robodev 0.18.0 → 0.20.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "robodev",
-  "version": "0.18.0",
+  "version": "0.20.0",
   "description": "CLI for Robodev Starbase — create, auth, link, and deploy hosted apps",
   "type": "module",
   "license": "MIT",

package/src/config.test.ts

@@ -25,12 +25,78 @@ test("writeViteApiUrl sets Vite and Povio public API URLs", async () => {
     );
     const spa = await readFile(join(root, ".config/local.spa.yml"), "utf8");
     assert.match(spa, /^\s*configs\s*:/m);
+    assert.match(spa, /name:\s*resolved/);
+    assert.match(spa, /-\s*name:\s*resolved/);
     assert.match(spa, /templateModule:\s*spa\.template/);
   } finally {
     await rm(root, { recursive: true, force: true });
   }
 });
 
+test("writeViteApiUrl upgrades unnamed spa manifest to resolved target", async () => {
+  const root = await mkdtemp(join(tmpdir(), "rd-spa-upgrade-"));
+  try {
+    await mkdir(join(root, ".config"), { recursive: true });
+    await writeFile(
+      join(root, ".config/local.spa.template.yml"),
+      `APP_PUBLIC_API_URL: &APP_PUBLIC_API_URL "http://localhost:4000"\nVITE_PUBLIC_API_URL: *APP_PUBLIC_API_URL\n`,
+    );
+    await writeFile(
+      join(root, ".config/local.spa.yml"),
+      `configs:
+  values:
+    - name: "@"
+      templateModule: spa.template
+`,
+    );
+    await writeViteApiUrl("https://prj.example.test", root);
+    const spa = await readFile(join(root, ".config/local.spa.yml"), "utf8");
+    assert.match(spa, /name:\s*resolved/);
+    assert.match(spa, /-\s*name:\s*resolved/);
+    assert.match(spa, /templateModule:\s*spa\.template/);
+    const env = await readFile(join(root, ".env"), "utf8");
+    assert.match(env, /^VITE_PUBLIC_API_URL=https:\/\/prj\.example\.test$/m);
+    const template = await readFile(join(root, ".config/local.spa.template.yml"), "utf8");
+    assert.match(
+      template,
+      /APP_PUBLIC_API_URL: &APP_PUBLIC_API_URL "https:\/\/prj\.example\.test"/,
+    );
+  } finally {
+    await rm(root, { recursive: true, force: true });
+  }
+});
+
+test("writeViteApiUrl leaves a resolved spa manifest in place", async () => {
+  const root = await mkdtemp(join(tmpdir(), "rd-spa-ok-"));
+  try {
+    await mkdir(join(root, ".config"), { recursive: true });
+    await writeFile(
+      join(root, ".config/local.spa.template.yml"),
+      `APP_PUBLIC_API_URL: &APP_PUBLIC_API_URL "http://localhost:4000"\nVITE_PUBLIC_API_URL: *APP_PUBLIC_API_URL\n`,
+    );
+    const good = `configs:
+  - name: resolved
+    values:
+      - name: "@"
+        templateModule: spa.template
+`;
+    await writeFile(join(root, ".config/local.spa.yml"), good);
+    await writeViteApiUrl("https://prj.example.test", root);
+    const spa = await readFile(join(root, ".config/local.spa.yml"), "utf8");
+    assert.match(spa, /name:\s*resolved/);
+    assert.match(spa, /templateModule:\s*spa\.template/);
+    const env = await readFile(join(root, ".env"), "utf8");
+    assert.match(env, /^VITE_PUBLIC_API_URL=https:\/\/prj\.example\.test$/m);
+    const template = await readFile(join(root, ".config/local.spa.template.yml"), "utf8");
+    assert.match(
+      template,
+      /APP_PUBLIC_API_URL: &APP_PUBLIC_API_URL "https:\/\/prj\.example\.test"/,
+    );
+  } finally {
+    await rm(root, { recursive: true, force: true });
+  }
+});
+
 test("writeLink merges frontend and unknown keys", async () => {
   const root = await mkdtemp(join(tmpdir(), "rd-link-"));
   try {

package/src/config.ts

@@ -23,9 +23,10 @@ export type ProjectLink = {
 const PROD_URL = "https://robodev.povio.dev";
 
 const SPA_MANIFEST = `configs:
-  values:
-    - name: "@"
-      templateModule: spa.template
+  - name: resolved
+    values:
+      - name: "@"
+        templateModule: spa.template
 `;
 
 /** Control-plane API. Override with `STARBASE_URL` for local Starbase. */
@@ -157,6 +158,10 @@ function isSpaManifest(content: string): boolean {
   return /^\s*configs\s*:/m.test(content);
 }
 
+function hasResolvedSpaTarget(content: string): boolean {
+  return /name:\s*resolved/.test(content);
+}
+
 function rewriteApiUrlInSpaValues(source: string, projectApiUrl: string): string {
   const quoted = JSON.stringify(projectApiUrl);
   const next = source.replace(/^(APP_PUBLIC_API_URL:\s*&APP_PUBLIC_API_URL\s+).+$/m, `$1${quoted}`);
@@ -209,7 +214,7 @@ async function rewriteLocalSpaConfig(projectApiUrl: string, cwd: string): Promis
     await writeFile(templatePath, next.endsWith("\n") ? next : `${next}\n`);
   }
 
-  if (!dest || !isSpaManifest(dest)) {
+  if (!dest || !isSpaManifest(dest) || !hasResolvedSpaTarget(dest)) {
     await writeFile(destPath, SPA_MANIFEST);
   }
 }

package/templates/auth-chat/README.md

@@ -2,16 +2,20 @@
 
 Starter from `robodev create --starter auth-chat`: Tiny chat APIs (`chat` database, `messages` table), authenticated invite email, and a Povio UI in `apps/fe`.
 
-After a CLI create or deploy with `.robodev` `frontend` set (the default for this starter), the project host serves the built Tiny SPA at `GET /`. APIs and Swagger still win over static files. Use bun in `apps/fe` to iterate locally:
+After a CLI create or deploy with `.robodev` `frontend` set (the default for this starter), the project host serves the built Tiny SPA at `GET /`. APIs and Swagger still win over static files.
+
+Local Starbase occupies FE **:3000** and BE **:4000**. Point the CLI at it, then run starter Vite on **3001** so it does not steal the dashboard port:
 
 ```bash
+STARBASE_URL=http://localhost:4000 STARBASE_FE_URL=http://localhost:3000
+# from starter root: auth / link / deploy as today
 cd apps/fe
 bun install
 bun openapi:gen
-bun dev
+bunx --bun vite --port 3001
 ```
 
-Vite defaults to port **3000** (`VITE_DEV_PORT`). `bun` is required for `apps/fe`.
+`bun` is required for `apps/fe`.
 
 Auth, link, and deploy from this **root**:
 

package/templates/auth-chat/apps/fe/openapi-codegen.config.ts

@@ -1,21 +1,56 @@
 /* oxlint-disable import/no-nodejs-modules */
 import type { OpenAPICodegenConfig } from "@povio/openapi-codegen-cli";
 import { resolveConfigSync } from "@povio/resolve-config";
-import { resolve } from "node:path";
+import { readFileSync } from "node:fs";
+import { join, resolve } from "node:path";
 
 const COMPACT_OPENAPI_INPUT = "../../openapi.json";
 const repoRoot = resolve(process.cwd(), "../..");
-const env = resolveConfigSync({ cwd: repoRoot, module: "spa", target: "resolved" }) as Record<
-  string,
-  string | undefined
->;
 
-function resolveLiveOpenApiInput(apiUrl = env.VITE_PUBLIC_API_URL) {
-  return `${apiUrl?.replace(/\/+$/, "")}/openapi.json`;
+function readDotEnvKey(root: string, key: string): string | undefined {
+  try {
+    const content = readFileSync(join(root, ".env"), "utf8");
+    const line = content.split(/\r?\n/).find((row) => row.startsWith(`${key}=`));
+    const value = line?.slice(key.length + 1).trim();
+    return value || undefined;
+  } catch {
+    return undefined;
+  }
+}
+
+function loadResolvedSpaEnv(cwd: string): Record<string, string | undefined> {
+  try {
+    const resolved = resolveConfigSync({ cwd, module: "spa", target: "resolved" });
+    if (resolved && typeof resolved === "object") {
+      return resolved as Record<string, string | undefined>;
+    }
+  } catch {
+    // unnamed or missing spa manifest
+  }
+  return {};
+}
+
+const env = loadResolvedSpaEnv(repoRoot);
+
+function fallbackApiUrl(): string {
+  return (
+    env.VITE_PUBLIC_API_URL ||
+    process.env.VITE_PUBLIC_API_URL ||
+    readDotEnvKey(repoRoot, "VITE_PUBLIC_API_URL") ||
+    "http://localhost:4000"
+  );
+}
+
+function resolveLiveOpenApiInput(apiUrl = fallbackApiUrl()) {
+  const usable = apiUrl.trim();
+  if (!usable) return COMPACT_OPENAPI_INPUT;
+  return `${usable.replace(/\/+$/, "")}/openapi.json`;
 }
 
 export function resolveOpenApiInput() {
-  return process.env.OPENAPI_INPUT || (process.env.OPENAPI_LIVE === "true" ? resolveLiveOpenApiInput() : COMPACT_OPENAPI_INPUT);
+  if (process.env.OPENAPI_INPUT) return process.env.OPENAPI_INPUT;
+  if (process.env.OPENAPI_LIVE === "true") return resolveLiveOpenApiInput();
+  return COMPACT_OPENAPI_INPUT;
 }
 
 const config: OpenAPICodegenConfig = {

package/templates/auth-chat/apps/fe/vite.config.ts

@@ -4,16 +4,47 @@ import tailwindCSS from "@tailwindcss/vite";
 import { devtools } from "@tanstack/devtools-vite";
 import { tanstackRouter } from "@tanstack/router-plugin/vite";
 import viteReact from "@vitejs/plugin-react";
+import { readFileSync } from "node:fs";
+import { join } from "node:path";
 import { defineConfig as defineViteConfig, mergeConfig } from "vite";
 import devtoolsJson from "vite-plugin-devtools-json";
 import { defineConfig as defineVitestConfig } from "vitest/config";
 import { reactIconsSprite } from "react-icons-sprite/vite";
 
 const repoRoot = new URL("../..", import.meta.url).pathname;
-const env = resolveConfigSync({ cwd: repoRoot, module: "spa", target: "resolved" }) as any;
 
+function readDotEnvKey(root: string, key: string): string | undefined {
+  try {
+    const content = readFileSync(join(root, ".env"), "utf8");
+    const line = content.split(/\r?\n/).find((row) => row.startsWith(`${key}=`));
+    const value = line?.slice(key.length + 1).trim();
+    return value || undefined;
+  } catch {
+    return undefined;
+  }
+}
+
+function loadResolvedSpaEnv(cwd: string): Record<string, unknown> {
+  try {
+    const resolved = resolveConfigSync({ cwd, module: "spa", target: "resolved" });
+    if (resolved && typeof resolved === "object") {
+      return resolved as Record<string, unknown>;
+    }
+  } catch {
+    // unnamed or missing spa manifest
+  }
+  return {};
+}
+
+const env = loadResolvedSpaEnv(repoRoot);
 applyEnv(env, "__");
 
+const apiUrl =
+  getString(env, "VITE_PUBLIC_API_URL") ||
+  process.env.VITE_PUBLIC_API_URL ||
+  readDotEnvKey(repoRoot, "VITE_PUBLIC_API_URL") ||
+  "http://localhost:4000";
+
 const isInTestMode = process.env.VITEST === "true";
 const iconsSpritePlugin = reactIconsSprite();
 const iconsSpriteTransform = iconsSpritePlugin.transform;
@@ -51,11 +82,11 @@ const createViteConfig = (isDevServer: boolean) => ({
   ],
   server: {
     open: false,
-    port: getNumber(env, "VITE_DEV_PORT"),
+    port: getNumber(env, "VITE_DEV_PORT") ?? 3000,
     strictPort: false,
     proxy: {
       "^/api(?:/|$)": {
-        target: getString(env, "VITE_PUBLIC_API_URL"),
+        target: apiUrl,
         changeOrigin: true,
         secure: false,
       },

package/templates/auth-chat/package.json

@@ -11,7 +11,7 @@
     "@robodev-ai/sdk": "^0.6.0"
   },
   "devDependencies": {
-    "robodev": "^0.18.0",
+    "robodev": "^0.20.0",
     "rulesync": "^8.18.0",
     "typescript": "^5.9.2"
   }

package/templates/backend/package.json

@@ -10,7 +10,7 @@
     "@robodev-ai/sdk": "^0.6.0"
   },
   "devDependencies": {
-    "robodev": "^0.18.0",
+    "robodev": "^0.20.0",
     "typescript": "^5.9.2"
   }
 }

package/templates/empty/package.json

@@ -10,7 +10,7 @@
     "@robodev-ai/sdk": "^0.6.0"
   },
   "devDependencies": {
-    "robodev": "^0.18.0",
+    "robodev": "^0.20.0",
     "typescript": "^5.9.2"
   }
 }

package/templates/space/README.md

@@ -2,16 +2,20 @@
 
 Starter from `robodev create`: Tiny Template schema (`planets`, `aliens`, `media`, `planet_likes`), file-based APIs in `api/`, and a Povio UI in `apps/fe`.
 
-After a CLI create or deploy with `.robodev` `frontend` set (the default for this starter), the project host serves the built Tiny SPA at `GET /`. APIs and Swagger still win over static files. Use bun in `apps/fe` to iterate locally:
+After a CLI create or deploy with `.robodev` `frontend` set (the default for this starter), the project host serves the built Tiny SPA at `GET /`. APIs and Swagger still win over static files.
+
+Local Starbase occupies FE **:3000** and BE **:4000**. Point the CLI at it, then run starter Vite on **3001** so it does not steal the dashboard port:
 
 ```bash
+STARBASE_URL=http://localhost:4000 STARBASE_FE_URL=http://localhost:3000
+# from starter root: auth / link / deploy as today
 cd apps/fe
 bun install
 bun openapi:gen
-bun dev
+bunx --bun vite --port 3001
 ```
 
-Vite defaults to port **3000** (`VITE_DEV_PORT`). `bun` is required for `apps/fe`.
+`bun` is required for `apps/fe`.
 
 Auth, link, and deploy from this **root**:
 

package/templates/space/apps/fe/openapi-codegen.config.ts

@@ -1,21 +1,56 @@
 /* oxlint-disable import/no-nodejs-modules */
 import type { OpenAPICodegenConfig } from "@povio/openapi-codegen-cli";
 import { resolveConfigSync } from "@povio/resolve-config";
-import { resolve } from "node:path";
+import { readFileSync } from "node:fs";
+import { join, resolve } from "node:path";
 
 const COMPACT_OPENAPI_INPUT = "../../openapi.json";
 const repoRoot = resolve(process.cwd(), "../..");
-const env = resolveConfigSync({ cwd: repoRoot, module: "spa", target: "resolved" }) as Record<
-  string,
-  string | undefined
->;
 
-function resolveLiveOpenApiInput(apiUrl = env.VITE_PUBLIC_API_URL) {
-  return `${apiUrl?.replace(/\/+$/, "")}/openapi.json`;
+function readDotEnvKey(root: string, key: string): string | undefined {
+  try {
+    const content = readFileSync(join(root, ".env"), "utf8");
+    const line = content.split(/\r?\n/).find((row) => row.startsWith(`${key}=`));
+    const value = line?.slice(key.length + 1).trim();
+    return value || undefined;
+  } catch {
+    return undefined;
+  }
+}
+
+function loadResolvedSpaEnv(cwd: string): Record<string, string | undefined> {
+  try {
+    const resolved = resolveConfigSync({ cwd, module: "spa", target: "resolved" });
+    if (resolved && typeof resolved === "object") {
+      return resolved as Record<string, string | undefined>;
+    }
+  } catch {
+    // unnamed or missing spa manifest
+  }
+  return {};
+}
+
+const env = loadResolvedSpaEnv(repoRoot);
+
+function fallbackApiUrl(): string {
+  return (
+    env.VITE_PUBLIC_API_URL ||
+    process.env.VITE_PUBLIC_API_URL ||
+    readDotEnvKey(repoRoot, "VITE_PUBLIC_API_URL") ||
+    "http://localhost:4000"
+  );
+}
+
+function resolveLiveOpenApiInput(apiUrl = fallbackApiUrl()) {
+  const usable = apiUrl.trim();
+  if (!usable) return COMPACT_OPENAPI_INPUT;
+  return `${usable.replace(/\/+$/, "")}/openapi.json`;
 }
 
 export function resolveOpenApiInput() {
-  return process.env.OPENAPI_INPUT || (process.env.OPENAPI_LIVE === "true" ? resolveLiveOpenApiInput() : COMPACT_OPENAPI_INPUT);
+  if (process.env.OPENAPI_INPUT) return process.env.OPENAPI_INPUT;
+  if (process.env.OPENAPI_LIVE === "true") return resolveLiveOpenApiInput();
+  return COMPACT_OPENAPI_INPUT;
 }
 
 const config: OpenAPICodegenConfig = {

package/templates/space/apps/fe/src/utils/media-upload-headers.ts

@@ -0,0 +1,8 @@
+/** Raw FormData upload headers. Never set Content-Type — the browser must add the multipart boundary. */
+export function mediaUploadHeaders(accessToken: string | null): Headers {
+  const headers = new Headers();
+  if (accessToken) {
+    headers.set("Authorization", `Bearer ${accessToken}`);
+  }
+  return headers;
+}

package/templates/space/apps/fe/src/utils/media-upload.test.ts

@@ -0,0 +1,19 @@
+import { describe, expect, it } from "vitest";
+
+import { mediaUploadHeaders } from "./media-upload-headers";
+
+describe("raw FormData upload headers", () => {
+  it("sends Bearer when a token exists and does not set Content-Type", () => {
+    const headers = mediaUploadHeaders("test-access-token");
+
+    expect(headers.get("Authorization")).toBe("Bearer test-access-token");
+    expect(headers.get("Content-Type")).toBeNull();
+  });
+
+  it("omits Authorization when no token exists and still does not set Content-Type", () => {
+    const headers = mediaUploadHeaders(null);
+
+    expect(headers.get("Authorization")).toBeNull();
+    expect(headers.get("Content-Type")).toBeNull();
+  });
+});

package/templates/space/apps/fe/src/utils/media-upload.ts

@@ -1,8 +1,10 @@
 import type { FileUploadRequest } from "@povio/ui";
 
+import { authTokenStore } from "@/clients/auth-token-store";
 import { AppConfig } from "@/config/app.config";
 import type { MediaModels } from "@/openapi/media/media.models";
 import { MediaQueries } from "@/openapi/media/media.queries";
+import { mediaUploadHeaders } from "@/utils/media-upload-headers";
 
 interface UseMediaUploadHandlerOptions {
   resourceName: MediaModels.MediaResourceName;
@@ -53,6 +55,7 @@ export function useMediaUploadHandler({ resourceName, method, onUploaded }: UseM
     const response = await fetch(uploadUrl, {
       method: instructions.method.toUpperCase(),
       body: formData,
+      headers: mediaUploadHeaders(authTokenStore.getAccessToken()),
       signal: options?.abortController?.signal,
     });
 

package/templates/space/apps/fe/vite.config.ts

@@ -4,16 +4,47 @@ import tailwindCSS from "@tailwindcss/vite";
 import { devtools } from "@tanstack/devtools-vite";
 import { tanstackRouter } from "@tanstack/router-plugin/vite";
 import viteReact from "@vitejs/plugin-react";
+import { readFileSync } from "node:fs";
+import { join } from "node:path";
 import { defineConfig as defineViteConfig, mergeConfig } from "vite";
 import devtoolsJson from "vite-plugin-devtools-json";
 import { defineConfig as defineVitestConfig } from "vitest/config";
 import { reactIconsSprite } from "react-icons-sprite/vite";
 
 const repoRoot = new URL("../..", import.meta.url).pathname;
-const env = resolveConfigSync({ cwd: repoRoot, module: "spa", target: "resolved" }) as any;
 
+function readDotEnvKey(root: string, key: string): string | undefined {
+  try {
+    const content = readFileSync(join(root, ".env"), "utf8");
+    const line = content.split(/\r?\n/).find((row) => row.startsWith(`${key}=`));
+    const value = line?.slice(key.length + 1).trim();
+    return value || undefined;
+  } catch {
+    return undefined;
+  }
+}
+
+function loadResolvedSpaEnv(cwd: string): Record<string, unknown> {
+  try {
+    const resolved = resolveConfigSync({ cwd, module: "spa", target: "resolved" });
+    if (resolved && typeof resolved === "object") {
+      return resolved as Record<string, unknown>;
+    }
+  } catch {
+    // unnamed or missing spa manifest
+  }
+  return {};
+}
+
+const env = loadResolvedSpaEnv(repoRoot);
 applyEnv(env, "__");
 
+const apiUrl =
+  getString(env, "VITE_PUBLIC_API_URL") ||
+  process.env.VITE_PUBLIC_API_URL ||
+  readDotEnvKey(repoRoot, "VITE_PUBLIC_API_URL") ||
+  "http://localhost:4000";
+
 const isInTestMode = process.env.VITEST === "true";
 const iconsSpritePlugin = reactIconsSprite();
 const iconsSpriteTransform = iconsSpritePlugin.transform;
@@ -51,11 +82,11 @@ const createViteConfig = (isDevServer: boolean) => ({
   ],
   server: {
     open: false,
-    port: getNumber(env, "VITE_DEV_PORT"),
+    port: getNumber(env, "VITE_DEV_PORT") ?? 3000,
     strictPort: false,
     proxy: {
       "^/api(?:/|$)": {
-        target: getString(env, "VITE_PUBLIC_API_URL"),
+        target: apiUrl,
         changeOrigin: true,
         secure: false,
       },

package/templates/space/package.json

@@ -11,7 +11,7 @@
     "@robodev-ai/sdk": "^0.6.0"
   },
   "devDependencies": {
-    "robodev": "^0.18.0",
+    "robodev": "^0.20.0",
     "rulesync": "^8.18.0",
     "typescript": "^5.9.2"
   }