robodev 0.26.0 → 0.27.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "robodev",
-  "version": "0.26.0",
+  "version": "0.27.0",
   "description": "CLI for Robodev Starbase — create, auth, link, and deploy hosted apps",
   "type": "module",
   "license": "MIT",

package/src/collect-files.test.ts

@@ -19,6 +19,9 @@ test("collectFiles includes hosted sources and skips denied paths", async () =>
     await writeFile(join(root, "api/invoices/[id].ts"), "export {}");
     await mkdir(join(root, "jobs"), { recursive: true });
     await writeFile(join(root, "jobs/x.ts"), "export {}");
+    await mkdir(join(root, "hooks"), { recursive: true });
+    await writeFile(join(root, "hooks/auth.ts"), "export {}");
+    await writeFile(join(root, "hooks/lib.ts"), "export {}");
     await writeFile(join(root, "package.json"), "{}");
     await mkdir(join(root, "node_modules"), { recursive: true });
     await writeFile(join(root, "node_modules/x.js"), "nope");
@@ -36,6 +39,8 @@ test("collectFiles includes hosted sources and skips denied paths", async () =>
     assert.ok(paths.has("api/x.ts"));
     assert.ok(paths.has("api/invoices/[id].ts"));
     assert.ok(paths.has("jobs/x.ts"));
+    assert.ok(paths.has("hooks/auth.ts"));
+    assert.ok(paths.has("hooks/lib.ts"));
     assert.ok(paths.has("package.json"));
     assert.ok(!paths.has("node_modules/x.js"));
     assert.ok(!paths.has("dist/x.js"));

package/src/collect-files.ts

@@ -100,6 +100,7 @@ function isAllowed(path: string): boolean {
   if (path === "database.ts") return true;
   if (path.startsWith("api/")) return path.endsWith(".ts");
   if (path.startsWith("jobs/")) return path.endsWith(".ts");
+  if (path.startsWith("hooks/")) return path.endsWith(".ts");
   if (path === "index.html") return true;
   if (path.startsWith("src/")) return SRC_EXTENSIONS.has(extname(path));
   if (path.startsWith("public/")) return PUBLIC_EXTENSIONS.has(extname(path));

package/src/emit-starter.test.ts

@@ -71,6 +71,7 @@ test("collectFiles for auth-chat starter is Tiny APIs without apps/fe", async ()
   assert.ok(paths.has("api/invite.ts"));
   assert.ok(paths.has("api/health.ts"));
   assert.ok(paths.has("api/me.ts"));
+  assert.ok(paths.has("hooks/auth.ts"));
   assert.ok(!paths.has("index.html"));
   assert.ok(!paths.has("src/main.tsx"));
   assert.ok([...paths].every((path) => !path.startsWith("apps/")));

package/templates/auth-chat/.rulesync/rules/project-overview.md

@@ -11,13 +11,13 @@ cursor:
 
 # Space starter AI rules
 
-This project is a Vite React frontend in `apps/fe` plus a Robodev backend at the **repository root** (`database.ts` + `api/**/*.ts` using `@robodev-ai/sdk`). There is no Expo / mobile app in this starter. End-user auth is reserved on the project host at `/api/user/*`. There is no in-browser fake backend.
+This project is a Vite React frontend in `apps/fe` plus a Robodev backend at the **repository root** (`database.ts` + `api/**/*.ts` + `hooks/auth.ts` using `@robodev-ai/sdk`). There is no Expo / mobile app in this starter. End-user auth is reserved on the project host at `/api/user/*`. There is no in-browser fake backend.
 
 `robodev deploy` from this root uploads schema and APIs. It does not host the Povio SPA. Run the UI with bun in `apps/fe`.
 
 Shared AI rules and skills are authored in `.rulesync/`. Generated files for Codex, Claude Code, and Cursor are local outputs and should be regenerated with `bun rules:gen`.
 
-The demo is a shared chat room plus an authenticated invite-email form. Signed-in users read and post on `GET/POST /api/messages`. Invites go through `POST /api/invite` (`auth: "required"`); posting a chat message does not send email. Do not add `api/user/**`.
+The demo is a shared chat room plus an authenticated invite-email form. Signed-in users read and post on `GET/POST /api/messages`. Invites go through `POST /api/invite` (`auth: "required"`), which persists an `invites` row then sends email. `hooks/auth.ts` claims matching pending invites on `user.created`. Posting a chat message does not send email. Do not add `api/user/**`. Do not add a User table — store `userId` as text matching `ctx.user.id`.
 
 When an app has multiple user roles with distinct UI or business workflows, use the conditional role-based app structure rule. Do not apply role splitting to simple single-role apps or small permission differences.
 

package/templates/auth-chat/.rulesync/rules/robodev-auth.md

@@ -10,6 +10,7 @@ cursor:
     [
       "database.ts",
       "api/**/*.ts",
+      "hooks/**/*.ts",
       "apps/fe/src/components/features/auth/**/*.{ts,tsx}",
       "apps/fe/src/clients/**/*.ts",
     ]

package/templates/auth-chat/api/invite.ts

@@ -1,4 +1,5 @@
-/** POST /api/invite — signed-in users send a chat invite email. */
+/** POST /api/invite — signed-in users persist an invite, then send email. */
+import { invites } from "../database";
 import { defineApi, z } from "@robodev-ai/sdk";
 
 function headerValue(
@@ -28,16 +29,25 @@ export const post = defineApi({
   auth: "required",
   body: z.object({ to: z.string().email() }),
   response: z.object({ id: z.string(), status: z.literal("sent") }),
-  handler: async ({ email, body, user, env, headers }) => {
+  handler: async ({ db, email, body, user, env, headers }) => {
+    const inviteEmail = body.to.toLowerCase();
+    const [row] = await db
+      .insert(invites)
+      .values({
+        email: inviteEmail,
+        invitedByUserId: user!.id,
+      })
+      .returning();
     const url = resolveProjectUrl(env, headers);
     const who = user?.name?.trim() || user?.email || "Someone";
     const project = url ? ` Project URL: ${url}` : "";
-    return email.send({
-      to: body.to,
+    const sent = await email.send({
+      to: inviteEmail,
       subject: "You're invited to the chat",
       text:
         `${who} invited you to a shared chat on Robodev. ` +
         `Open the App URL and sign in to join.${project}`,
     });
+    return { id: row?.id ?? sent.id, status: "sent" as const };
   },
 });

package/templates/auth-chat/database.ts

@@ -1,6 +1,7 @@
 /**
  * Shared chat room. `robodev_auth.users` is platform-owned — store only a
- * snapshot of the author on each message.
+ * snapshot of the author on each message. Invite `userId` columns are text
+ * matching Auth `ctx.user.id`.
  */
 import { defineDatabase, pgTable, text, timestamp, uuid } from "@robodev-ai/sdk";
 
@@ -13,7 +14,16 @@ export const messages = pgTable("messages", {
   createdAt: timestamp("createdAt", { withTimezone: true }).defaultNow(),
 });
 
+export const invites = pgTable("invites", {
+  id: uuid("id").primaryKey().defaultRandom(),
+  email: text("email").notNull(),
+  invitedByUserId: text("invitedByUserId").notNull(),
+  createdAt: timestamp("createdAt", { withTimezone: true }).defaultNow(),
+  claimedAt: timestamp("claimedAt", { withTimezone: true }),
+  claimedByUserId: text("claimedByUserId"),
+});
+
 export default defineDatabase({
   name: "chat",
-  tables: { messages },
+  tables: { messages, invites },
 });

package/templates/auth-chat/hooks/auth.ts

@@ -0,0 +1,17 @@
+import { and, defineAuthHook, eq, isNull } from "@robodev-ai/sdk";
+import { invites } from "../database";
+
+export default defineAuthHook({
+  onUserCreated: async ({ db, event }) => {
+    const email = event.user?.email.toLowerCase();
+    const userId = event.user?.id;
+    if (!email || !userId) return;
+    await db
+      .update(invites)
+      .set({
+        claimedAt: new Date(),
+        claimedByUserId: userId,
+      })
+      .where(and(eq(invites.email, email), isNull(invites.claimedAt)));
+  },
+});

package/templates/auth-chat/package.json

@@ -8,10 +8,10 @@
     "rules:gen": "rulesync generate"
   },
   "dependencies": {
-    "@robodev-ai/sdk": "^0.6.0"
+    "@robodev-ai/sdk": "^0.7.0"
   },
   "devDependencies": {
-    "robodev": "^0.26.0",
+    "robodev": "^0.27.0",
     "rulesync": "^8.18.0",
     "typescript": "^5.9.2"
   }

package/templates/backend/package.json

@@ -7,10 +7,10 @@
     "deploy": "robodev deploy"
   },
   "dependencies": {
-    "@robodev-ai/sdk": "^0.6.0"
+    "@robodev-ai/sdk": "^0.7.0"
   },
   "devDependencies": {
-    "robodev": "^0.26.0",
+    "robodev": "^0.27.0",
     "typescript": "^5.9.2"
   }
 }

package/templates/empty/package.json

@@ -7,10 +7,10 @@
     "deploy": "robodev deploy"
   },
   "dependencies": {
-    "@robodev-ai/sdk": "^0.6.0"
+    "@robodev-ai/sdk": "^0.7.0"
   },
   "devDependencies": {
-    "robodev": "^0.26.0",
+    "robodev": "^0.27.0",
     "typescript": "^5.9.2"
   }
 }

package/templates/marketplace/package.json

@@ -8,10 +8,10 @@
     "rules:gen": "rulesync generate"
   },
   "dependencies": {
-    "@robodev-ai/sdk": "^0.6.0"
+    "@robodev-ai/sdk": "^0.7.0"
   },
   "devDependencies": {
-    "robodev": "^0.26.0",
+    "robodev": "^0.27.0",
     "rulesync": "^8.18.0",
     "typescript": "^5.9.2"
   }

package/templates/space/package.json

@@ -8,10 +8,10 @@
     "rules:gen": "rulesync generate"
   },
   "dependencies": {
-    "@robodev-ai/sdk": "^0.6.0"
+    "@robodev-ai/sdk": "^0.7.0"
   },
   "devDependencies": {
-    "robodev": "^0.26.0",
+    "robodev": "^0.27.0",
     "rulesync": "^8.18.0",
     "typescript": "^5.9.2"
   }