@robodev-ai/runtime 0.1.0

package/src/path-match.ts

@@ -0,0 +1,213 @@
+import { isBackendTestPath } from "./deploy-files.js";
+
+export type FileRoute = {
+  path: string;
+  paramNames: string[];
+};
+
+export type RouteCandidate = {
+  method: string;
+  path: string;
+};
+
+const PARAM_SEGMENT = /^\[([A-Za-z_][A-Za-z0-9_]*)\]$/;
+
+function isReservedFileRoute(path: string): boolean {
+  return (
+    path === "/user" ||
+    path.startsWith("/user/") ||
+    path === "/api/user" ||
+    path.startsWith("/api/user/") ||
+    path === "/storage/objects" ||
+    path.startsWith("/storage/objects/") ||
+    path === "/_robodev" ||
+    path.startsWith("/_robodev/")
+  );
+}
+
+function canStripApiPrefix(path: string): boolean {
+  if (path === "/api/user" || path.startsWith("/api/user/")) return false;
+  return path === "/api" || path.startsWith("/api/");
+}
+
+function segmentsOf(path: string): string[] {
+  return path.split("/").filter((segment) => segment.length > 0);
+}
+
+function staticScore(pattern: string): { staticCount: number; staticPrefix: number } {
+  const parts = segmentsOf(pattern);
+  const staticCount = parts.filter((part) => !part.startsWith(":")).length;
+  let staticPrefix = 0;
+  for (const part of parts) {
+    if (part.startsWith(":")) break;
+    staticPrefix += part.length + 1;
+  }
+  return { staticCount, staticPrefix };
+}
+
+export function matchPathParams(pattern: string, pathname: string): Record<string, string> | null {
+  const patternParts = segmentsOf(pattern);
+  const pathParts = segmentsOf(pathname);
+  if (patternParts.length !== pathParts.length) return null;
+  const params: Record<string, string> = {};
+  for (let i = 0; i < patternParts.length; i++) {
+    const expected = patternParts[i] ?? "";
+    const actual = pathParts[i] ?? "";
+    if (expected.startsWith(":")) {
+      params[expected.slice(1)] = decodeURIComponent(actual);
+      continue;
+    }
+    if (expected !== actual) return null;
+  }
+  return params;
+}
+
+function matchOnce<T extends RouteCandidate>(
+  path: string,
+  verb: string,
+  routes: T[],
+): { route: T; params: Record<string, string> } | null {
+  const exact = routes.find((route) => route.method === verb && route.path === path);
+  if (exact) return { route: exact, params: {} };
+
+  const parameterized = routes
+    .filter((route) => route.method === verb && route.path.includes(":"))
+    .map((route) => {
+      const params = matchPathParams(route.path, path);
+      return params ? { route, params, ...staticScore(route.path) } : null;
+    })
+    .filter((entry): entry is NonNullable<typeof entry> => entry !== null)
+    .sort((a, b) => b.staticCount - a.staticCount || b.staticPrefix - a.staticPrefix);
+
+  const best = parameterized[0];
+  return best ? { route: best.route, params: best.params } : null;
+}
+
+export function matchProjectRoute<T extends RouteCandidate>(
+  pathname: string,
+  method: string,
+  routes: T[],
+): { route: T; params: Record<string, string> } | null {
+  const verb = method.toLowerCase();
+  const path = pathname.replace(/\/$/, "") || "/";
+  if (!canStripApiPrefix(path)) return null;
+  const direct = matchOnce(path, verb, routes);
+  if (direct) return direct;
+  const stripped = path === "/api" ? "/" : path.slice("/api".length);
+  return matchOnce(stripped, verb, routes);
+}
+
+function stripRobodevPrefix(filePath: string): string {
+  const normalized = filePath.replaceAll("\\", "/");
+  return normalized.startsWith("robodev/") ? normalized.slice("robodev/".length) : normalized;
+}
+
+export function fileToRoute(filePath: string): FileRoute | null {
+  const normalized = stripRobodevPrefix(filePath);
+  if (!normalized.startsWith("api/") || !normalized.endsWith(".ts")) return null;
+  if (normalized.includes("..")) return null;
+  if (isBackendTestPath(normalized)) return null;
+  const without = normalized.slice("api/".length, -".ts".length);
+  if (!without) return { path: "/", paramNames: [] };
+
+  const mapped = mapFileSegments(without);
+  if (!mapped) return null;
+  const path = `/${mapped.out.join("/")}`;
+  if (isReservedFileRoute(path)) return null;
+  if (!path.startsWith("/api/") && path !== "/api" && isReservedFileRoute(`/api${path}`)) {
+    return null;
+  }
+  return { path, paramNames: mapped.paramNames };
+}
+
+function mapFileSegments(without: string): { out: string[]; paramNames: string[] } | null {
+  const paramNames: string[] = [];
+  const out: string[] = [];
+  for (const segment of without.split("/")) {
+    if (!segment) return null;
+    if (segment.includes("[") || segment.includes("]")) {
+      const match = PARAM_SEGMENT.exec(segment);
+      if (!match?.[1]) return null;
+      if (paramNames.includes(match[1])) return null;
+      paramNames.push(match[1]);
+      out.push(`:${match[1]}`);
+      continue;
+    }
+    out.push(segment);
+  }
+  return { out, paramNames };
+}
+
+export function fileToSocketRoute(filePath: string): FileRoute | null {
+  const normalized = stripRobodevPrefix(filePath);
+  if (!normalized.startsWith("sockets/") || !normalized.endsWith(".ts")) return null;
+  if (normalized.includes("..")) return null;
+  if (isBackendTestPath(normalized)) return null;
+  const without = normalized.slice("sockets/".length, -".ts".length);
+  if (!without) return null;
+
+  const mapped = mapFileSegments(without);
+  if (!mapped) return null;
+  const path = `/sockets/${mapped.out.join("/")}`;
+  if (isReservedFileRoute(path) || isReservedFileRoute(`/${mapped.out.join("/")}`)) return null;
+  return { path, paramNames: mapped.paramNames };
+}
+
+export function isAuthHookFile(filePath: string): boolean {
+  return stripRobodevPrefix(filePath) === "hooks/auth.ts";
+}
+
+export function jobNameFromFile(filePath: string): string | null {
+  const normalized = stripRobodevPrefix(filePath);
+  if (!normalized.startsWith("jobs/") || !normalized.endsWith(".ts")) return null;
+  if (normalized.includes("..")) return null;
+  if (isBackendTestPath(normalized)) return null;
+  const name = normalized.slice("jobs/".length, -".ts".length);
+  if (!name || name.split("/").some((segment) => !segment)) return null;
+  return name;
+}
+
+export function socketNameFromFile(filePath: string): string | null {
+  const normalized = stripRobodevPrefix(filePath);
+  if (!normalized.startsWith("sockets/") || !normalized.endsWith(".ts")) return null;
+  if (normalized.includes("..")) return null;
+  if (isBackendTestPath(normalized)) return null;
+  const name = normalized.slice("sockets/".length, -".ts".length);
+  if (!name || name.split("/").some((segment) => !segment)) return null;
+  return name;
+}
+
+export function matchSocketRoute<T extends { path: string }>(
+  pathname: string,
+  sockets: T[],
+): { socket: T; params: Record<string, string> } | null {
+  const path = pathname.replace(/\/$/, "") || "/";
+  const exact = sockets.find((socket) => socket.path === path);
+  if (exact) return { socket: exact, params: {} };
+
+  const parameterized = sockets
+    .filter((socket) => socket.path.includes(":"))
+    .map((socket) => {
+      const params = matchPathParams(socket.path, path);
+      return params ? { socket, params, ...staticScore(socket.path) } : null;
+    })
+    .filter((entry): entry is NonNullable<typeof entry> => entry !== null)
+    .sort((a, b) => b.staticCount - a.staticCount || b.staticPrefix - a.staticPrefix);
+
+  const best = parameterized[0];
+  return best ? { socket: best.socket, params: best.params } : null;
+}
+
+export function openApiPath(routePath: string): string {
+  return routePath.replaceAll(/:([A-Za-z_][A-Za-z0-9_]*)/g, "{$1}");
+}
+
+export function openApiDocumentedPath(routePath: string): string {
+  const path = routePath.replace(/\/$/, "") || "/";
+  if (path === "/api" || path.startsWith("/api/")) return openApiPath(path);
+  return openApiPath(path === "/" ? "/api" : `/api${path}`);
+}
+
+export function pathParamNames(routePath: string): string[] {
+  return [...routePath.matchAll(/:([A-Za-z_][A-Za-z0-9_]*)/g)].map((match) => match[1] ?? "");
+}

package/src/project-jwt.ts

@@ -0,0 +1,57 @@
+import { createHash } from "node:crypto";
+import { jwtVerify, SignJWT } from "jose";
+import type { AuthUser } from "@robodev-ai/sdk";
+
+export const PROJECT_ACCESS_TYP = "project_access";
+export const PROJECT_ACCESS_TTL = "15m";
+
+/** Access tokens are scoped per project, so the signing key is derived per project. */
+export function projectSecret(baseSecret: string, projectId: string): Uint8Array {
+  return createHash("sha256").update(`${baseSecret}:${projectId}`).digest();
+}
+
+export async function signProjectUserToken(
+  projectId: string,
+  user: Pick<AuthUser, "id" | "email" | "name">,
+  baseSecret: string,
+): Promise<string> {
+  return new SignJWT({
+    email: user.email,
+    name: user.name ?? null,
+    project_id: projectId,
+    typ: PROJECT_ACCESS_TYP,
+  })
+    .setProtectedHeader({ alg: "HS256" })
+    .setSubject(user.id)
+    .setIssuedAt()
+    .setExpirationTime(PROJECT_ACCESS_TTL)
+    .sign(projectSecret(baseSecret, projectId));
+}
+
+export async function verifyProjectUserToken(
+  token: string,
+  projectId: string,
+  baseSecret: string,
+): Promise<AuthUser> {
+  const { payload } = await jwtVerify(token, projectSecret(baseSecret, projectId));
+  if (
+    !payload.sub ||
+    typeof payload.email !== "string" ||
+    payload.project_id !== projectId ||
+    payload.typ !== PROJECT_ACCESS_TYP
+  ) {
+    throw new Error("invalid project token");
+  }
+  return {
+    id: payload.sub,
+    email: payload.email,
+    name: typeof payload.name === "string" ? payload.name : null,
+  };
+}
+
+export function bearerToken(header?: string): string | null {
+  if (!header) return null;
+  const [scheme, token] = header.split(" ");
+  if (scheme?.toLowerCase() !== "bearer" || !token) return null;
+  return token;
+}

package/src/reserved-paths.ts

@@ -0,0 +1,25 @@
+/** Paths the runtime owns. File routes may never claim them, hosted or local. */
+
+export function isReservedAuthPath(pathname: string): boolean {
+  return pathname === "/api/user" || pathname.startsWith("/api/user/");
+}
+
+export function isReservedStoragePath(pathname: string): boolean {
+  return pathname.startsWith("/storage/objects/") && pathname.length > "/storage/objects/".length;
+}
+
+export function isReservedRobodevPath(pathname: string): boolean {
+  return (
+    pathname === "/_robodev" || pathname.startsWith("/_robodev/") || pathname === "/openapi.json"
+  );
+}
+
+export function isReservedProjectPath(pathname: string): boolean {
+  return (
+    isReservedAuthPath(pathname) ||
+    pathname === "/user" ||
+    pathname.startsWith("/user/") ||
+    isReservedStoragePath(pathname) ||
+    isReservedRobodevPath(pathname)
+  );
+}

package/src/schema-sync.ts

@@ -0,0 +1,83 @@
+import { pushSchema } from "drizzle-kit/api";
+import pg from "pg";
+import { createDb, type DatabaseDef } from "@robodev-ai/sdk";
+
+export type SchemaOp = {
+  type: string;
+  table: string;
+  column?: string;
+  sql: string;
+  destructive: boolean;
+};
+
+export type SchemaPlan = {
+  destructive: boolean;
+  operations: SchemaOp[];
+};
+
+function classifySql(sql: string): SchemaOp {
+  const normalized = sql.trim();
+  const destructive =
+    /\bdrop\s+(table|column|constraint|index)\b/i.test(normalized) ||
+    /\balter\s+column\b[\s\S]*\btype\b/i.test(normalized) ||
+    /\bset\s+not\s+null\b/i.test(normalized);
+
+  let type = "statement";
+  if (/^create\s+table\b/i.test(normalized)) type = "create_table";
+  else if (/\badd\s+column\b/i.test(normalized)) type = "add_column";
+  else if (/\bdrop\s+table\b/i.test(normalized)) type = "drop_table";
+  else if (/\bdrop\s+column\b/i.test(normalized)) type = "drop_column";
+  else if (/\balter\s+column\b/i.test(normalized) && /\btype\b/i.test(normalized))
+    type = "alter_type";
+  else if (/\b(set|drop)\s+not\s+null\b/i.test(normalized)) type = "alter_null";
+  else if (/\b(set|drop)\s+default\b/i.test(normalized)) type = "alter_default";
+  else if (/\badd\s+constraint\b|\bforeign\s+key\b/i.test(normalized)) type = "add_constraint";
+  else if (/\bdrop\s+constraint\b/i.test(normalized)) type = "drop_constraint";
+  else if (/\bcreate\s+index\b/i.test(normalized)) type = "create_index";
+  else if (/\bdrop\s+index\b/i.test(normalized)) type = "drop_index";
+
+  const tableMatch = normalized.match(/(?:table|from|on)\s+"?([A-Za-z_][A-Za-z0-9_]*)"?/i);
+  const columnMatch = normalized.match(/column\s+"?([A-Za-z_][A-Za-z0-9_]*)"?/i);
+
+  return {
+    type,
+    table: tableMatch?.[1] ?? "",
+    column: columnMatch?.[1],
+    sql: normalized,
+    destructive,
+  };
+}
+
+export async function buildPlan(
+  connectionString: string,
+  desired: DatabaseDef,
+): Promise<SchemaPlan> {
+  const { db, pool } = createDb(connectionString, desired.tables);
+  try {
+    const { hasDataLoss, statementsToExecute } = await pushSchema(desired.tables, db as never);
+    return {
+      destructive: hasDataLoss,
+      operations: statementsToExecute.map(classifySql),
+    };
+  } finally {
+    await pool.end();
+  }
+}
+
+export async function applyPlan(connectionString: string, plan: SchemaPlan): Promise<void> {
+  if (plan.operations.length === 0) return;
+  const client = new pg.Client({ connectionString });
+  await client.connect();
+  try {
+    await client.query("BEGIN");
+    for (const op of plan.operations) {
+      await client.query(op.sql);
+    }
+    await client.query("COMMIT");
+  } catch (error) {
+    await client.query("ROLLBACK").catch(() => undefined);
+    throw error;
+  } finally {
+    await client.end();
+  }
+}