robodev 0.27.0 → 0.28.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "robodev",
-  "version": "0.27.0",
+  "version": "0.28.0",
   "description": "CLI for Robodev Starbase — create, auth, link, and deploy hosted apps",
   "type": "module",
   "license": "MIT",

package/src/collect-files.test.ts

@@ -7,6 +7,54 @@ import { test } from "node:test";
 import { collectFiles, mergeCollectedFiles } from "./collect-files.js";
 
 test("collectFiles includes hosted sources and skips denied paths", async () => {
+  const root = await mkdtemp(join(tmpdir(), "rd-cli-"));
+  try {
+    await mkdir(join(root, "robodev/api/invoices"), { recursive: true });
+    await mkdir(join(root, "robodev/jobs"), { recursive: true });
+    await mkdir(join(root, "robodev/hooks"), { recursive: true });
+    await writeFile(join(root, "robodev/database.ts"), "export default {}");
+    await writeFile(join(root, "robodev/package.json"), '{"private":true,"dependencies":{}}');
+    await writeFile(join(root, "robodev/.robodev"), "nope");
+    await writeFile(join(root, "index.html"), "<html></html>");
+    await mkdir(join(root, "src"), { recursive: true });
+    await writeFile(join(root, "src/main.tsx"), "export {}");
+    await writeFile(join(root, "robodev/api/x.ts"), "export {}");
+    await writeFile(join(root, "robodev/api/invoices/[id].ts"), "export {}");
+    await writeFile(join(root, "robodev/jobs/x.ts"), "export {}");
+    await writeFile(join(root, "robodev/hooks/auth.ts"), "export {}");
+    await writeFile(join(root, "robodev/hooks/lib.ts"), "export {}");
+    await writeFile(join(root, "package.json"), "{}");
+    await mkdir(join(root, "node_modules"), { recursive: true });
+    await writeFile(join(root, "node_modules/x.js"), "nope");
+    await mkdir(join(root, "dist"), { recursive: true });
+    await writeFile(join(root, "dist/x.js"), "nope");
+    await writeFile(join(root, ".env"), "SECRET=1");
+    await mkdir(join(root, ".robodev"), { recursive: true });
+    await writeFile(join(root, ".robodev/x"), "nope");
+
+    const files = await collectFiles(root);
+    const paths = new Set(files.map((file) => file.path));
+    assert.ok(paths.has("index.html"));
+    assert.ok(paths.has("src/main.tsx"));
+    assert.ok(paths.has("robodev/database.ts"));
+    assert.ok(paths.has("robodev/package.json"));
+    assert.ok(paths.has("robodev/api/x.ts"));
+    assert.ok(paths.has("robodev/api/invoices/[id].ts"));
+    assert.ok(paths.has("robodev/jobs/x.ts"));
+    assert.ok(paths.has("robodev/hooks/auth.ts"));
+    assert.ok(paths.has("robodev/hooks/lib.ts"));
+    assert.ok(paths.has("package.json"));
+    assert.ok(!paths.has("node_modules/x.js"));
+    assert.ok(!paths.has("dist/x.js"));
+    assert.ok(!paths.has(".env"));
+    assert.ok(!paths.has(".robodev/x"));
+    assert.ok(!paths.has("robodev/.robodev"));
+  } finally {
+    await rm(root, { recursive: true, force: true });
+  }
+});
+
+test("collectFiles still accepts a legacy root database.ts tree", async () => {
   const root = await mkdtemp(join(tmpdir(), "rd-cli-"));
   try {
     await writeFile(join(root, "database.ts"), "export default {}");
@@ -78,3 +126,17 @@ test("collectFiles skips nested apps/fe sources", async () => {
     await rm(root, { recursive: true, force: true });
   }
 });
+
+test("collectFiles rejects mixed backend layouts", async () => {
+  const root = await mkdtemp(join(tmpdir(), "rd-cli-mix-"));
+  try {
+    await mkdir(join(root, "robodev"), { recursive: true });
+    await mkdir(join(root, "api"), { recursive: true });
+    await writeFile(join(root, "robodev/database.ts"), "export default {}");
+    await writeFile(join(root, "database.ts"), "export default {}");
+    await writeFile(join(root, "api/x.ts"), "export {}");
+    await assert.rejects(() => collectFiles(root), /mix robodev/);
+  } finally {
+    await rm(root, { recursive: true, force: true });
+  }
+});

package/src/collect-files.ts

@@ -85,22 +85,41 @@ function isUnsafe(path: string): boolean {
   );
 }
 
+function isRobodevLockfile(path: string): boolean {
+  return (
+    path === "robodev/package-lock.json" ||
+    path === "robodev/pnpm-lock.yaml" ||
+    path === "robodev/yarn.lock" ||
+    path === "robodev/npm-shrinkwrap.json"
+  );
+}
+
 function isDenied(path: string): boolean {
   const top = path.split("/")[0];
   if (SKIP_DIRS.has(top)) return true;
   if (path === "apps" || path.startsWith("apps/")) return true;
   if (path === ".env" || path.startsWith(".env.")) return true;
+  if (isRobodevLockfile(path)) return true;
   const name = basename(path);
   if (name.startsWith(".") && name !== ".gitignore") return true;
   if (BINARY_EXTENSIONS.has(extname(path))) return true;
   return false;
 }
 
+function isBackendPath(path: string): boolean {
+  const inner = path.startsWith("robodev/") ? path.slice("robodev/".length) : path;
+  if (inner === "database.ts" && (path === "database.ts" || path === "robodev/database.ts")) {
+    return true;
+  }
+  if (inner.startsWith("api/") || inner.startsWith("jobs/") || inner.startsWith("hooks/")) {
+    return inner.endsWith(".ts");
+  }
+  return path === "robodev/package.json";
+}
+
 function isAllowed(path: string): boolean {
-  if (path === "database.ts") return true;
-  if (path.startsWith("api/")) return path.endsWith(".ts");
-  if (path.startsWith("jobs/")) return path.endsWith(".ts");
-  if (path.startsWith("hooks/")) return path.endsWith(".ts");
+  if (isBackendPath(path)) return true;
+  if (path.startsWith("robodev/")) return false;
   if (path === "index.html") return true;
   if (path.startsWith("src/")) return SRC_EXTENSIONS.has(extname(path));
   if (path.startsWith("public/")) return PUBLIC_EXTENSIONS.has(extname(path));
@@ -110,6 +129,23 @@ function isAllowed(path: string): boolean {
   return false;
 }
 
+export function mixedBackendLayoutError(paths: Iterable<string>): string | null {
+  const list = [...paths].map(normalize);
+  const hasNewDb = list.includes("robodev/database.ts");
+  const hasLegacyDb = list.includes("database.ts");
+  const hasLegacyApiJobs = list.some((path) => path.startsWith("api/") || path.startsWith("jobs/"));
+  const hasNewApiJobs = list.some(
+    (path) => path.startsWith("robodev/api/") || path.startsWith("robodev/jobs/"),
+  );
+  if (hasNewDb && (hasLegacyDb || hasLegacyApiJobs)) {
+    return "Do not mix robodev/ backend files with root database.ts, api/, or jobs/";
+  }
+  if (hasLegacyDb && (hasNewDb || hasNewApiJobs)) {
+    return "Do not mix robodev/ backend files with root database.ts, api/, or jobs/";
+  }
+  return null;
+}
+
 export function shouldCollectPath(path: string): boolean {
   const normalized = normalize(path);
   return !isUnsafe(normalized) && !isDenied(normalized) && isAllowed(normalized);
@@ -176,10 +212,10 @@ export function mergeCollectedFiles(
 }
 
 export async function collectFiles(root: string): Promise<CollectedFile[]> {
-  try {
-    await stat(join(root, "database.ts"));
-  } catch {
-    throw new Error("database.ts not found in the current directory");
+  const hasNew = await fileExists(join(root, "robodev/database.ts"));
+  const hasLegacy = await fileExists(join(root, "database.ts"));
+  if (!hasNew && !hasLegacy) {
+    throw new Error("database.ts not found (looked in robodev/database.ts and ./database.ts)");
   }
 
   const files: CollectedFile[] = [];
@@ -223,8 +259,20 @@ export async function collectFiles(root: string): Promise<CollectedFile[]> {
   }
 
   await walk(root);
-  if (!files.some((file) => file.path === "database.ts")) {
-    throw new Error("database.ts not found in the current directory");
+  const mixed = mixedBackendLayoutError(files.map((file) => file.path));
+  if (mixed) {
+    throw new Error(mixed);
+  }
+  if (!files.some((file) => file.path === "robodev/database.ts" || file.path === "database.ts")) {
+    throw new Error("database.ts not found (looked in robodev/database.ts and ./database.ts)");
   }
   return files;
 }
+
+async function fileExists(path: string): Promise<boolean> {
+  try {
+    return (await stat(path)).isFile();
+  } catch {
+    return false;
+  }
+}

package/src/config.test.ts

@@ -121,7 +121,7 @@ test("writeLink merges frontend and unknown keys", async () => {
       },
       root,
     );
-    const raw = JSON.parse(await readFile(join(root, ".robodev"), "utf8")) as {
+    const raw = JSON.parse(await readFile(join(root, "robodev/.robodev"), "utf8")) as {
       projectId: string;
       apiUrl: string;
       projectApiUrl: string;
@@ -148,7 +148,7 @@ test("writeLink preserves frontend false opt-out", async () => {
       `${JSON.stringify({ projectId: "prj-1", apiUrl: "https://a.example", frontend: false }, null, 2)}\n`,
     );
     await writeLink({ projectId: "prj-1", apiUrl: "https://b.example" }, root);
-    const raw = JSON.parse(await readFile(join(root, ".robodev"), "utf8")) as {
+    const raw = JSON.parse(await readFile(join(root, "robodev/.robodev"), "utf8")) as {
       frontend: unknown;
     };
     assert.equal(raw.frontend, false);
@@ -158,3 +158,23 @@ test("writeLink preserves frontend false opt-out", async () => {
     await rm(root, { recursive: true, force: true });
   }
 });
+
+test("readLink prefers robodev/.robodev over a legacy root file", async () => {
+  const root = await mkdtemp(join(tmpdir(), "rd-link-pref-"));
+  try {
+    await writeFile(
+      join(root, ".robodev"),
+      `${JSON.stringify({ projectId: "legacy", apiUrl: "https://legacy.example" }, null, 2)}\n`,
+    );
+    await mkdir(join(root, "robodev"), { recursive: true });
+    await writeFile(
+      join(root, "robodev/.robodev"),
+      `${JSON.stringify({ projectId: "canonical", apiUrl: "https://canonical.example" }, null, 2)}\n`,
+    );
+    const link = await readLink(root);
+    assert.equal(link?.projectId, "canonical");
+    assert.equal(link?.apiUrl, "https://canonical.example");
+  } finally {
+    await rm(root, { recursive: true, force: true });
+  }
+});

package/src/config.ts

@@ -44,11 +44,39 @@ export function credentialsPath(): string {
   return join(homedir(), ".robodev", "credentials.json");
 }
 
-/** Project link file written by `create` / `link`. */
-export function linkPath(cwd = process.cwd()): string {
+/** Canonical project link file written by `create` / `link`. */
+export function canonicalLinkPath(cwd = process.cwd()): string {
+  return join(cwd, "robodev", ".robodev");
+}
+
+/** Legacy project link file at the project root. */
+export function legacyLinkPath(cwd = process.cwd()): string {
   return join(cwd, ".robodev");
 }
 
+/** Project link file written by `create` / `link`. Always the canonical path. */
+export function linkPath(cwd = process.cwd()): string {
+  return canonicalLinkPath(cwd);
+}
+
+async function readJsonFile(path: string): Promise<Record<string, unknown> | null> {
+  try {
+    const parsed = JSON.parse(await readFile(path, "utf8")) as unknown;
+    if (parsed && typeof parsed === "object" && !Array.isArray(parsed)) {
+      return parsed as Record<string, unknown>;
+    }
+    return null;
+  } catch {
+    return null;
+  }
+}
+
+export async function readLinkJson(cwd = process.cwd()): Promise<Record<string, unknown> | null> {
+  const canonical = await readJsonFile(canonicalLinkPath(cwd));
+  if (canonical) return canonical;
+  return readJsonFile(legacyLinkPath(cwd));
+}
+
 export function defaultFrontendConfig(): FrontendConfig {
   return { root: "apps/fe", script: "build", outDir: "dist" };
 }
@@ -98,18 +126,6 @@ export async function clearCredentials(): Promise<void> {
   await rm(credentialsPath(), { force: true });
 }
 
-export async function readLinkJson(cwd = process.cwd()): Promise<Record<string, unknown> | null> {
-  try {
-    const parsed = JSON.parse(await readFile(linkPath(cwd), "utf8")) as unknown;
-    if (parsed && typeof parsed === "object" && !Array.isArray(parsed)) {
-      return parsed as Record<string, unknown>;
-    }
-    return null;
-  } catch {
-    return null;
-  }
-}
-
 export async function readLink(cwd = process.cwd()): Promise<ProjectLink | null> {
   const raw = await readLinkJson(cwd);
   if (!raw || typeof raw.projectId !== "string" || typeof raw.apiUrl !== "string") {
@@ -141,7 +157,9 @@ export async function writeLink(link: ProjectLink, cwd = process.cwd()): Promise
   if ("frontend" in link) {
     next.frontend = link.frontend;
   }
-  await writeFile(linkPath(cwd), `${JSON.stringify(next, null, 2)}\n`);
+  const dest = canonicalLinkPath(cwd);
+  await mkdir(dirname(dest), { recursive: true });
+  await writeFile(dest, `${JSON.stringify(next, null, 2)}\n`);
 }
 
 const PROJECT_API_ENV_KEYS = ["VITE_API_URL", "VITE_PUBLIC_API_URL", "APP_PUBLIC_API_URL"] as const;

package/src/emit-starter.test.ts

@@ -66,12 +66,12 @@ test("emitStarter auth-chat FE build runs openapi:gen before vite", async () =>
 test("collectFiles for auth-chat starter is Tiny APIs without apps/fe", async () => {
   const files = await collectFiles(join(cliRoot(), "..", "starters", "auth-chat"));
   const paths = new Set(files.map((file) => file.path));
-  assert.ok(paths.has("database.ts"));
-  assert.ok(paths.has("api/messages.ts"));
-  assert.ok(paths.has("api/invite.ts"));
-  assert.ok(paths.has("api/health.ts"));
-  assert.ok(paths.has("api/me.ts"));
-  assert.ok(paths.has("hooks/auth.ts"));
+  assert.ok(paths.has("robodev/database.ts"));
+  assert.ok(paths.has("robodev/api/messages.ts"));
+  assert.ok(paths.has("robodev/api/invite.ts"));
+  assert.ok(paths.has("robodev/api/health.ts"));
+  assert.ok(paths.has("robodev/api/me.ts"));
+  assert.ok(paths.has("robodev/hooks/auth.ts"));
   assert.ok(!paths.has("index.html"));
   assert.ok(!paths.has("src/main.tsx"));
   assert.ok([...paths].every((path) => !path.startsWith("apps/")));
@@ -102,12 +102,12 @@ test("emitStarter marketplace FE build runs openapi:gen before vite", async () =
 test("collectFiles for marketplace starter is Tiny APIs without apps/fe", async () => {
   const files = await collectFiles(join(cliRoot(), "..", "starters", "marketplace"));
   const paths = new Set(files.map((file) => file.path));
-  assert.ok(paths.has("database.ts"));
-  assert.ok(paths.has("api/listings.ts"));
-  assert.ok(paths.has("api/cart.ts"));
-  assert.ok(paths.has("api/checkout.ts"));
-  assert.ok(paths.has("api/health.ts"));
-  assert.ok(paths.has("api/me.ts"));
+  assert.ok(paths.has("robodev/database.ts"));
+  assert.ok(paths.has("robodev/api/listings.ts"));
+  assert.ok(paths.has("robodev/api/cart.ts"));
+  assert.ok(paths.has("robodev/api/checkout.ts"));
+  assert.ok(paths.has("robodev/api/health.ts"));
+  assert.ok(paths.has("robodev/api/me.ts"));
   assert.ok(!paths.has("index.html"));
   assert.ok(!paths.has("src/main.tsx"));
   assert.ok([...paths].every((path) => !path.startsWith("apps/")));
@@ -117,12 +117,12 @@ test("collectFiles for marketplace starter is Tiny APIs without apps/fe", async
 test("collectFiles for space starter is Tiny APIs without apps/fe", async () => {
   const files = await collectFiles(join(cliRoot(), "..", "starters", "space"));
   const paths = new Set(files.map((file) => file.path));
-  assert.ok(paths.has("database.ts"));
-  assert.ok(paths.has("api/planets.ts"));
-  assert.ok(paths.has("api/planets/paginate.ts"));
-  assert.ok(paths.has("api/aliens/labels.ts"));
-  assert.ok(!paths.has("api/files/upload-request.ts"));
-  assert.ok(!paths.has("api/files/upload.ts"));
+  assert.ok(paths.has("robodev/database.ts"));
+  assert.ok(paths.has("robodev/api/planets.ts"));
+  assert.ok(paths.has("robodev/api/planets/paginate.ts"));
+  assert.ok(paths.has("robodev/api/aliens/labels.ts"));
+  assert.ok(!paths.has("robodev/api/files/upload-request.ts"));
+  assert.ok(!paths.has("robodev/api/files/upload.ts"));
   assert.ok(!paths.has("index.html"));
   assert.ok(!paths.has("src/main.tsx"));
   assert.ok([...paths].every((path) => !path.startsWith("apps/")));

package/src/index.ts

@@ -1,6 +1,6 @@
 import { createServer } from "node:http";
 import { randomBytes } from "node:crypto";
-import { mkdir, stat } from "node:fs/promises";
+import { mkdir, readFile, stat } from "node:fs/promises";
 import { createInterface } from "node:readline/promises";
 import { stdin, stdout } from "node:process";
 import { basename, join, relative, resolve } from "node:path";
@@ -47,7 +47,7 @@ Commands:
   whoami               Show the signed-in user
   projects             List your projects
   create [path] [--starter <id>] [--empty] [--org <id>]  Create a project, scaffold a starter, and deploy
-  link [projectId]     Write .robodev in the current folder
+  link [projectId]     Write robodev/.robodev in the current folder
   deploy [--force]     Deploy schema, APIs, jobs, and frontend (local Vite build when .robodev frontend is set)
 `);
   process.exit(1);
@@ -238,7 +238,7 @@ async function runDeploy(
   const root = options.root ?? process.cwd();
   const link = await readLink(root);
   if (!link) {
-    throw new Error("No .robodev file. Run `robodev link` or `robodev create` first.");
+    throw new Error("No robodev/.robodev file. Run `robodev link` or `robodev create` first.");
   }
   const files = await collectDeployFiles(root, link, options);
   let force = forceFlag;
@@ -414,7 +414,13 @@ function packageNameFromPath(root: string): string {
 }
 
 async function assertCreatable(root: string): Promise<void> {
-  for (const file of ["package.json", "database.ts", ".robodev"]) {
+  for (const file of [
+    "package.json",
+    "database.ts",
+    ".robodev",
+    "robodev/database.ts",
+    "robodev/.robodev",
+  ]) {
     try {
       await stat(join(root, file));
     } catch (error) {
@@ -425,6 +431,27 @@ async function assertCreatable(root: string): Promise<void> {
   }
 }
 
+async function npmInstallRobodevDeps(root: string): Promise<void> {
+  const pkgPath = join(root, "robodev", "package.json");
+  let raw: string;
+  try {
+    raw = await readFile(pkgPath, "utf8");
+  } catch {
+    return;
+  }
+  let pkg: { dependencies?: Record<string, string> };
+  try {
+    pkg = JSON.parse(raw) as { dependencies?: Record<string, string> };
+  } catch {
+    return;
+  }
+  const deps = pkg.dependencies ?? {};
+  const extra = Object.keys(deps).filter((name) => name !== "@robodev-ai/sdk");
+  if (extra.length === 0) return;
+  console.log("Installing robodev/ npm packages…");
+  await npmInstall(join(root, "robodev"));
+}
+
 async function npmInstall(root: string): Promise<void> {
   console.log("Installing npm packages…");
   await new Promise<void>((resolve, reject) => {
@@ -520,6 +547,7 @@ async function runCreate(args: string[]): Promise<void> {
 
   try {
     await npmInstall(root);
+    await npmInstallRobodevDeps(root);
   } catch (error) {
     console.log(error instanceof Error ? error.message : error);
     if (starter.kind === "backend") {

package/templates/auth-chat/.rulesync/rules/frontend-api-boundary.md

@@ -23,7 +23,7 @@ For generated mutations, pass invalidation through the mutation options instead
 
 After mutations, derive follow-up UI state from canonical API response or query state instead of leaving action controls unchanged. Disable duplicate submissions when the API state already represents a pending or completed action, and surface mutation errors through the default generated-client error handler or a feature-specific message.
 
-Do not import `@robodev-ai/sdk`, `database.ts`, Drizzle tables, or API helper modules into frontend features.
+Do not import `@robodev-ai/sdk`, `robodev/database.ts`, Drizzle tables, or API helper modules into frontend features.
 
 `apps/fe/src/openapi` is generated by `@povio/openapi-codegen-cli` from root `openapi.json` (or a live project `/openapi.json` when `OPENAPI_LIVE=true`). Do not hand-edit generated OpenAPI client files.
 

package/templates/auth-chat/.rulesync/rules/frontend-notifications.md

@@ -11,7 +11,7 @@ cursor:
 
 # Frontend Notifications
 
-Use generated `@/openapi` queries, mutations, and models for notification history, preferences, and push-token registration. Do not import `@robodev-ai/sdk` or `database.ts` into frontend feature code.
+Use generated `@/openapi` queries, mutations, and models for notification history, preferences, and push-token registration. Do not import `@robodev-ai/sdk` or `robodev/database.ts` into frontend feature code.
 
 Request push permission only after an explanatory UI and explicit user gesture. Never request it automatically during initial application load. Handle unsupported, default, denied, granted, registered, expired, and failed-registration states.
 

package/templates/auth-chat/.rulesync/rules/project-overview.md

@@ -11,19 +11,19 @@ cursor:
 
 # Space starter AI rules
 
-This project is a Vite React frontend in `apps/fe` plus a Robodev backend at the **repository root** (`database.ts` + `api/**/*.ts` + `hooks/auth.ts` using `@robodev-ai/sdk`). There is no Expo / mobile app in this starter. End-user auth is reserved on the project host at `/api/user/*`. There is no in-browser fake backend.
+This project is a Vite React frontend in `apps/fe` plus a Robodev backend under **`robodev/`** (`robodev/database.ts` + `robodev/api/**/*.ts` + `robodev/hooks/auth.ts` using `@robodev-ai/sdk`). There is no Expo / mobile app in this starter. End-user auth is reserved on the project host at `/api/user/*`. There is no in-browser fake backend.
 
 `robodev deploy` from this root uploads schema and APIs. It does not host the Povio SPA. Run the UI with bun in `apps/fe`.
 
 Shared AI rules and skills are authored in `.rulesync/`. Generated files for Codex, Claude Code, and Cursor are local outputs and should be regenerated with `bun rules:gen`.
 
-The demo is a shared chat room plus an authenticated invite-email form. Signed-in users read and post on `GET/POST /api/messages`. Invites go through `POST /api/invite` (`auth: "required"`), which persists an `invites` row then sends email. `hooks/auth.ts` claims matching pending invites on `user.created`. Posting a chat message does not send email. Do not add `api/user/**`. Do not add a User table — store `userId` as text matching `ctx.user.id`.
+The demo is a shared chat room plus an authenticated invite-email form. Signed-in users read and post on `GET/POST /api/messages`. Invites go through `POST /api/invite` (`auth: "required"`), which persists an `invites` row then sends email. `hooks/auth.ts` claims matching pending invites on `user.created`. Posting a chat message does not send email. Do not add `robodev/api/user/**`. Do not add a User table — store `userId` as text matching `ctx.user.id`.
 
 When an app has multiple user roles with distinct UI or business workflows, use the conditional role-based app structure rule. Do not apply role splitting to simple single-role apps or small permission differences.
 
 Use the more specific generated rules for:
 
-- Robodev `defineDatabase` tables in `database.ts`.
+- Robodev `defineDatabase` tables in `robodev/database.ts`.
 - Robodev `defineApi` routes in `api/`.
 - Reserved `/api/user/*` auth contracts (do not implement `api/user/**` in the project).
 - Frontend API boundaries around generated `@/openapi` queries and models.

package/templates/auth-chat/.rulesync/rules/robodev-api.md

@@ -2,24 +2,24 @@
 root: false
 targets: ["claudecode", "codexcli", "cursor"]
 description: "Robodev defineApi file routes and handler conventions."
-globs: ["api/**/*.ts"]
+globs: ["robodev/api/**/*.ts"]
 cursor:
   alwaysApply: false
   description: "Apply when editing Starbase API routes."
-  globs: ["api/**/*.ts"]
+  globs: ["robodev/api/**/*.ts"]
 ---
 
 # Robodev API
 
-Project APIs live in `api/`. `api/planets.ts` is served at `/planets` and `/api/planets`. Prefer the `/api/...` path in OpenAPI and frontend clients.
+Project APIs live in `robodev/api/`. `robodev/api/planets.ts` is served at `/planets` and `/api/planets`. Prefer the `/api/...` path in OpenAPI and frontend clients.
 
 ## File layout
 
-- `api/foo.ts` → `/api/foo`
-- `api/foo/[id].ts` → `/api/foo/:id`
+- `robodev/api/foo.ts` → `/api/foo`
+- `robodev/api/foo/[id].ts` → `/api/foo/:id`
 - Export `get` / `post` / `put` / `patch` / `delete` as `defineApi(...)`.
-- Shared helpers belong in `api/_lib.ts`. Do not export `defineApi` from `_lib.ts`.
-- Do not add `api/user/**`. Those paths are reserved for Robodev Auth.
+- Shared helpers belong in `robodev/api/_lib.ts`. Do not export `defineApi` from `_lib.ts`.
+- Do not add `robodev/api/user/**`. Those paths are reserved for Robodev Auth.
 
 ## Handlers
 

package/templates/auth-chat/.rulesync/rules/robodev-auth.md

@@ -8,8 +8,8 @@ cursor:
   description: "Apply when touching auth, login, register, or /api/user clients."
   globs:
     [
-      "database.ts",
-      "api/**/*.ts",
+      "robodev/database.ts",
+      "robodev/api/**/*.ts",
       "hooks/**/*.ts",
       "apps/fe/src/components/features/auth/**/*.{ts,tsx}",
       "apps/fe/src/clients/**/*.ts",

package/templates/auth-chat/.rulesync/rules/robodev-database.md

@@ -2,21 +2,21 @@
 root: false
 targets: ["claudecode", "codexcli", "cursor"]
 description: "Robodev database.ts Drizzle schema and deploy sync."
-globs: ["database.ts"]
+globs: ["robodev/database.ts"]
 cursor:
   alwaysApply: false
   description: "Apply when editing the Starbase database schema."
-  globs: ["database.ts"]
+  globs: ["robodev/database.ts"]
 ---
 
 # Robodev Database
 
-The backend schema lives in `database.ts` at the project root. Default-export `defineDatabase` with Drizzle `pgTable` definitions. `robodev deploy` from this root creates or syncs the named Postgres database. There are no migration files.
+The backend schema lives in `robodev/database.ts`. Default-export `defineDatabase` with Drizzle `pgTable` definitions. `robodev deploy` from this root creates or syncs the named Postgres database. There are no migration files.
 
 ## Rules
 
 - Import table helpers from `@robodev-ai/sdk` (`pgTable`, `uuid`, `text`, `timestamp`, `integer`, and query helpers).
 - Do not recreate User or auth tables. End users live in platform `robodev_auth`. Store `userId` as `text` matching `ctx.user.id`.
 - Prefer scalar columns and foreign keys. Destructive drops need deploy confirmation or `--force`.
-- Export named tables so API files can import them from `../database` or `api/_lib.ts`.
-- Seed demo rows in API handlers on first read (see `api/_lib.ts` `ensureSeed`), not with a separate seed runner.
+- Export named tables so API files can import them from `../database` or `robodev/api/_lib.ts`.
+- Seed demo rows in API handlers on first read (see `robodev/api/_lib.ts` `ensureSeed`), not with a separate seed runner.

package/templates/auth-chat/.rulesync/rules/role-based-app-structure.md

@@ -2,11 +2,11 @@
 root: false
 targets: ["claudecode", "codexcli", "cursor"]
 description: "Conditional role-based frontend and API structure for apps with distinct user roles."
-globs: ["apps/fe/src/**/*.{ts,tsx}", "api/**/*.ts"]
+globs: ["apps/fe/src/**/*.{ts,tsx}", "robodev/api/**/*.ts"]
 cursor:
   alwaysApply: false
   description: "Apply only when an app has multiple user roles with distinct UI surfaces or business workflows."
-  globs: ["apps/fe/src/**/*.{ts,tsx}", "api/**/*.ts"]
+  globs: ["apps/fe/src/**/*.{ts,tsx}", "robodev/api/**/*.ts"]
 ---
 
 # Role-Based App Structure

package/templates/auth-chat/.rulesync/skills/media-feature/SKILL.md

@@ -18,4 +18,4 @@ Preserve the upload contract:
 
 Never use a standalone files API. File bytes stay on the device until submit.
 
-Media metadata lives in the `media` table in `database.ts`. Bytes live in Robodev storage. Planet images use resource name `planet-image`.
+Media metadata lives in the `media` table in `robodev/database.ts`. Bytes live in Robodev storage. Planet images use resource name `planet-image`.

package/templates/auth-chat/.rulesync/skills/robodev-api-route/SKILL.md

@@ -1,13 +1,13 @@
 ---
 name: robodev-api-route
-description: Add a defineApi route under api/.
+description: Add a defineApi route under robodev/api/.
 ---
 
 # Add a Robodev API route
 
-1. Create `api/<path>.ts` or `api/<path>/[id].ts`.
+1. Create `robodev/api/<path>.ts` or `robodev/api/<path>/[id].ts`.
 2. Export HTTP methods with `defineApi` from `@robodev-ai/sdk`.
 3. Use `auth: "required"` unless the route is public.
 4. Keep JSON shapes aligned with `openapi.json`.
-5. Do not create `api/user/**` files.
+5. Do not create `robodev/api/user/**` files.
 6. Deploy from the project root (`robodev deploy`), then `bun openapi:gen` in `apps/fe` if the contract changed.

package/templates/auth-chat/.rulesync/skills/robodev-table/SKILL.md

@@ -1,11 +1,11 @@
 ---
 name: robodev-table
-description: Add a Drizzle table to database.ts and wire it into defineApi handlers.
+description: Add a Drizzle table to robodev/database.ts and wire it into defineApi handlers.
 ---
 
 # Add a Robodev table
 
-1. Add a `pgTable` to `database.ts` and include it in `defineDatabase({ tables })`.
+1. Add a `pgTable` to `robodev/database.ts` and include it in `defineDatabase({ tables })`.
 2. Do not add a User table. Auth users are platform-managed; store `userId` as text.
 3. Import the table in `api/_lib.ts` or the route file that needs it.
 4. Deploy from the project root with `robodev deploy`. Destructive drops need confirmation or `--force`.

package/templates/auth-chat/README.md

@@ -29,7 +29,7 @@ npx robodev deploy
 
 Dashboard create deploys schema + APIs only. The Tiny FE tree is copied by `robodev create`; a later CLI deploy hosts the SPA.
 
-`GET /api/me`, `GET/POST /api/messages`, and `POST /api/invite` require a Robodev Auth Bearer token. `GET /api/health` stays public. Invites send one email; posting a chat message does not. Auth stays reserved at `/api/user/*`. Do not add `api/user/**`.
+`GET /api/me`, `GET/POST /api/messages`, and `POST /api/invite` require a Robodev Auth Bearer token. `GET /api/health` stays public. Invites send one email; posting a chat message does not. Auth stays reserved at `/api/user/*`. Do not add `robodev/api/user/**`.
 
 Regenerate AI rules after editing `.rulesync/`:
 

package/templates/auth-chat/apps/fe/package.json

@@ -8,10 +8,10 @@
     "dev": "bunx --bun vite",
     "build": "bun run openapi:gen && bunx --bun vite build",
     "clean": "rimraf dist src/openapi",
-    "lint": "oxlint --type-aware . ../../api ../../database.ts --fix",
-    "lint:check": "oxlint --type-aware . ../../api ../../database.ts --quiet",
-    "format": "oxfmt -c \"../../oxfmt.config.js\" . ../../api ../../database.ts",
-    "format:check": "oxfmt -c \"../../oxfmt.config.js\" --check . ../../api ../../database.ts",
+    "lint": "oxlint --type-aware . ../../robodev/api ../../robodev/database.ts --fix",
+    "lint:check": "oxlint --type-aware . ../../robodev/api ../../robodev/database.ts --quiet",
+    "format": "oxfmt -c \"../../oxfmt.config.js\" . ../../robodev/api ../../robodev/database.ts",
+    "format:check": "oxfmt -c \"../../oxfmt.config.js\" --check . ../../robodev/api ../../robodev/database.ts",
     "ts:check": "tsc -b --noEmit",
     "test": "vitest run",
     "check": "bun ts:check && bun lint:check && bun format:check",