robodev 0.47.0 → 0.47.2

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "robodev",
-  "version": "0.47.0",
+  "version": "0.47.2",
   "description": "CLI for Robodev Starbase — create, auth, link, deploy, load, and run a project locally with robodev dev",
   "type": "module",
   "license": "MIT",
@@ -26,8 +26,8 @@
     "embedded-postgres": "17.10.0-beta.17",
     "fastify": "^5.12.1",
     "tsx": "^4.20.5",
-    "@robodev-ai/sdk": "0.13.0",
-    "@robodev-ai/runtime": "0.7.1"
+    "@robodev-ai/runtime": "0.7.1",
+    "@robodev-ai/sdk": "0.13.0"
   },
   "devDependencies": {
     "@types/node": "^24.3.0",

package/src/config.test.ts

@@ -3,7 +3,13 @@ import { mkdir, mkdtemp, readFile, rm, writeFile } from "node:fs/promises";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
 import { test } from "node:test";
-import { defaultFrontendConfig, readLink, writeLink, writeViteApiUrl } from "./config.js";
+import {
+  defaultFrontendConfig,
+  readLink,
+  resolveDeployKey,
+  writeLink,
+  writeViteApiUrl,
+} from "./config.js";
 
 test("writeViteApiUrl sets Vite and Povio public API URLs", async () => {
   const root = await mkdtemp(join(tmpdir(), "rd-env-"));
@@ -159,6 +165,98 @@ test("writeLink preserves frontend false opt-out", async () => {
   }
 });
 
+test("writeLink keeps an existing deployToken when rewriting other fields", async () => {
+  const root = await mkdtemp(join(tmpdir(), "rd-link-token-"));
+  try {
+    await mkdir(join(root, "robodev"), { recursive: true });
+    await writeFile(
+      join(root, "robodev/.robodev"),
+      `${JSON.stringify(
+        {
+          projectId: "prj-1",
+          apiUrl: "https://a.example",
+          projectApiUrl: "https://prj-1.example",
+          deployToken: "rdb_keep",
+        },
+        null,
+        2,
+      )}\n`,
+    );
+    await writeLink({ projectId: "prj-1", apiUrl: "https://b.example" }, root);
+    const raw = JSON.parse(await readFile(join(root, "robodev/.robodev"), "utf8")) as {
+      deployToken?: string;
+      apiUrl: string;
+    };
+    assert.equal(raw.deployToken, "rdb_keep");
+    assert.equal(raw.apiUrl, "https://b.example");
+    const link = await readLink(root);
+    assert.equal(link && "deployToken" in link, false);
+  } finally {
+    await rm(root, { recursive: true, force: true });
+  }
+});
+
+test("resolveDeployKey prefers ROBODEV_DEPLOY_KEY over a file token", async () => {
+  const root = await mkdtemp(join(tmpdir(), "rd-key-env-"));
+  const previous = process.env.ROBODEV_DEPLOY_KEY;
+  try {
+    await mkdir(join(root, "robodev"), { recursive: true });
+    await writeFile(
+      join(root, "robodev/.robodev"),
+      `${JSON.stringify({ projectId: "prj-1", apiUrl: "https://a.example", deployToken: "rdb_file" }, null, 2)}\n`,
+    );
+    process.env.ROBODEV_DEPLOY_KEY = "  rdb_env  ";
+    assert.equal(await resolveDeployKey(root), "rdb_env");
+  } finally {
+    if (previous === undefined) delete process.env.ROBODEV_DEPLOY_KEY;
+    else process.env.ROBODEV_DEPLOY_KEY = previous;
+    await rm(root, { recursive: true, force: true });
+  }
+});
+
+test("resolveDeployKey reads deployToken from robodev/.robodev then legacy .robodev", async () => {
+  const root = await mkdtemp(join(tmpdir(), "rd-key-file-"));
+  const previous = process.env.ROBODEV_DEPLOY_KEY;
+  try {
+    delete process.env.ROBODEV_DEPLOY_KEY;
+    await writeFile(
+      join(root, ".robodev"),
+      `${JSON.stringify({ projectId: "legacy", apiUrl: "https://legacy.example", deployToken: "rdb_legacy" }, null, 2)}\n`,
+    );
+    assert.equal(await resolveDeployKey(root), "rdb_legacy");
+    await mkdir(join(root, "robodev"), { recursive: true });
+    await writeFile(
+      join(root, "robodev/.robodev"),
+      `${JSON.stringify({ projectId: "canonical", apiUrl: "https://canonical.example", deployToken: "rdb_canonical" }, null, 2)}\n`,
+    );
+    assert.equal(await resolveDeployKey(root), "rdb_canonical");
+  } finally {
+    if (previous === undefined) delete process.env.ROBODEV_DEPLOY_KEY;
+    else process.env.ROBODEV_DEPLOY_KEY = previous;
+    await rm(root, { recursive: true, force: true });
+  }
+});
+
+test("resolveDeployKey ignores blank env and file tokens", async () => {
+  const root = await mkdtemp(join(tmpdir(), "rd-key-blank-"));
+  const previous = process.env.ROBODEV_DEPLOY_KEY;
+  try {
+    process.env.ROBODEV_DEPLOY_KEY = "   ";
+    await mkdir(join(root, "robodev"), { recursive: true });
+    await writeFile(
+      join(root, "robodev/.robodev"),
+      `${JSON.stringify({ projectId: "prj-1", apiUrl: "https://a.example", deployToken: "  " }, null, 2)}\n`,
+    );
+    assert.equal(await resolveDeployKey(root), null);
+    delete process.env.ROBODEV_DEPLOY_KEY;
+    assert.equal(await resolveDeployKey(root), null);
+  } finally {
+    if (previous === undefined) delete process.env.ROBODEV_DEPLOY_KEY;
+    else process.env.ROBODEV_DEPLOY_KEY = previous;
+    await rm(root, { recursive: true, force: true });
+  }
+});
+
 test("readLink prefers robodev/.robodev over a legacy root file", async () => {
   const root = await mkdtemp(join(tmpdir(), "rd-link-pref-"));
   try {

package/src/config.ts

@@ -145,6 +145,23 @@ export async function readLink(cwd = process.cwd()): Promise<ProjectLink | null>
   return link;
 }
 
+function trimNonEmpty(value: unknown): string | null {
+  if (typeof value !== "string") return null;
+  const trimmed = value.trim();
+  return trimmed.length > 0 ? trimmed : null;
+}
+
+/**
+ * Headless deploy credential. `ROBODEV_DEPLOY_KEY` wins over `deployToken` in the link file.
+ * Does not read or write `~/.robodev/credentials.json`. Never persist the env value.
+ */
+export async function resolveDeployKey(cwd = process.cwd()): Promise<string | null> {
+  const fromEnv = trimNonEmpty(process.env.ROBODEV_DEPLOY_KEY);
+  if (fromEnv) return fromEnv;
+  const raw = await readLinkJson(cwd);
+  return trimNonEmpty(raw?.deployToken);
+}
+
 export async function writeLink(link: ProjectLink, cwd = process.cwd()): Promise<void> {
   const existing = (await readLinkJson(cwd)) ?? {};
   const next: Record<string, unknown> = {

package/src/emit-starter.test.ts

@@ -149,6 +149,7 @@ test("collectFiles for empty starter includes hosted Welcome source", async () =
   assert.ok(paths.has("robodev/api/health.ts"));
   assert.ok(paths.has("index.html"));
   assert.ok(paths.has("src/main.tsx"));
+  assert.ok(paths.has("ROBODEV.md"));
   assert.ok(!paths.has("robodev/api/planets.ts"));
   assert.ok([...paths].every((path) => !path.startsWith("apps/")));
   assert.ok(files.length < 200);
@@ -178,6 +179,8 @@ test("emitStarter shadcn includes hosted Welcome plus orval and shadcn files", a
     const notes = await readFile(join(dest, "ROBODEV.md"), "utf8");
     assert.match(notes, /react-router-dom/);
     assert.match(notes, /src\/pages\/Home\.tsx/);
+    assert.match(notes, /robodev-email templates list/);
+    assert.match(notes, /Do not write `robodev\/emails\/\*\.html`/);
     const endpoints = await readFile(join(dest, "src/api/generated/endpoints.ts"), "utf8");
     assert.match(endpoints, /export const getHealth/);
     assert.doesNotMatch(endpoints, /axios|@tanstack\/react-query/);
@@ -230,6 +233,7 @@ test("collectFiles for space starter is Tiny APIs without apps/fe", async () =>
   assert.ok(paths.has("robodev/api/planets.ts"));
   assert.ok(paths.has("robodev/api/planets/paginate.ts"));
   assert.ok(paths.has("robodev/api/aliens/labels.ts"));
+  assert.ok(paths.has("ROBODEV.md"));
   assert.ok(!paths.has("robodev/api/files/upload-request.ts"));
   assert.ok(!paths.has("robodev/api/files/upload.ts"));
   assert.ok(!paths.has("index.html"));

package/src/index.ts

@@ -6,7 +6,7 @@ import { stdin, stdout } from "node:process";
 import { basename, join, relative, resolve } from "node:path";
 import { execFile, spawn } from "node:child_process";
 import { promisify } from "node:util";
-import { ApiError, authed, publicRequest } from "./api.js";
+import { ApiError, authed, deployKeyRequest, publicRequest } from "./api.js";
 import {
   clearCredentials,
   defaultFrontendConfig,
@@ -16,6 +16,7 @@ import {
   type ProjectLink,
   readLink,
   readLinkJson,
+  resolveDeployKey,
   starbaseUrl,
   writeCredentials,
   writeLink,
@@ -45,6 +46,7 @@ import {
 import { parseCreateArgs } from "./parse-create-args.js";
 import { parseDeployArgs } from "./parse-deploy-args.js";
 import { ensureDeployLink } from "./ensure-deploy-link.js";
+import { DEPLOY_NOT_AUTHENTICATED_MESSAGE, resolveDeployAuth } from "./resolve-deploy-auth.js";
 import { runLoad } from "./load.js";
 import { runMcp } from "./mcp.js";
 import { printLiveUrl } from "./print-live-url.js";
@@ -63,7 +65,7 @@ Commands:
   projects             List your projects
   create [path] [--template <id>] [--starter <id>] [--empty] [--org <id>]  Create a project, scaffold a starter, and deploy
   link [projectId]     Write robodev/.robodev in the current folder
-  deploy [--force] [--name <name>] [--org <id>]  Deploy schema, APIs, jobs, and frontend (creates and links if unlinked)
+  deploy [--force] [--name <name>] [--org <id>]  Deploy schema, APIs, jobs, and frontend (JWT, ROBODEV_DEPLOY_KEY, or file deployToken)
   load                 Download the project source onto this folder
   dev [options]        Run this project's APIs locally on an embedded Postgres, no Starbase needed
   mcp [--project <id>] Serve this project's backend over MCP on stdio, for an external coding agent
@@ -236,6 +238,8 @@ type DeployOptions = {
   root?: string;
   frontendFiles?: CollectedFile[];
   skipFrontendBuild?: boolean;
+  /** `robodev create` stays JWT-only even if a leftover CI key is in the environment. */
+  auth?: "auto" | "jwt";
 };
 
 async function collectDeployPayload(
@@ -266,6 +270,21 @@ async function collectDeployPayload(
   return { files: mergeCollectedFiles(host, frontendFiles), source };
 }
 
+async function deployAuthed<T>(path: string, init?: RequestInit): Promise<T> {
+  try {
+    return await authed<T>(path, init);
+  } catch (error) {
+    if (error instanceof Error && error.message.startsWith("Not authenticated.")) {
+      throw new Error(DEPLOY_NOT_AUTHENTICATED_MESSAGE);
+    }
+    throw error;
+  }
+}
+
+async function ensureJwtForDeploy(): Promise<void> {
+  await deployAuthed("/v1/auth/me");
+}
+
 /** Uploads schema, APIs, and frontend. Destructive schema changes need confirmation or `--force`. */
 async function runDeploy(
   forceFlag: boolean,
@@ -273,34 +292,43 @@ async function runDeploy(
   flags: { name?: string; orgId?: string } = {},
 ): Promise<string | undefined> {
   const root = options.root ?? process.cwd();
-  const link = await ensureDeployLink(
-    { root, name: flags.name, orgId: flags.orgId, isTty: Boolean(stdin.isTTY) },
-    {
-      readLink,
-      collectFiles,
-      ensureAuth: async () => {
-        await authed("/v1/auth/me");
-      },
-      resolveOrganization,
-      createProject: (body) =>
-        authed<Project>("/v1/projects", {
-          method: "POST",
-          body: JSON.stringify(body),
-        }),
-      writeLink,
-      writeViteApiUrl,
-      hasAppsFePackageJson,
-      starbaseUrl,
-      projectNameFromPath,
-      promptName: (defaultName) => prompt(`Project name [${defaultName}]: `),
-    },
-  );
+  const auth =
+    options.auth === "jwt"
+      ? { kind: "jwt" as const }
+      : await resolveDeployAuth(root, { resolveDeployKey, readLink });
+  const link =
+    auth.kind === "key"
+      ? auth.link
+      : await ensureDeployLink(
+          { root, name: flags.name, orgId: flags.orgId, isTty: Boolean(stdin.isTTY) },
+          {
+            readLink,
+            collectFiles,
+            ensureAuth: ensureJwtForDeploy,
+            resolveOrganization,
+            createProject: (body) =>
+              authed<Project>("/v1/projects", {
+                method: "POST",
+                body: JSON.stringify(body),
+              }),
+            writeLink,
+            writeViteApiUrl,
+            hasAppsFePackageJson,
+            starbaseUrl,
+            projectNameFromPath,
+            promptName: (defaultName) => prompt(`Project name [${defaultName}]: `),
+          },
+        );
+  const request =
+    auth.kind === "key"
+      ? <T>(path: string, init?: RequestInit) => deployKeyRequest<T>(path, auth.key, init)
+      : deployAuthed;
   const { files, source } = await collectDeployPayload(root, link, options);
   let force = forceFlag;
 
   for (;;) {
     try {
-      const result = await authed<{
+      const result = await request<{
         deploymentId: string;
         databaseName: string;
         databaseCreated?: boolean;
@@ -637,7 +665,12 @@ async function runCreate(args: string[]): Promise<void> {
       skipFrontendBuild = true;
     }
   }
-  const liveUrl = await runDeploy(false, { root, frontendFiles, skipFrontendBuild });
+  const liveUrl = await runDeploy(false, {
+    root,
+    frontendFiles,
+    skipFrontendBuild,
+    auth: "jwt",
+  });
 
   try {
     await pnpmInstall(root);

package/src/resolve-deploy-auth.test.ts

@@ -0,0 +1,65 @@
+import assert from "node:assert/strict";
+import { test } from "node:test";
+import type { ProjectLink } from "./config.js";
+import {
+  DEPLOY_NOT_AUTHENTICATED_MESSAGE,
+  resolveDeployAuth,
+  UNLINKED_DEPLOY_KEY_MESSAGE,
+} from "./resolve-deploy-auth.js";
+
+const link: ProjectLink = {
+  projectId: "proj_1",
+  apiUrl: "https://robodev.povio.dev",
+  projectApiUrl: "https://proj_1.robodev.povio.dev",
+};
+
+test("resolveDeployAuth uses a key and existing link without creating", async () => {
+  const auth = await resolveDeployAuth("/tmp/app", {
+    resolveDeployKey: async () => "rdb_secret",
+    readLink: async () => link,
+  });
+  assert.deepEqual(auth, { kind: "key", key: "rdb_secret", link });
+});
+
+test("resolveDeployAuth refuses an unlinked key deploy", async () => {
+  await assert.rejects(
+    () =>
+      resolveDeployAuth("/tmp/unlinked", {
+        resolveDeployKey: async () => "rdb_secret",
+        readLink: async () => null,
+      }),
+    (error: unknown) => {
+      assert.ok(error instanceof Error);
+      assert.equal(error.message, UNLINKED_DEPLOY_KEY_MESSAGE);
+      assert.match(error.message, /cannot create projects/);
+      assert.match(error.message, /robodev\/\.robodev/);
+      return true;
+    },
+  );
+});
+
+test("resolveDeployAuth falls through to JWT when no key is resolved", async () => {
+  const auth = await resolveDeployAuth("/tmp/app", {
+    resolveDeployKey: async () => null,
+    readLink: async () => null,
+  });
+  assert.deepEqual(auth, { kind: "jwt" });
+});
+
+test("resolveDeployAuth prefers a key over an existing link that a JWT could also use", async () => {
+  const auth = await resolveDeployAuth("/tmp/app", {
+    resolveDeployKey: async () => "rdb_env",
+    readLink: async () => link,
+  });
+  assert.equal(auth.kind, "key");
+  if (auth.kind === "key") {
+    assert.equal(auth.key, "rdb_env");
+  }
+});
+
+test("deploy not-authenticated copy mentions auth, env, and file token — not load", () => {
+  assert.match(DEPLOY_NOT_AUTHENTICATED_MESSAGE, /robodev auth/);
+  assert.match(DEPLOY_NOT_AUTHENTICATED_MESSAGE, /ROBODEV_DEPLOY_KEY/);
+  assert.match(DEPLOY_NOT_AUTHENTICATED_MESSAGE, /deployToken/);
+  assert.equal(DEPLOY_NOT_AUTHENTICATED_MESSAGE.includes("load"), false);
+});

package/src/resolve-deploy-auth.ts

@@ -0,0 +1,31 @@
+import type { ProjectLink } from "./config.js";
+
+export const UNLINKED_DEPLOY_KEY_MESSAGE =
+  "A deploy key cannot create projects. Link first (`robodev auth` + `robodev link` / `create`) or provide robodev/.robodev with projectId and apiUrl (no token required when ROBODEV_DEPLOY_KEY is set).";
+
+export const DEPLOY_NOT_AUTHENTICATED_MESSAGE =
+  "Not authenticated. Run `robodev auth`, set ROBODEV_DEPLOY_KEY, or add deployToken to robodev/.robodev.";
+
+export type DeployAuth = { kind: "key"; key: string; link: ProjectLink } | { kind: "jwt" };
+
+export type ResolveDeployAuthDeps = {
+  resolveDeployKey: (cwd: string) => Promise<string | null>;
+  readLink: (cwd: string) => Promise<ProjectLink | null>;
+};
+
+/**
+ * Key deploy (env or file token) requires an existing link and never creates a project.
+ * No key → JWT path, including unlinked create-and-link.
+ */
+export async function resolveDeployAuth(
+  root: string,
+  deps: ResolveDeployAuthDeps,
+): Promise<DeployAuth> {
+  const key = await deps.resolveDeployKey(root);
+  if (!key) return { kind: "jwt" };
+  const link = await deps.readLink(root);
+  if (!link) {
+    throw new Error(UNLINKED_DEPLOY_KEY_MESSAGE);
+  }
+  return { kind: "key", key, link };
+}

package/templates/auth-chat/README.md

@@ -1,6 +1,6 @@
 # {{NAME}}
 
-Starter from `robodev create --starter auth-chat`: Tiny chat APIs (`chat` database, `messages` table), authenticated invite email, and a Povio UI in `apps/fe`.
+Starter from `robodev create --starter auth-chat`: Tiny chat APIs (`chat` database, `messages` table), authenticated invite email, and a Povio UI in `apps/fe`. Agents: read `ROBODEV.md`.
 
 After a CLI create or deploy with `.robodev` `frontend` set (the default for this starter), the project host serves the built Tiny SPA at `GET /`. APIs and Swagger still win over static files.
 

package/templates/auth-chat/ROBODEV.md

@@ -0,0 +1,75 @@
+# Robodev
+
+Use this file for Robodev and SDK facts. Do not web-search the SDK.
+
+## defineApi (copy-paste)
+
+`db`, `email`, `storage`, and `env` are injected. Never `import { db } from "@robodev-ai/sdk"`.
+The SDK is not installed in the runner. Do not `import("@robodev-ai/sdk")`. Do not search `/opt`, `node_modules`, or grok/gemini home for it.
+
+```ts
+import { defineApi, z } from "@robodev-ai/sdk";
+
+export const get = defineApi({
+  response: z.object({ ok: z.literal(true) }),
+  handler: async ({ db, email, storage, env }) => {
+    void db;
+    void email;
+    void storage;
+    void env;
+    return { ok: true as const };
+  },
+});
+```
+
+## Hard rules
+
+- Do not run npm, pnpm, or yarn install.
+- Do not start npm run dev, vite, or any local server.
+- Do not run tsc (node_modules is not installed in this runner).
+- Do not port-scan or curl/fetch localhost.
+- Preview is the WebContainer. Live APIs exist only after `robodev-publish be`.
+- Publish backend after a batch of file edits, not after every file.
+- Do not publish the frontend.
+
+## Auth and product data
+
+Persist primary product data with `defineApi` and `robodev-publish be`. Do not use localStorage as the product store unless the user asked for a public, static, or no-account page. Auth is on by default: add login and register and protect routes unless the product is public or unauthenticated. Use `auth: "required"` and `ctx.user.id`. Call reserved `/api/user/auth/*` — do not implement `api/user/**`. Tiny: reuse seed login/register and AuthGuard. Shadcn, Empty, and legacy: create login/register with `@robodev-ai/client` tokens. A missing `.rulesync` skill is not a reason to skip APIs. Do not require `robodev-auth set` every run.
+
+## Backend
+
+- Auth: robodev-auth get / set / users / users-delete. Do not invent control-plane HTTP.
+- Secrets: robodev-secret list / set / delete. Use env.NAME in defineApi. List names only.
+- SQL: psql or robodev-sql for DML, SELECT, and seed only. Never print DATABASE_URL. Never run DDL.
+- Publish backend only with robodev-publish be. Do not publish the frontend.
+- Email settings: robodev-email get / set / validate / logs.
+
+## Email templates
+
+Hosted mail is the Email page. Changes apply immediately through these helpers — no Code save or deploy.
+
+- `robodev-email templates list`
+- `robodev-email templates get --slug <slug>`
+- `robodev-email templates set --slug <slug> [--subject] [--html] [--text]`
+
+`set` edits an existing slug. If the slug is missing and is a custom slug (`^[a-z][a-z0-9-]{0,62}$`, not `auth.*`), `set` creates it.
+
+System slugs: `auth.welcome` (`{{email}}`, `{{name}}`), `auth.magic-link` (`{{link}}`, `{{email}}`, `{{name}}`, `{{appUrl}}`), `auth.forgot-password` (`{{link}}`, `{{code}}`, `{{email}}`, `{{name}}`, `{{appUrl}}`). Keep placeholders exact. Do not delete system templates. Do not invent `auth.*` slugs.
+
+Send with `ctx.email.send({ template: "<slug>", to, vars })`.
+
+Do not write `robodev/emails/*.html` or `robodev/emails/*.json` for hosted templates. Those files do not update the live project.
+
+Never write `.env` or secrets. Never write `.robodev`.
+
+## Layout
+
+CLI Tiny-family: `robodev/database.ts` + `robodev/api/**`, Povio UI in `apps/fe`. Keep that layout.
+
+- Schema: `robodev/database.ts` (`defineDatabase` from `@robodev-ai/sdk`)
+- HTTP handlers: `robodev/api/**/*.ts`
+- Optional jobs / sockets / hooks under `robodev/`
+- Frontend: `apps/fe` (Povio UI)
+- Auth is reserved at `/api/user/*`. Do not add `robodev/api/user/**`.
+
+Allowed paths: `robodev/database.ts`, `robodev/api/**/*.ts`, `robodev/jobs/**/*.ts`, `robodev/sockets/**/*.ts`, `robodev/hooks/**/*.ts`, `robodev/package.json`, `apps/fe/**`, `.rulesync/**`, `openapi.json`, `package.json`, `README.md`, `ROBODEV.md`, `.gitignore`.

package/templates/auth-chat/package.json

@@ -12,7 +12,7 @@
     "@robodev-ai/sdk": "^0.13.0"
   },
   "devDependencies": {
-    "robodev": "^0.47.0",
+    "robodev": "^0.47.2",
     "rulesync": "^8.18.0",
     "typescript": "^5.9.2"
   }

package/templates/backend/README.md

@@ -1,6 +1,6 @@
 # {{NAME}}
 
-Tiny Template planets, aliens, and media APIs — no Vite UI. For Lovable, Bolt, or v0.
+Tiny Template planets, aliens, and media APIs — no Vite UI. For Lovable, Bolt, or v0. Agents: read `ROBODEV.md`.
 
 Deploy `robodev/database.ts` and `robodev/api/` from a real terminal:
 

package/templates/backend/ROBODEV.md

@@ -0,0 +1,73 @@
+# Robodev
+
+Use this file for Robodev and SDK facts. Do not web-search the SDK.
+
+## defineApi (copy-paste)
+
+`db`, `email`, `storage`, and `env` are injected. Never `import { db } from "@robodev-ai/sdk"`.
+The SDK is not installed in the runner. Do not `import("@robodev-ai/sdk")`. Do not search `/opt`, `node_modules`, or grok/gemini home for it.
+
+```ts
+import { defineApi, z } from "@robodev-ai/sdk";
+
+export const get = defineApi({
+  response: z.object({ ok: z.literal(true) }),
+  handler: async ({ db, email, storage, env }) => {
+    void db;
+    void email;
+    void storage;
+    void env;
+    return { ok: true as const };
+  },
+});
+```
+
+## Hard rules
+
+- Do not run npm, pnpm, or yarn install.
+- Do not start npm run dev, vite, or any local server.
+- Do not run tsc (node_modules is not installed in this runner).
+- Do not port-scan or curl/fetch localhost.
+- Preview is the WebContainer. Live APIs exist only after `robodev-publish be`.
+- Publish backend after a batch of file edits, not after every file.
+- Do not publish the frontend.
+
+## Auth and product data
+
+Persist primary product data with `defineApi` and `robodev-publish be`. Do not use localStorage as the product store unless the user asked for a public, static, or no-account page. Auth is on by default: add login and register and protect routes unless the product is public or unauthenticated. Use `auth: "required"` and `ctx.user.id`. Call reserved `/api/user/auth/*` — do not implement `api/user/**`. Tiny: reuse seed login/register and AuthGuard. Shadcn, Empty, and legacy: create login/register with `@robodev-ai/client` tokens. A missing `.rulesync` skill is not a reason to skip APIs. Do not require `robodev-auth set` every run.
+
+## Backend
+
+- Auth: robodev-auth get / set / users / users-delete. Do not invent control-plane HTTP.
+- Secrets: robodev-secret list / set / delete. Use env.NAME in defineApi. List names only.
+- SQL: psql or robodev-sql for DML, SELECT, and seed only. Never print DATABASE_URL. Never run DDL.
+- Publish backend only with robodev-publish be. Do not publish the frontend.
+- Email settings: robodev-email get / set / validate / logs.
+
+## Email templates
+
+Hosted mail is the Email page. Changes apply immediately through these helpers — no Code save or deploy.
+
+- `robodev-email templates list`
+- `robodev-email templates get --slug <slug>`
+- `robodev-email templates set --slug <slug> [--subject] [--html] [--text]`
+
+`set` edits an existing slug. If the slug is missing and is a custom slug (`^[a-z][a-z0-9-]{0,62}$`, not `auth.*`), `set` creates it.
+
+System slugs: `auth.welcome` (`{{email}}`, `{{name}}`), `auth.magic-link` (`{{link}}`, `{{email}}`, `{{name}}`, `{{appUrl}}`), `auth.forgot-password` (`{{link}}`, `{{code}}`, `{{email}}`, `{{name}}`, `{{appUrl}}`). Keep placeholders exact. Do not delete system templates. Do not invent `auth.*` slugs.
+
+Send with `ctx.email.send({ template: "<slug>", to, vars })`.
+
+Do not write `robodev/emails/*.html` or `robodev/emails/*.json` for hosted templates. Those files do not update the live project.
+
+Never write `.env` or secrets. Never write `.robodev`.
+
+## Layout
+
+APIs only: `robodev/`. No Vite UI.
+
+- Schema: `robodev/database.ts`
+- HTTP handlers: `robodev/api/**/*.ts`
+- Auth is reserved at `/api/user/*`. Do not add `robodev/api/user/**`.
+
+Allowed paths: `robodev/database.ts`, `robodev/api/**/*.ts`, `robodev/jobs/**/*.ts`, `robodev/sockets/**/*.ts`, `robodev/hooks/**/*.ts`, `robodev/package.json`, `package.json`, `README.md`, `ROBODEV.md`, `.gitignore`.

package/templates/backend/package.json

@@ -11,7 +11,7 @@
     "@robodev-ai/sdk": "^0.13.0"
   },
   "devDependencies": {
-    "robodev": "^0.47.0",
+    "robodev": "^0.47.2",
     "typescript": "^5.9.2"
   }
 }

package/templates/empty/README.md

@@ -2,7 +2,7 @@
 
 Blank `robodev/database.ts` and `GET /api/health` plus a hosted Welcome page. No sample schema.
 
-The project App URL serves the hosted Welcome page. Edit `index.html` and `src/`, then `robodev deploy` (or Code + Save).
+The project App URL serves the hosted Welcome page. Edit `index.html` and `src/`, then `robodev deploy` (or Code + Save). Agents: read `ROBODEV.md`. Unless the product is a public page, add login/register via reserved `/api/user/auth/*` and protect routes.
 
 ```bash
 robodev create my-app

package/templates/empty/ROBODEV.md

@@ -0,0 +1,76 @@
+# Robodev
+
+Use this file for Robodev and SDK facts. Do not web-search the SDK.
+
+## defineApi (copy-paste)
+
+`db`, `email`, `storage`, and `env` are injected. Never `import { db } from "@robodev-ai/sdk"`.
+The SDK is not installed in the runner. Do not `import("@robodev-ai/sdk")`. Do not search `/opt`, `node_modules`, or grok/gemini home for it.
+
+```ts
+import { defineApi, z } from "@robodev-ai/sdk";
+
+export const get = defineApi({
+  response: z.object({ ok: z.literal(true) }),
+  handler: async ({ db, email, storage, env }) => {
+    void db;
+    void email;
+    void storage;
+    void env;
+    return { ok: true as const };
+  },
+});
+```
+
+## Hard rules
+
+- Do not run npm, pnpm, or yarn install.
+- Do not start npm run dev, vite, or any local server.
+- Do not run tsc (node_modules is not installed in this runner).
+- Do not port-scan or curl/fetch localhost.
+- Preview is the WebContainer. Live APIs exist only after `robodev-publish be`.
+- Publish backend after a batch of file edits, not after every file.
+- Do not publish the frontend.
+
+## Auth and product data
+
+Persist primary product data with `defineApi` and `robodev-publish be`. Do not use localStorage as the product store unless the user asked for a public, static, or no-account page. Auth is on by default: add login and register and protect routes unless the product is public or unauthenticated. Use `auth: "required"` and `ctx.user.id`. Call reserved `/api/user/auth/*` — do not implement `api/user/**`. Tiny: reuse seed login/register and AuthGuard. Shadcn, Empty, and legacy: create login/register with `@robodev-ai/client` tokens. A missing `.rulesync` skill is not a reason to skip APIs. Do not require `robodev-auth set` every run.
+
+## Backend
+
+- Auth: robodev-auth get / set / users / users-delete. Do not invent control-plane HTTP.
+- Secrets: robodev-secret list / set / delete. Use env.NAME in defineApi. List names only.
+- SQL: psql or robodev-sql for DML, SELECT, and seed only. Never print DATABASE_URL. Never run DDL.
+- Publish backend only with robodev-publish be. Do not publish the frontend.
+- Email settings: robodev-email get / set / validate / logs.
+
+## Email templates
+
+Hosted mail is the Email page. Changes apply immediately through these helpers — no Code save or deploy.
+
+- `robodev-email templates list`
+- `robodev-email templates get --slug <slug>`
+- `robodev-email templates set --slug <slug> [--subject] [--html] [--text]`
+
+`set` edits an existing slug. If the slug is missing and is a custom slug (`^[a-z][a-z0-9-]{0,62}$`, not `auth.*`), `set` creates it.
+
+System slugs: `auth.welcome` (`{{email}}`, `{{name}}`), `auth.magic-link` (`{{link}}`, `{{email}}`, `{{name}}`, `{{appUrl}}`), `auth.forgot-password` (`{{link}}`, `{{code}}`, `{{email}}`, `{{name}}`, `{{appUrl}}`). Keep placeholders exact. Do not delete system templates. Do not invent `auth.*` slugs.
+
+Send with `ctx.email.send({ template: "<slug>", to, vars })`.
+
+Do not write `robodev/emails/*.html` or `robodev/emails/*.json` for hosted templates. Those files do not update the live project.
+
+Never write `.env` or secrets. Never write `.robodev`.
+
+## Layout
+
+This is the hosted Empty layout. Keep it.
+
+- Schema: `robodev/database.ts`
+- HTTP handlers: `robodev/api/**/*.ts`
+- Frontend: root `index.html` + `src/**`
+- Auth is reserved at `/api/user/*`. Do not add `robodev/api/user/**`.
+
+Do not write a `frontend` block in `robodev/.robodev`. Root `index.html` + `src/` deploy as hosted React.
+
+Allowed paths: `robodev/database.ts`, `robodev/api/**/*.ts`, `robodev/jobs/**/*.ts`, `robodev/sockets/**/*.ts`, `robodev/hooks/**/*.ts`, `robodev/package.json`, `index.html`, `src/**`, `package.json`, `README.md`, `ROBODEV.md`, `.gitignore`.

package/templates/empty/package.json

@@ -16,7 +16,7 @@
     "react-dom": "^18.3.1"
   },
   "devDependencies": {
-    "robodev": "^0.47.0",
+    "robodev": "^0.47.2",
     "typescript": "^5.9.2",
     "vite": "^6.0.0"
   }

package/templates/marketplace/README.md

@@ -1,6 +1,6 @@
 # {{NAME}}
 
-Starter from `robodev create --starter marketplace`: Marketplace C2C marketplace schema (`categories`, `listings`, `cart_items`, `orders`, `watches`, `reviews`, `media`), file-based APIs in `robodev/api/`, and a Povio UI in `apps/fe`.
+Starter from `robodev create --starter marketplace`: Marketplace C2C marketplace schema (`categories`, `listings`, `cart_items`, `orders`, `watches`, `reviews`, `media`), file-based APIs in `robodev/api/`, and a Povio UI in `apps/fe`. Agents: read `ROBODEV.md`.
 
 After a CLI create or deploy with `.robodev` `frontend` set (the default for this starter), the project host serves the built Marketplace SPA at `GET /`. APIs and Swagger still win over static files.
 

package/templates/marketplace/ROBODEV.md

@@ -0,0 +1,75 @@
+# Robodev
+
+Use this file for Robodev and SDK facts. Do not web-search the SDK.
+
+## defineApi (copy-paste)
+
+`db`, `email`, `storage`, and `env` are injected. Never `import { db } from "@robodev-ai/sdk"`.
+The SDK is not installed in the runner. Do not `import("@robodev-ai/sdk")`. Do not search `/opt`, `node_modules`, or grok/gemini home for it.
+
+```ts
+import { defineApi, z } from "@robodev-ai/sdk";
+
+export const get = defineApi({
+  response: z.object({ ok: z.literal(true) }),
+  handler: async ({ db, email, storage, env }) => {
+    void db;
+    void email;
+    void storage;
+    void env;
+    return { ok: true as const };
+  },
+});
+```
+
+## Hard rules
+
+- Do not run npm, pnpm, or yarn install.
+- Do not start npm run dev, vite, or any local server.
+- Do not run tsc (node_modules is not installed in this runner).
+- Do not port-scan or curl/fetch localhost.
+- Preview is the WebContainer. Live APIs exist only after `robodev-publish be`.
+- Publish backend after a batch of file edits, not after every file.
+- Do not publish the frontend.
+
+## Auth and product data
+
+Persist primary product data with `defineApi` and `robodev-publish be`. Do not use localStorage as the product store unless the user asked for a public, static, or no-account page. Auth is on by default: add login and register and protect routes unless the product is public or unauthenticated. Use `auth: "required"` and `ctx.user.id`. Call reserved `/api/user/auth/*` — do not implement `api/user/**`. Tiny: reuse seed login/register and AuthGuard. Shadcn, Empty, and legacy: create login/register with `@robodev-ai/client` tokens. A missing `.rulesync` skill is not a reason to skip APIs. Do not require `robodev-auth set` every run.
+
+## Backend
+
+- Auth: robodev-auth get / set / users / users-delete. Do not invent control-plane HTTP.
+- Secrets: robodev-secret list / set / delete. Use env.NAME in defineApi. List names only.
+- SQL: psql or robodev-sql for DML, SELECT, and seed only. Never print DATABASE_URL. Never run DDL.
+- Publish backend only with robodev-publish be. Do not publish the frontend.
+- Email settings: robodev-email get / set / validate / logs.
+
+## Email templates
+
+Hosted mail is the Email page. Changes apply immediately through these helpers — no Code save or deploy.
+
+- `robodev-email templates list`
+- `robodev-email templates get --slug <slug>`
+- `robodev-email templates set --slug <slug> [--subject] [--html] [--text]`
+
+`set` edits an existing slug. If the slug is missing and is a custom slug (`^[a-z][a-z0-9-]{0,62}$`, not `auth.*`), `set` creates it.
+
+System slugs: `auth.welcome` (`{{email}}`, `{{name}}`), `auth.magic-link` (`{{link}}`, `{{email}}`, `{{name}}`, `{{appUrl}}`), `auth.forgot-password` (`{{link}}`, `{{code}}`, `{{email}}`, `{{name}}`, `{{appUrl}}`). Keep placeholders exact. Do not delete system templates. Do not invent `auth.*` slugs.
+
+Send with `ctx.email.send({ template: "<slug>", to, vars })`.
+
+Do not write `robodev/emails/*.html` or `robodev/emails/*.json` for hosted templates. Those files do not update the live project.
+
+Never write `.env` or secrets. Never write `.robodev`.
+
+## Layout
+
+CLI Tiny-family: `robodev/database.ts` + `robodev/api/**`, Povio UI in `apps/fe`. Keep that layout.
+
+- Schema: `robodev/database.ts` (`defineDatabase` from `@robodev-ai/sdk`)
+- HTTP handlers: `robodev/api/**/*.ts`
+- Optional jobs / sockets / hooks under `robodev/`
+- Frontend: `apps/fe` (Povio UI)
+- Auth is reserved at `/api/user/*`. Do not add `robodev/api/user/**`.
+
+Allowed paths: `robodev/database.ts`, `robodev/api/**/*.ts`, `robodev/jobs/**/*.ts`, `robodev/sockets/**/*.ts`, `robodev/hooks/**/*.ts`, `robodev/package.json`, `apps/fe/**`, `.rulesync/**`, `openapi.json`, `package.json`, `README.md`, `ROBODEV.md`, `.gitignore`.

package/templates/marketplace/package.json

@@ -12,7 +12,7 @@
     "@robodev-ai/sdk": "^0.13.0"
   },
   "devDependencies": {
-    "robodev": "^0.47.0",
+    "robodev": "^0.47.2",
     "rulesync": "^8.18.0",
     "typescript": "^5.9.2"
   }

package/templates/shadcn/README.md

@@ -2,7 +2,7 @@
 
 Blank `robodev/database.ts` and `GET /api/health` plus a hosted Welcome page with shadcn and an orval client. No sample schema.
 
-The project App URL serves the hosted Welcome page (`/` via React Router in `src/pages/Home.tsx`). Edit `index.html` and `src/`, then `robodev deploy` (or Code + Save). Agents: read `ROBODEV.md`.
+The project App URL serves the hosted Welcome page (`/` via React Router in `src/pages/Home.tsx`). Edit `index.html` and `src/`, then `robodev deploy` (or Code + Save). Agents: read `ROBODEV.md`. Unless the product is a public page, add login/register via reserved `/api/user/auth/*` and protect routes.
 
 ```bash
 robodev create my-app --template shadcn

package/templates/shadcn/ROBODEV.md

@@ -1,18 +1,6 @@
 # Robodev
 
-Agent notes for this Shadcn workspace. Use this file for Robodev and SDK facts. Do not web-search the SDK.
-
-This is the hosted Shadcn layout. Keep it. Do not convert this tree to Tiny (`packages/be` + `apps/fe`).
-
-## Layout
-
-- Schema: `robodev/database.ts` (`defineDatabase` from `@robodev-ai/sdk`)
-- HTTP handlers: `robodev/api/**/*.ts` (`defineApi` from `@robodev-ai/sdk`)
-- Optional jobs: `robodev/jobs/**/*.ts`. Optional sockets: `robodev/sockets/**/*.ts` (`defineSocket`). Optional runtime packages go in `robodev/package.json` (allowlisted exact semver only). Do not npm install in this runner — Starbase installs on publish.
-- Frontend: root `index.html` + `src/**` (React, React Router, shadcn, generated orval client)
-- Auth is reserved at `/api/user/*`. Do not add `robodev/api/user/**`.
-
-Do not write a `frontend` block in `robodev/.robodev` — that block is for Tiny `apps/fe`. Root `index.html` + `src/` deploy as hosted React.
+Use this file for Robodev and SDK facts. Do not web-search the SDK.
 
 ## defineApi (copy-paste)
 
@@ -44,24 +32,51 @@ export const get = defineApi({
 - Publish backend after a batch of file edits, not after every file.
 - Do not publish the frontend.
 
+## Auth and product data
+
+Persist primary product data with `defineApi` and `robodev-publish be`. Do not use localStorage as the product store unless the user asked for a public, static, or no-account page. Auth is on by default: add login and register and protect routes unless the product is public or unauthenticated. Use `auth: "required"` and `ctx.user.id`. Call reserved `/api/user/auth/*` — do not implement `api/user/**`. Tiny: reuse seed login/register and AuthGuard. Shadcn, Empty, and legacy: create login/register with `@robodev-ai/client` tokens. A missing `.rulesync` skill is not a reason to skip APIs. Do not require `robodev-auth set` every run.
+
 ## Backend
 
-- Layout is `robodev/`. `robodev-publish be` maps `robodev/database.ts` → `database.ts` and `robodev/api/**` → `api/**`.
 - Auth: robodev-auth get / set / users / users-delete. Do not invent control-plane HTTP.
 - Secrets: robodev-secret list / set / delete. Use env.NAME in defineApi. List names only.
 - SQL: psql or robodev-sql for DML, SELECT, and seed only. Never print DATABASE_URL. Never run DDL.
 - Publish backend only with robodev-publish be. Do not publish the frontend.
+- Email settings: robodev-email get / set / validate / logs.
+
+## Email templates
+
+Hosted mail is the Email page. Changes apply immediately through these helpers — no Code save or deploy.
+
+- `robodev-email templates list`
+- `robodev-email templates get --slug <slug>`
+- `robodev-email templates set --slug <slug> [--subject] [--html] [--text]`
+
+`set` edits an existing slug. If the slug is missing and is a custom slug (`^[a-z][a-z0-9-]{0,62}$`, not `auth.*`), `set` creates it.
+
+System slugs: `auth.welcome` (`{{email}}`, `{{name}}`), `auth.magic-link` (`{{link}}`, `{{email}}`, `{{name}}`, `{{appUrl}}`), `auth.forgot-password` (`{{link}}`, `{{code}}`, `{{email}}`, `{{name}}`, `{{appUrl}}`). Keep placeholders exact. Do not delete system templates. Do not invent `auth.*` slugs.
 
-## Frontend
+Send with `ctx.email.send({ template: "<slug>", to, vars })`.
+
+Do not write `robodev/emails/*.html` or `robodev/emails/*.json` for hosted templates. Those files do not update the live project.
+
+Never write `.env` or secrets. Never write `.robodev`.
+
+## Layout
+
+This is the hosted Shadcn layout. Keep it. Do not convert this tree to Tiny (`packages/be` + `apps/fe`).
+
+- Schema: `robodev/database.ts` (`defineDatabase` from `@robodev-ai/sdk`)
+- HTTP handlers: `robodev/api/**/*.ts` (`defineApi` from `@robodev-ai/sdk`)
+- Optional jobs: `robodev/jobs/**/*.ts`. Optional sockets: `robodev/sockets/**/*.ts` (`defineSocket`). Optional runtime packages go in `robodev/package.json` (allowlisted exact semver only). Do not npm install in this runner — Starbase installs on publish.
+- Frontend: root `index.html` + `src/**` (React, React Router, shadcn, generated orval client)
+- Auth is reserved at `/api/user/*`. Do not add `robodev/api/user/**`.
+
+Do not write a `frontend` block in `robodev/.robodev` — that block is for Tiny `apps/fe`. Root `index.html` + `src/` deploy as hosted React.
 
 - Route with React Router in `src/`. `src/pages/Home.tsx` is `/`. Add a page by adding a component and a `<Route>` in `src/App.tsx`.
 - Call APIs through the committed orval client under `src/api/generated`. After API changes, update `src/api/openapi.json` and regenerate.
 - UI: shadcn under `src/components/ui`. Hosted compile does not run Tailwind. Keep hosted CSS in `src/app.css`. `tailwind.config.ts` and `postcss.config.js` are for local `shadcn add` / Vite only.
 - Hosted FE packages: `react`, `react-dom`, `react-router-dom`, `@robodev-ai/client`. Do not import other npm packages in `src/` — hosted compile will fail.
-- Preview runs `pnpm install` / `vite --host` from the project root. Do not run those in this runner.
-
-## Allowed paths
 
-`robodev/database.ts`, `robodev/api/**/*.ts`, `robodev/jobs/**/*.ts`, `robodev/sockets/**/*.ts`, `robodev/hooks/**/*.ts`, `robodev/package.json`, `index.html`, `src/**`, `package.json`, `README.md`, `ROBODEV.md`, `.gitignore`.
-
-Never write `.env` or secrets. Never write `.robodev`.
+Allowed paths: `robodev/database.ts`, `robodev/api/**/*.ts`, `robodev/jobs/**/*.ts`, `robodev/sockets/**/*.ts`, `robodev/hooks/**/*.ts`, `robodev/package.json`, `index.html`, `src/**`, `package.json`, `README.md`, `ROBODEV.md`, `.gitignore`.

package/templates/shadcn/package.json

@@ -21,7 +21,7 @@
     "autoprefixer": "^10.4.21",
     "orval": "^7.11.2",
     "postcss": "^8.5.6",
-    "robodev": "^0.47.0",
+    "robodev": "^0.47.2",
     "shadcn": "^2.10.0",
     "tailwindcss": "^3.4.17",
     "typescript": "^5.9.2",

package/templates/space/README.md

@@ -1,6 +1,6 @@
 # {{NAME}}
 
-Starter from `robodev create`: Tiny Template schema (`planets`, `aliens`, `media`, `planet_likes`), file-based APIs in `robodev/api/`, and a Povio UI in `apps/fe`.
+Starter from `robodev create`: Tiny Template schema (`planets`, `aliens`, `media`, `planet_likes`), file-based APIs in `robodev/api/`, and a Povio UI in `apps/fe`. Agents: read `ROBODEV.md`.
 
 After a CLI create or deploy with `.robodev` `frontend` set (the default for this starter), the project host serves the built Tiny SPA at `GET /`. APIs and Swagger still win over static files.
 

package/templates/space/ROBODEV.md

@@ -0,0 +1,75 @@
+# Robodev
+
+Use this file for Robodev and SDK facts. Do not web-search the SDK.
+
+## defineApi (copy-paste)
+
+`db`, `email`, `storage`, and `env` are injected. Never `import { db } from "@robodev-ai/sdk"`.
+The SDK is not installed in the runner. Do not `import("@robodev-ai/sdk")`. Do not search `/opt`, `node_modules`, or grok/gemini home for it.
+
+```ts
+import { defineApi, z } from "@robodev-ai/sdk";
+
+export const get = defineApi({
+  response: z.object({ ok: z.literal(true) }),
+  handler: async ({ db, email, storage, env }) => {
+    void db;
+    void email;
+    void storage;
+    void env;
+    return { ok: true as const };
+  },
+});
+```
+
+## Hard rules
+
+- Do not run npm, pnpm, or yarn install.
+- Do not start npm run dev, vite, or any local server.
+- Do not run tsc (node_modules is not installed in this runner).
+- Do not port-scan or curl/fetch localhost.
+- Preview is the WebContainer. Live APIs exist only after `robodev-publish be`.
+- Publish backend after a batch of file edits, not after every file.
+- Do not publish the frontend.
+
+## Auth and product data
+
+Persist primary product data with `defineApi` and `robodev-publish be`. Do not use localStorage as the product store unless the user asked for a public, static, or no-account page. Auth is on by default: add login and register and protect routes unless the product is public or unauthenticated. Use `auth: "required"` and `ctx.user.id`. Call reserved `/api/user/auth/*` — do not implement `api/user/**`. Tiny: reuse seed login/register and AuthGuard. Shadcn, Empty, and legacy: create login/register with `@robodev-ai/client` tokens. A missing `.rulesync` skill is not a reason to skip APIs. Do not require `robodev-auth set` every run.
+
+## Backend
+
+- Auth: robodev-auth get / set / users / users-delete. Do not invent control-plane HTTP.
+- Secrets: robodev-secret list / set / delete. Use env.NAME in defineApi. List names only.
+- SQL: psql or robodev-sql for DML, SELECT, and seed only. Never print DATABASE_URL. Never run DDL.
+- Publish backend only with robodev-publish be. Do not publish the frontend.
+- Email settings: robodev-email get / set / validate / logs.
+
+## Email templates
+
+Hosted mail is the Email page. Changes apply immediately through these helpers — no Code save or deploy.
+
+- `robodev-email templates list`
+- `robodev-email templates get --slug <slug>`
+- `robodev-email templates set --slug <slug> [--subject] [--html] [--text]`
+
+`set` edits an existing slug. If the slug is missing and is a custom slug (`^[a-z][a-z0-9-]{0,62}$`, not `auth.*`), `set` creates it.
+
+System slugs: `auth.welcome` (`{{email}}`, `{{name}}`), `auth.magic-link` (`{{link}}`, `{{email}}`, `{{name}}`, `{{appUrl}}`), `auth.forgot-password` (`{{link}}`, `{{code}}`, `{{email}}`, `{{name}}`, `{{appUrl}}`). Keep placeholders exact. Do not delete system templates. Do not invent `auth.*` slugs.
+
+Send with `ctx.email.send({ template: "<slug>", to, vars })`.
+
+Do not write `robodev/emails/*.html` or `robodev/emails/*.json` for hosted templates. Those files do not update the live project.
+
+Never write `.env` or secrets. Never write `.robodev`.
+
+## Layout
+
+CLI Tiny-family: `robodev/database.ts` + `robodev/api/**`, Povio UI in `apps/fe`. Keep that layout.
+
+- Schema: `robodev/database.ts` (`defineDatabase` from `@robodev-ai/sdk`)
+- HTTP handlers: `robodev/api/**/*.ts`
+- Optional jobs / sockets / hooks under `robodev/`
+- Frontend: `apps/fe` (Povio UI)
+- Auth is reserved at `/api/user/*`. Do not add `robodev/api/user/**`.
+
+Allowed paths: `robodev/database.ts`, `robodev/api/**/*.ts`, `robodev/jobs/**/*.ts`, `robodev/sockets/**/*.ts`, `robodev/hooks/**/*.ts`, `robodev/package.json`, `apps/fe/**`, `.rulesync/**`, `openapi.json`, `package.json`, `README.md`, `ROBODEV.md`, `.gitignore`.

package/templates/space/package.json

@@ -12,7 +12,7 @@
     "@robodev-ai/sdk": "^0.13.0"
   },
   "devDependencies": {
-    "robodev": "^0.47.0",
+    "robodev": "^0.47.2",
     "rulesync": "^8.18.0",
     "typescript": "^5.9.2"
   }