robodev 0.1.0

package/bin/robodev.mjs

@@ -0,0 +1,5 @@
+#!/usr/bin/env node
+import { register } from "tsx/esm/api";
+
+register();
+await import("../src/index.ts");

package/package.json

@@ -0,0 +1,32 @@
+{
+  "name": "robodev",
+  "version": "0.1.0",
+  "description": "CLI for Robodev Starbase — auth, link, and deploy file-based APIs",
+  "type": "module",
+  "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/robodev-com/robodev-starbase.git",
+    "directory": "robodev-cli"
+  },
+  "bin": {
+    "robodev": "./bin/robodev.mjs"
+  },
+  "files": [
+    "bin",
+    "src"
+  ],
+  "publishConfig": {
+    "access": "public"
+  },
+  "scripts": {
+    "robodev": "tsx src/index.ts"
+  },
+  "dependencies": {
+    "tsx": "^4.20.5"
+  },
+  "devDependencies": {
+    "@types/node": "^24.3.0",
+    "typescript": "^5.9.2"
+  }
+}

package/src/api.ts

@@ -0,0 +1,68 @@
+import { readCredentials, starbaseUrl, writeCredentials, type Credentials } from "./config.js";
+
+export class ApiError extends Error {
+  constructor(
+    message: string,
+    public status: number,
+    public body: Record<string, unknown>,
+  ) {
+    super(message);
+  }
+}
+
+async function request<T>(
+  path: string,
+  init: RequestInit = {},
+  credentials: Credentials | null = null,
+  retry = true,
+): Promise<T> {
+  const headers = new Headers(init.headers);
+  if (init.body && !headers.has("Content-Type")) {
+    headers.set("Content-Type", "application/json");
+  }
+  if (credentials?.accessToken) {
+    headers.set("Authorization", `Bearer ${credentials.accessToken}`);
+  }
+
+  const res = await fetch(`${starbaseUrl()}${path}`, { ...init, headers });
+  const body = (await res.json().catch(() => ({}))) as Record<string, unknown>;
+
+  if (res.status === 401 && retry && credentials?.refreshToken) {
+    const refreshed = await refresh(credentials.refreshToken);
+    if (refreshed) {
+      await writeCredentials(refreshed);
+      return request<T>(path, init, refreshed, false);
+    }
+  }
+
+  if (!res.ok) {
+    throw new ApiError(
+      String(body.message ?? body.error ?? `Request failed (${res.status})`),
+      res.status,
+      body,
+    );
+  }
+  return body as T;
+}
+
+async function refresh(refreshToken: string): Promise<Credentials | null> {
+  const res = await fetch(`${starbaseUrl()}/v1/auth/refresh`, {
+    method: "POST",
+    headers: { "Content-Type": "application/json" },
+    body: JSON.stringify({ refreshToken }),
+  });
+  if (!res.ok) return null;
+  return (await res.json()) as Credentials;
+}
+
+export async function authed<T>(path: string, init: RequestInit = {}): Promise<T> {
+  const credentials = await readCredentials();
+  if (!credentials) {
+    throw new Error("Not authenticated. Run `robodev auth` first.");
+  }
+  return request<T>(path, init, credentials);
+}
+
+export async function publicRequest<T>(path: string, init: RequestInit = {}): Promise<T> {
+  return request<T>(path, init, null, false);
+}

package/src/config.ts

@@ -0,0 +1,64 @@
+import { mkdir, readFile, rm, writeFile } from "node:fs/promises";
+import { homedir } from "node:os";
+import { dirname, join } from "node:path";
+
+export type Credentials = {
+  accessToken: string;
+  refreshToken: string;
+};
+
+export type ProjectLink = {
+  projectId: string;
+  apiUrl: string;
+};
+
+const PROD_URL = "https://robodev.povio.dev";
+
+export function starbaseUrl(): string {
+  return (process.env.STARBASE_URL ?? PROD_URL).replace(/\/$/, "");
+}
+
+export function feUrl(): string {
+  return (process.env.STARBASE_FE_URL ?? process.env.STARBASE_URL ?? PROD_URL).replace(
+    /\/$/,
+    "",
+  );
+}
+
+export function credentialsPath(): string {
+  return join(homedir(), ".robodev", "credentials.json");
+}
+
+export function linkPath(cwd = process.cwd()): string {
+  return join(cwd, ".robodev");
+}
+
+export async function readCredentials(): Promise<Credentials | null> {
+  try {
+    return JSON.parse(await readFile(credentialsPath(), "utf8")) as Credentials;
+  } catch {
+    return null;
+  }
+}
+
+export async function writeCredentials(credentials: Credentials): Promise<void> {
+  const path = credentialsPath();
+  await mkdir(dirname(path), { recursive: true });
+  await writeFile(path, `${JSON.stringify(credentials, null, 2)}\n`);
+}
+
+export async function clearCredentials(): Promise<void> {
+  await rm(credentialsPath(), { force: true });
+}
+
+export async function readLink(cwd = process.cwd()): Promise<ProjectLink | null> {
+  try {
+    return JSON.parse(await readFile(linkPath(cwd), "utf8")) as ProjectLink;
+  } catch {
+    return null;
+  }
+}
+
+export async function writeLink(link: ProjectLink, cwd = process.cwd()): Promise<void> {
+  await writeFile(linkPath(cwd), `${JSON.stringify(link, null, 2)}\n`);
+}

package/src/index.ts

@@ -0,0 +1,320 @@
+import { createServer } from "node:http";
+import { randomBytes } from "node:crypto";
+import { readdir, readFile, stat } from "node:fs/promises";
+import { createInterface } from "node:readline/promises";
+import { stdin, stdout } from "node:process";
+import { join, relative } from "node:path";
+import { execFile } from "node:child_process";
+import { promisify } from "node:util";
+import { ApiError, authed, publicRequest } from "./api.js";
+import {
+  clearCredentials,
+  feUrl,
+  readLink,
+  starbaseUrl,
+  writeCredentials,
+  writeLink,
+} from "./config.js";
+
+const execFileAsync = promisify(execFile);
+
+type Project = { id: string; name: string; apiUrl: string };
+
+function usage(): never {
+  console.log(`robodev <command>
+
+Commands:
+  auth                 Sign in via Starbase in the browser
+  logout               Remove stored credentials
+  whoami               Show the signed-in user
+  projects             List your projects
+  link [projectId]     Write .robodev in the current folder
+  deploy [--force]     Deploy database.ts and api/*.ts
+`);
+  process.exit(1);
+}
+
+async function openBrowser(url: string): Promise<void> {
+  const platform = process.platform;
+  if (platform === "darwin") {
+    await execFileAsync("open", [url]);
+    return;
+  }
+  if (platform === "win32") {
+    await execFileAsync("cmd", ["/c", "start", "", url]);
+    return;
+  }
+  await execFileAsync("xdg-open", [url]);
+}
+
+function prompt(question: string): Promise<string> {
+  const rl = createInterface({ input: stdin, output: stdout });
+  return rl.question(question).finally(() => rl.close());
+}
+
+async function waitForOauthCode(): Promise<{ code: string; redirectUri: string }> {
+  const state = randomBytes(16).toString("hex");
+  return new Promise((resolve, reject) => {
+    const server = createServer((req, res) => {
+      const url = new URL(req.url ?? "/", "http://127.0.0.1");
+      if (url.pathname !== "/callback") {
+        res.statusCode = 404;
+        res.end("Not found");
+        return;
+      }
+      const redirectUri = `http://127.0.0.1:${(server.address() as { port: number }).port}/callback`;
+      if (url.searchParams.get("error")) {
+        res.end("Authorization denied. You can close this window.");
+        server.close();
+        reject(new Error(url.searchParams.get("error") ?? "access_denied"));
+        return;
+      }
+      if (url.searchParams.get("state") !== state) {
+        res.statusCode = 400;
+        res.end("Invalid state");
+        server.close();
+        reject(new Error("OAuth state mismatch"));
+        return;
+      }
+      const authCode = url.searchParams.get("code");
+      if (!authCode) {
+        res.statusCode = 400;
+        res.end("Missing code");
+        server.close();
+        reject(new Error("Missing authorization code"));
+        return;
+      }
+      res.end("Authenticated. You can close this window and return to the terminal.");
+      server.close();
+      resolve({ code: authCode, redirectUri });
+    });
+
+    server.listen(0, "127.0.0.1", () => {
+      const address = server.address();
+      if (!address || typeof address === "string") {
+        reject(new Error("Could not bind OAuth callback"));
+        return;
+      }
+      const redirectUri = `http://127.0.0.1:${address.port}/callback`;
+      const authorize = new URL("/oauth/authorize", feUrl());
+      authorize.searchParams.set("client_id", "robodev-cli");
+      authorize.searchParams.set("response_type", "code");
+      authorize.searchParams.set("redirect_uri", redirectUri);
+      authorize.searchParams.set("state", state);
+      console.log(`Opening browser to authorize robodev-cli…`);
+      openBrowser(authorize.toString()).catch(() => {
+        console.log("Open this URL in your browser:");
+        console.log(authorize.toString());
+      });
+    });
+  });
+}
+
+async function runAuth(): Promise<void> {
+  const { code, redirectUri } = await waitForOauthCode();
+  const tokens = await publicRequest<{ accessToken: string; refreshToken: string }>(
+    "/v1/oauth/token",
+    {
+      method: "POST",
+      body: JSON.stringify({
+        grantType: "authorization_code",
+        code,
+        clientId: "robodev-cli",
+        redirectUri,
+      }),
+    },
+  );
+  await writeCredentials(tokens);
+  const me = await authed<{ email: string }>("/v1/auth/me");
+  console.log(`Signed in as ${me.email}`);
+}
+
+async function runWhoami(): Promise<void> {
+  const me = await authed<{ id: string; email: string }>("/v1/auth/me");
+  console.log(`${me.email} (${me.id})`);
+}
+
+async function listProjects(): Promise<Project[]> {
+  const data = await authed<{ projects: Project[] }>("/v1/projects");
+  return data.projects;
+}
+
+async function runProjects(): Promise<void> {
+  const projects = await listProjects();
+  if (projects.length === 0) {
+    console.log("No projects. Create one in Starbase first.");
+    return;
+  }
+  for (const project of projects) {
+    console.log(`${project.id}\t${project.name}\t${project.apiUrl}`);
+  }
+}
+
+async function runLink(projectId?: string): Promise<void> {
+  const projects = await listProjects();
+  let chosen = projectId;
+  if (!chosen) {
+    if (projects.length === 0) {
+      throw new Error("No projects to link.");
+    }
+    console.log("Projects:");
+    projects.forEach((p, i) => console.log(`  ${i + 1}. ${p.name} (${p.id})`));
+    const answer = await prompt("Project number or id: ");
+    const asIndex = Number(answer);
+    if (Number.isInteger(asIndex) && asIndex >= 1 && asIndex <= projects.length) {
+      chosen = projects[asIndex - 1].id;
+    } else {
+      chosen = answer.trim();
+    }
+  }
+  const project = projects.find((p) => p.id === chosen);
+  if (!project) {
+    throw new Error(`Project ${chosen} not found or not yours`);
+  }
+  await writeLink({ projectId: project.id, apiUrl: starbaseUrl() });
+  console.log(`Linked ${process.cwd()} to ${project.id}`);
+}
+
+async function collectFiles(root: string): Promise<{ path: string; content: string }[]> {
+  const files: { path: string; content: string }[] = [];
+  const database = join(root, "database.ts");
+  try {
+    await stat(database);
+    files.push({ path: "database.ts", content: await readFile(database, "utf8") });
+  } catch {
+    throw new Error("database.ts not found in the current directory");
+  }
+
+  async function walk(dir: string): Promise<void> {
+    let entries;
+    try {
+      entries = await readdir(dir, { withFileTypes: true });
+    } catch {
+      return;
+    }
+    for (const entry of entries) {
+      const abs = join(dir, entry.name);
+      if (entry.isDirectory()) {
+        await walk(abs);
+        continue;
+      }
+      if (entry.isFile() && entry.name.endsWith(".ts")) {
+        files.push({
+          path: relative(root, abs).replaceAll("\\", "/"),
+          content: await readFile(abs, "utf8"),
+        });
+      }
+    }
+  }
+
+  await walk(join(root, "api"));
+  return files;
+}
+
+async function runDeploy(forceFlag: boolean): Promise<void> {
+  const link = await readLink();
+  if (!link) {
+    throw new Error("No .robodev file. Run `robodev link` first.");
+  }
+  const files = await collectFiles(process.cwd());
+  let force = forceFlag;
+
+  for (;;) {
+    try {
+      const result = await authed<{
+        deploymentId: string;
+        databaseName: string;
+        databaseCreated?: boolean;
+        apiUrl: string;
+        docsUrl: string;
+        routes: { method: string; path: string }[];
+        plan: { operations: { type: string; table: string; column?: string; sql: string }[] };
+      }>(`/v1/projects/${link.projectId}/deploy`, {
+        method: "POST",
+        body: JSON.stringify({ force, files }),
+      });
+      console.log(`Deployed to ${result.apiUrl}`);
+      console.log(`Docs     ${result.docsUrl}`);
+      console.log(
+        result.databaseCreated
+          ? `Created database ${result.databaseName}`
+          : `Database ${result.databaseName}`,
+      );
+      if (result.plan.operations.length === 0) {
+        console.log("Schema already up to date.");
+      } else {
+        console.log("Schema changes:");
+        for (const op of result.plan.operations) {
+          console.log(`  ${op.type} ${op.table}${op.column ? `.${op.column}` : ""}`);
+        }
+      }
+      for (const route of result.routes) {
+        console.log(`  ${route.method.toUpperCase()} ${route.path}`);
+      }
+      return;
+    } catch (error) {
+      if (
+        error instanceof ApiError &&
+        error.status === 409 &&
+        !force &&
+        error.body.error === "destructive_schema_changes"
+      ) {
+        const plan = error.body.plan as {
+          operations: {
+            type: string;
+            table: string;
+            column?: string;
+            sql: string;
+            destructive: boolean;
+          }[];
+        };
+        console.log("Destructive schema changes:");
+        for (const op of plan.operations) {
+          const mark = op.destructive ? "!" : " ";
+          console.log(` ${mark} ${op.type} ${op.table}${op.column ? `.${op.column}` : ""}`);
+          console.log(`    ${op.sql}`);
+        }
+        const answer = await prompt("Apply destructive changes? (y/N) ");
+        if (!/^y(es)?$/i.test(answer.trim())) {
+          console.log("Deploy cancelled.");
+          return;
+        }
+        force = true;
+        continue;
+      }
+      throw error;
+    }
+  }
+}
+
+async function main(): Promise<void> {
+  const [command, ...args] = process.argv.slice(2);
+  switch (command) {
+    case "auth":
+      await runAuth();
+      break;
+    case "logout":
+      await clearCredentials();
+      console.log("Signed out.");
+      break;
+    case "whoami":
+      await runWhoami();
+      break;
+    case "projects":
+      await runProjects();
+      break;
+    case "link":
+      await runLink(args[0]);
+      break;
+    case "deploy":
+      await runDeploy(args.includes("--force"));
+      break;
+    default:
+      usage();
+  }
+}
+
+main().catch((error) => {
+  console.error(error instanceof Error ? error.message : error);
+  process.exit(1);
+});