robodev 0.47.1 → 0.47.2

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "robodev",
-  "version": "0.47.1",
+  "version": "0.47.2",
   "description": "CLI for Robodev Starbase — create, auth, link, deploy, load, and run a project locally with robodev dev",
   "type": "module",
   "license": "MIT",

package/src/config.test.ts

@@ -3,7 +3,13 @@ import { mkdir, mkdtemp, readFile, rm, writeFile } from "node:fs/promises";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
 import { test } from "node:test";
-import { defaultFrontendConfig, readLink, writeLink, writeViteApiUrl } from "./config.js";
+import {
+  defaultFrontendConfig,
+  readLink,
+  resolveDeployKey,
+  writeLink,
+  writeViteApiUrl,
+} from "./config.js";
 
 test("writeViteApiUrl sets Vite and Povio public API URLs", async () => {
   const root = await mkdtemp(join(tmpdir(), "rd-env-"));
@@ -159,6 +165,98 @@ test("writeLink preserves frontend false opt-out", async () => {
   }
 });
 
+test("writeLink keeps an existing deployToken when rewriting other fields", async () => {
+  const root = await mkdtemp(join(tmpdir(), "rd-link-token-"));
+  try {
+    await mkdir(join(root, "robodev"), { recursive: true });
+    await writeFile(
+      join(root, "robodev/.robodev"),
+      `${JSON.stringify(
+        {
+          projectId: "prj-1",
+          apiUrl: "https://a.example",
+          projectApiUrl: "https://prj-1.example",
+          deployToken: "rdb_keep",
+        },
+        null,
+        2,
+      )}\n`,
+    );
+    await writeLink({ projectId: "prj-1", apiUrl: "https://b.example" }, root);
+    const raw = JSON.parse(await readFile(join(root, "robodev/.robodev"), "utf8")) as {
+      deployToken?: string;
+      apiUrl: string;
+    };
+    assert.equal(raw.deployToken, "rdb_keep");
+    assert.equal(raw.apiUrl, "https://b.example");
+    const link = await readLink(root);
+    assert.equal(link && "deployToken" in link, false);
+  } finally {
+    await rm(root, { recursive: true, force: true });
+  }
+});
+
+test("resolveDeployKey prefers ROBODEV_DEPLOY_KEY over a file token", async () => {
+  const root = await mkdtemp(join(tmpdir(), "rd-key-env-"));
+  const previous = process.env.ROBODEV_DEPLOY_KEY;
+  try {
+    await mkdir(join(root, "robodev"), { recursive: true });
+    await writeFile(
+      join(root, "robodev/.robodev"),
+      `${JSON.stringify({ projectId: "prj-1", apiUrl: "https://a.example", deployToken: "rdb_file" }, null, 2)}\n`,
+    );
+    process.env.ROBODEV_DEPLOY_KEY = "  rdb_env  ";
+    assert.equal(await resolveDeployKey(root), "rdb_env");
+  } finally {
+    if (previous === undefined) delete process.env.ROBODEV_DEPLOY_KEY;
+    else process.env.ROBODEV_DEPLOY_KEY = previous;
+    await rm(root, { recursive: true, force: true });
+  }
+});
+
+test("resolveDeployKey reads deployToken from robodev/.robodev then legacy .robodev", async () => {
+  const root = await mkdtemp(join(tmpdir(), "rd-key-file-"));
+  const previous = process.env.ROBODEV_DEPLOY_KEY;
+  try {
+    delete process.env.ROBODEV_DEPLOY_KEY;
+    await writeFile(
+      join(root, ".robodev"),
+      `${JSON.stringify({ projectId: "legacy", apiUrl: "https://legacy.example", deployToken: "rdb_legacy" }, null, 2)}\n`,
+    );
+    assert.equal(await resolveDeployKey(root), "rdb_legacy");
+    await mkdir(join(root, "robodev"), { recursive: true });
+    await writeFile(
+      join(root, "robodev/.robodev"),
+      `${JSON.stringify({ projectId: "canonical", apiUrl: "https://canonical.example", deployToken: "rdb_canonical" }, null, 2)}\n`,
+    );
+    assert.equal(await resolveDeployKey(root), "rdb_canonical");
+  } finally {
+    if (previous === undefined) delete process.env.ROBODEV_DEPLOY_KEY;
+    else process.env.ROBODEV_DEPLOY_KEY = previous;
+    await rm(root, { recursive: true, force: true });
+  }
+});
+
+test("resolveDeployKey ignores blank env and file tokens", async () => {
+  const root = await mkdtemp(join(tmpdir(), "rd-key-blank-"));
+  const previous = process.env.ROBODEV_DEPLOY_KEY;
+  try {
+    process.env.ROBODEV_DEPLOY_KEY = "   ";
+    await mkdir(join(root, "robodev"), { recursive: true });
+    await writeFile(
+      join(root, "robodev/.robodev"),
+      `${JSON.stringify({ projectId: "prj-1", apiUrl: "https://a.example", deployToken: "  " }, null, 2)}\n`,
+    );
+    assert.equal(await resolveDeployKey(root), null);
+    delete process.env.ROBODEV_DEPLOY_KEY;
+    assert.equal(await resolveDeployKey(root), null);
+  } finally {
+    if (previous === undefined) delete process.env.ROBODEV_DEPLOY_KEY;
+    else process.env.ROBODEV_DEPLOY_KEY = previous;
+    await rm(root, { recursive: true, force: true });
+  }
+});
+
 test("readLink prefers robodev/.robodev over a legacy root file", async () => {
   const root = await mkdtemp(join(tmpdir(), "rd-link-pref-"));
   try {

package/src/config.ts

@@ -145,6 +145,23 @@ export async function readLink(cwd = process.cwd()): Promise<ProjectLink | null>
   return link;
 }
 
+function trimNonEmpty(value: unknown): string | null {
+  if (typeof value !== "string") return null;
+  const trimmed = value.trim();
+  return trimmed.length > 0 ? trimmed : null;
+}
+
+/**
+ * Headless deploy credential. `ROBODEV_DEPLOY_KEY` wins over `deployToken` in the link file.
+ * Does not read or write `~/.robodev/credentials.json`. Never persist the env value.
+ */
+export async function resolveDeployKey(cwd = process.cwd()): Promise<string | null> {
+  const fromEnv = trimNonEmpty(process.env.ROBODEV_DEPLOY_KEY);
+  if (fromEnv) return fromEnv;
+  const raw = await readLinkJson(cwd);
+  return trimNonEmpty(raw?.deployToken);
+}
+
 export async function writeLink(link: ProjectLink, cwd = process.cwd()): Promise<void> {
   const existing = (await readLinkJson(cwd)) ?? {};
   const next: Record<string, unknown> = {

package/src/index.ts

@@ -6,7 +6,7 @@ import { stdin, stdout } from "node:process";
 import { basename, join, relative, resolve } from "node:path";
 import { execFile, spawn } from "node:child_process";
 import { promisify } from "node:util";
-import { ApiError, authed, publicRequest } from "./api.js";
+import { ApiError, authed, deployKeyRequest, publicRequest } from "./api.js";
 import {
   clearCredentials,
   defaultFrontendConfig,
@@ -16,6 +16,7 @@ import {
   type ProjectLink,
   readLink,
   readLinkJson,
+  resolveDeployKey,
   starbaseUrl,
   writeCredentials,
   writeLink,
@@ -45,6 +46,7 @@ import {
 import { parseCreateArgs } from "./parse-create-args.js";
 import { parseDeployArgs } from "./parse-deploy-args.js";
 import { ensureDeployLink } from "./ensure-deploy-link.js";
+import { DEPLOY_NOT_AUTHENTICATED_MESSAGE, resolveDeployAuth } from "./resolve-deploy-auth.js";
 import { runLoad } from "./load.js";
 import { runMcp } from "./mcp.js";
 import { printLiveUrl } from "./print-live-url.js";
@@ -63,7 +65,7 @@ Commands:
   projects             List your projects
   create [path] [--template <id>] [--starter <id>] [--empty] [--org <id>]  Create a project, scaffold a starter, and deploy
   link [projectId]     Write robodev/.robodev in the current folder
-  deploy [--force] [--name <name>] [--org <id>]  Deploy schema, APIs, jobs, and frontend (creates and links if unlinked)
+  deploy [--force] [--name <name>] [--org <id>]  Deploy schema, APIs, jobs, and frontend (JWT, ROBODEV_DEPLOY_KEY, or file deployToken)
   load                 Download the project source onto this folder
   dev [options]        Run this project's APIs locally on an embedded Postgres, no Starbase needed
   mcp [--project <id>] Serve this project's backend over MCP on stdio, for an external coding agent
@@ -236,6 +238,8 @@ type DeployOptions = {
   root?: string;
   frontendFiles?: CollectedFile[];
   skipFrontendBuild?: boolean;
+  /** `robodev create` stays JWT-only even if a leftover CI key is in the environment. */
+  auth?: "auto" | "jwt";
 };
 
 async function collectDeployPayload(
@@ -266,6 +270,21 @@ async function collectDeployPayload(
   return { files: mergeCollectedFiles(host, frontendFiles), source };
 }
 
+async function deployAuthed<T>(path: string, init?: RequestInit): Promise<T> {
+  try {
+    return await authed<T>(path, init);
+  } catch (error) {
+    if (error instanceof Error && error.message.startsWith("Not authenticated.")) {
+      throw new Error(DEPLOY_NOT_AUTHENTICATED_MESSAGE);
+    }
+    throw error;
+  }
+}
+
+async function ensureJwtForDeploy(): Promise<void> {
+  await deployAuthed("/v1/auth/me");
+}
+
 /** Uploads schema, APIs, and frontend. Destructive schema changes need confirmation or `--force`. */
 async function runDeploy(
   forceFlag: boolean,
@@ -273,34 +292,43 @@ async function runDeploy(
   flags: { name?: string; orgId?: string } = {},
 ): Promise<string | undefined> {
   const root = options.root ?? process.cwd();
-  const link = await ensureDeployLink(
-    { root, name: flags.name, orgId: flags.orgId, isTty: Boolean(stdin.isTTY) },
-    {
-      readLink,
-      collectFiles,
-      ensureAuth: async () => {
-        await authed("/v1/auth/me");
-      },
-      resolveOrganization,
-      createProject: (body) =>
-        authed<Project>("/v1/projects", {
-          method: "POST",
-          body: JSON.stringify(body),
-        }),
-      writeLink,
-      writeViteApiUrl,
-      hasAppsFePackageJson,
-      starbaseUrl,
-      projectNameFromPath,
-      promptName: (defaultName) => prompt(`Project name [${defaultName}]: `),
-    },
-  );
+  const auth =
+    options.auth === "jwt"
+      ? { kind: "jwt" as const }
+      : await resolveDeployAuth(root, { resolveDeployKey, readLink });
+  const link =
+    auth.kind === "key"
+      ? auth.link
+      : await ensureDeployLink(
+          { root, name: flags.name, orgId: flags.orgId, isTty: Boolean(stdin.isTTY) },
+          {
+            readLink,
+            collectFiles,
+            ensureAuth: ensureJwtForDeploy,
+            resolveOrganization,
+            createProject: (body) =>
+              authed<Project>("/v1/projects", {
+                method: "POST",
+                body: JSON.stringify(body),
+              }),
+            writeLink,
+            writeViteApiUrl,
+            hasAppsFePackageJson,
+            starbaseUrl,
+            projectNameFromPath,
+            promptName: (defaultName) => prompt(`Project name [${defaultName}]: `),
+          },
+        );
+  const request =
+    auth.kind === "key"
+      ? <T>(path: string, init?: RequestInit) => deployKeyRequest<T>(path, auth.key, init)
+      : deployAuthed;
   const { files, source } = await collectDeployPayload(root, link, options);
   let force = forceFlag;
 
   for (;;) {
     try {
-      const result = await authed<{
+      const result = await request<{
         deploymentId: string;
         databaseName: string;
         databaseCreated?: boolean;
@@ -637,7 +665,12 @@ async function runCreate(args: string[]): Promise<void> {
       skipFrontendBuild = true;
     }
   }
-  const liveUrl = await runDeploy(false, { root, frontendFiles, skipFrontendBuild });
+  const liveUrl = await runDeploy(false, {
+    root,
+    frontendFiles,
+    skipFrontendBuild,
+    auth: "jwt",
+  });
 
   try {
     await pnpmInstall(root);

package/src/resolve-deploy-auth.test.ts

@@ -0,0 +1,65 @@
+import assert from "node:assert/strict";
+import { test } from "node:test";
+import type { ProjectLink } from "./config.js";
+import {
+  DEPLOY_NOT_AUTHENTICATED_MESSAGE,
+  resolveDeployAuth,
+  UNLINKED_DEPLOY_KEY_MESSAGE,
+} from "./resolve-deploy-auth.js";
+
+const link: ProjectLink = {
+  projectId: "proj_1",
+  apiUrl: "https://robodev.povio.dev",
+  projectApiUrl: "https://proj_1.robodev.povio.dev",
+};
+
+test("resolveDeployAuth uses a key and existing link without creating", async () => {
+  const auth = await resolveDeployAuth("/tmp/app", {
+    resolveDeployKey: async () => "rdb_secret",
+    readLink: async () => link,
+  });
+  assert.deepEqual(auth, { kind: "key", key: "rdb_secret", link });
+});
+
+test("resolveDeployAuth refuses an unlinked key deploy", async () => {
+  await assert.rejects(
+    () =>
+      resolveDeployAuth("/tmp/unlinked", {
+        resolveDeployKey: async () => "rdb_secret",
+        readLink: async () => null,
+      }),
+    (error: unknown) => {
+      assert.ok(error instanceof Error);
+      assert.equal(error.message, UNLINKED_DEPLOY_KEY_MESSAGE);
+      assert.match(error.message, /cannot create projects/);
+      assert.match(error.message, /robodev\/\.robodev/);
+      return true;
+    },
+  );
+});
+
+test("resolveDeployAuth falls through to JWT when no key is resolved", async () => {
+  const auth = await resolveDeployAuth("/tmp/app", {
+    resolveDeployKey: async () => null,
+    readLink: async () => null,
+  });
+  assert.deepEqual(auth, { kind: "jwt" });
+});
+
+test("resolveDeployAuth prefers a key over an existing link that a JWT could also use", async () => {
+  const auth = await resolveDeployAuth("/tmp/app", {
+    resolveDeployKey: async () => "rdb_env",
+    readLink: async () => link,
+  });
+  assert.equal(auth.kind, "key");
+  if (auth.kind === "key") {
+    assert.equal(auth.key, "rdb_env");
+  }
+});
+
+test("deploy not-authenticated copy mentions auth, env, and file token — not load", () => {
+  assert.match(DEPLOY_NOT_AUTHENTICATED_MESSAGE, /robodev auth/);
+  assert.match(DEPLOY_NOT_AUTHENTICATED_MESSAGE, /ROBODEV_DEPLOY_KEY/);
+  assert.match(DEPLOY_NOT_AUTHENTICATED_MESSAGE, /deployToken/);
+  assert.equal(DEPLOY_NOT_AUTHENTICATED_MESSAGE.includes("load"), false);
+});

package/src/resolve-deploy-auth.ts

@@ -0,0 +1,31 @@
+import type { ProjectLink } from "./config.js";
+
+export const UNLINKED_DEPLOY_KEY_MESSAGE =
+  "A deploy key cannot create projects. Link first (`robodev auth` + `robodev link` / `create`) or provide robodev/.robodev with projectId and apiUrl (no token required when ROBODEV_DEPLOY_KEY is set).";
+
+export const DEPLOY_NOT_AUTHENTICATED_MESSAGE =
+  "Not authenticated. Run `robodev auth`, set ROBODEV_DEPLOY_KEY, or add deployToken to robodev/.robodev.";
+
+export type DeployAuth = { kind: "key"; key: string; link: ProjectLink } | { kind: "jwt" };
+
+export type ResolveDeployAuthDeps = {
+  resolveDeployKey: (cwd: string) => Promise<string | null>;
+  readLink: (cwd: string) => Promise<ProjectLink | null>;
+};
+
+/**
+ * Key deploy (env or file token) requires an existing link and never creates a project.
+ * No key → JWT path, including unlinked create-and-link.
+ */
+export async function resolveDeployAuth(
+  root: string,
+  deps: ResolveDeployAuthDeps,
+): Promise<DeployAuth> {
+  const key = await deps.resolveDeployKey(root);
+  if (!key) return { kind: "jwt" };
+  const link = await deps.readLink(root);
+  if (!link) {
+    throw new Error(UNLINKED_DEPLOY_KEY_MESSAGE);
+  }
+  return { kind: "key", key, link };
+}

package/templates/auth-chat/ROBODEV.md

@@ -32,6 +32,10 @@ export const get = defineApi({
 - Publish backend after a batch of file edits, not after every file.
 - Do not publish the frontend.
 
+## Auth and product data
+
+Persist primary product data with `defineApi` and `robodev-publish be`. Do not use localStorage as the product store unless the user asked for a public, static, or no-account page. Auth is on by default: add login and register and protect routes unless the product is public or unauthenticated. Use `auth: "required"` and `ctx.user.id`. Call reserved `/api/user/auth/*` — do not implement `api/user/**`. Tiny: reuse seed login/register and AuthGuard. Shadcn, Empty, and legacy: create login/register with `@robodev-ai/client` tokens. A missing `.rulesync` skill is not a reason to skip APIs. Do not require `robodev-auth set` every run.
+
 ## Backend
 
 - Auth: robodev-auth get / set / users / users-delete. Do not invent control-plane HTTP.

package/templates/auth-chat/package.json

@@ -12,7 +12,7 @@
     "@robodev-ai/sdk": "^0.13.0"
   },
   "devDependencies": {
-    "robodev": "^0.47.1",
+    "robodev": "^0.47.2",
     "rulesync": "^8.18.0",
     "typescript": "^5.9.2"
   }

package/templates/backend/ROBODEV.md

@@ -32,6 +32,10 @@ export const get = defineApi({
 - Publish backend after a batch of file edits, not after every file.
 - Do not publish the frontend.
 
+## Auth and product data
+
+Persist primary product data with `defineApi` and `robodev-publish be`. Do not use localStorage as the product store unless the user asked for a public, static, or no-account page. Auth is on by default: add login and register and protect routes unless the product is public or unauthenticated. Use `auth: "required"` and `ctx.user.id`. Call reserved `/api/user/auth/*` — do not implement `api/user/**`. Tiny: reuse seed login/register and AuthGuard. Shadcn, Empty, and legacy: create login/register with `@robodev-ai/client` tokens. A missing `.rulesync` skill is not a reason to skip APIs. Do not require `robodev-auth set` every run.
+
 ## Backend
 
 - Auth: robodev-auth get / set / users / users-delete. Do not invent control-plane HTTP.

package/templates/backend/package.json

@@ -11,7 +11,7 @@
     "@robodev-ai/sdk": "^0.13.0"
   },
   "devDependencies": {
-    "robodev": "^0.47.1",
+    "robodev": "^0.47.2",
     "typescript": "^5.9.2"
   }
 }

package/templates/empty/README.md

@@ -2,7 +2,7 @@
 
 Blank `robodev/database.ts` and `GET /api/health` plus a hosted Welcome page. No sample schema.
 
-The project App URL serves the hosted Welcome page. Edit `index.html` and `src/`, then `robodev deploy` (or Code + Save). Agents: read `ROBODEV.md`.
+The project App URL serves the hosted Welcome page. Edit `index.html` and `src/`, then `robodev deploy` (or Code + Save). Agents: read `ROBODEV.md`. Unless the product is a public page, add login/register via reserved `/api/user/auth/*` and protect routes.
 
 ```bash
 robodev create my-app

package/templates/empty/ROBODEV.md

@@ -32,6 +32,10 @@ export const get = defineApi({
 - Publish backend after a batch of file edits, not after every file.
 - Do not publish the frontend.
 
+## Auth and product data
+
+Persist primary product data with `defineApi` and `robodev-publish be`. Do not use localStorage as the product store unless the user asked for a public, static, or no-account page. Auth is on by default: add login and register and protect routes unless the product is public or unauthenticated. Use `auth: "required"` and `ctx.user.id`. Call reserved `/api/user/auth/*` — do not implement `api/user/**`. Tiny: reuse seed login/register and AuthGuard. Shadcn, Empty, and legacy: create login/register with `@robodev-ai/client` tokens. A missing `.rulesync` skill is not a reason to skip APIs. Do not require `robodev-auth set` every run.
+
 ## Backend
 
 - Auth: robodev-auth get / set / users / users-delete. Do not invent control-plane HTTP.

package/templates/empty/package.json

@@ -16,7 +16,7 @@
     "react-dom": "^18.3.1"
   },
   "devDependencies": {
-    "robodev": "^0.47.1",
+    "robodev": "^0.47.2",
     "typescript": "^5.9.2",
     "vite": "^6.0.0"
   }

package/templates/marketplace/ROBODEV.md

@@ -32,6 +32,10 @@ export const get = defineApi({
 - Publish backend after a batch of file edits, not after every file.
 - Do not publish the frontend.
 
+## Auth and product data
+
+Persist primary product data with `defineApi` and `robodev-publish be`. Do not use localStorage as the product store unless the user asked for a public, static, or no-account page. Auth is on by default: add login and register and protect routes unless the product is public or unauthenticated. Use `auth: "required"` and `ctx.user.id`. Call reserved `/api/user/auth/*` — do not implement `api/user/**`. Tiny: reuse seed login/register and AuthGuard. Shadcn, Empty, and legacy: create login/register with `@robodev-ai/client` tokens. A missing `.rulesync` skill is not a reason to skip APIs. Do not require `robodev-auth set` every run.
+
 ## Backend
 
 - Auth: robodev-auth get / set / users / users-delete. Do not invent control-plane HTTP.

package/templates/marketplace/package.json

@@ -12,7 +12,7 @@
     "@robodev-ai/sdk": "^0.13.0"
   },
   "devDependencies": {
-    "robodev": "^0.47.1",
+    "robodev": "^0.47.2",
     "rulesync": "^8.18.0",
     "typescript": "^5.9.2"
   }

package/templates/shadcn/README.md

@@ -2,7 +2,7 @@
 
 Blank `robodev/database.ts` and `GET /api/health` plus a hosted Welcome page with shadcn and an orval client. No sample schema.
 
-The project App URL serves the hosted Welcome page (`/` via React Router in `src/pages/Home.tsx`). Edit `index.html` and `src/`, then `robodev deploy` (or Code + Save). Agents: read `ROBODEV.md`.
+The project App URL serves the hosted Welcome page (`/` via React Router in `src/pages/Home.tsx`). Edit `index.html` and `src/`, then `robodev deploy` (or Code + Save). Agents: read `ROBODEV.md`. Unless the product is a public page, add login/register via reserved `/api/user/auth/*` and protect routes.
 
 ```bash
 robodev create my-app --template shadcn

package/templates/shadcn/ROBODEV.md

@@ -32,6 +32,10 @@ export const get = defineApi({
 - Publish backend after a batch of file edits, not after every file.
 - Do not publish the frontend.
 
+## Auth and product data
+
+Persist primary product data with `defineApi` and `robodev-publish be`. Do not use localStorage as the product store unless the user asked for a public, static, or no-account page. Auth is on by default: add login and register and protect routes unless the product is public or unauthenticated. Use `auth: "required"` and `ctx.user.id`. Call reserved `/api/user/auth/*` — do not implement `api/user/**`. Tiny: reuse seed login/register and AuthGuard. Shadcn, Empty, and legacy: create login/register with `@robodev-ai/client` tokens. A missing `.rulesync` skill is not a reason to skip APIs. Do not require `robodev-auth set` every run.
+
 ## Backend
 
 - Auth: robodev-auth get / set / users / users-delete. Do not invent control-plane HTTP.

package/templates/shadcn/package.json

@@ -21,7 +21,7 @@
     "autoprefixer": "^10.4.21",
     "orval": "^7.11.2",
     "postcss": "^8.5.6",
-    "robodev": "^0.47.1",
+    "robodev": "^0.47.2",
     "shadcn": "^2.10.0",
     "tailwindcss": "^3.4.17",
     "typescript": "^5.9.2",

package/templates/space/ROBODEV.md

@@ -32,6 +32,10 @@ export const get = defineApi({
 - Publish backend after a batch of file edits, not after every file.
 - Do not publish the frontend.
 
+## Auth and product data
+
+Persist primary product data with `defineApi` and `robodev-publish be`. Do not use localStorage as the product store unless the user asked for a public, static, or no-account page. Auth is on by default: add login and register and protect routes unless the product is public or unauthenticated. Use `auth: "required"` and `ctx.user.id`. Call reserved `/api/user/auth/*` — do not implement `api/user/**`. Tiny: reuse seed login/register and AuthGuard. Shadcn, Empty, and legacy: create login/register with `@robodev-ai/client` tokens. A missing `.rulesync` skill is not a reason to skip APIs. Do not require `robodev-auth set` every run.
+
 ## Backend
 
 - Auth: robodev-auth get / set / users / users-delete. Do not invent control-plane HTTP.

package/templates/space/package.json

@@ -12,7 +12,7 @@
     "@robodev-ai/sdk": "^0.13.0"
   },
   "devDependencies": {
-    "robodev": "^0.47.1",
+    "robodev": "^0.47.2",
     "rulesync": "^8.18.0",
     "typescript": "^5.9.2"
   }