robodev 0.47.2 → 0.48.0

package/templates/povio/oxfmt.config.js

@@ -0,0 +1,23 @@
+export default {
+  useTabs: false,
+  tabWidth: 2,
+  printWidth: 120,
+  singleQuote: false,
+  jsxSingleQuote: false,
+  quoteProps: "as-needed",
+  trailingComma: "all",
+  semi: true,
+  arrowParens: "always",
+  bracketSameLine: false,
+  bracketSpacing: true,
+  singleAttributePerLine: true,
+  ignorePatterns: [
+    "node_modules",
+    "dist",
+    "out",
+    ".turbo",
+    ".next",
+    "routeTree.gen.ts",
+    "openapi.generated.json",
+  ],
+};

package/templates/povio/package.json

@@ -0,0 +1,19 @@
+{
+  "name": "{{PACKAGE_NAME}}",
+  "version": "0.1.0",
+  "private": true,
+  "type": "module",
+  "scripts": {
+    "dev": "robodev dev --with-fe",
+    "deploy": "robodev deploy",
+    "rules:gen": "rulesync generate"
+  },
+  "dependencies": {
+    "@robodev-ai/sdk": "^0.14.0"
+  },
+  "devDependencies": {
+    "robodev": "^0.48.0",
+    "rulesync": "^8.18.0",
+    "typescript": "^5.9.2"
+  }
+}

package/templates/povio/robodev/api/_lib.ts

@@ -0,0 +1,99 @@
+import { eq } from "@robodev-ai/sdk";
+import type { ApiHandlerContext, UploadedFile } from "@robodev-ai/sdk";
+import { media } from "../database";
+
+export function fail(status: number, message: string) {
+  return { status, body: { message } };
+}
+
+export function iso(value: Date | string | null | undefined): string | null {
+  if (!value) return null;
+  return value instanceof Date ? value.toISOString() : value;
+}
+
+export function requiredIso(value: Date | string | null | undefined): string {
+  return iso(value) ?? new Date().toISOString();
+}
+
+export function paginate<T>(items: T[], page?: number, limit?: number) {
+  const currentPage = page && page > 0 ? page : 1;
+  const currentLimit = limit && limit > 0 ? Math.min(limit, 20) : 20;
+  const start = (currentPage - 1) * currentLimit;
+  const nextPage = currentPage * currentLimit < items.length ? currentPage + 1 : null;
+  return {
+    items: items.slice(start, start + currentLimit),
+    page: currentPage,
+    cursor: String(currentPage),
+    nextCursor: nextPage ? String(nextPage) : null,
+    limit: currentLimit,
+    totalItems: items.length,
+  };
+}
+
+export async function resolveImage(
+  ctx: ApiHandlerContext<unknown, unknown>,
+  imageId: string | null | undefined,
+): Promise<{ id: string; url: string } | null> {
+  if (!imageId) return null;
+  const [row] = await ctx.db.select().from(media).where(eq(media.id, imageId)).limit(1);
+  if (!row?.uploaded) return null;
+  try {
+    const url = await ctx.storage.getUrl(row.key);
+    return { id: row.id, url };
+  } catch {
+    return { id: row.id, url: `/storage/objects/${encodeURIComponent(row.key)}` };
+  }
+}
+
+const ALLOWED_IMAGE_TYPES = new Set(["image/jpeg", "image/png", "image/webp"]);
+const MAX_IMAGE_BYTES = 2 * 1024 * 1024;
+
+/** Matches dashboard sanitizeFilename / KEY_RE. */
+function sanitizeFilename(name: string): string {
+  const base = name.split(/[/\\]/).pop() ?? "";
+  return base.replace(/[^A-Za-z0-9._-]+/g, "-").replace(/-+/g, "-").replace(/^-|-$/g, "").slice(0, 80);
+}
+
+/** Store an uploaded image in Robodev storage and record it in the media table. */
+export async function saveImage(
+  ctx: ApiHandlerContext<unknown, unknown>,
+  file: UploadedFile,
+  resourceName: string,
+): Promise<{ id: string } | ReturnType<typeof fail>> {
+  const mimeType = file.mimetype || "application/octet-stream";
+  if (file.data.length > MAX_IMAGE_BYTES) {
+    return fail(400, "File is too large");
+  }
+  if (!ALLOWED_IMAGE_TYPES.has(mimeType)) {
+    return fail(400, "Unsupported image type");
+  }
+
+  const fileName = file.filename || "image";
+  const safe = sanitizeFilename(fileName) || "image";
+  const key = `${resourceName}s/${ctx.user!.id}/${crypto.randomUUID()}-${safe}`;
+  const [row] = await ctx.db
+    .insert(media)
+    .values({
+      key,
+      userId: ctx.user!.id,
+      resourceName,
+      fileName,
+      fileSize: file.data.length,
+      mimeType,
+    })
+    .returning();
+
+  try {
+    await ctx.storage.upload(row!.key, file.data, {
+      public: true,
+      contentType: mimeType,
+    });
+  } catch (error) {
+    return fail(503, error instanceof Error ? error.message : "Storage is not configured");
+  }
+
+  await ctx.db.update(media).set({ uploaded: new Date() }).where(eq(media.id, row!.id));
+  return { id: row!.id };
+}
+
+export { media };

package/templates/povio/robodev/api/health.ts

@@ -0,0 +1,7 @@
+/** GET /api/health — liveness check for the deployed project host. */
+import { defineApi, z } from "@robodev-ai/sdk";
+
+export const get = defineApi({
+  response: z.object({ ok: z.literal(true) }),
+  handler: async () => ({ ok: true as const }),
+});

package/templates/povio/robodev/database.ts

@@ -0,0 +1,28 @@
+/**
+ * Placeholder schema. Replace the items table or add tables, then publish.
+ * Keep the media table if the product needs file uploads (see the
+ * media-feature skill).
+ */
+import { defineDatabase, integer, pgTable, text, timestamp, uuid } from "@robodev-ai/sdk";
+
+export const items = pgTable("items", {
+  id: uuid("id").primaryKey().defaultRandom(),
+  name: text("name").notNull(),
+});
+
+export const media = pgTable("media", {
+  id: uuid("id").primaryKey().defaultRandom(),
+  key: text("key").notNull(),
+  userId: text("userId").notNull(),
+  resourceName: text("resourceName").notNull(),
+  fileName: text("fileName").notNull(),
+  fileSize: integer("fileSize").notNull(),
+  mimeType: text("mimeType").notNull(),
+  uploaded: timestamp("uploaded", { withTimezone: true }),
+  createdAt: timestamp("createdAt", { withTimezone: true }).defaultNow(),
+});
+
+export default defineDatabase({
+  name: "app",
+  tables: { items, media },
+});

package/templates/povio/robodev/package.json

@@ -0,0 +1,4 @@
+{
+  "private": true,
+  "dependencies": {}
+}

package/templates/povio/rulesync.jsonc

@@ -0,0 +1,18 @@
+{
+  "$schema": "https://github.com/dyoshikawa/rulesync/releases/latest/download/config-schema.json",
+  "targets": {
+    "cursor": ["rules", "skills"],
+    "claudecode": ["rules", "skills"],
+    "codexcli": ["rules", "skills"],
+  },
+  "outputRoots": ["."],
+  // Clean stale outputs when source rules are removed. All sources live under .rulesync/.
+  "delete": true,
+  "verbose": false,
+  "silent": false,
+  "global": false,
+  "simulateCommands": false,
+  "simulateSubagents": false,
+  "simulateSkills": false,
+  "gitignoreTargetsOnly": true,
+}

package/templates/povio/tsconfig.json

@@ -0,0 +1,11 @@
+{
+  "compilerOptions": {
+    "target": "ES2022",
+    "module": "ESNext",
+    "moduleResolution": "bundler",
+    "strict": true,
+    "skipLibCheck": true,
+    "noEmit": true
+  },
+  "include": ["robodev/**/*.ts"]
+}

package/templates/shadcn/.rulesync/rules/frontend-api-boundary.md

@@ -0,0 +1,29 @@
+---
+root: false
+targets: ["claudecode", "codexcli", "cursor"]
+description: "Frontend calls app APIs through the shared client, not raw fetch."
+globs: ["src/**/*.{ts,tsx}"]
+cursor:
+  alwaysApply: false
+  description: "Apply when frontend code calls the API."
+  globs: ["src/**/*.{ts,tsx}"]
+---
+
+# Frontend API Boundary
+
+Call app APIs through `client` from `@/lib/client`:
+
+```ts
+import { client } from "@/lib/client";
+
+const todos = await client.get<Todo[]>("/api/todos");
+const created = await client.post<Todo>("/api/todos", { title });
+await client.put(`/api/todos/${id}`, { done: true });
+await client.del(`/api/todos/${id}`);
+```
+
+- `client` adds the `Authorization` header and refreshes tokens on 401. Never call `fetch()` on `/api/...` directly and never build your own token handling.
+- Define response types next to the feature (or a shared `src/types.ts`) and pass them as the generic parameter.
+- Do not import `@robodev-ai/sdk`, `robodev/database.ts`, or anything from `robodev/` into `src/` — backend and frontend never share code.
+- The committed orval client under `src/api/generated/` serves the seed `getHealth` call and optional local regeneration (`pnpm run generate:api`); it does not send auth headers, so do not add authenticated endpoints to it.
+- After changing API contracts, update the frontend calls in the same batch so the preview keeps rendering.

package/templates/shadcn/.rulesync/rules/frontend-component-structure.md

@@ -0,0 +1,19 @@
+---
+root: false
+targets: ["claudecode", "codexcli", "cursor"]
+description: "Frontend page, feature, and component file structure."
+globs: ["src/**/*.{ts,tsx}"]
+cursor:
+  alwaysApply: false
+  description: "Apply when organizing frontend components and pages."
+  globs: ["src/**/*.{ts,tsx}"]
+---
+
+# Frontend Component Structure
+
+- Pages live in `src/pages/<Name>.tsx` and are wired in `src/App.tsx` with a `<Route>`. Protected pages wrap in `AuthGuard`.
+- Reusable primitives stay in `src/components/ui/`. Feature components live in `src/components/<feature>/` (for example `src/components/todos/TodoRow.tsx`).
+- Every named component gets its own file. Anything mapped from an array (cards, table rows, list items) should be a component.
+- Pages own routing concerns and data loading; feature components own the UI and interactions.
+- Generic formatting/parsing helpers go in `src/lib/` (for example `src/lib/format.ts`), not inside component files.
+- Ship in small vertical slices: land one route end to end (schema → API → page → route) before starting the next, so the preview keeps rendering.

package/templates/shadcn/.rulesync/rules/frontend-hosted-ui.md

@@ -0,0 +1,38 @@
+---
+root: false
+targets: ["claudecode", "codexcli", "cursor"]
+description: "Hosted UI kit: app.css tokens and src/components/ui primitives. No Tailwind."
+globs: ["src/**/*.{ts,tsx,css}"]
+cursor:
+  alwaysApply: false
+  description: "Apply when building or styling frontend UI."
+  globs: ["src/**/*.{ts,tsx,css}"]
+---
+
+# Hosted UI Kit
+
+There is **no Tailwind**. The hosted compile bundles CSS as-is: every class must exist in `src/app.css`. A class that is not defined there silently renders unstyled.
+
+## Components (import from `@/components/ui/<file>`)
+
+- `Button` (`variant`: default | destructive | outline | secondary | ghost | link; `size`: default | sm | lg | icon)
+- `Input`, `Textarea`, `Label`
+- `Card`, `CardHeader`, `CardTitle`, `CardDescription`, `CardContent`, `CardFooter`
+- `Badge` (`variant`: default | secondary | destructive | outline)
+- `Table`, `TableHeader`, `TableBody`, `TableRow`, `TableHead`, `TableCell`
+- `Dialog` (`{ open, onClose, title?, footer? }`, controlled)
+- `Skeleton`, `Spinner`, `EmptyState` (`{ title, description?, action? }`)
+
+## Layout and text classes (already in app.css)
+
+- `.page` (centered max-width container), `.page-header` + `.page-title`
+- `.stack` (column, 1rem gap), `.row` (inline, 0.5rem gap)
+- `.field` (label + input + error), `.field-error`, `.muted`
+- `.auth-page` + `.auth-card` for full-screen centered forms
+
+## Rules
+
+- Compose screens from these primitives plus the layout classes. Form rows are `<div className="field"><Label/><Input/></div>` inside a `.stack` form.
+- New visual treatment = add a class to `src/app.css` using the `hsl(var(--token))` color variables. Do not inline hex colors or long `style={{...}}` objects.
+- Tokens: `--background/foreground`, `--card`, `--popover`, `--primary`, `--secondary`, `--muted`, `--accent`, `--destructive` (each with `-foreground`), `--border`, `--input`, `--ring`, `--radius`. Dark mode = `.dark` class on `<html>` or `<body>`.
+- Loading uses `Skeleton` or `Spinner`; no-data uses `EmptyState` with an action button. Never leave a bare "no items" paragraph.

package/templates/shadcn/.rulesync/rules/project-overview.md

@@ -0,0 +1,29 @@
+---
+root: true
+targets: ["claudecode", "codexcli", "cursor"]
+description: "Hosted Shadcn project overview and source-of-truth guidance."
+globs: ["**/*"]
+cursor:
+  alwaysApply: true
+  description: "Hosted Shadcn project overview and source-of-truth guidance."
+  globs: ["**/*"]
+---
+
+# Hosted Shadcn seed AI rules
+
+This project is a hosted React frontend (root `index.html` + `src/**`) plus a Robodev backend under `robodev/` (`robodev/database.ts` + `robodev/api/**/*.ts` using `@robodev-ai/sdk`). Keep this layout. Do not convert this tree to Tiny (`packages/be` + `apps/fe`).
+
+The hosted compile is esbuild only — **no Tailwind, no PostCSS**. Every CSS class used in `src/` must be defined in `src/app.css`. There is no Tailwind anywhere in this tree; do not write utility classes like `flex` or `p-4`.
+
+Frontend packages on the hosted live app are only: `react`, `react-dom`, `react-router-dom`, `@robodev-ai/client`. Importing anything else in `src/` fails the hosted build.
+
+Auth is seeded and reserved on the project host at `/api/user/*`: reuse `src/lib/client.ts`, `src/lib/auth.tsx` (`AuthProvider`, `useAuth`, `AuthGuard`), `src/pages/Login.tsx`, `src/pages/Register.tsx`.
+
+Use the more specific rules for:
+
+- Robodev `defineDatabase` tables in `robodev/database.ts`.
+- Robodev `defineApi` routes in `robodev/api/`.
+- Reserved `/api/user/*` auth contracts and the seeded auth files.
+- The frontend API boundary (`client` from `@/lib/client`).
+- The hosted UI kit in `src/components/ui` and `src/app.css` tokens.
+- Component and page structure.

package/templates/shadcn/.rulesync/rules/robodev-api.md

@@ -0,0 +1,22 @@
+---
+root: false
+targets: ["claudecode", "codexcli", "cursor"]
+description: "Robodev defineApi file routes and handler conventions."
+globs: ["robodev/api/**/*.ts"]
+cursor:
+  alwaysApply: false
+  description: "Apply when editing Robodev API routes."
+  globs: ["robodev/api/**/*.ts"]
+---
+
+# Robodev API
+
+Project APIs live in `robodev/api/`. The route is the file path: `robodev/api/foo.ts` → `/api/foo`, `robodev/api/foo/[id].ts` → `/api/foo/:id`.
+
+- Export `get` / `post` / `put` / `patch` / `delete` as `defineApi(...)` from `@robodev-ai/sdk`.
+- Shared helpers belong in `robodev/api/_lib.ts`. Do not export `defineApi` handlers from `_lib.ts`.
+- Do not add `robodev/api/user/**`. Those paths are reserved for Robodev Auth.
+- Use `auth: "required"` on routes that belong to a signed-in user, and scope rows by `ctx.user.id`.
+- Handler context includes `db`, `user`, `email`, `storage`, `env`, `params`, `query`, `body`. These are injected — never `import { db } from "@robodev-ai/sdk"`.
+- Return JSON for 200, or `{ status, body }` for errors (400/403/404).
+- After a batch of API or schema edits, run `robodev-publish be` so the APIs go live.

package/templates/shadcn/.rulesync/rules/robodev-auth.md

@@ -0,0 +1,47 @@
+---
+root: false
+targets: ["claudecode", "codexcli", "cursor"]
+description: "Reserved Robodev /api/user auth contracts and the seeded auth files."
+globs: ["**/*.ts", "src/**/*.{ts,tsx}"]
+cursor:
+  alwaysApply: false
+  description: "Apply when touching auth, login, register, or /api/user clients."
+  globs:
+    [
+      "robodev/database.ts",
+      "robodev/api/**/*.ts",
+      "src/lib/**/*.{ts,tsx}",
+      "src/pages/Login.tsx",
+      "src/pages/Register.tsx",
+    ]
+---
+
+# Robodev Auth
+
+End-user auth is reserved on the project host. Do not implement `api/user/**` in this project.
+
+**Auth is already seeded — reuse it, never rebuild it:**
+
+- `src/lib/client.ts` — same-origin `createClient` that stores tokens, sends `Authorization`, and refreshes on 401.
+- `src/lib/auth.tsx` — `AuthProvider` (mounted in `App.tsx`), `useAuth()`, and `AuthGuard`.
+- `src/pages/Login.tsx` / `src/pages/Register.tsx` — working forms. Restyle them; do not reimplement token handling.
+
+Protect a route: `<Route path="/todos" element={<AuthGuard><TodosPage /></AuthGuard>} />`.
+
+## Contracts
+
+| Method  | Path                                      | Notes                                                   |
+| ------- | ----------------------------------------- | ------------------------------------------------------- |
+| POST    | `/api/user/auth/login`                    | `{ email, password }` → `{ accessToken, refreshToken }` |
+| POST    | `/api/user/auth/register`                 | password min 12, 201, token pair                        |
+| POST    | `/api/user/auth/refresh`                  | `{ refreshToken }` → new pair                           |
+| GET     | `/api/user/auth/magic-link`               | query `email`, generic status                           |
+| GET     | `/api/user/auth/magic-link/callback`      | query `code` → tokens                                   |
+| POST    | `/api/user/auth/forgot-password`          | `{ email }`                                             |
+| POST    | `/api/user/auth/forgot-password/callback` | `{ code, password }`                                    |
+| GET     | `/api/user/auth/google`                   | start OAuth; `redirect_uri` required                    |
+| GET/PUT | `/api/user/me`                            | flat `{ id, name, email }`                              |
+
+Access tokens last 15 minutes, refresh tokens 30 days. `client` handles both — never touch localStorage for tokens yourself.
+
+Error `code` is top-level: `invalid-credentials`, `identity-already-exists`, `identity-not-found`, `nonce-invalid`.

package/templates/shadcn/.rulesync/rules/robodev-database.md

@@ -0,0 +1,21 @@
+---
+root: false
+targets: ["claudecode", "codexcli", "cursor"]
+description: "Robodev database.ts Drizzle schema and deploy sync."
+globs: ["robodev/database.ts"]
+cursor:
+  alwaysApply: false
+  description: "Apply when editing the database schema."
+  globs: ["robodev/database.ts"]
+---
+
+# Robodev Database
+
+The schema lives in `robodev/database.ts`. Default-export `defineDatabase` with Drizzle `pgTable` definitions. `robodev-publish be` syncs it; there are no migration files.
+
+- Import table helpers from `@robodev-ai/sdk` (`pgTable`, `uuid`, `text`, `timestamp`, `integer`, and query helpers).
+- Do not recreate User or auth tables. End users live in platform auth. Store `userId` as `text` matching `ctx.user.id`.
+- The seeded `items` table is a placeholder — replace it with the product's real tables.
+- Export named tables so API files can import them from `../database`.
+- Prefer scalar columns and foreign keys. Destructive drops need deploy confirmation or `--force`.
+- Schema changes only via this file + publish — never DDL in SQL.

package/templates/shadcn/.rulesync/skills/robodev-crud-page/SKILL.md

@@ -0,0 +1,181 @@
+---
+name: robodev-crud-page
+description: Build a list-create-edit-delete page for a database table in the hosted Shadcn layout. Use it whenever a request needs a page that lists records and lets the user add, change, or remove them — a table page, an admin screen, a CRUD feature, a "manage X" page.
+---
+
+# Add a CRUD page (hosted Shadcn layout)
+
+Four files per resource, in this order. `todos` is the running example.
+
+## 1. Table — `robodev/database.ts`
+
+```ts
+import { defineDatabase, pgTable, text, uuid, boolean, timestamp } from "@robodev-ai/sdk";
+
+export const todos = pgTable("todos", {
+  id: uuid("id").primaryKey().defaultRandom(),
+  userId: text("user_id").notNull(),
+  title: text("title").notNull(),
+  done: boolean("done").notNull().default(false),
+  createdAt: timestamp("created_at").notNull().defaultNow(),
+});
+
+export default defineDatabase({ name: "app", tables: { todos } });
+```
+
+## 2. Routes — `robodev/api/todos.ts` and `robodev/api/todos/[id].ts`
+
+```ts
+// robodev/api/todos.ts
+import { defineApi, z, eq, desc } from "@robodev-ai/sdk";
+import { todos } from "../database";
+
+export const get = defineApi({
+  auth: "required",
+  response: z.array(z.object({ id: z.string(), title: z.string(), done: z.boolean() })),
+  handler: async ({ db, user }) =>
+    db.select().from(todos).where(eq(todos.userId, user.id)).orderBy(desc(todos.createdAt)),
+});
+
+export const post = defineApi({
+  auth: "required",
+  body: z.object({ title: z.string().min(1) }),
+  response: z.object({ id: z.string(), title: z.string(), done: z.boolean() }),
+  handler: async ({ db, user, body }) => {
+    const [row] = await db.insert(todos).values({ userId: user.id, title: body.title }).returning();
+    return row;
+  },
+});
+```
+
+```ts
+// robodev/api/todos/[id].ts
+import { defineApi, z, and, eq } from "@robodev-ai/sdk";
+import { todos } from "../../database";
+
+const owned = (userId: string, id: string) => and(eq(todos.userId, userId), eq(todos.id, id));
+
+export const put = defineApi({
+  auth: "required",
+  body: z.object({ title: z.string().min(1).optional(), done: z.boolean().optional() }),
+  response: z.object({ id: z.string(), title: z.string(), done: z.boolean() }),
+  handler: async ({ db, user, params, body }) => {
+    const [row] = await db.update(todos).set(body).where(owned(user.id, params.id)).returning();
+    if (!row) return { status: 404, body: { message: "Not found" } };
+    return row;
+  },
+});
+
+const remove = defineApi({
+  auth: "required",
+  response: z.object({ ok: z.literal(true) }),
+  handler: async ({ db, user, params }) => {
+    await db.delete(todos).where(owned(user.id, params.id));
+    return { ok: true as const };
+  },
+});
+// `delete` is a reserved word: define under another name, export as `delete`.
+export { remove as delete };
+```
+
+Then `robodev-publish be`.
+
+## 3. Page — `src/pages/Todos.tsx`
+
+List with `Table`, create/edit in a `Dialog` form (`.field` rows), `EmptyState` when the list is empty, `Skeleton` while loading, all data through `client`:
+
+```tsx
+import { useEffect, useState } from "react";
+import { client } from "@/lib/client";
+import { Button } from "@/components/ui/button";
+import { Dialog } from "@/components/ui/dialog";
+import { EmptyState } from "@/components/ui/empty-state";
+import { Input } from "@/components/ui/input";
+import { Label } from "@/components/ui/label";
+import { Skeleton } from "@/components/ui/skeleton";
+import { Table, TableBody, TableCell, TableHead, TableHeader, TableRow } from "@/components/ui/table";
+
+type Todo = { id: string; title: string; done: boolean };
+
+export function Todos() {
+  const [todos, setTodos] = useState<Todo[] | null>(null);
+  const [open, setOpen] = useState(false);
+  const [title, setTitle] = useState("");
+
+  async function load() {
+    setTodos(await client.get<Todo[]>("/api/todos"));
+  }
+  useEffect(() => {
+    void load();
+  }, []);
+
+  async function create() {
+    await client.post("/api/todos", { title });
+    setTitle("");
+    setOpen(false);
+    await load();
+  }
+
+  return (
+    <div className="page">
+      <div className="page-header">
+        <h1 className="page-title">Todos</h1>
+        <Button onClick={() => setOpen(true)}>New todo</Button>
+      </div>
+      {todos === null ? (
+        <div className="stack">
+          <Skeleton style={{ height: "2.5rem" }} />
+          <Skeleton style={{ height: "2.5rem" }} />
+        </div>
+      ) : todos.length === 0 ? (
+        <EmptyState
+          title="No todos yet"
+          description="Create your first todo to get started."
+          action={<Button onClick={() => setOpen(true)}>New todo</Button>}
+        />
+      ) : (
+        <Table>
+          <TableHeader>
+            <TableRow>
+              <TableHead>Title</TableHead>
+              <TableHead>Status</TableHead>
+            </TableRow>
+          </TableHeader>
+          <TableBody>
+            {todos.map((todo) => (
+              <TableRow key={todo.id}>
+                <TableCell>{todo.title}</TableCell>
+                <TableCell>{todo.done ? "Done" : "Open"}</TableCell>
+              </TableRow>
+            ))}
+          </TableBody>
+        </Table>
+      )}
+      <Dialog
+        open={open}
+        onClose={() => setOpen(false)}
+        title="New todo"
+        footer={
+          <>
+            <Button variant="outline" onClick={() => setOpen(false)}>Cancel</Button>
+            <Button onClick={() => void create()}>Create</Button>
+          </>
+        }
+      >
+        <div className="field">
+          <Label htmlFor="title">Title</Label>
+          <Input id="title" value={title} onChange={(e) => setTitle(e.target.value)} />
+        </div>
+      </Dialog>
+    </div>
+  );
+}
+```
+
+Extract `TodoRow` and the dialog form into `src/components/todos/` when they grow.
+
+## 4. Route — `src/App.tsx`
+
+```tsx
+<Route path="/todos" element={<AuthGuard><Todos /></AuthGuard>} />
+```

package/templates/shadcn/README.md

@@ -1,8 +1,15 @@
 # {{NAME}}
 
-Blank `robodev/database.ts` and `GET /api/health` plus a hosted Welcome page with shadcn and an orval client. No sample schema.
+Blank `robodev/database.ts` and `GET /api/health` plus a hosted Welcome page with a shadcn-style UI kit, seeded auth, and an orval client. No sample schema.
 
-The project App URL serves the hosted Welcome page (`/` via React Router in `src/pages/Home.tsx`). Edit `index.html` and `src/`, then `robodev deploy` (or Code + Save). Agents: read `ROBODEV.md`. Unless the product is a public page, add login/register via reserved `/api/user/auth/*` and protect routes.
+The project App URL serves the hosted Welcome page (`/` via React Router in `src/pages/Home.tsx`). Edit `index.html` and `src/`, then `robodev deploy` (or Code + Save). Agents: read `ROBODEV.md` and `.rulesync/rules/project-overview.md`.
+
+What is seeded:
+
+- **Auth**: `src/lib/client.ts` (`@robodev-ai/client`, same-origin), `src/lib/auth.tsx` (`AuthProvider`, `useAuth`, `AuthGuard`), `src/pages/Login.tsx`, `src/pages/Register.tsx`, plus a `*` NotFound route. Reuse these — do not reimplement token handling.
+- **UI kit**: shadcn-style components in `src/components/ui` (button, input, textarea, label, card, badge, table, dialog, skeleton, spinner, empty-state) styled by design tokens and plain CSS in `src/app.css` (light + `.dark`). The hosted compile does not run Tailwind, so there is no Tailwind in this tree — every class lives in `app.css`.
+- **API path**: call app APIs with `client.get/post/put/patch/del`. The committed orval client under `src/api/generated/` covers the seed `getHealth`; regenerate locally with `pnpm run generate:api` after editing `src/api/openapi.json` if you want typed public endpoints.
+- **Agent rules**: `.rulesync/rules/*` and `.rulesync/skills/robodev-crud-page/SKILL.md`.
 
 ```bash
 robodev create my-app --template shadcn
@@ -15,6 +22,4 @@ pnpm run generate:api  # regenerate the orval client from src/api/openapi.json
 
 Do not write a `frontend` block in `robodev/.robodev` — that block is for Tiny `apps/fe`. Root `index.html` + `src/` deploy as hosted React.
 
-Hosted compile does not run Tailwind. `src/app.css` is plain CSS so Welcome works on the project host. `tailwind.config.ts` and `postcss.config.js` are for local `shadcn add` / Vite only. The orval client under `src/api/generated/` is committed; regenerate it after API changes.
-
 Docs: https://robodev.povio.dev/docs