileName of [
-        '.env',
-        '.env.local',
-        mode ? `.env.${mode}` : null,
-        mode ? `.env.${mode}.local` : null,
-    ]) {
-        if (!fileName)
-            continue;
-        const filePath = resolve(envDir, fileName);
-        if (existsSync(filePath)) {
-            Object.assign(env, readDotEnvFile(filePath));
-        }
-    }
-    for (const [key, value] of Object.entries(process.env)) {
-        if (typeof value === 'string') {
-            env[key] = value;
-        }
-    }
-    return {
-        DEV_SECRET: env.DEV_SECRET?.trim(),
-        API_BASE_URL: env.API_BASE_URL?.trim().replace(/\/$/, ''),
-    };
-}
-export function bardiocDevAuth(options) {
-    let proxyOptions = options.proxy ?? null;
-    return {
-        name: 'bardioc-dev-auth',
-        apply: 'serve',
-        enforce: 'pre',
-        configureServer(server) {
-            if (!proxyOptions) {
-                const env = readRuntimeEnv(server);
-                if (!env.DEV_SECRET || !env.API_BASE_URL) {
-                    server.config.logger.warn(`[bardioc-dev-auth] DEV_SECRET and API_BASE_URL are required for dev auth — disabled for appName="${options.appName}".`);
-                    return;
-                }
-                proxyOptions = {
-                    apiBaseUrl: env.API_BASE_URL,
-                    devSecret: env.DEV_SECRET,
-                };
-            }
-            const handler = createDevAuthProxyHandler(proxyOptions);
-            const basePath = server.config.base.endsWith('/')
-                ? server.config.base.slice(0, -1)
-                : server.config.base;
-            server.config.logger.info(`[bardioc-dev-auth] proxying /rest/* → ${proxyOptions.apiBaseUrl} for appName="${options.appName}"`);
-            server.middlewares.use(async (req, res, next) => {
-                const originalUrl = req.url ?? '';
-                const parsed = new URL(originalUrl, 'http://localhost');
-                const pathname = parsed.pathname;
-                const routePath = pathname.startsWith(basePath)
-                    ? pathname.slice(basePath.length) || '/'
-                    : pathname;
-                if (!routePath.startsWith('/rest/')) {
-                    next();
-                    return;
-                }
-                try {
-                    req.url = `${routePath}${parsed.search}`;
-                    await handler(req, res);
-                }
-                catch (error) {
-                    next(error);
-                }
-                finally {
-                    req.url = originalUrl;
-                }
-            });
-        },
-    };
-}

package/dist/dev-session-cli.d.ts

@@ -1,34 +0,0 @@
-import { spawn } from 'node:child_process';
-interface CliConfig {
-    hostUrl?: string;
-    cliAccessToken?: string;
-    cliAccessTokenExpiresAt?: number;
-}
-interface RuntimeEnv {
-    VITE_ENABLE_DEV_AUTH?: string;
-    VITE_APP_ID?: string;
-    DEV_AUTH_HOST_URL?: string;
-}
-interface DevSessionResponse {
-    sessionKey: string;
-    hostUrl: string;
-    appId: string;
-}
-interface CliMainRuntime {
-    argv?: string[];
-    cwd?: () => string;
-    env?: NodeJS.ProcessEnv;
-    platform?: NodeJS.Platform;
-    spawnCommand?: typeof spawn;
-    stdout?: Pick<NodeJS.WriteStream, 'write'>;
-    stderr?: Pick<NodeJS.WriteStream, 'write'>;
-    exit?: (code: number) => void;
-    readCliConfig?: () => CliConfig | null;
-}
-export declare function readLayeredEnv(cwd: string, runtimeEnv?: NodeJS.ProcessEnv): RuntimeEnv;
-export declare function readCliConfigFromFile(configPath: string): CliConfig | null;
-export declare function normalizeHostUrl(hostUrl: string): string;
-export declare function assertCliConfig(config: CliConfig | null, hostUrl: string): asserts config is CliConfig;
-export declare function fetchDevSession(hostUrl: string, cliAccessToken: string, appId: string): Promise<DevSessionResponse>;
-export declare function main(runtime?: CliMainRuntime): Promise<void>;
-export {};

package/dist/dev-session-cli.js

@@ -1,125 +0,0 @@
-import { spawn } from 'node:child_process';
-import { existsSync, readFileSync, realpathSync } from 'node:fs';
-import { homedir } from 'node:os';
-import { resolve } from 'node:path';
-import { fileURLToPath } from 'node:url';
-import { readDotEnvFile } from './dot-env.js';
-export function readLayeredEnv(cwd, runtimeEnv = process.env) {
-    const env = {};
-    for (const fileName of ['.env', '.env.local']) {
-        const filePath = resolve(cwd, fileName);
-        if (!existsSync(filePath)) {
-            continue;
-        }
-        Object.assign(env, readDotEnvFile(filePath));
-    }
-    for (const [key, value] of Object.entries(runtimeEnv)) {
-        if (typeof value === 'string') {
-            env[key] = value;
-        }
-    }
-    return env;
-}
-export function readCliConfigFromFile(configPath) {
-    if (!existsSync(configPath)) {
-        return null;
-    }
-    const parsed = JSON.parse(readFileSync(configPath, 'utf8'));
-    return parsed;
-}
-function readCliConfig() {
-    return readCliConfigFromFile(resolve(homedir(), '.bardioc', 'config.json'));
-}
-export function normalizeHostUrl(hostUrl) {
-    return hostUrl.trim().replace(/\/$/, '');
-}
-export function assertCliConfig(config, hostUrl) {
-    if (!config?.hostUrl || !config.cliAccessToken) {
-        throw new Error('Missing CLI login. Run `bardioc login` first.');
-    }
-    if (normalizeHostUrl(config.hostUrl) !== normalizeHostUrl(hostUrl)) {
-        throw new Error(`CLI login host ${normalizeHostUrl(config.hostUrl)} does not match DEV_AUTH_HOST_URL ${normalizeHostUrl(hostUrl)}.`);
-    }
-    if (typeof config.cliAccessTokenExpiresAt === 'number' &&
-        config.cliAccessTokenExpiresAt > 0 &&
-        config.cliAccessTokenExpiresAt * 1000 <= Date.now()) {
-        throw new Error('Stored CLI login is expired. Run `bardioc login` again.');
-    }
-}
-export async function fetchDevSession(hostUrl, cliAccessToken, appId) {
-    const response = await fetch(`${normalizeHostUrl(hostUrl)}/api/auth/dev-session`, {
-        method: 'POST',
-        headers: {
-            'Content-Type': 'application/json',
-            Authorization: `Bearer ${cliAccessToken}`,
-        },
-        body: JSON.stringify({ appId }),
-        cache: 'no-store',
-    });
-    if (!response.ok) {
-        const data = (await response.json().catch(() => ({})));
-        throw new Error(data.error ?? `Dev session failed (${response.status})`);
-    }
-    return (await response.json());
-}
-export async function main(runtime = {}) {
-    const argv = runtime.argv ?? process.argv;
-    const currentEnv = runtime.env ?? process.env;
-    const currentCwd = runtime.cwd ?? (() => process.cwd());
-    const spawnCommand = runtime.spawnCommand ?? spawn;
-    const stdout = runtime.stdout ?? process.stdout;
-    const stderr = runtime.stderr ?? process.stderr;
-    const exit = runtime.exit ?? process.exit;
-    const separatorIndex = argv.indexOf('--');
-    const commandArgs = separatorIndex >= 0 ? argv.slice(separatorIndex + 1) : [];
-    if (commandArgs.length === 0) {
-        throw new Error('Missing command after `--`. Example: bardioc-dev-session -- vite');
-    }
-    const cwd = currentCwd();
-    const env = readLayeredEnv(cwd, currentEnv);
-    const devAuthEnabled = env.VITE_ENABLE_DEV_AUTH === 'true';
-    const childEnv = { ...currentEnv };
-    const [command, ...commandRestArgs] = commandArgs;
-    if (!command) {
-        throw new Error('Missing command after `--`. Example: bardioc-dev-session -- vite');
-    }
-    if (devAuthEnabled) {
-        const appId = env.VITE_APP_ID?.trim();
-        const hostUrl = env.DEV_AUTH_HOST_URL?.trim();
-        if (!appId) {
-            throw new Error('Missing VITE_APP_ID for standalone dev auth.');
-        }
-        if (!hostUrl) {
-            throw new Error('Missing DEV_AUTH_HOST_URL for standalone dev auth.');
-        }
-        const cliConfig = (runtime.readCliConfig ?? readCliConfig)();
-        assertCliConfig(cliConfig, hostUrl);
-        const devSession = await fetchDevSession(hostUrl, cliConfig.cliAccessToken, appId);
-        childEnv.DEV_AUTH_HOST_URL = normalizeHostUrl(devSession.hostUrl);
-        childEnv.DEV_SESSION_KEY = devSession.sessionKey;
-        stdout.write(`[bardioc-dev-session] Refreshed dev session for appId="${devSession.appId}" via ${childEnv.DEV_AUTH_HOST_URL}\n`);
-    }
-    const child = spawnCommand(command, commandRestArgs, {
-        stdio: 'inherit',
-        env: childEnv,
-        shell: (runtime.platform ?? process.platform) === 'win32',
-    });
-    child.on('exit', (code) => {
-        exit(code ?? 0);
-    });
-    child.on('error', (error) => {
-        stderr.write(`${error.message}\n`);
-        exit(1);
-    });
-}
-const isDirectRun = process.argv[1]
-    ? realpathSync.native(resolve(process.argv[1])) ===
-        realpathSync.native(fileURLToPath(import.meta.url))
-    : false;
-if (isDirectRun) {
-    void main().catch(error => {
-        const message = error instanceof Error ? error.message : String(error);
-        process.stderr.write(`[bardioc-dev-session] ${message}\n`);
-        process.exit(1);
-    });
-}