@bardioc/create-bardioc-app 0.5.6 → 0.6.0

package/README.md

@@ -72,7 +72,7 @@ Generated apps can run standalone with the `DEV_SECRET` dev-auth proxy.
 2. Fill in `VITE_APP_NAME`, `DEV_SECRET`, and `API_BASE_URL`
 3. Run `npm run dev`
 
-When running outside the host iframe, the SDK proxies `/rest/*` to `API_BASE_URL` with the `X-Dev-Secret` header and `installDevBridge()` handles SDK messages. Vite templates do this through the `bardiocDevAuth` plugin; the angular and nextjs templates run `scripts/dev-auth-proxy.mjs`, which `npm run dev` starts alongside their dev server.
+When running outside the host iframe, the SDK proxies `/rest/*` to `API_BASE_URL` with the `X-Dev-Secret` header and `installDevBridge()` handles SDK messages. Vite templates do this through the `bardiocDevAuth` plugin; the angular and nextjs templates run `scripts/dev.mjs`, which starts it alongside their dev server.
 
 ## Options
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bardioc/create-bardioc-app",
-  "version": "0.5.6",
+  "version": "0.6.0",
   "description": "Scaffold a Bardioc app with framework templates (vite, react, vue, angular, svelte, solid, preact, nextjs)",
   "license": "MIT",
   "private": false,

package/templates/_base/README.md

@@ -18,7 +18,7 @@ npm run dev              # http://localhost:{{PORT}}
 
 `npm run dev` starts the dev server as a local preview shell. Live SDK data comes when the app is
 opened inside the host, or standalone once `DEV_SECRET` and `API_BASE_URL` are set — the SDK then
-proxies `/rest/*` to the BFF (via the `bardiocDevAuth` Vite plugin, or `scripts/dev-auth-proxy.mjs`
+proxies `/rest/*` to the BFF (via the `bardiocDevAuth` Vite plugin, or `scripts/dev.mjs`
 in the angular and nextjs templates, which `npm run dev` starts alongside the dev server). See
 `.env.example` for the required variables.
 

package/templates/_base/public/app-manifest.json

@@ -5,6 +5,5 @@
   "description": "{{DISPLAY_NAME}} — a Bardioc hosted app",
   "version": "0.0.1",
   "entry": "index.html",
-  "icon": "icon.svg",
-  "permissions": ["notify", "transport"]
+  "icon": "icon.svg"
 }

package/templates/angular/.env.example

@@ -2,8 +2,11 @@
 VITE_APP_NAME={{APP_NAME}}
 
 # Paste the dev secret from the BardiocOS AppStore after registering your app.
-# Used by the dev-auth proxy (scripts/dev-auth-proxy.mjs) to sign requests to the BFF.
+# Used by the dev-auth proxy (scripts/dev.mjs) to sign requests to the BFF.
 DEV_SECRET=
 
 # Base URL of the Bardioc BFF / backend-for-frontend (e.g. https://your-host).
 API_BASE_URL=
+
+# By default, the app will start on port {{PORT}}. Feel free to uncomment the following variable and change it to match your local setup preferences.
+#LOCALHOST_PORT={{PORT}}

package/templates/angular/package.json

@@ -6,7 +6,7 @@
     "sync:runtime-env": "node ./scripts/sync-runtime-env.mjs",
     "ng": "ng",
     "predev": "npm run sync:runtime-env",
-    "dev": "node ./scripts/dev-auth-proxy.mjs & PROXY_PID=$!; ng serve --port {{PORT}}; EXIT_CODE=$?; kill $PROXY_PID 2>/dev/null; exit $EXIT_CODE",
+    "dev": "node ./scripts/dev.mjs",
     "prebuild": "npm run sync:runtime-env",
     "build": "ng build && node scripts/stamp-manifest.mjs dist/{{APP_NAME}}/browser",
     "bundle": "ng build && node scripts/stamp-manifest.mjs dist/{{APP_NAME}}/browser && cd dist/{{APP_NAME}}/browser && zip -r ../../../{{APP_NAME}}.zip .",
@@ -28,7 +28,7 @@
     "@angular/platform-browser": "^19.2.12",
     "@angular/platform-browser-dynamic": "^19.2.12",
     "@angular/router": "^19.2.12",
-    "@bardioc/app-sdk": "^0.4.9",
+    "@bardioc/app-sdk": "^1.0.0",
     "rxjs": "~7.8.2",
     "tslib": "^2.8.1",
     "zone.js": "~0.15.1"

package/templates/angular/scripts/dev-env.mjs

@@ -0,0 +1,62 @@
+import { readFileSync } from 'node:fs';
+import { join } from 'node:path';
+
+// The port a scaffolded app defaults to. LOCALHOST_PORT overrides it, from .env or the shell.
+const DEFAULT_PORT = {{PORT}};
+
+// The dev-auth proxy answers on the app port plus this offset — the same origin the app points
+// installDevHost at.
+export const PROXY_PORT_OFFSET = 100;
+
+// Neither Next nor Angular exposes import.meta.env to a node script, so the dotenv files are read
+// here: .env, then .env.local, then the shell, which always wins — the precedence of Vite's loadEnv.
+export function readEnvValue(projectDir, key) {
+  let value;
+
+  for (const fileName of ['.env', '.env.local']) {
+    let source;
+    try {
+      source = readFileSync(join(projectDir, fileName), 'utf8');
+    } catch {
+      continue;
+    }
+
+    for (const rawLine of source.split(/\r?\n/)) {
+      const line = rawLine.trim();
+      if (line.startsWith(`${key}=`)) {
+        value = parseValue(line.slice(key.length + 1));
+      }
+    }
+  }
+
+  return process.env[key] ?? value;
+}
+
+// A quoted value is taken verbatim; an unquoted one ends at a `#` comment, as dotenv reads it.
+function parseValue(raw) {
+  const value = raw.trim();
+  const quoted = /^(['"`])(.*?)\1/.exec(value);
+  return quoted ? quoted[2] : value.split('#')[0].trim();
+}
+
+export function resolveAppPort(projectDir) {
+  const raw = readEnvValue(projectDir, 'LOCALHOST_PORT');
+  if (!raw) {
+    return DEFAULT_PORT;
+  }
+
+  const port = Number(raw);
+  if (Number.isInteger(port) && port >= 1 && port <= 65535) {
+    return port;
+  }
+
+  console.warn(`[dev] LOCALHOST_PORT=${raw} is not a valid port — using ${DEFAULT_PORT}`);
+  return DEFAULT_PORT;
+}
+
+// The standalone dev-auth contract; null when either value is missing, which disables the proxy.
+export function readDevAuthEnv(projectDir) {
+  const devSecret = readEnvValue(projectDir, 'DEV_SECRET')?.trim();
+  const apiBaseUrl = readEnvValue(projectDir, 'API_BASE_URL')?.trim().replace(/\/$/, '');
+  return devSecret && apiBaseUrl ? { devSecret, apiBaseUrl } : null;
+}

package/templates/angular/scripts/dev.mjs

@@ -0,0 +1,56 @@
+#!/usr/bin/env node
+
+import { createDevAuthProxyHandler } from '@bardioc/app-sdk/dev-proxy';
+import { spawn } from 'node:child_process';
+import { createServer } from 'node:http';
+import { dirname, resolve } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { PROXY_PORT_OFFSET, readDevAuthEnv, resolveAppPort } from './dev-env.mjs';
+
+const PROXY_HOST = '127.0.0.1';
+
+const projectDir = resolve(dirname(fileURLToPath(import.meta.url)), '..');
+const port = resolveAppPort(projectDir);
+
+// Angular's dev server cannot host the SDK Vite plugin, so the proxy runs beside it.
+const proxy = await startProxy(port + PROXY_PORT_OFFSET);
+
+// One command string: shell:true resolves the .cmd shim on Windows, and passing an args array
+// alongside it is deprecated (DEP0190).
+const server = spawn(`ng serve --port ${port}`, { stdio: 'inherit', shell: true });
+
+for (const signal of ['SIGINT', 'SIGTERM']) {
+  process.on(signal, () => server.kill(signal));
+}
+
+// Exit only once the dev server has, carrying its exit code.
+server.on('exit', (code, signal) => {
+  proxy?.close();
+  process.exit(signal ? 1 : (code ?? 0));
+});
+
+// Built from the SDK handler rather than startDevAuthProxy, whose own SIGINT handler exits the
+// process before the dev server has shut down. Without DEV_SECRET / API_BASE_URL the dev server
+// runs alone, matching how the SDK Vite plugin disables itself.
+async function startProxy(proxyPort) {
+  const env = readDevAuthEnv(projectDir);
+  if (!env) {
+    console.warn(
+      '[bardioc-dev-auth] DEV_SECRET and API_BASE_URL are required for dev auth — proxy disabled'
+    );
+    return null;
+  }
+
+  const handler = createDevAuthProxyHandler({ ...env, allowOrigin: '*' });
+  const proxyServer = createServer((req, res) => void handler(req, res));
+
+  await new Promise((resolveListen, rejectListen) => {
+    proxyServer.once('error', rejectListen);
+    proxyServer.listen(proxyPort, PROXY_HOST, resolveListen);
+  });
+
+  console.log(
+    `[bardioc-dev-auth] proxying /rest/* → ${env.apiBaseUrl} on http://${PROXY_HOST}:${proxyPort}/rest`
+  );
+  return proxyServer;
+}

package/templates/angular/scripts/sync-runtime-env.mjs

@@ -1,8 +1,9 @@
 #!/usr/bin/env node
 
-import { mkdirSync, readFileSync, writeFileSync } from 'node:fs';
+import { mkdirSync, writeFileSync } from 'node:fs';
 import { dirname, join, resolve } from 'node:path';
 import { fileURLToPath } from 'node:url';
+import { readEnvValue } from './dev-env.mjs';
 
 const __dirname = dirname(fileURLToPath(import.meta.url));
 const projectRoot = resolve(__dirname, '..');
@@ -19,30 +20,3 @@ writeFileSync(
   'utf8'
 );
 
-// Angular has no import.meta.env, so the app slug is baked into a runtime script instead.
-function readEnvValue(projectDir, key) {
-  let value;
-
-  for (const fileName of ['.env', '.env.local']) {
-    let source;
-    try {
-      source = readFileSync(join(projectDir, fileName), 'utf8');
-    } catch {
-      continue;
-    }
-
-    for (const rawLine of source.split(/\r?\n/)) {
-      const line = rawLine.trim();
-      if (!line.startsWith(`${key}=`)) {
-        continue;
-      }
-      value = line
-        .slice(key.length + 1)
-        .trim()
-        .replace(/^['"]|['"]$/g, '');
-    }
-  }
-
-  // A shell value always wins over the dotenv files, like Vite's env loading.
-  return process.env[key] ?? value;
-}

package/templates/angular/src/app/app.component.ts

@@ -1,8 +1,8 @@
-import { isDevStandalone, isInsideIframe } from '@bardioc/app-sdk/dev';
 import { JsonPipe } from '@angular/common';
 import { Component, inject, signal } from '@angular/core';
-import { BARDIOC_BRIDGE } from './bardioc.token';
-import type { HostBridge } from '@bardioc/app-sdk';
+import type { NotifyLevel } from '@bardioc/app-sdk';
+import { isDevStandalone, isInsideIframe } from '@bardioc/app-sdk/dev';
+import { BARDIOC } from './bardioc.token';
 
 type ResultState =
   | { status: 'idle' }
@@ -15,7 +15,7 @@ type ResultState =
   standalone: true,
   imports: [JsonPipe],
   template: `
-    <div class="bg-background text-foreground min-h-screen">
+    <div class="bg-background text-foreground @container/app min-h-screen">
       @if (showSdkDemo) {
         <div class="mx-auto flex min-h-screen w-full max-w-3xl flex-col gap-3 p-4">
           <div class="flex flex-col gap-1">
@@ -27,30 +27,38 @@ type ResultState =
 
           <div class="flex flex-wrap gap-2">
             <button
-              class="bg-primary text-primary-foreground hover:bg-primary/90 disabled:opacity-50 rounded px-3 py-1 text-xs font-medium disabled:cursor-not-allowed"
+              class="bg-primary text-primary-foreground hover:bg-primary/90 rounded px-3 py-1 text-xs font-medium disabled:cursor-not-allowed disabled:opacity-50"
               (click)="runGetProfile()"
-              [disabled]="running()">
+              [disabled]="running()"
+            >
               Get Profile
             </button>
             <button
-              class="bg-primary text-primary-foreground hover:bg-primary/90 disabled:opacity-50 rounded px-3 py-1 text-xs font-medium disabled:cursor-not-allowed"
+              class="bg-primary text-primary-foreground hover:bg-primary/90 rounded px-3 py-1 text-xs font-medium disabled:cursor-not-allowed disabled:opacity-50"
               (click)="handleNotify()"
-              [disabled]="running()">
+              [disabled]="running()"
+            >
               Send Notification OS
             </button>
             <button
               class="border-border text-muted-foreground hover:text-foreground rounded border px-3 py-1 text-xs"
               (click)="clearResult()"
-              [disabled]="running()">
+              [disabled]="running()"
+            >
               Clear
             </button>
           </div>
 
-          <div class="border-border bg-background flex min-h-0 flex-1 flex-col overflow-hidden rounded border">
+          <div
+            class="border-border bg-background flex min-h-0 flex-1 flex-col overflow-hidden rounded border"
+          >
             @switch (result().status) {
               @case ('idle') {
-                <div class="text-muted-foreground flex h-full items-center justify-center p-3 text-center text-xs leading-5">
-                  Run a query to see results. If the host session is missing, the transport route will return 401.
+                <div
+                  class="text-muted-foreground flex h-full items-center justify-center p-3 text-center text-xs leading-5"
+                >
+                  Run a query to see results. If the host session is missing, the transport route
+                  will return 401.
                 </div>
               }
               @case ('loading') {
@@ -64,15 +72,21 @@ type ResultState =
                   <div class="text-muted-foreground border-border border-b pb-2 font-mono text-xs">
                     {{ resultRequest() }}
                   </div>
-                  <div class="text-destructive break-all whitespace-pre-wrap">{{ resultMessage() }}</div>
+                  <div class="text-destructive whitespace-pre-wrap break-all">
+                    {{ resultMessage() }}
+                  </div>
                 </div>
               }
               @case ('success') {
                 <div class="flex h-full flex-col gap-0 overflow-hidden">
-                  <div class="border-border text-muted-foreground shrink-0 border-b px-3 py-1 font-mono text-xs">
+                  <div
+                    class="border-border text-muted-foreground shrink-0 border-b px-3 py-1 font-mono text-xs"
+                  >
                     {{ resultRequest() }}
                   </div>
-                  <pre class="text-foreground flex-1 overflow-auto p-3 text-[11px] leading-5">{{ resultData() | json }}</pre>
+                  <pre class="text-foreground flex-1 overflow-auto p-3 text-[11px] leading-5">{{
+                    resultData() | json
+                  }}</pre>
                 </div>
               }
             }
@@ -82,7 +96,7 @@ type ResultState =
         <div class="mx-auto flex min-h-screen w-full max-w-3xl flex-col gap-4 p-4">
           <h1 class="m-0 text-2xl font-semibold">Hello Bardioc App</h1>
           <p class="text-muted-foreground m-0 max-w-2xl text-xs leading-5">
-            Open this app inside Bardioc OS to use transport requests and send host notifications.
+            Open this app inside Bardioc to use transport requests and send host notifications.
           </p>
           <div class="border-border bg-muted/20 rounded-xl border p-3 text-xs leading-5">
             Outside the host iframe this page is only a local preview shell.
@@ -93,30 +107,30 @@ type ResultState =
   `,
 })
 export class AppComponent {
-  private bridge = inject(BARDIOC_BRIDGE, { optional: true }) as HostBridge | null;
+  private bardioc = inject(BARDIOC, { optional: true });
 
   showSdkDemo = isInsideIframe() || isDevStandalone();
   result = signal<ResultState>({ status: 'idle' });
   running = signal(false);
 
   async runGetProfile(): Promise<void> {
-    if (this.running() || !this.bridge) return;
+    if (this.running() || !this.bardioc) return;
     this.running.set(true);
 
-    const request = 'transport.os.profile.get()';
+    const request = 'os.profile.get()';
     this.result.set({ status: 'loading', request });
 
     const startTime = Date.now();
-    this.bridge.notify('Getting user profile', 'info');
+    this.notify('Getting user profile…', 'info');
 
     try {
-      const data = await this.bridge.transport.os.profile.get();
+      const data = await this.bardioc.os.profile.get();
       const duration = Date.now() - startTime;
-      this.bridge.notify(`Profile loaded (${duration}ms)`, 'success');
+      this.notify(`Profile loaded (${duration}ms).`, 'success');
       this.result.set({ status: 'success', request, data });
     } catch (err) {
       const message = err instanceof Error ? err.message : String(err);
-      this.bridge.notify(`Failed: ${message}`, 'error');
+      this.notify(`Failed: ${message}`, 'error');
       this.result.set({ status: 'error', request, message });
     }
 
@@ -124,15 +138,19 @@ export class AppComponent {
   }
 
   handleNotify(): void {
-    if (!this.bridge) return;
-    this.bridge.notify('Hello from {{DISPLAY_NAME}}', 'info');
+    if (!this.bardioc) return;
+    this.notify('Hello from {{DISPLAY_NAME}}.', 'info');
     this.result.set({
       status: 'success',
-      request: 'SDK_NOTIFY',
+      request: 'ui.notify',
       data: { ok: true, message: 'Notification sent to OS' },
     });
   }
 
+  private notify(message: string, level: NotifyLevel): void {
+    this.bardioc?.ui.notify(message, level).catch(console.error);
+  }
+
   clearResult(): void {
     this.result.set({ status: 'idle' });
   }

package/templates/angular/src/app/bardioc.token.ts

@@ -1,4 +1,4 @@
 import { InjectionToken } from '@angular/core';
-import type { HostBridge } from '@bardioc/app-sdk';
+import type { Bardioc } from '@bardioc/app-sdk';
 
-export const BARDIOC_BRIDGE = new InjectionToken<HostBridge>('BARDIOC_BRIDGE');
+export const BARDIOC = new InjectionToken<Bardioc>('BARDIOC');

package/templates/angular/src/main.ts

@@ -1,5 +1,6 @@
+import { connect } from '@bardioc/app-sdk';
 import {
-  installDevBridge,
+  installDevHost,
   isDevStandalone,
   isInsideIframe,
 } from '@bardioc/app-sdk/dev';
@@ -7,8 +8,7 @@ import { bootstrapApplication } from '@angular/platform-browser';
 import { provideHttpClient } from '@angular/common/http';
 import { type EnvironmentProviders, type Provider } from '@angular/core';
 import { AppComponent } from './app/app.component';
-import { createBardiocBridge } from './app/bardioc-bridge';
-import { BARDIOC_BRIDGE } from './app/bardioc.token';
+import { BARDIOC } from './app/bardioc.token';
 import './styles.css';
 
 function readAppPort(): number {
@@ -24,7 +24,8 @@ const useSdkProvider = insideIframe || devStandalone;
 
 async function bootstrap() {
   if (devStandalone) {
-    installDevBridge({
+    installDevHost({
+      appId: '{{APP_NAME}}',
       apiBaseUrl: `http://127.0.0.1:${proxyPort}/rest`,
     });
   }
@@ -34,10 +35,7 @@ async function bootstrap() {
   ];
 
   if (useSdkProvider) {
-    providers.push({
-      provide: BARDIOC_BRIDGE,
-      useValue: createBardiocBridge(),
-    });
+    providers.push({ provide: BARDIOC, useValue: await connect() });
   }
 
   bootstrapApplication(AppComponent, {

package/templates/angular/src/styles.css

@@ -85,6 +85,10 @@ code {
     margin: 0;
 }
 
+.\@container\/app {
+    container: app / inline-size;
+}
+
 .flex {
     display: flex;
 }

package/templates/nextjs/.env.example

@@ -2,8 +2,11 @@
 NEXT_PUBLIC_APP_NAME={{APP_NAME}}
 
 # Paste the dev secret from the BardiocOS AppStore after registering your app.
-# Used by the dev-auth proxy (scripts/dev-auth-proxy.mjs) to sign requests to the BFF.
+# Used by the dev-auth proxy (scripts/dev.mjs) to sign requests to the BFF.
 DEV_SECRET=
 
 # Base URL of the Bardioc BFF / backend-for-frontend (e.g. https://your-host).
 API_BASE_URL=
+
+# By default, the app will start on port {{PORT}}. Feel free to uncomment the following variable and change it to match your local setup preferences.
+#LOCALHOST_PORT={{PORT}}

package/templates/nextjs/app/page.tsx

@@ -1,6 +1,6 @@
 'use client';
 
-import { installDevBridge, isDevStandalone, isInsideIframe } from '@bardioc/app-sdk/dev';
+import { installDevHost, isDevStandalone, isInsideIframe } from '@bardioc/app-sdk/dev';
 import { AppSdkProvider, useNotify, useSdk } from '@bardioc/app-sdk/react';
 import { useEffect, useState } from 'react';
 
@@ -12,11 +12,11 @@ type ResultState =
 
 const APP_NAME = process.env.NEXT_PUBLIC_APP_NAME?.trim();
 
-// scripts/dev-auth-proxy.mjs listens on the app port + 100 for standalone dev auth.
-const DEV_PROXY_PORT = Number('{{PORT}}') + 100;
+// The port the app falls back to when it is not being served over HTTP (LOCALHOST_PORT moves it).
+const DEFAULT_PORT = Number('{{PORT}}');
 
 function SdkDemo() {
-  const bridge = useSdk();
+  const bardioc = useSdk();
   const notify = useNotify();
   const [result, setResult] = useState<ResultState>({ status: 'idle' });
   const [running, setRunning] = useState(false);
@@ -25,17 +25,17 @@ function SdkDemo() {
     if (running) return;
     setRunning(true);
 
-    const request = 'transport.os.profile.get()';
+    const request = 'os.profile.get()';
     setResult({ status: 'loading', request });
 
     const startTime = Date.now();
-    notify('Getting user profile', 'info');
+    notify('Getting user profile…', 'info');
 
     try {
-      const data = await bridge.transport.os.profile.get();
+      const data = await bardioc.os.profile.get();
 
       const duration = Date.now() - startTime;
-      notify(`Profile loaded (${duration}ms)`, 'success');
+      notify(`Profile loaded (${duration}ms).`, 'success');
       setResult({ status: 'success', request, data });
     } catch (err) {
       const message = err instanceof Error ? err.message : String(err);
@@ -47,10 +47,10 @@ function SdkDemo() {
   }
 
   function handleNotify() {
-    notify('Hello from {{DISPLAY_NAME}}', 'info');
+    notify('Hello from {{DISPLAY_NAME}}.', 'info');
     setResult({
       status: 'success',
-      request: 'SDK_NOTIFY',
+      request: 'ui.notify',
       data: { ok: true, message: 'Notification sent to OS' },
     });
   }
@@ -106,7 +106,7 @@ function SdkDemo() {
             <div className="text-muted-foreground border-border border-b pb-2 font-mono text-xs">
               {result.request}
             </div>
-            <div className="text-destructive break-all whitespace-pre-wrap">{result.message}</div>
+            <div className="text-destructive whitespace-pre-wrap break-all">{result.message}</div>
           </div>
         )}
         {result.status === 'success' && (
@@ -129,7 +129,7 @@ function PreviewShell() {
     <div className="mx-auto flex min-h-screen w-full max-w-3xl flex-col gap-4 p-4">
       <h1 className="m-0 text-2xl font-semibold">Hello Bardioc App</h1>
       <p className="text-muted-foreground m-0 max-w-2xl text-xs leading-5">
-        Open this app inside Bardioc OS to use transport requests and send host notifications.
+        Open this app inside Bardioc to use transport requests and send host notifications.
       </p>
       <div className="border-border bg-muted/20 rounded-xl border p-3 text-xs leading-5">
         Outside the host iframe this page is only a local preview shell.
@@ -147,14 +147,17 @@ export default function Page() {
 
   useEffect(() => {
     if (isDevStandalone()) {
-      installDevBridge({ apiBaseUrl: `http://127.0.0.1:${DEV_PROXY_PORT}/rest` });
+      // scripts/dev.mjs runs the dev-auth proxy on the app port + 100, so read the port the page
+      // is actually served on rather than the one baked in at scaffold time.
+      const appPort = Number(window.location.port) || DEFAULT_PORT;
+      installDevHost({ appId: APP_NAME, apiBaseUrl: `http://127.0.0.1:${appPort + 100}/rest` });
     }
   }, []);
 
   return (
-    <div className="bg-background text-foreground min-h-screen">
+    <div className="bg-background text-foreground @container/app min-h-screen">
       {useSdkProvider ? (
-        <AppSdkProvider appId={APP_NAME}>
+        <AppSdkProvider>
           <SdkDemo />
         </AppSdkProvider>
       ) : (

package/templates/nextjs/next.config.ts

@@ -1,6 +1,6 @@
 import type { NextConfig } from 'next';
 
-// Standalone dev auth lives in scripts/dev-auth-proxy.mjs (the SDK dev-auth proxy), not here:
+// Standalone dev auth lives in scripts/dev.mjs (the SDK dev-auth proxy), not here:
 // the BFF needs Origin dropped and X-Requested-With stamped, which rewrites cannot do.
 const nextConfig: NextConfig = {
   output: 'export',

package/templates/nextjs/package.json

@@ -3,7 +3,7 @@
   "version": "0.0.1",
   "private": true,
   "scripts": {
-    "dev": "node ./scripts/dev-auth-proxy.mjs & PROXY_PID=$!; next dev --port {{PORT}}; EXIT_CODE=$?; kill $PROXY_PID 2>/dev/null; exit $EXIT_CODE",
+    "dev": "node ./scripts/dev.mjs",
     "build": "next build && node scripts/stamp-manifest.mjs out",
     "bundle": "next build && node scripts/stamp-manifest.mjs out && cd out && zip -r ../{{APP_NAME}}.zip .",
     "start": "next start",
@@ -17,13 +17,13 @@
     "release:publish": "changeset publish"
   },
   "dependencies": {
-    "@bardioc/app-sdk": "^0.4.9",
+    "@bardioc/app-sdk": "^1.0.0",
     "next": "^15.3.2",
     "react": "^19.2.5",
     "react-dom": "^19.2.5"
   },
   "devDependencies": {
-    "@bardioc/configs": "^0.2.1",
+    "@bardioc/configs": "0.2.1",
     "@changesets/cli": "^2.31.0",
     "@tailwindcss/postcss": "^4.2.4",
     "@types/node": "^22.10.0",

package/templates/nextjs/scripts/dev-env.mjs

@@ -0,0 +1,62 @@
+import { readFileSync } from 'node:fs';
+import { join } from 'node:path';
+
+// The port a scaffolded app defaults to. LOCALHOST_PORT overrides it, from .env or the shell.
+const DEFAULT_PORT = {{PORT}};
+
+// The dev-auth proxy answers on the app port plus this offset — the same origin the app points
+// installDevHost at.
+export const PROXY_PORT_OFFSET = 100;
+
+// Neither Next nor Angular exposes import.meta.env to a node script, so the dotenv files are read
+// here: .env, then .env.local, then the shell, which always wins — the precedence of Vite's loadEnv.
+export function readEnvValue(projectDir, key) {
+  let value;
+
+  for (const fileName of ['.env', '.env.local']) {
+    let source;
+    try {
+      source = readFileSync(join(projectDir, fileName), 'utf8');
+    } catch {
+      continue;
+    }
+
+    for (const rawLine of source.split(/\r?\n/)) {
+      const line = rawLine.trim();
+      if (line.startsWith(`${key}=`)) {
+        value = parseValue(line.slice(key.length + 1));
+      }
+    }
+  }
+
+  return process.env[key] ?? value;
+}
+
+// A quoted value is taken verbatim; an unquoted one ends at a `#` comment, as dotenv reads it.
+function parseValue(raw) {
+  const value = raw.trim();
+  const quoted = /^(['"`])(.*?)\1/.exec(value);
+  return quoted ? quoted[2] : value.split('#')[0].trim();
+}
+
+export function resolveAppPort(projectDir) {
+  const raw = readEnvValue(projectDir, 'LOCALHOST_PORT');
+  if (!raw) {
+    return DEFAULT_PORT;
+  }
+
+  const port = Number(raw);
+  if (Number.isInteger(port) && port >= 1 && port <= 65535) {
+    return port;
+  }
+
+  console.warn(`[dev] LOCALHOST_PORT=${raw} is not a valid port — using ${DEFAULT_PORT}`);
+  return DEFAULT_PORT;
+}
+
+// The standalone dev-auth contract; null when either value is missing, which disables the proxy.
+export function readDevAuthEnv(projectDir) {
+  const devSecret = readEnvValue(projectDir, 'DEV_SECRET')?.trim();
+  const apiBaseUrl = readEnvValue(projectDir, 'API_BASE_URL')?.trim().replace(/\/$/, '');
+  return devSecret && apiBaseUrl ? { devSecret, apiBaseUrl } : null;
+}