npm - robodev - Versions diffs - 0.4.0 → 0.6.0 - Mend

robodev 0.4.0 → 0.6.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (12) hide show

package/package.json +6 -3
package/src/collect-files.test.ts +41 -0
package/src/collect-files.ts +164 -0
package/src/emit-starter.ts +183 -0
package/src/generate-templates.ts +31 -0
package/src/index.ts +23 -100
package/templates/auth-chat/README.md +4 -8
package/templates/auth-chat/package.json +5 -4
package/templates/auth-chat/src/main.tsx +12 -23
package/templates/space/README.md +4 -8
package/templates/space/package.json +5 -4
package/templates/space/src/main.tsx +10 -9

package/package.json CHANGED Viewed

@@ -1,7 +1,7 @@
 {
   "name": "robodev",
-  "version": "0.4.0",
-  "description": "CLI for Robodev Starbase — create, auth, link, and deploy file-based APIs",
+  "version": "0.6.0",
+  "description": "CLI for Robodev Starbase — create, auth, link, and deploy hosted apps",
   "type": "module",
   "license": "MIT",
   "repository": {
@@ -21,7 +21,10 @@
     "access": "public"
   },
   "scripts": {
-    "robodev": "tsx src/index.ts"
+    "robodev": "tsx src/index.ts",
+    "generate:templates": "tsx src/generate-templates.ts",
+    "prepack": "tsx src/generate-templates.ts",
+    "test": "tsx --test src/**/*.test.ts"
   },
   "dependencies": {
     "tsx": "^4.20.5"

package/src/collect-files.test.ts ADDED Viewed

@@ -0,0 +1,41 @@
+import assert from "node:assert/strict";
+import { mkdir, writeFile } from "node:fs/promises";
+import { mkdtemp, rm } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { test } from "node:test";
+import { collectFiles } from "./collect-files.js";
+test("collectFiles includes hosted sources and skips denied paths", async () => {
+  const root = await mkdtemp(join(tmpdir(), "rd-cli-"));
+  try {
+    await writeFile(join(root, "database.ts"), "export default {}");
+    await writeFile(join(root, "index.html"), "<html></html>");
+    await mkdir(join(root, "src"), { recursive: true });
+    await writeFile(join(root, "src/main.tsx"), "export {}");
+    await mkdir(join(root, "api"), { recursive: true });
+    await writeFile(join(root, "api/x.ts"), "export {}");
+    await writeFile(join(root, "package.json"), "{}");
+    await mkdir(join(root, "node_modules"), { recursive: true });
+    await writeFile(join(root, "node_modules/x.js"), "nope");
+    await mkdir(join(root, "dist"), { recursive: true });
+    await writeFile(join(root, "dist/x.js"), "nope");
+    await writeFile(join(root, ".env"), "SECRET=1");
+    await mkdir(join(root, ".robodev"), { recursive: true });
+    await writeFile(join(root, ".robodev/x"), "nope");
+    const files = await collectFiles(root);
+    const paths = new Set(files.map((file) => file.path));
+    assert.ok(paths.has("index.html"));
+    assert.ok(paths.has("src/main.tsx"));
+    assert.ok(paths.has("database.ts"));
+    assert.ok(paths.has("api/x.ts"));
+    assert.ok(paths.has("package.json"));
+    assert.ok(!paths.has("node_modules/x.js"));
+    assert.ok(!paths.has("dist/x.js"));
+    assert.ok(!paths.has(".env"));
+    assert.ok(!paths.has(".robodev/x"));
+  } finally {
+    await rm(root, { recursive: true, force: true });
+  }
+});

package/src/collect-files.ts ADDED Viewed

@@ -0,0 +1,164 @@
+import { readdir, readFile, stat } from "node:fs/promises";
+import { join, relative } from "node:path";
+export const MAX_FILE_COUNT = 200;
+export const MAX_FILE_BYTES = 1024 * 1024;
+export const MAX_TREE_BYTES = 15 * 1024 * 1024;
+export const MAX_PATH_LENGTH = 240;
+export const MAX_PATH_DEPTH = 12;
+const SKIP_DIRS = new Set(["node_modules", "dist", ".git", ".robodev"]);
+const BINARY_EXTENSIONS = new Set([
+  ".png",
+  ".jpg",
+  ".jpeg",
+  ".gif",
+  ".webp",
+  ".ico",
+  ".bmp",
+  ".woff",
+  ".woff2",
+  ".ttf",
+  ".eot",
+  ".otf",
+  ".wasm",
+  ".zip",
+  ".gz",
+  ".tgz",
+  ".7z",
+  ".pdf",
+  ".mp4",
+  ".webm",
+  ".mp3",
+]);
+const SRC_EXTENSIONS = new Set([
+  ".ts",
+  ".tsx",
+  ".js",
+  ".jsx",
+  ".mjs",
+  ".cjs",
+  ".css",
+  ".json",
+  ".svg",
+]);
+const PUBLIC_EXTENSIONS = new Set([...SRC_EXTENSIONS, ".html", ".txt", ".md"]);
+const ROOT_STATIC_EXTENSIONS = new Set([".html", ".css", ".js", ".mjs", ".svg", ".txt", ".md"]);
+const CONFIG_FILES = new Set([
+  "package.json",
+  "package-lock.json",
+  "pnpm-lock.yaml",
+  "tsconfig.json",
+  "vite.config.ts",
+  "vite.config.js",
+  "vite.config.mts",
+  "vite.config.mjs",
+  "README.md",
+  ".gitignore",
+]);
+export type CollectedFile = { path: string; content: string };
+function normalize(path: string): string {
+  return path.replaceAll("\\", "/");
+}
+function extname(path: string): string {
+  const base = path.split("/").pop() ?? "";
+  const dot = base.lastIndexOf(".");
+  if (dot <= 0) return "";
+  return base.slice(dot).toLowerCase();
+}
+function basename(path: string): string {
+  return path.split("/").pop() ?? path;
+}
+function isUnsafe(path: string): boolean {
+  return (
+    path.startsWith("/") ||
+    path.includes("..") ||
+    path.split("/").some((segment) => segment === "") ||
+    /^[A-Za-z]:/.test(path)
+  );
+}
+function isDenied(path: string): boolean {
+  const top = path.split("/")[0];
+  if (SKIP_DIRS.has(top)) return true;
+  if (path === ".env" || path.startsWith(".env.")) return true;
+  const name = basename(path);
+  if (name.startsWith(".") && name !== ".gitignore") return true;
+  if (BINARY_EXTENSIONS.has(extname(path))) return true;
+  return false;
+}
+function isAllowed(path: string): boolean {
+  if (path === "database.ts") return true;
+  if (path.startsWith("api/")) return path.endsWith(".ts");
+  if (path === "index.html") return true;
+  if (path.startsWith("src/")) return SRC_EXTENSIONS.has(extname(path));
+  if (path.startsWith("public/")) return PUBLIC_EXTENSIONS.has(extname(path));
+  if (CONFIG_FILES.has(path) || CONFIG_FILES.has(basename(path))) return true;
+  if (/^tsconfig\..+\.json$/.test(basename(path)) && !path.includes("/")) return true;
+  if (!path.includes("/") && ROOT_STATIC_EXTENSIONS.has(extname(path))) return true;
+  return false;
+}
+export function shouldCollectPath(path: string): boolean {
+  const normalized = normalize(path);
+  return !isUnsafe(normalized) && !isDenied(normalized) && isAllowed(normalized);
+}
+export async function collectFiles(root: string): Promise<CollectedFile[]> {
+  try {
+    await stat(join(root, "database.ts"));
+  } catch {
+    throw new Error("database.ts not found in the current directory");
+  }
+  const files: CollectedFile[] = [];
+  let totalBytes = 0;
+  async function walk(dir: string): Promise<void> {
+    let entries;
+    try {
+      entries = await readdir(dir, { withFileTypes: true });
+    } catch {
+      return;
+    }
+    for (const entry of entries) {
+      const abs = join(dir, entry.name);
+      if (entry.isDirectory()) {
+        if (SKIP_DIRS.has(entry.name)) continue;
+        await walk(abs);
+        continue;
+      }
+      if (!entry.isFile()) continue;
+      const path = normalize(relative(root, abs));
+      if (!shouldCollectPath(path)) continue;
+      if (path.length > MAX_PATH_LENGTH || path.split("/").length > MAX_PATH_DEPTH) {
+        throw new Error(`Invalid file path: ${path}`);
+      }
+      const content = await readFile(abs, "utf8");
+      const bytes = Buffer.byteLength(content, "utf8");
+      if (bytes > MAX_FILE_BYTES) {
+        throw new Error(`File must be under 1MB: ${path}`);
+      }
+      totalBytes += bytes;
+      if (totalBytes > MAX_TREE_BYTES) {
+        throw new Error("Deploy tree must be under 15MB");
+      }
+      files.push({ path, content });
+      if (files.length > MAX_FILE_COUNT) {
+        throw new Error(`Deploy may include at most ${MAX_FILE_COUNT} files`);
+      }
+    }
+  }
+  await walk(root);
+  if (!files.some((file) => file.path === "database.ts")) {
+    throw new Error("database.ts not found in the current directory");
+  }
+  return files;
+}

package/src/emit-starter.ts ADDED Viewed

@@ -0,0 +1,183 @@
+import { mkdir, readdir, readFile, stat, writeFile } from "node:fs/promises";
+import { dirname, join } from "node:path";
+import { fileURLToPath } from "node:url";
+export type Starter = { id: string; title: string; description: string };
+export type PackageVersions = {
+  robodev: string;
+  sdk: string;
+  client: string;
+};
+export type EmitContext = {
+  name: string;
+  packageName: string;
+  title: string;
+  versions: PackageVersions;
+};
+const SKIP_DIRS = new Set(["node_modules", ".robodev", ".git"]);
+type DepMap = Record<string, string>;
+type PackageJson = {
+  name?: string;
+  dependencies?: DepMap;
+  devDependencies?: DepMap;
+  optionalDependencies?: DepMap;
+  [key: string]: unknown;
+};
+export function cliRoot(): string {
+  return join(dirname(fileURLToPath(import.meta.url)), "..");
+}
+export async function resolveStarterTree(): Promise<{
+  catalogPath: string;
+  treeRoot: string;
+  catalogLabel: string;
+}> {
+  const workspaceCatalog = join(cliRoot(), "..", "starters", "catalog.json");
+  if (await pathExists(workspaceCatalog)) {
+    return {
+      catalogPath: workspaceCatalog,
+      treeRoot: join(cliRoot(), "..", "starters"),
+      catalogLabel: "starters/catalog.json",
+    };
+  }
+  return {
+    catalogPath: join(cliRoot(), "templates", "catalog.json"),
+    treeRoot: join(cliRoot(), "templates"),
+    catalogLabel: "templates/catalog.json",
+  };
+}
+export async function loadCatalog(): Promise<Starter[]> {
+  const { catalogPath, treeRoot, catalogLabel } = await resolveStarterTree();
+  return loadCatalogFrom(treeRoot, catalogPath, catalogLabel);
+}
+export async function loadCatalogFrom(
+  treeRoot: string,
+  catalogPath: string,
+  catalogLabel: string,
+): Promise<Starter[]> {
+  let raw: { starters?: Starter[] };
+  try {
+    raw = JSON.parse(await readFile(catalogPath, "utf8")) as { starters?: Starter[] };
+  } catch (error) {
+    if ((error as NodeJS.ErrnoException).code === "ENOENT") {
+      throw new Error(`${catalogLabel} is missing`);
+    }
+    throw error;
+  }
+  if (!Array.isArray(raw.starters)) {
+    throw new Error(`${catalogLabel} is missing a starters array`);
+  }
+  const treeLabel = catalogLabel.replace(/\/catalog\.json$/, "");
+  const starters: Starter[] = [];
+  for (const row of raw.starters) {
+    if (!(await isDirectory(join(treeRoot, row.id)))) {
+      throw new Error(`Starter "${row.id}" is missing a ${treeLabel}/${row.id} directory`);
+    }
+    starters.push(row);
+  }
+  return starters;
+}
+export async function loadPackageVersions(): Promise<PackageVersions> {
+  const root = cliRoot();
+  const repo = join(root, "..");
+  const robodev = await readPackageVersion(join(root, "package.json"));
+  return {
+    robodev,
+    sdk: await readPackageVersion(join(repo, "robodev-sdk", "package.json"), robodev),
+    client: await readPackageVersion(join(repo, "robodev-client", "package.json"), robodev),
+  };
+}
+/** Copies a starter tree and applies package + display rewrites used by create and prepack. */
+export async function emitStarter(src: string, dest: string, ctx: EmitContext): Promise<void> {
+  await mkdir(dest, { recursive: true });
+  const entries = await readdir(src, { withFileTypes: true });
+  for (const entry of entries) {
+    if (entry.isDirectory()) {
+      if (SKIP_DIRS.has(entry.name)) continue;
+      await emitStarter(join(src, entry.name), join(dest, entry.name), ctx);
+      continue;
+    }
+    if (!entry.isFile() || entry.name === ".env") continue;
+    const content = await readFile(join(src, entry.name), "utf8");
+    const next =
+      entry.name === "package.json"
+        ? rewritePackageJson(content, ctx)
+        : rewriteDisplay(content, ctx);
+    await writeFile(join(dest, entry.name), next);
+  }
+}
+async function pathExists(path: string): Promise<boolean> {
+  try {
+    await stat(path);
+    return true;
+  } catch (error) {
+    if ((error as NodeJS.ErrnoException).code === "ENOENT") return false;
+    throw error;
+  }
+}
+async function isDirectory(path: string): Promise<boolean> {
+  try {
+    return (await stat(path)).isDirectory();
+  } catch (error) {
+    if ((error as NodeJS.ErrnoException).code === "ENOENT") return false;
+    throw error;
+  }
+}
+async function readPackageVersion(path: string, fallback?: string): Promise<string> {
+  try {
+    const pkg = JSON.parse(await readFile(path, "utf8")) as { version?: string };
+    if (typeof pkg.version === "string" && pkg.version) return pkg.version;
+  } catch (error) {
+    if ((error as NodeJS.ErrnoException).code !== "ENOENT" || fallback === undefined) {
+      throw error;
+    }
+  }
+  if (fallback !== undefined) return fallback;
+  throw new Error(`Missing version in ${path}`);
+}
+function rewritePackageJson(raw: string, ctx: EmitContext): string {
+  const pkg = JSON.parse(raw) as PackageJson;
+  pkg.name = ctx.packageName;
+  const pins: Record<string, string> = {
+    robodev: `^${ctx.versions.robodev}`,
+    "@robodev-ai/sdk": `^${ctx.versions.sdk}`,
+    "@robodev-ai/client": `^${ctx.versions.client}`,
+  };
+  for (const section of ["dependencies", "devDependencies", "optionalDependencies"] as const) {
+    const deps = pkg[section];
+    if (!deps) continue;
+    for (const [name, pin] of Object.entries(pins)) {
+      if (deps[name] === "workspace:*") deps[name] = pin;
+    }
+  }
+  const moved = pkg.dependencies?.robodev;
+  if (pkg.dependencies) delete pkg.dependencies.robodev;
+  pkg.devDependencies = pkg.devDependencies ?? {};
+  pkg.devDependencies.robodev = pkg.devDependencies.robodev ?? moved ?? pins.robodev;
+  return `${JSON.stringify(pkg, null, 2)}\n`;
+}
+function rewriteDisplay(content: string, ctx: EmitContext): string {
+  let next = content.replace(/<title>[^<]*<\/title>/g, `<title>${ctx.name}</title>`);
+  next = next.replace(/^# .+$/m, `# ${ctx.name}`);
+  next = next.replaceAll(`<h1>{"${ctx.title}"}</h1>`, `<h1>{"${ctx.name}"}</h1>`);
+  next = next.replaceAll(`<h1>${ctx.title}</h1>`, `<h1>${ctx.name}</h1>`);
+  return next.replaceAll("{{NAME}}", ctx.name).replaceAll("{{PACKAGE_NAME}}", ctx.packageName);
+}

package/src/generate-templates.ts ADDED Viewed

@@ -0,0 +1,31 @@
+import { copyFile, mkdir, rm } from "node:fs/promises";
+import { join } from "node:path";
+import { emitStarter, loadCatalogFrom, loadPackageVersions, cliRoot } from "./emit-starter.js";
+const startersRoot = join(cliRoot(), "..", "starters");
+const templatesRoot = join(cliRoot(), "templates");
+const catalogLabel = "starters/catalog.json";
+async function main(): Promise<void> {
+  const catalogPath = join(startersRoot, "catalog.json");
+  const starters = await loadCatalogFrom(startersRoot, catalogPath, catalogLabel);
+  const versions = await loadPackageVersions();
+  await rm(templatesRoot, { recursive: true, force: true });
+  await mkdir(templatesRoot, { recursive: true });
+  await copyFile(catalogPath, join(templatesRoot, "catalog.json"));
+  for (const starter of starters) {
+    await emitStarter(join(startersRoot, starter.id), join(templatesRoot, starter.id), {
+      name: "{{NAME}}",
+      packageName: "{{PACKAGE_NAME}}",
+      title: starter.title,
+      versions,
+    });
+  }
+}
+main().catch((error) => {
+  console.error(error instanceof Error ? error.message : error);
+  process.exit(1);
+});

package/src/index.ts CHANGED Viewed

@@ -1,12 +1,11 @@
 import { createServer } from "node:http";
 import { randomBytes } from "node:crypto";
-import { mkdir, readdir, readFile, stat, writeFile } from "node:fs/promises";
+import { mkdir, stat } from "node:fs/promises";
 import { createInterface } from "node:readline/promises";
 import { stdin, stdout } from "node:process";
-import { basename, dirname, join, relative, resolve } from "node:path";
+import { basename, join, relative, resolve } from "node:path";
 import { execFile, spawn } from "node:child_process";
 import { promisify } from "node:util";
-import { fileURLToPath } from "node:url";
 import { ApiError, authed, publicRequest } from "./api.js";
 import {
   clearCredentials,
@@ -18,6 +17,14 @@ import {
   writeViteApiUrl,
 } from "./config.js";
 import { waitUntilLive } from "./wait-until-live.js";
+import { collectFiles } from "./collect-files.js";
+import {
+  emitStarter,
+  loadCatalog,
+  loadPackageVersions,
+  resolveStarterTree,
+  type Starter,
+} from "./emit-starter.js";
 const execFileAsync = promisify(execFile);
@@ -33,7 +40,7 @@ Commands:
   projects             List your projects
   create [path] [--starter <id>]  Create a project, scaffold a starter, and deploy
   link [projectId]     Write .robodev in the current folder
-  deploy [--force]     Deploy database.ts and api/*.ts
+  deploy [--force]     Deploy the project file tree (schema, APIs, and frontend)
 `);
   process.exit(1);
 }
@@ -186,44 +193,7 @@ async function runLink(projectId?: string): Promise<void> {
   console.log(`Frontend API ${project.apiUrl}`);
 }
-/** Collects `database.ts` plus every TypeScript file under `api/` for a deploy upload. */
-async function collectFiles(root: string): Promise<{ path: string; content: string }[]> {
-  const files: { path: string; content: string }[] = [];
-  const database = join(root, "database.ts");
-  try {
-    await stat(database);
-    files.push({ path: "database.ts", content: await readFile(database, "utf8") });
-  } catch {
-    throw new Error("database.ts not found in the current directory");
-  }
-  async function walk(dir: string): Promise<void> {
-    let entries;
-    try {
-      entries = await readdir(dir, { withFileTypes: true });
-    } catch {
-      return;
-    }
-    for (const entry of entries) {
-      const abs = join(dir, entry.name);
-      if (entry.isDirectory()) {
-        await walk(abs);
-        continue;
-      }
-      if (entry.isFile() && entry.name.endsWith(".ts")) {
-        files.push({
-          path: relative(root, abs).replaceAll("\\", "/"),
-          content: await readFile(abs, "utf8"),
-        });
-      }
-    }
-  }
-  await walk(join(root, "api"));
-  return files;
-}
-/** Uploads schema + APIs. Destructive schema changes need confirmation or `--force`. */
+/** Uploads schema, APIs, and frontend. Destructive schema changes need confirmation or `--force`. */
 async function runDeploy(forceFlag: boolean, root = process.cwd()): Promise<void> {
   const link = await readLink(root);
   if (!link) {
@@ -239,6 +209,7 @@ async function runDeploy(forceFlag: boolean, root = process.cwd()): Promise<void
         databaseName: string;
         databaseCreated?: boolean;
         apiUrl: string;
+        appUrl?: string;
         docsUrl: string;
         routes: { method: string; path: string }[];
         plan: { operations: { type: string; table: string; column?: string; sql: string }[] };
@@ -247,7 +218,7 @@ async function runDeploy(forceFlag: boolean, root = process.cwd()): Promise<void
         body: JSON.stringify({ force, files }),
       });
       await waitUntilLive(result.apiUrl);
-      console.log(`Deployed to ${result.apiUrl}`);
+      console.log(`App      ${result.appUrl ?? result.apiUrl}`);
       console.log(`Docs     ${result.docsUrl}`);
       console.log(
         result.databaseCreated
@@ -296,51 +267,18 @@ async function runDeploy(forceFlag: boolean, root = process.cwd()): Promise<void
         force = true;
         continue;
       }
+      if (error instanceof ApiError && error.status === 413) {
+        throw new Error(error.message);
+      }
       throw error;
     }
   }
 }
-type Starter = { id: string; title: string; description: string };
-function cliRoot(): string {
-  return join(dirname(fileURLToPath(import.meta.url)), "..");
-}
-function templateRoot(id: string): string {
-  return join(cliRoot(), "templates", id);
-}
 function validIdsMessage(starters: Starter[]): string {
   return `Valid ids: ${starters.map((starter) => starter.id).join(", ")}`;
 }
-async function isDirectory(path: string): Promise<boolean> {
-  try {
-    return (await stat(path)).isDirectory();
-  } catch (error) {
-    if ((error as NodeJS.ErrnoException).code === "ENOENT") return false;
-    throw error;
-  }
-}
-async function loadCatalog(): Promise<Starter[]> {
-  const raw = JSON.parse(await readFile(join(cliRoot(), "templates", "catalog.json"), "utf8")) as {
-    starters?: Starter[];
-  };
-  if (!Array.isArray(raw.starters)) {
-    throw new Error("templates/catalog.json is missing a starters array");
-  }
-  const starters: Starter[] = [];
-  for (const row of raw.starters) {
-    if (!(await isDirectory(templateRoot(row.id)))) {
-      throw new Error(`Starter "${row.id}" is missing a templates/${row.id} directory`);
-    }
-    starters.push(row);
-  }
-  return starters;
-}
 function parseCreateArgs(args: string[]): { path?: string; starterId?: string } {
   let path: string | undefined;
   let starterId: string | undefined;
@@ -436,24 +374,6 @@ async function assertCreatable(root: string): Promise<void> {
   }
 }
-async function copyTemplate(from: string, to: string, vars: Record<string, string>): Promise<void> {
-  await mkdir(to, { recursive: true });
-  const entries = await readdir(from, { withFileTypes: true });
-  for (const entry of entries) {
-    const src = join(from, entry.name);
-    const dest = join(to, entry.name);
-    if (entry.isDirectory()) {
-      await copyTemplate(src, dest, vars);
-      continue;
-    }
-    let content = await readFile(src, "utf8");
-    for (const [key, value] of Object.entries(vars)) {
-      content = content.replaceAll(`{{${key}}}`, value);
-    }
-    await writeFile(dest, content);
-  }
-}
 async function npmInstall(root: string): Promise<void> {
   console.log("Installing npm packages…");
   await new Promise<void>((resolve, reject) => {
@@ -482,9 +402,12 @@ async function runCreate(args: string[]): Promise<void> {
     body: JSON.stringify({ name }),
   });
-  await copyTemplate(templateRoot(starter.id), root, {
-    NAME: name,
-    PACKAGE_NAME: packageNameFromPath(root),
+  const { treeRoot } = await resolveStarterTree();
+  await emitStarter(join(treeRoot, starter.id), root, {
+    name,
+    packageName: packageNameFromPath(root),
+    title: starter.title,
+    versions: await loadPackageVersions(),
   });
   await writeLink(
     {

package/templates/auth-chat/README.md CHANGED Viewed

@@ -2,20 +2,16 @@
 Starter app from `robodev create --starter auth-chat`: email + Google sign-in and a shared chat room (`chat` database, `messages` table).
-The backend is already on Starbase. Run the frontend:
+The project host is the app. After create or deploy, open the printed App URL — no `npm run dev` required. Local Vite is optional:
 ```bash
 npm run dev
 ```
-It reads `VITE_API_URL` from `.env` (written by `robodev create` / `robodev link`).
+Local Vite reads `VITE_API_URL` from `.env` (written by `robodev create` / `robodev link`). Hosted builds use the same origin as the APIs.
 Docs: https://robodev.povio.dev/docs/starter
-`GET /me` and `GET/POST /messages` (`api/me.ts`, `api/messages.ts`) require a Robodev Auth Bearer token. `GET /health` stays public. Email auth works without Google. If Google is not configured on Starbase, the button shows a 503 message.
+`GET /me` and `GET/POST /messages` (`api/me.ts`, `api/messages.ts`) require a Robodev Auth Bearer token. `GET /health` stays public. Email auth works without Google. If Google is not configured on Starbase, the button shows a 503 message. Google OAuth may not complete inside the dashboard preview iframe — use Open app.
-Add tables in `database.ts` and routes as `api/<name>.ts`, then:
-```bash
-npx robodev deploy
-```
+Edit files in the dashboard Code page, or here, then Save / `npx robodev deploy`.

package/templates/auth-chat/package.json CHANGED Viewed

@@ -1,5 +1,6 @@
 {
   "name": "{{PACKAGE_NAME}}",
+  "version": "0.1.0",
   "private": true,
   "type": "module",
   "scripts": {
@@ -10,15 +11,15 @@
   "dependencies": {
     "react": "^18.3.1",
     "react-dom": "^18.3.1",
-    "@robodev-ai/sdk": "^0.3.0",
-    "@robodev-ai/client": "^0.1.0"
+    "@robodev-ai/sdk": "^0.5.0",
+    "@robodev-ai/client": "^0.2.0"
   },
   "devDependencies": {
     "@types/react": "^18.3.24",
     "@types/react-dom": "^18.3.7",
     "@vitejs/plugin-react": "^4.7.0",
-    "robodev": "^0.3.0",
     "typescript": "^5.9.2",
-    "vite": "^6.3.5"
+    "vite": "^6.3.5",
+    "robodev": "^0.6.0"
   }
 }

package/templates/auth-chat/src/main.tsx CHANGED Viewed

@@ -11,8 +11,15 @@ type Message = {
   createdAt: string | null;
 };
-const apiUrl = import.meta.env.VITE_API_URL as string | undefined;
-const api = apiUrl ? createClient({ url: apiUrl }) : null;
+function projectApiUrl(): string {
+  const fromEnv = import.meta.env.VITE_API_URL;
+  if (typeof fromEnv === "string" && fromEnv.trim()) return fromEnv.replace(/\/+$/, "");
+  if (typeof window !== "undefined") return window.location.origin;
+  return "";
+}
+const apiUrl = projectApiUrl();
+const api = createClient({ url: apiUrl });
 function authorLabel(user: { name?: string | null; email: string }) {
   return user.name?.trim() || user.email;
@@ -33,17 +40,12 @@ function App() {
   const listRef = useRef<HTMLDivElement>(null);
   async function refreshMessages() {
-    if (!api) return;
     const res = await api.fetch("/messages");
     if (!res.ok) throw new Error(await res.text());
     setMessages((await res.json()) as Message[]);
   }
   useEffect(() => {
-    if (!api) {
-      setReady(true);
-      return;
-    }
     api.consumeTokenFromUrl();
     void api.auth
       .getUser()
@@ -53,7 +55,7 @@ function App() {
   }, []);
   useEffect(() => {
-    if (!user || !api) return;
+    if (!user) return;
     let cancelled = false;
     const load = () =>
       refreshMessages().catch((err: unknown) => {
@@ -72,7 +74,6 @@ function App() {
   }, [messages]);
   useEffect(() => {
-    if (!apiUrl) return;
     void fetch(`${apiUrl}/messages`).then((res) => {
       setUnauthStatus(
         `${res.status} ${res.status === 401 ? "unauthorized (expected)" : res.statusText}`,
@@ -82,7 +83,6 @@ function App() {
   async function onEmailAuth(event: FormEvent) {
     event.preventDefault();
-    if (!api) return;
     setPending(true);
     setError(null);
     try {
@@ -100,7 +100,6 @@ function App() {
   }
   async function onGoogle() {
-    if (!api) return;
     setPending(true);
     setError(null);
     try {
@@ -122,7 +121,6 @@ function App() {
   }
   async function onSignOut() {
-    if (!api) return;
     await api.auth.signOut();
     setUser(null);
     setMessages([]);
@@ -130,7 +128,7 @@ function App() {
   async function onSend(event: FormEvent) {
     event.preventDefault();
-    if (!api || !draft.trim()) return;
+    if (!draft.trim()) return;
     setPending(true);
     setError(null);
     try {
@@ -156,20 +154,11 @@ function App() {
     );
   }
-  if (!api) {
-    return (
-      <main>
-        <h1>Auth chat</h1>
-        <p className="error">Missing VITE_API_URL. Run `robodev create` or `robodev link`.</p>
-      </main>
-    );
-  }
   if (!user) {
     return (
       <main className="narrow">
         <p className="eyebrow">Robodev Auth</p>
-        <h1>Auth chat</h1>
+        <h1>{{NAME}}</h1>
         <p className="lede">
           Sign in with email or Google. Protected APIs live at {apiUrl}. Unauthenticated GET
           /messages: {unauthStatus ?? "checking…"}.

package/templates/space/README.md CHANGED Viewed

@@ -1,21 +1,17 @@
 # {{NAME}}
-Starter app from `robodev create`: a `space` database (`planets`, `rockets`), file-based APIs in `api/`, and a small React UI.
+Starter app from `robodev create`: a `space` database (`planets`, `rockets`), file-based APIs in `api/`, and a React UI.
-The backend is already on Starbase. Run the frontend:
+The project host is the app. After create or deploy, open the printed App URL — no `npm run dev` required. Local Vite is optional:
 ```bash
 npm run dev
 ```
-It reads `VITE_API_URL` from `.env` (written by `robodev create` / `robodev link`).
+Local Vite reads `VITE_API_URL` from `.env` (written by `robodev create` / `robodev link`). Hosted builds use the same origin as the APIs.
 Docs: https://robodev.povio.dev/docs
 `GET /me` (`api/me.ts`) requires a Robodev Auth Bearer token. Planet and rocket routes stay public. Optional browser helper: `@robodev-ai/client`. Auth how-to: https://robodev.povio.dev/docs/auth
-Add tables in `database.ts` and routes as `api/<name>.ts`, then:
-```bash
-npx robodev deploy
-```
+Edit files in the dashboard Code page, or here, then Save / `npx robodev deploy`.

package/templates/space/package.json CHANGED Viewed

@@ -1,5 +1,6 @@
 {
   "name": "{{PACKAGE_NAME}}",
+  "version": "0.1.0",
   "private": true,
   "type": "module",
   "scripts": {
@@ -10,15 +11,15 @@
   "dependencies": {
     "react": "^18.3.1",
     "react-dom": "^18.3.1",
-    "@robodev-ai/sdk": "^0.3.0",
-    "@robodev-ai/client": "^0.1.0"
+    "@robodev-ai/sdk": "^0.5.0",
+    "@robodev-ai/client": "^0.2.0"
   },
   "devDependencies": {
     "@types/react": "^18.3.24",
     "@types/react-dom": "^18.3.7",
     "@vitejs/plugin-react": "^4.7.0",
-    "robodev": "^0.3.0",
     "typescript": "^5.9.2",
-    "vite": "^6.3.5"
+    "vite": "^6.3.5",
+    "robodev": "^0.6.0"
   }
 }

package/templates/space/src/main.tsx CHANGED Viewed

@@ -1,17 +1,20 @@
-/** Starter UI. Calls the deployed project host using `VITE_API_URL` from `.env`. */
+/** Starter UI. Hosted builds use the project origin; local Vite uses `VITE_API_URL`. */
 import { StrictMode, useEffect, useState, type FormEvent } from "react";
 import { createRoot } from "react-dom/client";
 type Planet = { id: string; name: string; climate: string; moons: number };
 type Rocket = { id: string; name: string; destinationId: string; launched: boolean };
-const apiUrl = import.meta.env.VITE_API_URL as string | undefined;
+function projectApiUrl(): string {
+  const fromEnv = import.meta.env.VITE_API_URL;
+  if (typeof fromEnv === "string" && fromEnv.trim()) return fromEnv.replace(/\/+$/, "");
+  if (typeof window !== "undefined") return window.location.origin;
+  return "";
+}
 async function request<T>(path: string, init?: RequestInit): Promise<T> {
-  if (!apiUrl) {
-    throw new Error("Missing VITE_API_URL. Run `robodev create` or `robodev link`.");
-  }
-  const res = await fetch(`${apiUrl}${path}`, {
+  const base = projectApiUrl();
+  const res = await fetch(`${base}${path}`, {
     ...init,
     headers: { "Content-Type": "application/json", ...init?.headers },
   });
@@ -110,9 +113,7 @@ function App() {
   return (
     <main>
       <h1>{"{{NAME}}"}</h1>
-      <p className="lede">
-        React frontend talking to your Starbase APIs at {apiUrl ?? "(not linked)"}.
-      </p>
+      <p className="lede">React frontend talking to your Starbase APIs at {projectApiUrl()}.</p>
       {error ? <p className="error">{error}</p> : null}
       <div className="grid">