robodev 0.21.1 → 0.22.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "robodev",
-  "version": "0.21.1",
+  "version": "0.22.0",
   "description": "CLI for Robodev Starbase — create, auth, link, and deploy hosted apps",
   "type": "module",
   "license": "MIT",

package/src/emit-starter.test.ts

@@ -84,8 +84,8 @@ test("collectFiles for space starter is Tiny APIs without apps/fe", async () =>
   assert.ok(paths.has("api/planets.ts"));
   assert.ok(paths.has("api/planets/paginate.ts"));
   assert.ok(paths.has("api/aliens/labels.ts"));
-  assert.ok(paths.has("api/files/upload-request.ts"));
-  assert.ok(paths.has("api/files/upload.ts"));
+  assert.ok(!paths.has("api/files/upload-request.ts"));
+  assert.ok(!paths.has("api/files/upload.ts"));
   assert.ok(!paths.has("index.html"));
   assert.ok(!paths.has("src/main.tsx"));
   assert.ok([...paths].every((path) => !path.startsWith("apps/")));

package/templates/auth-chat/.rulesync/skills/media-feature/SKILL.md

@@ -10,12 +10,12 @@ codexcli:
 
 Preserve the upload contract:
 
-1. Frontend selects a `File`.
-2. Frontend calls `MediaQueries.useUploadRequest` with metadata only (`POST /api/files/upload-request`).
-3. Frontend uploads bytes to the returned URL (`POST /api/files/upload` via Starbase `ctx.storage`).
-4. Feature create/update submits only `image: { id }`.
-5. Feature reads resolve that ID to `image: { id, url }`.
+1. Frontend selects a `File` and keeps it local until submit. Do not call `/api/files/*`.
+2. Feature create/update is one `multipart/form-data` request (`POST` / `PUT`) with text fields and an optional `file`.
+3. The handler validates text fields, optionally calls `savePlanetImage` (`ctx.storage.upload` public), and writes the feature row.
+4. Update may send `clearImage=true` when the user cleared an existing image and picked nothing new. A new `file` wins over `clearImage`.
+5. Feature reads resolve the stored media ID to `image: { id, url }`.
 
-Never send `File`, `Blob`, base64, or raw bytes in a feature create/update request.
+Never use a standalone files API. File bytes stay on the device until submit.
 
 Media metadata lives in the `media` table in `database.ts`. Bytes live in Robodev storage. Planet images use resource name `planet-image`.

package/templates/auth-chat/package.json

@@ -11,7 +11,7 @@
     "@robodev-ai/sdk": "^0.6.0"
   },
   "devDependencies": {
-    "robodev": "^0.21.1",
+    "robodev": "^0.22.0",
     "rulesync": "^8.18.0",
     "typescript": "^5.9.2"
   }

package/templates/backend/api/_lib.ts

@@ -1,5 +1,5 @@
 import { asc, eq, type InferSelectModel } from "@robodev-ai/sdk";
-import type { ApiHandlerContext } from "@robodev-ai/sdk";
+import type { ApiHandlerContext, UploadedFile } from "@robodev-ai/sdk";
 import { aliens, media, planetLikes, planets } from "../database";
 
 export const PLANET_IMAGE_RESOURCE = "planet-image";
@@ -339,21 +339,46 @@ export async function validateAlien(
   return row ?? null;
 }
 
-export async function validateImage(
-  db: ApiHandlerContext<unknown, unknown>["db"],
-  image: { id: string } | null | undefined,
-  userId: string,
-) {
-  if (!image) return null;
-  const [row] = await db.select().from(media).where(eq(media.id, image.id)).limit(1);
-  if (!row) return { error: fail(404, "Media not found") };
-  if (row.userId !== userId) return { error: fail(403, "You can only use your own media") };
-  if (row.resourceName !== PLANET_IMAGE_RESOURCE) {
-    return { error: fail(400, "Media cannot be used as a planet image") };
+const ALLOWED_PLANET_IMAGE_TYPES = new Set(["image/jpeg", "image/png", "image/webp"]);
+const MAX_PLANET_IMAGE_BYTES = 2 * 1024 * 1024;
+
+export async function savePlanetImage(
+  ctx: ApiHandlerContext<unknown, unknown>,
+  file: UploadedFile,
+): Promise<{ id: string } | ReturnType<typeof fail>> {
+  const mimeType = file.mimetype || "application/octet-stream";
+  if (file.data.length > MAX_PLANET_IMAGE_BYTES) {
+    return fail(400, "File is too large");
+  }
+  if (!ALLOWED_PLANET_IMAGE_TYPES.has(mimeType)) {
+    return fail(400, "Unsupported image type");
   }
-  if (!row.uploaded)
-    return { error: fail(400, "Media must be uploaded before it can be attached") };
-  return { id: row.id };
+
+  const fileName = (file.filename || "image").replaceAll("/", "-");
+  const key = `planet-images/${ctx.user!.id}/${crypto.randomUUID()}-${fileName}`;
+  const [row] = await ctx.db
+    .insert(media)
+    .values({
+      key,
+      userId: ctx.user!.id,
+      resourceName: PLANET_IMAGE_RESOURCE,
+      fileName,
+      fileSize: file.data.length,
+      mimeType,
+    })
+    .returning();
+
+  try {
+    await ctx.storage.upload(row!.key, file.data, {
+      public: true,
+      contentType: mimeType,
+    });
+  } catch (error) {
+    return fail(503, error instanceof Error ? error.message : "Storage is not configured");
+  }
+
+  await ctx.db.update(media).set({ uploaded: new Date() }).where(eq(media.id, row!.id));
+  return { id: row!.id };
 }
 
 export { aliens, media, planetLikes, planets };

package/templates/backend/api/planets/[id].ts

@@ -1,12 +1,18 @@
 import { defineApi, eq, z } from "@robodev-ai/sdk";
-import { enrichOne, fail, findPlanet, planets, validateAlien, validateImage } from "../_lib";
+import { enrichOne, fail, findPlanet, planets, savePlanetImage, validateAlien } from "../_lib";
+
+const emptyToUndefined = (value: unknown) => (value === "" ? undefined : value);
 
 const planetBody = z.object({
   name: z.string().min(1),
-  alienId: z.string().nullish(),
-  discoveryDate: z.string().nullish(),
-  description: z.string().nullish(),
-  image: z.object({ id: z.string() }).nullish(),
+  alienId: z.preprocess(emptyToUndefined, z.string().optional()),
+  discoveryDate: z.preprocess(emptyToUndefined, z.string().optional()),
+  description: z.preprocess(emptyToUndefined, z.string().optional()),
+  clearImage: z.preprocess((value) => {
+    if (value === "true" || value === true) return true;
+    if (value === "false" || value === false || value === "" || value === undefined) return undefined;
+    return value;
+  }, z.boolean().optional()),
 });
 
 export const get = defineApi({
@@ -20,6 +26,7 @@ export const get = defineApi({
 
 export const put = defineApi({
   auth: "required",
+  multipart: true,
   body: planetBody,
   handler: async (ctx) => {
     const planet = await findPlanet(ctx.db, ctx.params.id);
@@ -30,8 +37,16 @@ export const put = defineApi({
     if (alienId && !(await validateAlien(ctx.db, alienId))) {
       return fail(404, "Alien not found");
     }
-    const image = await validateImage(ctx.db, ctx.body.image, ctx.user!.id);
-    if (image && "error" in image) return image.error;
+
+    const file = ctx.files?.find((f) => f.fieldname === "file") ?? ctx.files?.[0];
+    let imageId = planet.imageId ?? null;
+    if (file?.data.length) {
+      const saved = await savePlanetImage(ctx, file);
+      if (!("id" in saved)) return saved;
+      imageId = saved.id;
+    } else if (ctx.body.clearImage) {
+      imageId = null;
+    }
 
     const [updated] = await ctx.db
       .update(planets)
@@ -40,7 +55,7 @@ export const put = defineApi({
         alienId,
         discoveryDate: ctx.body.discoveryDate ? new Date(ctx.body.discoveryDate) : null,
         description: ctx.body.description ?? null,
-        imageId: image?.id ?? null,
+        imageId,
         updatedAt: new Date(),
       })
       .where(eq(planets.id, planet.id))

package/templates/backend/api/planets.ts

@@ -8,19 +8,18 @@ import {
   loadLookups,
   parseFilter,
   planets,
+  savePlanetImage,
   sortPlanets,
   validateAlien,
-  validateImage,
 } from "./_lib";
 
-const imageRequest = z.object({ id: z.string() }).nullish();
+const emptyToUndefined = (value: unknown) => (value === "" ? undefined : value);
 
 const planetBody = z.object({
   name: z.string().min(1),
-  alienId: z.string().nullish(),
-  discoveryDate: z.string().nullish(),
-  description: z.string().nullish(),
-  image: imageRequest,
+  alienId: z.preprocess(emptyToUndefined, z.string().optional()),
+  discoveryDate: z.preprocess(emptyToUndefined, z.string().optional()),
+  description: z.preprocess(emptyToUndefined, z.string().optional()),
 });
 
 export const get = defineApi({
@@ -42,14 +41,20 @@ export const get = defineApi({
 
 export const post = defineApi({
   auth: "required",
+  multipart: true,
   body: planetBody,
   handler: async (ctx) => {
     const alienId = ctx.body.alienId || null;
     if (alienId && !(await validateAlien(ctx.db, alienId))) {
       return fail(404, "Alien not found");
     }
-    const image = await validateImage(ctx.db, ctx.body.image, ctx.user!.id);
-    if (image && "error" in image) return image.error;
+    const file = ctx.files?.find((f) => f.fieldname === "file") ?? ctx.files?.[0];
+    let imageId: string | null = null;
+    if (file?.data.length) {
+      const saved = await savePlanetImage(ctx, file);
+      if (!("id" in saved)) return saved;
+      imageId = saved.id;
+    }
 
     const [row] = await ctx.db
       .insert(planets)
@@ -60,7 +65,7 @@ export const post = defineApi({
         discoveryDate: ctx.body.discoveryDate ? new Date(ctx.body.discoveryDate) : null,
         name: ctx.body.name,
         description: ctx.body.description ?? null,
-        imageId: image?.id ?? null,
+        imageId,
       })
       .returning();
     return enrichOne(ctx, row!, ctx.user!.id);

package/templates/backend/package.json

@@ -10,7 +10,7 @@
     "@robodev-ai/sdk": "^0.6.0"
   },
   "devDependencies": {
-    "robodev": "^0.21.1",
+    "robodev": "^0.22.0",
     "typescript": "^5.9.2"
   }
 }

package/templates/empty/package.json

@@ -10,7 +10,7 @@
     "@robodev-ai/sdk": "^0.6.0"
   },
   "devDependencies": {
-    "robodev": "^0.21.1",
+    "robodev": "^0.22.0",
     "typescript": "^5.9.2"
   }
 }

package/templates/space/.rulesync/skills/media-feature/SKILL.md

@@ -10,12 +10,12 @@ codexcli:
 
 Preserve the upload contract:
 
-1. Frontend selects a `File`.
-2. Frontend calls `MediaQueries.useUploadRequest` with metadata only (`POST /api/files/upload-request`).
-3. Frontend uploads bytes to the returned URL (`POST /api/files/upload` via Starbase `ctx.storage`).
-4. Feature create/update submits only `image: { id }`.
-5. Feature reads resolve that ID to `image: { id, url }`.
+1. Frontend selects a `File` and keeps it local until submit. Do not call `/api/files/*`.
+2. Feature create/update is one `multipart/form-data` request (`POST` / `PUT`) with text fields and an optional `file`.
+3. The handler validates text fields, optionally calls `savePlanetImage` (`ctx.storage.upload` public), and writes the feature row.
+4. Update may send `clearImage=true` when the user cleared an existing image and picked nothing new. A new `file` wins over `clearImage`.
+5. Feature reads resolve the stored media ID to `image: { id, url }`.
 
-Never send `File`, `Blob`, base64, or raw bytes in a feature create/update request.
+Never use a standalone files API. File bytes stay on the device until submit.
 
 Media metadata lives in the `media` table in `database.ts`. Bytes live in Robodev storage. Planet images use resource name `planet-image`.

package/templates/space/api/_lib.ts

@@ -1,5 +1,5 @@
 import { asc, eq, type InferSelectModel } from "@robodev-ai/sdk";
-import type { ApiHandlerContext } from "@robodev-ai/sdk";
+import type { ApiHandlerContext, UploadedFile } from "@robodev-ai/sdk";
 import { aliens, media, planetLikes, planets } from "../database";
 
 export const PLANET_IMAGE_RESOURCE = "planet-image";
@@ -339,21 +339,46 @@ export async function validateAlien(
   return row ?? null;
 }
 
-export async function validateImage(
-  db: ApiHandlerContext<unknown, unknown>["db"],
-  image: { id: string } | null | undefined,
-  userId: string,
-) {
-  if (!image) return null;
-  const [row] = await db.select().from(media).where(eq(media.id, image.id)).limit(1);
-  if (!row) return { error: fail(404, "Media not found") };
-  if (row.userId !== userId) return { error: fail(403, "You can only use your own media") };
-  if (row.resourceName !== PLANET_IMAGE_RESOURCE) {
-    return { error: fail(400, "Media cannot be used as a planet image") };
+const ALLOWED_PLANET_IMAGE_TYPES = new Set(["image/jpeg", "image/png", "image/webp"]);
+const MAX_PLANET_IMAGE_BYTES = 2 * 1024 * 1024;
+
+export async function savePlanetImage(
+  ctx: ApiHandlerContext<unknown, unknown>,
+  file: UploadedFile,
+): Promise<{ id: string } | ReturnType<typeof fail>> {
+  const mimeType = file.mimetype || "application/octet-stream";
+  if (file.data.length > MAX_PLANET_IMAGE_BYTES) {
+    return fail(400, "File is too large");
+  }
+  if (!ALLOWED_PLANET_IMAGE_TYPES.has(mimeType)) {
+    return fail(400, "Unsupported image type");
   }
-  if (!row.uploaded)
-    return { error: fail(400, "Media must be uploaded before it can be attached") };
-  return { id: row.id };
+
+  const fileName = (file.filename || "image").replaceAll("/", "-");
+  const key = `planet-images/${ctx.user!.id}/${crypto.randomUUID()}-${fileName}`;
+  const [row] = await ctx.db
+    .insert(media)
+    .values({
+      key,
+      userId: ctx.user!.id,
+      resourceName: PLANET_IMAGE_RESOURCE,
+      fileName,
+      fileSize: file.data.length,
+      mimeType,
+    })
+    .returning();
+
+  try {
+    await ctx.storage.upload(row!.key, file.data, {
+      public: true,
+      contentType: mimeType,
+    });
+  } catch (error) {
+    return fail(503, error instanceof Error ? error.message : "Storage is not configured");
+  }
+
+  await ctx.db.update(media).set({ uploaded: new Date() }).where(eq(media.id, row!.id));
+  return { id: row!.id };
 }
 
 export { aliens, media, planetLikes, planets };

package/templates/space/api/planets/[id].ts

@@ -1,12 +1,18 @@
 import { defineApi, eq, z } from "@robodev-ai/sdk";
-import { enrichOne, fail, findPlanet, planets, validateAlien, validateImage } from "../_lib";
+import { enrichOne, fail, findPlanet, planets, savePlanetImage, validateAlien } from "../_lib";
+
+const emptyToUndefined = (value: unknown) => (value === "" ? undefined : value);
 
 const planetBody = z.object({
   name: z.string().min(1),
-  alienId: z.string().nullish(),
-  discoveryDate: z.string().nullish(),
-  description: z.string().nullish(),
-  image: z.object({ id: z.string() }).nullish(),
+  alienId: z.preprocess(emptyToUndefined, z.string().optional()),
+  discoveryDate: z.preprocess(emptyToUndefined, z.string().optional()),
+  description: z.preprocess(emptyToUndefined, z.string().optional()),
+  clearImage: z.preprocess((value) => {
+    if (value === "true" || value === true) return true;
+    if (value === "false" || value === false || value === "" || value === undefined) return undefined;
+    return value;
+  }, z.boolean().optional()),
 });
 
 export const get = defineApi({
@@ -20,6 +26,7 @@ export const get = defineApi({
 
 export const put = defineApi({
   auth: "required",
+  multipart: true,
   body: planetBody,
   handler: async (ctx) => {
     const planet = await findPlanet(ctx.db, ctx.params.id);
@@ -30,8 +37,16 @@ export const put = defineApi({
     if (alienId && !(await validateAlien(ctx.db, alienId))) {
       return fail(404, "Alien not found");
     }
-    const image = await validateImage(ctx.db, ctx.body.image, ctx.user!.id);
-    if (image && "error" in image) return image.error;
+
+    const file = ctx.files?.find((f) => f.fieldname === "file") ?? ctx.files?.[0];
+    let imageId = planet.imageId ?? null;
+    if (file?.data.length) {
+      const saved = await savePlanetImage(ctx, file);
+      if (!("id" in saved)) return saved;
+      imageId = saved.id;
+    } else if (ctx.body.clearImage) {
+      imageId = null;
+    }
 
     const [updated] = await ctx.db
       .update(planets)
@@ -40,7 +55,7 @@ export const put = defineApi({
         alienId,
         discoveryDate: ctx.body.discoveryDate ? new Date(ctx.body.discoveryDate) : null,
         description: ctx.body.description ?? null,
-        imageId: image?.id ?? null,
+        imageId,
         updatedAt: new Date(),
       })
       .where(eq(planets.id, planet.id))

package/templates/space/api/planets.ts

@@ -8,19 +8,18 @@ import {
   loadLookups,
   parseFilter,
   planets,
+  savePlanetImage,
   sortPlanets,
   validateAlien,
-  validateImage,
 } from "./_lib";
 
-const imageRequest = z.object({ id: z.string() }).nullish();
+const emptyToUndefined = (value: unknown) => (value === "" ? undefined : value);
 
 const planetBody = z.object({
   name: z.string().min(1),
-  alienId: z.string().nullish(),
-  discoveryDate: z.string().nullish(),
-  description: z.string().nullish(),
-  image: imageRequest,
+  alienId: z.preprocess(emptyToUndefined, z.string().optional()),
+  discoveryDate: z.preprocess(emptyToUndefined, z.string().optional()),
+  description: z.preprocess(emptyToUndefined, z.string().optional()),
 });
 
 export const get = defineApi({
@@ -42,14 +41,20 @@ export const get = defineApi({
 
 export const post = defineApi({
   auth: "required",
+  multipart: true,
   body: planetBody,
   handler: async (ctx) => {
     const alienId = ctx.body.alienId || null;
     if (alienId && !(await validateAlien(ctx.db, alienId))) {
       return fail(404, "Alien not found");
     }
-    const image = await validateImage(ctx.db, ctx.body.image, ctx.user!.id);
-    if (image && "error" in image) return image.error;
+    const file = ctx.files?.find((f) => f.fieldname === "file") ?? ctx.files?.[0];
+    let imageId: string | null = null;
+    if (file?.data.length) {
+      const saved = await savePlanetImage(ctx, file);
+      if (!("id" in saved)) return saved;
+      imageId = saved.id;
+    }
 
     const [row] = await ctx.db
       .insert(planets)
@@ -60,7 +65,7 @@ export const post = defineApi({
         discoveryDate: ctx.body.discoveryDate ? new Date(ctx.body.discoveryDate) : null,
         name: ctx.body.name,
         description: ctx.body.description ?? null,
-        imageId: image?.id ?? null,
+        imageId,
       })
       .returning();
     return enrichOne(ctx, row!, ctx.user!.id);

package/templates/space/apps/fe/src/assets/locales/en/translation.json

@@ -228,6 +228,7 @@
       "imageEmptyText": "No image",
       "imageUploadText": "Upload",
       "imageBrowseText": "Browse",
+      "imageRemove": "Remove image",
       "submit": "Save",
       "cancel": "Cancel",
       "success": "Planet updated",

package/templates/space/apps/fe/src/assets/locales/sl/translation.json

@@ -228,6 +228,7 @@
       "imageEmptyText": "Brez slike",
       "imageUploadText": "Naloži",
       "imageBrowseText": "Brskaj",
+      "imageRemove": "Odstrani sliko",
       "submit": "Shrani",
       "cancel": "Prekliči",
       "success": "Planet posodobljen",