@bardioc/create-bardioc-app 0.5.2 → 0.5.4

package/README.md

@@ -28,10 +28,10 @@ npm exec --yes @bardioc/create-bardioc-app my-app -- --port 3005
 create-bardioc-app my-app --port 3005
 cd my-app
 npm install
-bardioc login
-npm run dev
 ```
 
+Copy `.env.example` to `.env` and fill in `VITE_APP_NAME`, `DEV_SECRET`, and `API_BASE_URL`. Then run `npm run dev`.
+
 ## Generated app
 
 The generated app includes:
@@ -39,7 +39,7 @@ The generated app includes:
 - React + Vite project structure (or your chosen `--template`)
 - `@bardioc/app-sdk` dependency
 - `AppSdkProvider` wiring
-- optional host-backed standalone dev-session wiring via `.env`
+- optional standalone dev-auth wiring via `.env` (`DEV_SECRET` proxy)
 - a compact SDK demo with notification and transport examples
 - `public/app-manifest.json`
 
@@ -64,18 +64,15 @@ Heavier, environment-specific tooling is **off by default** — pass a flag to i
 - **`--with-link`** — the **`link:source` / `unlink:source`** dev flow (`scripts/link-source.mjs` +
   `pnpm-workspace.yaml` + `.npmrc`) for developing against an in-tree `@bardioc/*` source checkout.
 
-## Standalone dev session
+## Standalone dev auth
 
-Generated apps can opt into the same host-backed standalone dev-session flow used by the SDK examples.
+Generated apps can run standalone with the `DEV_SECRET` dev-auth proxy.
 
 1. Copy `.env.example` to `.env`
-2. Fill in `VITE_APP_NAME`, `VITE_APP_ID`, and `DEV_AUTH_HOST_URL`
-3. Run `bardioc login` once for that host
-4. Set `VITE_ENABLE_DEV_AUTH=true`
-
-Important: standalone login will not start unless `VITE_ENABLE_DEV_AUTH=true` is present in `.env`. Running `npm run dev` with only `VITE_APP_NAME` and `VITE_APP_ID` is not enough.
+2. Fill in `VITE_APP_NAME`, `DEV_SECRET`, and `API_BASE_URL`
+3. Run `npm run dev`
 
-When enabled, running `npm run dev` outside the host iframe will use your stored CLI login to mint a fresh host dev session before the dev server starts, then route SDK transport calls through the local proxy into the host transport. `DEV_SESSION_KEY` no longer needs to be copied manually. If a request needs a specific scope, pass `scopeId` on that request.
+When running outside the host iframe, the Vite plugin proxies `/rest/*` to `API_BASE_URL` with the `X-Dev-Secret` header and `installDevBridge()` handles SDK messages.
 
 For public testing, run `npm run dev:live` and use the emitted tunnel URL as the app's live URL in the host App Store configuration.
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bardioc/create-bardioc-app",
-  "version": "0.5.2",
+  "version": "0.5.4",
   "description": "Scaffold a Bardioc app with framework templates (vite, react, vue, angular, svelte, solid, preact, nextjs)",
   "license": "MIT",
   "private": false,

package/templates/angular/.env.example

@@ -1,5 +1,7 @@
 VITE_APP_NAME={{APP_NAME}}
-VITE_APP_ID=your-app-client-id-here
-VITE_ENABLE_DEV_AUTH=false
-DEV_AUTH_HOST_URL=
-DEV_SESSION_KEY=
+
+# Dev auth proxy secret for local standalone development.
+DEV_SECRET=
+
+# Base URL of the Bardioc API the dev auth proxy should forward to.
+API_BASE_URL=

package/templates/angular/scripts/dev-auth-proxy.mjs

@@ -12,15 +12,14 @@ const appPort = readAppPort();
 const proxyPort = appPort + 100;
 const env = loadEnv(projectRoot);
 
-if (!env.VITE_APP_ID || !env.DEV_AUTH_HOST_URL || !env.DEV_SESSION_KEY) {
-  process.stderr.write('[bardioc-dev-auth-proxy] missing env, proxy disabled\n');
+if (!env.DEV_SECRET || !env.API_BASE_URL) {
+  process.stderr.write('[bardioc-dev-auth-proxy] missing DEV_SECRET or API_BASE_URL, proxy disabled\n');
   await new Promise(() => {});
 }
 
 const handler = createDevAuthProxyHandler({
-  appId: env.VITE_APP_ID,
-  hostUrl: env.DEV_AUTH_HOST_URL,
-  devSessionKey: env.DEV_SESSION_KEY,
+  apiBaseUrl: env.API_BASE_URL,
+  devSecret: env.DEV_SECRET,
   allowOrigin: '*',
 });
 
@@ -29,7 +28,7 @@ const server = createServer((req, res) => {
 });
 
 server.listen(proxyPort, '127.0.0.1', () => {
-  process.stdout.write(`[bardioc-dev-auth-proxy] listening on http://127.0.0.1:${proxyPort}/proxy\n`);
+  process.stdout.write(`[bardioc-dev-auth-proxy] listening on http://127.0.0.1:${proxyPort}/rest\n`);
 });
 
 for (const signal of ['SIGINT', 'SIGTERM']) {
@@ -89,4 +88,4 @@ function parseEnv(source) {
   }
 
   return result;
-}
+}

package/templates/angular/scripts/sync-runtime-env.mjs

@@ -7,41 +7,19 @@ import { fileURLToPath } from 'node:url';
 const __dirname = dirname(fileURLToPath(import.meta.url));
 const projectRoot = resolve(__dirname, '..');
 const env = loadEnv(projectRoot);
-const appPort = readAppPort();
-const proxyPort = appPort + 100;
 
 const runtimeEnv = {
   VITE_APP_NAME: env.VITE_APP_NAME,
-  VITE_APP_ID: env.VITE_APP_ID,
-  VITE_ENABLE_DEV_AUTH: env.VITE_ENABLE_DEV_AUTH,
-  DEV_AUTH_HOST_URL: env.DEV_AUTH_HOST_URL,
-  DEV_SESSION_KEY: env.DEV_SESSION_KEY,
 };
 
-const injectedDevAuth =
-  env.DEV_AUTH_HOST_URL && env.DEV_SESSION_KEY
-    ? {
-        hostUrl: env.DEV_AUTH_HOST_URL,
-        sessionKey: env.DEV_SESSION_KEY,
-        proxyUrl: `http://127.0.0.1:${proxyPort}/proxy`,
-      }
-    : null;
-
 const outputPath = join(projectRoot, 'public', 'runtime-env.js');
 mkdirSync(dirname(outputPath), { recursive: true });
 writeFileSync(
   outputPath,
-  `window.__BARDIOC_RUNTIME_ENV__ = ${JSON.stringify(runtimeEnv, null, 2)};\nwindow.__BARDIOC_DEV_AUTH__ = ${JSON.stringify(injectedDevAuth, null, 2)};\n`,
+  `window.__BARDIOC_RUNTIME_ENV__ = ${JSON.stringify(runtimeEnv, null, 2)};\n`,
   'utf8'
 );
 
-function readAppPort() {
-  const flagIndex = process.argv.indexOf('--app-port');
-  const raw = flagIndex >= 0 ? process.argv[flagIndex + 1] : undefined;
-  const parsed = Number.parseInt(raw ?? '{{PORT}}', 10);
-  return Number.isFinite(parsed) ? parsed : {{PORT}};
-}
-
 function loadEnv(projectDir) {
   const result = {};
 
@@ -86,4 +64,4 @@ function parseEnv(source) {
   }
 
   return result;
-}
+}

package/templates/angular/src/app/app.component.ts

@@ -3,27 +3,6 @@ import { JsonPipe } from '@angular/common';
 import { Component, inject, signal } from '@angular/core';
 import { BARDIOC_BRIDGE } from './bardioc.token';
 import type { HostBridge } from '@bardioc/app-sdk';
-import { readRuntimeEnv } from '../runtime-env';
-
-type InjectedDevAuthConfig = {
-  hostUrl?: string;
-  sessionKey?: string;
-};
-
-function readInjectedDevAuthConfig(): InjectedDevAuthConfig | null {
-  const config = (globalThis as typeof globalThis & {
-    __BARDIOC_DEV_AUTH__?: InjectedDevAuthConfig;
-  }).__BARDIOC_DEV_AUTH__;
-
-  if (!config?.hostUrl || !config?.sessionKey) {
-    return null;
-  }
-
-  return {
-    hostUrl: config.hostUrl,
-    sessionKey: config.sessionKey,
-  };
-}
 
 type ResultState =
   | { status: 'idle' }
@@ -115,14 +94,8 @@ type ResultState =
 })
 export class AppComponent {
   private bridge = inject(BARDIOC_BRIDGE, { optional: true }) as HostBridge | null;
-  private injectedDevAuth = readInjectedDevAuthConfig();
-  
-  showSdkDemo =
-    isInsideIframe() ||
-    (readRuntimeEnv('VITE_ENABLE_DEV_AUTH') === 'true' &&
-      !!this.injectedDevAuth?.hostUrl &&
-      !!this.injectedDevAuth?.sessionKey &&
-      isDevStandalone());
+
+  showSdkDemo = isInsideIframe() || isDevStandalone();
   result = signal<ResultState>({ status: 'idle' });
   running = signal(false);
 
@@ -135,11 +108,11 @@ export class AppComponent {
 
     const startTime = Date.now();
     this.bridge.notify('Getting user profile', 'info');
-    
+
     try {
       const data = await this.bridge.transport.os.profile.get();
       const duration = Date.now() - startTime;
-      this.bridge.notify(`Profile loaded (${duration}ms)`, 'success');
+      this.bridge.notify(`Profile loaded (${duration}ms)`, 'success`);
       this.result.set({ status: 'success', request, data });
     } catch (err) {
       const message = err instanceof Error ? err.message : String(err);

package/templates/angular/src/app/bardioc-bridge.ts

@@ -1,5 +1,5 @@
 import { createHostBridge, type HostBridge } from '@bardioc/app-sdk';
 
-export function createBardiocBridge(appId: string): HostBridge {
-	return createHostBridge({ appId });
-}
+export function createBardiocBridge(): HostBridge {
+	return createHostBridge({});
+}

package/templates/angular/src/main.ts

@@ -1,65 +1,31 @@
 import {
-  ensureDevAuthSession,
   installDevBridge,
   isDevStandalone,
   isInsideIframe,
 } from '@bardioc/app-sdk/dev';
 import { bootstrapApplication } from '@angular/platform-browser';
 import { provideHttpClient } from '@angular/common/http';
-import { isDevMode, type EnvironmentProviders, type Provider } from '@angular/core';
+import { type EnvironmentProviders, type Provider } from '@angular/core';
 import { AppComponent } from './app/app.component';
 import { createBardiocBridge } from './app/bardioc-bridge';
 import { BARDIOC_BRIDGE } from './app/bardioc.token';
-import { readRuntimeEnv } from './runtime-env';
 import './styles.css';
 
-type InjectedDevAuthConfig = {
-  hostUrl?: string;
-  sessionKey?: string;
-  proxyUrl?: string;
-};
-
-function readInjectedDevAuthConfig(): InjectedDevAuthConfig | null {
-  const config = (globalThis as typeof globalThis & {
-    __BARDIOC_DEV_AUTH__?: InjectedDevAuthConfig;
-  }).__BARDIOC_DEV_AUTH__;
-
-  if (!config?.hostUrl || !config?.sessionKey) {
-    return null;
-  }
-
-  return {
-    hostUrl: config.hostUrl,
-    sessionKey: config.sessionKey,
-    proxyUrl: typeof config.proxyUrl === 'string' ? config.proxyUrl : undefined,
-  };
+function readAppPort(): number {
+  const parsed = Number.parseInt(window.location.port, 10);
+  return Number.isFinite(parsed) ? parsed : {{PORT}};
 }
 
-const APP_NAME = (readRuntimeEnv('VITE_APP_NAME') ?? document.title.trim()) || 'Bardioc App';
-const APP_ID = readRuntimeEnv('VITE_APP_ID');
-const injectedDevAuth = readInjectedDevAuthConfig();
-const standaloneDevAuthEnabled =
-  isDevMode() &&
-  readRuntimeEnv('VITE_ENABLE_DEV_AUTH') === 'true' &&
-  !!injectedDevAuth?.hostUrl &&
-  !!injectedDevAuth?.sessionKey;
-
+const appPort = readAppPort();
+const proxyPort = appPort + 100;
 const insideIframe = isInsideIframe();
-const devStandalone = standaloneDevAuthEnabled && isDevStandalone();
+const devStandalone = isDevStandalone();
 const useSdkProvider = insideIframe || devStandalone;
 
-if (useSdkProvider && !APP_ID) {
-  throw new Error('Missing VITE_APP_ID for SDK runtime');
-}
-
 async function bootstrap() {
   if (devStandalone) {
-    await ensureDevAuthSession({ appId: APP_ID!, appName: APP_NAME });
     installDevBridge({
-      appId: APP_ID!,
-      appName: APP_NAME,
-      debug: false,
-      proxyPath: injectedDevAuth?.proxyUrl,
+      apiBaseUrl: `http://127.0.0.1:${proxyPort}/rest`,
     });
   }
 
@@ -70,7 +36,7 @@ async function bootstrap() {
   if (useSdkProvider) {
     providers.push({
       provide: BARDIOC_BRIDGE,
-      useValue: createBardiocBridge(APP_ID!),
+      useValue: createBardiocBridge(),
     });
   }
 

package/templates/angular/src/vite-env.d.ts

@@ -1,10 +1,8 @@
 interface ImportMetaEnv {
 	readonly DEV?: boolean;
-	readonly VITE_APP_ID?: string;
 	readonly VITE_APP_NAME?: string;
-	readonly VITE_ENABLE_DEV_AUTH?: string;
 }
 
 interface ImportMeta {
 	readonly env: ImportMetaEnv;
-}
+}

package/templates/nextjs/.env.example

@@ -1,8 +1,7 @@
 NEXT_PUBLIC_APP_NAME={{APP_NAME}}
-NEXT_PUBLIC_APP_ID=your-app-client-id-here
-NEXT_PUBLIC_ENABLE_DEV_AUTH=false
 
-# Required host URL for standalone dev auth. Run `bardioc login` once, then
-# `npm run dev` will refresh DEV_SESSION_KEY automatically before Next starts.
-DEV_AUTH_HOST_URL=
-DEV_SESSION_KEY=
+# Shared secret used for dev auth when proxying API requests through /rest.
+DEV_SECRET=
+
+# Base URL of the Bardioc API backend to proxy /rest requests to.
+API_BASE_URL=

package/templates/nextjs/app/page.tsx

@@ -1,8 +1,8 @@
 'use client';
 
-import { ensureDevAuthSession, installDevBridge } from '@bardioc/app-sdk/dev';
+import { isInsideIframe, isDevStandalone, installDevBridge } from '@bardioc/app-sdk/dev';
 import { AppSdkProvider, useNotify, useSdk } from '@bardioc/app-sdk/react';
-import { useEffect, useState, type ReactNode } from 'react';
+import { useEffect, useState } from 'react';
 
 type ResultState =
   | { status: 'idle' }
@@ -10,33 +10,7 @@ type ResultState =
   | { status: 'success'; request: string; data: unknown }
   | { status: 'error'; request: string; message: string };
 
-type InjectedDevAuthConfig = {
-  hostUrl?: string;
-  sessionKey?: string;
-};
-
 const APP_NAME = process.env.NEXT_PUBLIC_APP_NAME?.trim();
-const APP_ID = process.env.NEXT_PUBLIC_APP_ID?.trim();
-const standaloneDevAuthEnabled =
-  process.env.NODE_ENV === 'development' && process.env.NEXT_PUBLIC_ENABLE_DEV_AUTH === 'true';
-const DEV_AUTH_HOST_URL = process.env.NEXT_PUBLIC_DEV_AUTH_HOST_URL?.trim();
-const DEV_SESSION_KEY = process.env.NEXT_PUBLIC_DEV_SESSION_KEY?.trim();
-
-function installInjectedDevAuthConfig() {
-  if (!DEV_AUTH_HOST_URL || !DEV_SESSION_KEY) {
-    return;
-  }
-
-  (
-    window as Window &
-      typeof globalThis & {
-        __BARDIOC_DEV_AUTH__?: InjectedDevAuthConfig;
-      }
-  ).__BARDIOC_DEV_AUTH__ = {
-    hostUrl: DEV_AUTH_HOST_URL,
-    sessionKey: DEV_SESSION_KEY,
-  };
-}
 
 function SdkDemo() {
   const bridge = useSdk();
@@ -161,62 +135,28 @@ function PreviewShell() {
   );
 }
 
-function DevAuthProvider({ children, enabled }: { children: ReactNode; enabled: boolean }) {
-  const requiresStandaloneDevAuth = enabled && standaloneDevAuthEnabled && !!APP_ID && !!APP_NAME;
-  const [ready, setReady] = useState(!requiresStandaloneDevAuth);
-
-  useEffect(() => {
-    if (!requiresStandaloneDevAuth) {
-      return;
-    }
-
-    installInjectedDevAuthConfig();
-
-    ensureDevAuthSession({ appId: APP_ID, appName: APP_NAME })
-      .then(() => {
-        installDevBridge({ appId: APP_ID, appName: APP_NAME, debug: false });
-        setReady(true);
-      })
-      .catch(error => {
-        console.error('[template-smoke-nextjs] failed to initialize dev bridge', error);
-        setReady(true);
-      });
-  }, [requiresStandaloneDevAuth]);
-
-  if (!ready) {
-    return (
-      <div className="flex min-h-screen items-center justify-center">
-        <div className="text-muted-foreground text-xs">Initializing dev bridge...</div>
-      </div>
-    );
-  }
-
-  return <>{children}</>;
-}
-
 export default function Page() {
-  const useSdkProvider =
-    standaloneDevAuthEnabled || (typeof window !== 'undefined' && window.parent !== window);
+  const useSdkProvider = isInsideIframe() || isDevStandalone();
 
   if (!APP_NAME) {
     throw new Error('Missing NEXT_PUBLIC_APP_NAME for runtime');
   }
 
-  if (useSdkProvider && !APP_ID) {
-    throw new Error('Missing NEXT_PUBLIC_APP_ID for SDK runtime');
-  }
+  useEffect(() => {
+    if (isDevStandalone()) {
+      installDevBridge();
+    }
+  }, []);
 
   return (
     <div className="bg-background text-foreground min-h-screen">
-      <DevAuthProvider enabled={useSdkProvider}>
-        {useSdkProvider ? (
-          <AppSdkProvider appId={APP_ID!}>
-            <SdkDemo />
-          </AppSdkProvider>
-        ) : (
-          <PreviewShell />
-        )}
-      </DevAuthProvider>
+      {useSdkProvider ? (
+        <AppSdkProvider appId={APP_NAME}>
+          <SdkDemo />
+        </AppSdkProvider>
+      ) : (
+        <PreviewShell />
+      )}
     </div>
   );
 }

package/templates/nextjs/next.config.ts

@@ -1,21 +1,32 @@
 import type { NextConfig } from 'next';
 
+const apiBaseUrl = process.env.API_BASE_URL?.replace(/\/$/, '');
+const devSecret = process.env.DEV_SECRET;
+
 const nextConfig: NextConfig = {
 	output: 'export',
-	env: {
-		NEXT_PUBLIC_APP_NAME: process.env.NEXT_PUBLIC_APP_NAME ?? process.env.VITE_APP_NAME,
-		NEXT_PUBLIC_APP_ID: process.env.NEXT_PUBLIC_APP_ID ?? process.env.VITE_APP_ID,
-		NEXT_PUBLIC_ENABLE_DEV_AUTH:
-			process.env.NEXT_PUBLIC_ENABLE_DEV_AUTH ?? process.env.VITE_ENABLE_DEV_AUTH,
-		NEXT_PUBLIC_DEV_AUTH_HOST_URL:
-			process.env.NEXT_PUBLIC_DEV_AUTH_HOST_URL ?? process.env.DEV_AUTH_HOST_URL,
-		NEXT_PUBLIC_DEV_SESSION_KEY:
-			process.env.NEXT_PUBLIC_DEV_SESSION_KEY ?? process.env.DEV_SESSION_KEY,
-	},
 	images: {
 		unoptimized: true,
 	},
 	trailingSlash: true,
+	async headers() {
+		if (!devSecret) return [];
+		return [
+			{
+				source: '/rest/:path*',
+				headers: [{ key: 'X-Dev-Secret', value: devSecret }],
+			},
+		];
+	},
+	async rewrites() {
+		if (!apiBaseUrl) return [];
+		return [
+			{
+				source: '/rest/:path*',
+				destination: `${apiBaseUrl}/:path*`,
+			},
+		];
+	},
 };
 
-export default nextConfig;
+export default nextConfig;

package/templates/nextjs/package.json

@@ -3,8 +3,8 @@
   "version": "0.0.1",
   "private": true,
   "scripts": {
-    "dev": "bardioc-dev-session -- next dev --port {{PORT}}",
-    "dev:live": "BARDIOC_TUNNEL=1 bardioc-dev-session -- next dev --port {{PORT}}",
+    "dev": "next dev --port {{PORT}}",
+    "dev:live": "BARDIOC_TUNNEL=1 next dev --port {{PORT}}",
     "build": "next build && node scripts/stamp-manifest.mjs out",
     "bundle": "next build && node scripts/stamp-manifest.mjs out && cd out && zip -r ../{{APP_NAME}}.zip .",
     "start": "next start",

package/templates/preact/.env.example

@@ -1,13 +1,9 @@
 # Hosted app slug used by local runtime/dev-auth wiring.
 VITE_APP_NAME={{APP_NAME}}
 
-# Get this from the BardiocOS AppStore after registering your app.
-# Required for token exchange
-VITE_APP_ID=your-app-client-id-here
+# Paste the dev secret from the BardiocOS AppStore after registering your app.
+# Used by the Vite dev-auth proxy to sign requests to the BFF.
+DEV_SECRET=
 
-# Opt into the host-backed standalone dev session when running outside the host iframe.
-VITE_ENABLE_DEV_AUTH=false
-
-# Copy these from the host App Store app details via "Copy Dev Session".
-DEV_AUTH_HOST_URL=
-DEV_SESSION_KEY=
+# Base URL of the Bardioc BFF / backend-for-frontend (e.g. https://your-host).
+API_BASE_URL=

package/templates/preact/package.json

@@ -4,8 +4,8 @@
   "private": true,
   "type": "module",
   "scripts": {
-    "dev": "bardioc-dev-session -- vite",
-    "dev:live": "BARDIOC_TUNNEL=1 bardioc-dev-session -- vite",
+    "dev": "vite",
+    "dev:live": "BARDIOC_TUNNEL=1 vite",
     "build": "tsc && vite build && node scripts/stamp-manifest.mjs dist",
     "bundle": "tsc && vite build && node scripts/stamp-manifest.mjs dist && cd dist && zip -r ../{{APP_NAME}}.zip .",
     "preview": "vite preview",

package/templates/preact/src/App.tsx

@@ -117,7 +117,7 @@ function SdkDemo() {
 }
 
 export function App() {
-  const showSdkDemo = isInsideIframe() || (import.meta.env.VITE_ENABLE_DEV_AUTH === 'true' && isDevStandalone());
+  const showSdkDemo = isInsideIframe() || isDevStandalone();
 
   return (
     <div className="bg-background text-foreground min-h-screen">

package/templates/preact/src/main.tsx

@@ -1,46 +1,30 @@
-import {
-  ensureDevAuthSession,
-  installDevBridge,
-  isDevStandalone,
-  isInsideIframe,
-} from '@bardioc/app-sdk/dev';
+import { installDevBridge, isDevStandalone, isInsideIframe } from '@bardioc/app-sdk/dev';
 import { AppSdkProvider } from '@bardioc/app-sdk/react';
 import { render } from 'preact';
 import { App } from './App';
 import './index.css';
 
 const APP_NAME = import.meta.env.VITE_APP_NAME?.trim();
-const APP_ID = import.meta.env.VITE_APP_ID?.trim();
-const standaloneDevAuthEnabled = import.meta.env.DEV && import.meta.env.VITE_ENABLE_DEV_AUTH === 'true';
 
 if (!APP_NAME) {
   throw new Error('Missing VITE_APP_NAME for runtime');
 }
 
 const insideIframe = isInsideIframe();
-const devStandalone = standaloneDevAuthEnabled && isDevStandalone();
+const devStandalone = isDevStandalone();
 const useSdkProvider = insideIframe || devStandalone;
 
-if (useSdkProvider && !APP_ID) {
-  throw new Error('Missing VITE_APP_ID for SDK runtime');
+if (devStandalone) {
+  installDevBridge({ debug: false });
 }
 
-async function bootstrap() {
-  if (devStandalone) {
-    await ensureDevAuthSession({ appId: APP_ID, appName: APP_NAME });
-    installDevBridge({ appId: APP_ID, appName: APP_NAME, debug: false });
-  }
-
-  render(
-    useSdkProvider ? (
-      <AppSdkProvider appId={APP_ID!}>
-        <App />
-      </AppSdkProvider>
-    ) : (
+render(
+  useSdkProvider ? (
+    <AppSdkProvider appId={APP_NAME}>
       <App />
-    ),
-    document.getElementById('root')!
-  );
-}
-
-bootstrap();
+    </AppSdkProvider>
+  ) : (
+    <App />
+  ),
+  document.getElementById('root')!
+);

package/templates/preact/src/vite-env.d.ts

@@ -2,8 +2,6 @@
 
 interface ImportMetaEnv {
   readonly VITE_APP_NAME: string
-  readonly VITE_APP_ID: string
-  readonly VITE_ENABLE_DEV_AUTH?: string
 }
 
 interface ImportMeta {

package/templates/solid/.env.example

@@ -1,13 +1,9 @@
 # Hosted app slug used by local runtime/dev-auth wiring.
 VITE_APP_NAME={{APP_NAME}}
 
-# Get this from the BardiocOS AppStore after registering your app.
-# Required for token exchange
-VITE_APP_ID=your-app-client-id-here
+# Paste the dev secret from the BardiocOS AppStore after registering your app.
+# Used by the Vite dev-auth proxy to sign requests to the BFF.
+DEV_SECRET=
 
-# Opt into the host-backed standalone dev session when running outside the host iframe.
-VITE_ENABLE_DEV_AUTH=false
-
-# Copy these from the host App Store app details via "Copy Dev Session".
-DEV_AUTH_HOST_URL=
-DEV_SESSION_KEY=
+# Base URL of the Bardioc BFF / backend-for-frontend (e.g. https://your-host).
+API_BASE_URL=

package/templates/solid/package.json

@@ -4,8 +4,8 @@
   "private": true,
   "type": "module",
   "scripts": {
-    "dev": "bardioc-dev-session -- vite",
-    "dev:live": "BARDIOC_TUNNEL=1 bardioc-dev-session -- vite",
+    "dev": "vite",
+    "dev:live": "BARDIOC_TUNNEL=1 vite",
     "build": "tsc && vite build && node scripts/stamp-manifest.mjs dist",
     "bundle": "tsc && vite build && node scripts/stamp-manifest.mjs dist && cd dist && zip -r ../{{APP_NAME}}.zip .",
     "preview": "vite preview",

package/templates/solid/src/App.tsx

@@ -128,7 +128,7 @@ function SdkDemo() {
 }
 
 export function App() {
-  const showSdkDemo = isInsideIframe() || (import.meta.env.VITE_ENABLE_DEV_AUTH === 'true' && isDevStandalone());
+  const showSdkDemo = isInsideIframe() || isDevStandalone();
 
   return (
     <div class="bg-background text-foreground min-h-screen">

package/templates/solid/src/main.tsx

@@ -1,50 +1,34 @@
-import {
-  ensureDevAuthSession,
-  installDevBridge,
-  isDevStandalone,
-  isInsideIframe,
-} from '@bardioc/app-sdk/dev';
+import { installDevBridge, isDevStandalone, isInsideIframe } from '@bardioc/app-sdk/dev';
 import { render } from 'solid-js/web';
 import { App } from './App';
 import { AppSdkProvider } from './bardioc-sdk';
 import './index.css';
 
 const APP_NAME = import.meta.env.VITE_APP_NAME?.trim();
-const APP_ID = import.meta.env.VITE_APP_ID?.trim();
-const standaloneDevAuthEnabled = import.meta.env.DEV && import.meta.env.VITE_ENABLE_DEV_AUTH === 'true';
 
 if (!APP_NAME) {
   throw new Error('Missing VITE_APP_NAME for runtime');
 }
 
 const insideIframe = isInsideIframe();
-const devStandalone = standaloneDevAuthEnabled && isDevStandalone();
+const devStandalone = isDevStandalone();
 const useSdkProvider = insideIframe || devStandalone;
 
-if (useSdkProvider && !APP_ID) {
-  throw new Error('Missing VITE_APP_ID for SDK runtime');
+if (devStandalone) {
+  installDevBridge({ debug: false });
 }
 
-async function bootstrap() {
-  if (devStandalone) {
-    await ensureDevAuthSession({ appId: APP_ID, appName: APP_NAME });
-    installDevBridge({ appId: APP_ID, appName: APP_NAME, debug: false });
-  }
-
-  const root = document.getElementById('root')!;
-
-  if (useSdkProvider) {
-    render(
-      () => (
-        <AppSdkProvider appId={APP_ID!}>
-          <App />
-        </AppSdkProvider>
-      ),
-      root
-    );
-  } else {
-    render(() => <App />, root);
-  }
+const root = document.getElementById('root')!;
+
+if (useSdkProvider) {
+  render(
+    () => (
+      <AppSdkProvider appId={APP_NAME}>
+        <App />
+      </AppSdkProvider>
+    ),
+    root
+  );
+} else {
+  render(() => <App />, root);
 }
-
-bootstrap();

package/templates/solid/src/vite-env.d.ts

@@ -2,8 +2,6 @@
 
 interface ImportMetaEnv {
   readonly VITE_APP_NAME: string
-  readonly VITE_APP_ID: string
-  readonly VITE_ENABLE_DEV_AUTH?: string
 }
 
 interface ImportMeta {

package/templates/svelte/.env.example

@@ -1,5 +1,9 @@
+# Hosted app slug used by local runtime/dev-auth wiring.
 VITE_APP_NAME={{APP_NAME}}
-VITE_APP_ID=your-app-client-id-here
-VITE_ENABLE_DEV_AUTH=false
-DEV_AUTH_HOST_URL=
-DEV_SESSION_KEY=
+
+# Paste the dev secret from the BardiocOS AppStore after registering your app.
+# Used by the Vite dev-auth proxy to sign requests to the BFF.
+DEV_SECRET=
+
+# Base URL of the Bardioc BFF / backend-for-frontend (e.g. https://your-host).
+API_BASE_URL=

package/templates/svelte/package.json

@@ -4,8 +4,8 @@
   "private": true,
   "type": "module",
   "scripts": {
-    "dev": "bardioc-dev-session -- vite",
-    "dev:live": "BARDIOC_TUNNEL=1 bardioc-dev-session -- vite",
+    "dev": "vite",
+    "dev:live": "BARDIOC_TUNNEL=1 vite",
     "build": "svelte-check && vite build && node scripts/stamp-manifest.mjs dist",
     "bundle": "svelte-check && vite build && node scripts/stamp-manifest.mjs dist && cd dist && zip -r ../{{APP_NAME}}.zip .",
     "preview": "vite preview",

package/templates/svelte/src/App.svelte

@@ -12,7 +12,7 @@
 
   let { bridge = null, children }: { bridge?: HostBridge | null; children?: Snippet } = $props();
 
-  const showSdkDemo = isInsideIframe() || (import.meta.env.VITE_ENABLE_DEV_AUTH === 'true' && isDevStandalone());
+  const showSdkDemo = isInsideIframe() || isDevStandalone();
 
   let result = $state<ResultState>({ status: 'idle' });
   let running = $state(false);

package/templates/svelte/src/main.ts

@@ -1,42 +1,26 @@
-import {
-  ensureDevAuthSession,
-  installDevBridge,
-  isDevStandalone,
-  isInsideIframe,
-} from '@bardioc/app-sdk/dev';
+import { installDevBridge, isDevStandalone, isInsideIframe } from '@bardioc/app-sdk/dev';
 import { createHostBridge } from '@bardioc/app-sdk';
 import { mount } from 'svelte';
 import App from './App.svelte';
 import './index.css';
 
 const APP_NAME = import.meta.env.VITE_APP_NAME?.trim();
-const APP_ID = import.meta.env.VITE_APP_ID?.trim();
-const standaloneDevAuthEnabled = import.meta.env.DEV && import.meta.env.VITE_ENABLE_DEV_AUTH === 'true';
 
 if (!APP_NAME) {
   throw new Error('Missing VITE_APP_NAME for runtime');
 }
 
 const insideIframe = isInsideIframe();
-const devStandalone = standaloneDevAuthEnabled && isDevStandalone();
+const devStandalone = isDevStandalone();
 const useSdkProvider = insideIframe || devStandalone;
 
-if (useSdkProvider && !APP_ID) {
-  throw new Error('Missing VITE_APP_ID for SDK runtime');
+if (devStandalone) {
+  installDevBridge({ debug: false });
 }
 
-async function bootstrap() {
-  if (devStandalone) {
-    await ensureDevAuthSession({ appId: APP_ID, appName: APP_NAME });
-    installDevBridge({ appId: APP_ID, appName: APP_NAME, debug: false });
-  }
+const bridge = useSdkProvider ? createHostBridge({ appId: APP_NAME }) : null;
 
-  const bridge = useSdkProvider ? createHostBridge({ appId: APP_ID! }) : null;
-
-  mount(App, {
-    target: document.getElementById('app')!,
-    props: { bridge },
-  });
-}
-
-bootstrap();
+mount(App, {
+  target: document.getElementById('app')!,
+  props: { bridge },
+});

package/templates/svelte/src/vite-env.d.ts

@@ -2,8 +2,6 @@
 
 interface ImportMetaEnv {
   readonly VITE_APP_NAME: string
-  readonly VITE_APP_ID: string
-  readonly VITE_ENABLE_DEV_AUTH?: string
 }
 
 interface ImportMeta {

package/templates/vite/.env.example

@@ -1,14 +1,9 @@
 # Hosted app slug used by local runtime/dev-auth wiring.
 VITE_APP_NAME={{APP_NAME}}
 
-# Get this from the BardiocOS AppStore after registering your app.
-# Required for token exchange
-VITE_APP_ID=your-app-client-id-here
+# Paste the dev secret from the BardiocOS AppStore after registering your app.
+# Used by the Vite dev-auth proxy to sign requests to the BFF.
+DEV_SECRET=
 
-# Opt into the host-backed standalone dev session when running outside the host iframe.
-VITE_ENABLE_DEV_AUTH=false
-
-# Required host URL for standalone dev auth. Run `bardioc login` once, then
-# `npm run dev` will refresh DEV_SESSION_KEY automatically before Vite starts.
-DEV_AUTH_HOST_URL=
-DEV_SESSION_KEY=
+# Base URL of the Bardioc BFF / backend-for-frontend (e.g. https://your-host).
+API_BASE_URL=

package/templates/vite/CLAUDE.md

@@ -33,7 +33,7 @@ src/
   dashboard-provider.tsx  # context: climate state + profile, via useDashboard()
   use-app-notify.ts       # OS host notification (useNotify) mirrored to a local toast
   auth/
-    onboarding.tsx        # Empty full-page screen with the CLI dev-session steps
+    onboarding.tsx        # Empty full-page screen with the DEV_SECRET dev-auth steps
   shell/
     app-shell.tsx         # Sidebar + view routing + Toaster + OS top-menu integration (useCommandMenu)
     about-dialog.tsx      # "About" Dialog — reads public/app-manifest.json at runtime (manifest example)
@@ -75,8 +75,8 @@ pnpm bundle           # → {{APP_NAME}}.zip
 ```
 
 `npm run dev` runs plain Vite — a local preview shell (no transport): the dashboard renders, but
-live SDK data comes only when the app is opened inside the host. `.env` (see `.env.example`): set
-`VITE_APP_ID` (from the BardiocOS AppStore) when you wire the app up to the host.
+live SDK data comes only when the app is opened inside the host, or when `DEV_SECRET` and
+`API_BASE_URL` are set for standalone dev auth (see `.env.example`).
 
 ---
 

package/templates/vite/package.json

@@ -7,7 +7,7 @@
     "dev": "vite",
     "dev:live": "BARDIOC_TUNNEL=1 vite",
     "build": "tsc && vite build && node scripts/stamp-manifest.mjs dist",
-    "bundle": "tsc && vite build && node scripts/stamp-manifest.mjs dist && cd dist && zip -r ../{{APP_NAME}}.zip .",
+    "bundle": "rm -f {{APP_NAME}}.zip && tsc && vite build && node scripts/stamp-manifest.mjs dist && cd dist && zip -r ../{{APP_NAME}}.zip .",
     "preview": "vite preview",
     "check-types": "tsc --noEmit",
     "changeset": "changeset",

package/templates/vite/src/App.tsx

@@ -4,8 +4,7 @@ import { DashboardProvider } from './dashboard-provider';
 import { AppShell } from './shell/app-shell';
 
 export function App() {
-  const authorized =
-    isInsideIframe() || (import.meta.env.VITE_ENABLE_DEV_AUTH === 'true' && isDevStandalone());
+  const authorized = isInsideIframe() || isDevStandalone();
 
   if (!authorized) {
     return <Onboarding />;

package/templates/vite/src/auth/onboarding.tsx

@@ -18,7 +18,6 @@ function DetectedRow({ label, ok }: Readonly<{ label: string; ok: boolean }>) {
 export function Onboarding() {
   const { t } = useTranslation();
   const insideHost = isInsideIframe();
-  const devAuth = import.meta.env.VITE_ENABLE_DEV_AUTH === 'true';
 
   return (
     <Empty
@@ -38,16 +37,16 @@ export function Onboarding() {
     >
       <div className="border-border bg-card mt-4 w-full max-w-md rounded-lg border p-4 text-left text-xs leading-6">
         <p className="text-foreground mb-2 font-medium">
-          {t('auth.stepsTitle', { fallback: 'Run standalone with a dev session:' })}
+          {t('auth.stepsTitle', { fallback: 'Run standalone with dev auth:' })}
         </p>
         <ol className="text-muted-foreground list-decimal space-y-2 pl-4">
-          <li>{t('auth.step1', { fallback: 'Set VITE_ENABLE_DEV_AUTH=true in .env' })}</li>
           <li>
-            <div>{t('auth.step2', { fallback: 'Authorize once in the app folder:' })}</div>
-            <Kbd>bardioc login</Kbd>
+            {t('auth.step1', {
+              fallback: 'Set DEV_SECRET=<your-secret> and API_BASE_URL=<your-host> in .env',
+            })}
           </li>
           <li>
-            <div>{t('auth.step3', { fallback: 'Start the dev server:' })}</div>
+            <div>{t('auth.step2', { fallback: 'Start the dev server:' })}</div>
             <Kbd>pnpm dev</Kbd>
           </li>
         </ol>
@@ -59,7 +58,6 @@ export function Onboarding() {
             label={t('auth.insideHost', { fallback: 'Inside host iframe' })}
             ok={insideHost}
           />
-          <DetectedRow label={t('auth.devAuth', { fallback: 'Dev auth enabled' })} ok={devAuth} />
         </div>
       </div>
     </Empty>

package/templates/vite/src/locales/de.json

@@ -42,9 +42,8 @@
     "title": "Mit Bardioc OS verbinden",
     "description": "Dieses Dashboard liest Live-Daten über den Bardioc-SDK-Transport. Es läuft in Bardioc OS oder eigenständig mit einer CLI-Dev-Session.",
     "stepsTitle": "Eigenständig mit Dev-Session ausführen:",
-    "step1": "Setze VITE_ENABLE_DEV_AUTH=true und DEV_AUTH_HOST_URL=<dein-host> in .env",
-    "step2": "Einmal im App-Ordner autorisieren:",
-    "step3": "Dev-Server starten — der Session-Key wird automatisch erzeugt und erneuert:",
+    "step1": "Setze DEV_SECRET=<dein-secret> und API_BASE_URL=<dein-host> in .env",
+    "step2": "Dev-Server starten:",
     "detectedTitle": "Erkannte Umgebung",
     "insideHost": "Im Host-Iframe",
     "devAuth": "Dev-Auth aktiviert",

package/templates/vite/src/locales/en.json

@@ -42,9 +42,8 @@
     "title": "Connect to Bardioc OS",
     "description": "This dashboard reads live data through the Bardioc SDK transport. It runs when opened inside Bardioc OS, or standalone with a CLI dev session.",
     "stepsTitle": "Run standalone with a dev session:",
-    "step1": "Set VITE_ENABLE_DEV_AUTH=true and DEV_AUTH_HOST_URL=<your-host> in .env",
-    "step2": "Authorize once in the app folder:",
-    "step3": "Start the dev server — the session key is minted and refreshed automatically:",
+    "step1": "Set DEV_SECRET=<your-secret> and API_BASE_URL=<your-host> in .env",
+    "step2": "Start the dev server:",
     "detectedTitle": "Detected environment",
     "insideHost": "Inside host iframe",
     "devAuth": "Dev auth enabled",

package/templates/vite/src/main.tsx

@@ -1,9 +1,4 @@
-import {
-  ensureDevAuthSession,
-  installDevBridge,
-  isDevStandalone,
-  isInsideIframe,
-} from '@bardioc/app-sdk/dev';
+import { installDevBridge, isDevStandalone, isInsideIframe } from '@bardioc/app-sdk/dev';
 import { AppSdkProvider } from '@bardioc/app-sdk/react';
 import { StrictMode } from 'react';
 import { createRoot } from 'react-dom/client';
@@ -12,31 +7,23 @@ import { AppI18nProvider } from './i18n';
 import './index.css';
 
 const APP_NAME = import.meta.env.VITE_APP_NAME?.trim();
-const APP_ID = import.meta.env.VITE_APP_ID?.trim();
-const standaloneDevAuthEnabled =
-  import.meta.env.DEV && import.meta.env.VITE_ENABLE_DEV_AUTH === 'true';
 
 if (!APP_NAME) {
   throw new Error('Missing VITE_APP_NAME for runtime');
 }
 
 const insideIframe = isInsideIframe();
-const devStandalone = standaloneDevAuthEnabled && isDevStandalone();
+const devStandalone = isDevStandalone();
 const useSdkProvider = insideIframe || devStandalone;
 
-if (useSdkProvider && !APP_ID) {
-  throw new Error('Missing VITE_APP_ID for SDK runtime');
-}
-
 if (devStandalone) {
-  await ensureDevAuthSession({ appId: APP_ID, appName: APP_NAME });
-  installDevBridge({ appId: APP_ID, appName: APP_NAME, debug: false });
+  installDevBridge({ debug: false });
 }
 
 createRoot(document.getElementById('root')!).render(
   <StrictMode>
     {useSdkProvider ? (
-      <AppSdkProvider appId={APP_ID}>
+      <AppSdkProvider appId={APP_NAME}>
         <AppI18nProvider syncWithOs>
           <App />
         </AppI18nProvider>

package/templates/vite/src/vite-env.d.ts

@@ -2,8 +2,6 @@
 
 interface ImportMetaEnv {
   readonly VITE_APP_NAME: string;
-  readonly VITE_APP_ID: string;
-  readonly VITE_ENABLE_DEV_AUTH?: string;
 }
 
 interface ImportMeta {

package/templates/vue/.env.example

@@ -1,5 +1,9 @@
+# Hosted app slug used by local runtime/dev-auth wiring.
 VITE_APP_NAME={{APP_NAME}}
-VITE_APP_ID=your-app-client-id-here
-VITE_ENABLE_DEV_AUTH=false
-DEV_AUTH_HOST_URL=
-DEV_SESSION_KEY=
+
+# Paste the dev secret from the BardiocOS AppStore after registering your app.
+# Used by the Vite dev-auth proxy to sign requests to the BFF.
+DEV_SECRET=
+
+# Base URL of the Bardioc BFF / backend-for-frontend (e.g. https://your-host).
+API_BASE_URL=

package/templates/vue/package.json

@@ -4,8 +4,8 @@
   "private": true,
   "type": "module",
   "scripts": {
-    "dev": "bardioc-dev-session -- vite",
-    "dev:live": "BARDIOC_TUNNEL=1 bardioc-dev-session -- vite",
+    "dev": "vite",
+    "dev:live": "BARDIOC_TUNNEL=1 vite",
     "build": "vue-tsc -b && vite build && node scripts/stamp-manifest.mjs dist",
     "bundle": "vue-tsc -b && vite build && node scripts/stamp-manifest.mjs dist && cd dist && zip -r ../{{APP_NAME}}.zip .",
     "preview": "vite preview",

package/templates/vue/src/App.vue

@@ -9,7 +9,7 @@ type ResultState =
   | { status: 'success'; request: string; data: unknown }
   | { status: 'error'; request: string; message: string };
 
-const showSdkDemo = isInsideIframe() || (import.meta.env.VITE_ENABLE_DEV_AUTH === 'true' && isDevStandalone());
+const showSdkDemo = isInsideIframe() || isDevStandalone();
 const bridge = useBardiocBridge();
 const notify = useNotify();
 const result = ref<ResultState>({ status: 'idle' });

package/templates/vue/src/main.ts

@@ -1,43 +1,27 @@
-import {
-  ensureDevAuthSession,
-  installDevBridge,
-  isDevStandalone,
-  isInsideIframe,
-} from '@bardioc/app-sdk/dev';
+import { installDevBridge, isDevStandalone, isInsideIframe } from '@bardioc/app-sdk/dev';
 import { createApp } from 'vue';
 import App from './App.vue';
 import { BARDIOC_BRIDGE_KEY, createAppSdkBridge } from './bardioc-sdk';
 import './index.css';
 
 const APP_NAME = import.meta.env.VITE_APP_NAME?.trim();
-const APP_ID = import.meta.env.VITE_APP_ID?.trim();
-const standaloneDevAuthEnabled = import.meta.env.DEV && import.meta.env.VITE_ENABLE_DEV_AUTH === 'true';
 
 if (!APP_NAME) {
   throw new Error('Missing VITE_APP_NAME for runtime');
 }
 
 const insideIframe = isInsideIframe();
-const devStandalone = standaloneDevAuthEnabled && isDevStandalone();
+const devStandalone = isDevStandalone();
 const useSdkProvider = insideIframe || devStandalone;
 
-if (useSdkProvider && !APP_ID) {
-  throw new Error('Missing VITE_APP_ID for SDK runtime');
+if (devStandalone) {
+  installDevBridge({ debug: false });
 }
 
-async function bootstrap() {
-  if (devStandalone) {
-    await ensureDevAuthSession({ appId: APP_ID, appName: APP_NAME });
-    installDevBridge({ appId: APP_ID, appName: APP_NAME, debug: false });
-  }
+const app = createApp(App);
 
-  const app = createApp(App);
-  
-  if (useSdkProvider) {
-    app.provide(BARDIOC_BRIDGE_KEY, createAppSdkBridge(APP_ID!));
-  }
-
-  app.mount('#app');
+if (useSdkProvider) {
+  app.provide(BARDIOC_BRIDGE_KEY, createAppSdkBridge(APP_NAME));
 }
 
-bootstrap();
+app.mount('#app');

package/templates/vue/src/vite-env.d.ts

@@ -2,8 +2,6 @@
 
 interface ImportMetaEnv {
   readonly VITE_APP_NAME: string
-  readonly VITE_APP_ID: string
-  readonly VITE_ENABLE_DEV_AUTH?: string
 }
 
 interface ImportMeta {

package/templates/nextjs/app/proxy/route.ts

@@ -1,85 +0,0 @@
-import { NextRequest, NextResponse } from 'next/server';
-
-type ProxyPayload = {
-  path?: string;
-  method?: 'GET' | 'POST' | 'PUT' | 'PATCH' | 'DELETE';
-  body?: unknown;
-  contentType?: string;
-  scopeId?: string | null;
-  scopePolicy?: 'none' | 'optional' | 'required';
-  sessionKey?: string;
-  hostUrl?: string;
-};
-
-const APP_ID = process.env.NEXT_PUBLIC_APP_ID?.trim();
-const DEV_AUTH_HOST_URL =
-  process.env.NEXT_PUBLIC_DEV_AUTH_HOST_URL?.trim() ?? process.env.DEV_AUTH_HOST_URL?.trim();
-const DEV_SESSION_KEY =
-  process.env.NEXT_PUBLIC_DEV_SESSION_KEY?.trim() ?? process.env.DEV_SESSION_KEY?.trim();
-
-export async function POST(request: NextRequest) {
-  const payload = (await request.json().catch(() => null)) as ProxyPayload | null;
-
-  if (!payload?.path) {
-    return NextResponse.json(
-      { error: 'invalid_payload' },
-      { status: 400, headers: noStoreHeaders() }
-    );
-  }
-
-  const hostUrl = payload.hostUrl ?? DEV_AUTH_HOST_URL;
-  const sessionKey = payload.sessionKey ?? DEV_SESSION_KEY;
-
-  if (!hostUrl || !sessionKey) {
-    return NextResponse.json(
-      { error: 'missing_dev_session' },
-      { status: 400, headers: noStoreHeaders() }
-    );
-  }
-
-  if (!APP_ID) {
-    return NextResponse.json(
-      { error: 'missing_app_id' },
-      { status: 500, headers: noStoreHeaders() }
-    );
-  }
-
-  try {
-    const transportResponse = await fetch(`${hostUrl.replace(/\/$/, '')}/api/transport`, {
-      method: 'POST',
-      headers: {
-        'Content-Type': 'application/json',
-        'X-Dev-Session-Key': sessionKey,
-      },
-      body: JSON.stringify({
-        appId: APP_ID,
-        path: payload.path,
-        method: payload.method ?? 'GET',
-        body: payload.body,
-        contentType: payload.contentType,
-        scopePolicy: payload.scopePolicy,
-        scopeId: payload.scopeId ?? null,
-      }),
-      cache: 'no-store',
-    });
-
-    const responseText = await transportResponse.text();
-
-    return new NextResponse(responseText, {
-      status: transportResponse.status,
-      headers: {
-        'Cache-Control': 'no-store',
-        'Content-Type': transportResponse.headers.get('content-type') ?? 'application/json',
-      },
-    });
-  } catch {
-    return NextResponse.json(
-      { error: 'host_transport_failed' },
-      { status: 502, headers: noStoreHeaders() }
-    );
-  }
-}
-
-function noStoreHeaders(): HeadersInit {
-  return { 'Cache-Control': 'no-store' };
-}