@bardioc/app-sdk 1.0.1 → 1.0.3

package/README.md

@@ -136,6 +136,8 @@ export default defineConfig({
 
 Handles dev base path, port config, host session proxy routes, platform fonts, and manifest validation on build.
 
+`vite preview` serves the build on `port + 1000` (`4005` here), not on `port`. Pass `previewPort` to choose another one.
+
 ### Platform fonts
 
 The Bardioc platform guarantees a stable font endpoint wherever an app runs — like `/api/transport`, it is a public contract that will never be renamed or removed. Load it with one line in `index.html` and do **not** bundle font packages into your app:

package/dist/api/request.d.ts

@@ -3,14 +3,14 @@ import type { TransportScopeOptions } from '../types.js';
 export type BffRequester = <T>(request: BffRequest) => Promise<T>;
 type QueryValue = string | number | boolean | undefined;
 export declare function withQuery(path: string, params: Record<string, QueryValue>): string;
-export declare const json: (body: unknown, method?: BffRequest["method"]) => {
-    readonly method: "GET" | "POST" | "PUT" | "PATCH" | "DELETE";
+export declare const json: (body: unknown, method?: BffRequest['method']) => {
+    readonly method: "DELETE" | "GET" | "PATCH" | "POST" | "PUT";
     readonly body: unknown;
-    readonly contentType: "application/json";
+    readonly contentType: 'application/json';
 };
 export declare const scoped: ({ scopeId }?: TransportScopeOptions) => {
     readonly scopeId: string;
-    readonly scopePolicy: "required";
+    readonly scopePolicy: 'required';
 } | {
     readonly scopeId?: undefined;
     readonly scopePolicy?: undefined;

package/dist/client.d.ts

@@ -96,6 +96,10 @@ declare function open(port: MessagePort, initial: Context): {
         launch: (id: string) => Promise<{
             windowId: string | null;
         }>;
+        /** The caller's settings of the developer application `id`, as the host holds them. */
+        getConfig: (id: string) => Promise<import("./contract.js").DevAppConfig>;
+        /** Replaces them with the edited document; the host applies the answer at once. */
+        saveConfig: (id: string, data: Record<string, unknown>) => Promise<import("./contract.js").DevAppConfig>;
     };
 };
 export type Bardioc = ReturnType<typeof open>;

package/dist/client.js

@@ -92,6 +92,10 @@ function open(port, initial) {
             /** The file contents are transferred to the host and unusable here afterwards. */
             upload: (upload) => call('apps.upload', upload, { transfer: upload.files.map(file => file.content) }),
             launch: (id) => call('apps.launch', { id }),
+            /** The caller's settings of the developer application `id`, as the host holds them. */
+            getConfig: (id) => call('apps.getConfig', { id }),
+            /** Replaces them with the edited document; the host applies the answer at once. */
+            saveConfig: (id, data) => call('apps.saveConfig', { id, data }),
         },
     };
 }

package/dist/contract-matrix.d.ts

@@ -0,0 +1,148 @@
+import type { AppManifestPermission } from './manifest.js';
+export declare const SDK_CONTRACT_MATRIX: {
+    readonly SDK_INIT: {
+        readonly requestPayload: "{ appId?: string }";
+        readonly responsePayload: "SdkInitResponse";
+        readonly permission: null;
+        readonly expectedHostBehavior: "Handshake the iframe app and return SDK-owned host context.";
+    };
+    readonly SDK_NOTIFY: {
+        readonly requestPayload: "SdkNotifyPayload";
+        readonly responsePayload: "{ ok: true }";
+        readonly permission: "notify";
+        readonly expectedHostBehavior: "Surface a host-level notification and acknowledge delivery.";
+    };
+    readonly SDK_KERNEL_PROXY: {
+        readonly requestPayload: "SdkKernelProxyPayload";
+        readonly responsePayload: "KernelProtocol response";
+        readonly permission: "kernel-proxy";
+        readonly expectedHostBehavior: "Forward only allow-listed kernel messages through the host.";
+    };
+    readonly SDK_TRANSPORT: {
+        readonly requestPayload: "SdkTransportPayload";
+        readonly responsePayload: "Upstream transport response payload";
+        readonly permission: "transport";
+        readonly expectedHostBehavior: "Relay app-scoped transport requests with scope-aware host mediation.";
+    };
+    readonly SDK_SET_COMMANDS: {
+        readonly requestPayload: "SdkSetCommandsPayload";
+        readonly responsePayload: "{ ok: true }";
+        readonly permission: null;
+        readonly expectedHostBehavior: "Store the app command registry for host command invocation.";
+    };
+    readonly SDK_SET_MENU: {
+        readonly requestPayload: "SdkSetMenuPayload";
+        readonly responsePayload: "{ ok: true }";
+        readonly permission: null;
+        readonly expectedHostBehavior: "Store the app menu tree without degrading supported SDK menu kinds.";
+    };
+    readonly SDK_SET_ACTIVE_TAB: {
+        readonly requestPayload: "SdkSetActiveTabPayload";
+        readonly responsePayload: "{ ok: true }";
+        readonly permission: null;
+        readonly expectedHostBehavior: "Persist the app-reported active tab label in host window state.";
+    };
+    readonly SDK_SHORTCUT_EVENT: {
+        readonly requestPayload: "SdkShortcutEventPayload";
+        readonly responsePayload: null;
+        readonly permission: null;
+        readonly expectedHostBehavior: "Route a focused iframe shortcut event through host shortcut handling.";
+    };
+    readonly SDK_STORAGE_GET: {
+        readonly requestPayload: "SdkStorageGetPayload";
+        readonly responsePayload: "unknown";
+        readonly permission: "storage";
+        readonly expectedHostBehavior: "Host-owned storage bridge; currently deferred in bdf.";
+    };
+    readonly SDK_STORAGE_SET: {
+        readonly requestPayload: "SdkStorageSetPayload";
+        readonly responsePayload: "void";
+        readonly permission: "storage";
+        readonly expectedHostBehavior: "Host-owned storage bridge; currently deferred in bdf.";
+    };
+    readonly SDK_STORAGE_DELETE: {
+        readonly requestPayload: "SdkStorageDeletePayload";
+        readonly responsePayload: "void";
+        readonly permission: "storage";
+        readonly expectedHostBehavior: "Host-owned storage bridge; currently deferred in bdf.";
+    };
+    readonly SDK_STORAGE_KEYS: {
+        readonly requestPayload: "{}";
+        readonly responsePayload: "string[]";
+        readonly permission: "storage";
+        readonly expectedHostBehavior: "Host-owned storage bridge; currently deferred in bdf.";
+    };
+    readonly SDK_IDB_GET: {
+        readonly requestPayload: "SdkIdbGetPayload";
+        readonly responsePayload: "SdkIdbEntry | null";
+        readonly permission: "indexdb";
+        readonly expectedHostBehavior: "Perform app-scoped IndexedDB reads in host-owned storage.";
+    };
+    readonly SDK_IDB_PUT: {
+        readonly requestPayload: "SdkIdbPutPayload";
+        readonly responsePayload: "void";
+        readonly permission: "indexdb";
+        readonly expectedHostBehavior: "Perform app-scoped IndexedDB writes in host-owned storage.";
+    };
+    readonly SDK_IDB_DELETE: {
+        readonly requestPayload: "SdkIdbDeletePayload";
+        readonly responsePayload: "void";
+        readonly permission: "indexdb";
+        readonly expectedHostBehavior: "Perform app-scoped IndexedDB deletes in host-owned storage.";
+    };
+    readonly SDK_IDB_QUERY: {
+        readonly requestPayload: "SdkIdbQueryPayload";
+        readonly responsePayload: "SdkIdbEntry[]";
+        readonly permission: "indexdb";
+        readonly expectedHostBehavior: "Perform app-scoped IndexedDB queries in host-owned storage.";
+    };
+    readonly SDK_LAUNCH_APP: {
+        readonly requestPayload: "{ appId: string }";
+        readonly responsePayload: "{ windowId: string | null }";
+        readonly permission: null;
+        readonly expectedHostBehavior: "Launch another registered app through the host shell.";
+    };
+    readonly SDK_COMMAND_INVOKE: {
+        readonly requestPayload: "SdkCommandInvokePayload";
+        readonly responsePayload: "{ ok: true }";
+        readonly permission: null;
+        readonly expectedHostBehavior: "Host-to-app command callback delivery.";
+    };
+    readonly SDK_EVENT_SUBSCRIBE: {
+        readonly requestPayload: "EventSubscribeRequest";
+        readonly responsePayload: "EventSubscribeResponse";
+        readonly permission: "events";
+        readonly expectedHostBehavior: "Open a scoped graph-event SSE stream for the requested OGIT types.";
+    };
+    readonly SDK_EVENT_UNSUBSCRIBE: {
+        readonly requestPayload: "EventUnsubscribeRequest";
+        readonly responsePayload: "{ ok: true }";
+        readonly permission: "events";
+        readonly expectedHostBehavior: "Close the graph-event SSE stream for the given subscription.";
+    };
+    readonly SDK_GRAPH_EVENT: {
+        readonly requestPayload: "GraphEventPushPayload";
+        readonly responsePayload: null;
+        readonly permission: null;
+        readonly expectedHostBehavior: "Host-to-app graph-event push delivery (no ack).";
+    };
+    readonly SDK_OS_CONFIG_UPDATE: {
+        readonly requestPayload: "OsConfig";
+        readonly responsePayload: null;
+        readonly permission: null;
+        readonly expectedHostBehavior: "Host-to-app runtime OS configuration update delivery.";
+    };
+    readonly SDK_RESPONSE: {
+        readonly requestPayload: "SdkResponse";
+        readonly responsePayload: null;
+        readonly permission: null;
+        readonly expectedHostBehavior: "Request/response envelope used by the bridge runtime.";
+    };
+    readonly SDK_INIT_ACK: {
+        readonly requestPayload: "SdkInitResponse";
+        readonly responsePayload: null;
+        readonly permission: null;
+        readonly expectedHostBehavior: "Handshake acknowledgement used by the bridge runtime.";
+    };
+};
+export declare function getRequiredPermissionForSdkMessage(messageType: string): AppManifestPermission | null;

package/dist/contract-matrix.js

@@ -0,0 +1,150 @@
+import { SDK_MSG } from './protocol.js';
+export const SDK_CONTRACT_MATRIX = {
+    [SDK_MSG.INIT]: {
+        requestPayload: '{ appId?: string }',
+        responsePayload: 'SdkInitResponse',
+        permission: null,
+        expectedHostBehavior: 'Handshake the iframe app and return SDK-owned host context.',
+    },
+    [SDK_MSG.NOTIFY]: {
+        requestPayload: 'SdkNotifyPayload',
+        responsePayload: '{ ok: true }',
+        permission: 'notify',
+        expectedHostBehavior: 'Surface a host-level notification and acknowledge delivery.',
+    },
+    [SDK_MSG.KERNEL_PROXY]: {
+        requestPayload: 'SdkKernelProxyPayload',
+        responsePayload: 'KernelProtocol response',
+        permission: 'kernel-proxy',
+        expectedHostBehavior: 'Forward only allow-listed kernel messages through the host.',
+    },
+    [SDK_MSG.TRANSPORT]: {
+        requestPayload: 'SdkTransportPayload',
+        responsePayload: 'Upstream transport response payload',
+        permission: 'transport',
+        expectedHostBehavior: 'Relay app-scoped transport requests with scope-aware host mediation.',
+    },
+    [SDK_MSG.SET_COMMANDS]: {
+        requestPayload: 'SdkSetCommandsPayload',
+        responsePayload: '{ ok: true }',
+        permission: null,
+        expectedHostBehavior: 'Store the app command registry for host command invocation.',
+    },
+    [SDK_MSG.SET_MENU]: {
+        requestPayload: 'SdkSetMenuPayload',
+        responsePayload: '{ ok: true }',
+        permission: null,
+        expectedHostBehavior: 'Store the app menu tree without degrading supported SDK menu kinds.',
+    },
+    [SDK_MSG.SET_ACTIVE_TAB]: {
+        requestPayload: 'SdkSetActiveTabPayload',
+        responsePayload: '{ ok: true }',
+        permission: null,
+        expectedHostBehavior: 'Persist the app-reported active tab label in host window state.',
+    },
+    [SDK_MSG.SHORTCUT_EVENT]: {
+        requestPayload: 'SdkShortcutEventPayload',
+        responsePayload: null,
+        permission: null,
+        expectedHostBehavior: 'Route a focused iframe shortcut event through host shortcut handling.',
+    },
+    [SDK_MSG.STORAGE_GET]: {
+        requestPayload: 'SdkStorageGetPayload',
+        responsePayload: 'unknown',
+        permission: 'storage',
+        expectedHostBehavior: 'Host-owned storage bridge; currently deferred in bdf.',
+    },
+    [SDK_MSG.STORAGE_SET]: {
+        requestPayload: 'SdkStorageSetPayload',
+        responsePayload: 'void',
+        permission: 'storage',
+        expectedHostBehavior: 'Host-owned storage bridge; currently deferred in bdf.',
+    },
+    [SDK_MSG.STORAGE_DELETE]: {
+        requestPayload: 'SdkStorageDeletePayload',
+        responsePayload: 'void',
+        permission: 'storage',
+        expectedHostBehavior: 'Host-owned storage bridge; currently deferred in bdf.',
+    },
+    [SDK_MSG.STORAGE_KEYS]: {
+        requestPayload: '{}',
+        responsePayload: 'string[]',
+        permission: 'storage',
+        expectedHostBehavior: 'Host-owned storage bridge; currently deferred in bdf.',
+    },
+    [SDK_MSG.IDB_GET]: {
+        requestPayload: 'SdkIdbGetPayload',
+        responsePayload: 'SdkIdbEntry | null',
+        permission: 'indexdb',
+        expectedHostBehavior: 'Perform app-scoped IndexedDB reads in host-owned storage.',
+    },
+    [SDK_MSG.IDB_PUT]: {
+        requestPayload: 'SdkIdbPutPayload',
+        responsePayload: 'void',
+        permission: 'indexdb',
+        expectedHostBehavior: 'Perform app-scoped IndexedDB writes in host-owned storage.',
+    },
+    [SDK_MSG.IDB_DELETE]: {
+        requestPayload: 'SdkIdbDeletePayload',
+        responsePayload: 'void',
+        permission: 'indexdb',
+        expectedHostBehavior: 'Perform app-scoped IndexedDB deletes in host-owned storage.',
+    },
+    [SDK_MSG.IDB_QUERY]: {
+        requestPayload: 'SdkIdbQueryPayload',
+        responsePayload: 'SdkIdbEntry[]',
+        permission: 'indexdb',
+        expectedHostBehavior: 'Perform app-scoped IndexedDB queries in host-owned storage.',
+    },
+    [SDK_MSG.LAUNCH_APP]: {
+        requestPayload: '{ appId: string }',
+        responsePayload: '{ windowId: string | null }',
+        permission: null,
+        expectedHostBehavior: 'Launch another registered app through the host shell.',
+    },
+    [SDK_MSG.COMMAND_INVOKE]: {
+        requestPayload: 'SdkCommandInvokePayload',
+        responsePayload: '{ ok: true }',
+        permission: null,
+        expectedHostBehavior: 'Host-to-app command callback delivery.',
+    },
+    [SDK_MSG.EVENT_SUBSCRIBE]: {
+        requestPayload: 'EventSubscribeRequest',
+        responsePayload: 'EventSubscribeResponse',
+        permission: 'events',
+        expectedHostBehavior: 'Open a scoped graph-event SSE stream for the requested OGIT types.',
+    },
+    [SDK_MSG.EVENT_UNSUBSCRIBE]: {
+        requestPayload: 'EventUnsubscribeRequest',
+        responsePayload: '{ ok: true }',
+        permission: 'events',
+        expectedHostBehavior: 'Close the graph-event SSE stream for the given subscription.',
+    },
+    [SDK_MSG.GRAPH_EVENT]: {
+        requestPayload: 'GraphEventPushPayload',
+        responsePayload: null,
+        permission: null,
+        expectedHostBehavior: 'Host-to-app graph-event push delivery (no ack).',
+    },
+    [SDK_MSG.OS_CONFIG_UPDATE]: {
+        requestPayload: 'OsConfig',
+        responsePayload: null,
+        permission: null,
+        expectedHostBehavior: 'Host-to-app runtime OS configuration update delivery.',
+    },
+    [SDK_MSG.RESPONSE]: {
+        requestPayload: 'SdkResponse',
+        responsePayload: null,
+        permission: null,
+        expectedHostBehavior: 'Request/response envelope used by the bridge runtime.',
+    },
+    [SDK_MSG.INIT_ACK]: {
+        requestPayload: 'SdkInitResponse',
+        responsePayload: null,
+        permission: null,
+        expectedHostBehavior: 'Handshake acknowledgement used by the bridge runtime.',
+    },
+};
+export function getRequiredPermissionForSdkMessage(messageType) {
+    return SDK_CONTRACT_MATRIX[messageType]?.permission ?? null;
+}

package/dist/contract.d.ts

@@ -48,9 +48,9 @@ declare const MenuRoot: z.ZodMiniObject<{
 declare const Notify: z.ZodMiniObject<{
     message: z.ZodMiniString<string>;
     level: z.ZodMiniEnum<{
-        success: "success";
         error: "error";
         info: "info";
+        success: "success";
         warning: "warning";
     }>;
 }, z.core.$strict>;
@@ -64,11 +64,11 @@ declare const Shortcut: z.ZodMiniObject<{
 declare const BffRequest: z.ZodMiniObject<{
     path: z.ZodMiniString<string>;
     method: z.ZodMiniOptional<z.ZodMiniEnum<{
+        DELETE: "DELETE";
         GET: "GET";
+        PATCH: "PATCH";
         POST: "POST";
         PUT: "PUT";
-        PATCH: "PATCH";
-        DELETE: "DELETE";
     }>>;
     body: z.ZodMiniOptional<z.ZodMiniUnknown>;
     contentType: z.ZodMiniOptional<z.ZodMiniString<string>>;
@@ -85,14 +85,14 @@ declare const AppRecord: z.ZodMiniObject<{
     version: z.ZodMiniString<string>;
     launchUrl: z.ZodMiniString<string>;
     source: z.ZodMiniEnum<{
-        uploaded: "uploaded";
         dev: "dev";
+        uploaded: "uploaded";
     }>;
     description: z.ZodMiniOptional<z.ZodMiniString<string>>;
     icon: z.ZodMiniOptional<z.ZodMiniString<string>>;
     appId: z.ZodMiniOptional<z.ZodMiniString<string>>;
-    bundleSize: z.ZodMiniOptional<z.ZodMiniNumberFormat>;
-    fileCount: z.ZodMiniOptional<z.ZodMiniNumberFormat>;
+    bundleSize: z.ZodMiniOptional<z.ZodMiniInt>;
+    fileCount: z.ZodMiniOptional<z.ZodMiniInt>;
 }, z.core.$strict>;
 declare const AppUpload: z.ZodMiniObject<{
     alias: z.ZodMiniString<string>;
@@ -103,8 +103,8 @@ declare const AppUpload: z.ZodMiniObject<{
     }, z.core.$strict>>;
     appId: z.ZodMiniOptional<z.ZodMiniString<string>>;
     source: z.ZodMiniOptional<z.ZodMiniEnum<{
-        uploaded: "uploaded";
         dev: "dev";
+        uploaded: "uploaded";
     }>>;
 }, z.core.$strict>;
 export type Command = z.infer<typeof Command>;
@@ -122,18 +122,50 @@ export interface OsConfig {
     windowId: string;
     instanceId: string | null;
 }
+/** A setting's value as the configuration service holds it. */
+export type SettingValue = string | number | boolean | null;
 /** What the host tells an app when it connects, and again whenever it changes. */
 export interface Context {
     appId: string;
     host: 'os' | 'dev';
     osConfig: OsConfig;
+    /** The app's own settings, keyed `<group>.<field>` as its manifest declares them. */
+    settings?: Record<string, SettingValue>;
+}
+/** One setting as the configuration service renders it: value, flags and declared metadata. */
+export interface Setting {
+    value: SettingValue;
+    type: string;
+    editable: boolean;
+    hidden: boolean;
+    immutable: boolean;
+    declared: boolean;
+    origin: string;
+    section: string;
+    label?: string;
+    description?: string;
+    unit?: string;
+    enum?: SettingValue[];
+    min?: number;
+    max?: number;
+    step?: number;
+    order?: number;
+    appId?: string;
+}
+/**
+ * A developer's own settings of a developer application: `data` is the document they edit
+ * (keys `apps.<id>.<group>.<field>`, group flags under `<group>.__flags`), `settings` its view.
+ */
+export interface DevAppConfig {
+    data: Record<string, unknown>;
+    settings: Record<string, Setting>;
 }
 export interface IdbEntry<T = unknown> {
     key: string;
     value: T;
     updatedAt: number;
 }
-export declare const GRAPH_EVENT_TYPES: readonly ["CREATE", "REPLACE", "UPDATE", "CONNECT", "DISCONNECT", "DELETE", "WRITE_TIMESERIES"];
+export declare const GRAPH_EVENT_TYPES: readonly ['CREATE', 'REPLACE', 'UPDATE', 'CONNECT', 'DISCONNECT', 'DELETE', 'WRITE_TIMESERIES'];
 export interface GraphEvent {
     id: string;
     type: (typeof GRAPH_EVENT_TYPES)[number];
@@ -159,9 +191,9 @@ export declare const APP_METHODS: {
     readonly 'ui.notify': CallMethod<z.ZodMiniObject<{
         message: z.ZodMiniString<string>;
         level: z.ZodMiniEnum<{
-            success: "success";
             error: "error";
             info: "info";
+            success: "success";
             warning: "warning";
         }>;
     }, z.core.$strict>, void>;
@@ -198,11 +230,11 @@ export declare const APP_METHODS: {
     readonly 'bff.request': CallMethod<z.ZodMiniObject<{
         path: z.ZodMiniString<string>;
         method: z.ZodMiniOptional<z.ZodMiniEnum<{
+            DELETE: "DELETE";
             GET: "GET";
+            PATCH: "PATCH";
             POST: "POST";
             PUT: "PUT";
-            PATCH: "PATCH";
-            DELETE: "DELETE";
         }>>;
         body: z.ZodMiniOptional<z.ZodMiniUnknown>;
         contentType: z.ZodMiniOptional<z.ZodMiniString<string>>;
@@ -232,7 +264,7 @@ export declare const APP_METHODS: {
     readonly 'idb.query': CallMethod<z.ZodMiniObject<{
         store: z.ZodMiniString<string>;
         prefix: z.ZodMiniOptional<z.ZodMiniString<string>>;
-        limit: z.ZodMiniOptional<z.ZodMiniNumberFormat>;
+        limit: z.ZodMiniOptional<z.ZodMiniInt>;
     }, z.core.$strict>, IdbEntry<unknown>[]>;
     readonly 'apps.list': CallMethod<z.ZodMiniUndefined, InstalledApp[]>;
     readonly 'apps.get': CallMethod<z.ZodMiniObject<{
@@ -244,14 +276,14 @@ export declare const APP_METHODS: {
         version: z.ZodMiniString<string>;
         launchUrl: z.ZodMiniString<string>;
         source: z.ZodMiniEnum<{
-            uploaded: "uploaded";
             dev: "dev";
+            uploaded: "uploaded";
         }>;
         description: z.ZodMiniOptional<z.ZodMiniString<string>>;
         icon: z.ZodMiniOptional<z.ZodMiniString<string>>;
         appId: z.ZodMiniOptional<z.ZodMiniString<string>>;
-        bundleSize: z.ZodMiniOptional<z.ZodMiniNumberFormat>;
-        fileCount: z.ZodMiniOptional<z.ZodMiniNumberFormat>;
+        bundleSize: z.ZodMiniOptional<z.ZodMiniInt>;
+        fileCount: z.ZodMiniOptional<z.ZodMiniInt>;
     }, z.core.$strict>, InstalledApp>;
     readonly 'apps.delete': CallMethod<z.ZodMiniObject<{
         id: z.ZodMiniString<string>;
@@ -265,8 +297,8 @@ export declare const APP_METHODS: {
         }, z.core.$strict>>;
         appId: z.ZodMiniOptional<z.ZodMiniString<string>>;
         source: z.ZodMiniOptional<z.ZodMiniEnum<{
-            uploaded: "uploaded";
             dev: "dev";
+            uploaded: "uploaded";
         }>>;
     }, z.core.$strict>, UploadResult>;
     readonly 'apps.launch': CallMethod<z.ZodMiniObject<{
@@ -274,6 +306,13 @@ export declare const APP_METHODS: {
     }, z.core.$strict>, {
         windowId: string | null;
     }>;
+    readonly 'apps.getConfig': CallMethod<z.ZodMiniObject<{
+        id: z.ZodMiniString<string>;
+    }, z.core.$strict>, DevAppConfig>;
+    readonly 'apps.saveConfig': CallMethod<z.ZodMiniObject<{
+        id: z.ZodMiniString<string>;
+        data: z.ZodMiniRecord<z.ZodMiniString<string>, z.ZodMiniUnknown>;
+    }, z.core.$strict>, DevAppConfig>;
 };
 /** Methods a host calls on its app. */
 export declare const HOST_METHODS: {

package/dist/contract.js

@@ -103,6 +103,10 @@ const AppRecord = z.strictObject({
     bundleSize: z.optional(count),
     fileCount: z.optional(count),
 });
+const AppConfigSave = z.strictObject({
+    id: text,
+    data: z.record(z.string(), z.unknown()),
+});
 const AppUpload = z.strictObject({
     alias: text,
     name: text,
@@ -138,6 +142,8 @@ export const APP_METHODS = {
     'apps.delete': call(AppId).returns(),
     'apps.upload': call(AppUpload).returns(120_000),
     'apps.launch': call(AppId).returns(),
+    'apps.getConfig': call(AppId).returns(),
+    'apps.saveConfig': call(AppConfigSave).returns(),
 };
 /** Methods a host calls on its app. */
 export const HOST_METHODS = {

package/dist/dev-auth-proxy-core.d.ts

@@ -0,0 +1,24 @@
+import type { IncomingMessage, ServerResponse } from 'node:http';
+export type ProxyPayload = {
+    sessionKey?: string;
+    hostUrl?: string;
+    scopeId?: string | null;
+    scopePolicy?: 'none' | 'optional' | 'required';
+    path: string;
+    method?: 'GET' | 'POST' | 'PUT' | 'PATCH' | 'DELETE';
+    body?: unknown;
+    contentType?: string;
+};
+interface ProxyTransportOptions {
+    appId: string;
+    hostUrl: string;
+    devSessionKey: string;
+}
+interface SendJsonOptions {
+    allowOrigin?: string;
+}
+export declare function readJsonBody<T = unknown>(req: IncomingMessage): Promise<T | null>;
+export declare function applyCors(res: ServerResponse, allowOrigin?: string): void;
+export declare function sendJson(res: ServerResponse, status: number, body: unknown, options?: SendJsonOptions): void;
+export declare function forwardDevAuthProxyRequest(payload: ProxyPayload, options: ProxyTransportOptions): Promise<Response>;
+export {};

package/dist/dev-auth-proxy-core.js

@@ -0,0 +1,59 @@
+export async function readJsonBody(req) {
+    return new Promise(resolveBody => {
+        const chunks = [];
+        req.on('data', (chunk) => chunks.push(chunk));
+        req.on('end', () => {
+            const buffer = Buffer.concat(chunks);
+            if (buffer.length === 0) {
+                resolveBody(null);
+                return;
+            }
+            try {
+                resolveBody(JSON.parse(buffer.toString('utf8')));
+            }
+            catch {
+                resolveBody(null);
+            }
+        });
+        req.on('error', () => resolveBody(null));
+    });
+}
+export function applyCors(res, allowOrigin) {
+    if (!allowOrigin) {
+        return;
+    }
+    res.setHeader('Access-Control-Allow-Origin', allowOrigin);
+    res.setHeader('Access-Control-Allow-Methods', 'POST,OPTIONS');
+    res.setHeader('Access-Control-Allow-Headers', 'Content-Type');
+}
+export function sendJson(res, status, body, options = {}) {
+    applyCors(res, options.allowOrigin);
+    res.statusCode = status;
+    res.setHeader('Content-Type', 'application/json');
+    res.setHeader('Cache-Control', 'no-store');
+    res.end(JSON.stringify(body));
+}
+export async function forwardDevAuthProxyRequest(payload, options) {
+    const hostUrl = payload.hostUrl ?? options.hostUrl;
+    const sessionKey = payload.sessionKey ?? options.devSessionKey;
+    if (!hostUrl || !sessionKey) {
+        throw new Error('missing_dev_session');
+    }
+    return fetch(`${hostUrl.replace(/\/$/, '')}/api/transport`, {
+        method: 'POST',
+        headers: {
+            'Content-Type': 'application/json',
+            'X-Dev-Session-Key': sessionKey,
+        },
+        body: JSON.stringify({
+            appId: options.appId,
+            path: payload.path,
+            method: payload.method ?? 'GET',
+            body: payload.body,
+            contentType: payload.contentType,
+            scopePolicy: payload.scopePolicy,
+            scopeId: payload.scopeId ?? null,
+        }),
+        cache: 'no-store',
+    });
+}

package/dist/dev-auth-vite.d.ts

@@ -0,0 +1,34 @@
+import type { IncomingMessage, ServerResponse } from 'node:http';
+type VitePlugin = {
+    name: string;
+    apply?: 'serve' | 'build';
+    enforce?: 'pre' | 'post';
+    configureServer?: (server: ViteDevServerLike) => void;
+    transformIndexHtml?: () => Array<{
+        tag: string;
+        attrs?: Record<string, string>;
+        children?: string;
+        injectTo?: 'head' | 'body' | 'head-prepend' | 'body-prepend';
+    }> | void;
+};
+interface ViteDevServerLike {
+    config: {
+        root: string;
+        envDir?: string;
+        mode?: string;
+        base: string;
+        logger: {
+            warn: (message: string) => void;
+            info: (message: string) => void;
+        };
+    };
+    middlewares: {
+        use: (handler: (req: IncomingMessage, res: ServerResponse, next: (error?: unknown) => void) => void) => void;
+    };
+}
+export interface BardiocDevAuthOptions {
+    appName: string;
+    sessionStorageKey?: string;
+}
+export declare function bardiocDevAuth(options: BardiocDevAuthOptions): VitePlugin;
+export {};