@robodev-ai/runtime 0.1.0

package/src/compile.ts

@@ -0,0 +1,113 @@
+import { mkdir, writeFile } from "node:fs/promises";
+import { builtinModules, isBuiltin } from "node:module";
+import { dirname, join, relative } from "node:path";
+import * as esbuild from "esbuild";
+import { apiCompilePaths, type DeployFile } from "./deploy-files.js";
+
+export const HOST_SDK = "@robodev-ai/sdk";
+
+/**
+ * `builtinModules` omits the prefix-only builtins, which are importable as `node:test` and
+ * friends but have no bare alias. Spell them out so esbuild's externals list covers them;
+ * `isBuiltin` already knows about them.
+ */
+const PREFIX_ONLY_BUILTINS = ["test", "test/reporters", "sea", "sqlite"];
+const NODE_BUILTINS = new Set([
+  ...builtinModules,
+  ...builtinModules.map((name) => `node:${name}`),
+  ...PREFIX_ONLY_BUILTINS.map((name) => `node:${name}`),
+]);
+
+export function isNodeBuiltin(spec: string): boolean {
+  return isBuiltin(spec);
+}
+
+/** Externals every backend bundle shares: the host SDK plus Node builtins. */
+export function apiBundleExternals(): string[] {
+  return [HOST_SDK, ...NODE_BUILTINS];
+}
+
+export type CompileIssue = {
+  text: string;
+  path?: string;
+  line?: number;
+  column?: number;
+};
+
+export class ApiBuildError extends Error {
+  statusCode = 400;
+  code = "api_build_failed";
+  details: { errors: CompileIssue[] };
+
+  constructor(errors: CompileIssue[]) {
+    super("API build failed");
+    this.details = { errors };
+  }
+}
+
+function toDeployPath(file: string | undefined, srcDir: string): string | undefined {
+  if (!file) return undefined;
+  const rel = relative(srcDir, file).replaceAll("\\", "/");
+  if (rel && !rel.startsWith("..")) return rel;
+  return file.replaceAll("\\", "/").split(/[\\/]/).slice(-3).join("/");
+}
+
+export function mapEsbuildErrors(
+  errors: readonly esbuild.Message[],
+  srcDir: string,
+): CompileIssue[] {
+  return errors.map((error) => ({
+    text: error.text,
+    path: toDeployPath(error.location?.file, srcDir),
+    line: error.location?.line,
+    column: error.location?.column,
+  }));
+}
+
+export function isEsbuildFailure(error: unknown): error is esbuild.BuildFailure {
+  return Boolean(error && typeof error === "object" && "errors" in error);
+}
+
+/** Writes the deploy tree to `srcDir` so esbuild has real files to resolve against. */
+export async function writeDeploySources(srcDir: string, files: DeployFile[]): Promise<void> {
+  for (const file of files) {
+    const dest = join(srcDir, file.path);
+    await mkdir(dirname(dest), { recursive: true });
+    await writeFile(dest, file.content, "utf8");
+  }
+}
+
+export type CompileApiOptions = {
+  /** Build root. Sources are read from `<dir>/src`, output goes to `<dir>/dist`. */
+  dir: string;
+  files: readonly DeployFile[];
+  /** Extra module directories esbuild may resolve bare specifiers from. */
+  nodePaths?: string[];
+  external?: string[];
+  plugins?: esbuild.Plugin[];
+};
+
+/**
+ * The single esbuild path for `database.ts`, `api/**`, `jobs/**`, `hooks/**`, and
+ * `sockets/**`. Hosted deploy and `robodev dev` both go through this so a bundle that
+ * compiles locally compiles the same way on Starbase.
+ */
+export async function compileApiTree(options: CompileApiOptions): Promise<string> {
+  const srcDir = join(options.dir, "src");
+  const distDir = join(options.dir, "dist");
+  const entryPoints = apiCompilePaths(options.files).map((path) => join(srcDir, path));
+  await esbuild.build({
+    absWorkingDir: options.dir,
+    entryPoints,
+    outdir: distDir,
+    outbase: srcDir,
+    bundle: true,
+    format: "esm",
+    platform: "node",
+    target: "node20",
+    nodePaths: options.nodePaths ?? [],
+    external: options.external ?? apiBundleExternals(),
+    plugins: options.plugins ?? [],
+  });
+  return distDir;
+}

package/src/deploy-files.test.ts

@@ -0,0 +1,288 @@
+import assert from "node:assert/strict";
+import { test } from "node:test";
+import {
+  classifyDeployPath,
+  detectFrontendKind,
+  MAX_FILE_COUNT,
+  validateDeployFiles,
+  backendRootFromFiles,
+  isAllowedWorkspacePath,
+  isDeniedPath,
+  mapWorkspaceToDeployFiles,
+  apiCompilePaths,
+  isAllowedDeployPath,
+  isBackendTestPath,
+  workspaceHasTinyFrontend,
+  workspaceHasFrontend,
+} from "./deploy-files.js";
+
+const db = { path: "database.ts", content: "export default {}" };
+
+test("allows official tree paths", () => {
+  const files = validateDeployFiles([
+    db,
+    { path: "api/planets.ts", content: "export {}" },
+    { path: "api/invoices/[id].ts", content: "export {}" },
+    { path: "jobs/x.ts", content: "export {}" },
+    { path: "sockets/chat.ts", content: "export {}" },
+    { path: "hooks/auth.ts", content: "export {}" },
+    { path: "hooks/lib.ts", content: "export {}" },
+    { path: "index.html", content: "<html></html>" },
+    { path: "src/main.tsx", content: "export {}" },
+    { path: "package.json", content: "{}" },
+    { path: "README.md", content: "# Hi" },
+    { path: "public/note.txt", content: "ok" },
+  ]);
+  assert.equal(files.length, 12);
+  assert.equal(backendRootFromFiles(files), "");
+});
+
+test("rejects unsafe and denied paths", () => {
+  for (const path of [
+    "../x.ts",
+    "/abs.ts",
+    "node_modules/x.js",
+    "dist/x.js",
+    ".env",
+    ".env.local",
+    "secret.png",
+    "apps/fe/package.json",
+    "apps/fe/src/main.tsx",
+    "robodev/.robodev",
+    ".robodev",
+  ]) {
+    assert.throws(
+      () => validateDeployFiles([db, { path, content: "x" }]),
+      (err: { code?: string }) => err.code === "invalid_file" || err.code === "invalid_file_path",
+    );
+  }
+});
+
+test("workspace allowlist persists Tiny paths and still denies .env", () => {
+  assert.equal(isAllowedWorkspacePath("packages/be/database.ts"), true);
+  assert.equal(isAllowedWorkspacePath("packages/be/api/items.ts"), true);
+  assert.equal(isAllowedWorkspacePath("packages/be/sockets/chat.ts"), true);
+  assert.equal(isAllowedWorkspacePath("apps/fe/package.json"), true);
+  assert.equal(isAllowedWorkspacePath("apps/fe/src/main.tsx"), true);
+  assert.equal(isAllowedWorkspacePath(".rulesync/rules/project-overview.md"), true);
+  assert.equal(isAllowedWorkspacePath("apps/fe/src/styles/fonts/fonts.tsx"), true);
+  assert.equal(isAllowedWorkspacePath("apps/fe/public/favicon.svg"), true);
+  assert.equal(isAllowedWorkspacePath(".env"), false);
+  assert.equal(isAllowedWorkspacePath("apps/fe/.env"), false);
+  assert.equal(isAllowedWorkspacePath("node_modules/x.js"), false);
+  assert.equal(isDeniedPath("apps/fe/src/main.tsx"), true);
+});
+
+test("maps packages/be to hosted database.ts and api/**", () => {
+  const mapped = mapWorkspaceToDeployFiles([
+    { path: "packages/be/database.ts", content: "db" },
+    { path: "packages/be/api/items.ts", content: "api" },
+    { path: "packages/be/sockets/chat.ts", content: "socket" },
+    { path: "apps/fe/src/main.tsx", content: "fe" },
+    { path: ".rulesync/rules/overview.md", content: "rules" },
+  ]);
+  assert.deepEqual(
+    mapped.map((file) => file.path),
+    ["database.ts", "api/items.ts", "sockets/chat.ts"],
+  );
+});
+
+test("allows robodev/ backend tree", () => {
+  const files = validateDeployFiles([
+    { path: "robodev/database.ts", content: "export default {}" },
+    { path: "robodev/api/planets.ts", content: "export {}" },
+    { path: "robodev/api/invoices/[id].ts", content: "export {}" },
+    { path: "robodev/jobs/x.ts", content: "export {}" },
+    { path: "robodev/sockets/chat.ts", content: "export {}" },
+    { path: "robodev/hooks/auth.ts", content: "export {}" },
+    { path: "robodev/package.json", content: '{"private":true,"dependencies":{}}' },
+    { path: "index.html", content: "<html></html>" },
+    { path: "src/main.tsx", content: "export {}" },
+    { path: "package.json", content: "{}" },
+  ]);
+  assert.equal(files.length, 10);
+  assert.equal(backendRootFromFiles(files), "robodev");
+});
+
+test("rejects mixed robodev/ and root backend layouts", () => {
+  assert.throws(
+    () =>
+      validateDeployFiles([
+        { path: "robodev/database.ts", content: "export default {}" },
+        { path: "database.ts", content: "export default {}" },
+      ]),
+    (err: { code?: string }) => err.code === "mixed_backend_layout",
+  );
+  assert.throws(
+    () =>
+      validateDeployFiles([
+        { path: "robodev/database.ts", content: "export default {}" },
+        { path: "api/x.ts", content: "export {}" },
+      ]),
+    (err: { code?: string }) => err.code === "mixed_backend_layout",
+  );
+});
+
+test("requires database.ts at either layout", () => {
+  assert.throws(
+    () => validateDeployFiles([{ path: "api/x.ts", content: "export {}" }]),
+    (err: { code?: string }) => err.code === "database_required",
+  );
+});
+
+test("rejects duplicate paths", () => {
+  assert.throws(
+    () => validateDeployFiles([db, db]),
+    (err: { code?: string }) => err.code === "invalid_file",
+  );
+});
+
+test("rejects api non-ts and unknown src extensions", () => {
+  assert.throws(
+    () => validateDeployFiles([db, { path: "api/x.tsx", content: "x" }]),
+    (err: { code?: string }) => err.code === "invalid_file",
+  );
+  assert.throws(
+    () => validateDeployFiles([db, { path: "src/photo.bmp", content: "x" }]),
+    (err: { code?: string }) => err.code === "invalid_file",
+  );
+});
+
+test("enforces file count and size limits", () => {
+  const many = [
+    db,
+    ...Array.from({ length: MAX_FILE_COUNT }, (_, i) => ({
+      path: `api/f${i}.ts`,
+      content: "x",
+    })),
+  ];
+  assert.throws(
+    () => validateDeployFiles(many),
+    (err: { code?: string }) => err.code === "too_many_files",
+  );
+  assert.throws(
+    () => validateDeployFiles([db, { path: "api/big.ts", content: "a".repeat(1024 * 1024 + 1) }]),
+    (err: { code?: string }) => err.code === "file_too_large",
+  );
+  assert.equal(
+    validateDeployFiles([
+      db,
+      { path: "index.html", content: "<html></html>" },
+      { path: "public/assets/app.js", content: "a".repeat(1024 * 1024 + 10) },
+    ]).length,
+    3,
+  );
+  assert.throws(
+    () =>
+      validateDeployFiles([
+        db,
+        { path: "public/assets/app.js", content: "a".repeat(8 * 1024 * 1024 + 1) },
+      ]),
+    (err: { code?: string }) => err.code === "file_too_large",
+  );
+});
+
+test("classifies api vs frontend vs config", () => {
+  assert.equal(classifyDeployPath("database.ts"), "api");
+  assert.equal(classifyDeployPath("robodev/database.ts"), "api");
+  assert.equal(classifyDeployPath("api/x.ts"), "api");
+  assert.equal(classifyDeployPath("robodev/api/x.ts"), "api");
+  assert.equal(classifyDeployPath("api/invoices/[id].ts"), "api");
+  assert.equal(classifyDeployPath("jobs/x.ts"), "api");
+  assert.equal(classifyDeployPath("robodev/jobs/x.ts"), "api");
+  assert.equal(classifyDeployPath("sockets/chat.ts"), "api");
+  assert.equal(classifyDeployPath("robodev/sockets/chat.ts"), "api");
+  assert.equal(classifyDeployPath("hooks/auth.ts"), "api");
+  assert.equal(classifyDeployPath("robodev/hooks/auth.ts"), "api");
+  assert.equal(classifyDeployPath("hooks/lib.ts"), "api");
+  assert.equal(classifyDeployPath("src/main.tsx"), "frontend");
+  assert.equal(classifyDeployPath("index.html"), "frontend");
+  assert.equal(classifyDeployPath("package.json"), "config");
+  assert.equal(classifyDeployPath("robodev/package.json"), "config");
+  assert.equal(classifyDeployPath("styles.css"), "static");
+  assert.equal(classifyDeployPath("public/assets/font.woff2"), "static");
+  assert.equal(classifyDeployPath("apps/fe/src/main.tsx"), "rejected");
+  assert.equal(classifyDeployPath(".env"), "rejected");
+});
+
+test("validate accepts public SPA binaries as base64 and still denies apps/fe", () => {
+  const font = Buffer.from("woff2-bytes").toString("base64");
+  const files = validateDeployFiles([
+    db,
+    { path: "index.html", content: "<html></html>" },
+    { path: "public/assets/x.woff2", content: font },
+  ]);
+  assert.equal(files.find((file) => file.path === "public/assets/x.woff2")?.content, font);
+  assert.throws(
+    () => validateDeployFiles([db, { path: "apps/fe/src/main.tsx", content: "export {}" }]),
+    (err: { code?: string }) => err.code === "invalid_file",
+  );
+  assert.throws(
+    () => validateDeployFiles([db, { path: "public/assets/app.wasm", content: font }]),
+    (err: { code?: string }) => err.code === "invalid_file",
+  );
+  const over = Buffer.alloc(8 * 1024 * 1024 + 1).toString("base64");
+  assert.throws(
+    () => validateDeployFiles([db, { path: "public/assets/huge.woff2", content: over }]),
+    (err: { code?: string }) => err.code === "file_too_large",
+  );
+});
+
+test("detects react, static, and none", () => {
+  assert.equal(detectFrontendKind([{ path: "database.ts" }]), "none");
+  assert.equal(detectFrontendKind([{ path: "index.html" }]), "static");
+  assert.equal(detectFrontendKind([{ path: "index.html" }, { path: "src/main.tsx" }]), "react");
+});
+
+test("apiCompilePaths includes sockets as backend TS", () => {
+  assert.deepEqual(
+    apiCompilePaths([
+      { path: "database.ts", content: "" },
+      { path: "api/x.ts", content: "" },
+      { path: "jobs/x.ts", content: "" },
+      { path: "sockets/chat.ts", content: "" },
+      { path: "src/main.tsx", content: "" },
+    ]),
+    ["database.ts", "api/x.ts", "jobs/x.ts", "sockets/chat.ts"],
+  );
+});
+
+test("apiCompilePaths skips backend tests", () => {
+  assert.deepEqual(
+    apiCompilePaths([
+      { path: "robodev/database.ts", content: "" },
+      { path: "robodev/api/_lib.ts", content: "" },
+      { path: "robodev/api/_lib.seed.test.ts", content: "" },
+      { path: "robodev/jobs/resize.spec.ts", content: "" },
+      { path: "robodev/sockets/chat.test.ts", content: "" },
+    ]),
+    ["robodev/database.ts", "robodev/api/_lib.ts"],
+  );
+});
+
+test("backend tests stay uploadable even though they never compile", () => {
+  assert.equal(isBackendTestPath("robodev/api/_lib.seed.test.ts"), true);
+  assert.equal(isBackendTestPath("robodev/api/latest.ts"), false);
+  assert.equal(isAllowedDeployPath("robodev/api/_lib.seed.test.ts"), true);
+});
+
+test("Tiny frontend is package.json or index.html under apps/fe", () => {
+  assert.equal(workspaceHasTinyFrontend([{ path: "apps/fe/package.json" }]), true);
+  assert.equal(workspaceHasTinyFrontend([{ path: "apps/fe/index.html" }]), true);
+  assert.equal(workspaceHasTinyFrontend([{ path: "index.html" }]), false);
+  assert.equal(
+    workspaceHasFrontend([
+      { path: "packages/be/database.ts", content: "db" },
+      { path: "apps/fe/package.json", content: "{}" },
+    ]),
+    true,
+  );
+  assert.equal(workspaceHasFrontend([{ path: "database.ts", content: "db" }]), false);
+  assert.equal(
+    workspaceHasFrontend([
+      { path: "database.ts", content: "db" },
+      { path: "index.html", content: "<html></html>" },
+    ]),
+    true,
+  );
+});