@robodev-ai/runtime 0.1.0

package/package.json

@@ -0,0 +1,47 @@
+{
+  "name": "@robodev-ai/runtime",
+  "version": "0.1.0",
+  "description": "Robodev project runtime — deploy-file classification, esbuild compile, module loading, schema push, route matching, OpenAPI, handler invocation, and Robodev Auth. Shared by hosted Starbase and `robodev dev`.",
+  "type": "module",
+  "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/robodev-com/robodev-starbase.git",
+    "directory": "robodev-runtime"
+  },
+  "exports": {
+    ".": {
+      "types": "./src/index.ts",
+      "import": "./src/index.ts",
+      "default": "./src/index.ts"
+    }
+  },
+  "files": [
+    "src"
+  ],
+  "publishConfig": {
+    "access": "public"
+  },
+  "dependencies": {
+    "busboy": "^1.6.0",
+    "drizzle-kit": "^0.31.10",
+    "drizzle-orm": "^0.45.2",
+    "esbuild": "^0.25.9",
+    "jose": "^6.0.13",
+    "nanoid": "^5.1.5",
+    "pg": "^8.16.3",
+    "zod": "^3.25.76",
+    "zod-to-json-schema": "^3.24.6",
+    "@robodev-ai/sdk": "0.10.0"
+  },
+  "devDependencies": {
+    "@types/busboy": "^1.5.4",
+    "@types/node": "^24.3.0",
+    "@types/pg": "^8.15.5",
+    "tsx": "^4.20.5",
+    "typescript": "^5.9.2"
+  },
+  "scripts": {
+    "test": "tsx --test \"src/**/*.test.ts\""
+  }
+}

package/src/auth-core.ts

@@ -0,0 +1,269 @@
+import { createHash, randomBytes } from "node:crypto";
+import type { AuthUser } from "@robodev-ai/sdk";
+import { id } from "./ids.js";
+import { hashPassword, verifyPassword } from "./password.js";
+import { signProjectUserToken } from "./project-jwt.js";
+
+/** Anything with a `pg`-shaped `query`. Keeps this module off a Pool type. */
+export type AuthQueryable = {
+  query: <R extends Record<string, unknown> = Record<string, unknown>>(
+    sql: string,
+    values?: unknown[],
+  ) => Promise<{ rows: R[] }>;
+};
+
+export type AuthRow = {
+  id: string;
+  email: string;
+  password_hash: string | null;
+  name: string | null;
+  google_subject?: string | null;
+};
+
+export type NonceType = "magic" | "forgot-password";
+
+export const REFRESH_TTL_MS = 30 * 24 * 60 * 60 * 1000;
+export const NONCE_TTL_MS = 15 * 60 * 1000;
+
+export function hashToken(token: string): string {
+  return createHash("sha256").update(token).digest("hex");
+}
+
+export function randomSecret(): string {
+  return randomBytes(32).toString("base64url");
+}
+
+export function toAuthUser(row: AuthRow): AuthUser {
+  return { id: row.id, email: row.email, name: row.name };
+}
+
+/** Creates the `robodev_auth` schema. Idempotent, run on every runtime activation. */
+export async function ensureAuthSchema(db: AuthQueryable): Promise<void> {
+  await db.query(`CREATE SCHEMA IF NOT EXISTS robodev_auth`);
+  await db.query(`
+    CREATE TABLE IF NOT EXISTS robodev_auth.users (
+      id TEXT PRIMARY KEY,
+      email TEXT UNIQUE NOT NULL,
+      password_hash TEXT,
+      name TEXT,
+      created_at TIMESTAMPTZ NOT NULL DEFAULT now()
+    )
+  `);
+  await db.query(`ALTER TABLE robodev_auth.users ADD COLUMN IF NOT EXISTS google_subject TEXT`);
+  await db.query(`
+    CREATE TABLE IF NOT EXISTS robodev_auth.refresh_tokens (
+      id TEXT PRIMARY KEY,
+      user_id TEXT NOT NULL REFERENCES robodev_auth.users(id) ON DELETE CASCADE,
+      token_hash TEXT UNIQUE NOT NULL,
+      expires_at TIMESTAMPTZ NOT NULL,
+      created_at TIMESTAMPTZ NOT NULL DEFAULT now()
+    )
+  `);
+  await db.query(`
+    CREATE TABLE IF NOT EXISTS robodev_auth.authn_nonces (
+      id TEXT PRIMARY KEY,
+      user_id TEXT NOT NULL REFERENCES robodev_auth.users(id) ON DELETE CASCADE,
+      code TEXT UNIQUE NOT NULL,
+      type TEXT NOT NULL,
+      expires_at TIMESTAMPTZ NOT NULL,
+      used_at TIMESTAMPTZ,
+      created_at TIMESTAMPTZ NOT NULL DEFAULT now()
+    )
+  `);
+}
+
+const USER_COLUMNS = `id, email, password_hash, name, google_subject`;
+
+export async function loadUserByEmail(
+  db: AuthQueryable,
+  email: string,
+): Promise<AuthRow | undefined> {
+  const found = await db.query<AuthRow>(
+    `SELECT ${USER_COLUMNS} FROM robodev_auth.users WHERE email = $1`,
+    [email],
+  );
+  return found.rows[0];
+}
+
+export async function loadUserById(
+  db: AuthQueryable,
+  userId: string,
+): Promise<AuthRow | undefined> {
+  const found = await db.query<AuthRow>(
+    `SELECT ${USER_COLUMNS} FROM robodev_auth.users WHERE id = $1`,
+    [userId],
+  );
+  return found.rows[0];
+}
+
+export async function insertPasswordUser(
+  db: AuthQueryable,
+  input: { email: string; password: string; name?: string },
+): Promise<AuthRow> {
+  const row: AuthRow = {
+    id: id("usr"),
+    email: input.email,
+    password_hash: await hashPassword(input.password),
+    name: input.name ? input.name : null,
+  };
+  await db.query(
+    `INSERT INTO robodev_auth.users (id, email, password_hash, name) VALUES ($1, $2, $3, $4)`,
+    [row.id, row.email, row.password_hash, row.name],
+  );
+  return row;
+}
+
+export async function passwordMatches(row: AuthRow, password: string): Promise<boolean> {
+  if (!row.password_hash) return false;
+  return verifyPassword(password, row.password_hash);
+}
+
+export async function updateUserPassword(
+  db: AuthQueryable,
+  userId: string,
+  password: string,
+): Promise<void> {
+  await db.query(`UPDATE robodev_auth.users SET password_hash = $1 WHERE id = $2`, [
+    await hashPassword(password),
+    userId,
+  ]);
+}
+
+export async function updateUserProfile(
+  db: AuthQueryable,
+  userId: string,
+  input: { name: string | null; email: string },
+): Promise<void> {
+  await db.query(`UPDATE robodev_auth.users SET name = $1, email = $2 WHERE id = $3`, [
+    input.name,
+    input.email,
+    userId,
+  ]);
+}
+
+export async function issueProjectTokenPair(
+  db: AuthQueryable,
+  projectId: string,
+  user: Pick<AuthUser, "id" | "email" | "name">,
+  baseSecret: string,
+): Promise<{ accessToken: string; refreshToken: string }> {
+  const refreshToken = randomSecret();
+  const expires = new Date(Date.now() + REFRESH_TTL_MS);
+  await db.query(
+    `INSERT INTO robodev_auth.refresh_tokens (id, user_id, token_hash, expires_at)
+     VALUES ($1, $2, $3, $4)`,
+    [id("tok"), user.id, hashToken(refreshToken), expires.toISOString()],
+  );
+  return {
+    accessToken: await signProjectUserToken(projectId, user, baseSecret),
+    refreshToken,
+  };
+}
+
+export async function createNonce(
+  db: AuthQueryable,
+  userId: string,
+  type: NonceType,
+): Promise<string> {
+  const code = randomSecret();
+  await db.query(
+    `INSERT INTO robodev_auth.authn_nonces (id, user_id, code, type, expires_at)
+     VALUES ($1, $2, $3, $4, $5)`,
+    [id("nnc"), userId, code, type, new Date(Date.now() + NONCE_TTL_MS).toISOString()],
+  );
+  return code;
+}
+
+export async function consumeNonce(
+  db: AuthQueryable,
+  code: string,
+  type: NonceType,
+): Promise<AuthRow | null> {
+  const found = await db.query<{
+    id: string;
+    user_id: string;
+    type: string;
+    expires_at: Date | string;
+    used_at: Date | string | null;
+  }>(
+    `SELECT id, user_id, type, expires_at, used_at FROM robodev_auth.authn_nonces WHERE code = $1`,
+    [code],
+  );
+  const row = found.rows[0];
+  if (!row || row.type !== type || row.used_at || new Date(row.expires_at) < new Date()) {
+    return null;
+  }
+  await db.query(`UPDATE robodev_auth.authn_nonces SET used_at = now() WHERE id = $1`, [row.id]);
+  return (await loadUserById(db, row.user_id)) ?? null;
+}
+
+export async function rotateRefresh(
+  db: AuthQueryable,
+  projectId: string,
+  refreshToken: string,
+  baseSecret: string,
+): Promise<{ accessToken: string; refreshToken: string } | "reuse"> {
+  const found = await db.query<{
+    id: string;
+    user_id: string;
+    expires_at: Date | string;
+    email: string;
+    name: string | null;
+  }>(
+    `SELECT r.id, r.user_id, r.expires_at, u.email, u.name
+     FROM robodev_auth.refresh_tokens r
+     JOIN robodev_auth.users u ON u.id = r.user_id
+     WHERE r.token_hash = $1`,
+    [hashToken(refreshToken)],
+  );
+  const row = found.rows[0];
+  if (!row || new Date(row.expires_at) < new Date()) {
+    return "reuse";
+  }
+  await db.query(`DELETE FROM robodev_auth.refresh_tokens WHERE id = $1`, [row.id]);
+  return issueProjectTokenPair(
+    db,
+    projectId,
+    { id: row.user_id, email: row.email, name: row.name },
+    baseSecret,
+  );
+}
+
+export async function loadRefreshSession(
+  db: AuthQueryable,
+  refreshToken: string,
+): Promise<{ user: AuthRow; expired: boolean } | undefined> {
+  const found = await db.query<{
+    id: string;
+    user_id: string;
+    expires_at: Date | string;
+    email: string;
+    name: string | null;
+    password_hash: string | null;
+    google_subject: string | null;
+  }>(
+    `SELECT r.id, r.user_id, r.expires_at, u.email, u.name, u.password_hash, u.google_subject
+     FROM robodev_auth.refresh_tokens r
+     JOIN robodev_auth.users u ON u.id = r.user_id
+     WHERE r.token_hash = $1`,
+    [hashToken(refreshToken)],
+  );
+  const row = found.rows[0];
+  if (!row) return undefined;
+  return {
+    expired: new Date(row.expires_at) < new Date(),
+    user: {
+      id: row.user_id,
+      email: row.email,
+      password_hash: row.password_hash,
+      name: row.name,
+      google_subject: row.google_subject,
+    },
+  };
+}
+
+export async function revokeRefresh(db: AuthQueryable, refreshToken: string): Promise<void> {
+  await db.query(`DELETE FROM robodev_auth.refresh_tokens WHERE token_hash = $1`, [
+    hashToken(refreshToken),
+  ]);
+}

package/src/auth-schemas.ts

@@ -0,0 +1,58 @@
+import { z } from "zod";
+
+/** Wire contract for the reserved `/api/user/**` routes. Shared by hosted and local Auth. */
+
+export const emailField = z
+  .string()
+  .email()
+  .transform((value) => value.toLowerCase().trim());
+
+export const loginBody = z.object({
+  email: emailField,
+  password: z.string().min(1).max(200),
+});
+
+export const registerBody = z.object({
+  email: emailField,
+  password: z.string().min(12).max(200),
+  name: z.string().trim().max(80).optional(),
+});
+
+export const refreshBody = z.object({
+  refreshToken: z.string().min(1),
+  revoke: z.boolean().optional(),
+});
+
+export const forgotRequestBody = z.object({
+  email: emailField,
+});
+
+export const forgotCallbackBody = z.object({
+  code: z.string().min(1),
+  password: z.string().min(12).max(200),
+});
+
+export const meUpdateBody = z.object({
+  name: z.string().trim().max(80).optional(),
+  email: emailField.optional(),
+});
+
+export const magicGenerateQuery = z.object({
+  email: emailField,
+  redirect_uri: z.string().optional(),
+});
+
+export const magicConsumeQuery = z.object({
+  code: z.string().min(1),
+});
+
+export const googleStartQuery = z.object({
+  redirect_uri: z.string().min(1),
+});
+
+export const GENERIC_STATUS_MESSAGE =
+  "If you entered a valid email, you'll receive an email shortly";
+
+export function statusOk(message: string) {
+  return { status: "ok", message, code: "ok" };
+}

package/src/compile-invoke.test.ts

@@ -0,0 +1,228 @@
+import assert from "node:assert/strict";
+import { mkdtemp, rm } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import test from "node:test";
+import type { RobodevDb } from "@robodev-ai/sdk";
+import { apiBundleExternals, compileApiTree, writeDeploySources } from "./compile.js";
+import { loadModules } from "./load-modules.js";
+import { buildOpenApi } from "./openapi.js";
+import { runRoute, type RouteClients } from "./invoke.js";
+
+/**
+ * Exercises the whole shared path — esbuild compile, module load, OpenAPI, and handler
+ * invocation — on a starter-shaped fixture. No Postgres: `ctx.db` is never touched.
+ */
+
+const DATABASE_TS = `import { defineDatabase, pgTable, text } from "@robodev-ai/sdk";
+
+export const planets = pgTable("planets", {
+  id: text("id").primaryKey(),
+  name: text("name").notNull(),
+});
+
+export default defineDatabase({ name: "space", tables: { planets } });
+`;
+
+const PLANETS_TS = `import { defineApi, z } from "@robodev-ai/sdk";
+import { greeting } from "./_lib.js";
+
+export const get = defineApi({
+  query: z.object({ q: z.string().optional() }),
+  handler: ({ query }) => ({ planets: [greeting(query.q ?? "all")] }),
+});
+
+export const post = defineApi({
+  body: z.object({ name: z.string().min(2) }),
+  handler: ({ body }) => ({ status: 201, body: { created: body.name } }),
+});
+`;
+
+const LIB_TS = `export function greeting(name: string): string {
+  return \`hello \${name}\`;
+}
+`;
+
+const BY_ID_TS = `import { defineApi } from "@robodev-ai/sdk";
+
+export const get = defineApi({
+  handler: ({ params }) => ({ id: params.id }),
+});
+`;
+
+const PRIVATE_TS = `import { defineApi } from "@robodev-ai/sdk";
+
+export const get = defineApi({
+  auth: "required",
+  handler: ({ user }) => ({ email: user?.email ?? null }),
+});
+`;
+
+const FIXTURE = [
+  { path: "database.ts", content: DATABASE_TS },
+  { path: "api/planets.ts", content: PLANETS_TS },
+  { path: "api/_lib.ts", content: LIB_TS },
+  { path: "api/planets/[id].ts", content: BY_ID_TS },
+  { path: "api/private.ts", content: PRIVATE_TS },
+];
+
+function stubClients(): RouteClients {
+  const missing = () => {
+    throw new Error("not used in this test");
+  };
+  return {
+    email: { send: missing },
+    llm: { complete: missing, stream: missing },
+    agent: {
+      createSession: missing,
+      start: missing,
+      events: missing,
+      subscribe: missing,
+      destroy: missing,
+    },
+    storage: { upload: missing, get: missing, getUrl: missing, delete: missing, list: missing },
+    push: { send: missing },
+    jobs: { enqueue: missing },
+    sockets: { send: missing, broadcast: missing },
+    env: { GREETING: "hi" },
+  } as unknown as RouteClients;
+}
+
+async function compileFixture() {
+  const dir = await mkdtemp(join(tmpdir(), "robodev-runtime-"));
+  await writeDeploySources(join(dir, "src"), FIXTURE);
+  const distDir = await compileApiTree({
+    dir,
+    files: FIXTURE,
+    external: apiBundleExternals(),
+    nodePaths: [join(import.meta.dirname, "..", "node_modules")],
+  });
+  const loaded = await loadModules(distDir, FIXTURE);
+  return { dir, loaded };
+}
+
+const invoke = (
+  loaded: Awaited<ReturnType<typeof compileFixture>>["loaded"],
+  input: Partial<Parameters<typeof runRoute>[0]> & { method: string; pathname: string },
+) =>
+  runRoute({
+    db: {} as RobodevDb,
+    routes: loaded.routes,
+    query: {},
+    body: undefined,
+    headers: {},
+    resolveUser: async () => null,
+    clients: stubClients,
+    ...input,
+  });
+
+test("a starter-shaped fixture compiles, loads, and serves its file routes", async () => {
+  const { dir, loaded } = await compileFixture();
+  try {
+    assert.equal(loaded.database.name, "space");
+    assert.deepEqual(loaded.routes.map((route) => `${route.method} ${route.path}`).sort(), [
+      "get /planets",
+      "get /planets/:id",
+      "get /private",
+      "post /planets",
+    ]);
+    // `_lib.ts` is bundled into its importers, never exposed as a route.
+    assert.ok(!loaded.routes.some((route) => route.path.includes("_lib")));
+
+    const openapi = buildOpenApi({
+      title: "space APIs",
+      projectId: "local",
+      routes: loaded.routes,
+    });
+    const paths = Object.keys(openapi.paths as Record<string, unknown>);
+    assert.ok(paths.includes("/api/planets"));
+    assert.ok(paths.includes("/api/planets/{id}"));
+    assert.ok(paths.includes("/api/user/me"));
+  } finally {
+    await rm(dir, { recursive: true, force: true });
+  }
+});
+
+test("runRoute validates, invokes, and encodes a bundled handler", async () => {
+  const { dir, loaded } = await compileFixture();
+  try {
+    const ok = await invoke(loaded, {
+      method: "get",
+      pathname: "/api/planets",
+      query: { q: "mars" },
+    });
+    assert.equal(ok.kind, "ok");
+    assert.deepEqual(ok.kind === "ok" ? ok.encoded.payload : null, { planets: ["hello mars"] });
+
+    const param = await invoke(loaded, { method: "get", pathname: "/api/planets/abc" });
+    assert.deepEqual(param.kind === "ok" ? param.encoded.payload : null, { id: "abc" });
+
+    const envelope = await invoke(loaded, {
+      method: "post",
+      pathname: "/api/planets",
+      body: { name: "Vega" },
+    });
+    assert.equal(envelope.kind === "ok" ? envelope.encoded.status : 0, 201);
+    assert.deepEqual(envelope.kind === "ok" ? envelope.encoded.payload : null, { created: "Vega" });
+  } finally {
+    await rm(dir, { recursive: true, force: true });
+  }
+});
+
+test("runRoute rejects invalid bodies and unknown routes", async () => {
+  const { dir, loaded } = await compileFixture();
+  try {
+    const invalid = await invoke(loaded, {
+      method: "post",
+      pathname: "/api/planets",
+      body: { name: "x" },
+    });
+    assert.equal(invalid.kind, "error");
+    assert.equal(invalid.kind === "error" ? invalid.status : 0, 400);
+    assert.equal(invalid.kind === "error" ? invalid.body.error : "", "invalid_body");
+
+    const missing = await invoke(loaded, { method: "get", pathname: "/api/nope" });
+    assert.equal(missing.kind === "error" ? missing.status : 0, 404);
+  } finally {
+    await rm(dir, { recursive: true, force: true });
+  }
+});
+
+test("runRoute enforces auth: required through the injected resolver", async () => {
+  const { dir, loaded } = await compileFixture();
+  try {
+    const anonymous = await invoke(loaded, { method: "get", pathname: "/api/private" });
+    assert.equal(anonymous.kind === "error" ? anonymous.status : 0, 401);
+
+    const signedIn = await invoke(loaded, {
+      method: "get",
+      pathname: "/api/private",
+      authorization: "Bearer token",
+      resolveUser: async () => ({ id: "usr_1", email: "a@b.com", name: null }),
+    });
+    assert.deepEqual(signedIn.kind === "ok" ? signedIn.encoded.payload : null, {
+      email: "a@b.com",
+    });
+  } finally {
+    await rm(dir, { recursive: true, force: true });
+  }
+});
+
+test("a broken source fails the compile instead of activating", async () => {
+  const dir = await mkdtemp(join(tmpdir(), "robodev-runtime-bad-"));
+  const broken = [
+    { path: "database.ts", content: DATABASE_TS },
+    {
+      path: "api/broken.ts",
+      content: `import { nope } from "./does-not-exist.js";\nexport const x = nope;\n`,
+    },
+  ];
+  try {
+    await writeDeploySources(join(dir, "src"), broken);
+    await assert.rejects(() =>
+      compileApiTree({ dir, files: broken, external: apiBundleExternals() }),
+    );
+  } finally {
+    await rm(dir, { recursive: true, force: true });
+  }
+});