robodev 0.47.3 → 0.49.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "robodev",
-  "version": "0.47.3",
+  "version": "0.49.0",
   "description": "CLI for Robodev Starbase — create, auth, link, deploy, load, and run a project locally with robodev dev",
   "type": "module",
   "license": "MIT",
@@ -26,8 +26,8 @@
     "embedded-postgres": "17.10.0-beta.17",
     "fastify": "^5.12.1",
     "tsx": "^4.20.5",
-    "@robodev-ai/runtime": "0.7.2",
-    "@robodev-ai/sdk": "0.13.0"
+    "@robodev-ai/sdk": "0.15.0",
+    "@robodev-ai/runtime": "0.9.0"
   },
   "devDependencies": {
     "@types/node": "^24.3.0",

package/src/dev-inspect.test.ts

@@ -62,6 +62,10 @@ test("shouldCountRequestHistogram counts Auth and matched file routes only", ()
   assert.equal(shouldCountRequestHistogram("/_robodev/scalar", fileRuntime, "GET"), false);
   assert.equal(shouldCountRequestHistogram("/_robodev/ready", fileRuntime, "GET"), false);
   assert.equal(shouldCountRequestHistogram("/openapi.json", fileRuntime, "GET"), false);
+  assert.equal(
+    shouldCountRequestHistogram("/robodev-enterprise-spec.json", fileRuntime, "GET"),
+    false,
+  );
   assert.equal(shouldCountRequestHistogram("/docs", fileRuntime, "GET"), false);
   assert.equal(shouldCountRequestHistogram("/swagger", fileRuntime, "GET"), false);
   assert.equal(isHistogramExcludedPath("/scalar"), true);
@@ -278,6 +282,17 @@ test("inspect HTML has nav labels and polls state.json", () => {
   assert.doesNotMatch(html, /fetch\("\/_robodev\/logs\.json"\)/);
   assert.doesNotMatch(html, /@xyflow|React\.createElement|react-dom/);
   assert.match(html, /setInterval\(poll, 1000\)/);
+  assert.match(html, /state\.overview\.links\.enterprise/);
+  assert.match(html, /label: "Enterprise spec"/);
+});
+
+test("dashboard state includes enterprise spec link after openapi", async () => {
+  const state = await buildDashboardState({
+    inspect: createDevInspect(),
+    runtime: { routes: [], jobs: [] },
+  });
+  assert.equal(state.overview.links.openapi, "/openapi.json");
+  assert.equal(state.overview.links.enterprise, "/robodev-enterprise-spec.json");
 });
 
 test("storageActivityMatchesKey uses exact key except list prefixes", () => {

package/src/dev-inspect.ts

@@ -40,6 +40,7 @@ const HISTOGRAM_EXCLUDED_PATHS = new Set([
   "/_robodev/scalar",
   "/scalar",
   "/openapi.json",
+  "/robodev-enterprise-spec.json",
   "/_robodev/ready",
 ]);
 
@@ -213,7 +214,7 @@ export type DashboardState = {
     google: DashboardGoogle;
     requestHistogram: RequestHistogramBucket[];
     jobHistogram: JobHistogramBucket[];
-    links: { swagger: string; scalar: string; openapi: string };
+    links: { swagger: string; scalar: string; openapi: string; enterprise: string };
   };
   routes: Array<{ method: string; path: string; file: string }>;
   calls: Array<{ at: number; method: string; path: string; status: number; durationMs: number }>;
@@ -596,7 +597,12 @@ export async function buildDashboardState(input: {
       google,
       requestHistogram: input.inspect.requestHistogram(),
       jobHistogram: input.inspect.jobHistogram(),
-      links: { swagger: "/_robodev/docs", scalar: "/_robodev/scalar", openapi: "/openapi.json" },
+      links: {
+        swagger: "/_robodev/docs",
+        scalar: "/_robodev/scalar",
+        openapi: "/openapi.json",
+        enterprise: "/robodev-enterprise-spec.json",
+      },
     },
     routes,
     calls,
@@ -1067,7 +1073,8 @@ export function inspectHtml(): string {
         var items = [
           { href: state.overview.links.swagger, label: "Swagger" },
           { href: state.overview.links.scalar, label: "Scalar" },
-          { href: state.overview.links.openapi, label: "openapi.json" }
+          { href: state.overview.links.openapi, label: "openapi.json" },
+          { href: state.overview.links.enterprise, label: "Enterprise spec" }
         ];
         for (var i = 0; i < items.length; i++) {
           var a = document.createElement("a");

package/src/dev-server.ts

@@ -11,9 +11,11 @@ import {
   browseRows,
   browseSchema,
   buildOpenApi,
+  buildEnterpriseSpec,
   handleLocalAuth,
   isLocalAuthPath,
   isReservedStoragePath,
+  ENTERPRISE_SPEC_PATH,
   matchProjectRoute,
   matchSocketRoute,
   parseLogicalKey,
@@ -624,6 +626,10 @@ export async function startDevServer(
         await reply.send(runtime.openapi);
         return;
       }
+      if (pathname === ENTERPRISE_SPEC_PATH) {
+        await reply.send(buildEnterpriseSpec(runtime.openapi));
+        return;
+      }
 
       if (isLocalAuthPath(pathname)) {
         const result = await handleLocalAuth(

package/src/emit-starter.test.ts

@@ -218,9 +218,12 @@ test("collectFiles for shadcn starter includes hosted Welcome and tooling config
   assert.ok(paths.has("src/api/generated/endpoints.ts"));
   assert.ok(paths.has("src/api/openapi.json"));
   assert.ok(paths.has("orval.config.ts"));
-  assert.ok(paths.has("components.json"));
-  assert.ok(paths.has("tailwind.config.ts"));
-  assert.ok(paths.has("postcss.config.js"));
+  assert.ok(paths.has("src/lib/client.ts"));
+  assert.ok(paths.has("src/lib/auth.tsx"));
+  assert.ok(paths.has("src/pages/Login.tsx"));
+  assert.ok(!paths.has("components.json"));
+  assert.ok(!paths.has("tailwind.config.ts"));
+  assert.ok(!paths.has("postcss.config.js"));
   assert.ok(!paths.has("robodev/api/planets.ts"));
   assert.ok([...paths].every((path) => !path.startsWith("apps/")));
   assert.ok(files.length < 200);

package/templates/auth-chat/ROBODEV.md

@@ -22,6 +22,12 @@ export const get = defineApi({
 });
 ```
 
+Method exports: one export per method — `get` / `post` / `put` / `patch` / `delete`. `delete` is a reserved word — write `export const del = ...` or `export { remove as delete }`; both serve DELETE.
+
+`ctx.user.id` is a string like `usr_abc123`, not a UUID. Type user id columns as `text`, never `uuid`.
+
+Throw an Error with an integer `statusCode` (400-599) to answer with that status: `throw Object.assign(new Error("Not found"), { statusCode: 404 })`. Any other throw is a generic 500.
+
 ## Hard rules
 
 - Do not run npm, pnpm, or yarn install.
@@ -34,7 +40,7 @@ export const get = defineApi({
 
 ## Auth and product data
 
-Persist primary product data with `defineApi` and `robodev-publish be`. Do not use localStorage as the product store unless the user asked for a public, static, or no-account page. Auth is on by default: add login and register and protect routes unless the product is public or unauthenticated. Use `auth: "required"` and `ctx.user.id`. Call reserved `/api/user/auth/*` — do not implement `api/user/**`. Tiny: reuse seed login/register and AuthGuard. Shadcn, Empty, and legacy: create login/register with `@robodev-ai/client` tokens. A missing `.rulesync` skill is not a reason to skip APIs. Do not require `robodev-auth set` every run.
+Persist primary product data with `defineApi` and `robodev-publish be`. Do not use localStorage as the product store unless the user asked for a public, static, or no-account page. Auth is on by default: add login and register and protect routes unless the product is public or unauthenticated. Use `auth: "required"` and `ctx.user.id`. Call reserved `/api/user/auth/*` — do not implement `api/user/**`. Tiny and Shadcn: reuse seed login/register and AuthGuard. Empty and legacy: create login/register with `@robodev-ai/client` tokens. A missing `.rulesync` skill is not a reason to skip APIs. Do not require `robodev-auth set` every run.
 
 ## Backend
 

package/templates/auth-chat/package.json

@@ -9,10 +9,10 @@
     "rules:gen": "rulesync generate"
   },
   "dependencies": {
-    "@robodev-ai/sdk": "^0.13.0"
+    "@robodev-ai/sdk": "^0.15.0"
   },
   "devDependencies": {
-    "robodev": "^0.47.3",
+    "robodev": "^0.49.0",
     "rulesync": "^8.18.0",
     "typescript": "^5.9.2"
   }

package/templates/backend/ROBODEV.md

@@ -22,6 +22,12 @@ export const get = defineApi({
 });
 ```
 
+Method exports: one export per method — `get` / `post` / `put` / `patch` / `delete`. `delete` is a reserved word — write `export const del = ...` or `export { remove as delete }`; both serve DELETE.
+
+`ctx.user.id` is a string like `usr_abc123`, not a UUID. Type user id columns as `text`, never `uuid`.
+
+Throw an Error with an integer `statusCode` (400-599) to answer with that status: `throw Object.assign(new Error("Not found"), { statusCode: 404 })`. Any other throw is a generic 500.
+
 ## Hard rules
 
 - Do not run npm, pnpm, or yarn install.
@@ -34,7 +40,7 @@ export const get = defineApi({
 
 ## Auth and product data
 
-Persist primary product data with `defineApi` and `robodev-publish be`. Do not use localStorage as the product store unless the user asked for a public, static, or no-account page. Auth is on by default: add login and register and protect routes unless the product is public or unauthenticated. Use `auth: "required"` and `ctx.user.id`. Call reserved `/api/user/auth/*` — do not implement `api/user/**`. Tiny: reuse seed login/register and AuthGuard. Shadcn, Empty, and legacy: create login/register with `@robodev-ai/client` tokens. A missing `.rulesync` skill is not a reason to skip APIs. Do not require `robodev-auth set` every run.
+Persist primary product data with `defineApi` and `robodev-publish be`. Do not use localStorage as the product store unless the user asked for a public, static, or no-account page. Auth is on by default: add login and register and protect routes unless the product is public or unauthenticated. Use `auth: "required"` and `ctx.user.id`. Call reserved `/api/user/auth/*` — do not implement `api/user/**`. Tiny and Shadcn: reuse seed login/register and AuthGuard. Empty and legacy: create login/register with `@robodev-ai/client` tokens. A missing `.rulesync` skill is not a reason to skip APIs. Do not require `robodev-auth set` every run.
 
 ## Backend
 

package/templates/backend/package.json

@@ -8,10 +8,10 @@
     "deploy": "robodev deploy"
   },
   "dependencies": {
-    "@robodev-ai/sdk": "^0.13.0"
+    "@robodev-ai/sdk": "^0.15.0"
   },
   "devDependencies": {
-    "robodev": "^0.47.3",
+    "robodev": "^0.49.0",
     "typescript": "^5.9.2"
   }
 }

package/templates/catalog.json

@@ -30,6 +30,11 @@
       "id": "shadcn",
       "title": "Shadcn",
       "description": "Blank database.ts and GET /api/health plus a hosted Welcome page with shadcn and an orval client. No sample schema."
+    },
+    {
+      "id": "povio",
+      "title": "Povio UI",
+      "description": "Blank seed with the real @povio/ui in apps/fe: empty schema, GET /api/health, seeded auth. No sample features."
     }
   ]
 }

package/templates/empty/ROBODEV.md

@@ -22,6 +22,12 @@ export const get = defineApi({
 });
 ```
 
+Method exports: one export per method — `get` / `post` / `put` / `patch` / `delete`. `delete` is a reserved word — write `export const del = ...` or `export { remove as delete }`; both serve DELETE.
+
+`ctx.user.id` is a string like `usr_abc123`, not a UUID. Type user id columns as `text`, never `uuid`.
+
+Throw an Error with an integer `statusCode` (400-599) to answer with that status: `throw Object.assign(new Error("Not found"), { statusCode: 404 })`. Any other throw is a generic 500.
+
 ## Hard rules
 
 - Do not run npm, pnpm, or yarn install.
@@ -34,7 +40,7 @@ export const get = defineApi({
 
 ## Auth and product data
 
-Persist primary product data with `defineApi` and `robodev-publish be`. Do not use localStorage as the product store unless the user asked for a public, static, or no-account page. Auth is on by default: add login and register and protect routes unless the product is public or unauthenticated. Use `auth: "required"` and `ctx.user.id`. Call reserved `/api/user/auth/*` — do not implement `api/user/**`. Tiny: reuse seed login/register and AuthGuard. Shadcn, Empty, and legacy: create login/register with `@robodev-ai/client` tokens. A missing `.rulesync` skill is not a reason to skip APIs. Do not require `robodev-auth set` every run.
+Persist primary product data with `defineApi` and `robodev-publish be`. Do not use localStorage as the product store unless the user asked for a public, static, or no-account page. Auth is on by default: add login and register and protect routes unless the product is public or unauthenticated. Use `auth: "required"` and `ctx.user.id`. Call reserved `/api/user/auth/*` — do not implement `api/user/**`. Tiny and Shadcn: reuse seed login/register and AuthGuard. Empty and legacy: create login/register with `@robodev-ai/client` tokens. A missing `.rulesync` skill is not a reason to skip APIs. Do not require `robodev-auth set` every run.
 
 ## Backend
 

package/templates/empty/package.json

@@ -10,13 +10,13 @@
     "build": "vite build"
   },
   "dependencies": {
-    "@robodev-ai/sdk": "^0.13.0",
+    "@robodev-ai/sdk": "^0.15.0",
     "@robodev-ai/client": "^0.5.0",
     "react": "^18.3.1",
     "react-dom": "^18.3.1"
   },
   "devDependencies": {
-    "robodev": "^0.47.3",
+    "robodev": "^0.49.0",
     "typescript": "^5.9.2",
     "vite": "^6.0.0"
   }

package/templates/marketplace/ROBODEV.md

@@ -22,6 +22,12 @@ export const get = defineApi({
 });
 ```
 
+Method exports: one export per method — `get` / `post` / `put` / `patch` / `delete`. `delete` is a reserved word — write `export const del = ...` or `export { remove as delete }`; both serve DELETE.
+
+`ctx.user.id` is a string like `usr_abc123`, not a UUID. Type user id columns as `text`, never `uuid`.
+
+Throw an Error with an integer `statusCode` (400-599) to answer with that status: `throw Object.assign(new Error("Not found"), { statusCode: 404 })`. Any other throw is a generic 500.
+
 ## Hard rules
 
 - Do not run npm, pnpm, or yarn install.
@@ -34,7 +40,7 @@ export const get = defineApi({
 
 ## Auth and product data
 
-Persist primary product data with `defineApi` and `robodev-publish be`. Do not use localStorage as the product store unless the user asked for a public, static, or no-account page. Auth is on by default: add login and register and protect routes unless the product is public or unauthenticated. Use `auth: "required"` and `ctx.user.id`. Call reserved `/api/user/auth/*` — do not implement `api/user/**`. Tiny: reuse seed login/register and AuthGuard. Shadcn, Empty, and legacy: create login/register with `@robodev-ai/client` tokens. A missing `.rulesync` skill is not a reason to skip APIs. Do not require `robodev-auth set` every run.
+Persist primary product data with `defineApi` and `robodev-publish be`. Do not use localStorage as the product store unless the user asked for a public, static, or no-account page. Auth is on by default: add login and register and protect routes unless the product is public or unauthenticated. Use `auth: "required"` and `ctx.user.id`. Call reserved `/api/user/auth/*` — do not implement `api/user/**`. Tiny and Shadcn: reuse seed login/register and AuthGuard. Empty and legacy: create login/register with `@robodev-ai/client` tokens. A missing `.rulesync` skill is not a reason to skip APIs. Do not require `robodev-auth set` every run.
 
 ## Backend
 

package/templates/marketplace/package.json

@@ -9,10 +9,10 @@
     "rules:gen": "rulesync generate"
   },
   "dependencies": {
-    "@robodev-ai/sdk": "^0.13.0"
+    "@robodev-ai/sdk": "^0.15.0"
   },
   "devDependencies": {
-    "robodev": "^0.47.3",
+    "robodev": "^0.49.0",
     "rulesync": "^8.18.0",
     "typescript": "^5.9.2"
   }

package/templates/povio/.config/local.spa.template.yml

@@ -0,0 +1,27 @@
+STAGE: "local"
+OUTPUT: "export"
+
+ANALYZE: "false"
+NEXT_TELEMETRY_DISABLED: "1"
+
+VITE_PUBLIC_RELEASE: ${env:RELEASE}
+VITE_PUBLIC_STAGE: ${func:stage}
+
+APP_PUBLIC_API_URL: &APP_PUBLIC_API_URL "http://localhost:4000"
+APP_PUBLIC_API_MODE: &APP_PUBLIC_API_MODE "real"
+VITE_PUBLIC_API_URL: *APP_PUBLIC_API_URL
+VITE_PUBLIC_API_MODE: *APP_PUBLIC_API_MODE
+
+VITE_PUBLIC_LOG_LEVEL: "trace"
+
+VITE_PUBLIC_SENTRY_DSN: ""
+VITE_PUBLIC_SENTRY_ENVIRONMENT: ${func:stage}
+VITE_PUBLIC_SENTRY_TRACES_SAMPLE_RATE: "0"
+VITE_PUBLIC_SENTRY_REPLAYS_SESSION_SAMPLE_RATE: "0"
+VITE_PUBLIC_SENTRY_REPLAYS_ON_ERROR_SAMPLE_RATE: "0"
+
+VITE_PUBLIC_AUTH_CUSTOM_JWT_ENABLE_MAGIC_LINK: "true"
+
+VITE_PUBLIC_GOOGLE_ANALYTICS_MEASUREMENT_ID: ""
+
+VITE_DEV_PORT: "3000"

package/templates/povio/.oxlint-base.json

@@ -0,0 +1,29 @@
+{
+  "$schema": "apps/fe/node_modules/oxlint/configuration_schema.json",
+  "plugins": ["eslint", "typescript", "unicorn", "import", "oxc", "promise", "vitest"],
+  "categories": {
+    "correctness": "error",
+    "perf": "error",
+    "pedantic": "off",
+    "style": "off",
+    "restriction": "off",
+    "suspicious": "off",
+    "nursery": "off"
+  },
+  "env": {
+    "builtin": true,
+    "node": true,
+    "shared-node-browser": true
+  },
+  "rules": {
+    "eslint/eqeqeq": [
+      "error",
+      "always",
+      {
+        "null": "ignore"
+      }
+    ],
+    "typescript/no-floating-promises": "off",
+    "eslint/capitalized-comments": "off"
+  }
+}

package/templates/povio/.oxlintrc.json

@@ -0,0 +1,78 @@
+{
+  "$schema": "apps/fe/node_modules/oxlint/configuration_schema.json",
+  "extends": [".oxlint-base.json"],
+  "plugins": [
+    "eslint",
+    "typescript",
+    "unicorn",
+    "import",
+    "vitest",
+    "react",
+    "react-perf",
+    "jsx-a11y"
+  ],
+  "categories": {
+    "style": "error"
+  },
+  "ignorePatterns": [
+    "openapi-codegen.config.ts",
+    "postcss.config.js",
+    "out",
+    "dist",
+    "public",
+    "scripts",
+    ".vscode",
+    ".turbo",
+    "node_modules",
+    "apps/fe/src/routeTree.gen.ts",
+    "apps/fe/src/openapi",
+    "apps/fe/public"
+  ],
+  "overrides": [
+    {
+      "files": ["vite-plugin-*.ts", "apps/fe/vite-plugin-*.ts"],
+      "rules": {
+        "import/no-nodejs-modules": "off"
+      }
+    }
+  ],
+  "rules": {
+    "eslint/no-implicit-coercion": "off",
+    "no-map-spread": "off",
+    "eslint/sort-keys": "off",
+    "eslint/sort-imports": "off",
+    "eslint/no-ternary": "off",
+    "eslint/id-length": "off",
+    "eslint/no-magic-numbers": "off",
+    "eslint/arrow-body-style": "off",
+    "eslint/max-params": "off",
+    "eslint/func-style": "off",
+    "eslint/new-cap": "off",
+    "eslint/no-continue": "off",
+    "eslint/max-statements": "off",
+    "eslint/no-duplicate-imports": [
+      "error",
+      {
+        "allowSeparateTypeImports": true
+      }
+    ],
+    "react/exhaustive-deps": "off",
+    "react/jsx-props-no-spreading": "off",
+    "react/jsx-max-depth": "off",
+    "react-perf/jsx-no-new-object-as-prop": "off",
+    "react-perf/jsx-no-new-function-as-prop": "off",
+    "react-perf/jsx-no-new-array-as-prop": "off",
+    "react-perf/jsx-no-jsx-as-prop": "off",
+    "typescript/no-empty-interface": "off",
+    "import/no-named-export": "off",
+    "import/group-exports": "off",
+    "import/prefer-default-export": "off",
+    "import/exports-last": "off",
+    "import/consistent-type-specifier-style": "off",
+    "jest/require-hook": "off",
+    "unicorn/filename-case": "off",
+    "unicorn/prefer-global-this": "off",
+    "unicorn/no-await-expression-member": "off",
+    "unicorn/no-null": "off"
+  }
+}

package/templates/povio/.rulesync/rules/frontend-api-boundary.md

@@ -0,0 +1,36 @@
+---
+root: false
+targets: ["claudecode", "codexcli", "cursor"]
+description: "Frontend must consume generated OpenAPI queries and models, not backend internals."
+globs: ["apps/fe/src/**/*.{ts,tsx}"]
+cursor:
+  alwaysApply: false
+  description: "Apply when editing frontend components, hooks, providers, pages, or clients that call the API."
+  globs: ["apps/fe/src/**/*.{ts,tsx}"]
+---
+
+# Frontend API Boundary
+
+Frontend application code must consume the API through generated files in `apps/fe/src/openapi`.
+
+Use generated modules such as:
+
+- `@/openapi/<domain>/<domain>.queries`
+- `@/openapi/<domain>/<domain>.models`
+- `@/openapi/queryModules`
+
+For generated mutations, pass invalidation through the mutation options instead of importing `queryClient` or calling `invalidateQueries` with generated query keys. The current module is invalidated by default through `invalidateCurrentModule: true`; invalidate dependent modules explicitly with `invalidateModules: [QueryModule.someModule]`.
+
+After mutations, derive follow-up UI state from canonical API response or query state instead of leaving action controls unchanged. Disable duplicate submissions when the API state already represents a pending or completed action, and surface mutation errors through the default generated-client error handler or a feature-specific message.
+
+Do not import `@robodev-ai/sdk`, `robodev/database.ts`, Drizzle tables, or API helper modules into frontend features.
+
+`apps/fe/src/openapi` is generated by `@povio/openapi-codegen-cli` from root `openapi.json` (or a live project `/openapi.json` when `OPENAPI_LIVE=true`). Do not hand-edit generated OpenAPI client files.
+
+When API contracts change:
+
+1. Update `api/` handlers and `openapi.json` if the documented contract changed.
+2. Run `bun openapi:gen` from `apps/fe`.
+3. Update frontend code to use the regenerated queries and models.
+
+Point `VITE_PUBLIC_API_URL` at the Starbase project host origin only. Do not append `/api`.

package/templates/povio/.rulesync/rules/frontend-component-structure.md

@@ -0,0 +1,40 @@
+---
+root: false
+targets: ["claudecode", "codexcli", "cursor"]
+description: "Frontend component extraction and feature subcomponent structure conventions."
+globs: ["apps/fe/src/**/*.{ts,tsx}"]
+cursor:
+  alwaysApply: false
+  description: "Apply when organizing frontend feature components, page sections, mapped items, or reusable UI."
+  globs: ["apps/fe/src/**/*.{ts,tsx}"]
+---
+
+# Frontend Component Structure
+
+Extract repeatable UI into subcomponents. Every named React component should live in its own file, even when it is currently used only once. Keep the component file near the feature, layout, page, or shared UI area that owns it.
+
+Extract large or complex sections of pages into named components so route and page components stay readable. Anything mapped from an array should usually be a component, such as cards, table row actions, repeated sections, or list items.
+
+For a `todos` feature that means:
+
+- `TodoCard` for mapped grid cards.
+- `TodosFilters` for shared filter controls.
+- `TodosTableActions` for repeated row actions.
+- `TodosTable` and `TodosTableInfinite` for table wrappers.
+- `TodoDetailsPage` and `TodoEditPage` for large route-owned views.
+
+The seeded `auth`, `home`, and `profile` features show the structure.
+
+Add each new product page to the navigation in `apps/fe/src/components/layout/app-header/AppHeader.tsx` and `MobileNavigation.tsx` so it is reachable.
+
+Route files should own routing, document metadata, and route data boundaries. Feature components should own the page UI and interaction details.
+
+Exception: route-local wrappers such as `PageComponent` or layout guard components may stay in route files when they only connect routing primitives to feature components.
+
+## Shared Utilities
+
+Keep generic formatting, parsing, calculation, and data-shaping helpers in `apps/fe/src/utils/*.utils.ts` files instead of defining them inside component files. Export helpers through namespaces such as `DateUtils.formatDate(...)` or `NumberUtils.formatInteger(...)` so call sites stay explicit and related helpers stay grouped.
+
+Component files may keep UI-local glue helpers only when the logic is tightly coupled to that component's JSX, such as adapting one component's prop shape or handling a local event. If the helper describes dates, numbers, arrays, strings, IDs, or other domain-neutral data, move it into a shared utility file.
+
+For apps with multiple user roles that require distinct UI or business workflows, also apply the role-based app structure rule.

package/templates/povio/.rulesync/rules/frontend-forms.md

@@ -0,0 +1,27 @@
+---
+root: false
+targets: ["claudecode", "codexcli", "cursor"]
+description: "Frontend form patterns with Povio UI useForm, generated schemas, and formControl wiring."
+globs: ["apps/fe/src/**/*.{ts,tsx}"]
+cursor:
+  alwaysApply: false
+  description: "Apply when building or changing frontend forms, modals, edit pages, or input components."
+  globs: ["apps/fe/src/**/*.{ts,tsx}"]
+---
+
+# Frontend Forms
+
+Use `useForm` and form-aware inputs from `@povio/ui/tanstack` with generated OpenAPI Zod schemas for API-backed forms. The seeded login and register forms (`apps/fe/src/components/features/auth/LoginPage.tsx`, `RegisterPage.tsx`) show the pattern. Prefer this shape:
+
+```tsx
+const form = useForm({
+  zodSchema: TodosModels.TodosCreateInputSchema,
+  defaultValues: { name: "" },
+});
+```
+
+Pass form state into Povio UI inputs with `field={{ form, name: "fieldName" }}`. Use `form.handleSubmit`, `form.reset`, and `form.setFieldValue` for form actions, and `useFormValue(form, selector)` for reactive field reads.
+
+Avoid local `useState`, custom `value`, and custom `onChange` plumbing for fields that belong to the form. Use TanStack Form's `form.Field` adapter only when a component cannot accept the Povio UI `field` binding.
+
+Use generated OpenAPI queries and mutations for submit handlers. Keep toast feedback and navigation close to the feature interaction that owns them.

package/templates/povio/.rulesync/rules/frontend-notifications.md

@@ -0,0 +1,24 @@
+---
+root: false
+targets: ["claudecode", "codexcli", "cursor"]
+description: "Frontend notification inbox, preferences, push permission, service worker, and token registration boundaries."
+globs: ["apps/fe/src/**/*.{ts,tsx}", "apps/fe/public/**/*.{js,ts}"]
+cursor:
+  alwaysApply: false
+  description: "Apply when frontend work handles notifications, push permission, service workers, push tokens, unread counts, or notification preferences."
+  globs: ["apps/fe/src/**/*.{ts,tsx}", "apps/fe/public/**/*.{js,ts}"]
+---
+
+# Frontend Notifications
+
+Use generated `@/openapi` queries, mutations, and models for notification history, preferences, and push-token registration. Do not import `@robodev-ai/sdk` or `robodev/database.ts` into frontend feature code.
+
+Request push permission only after an explanatory UI and explicit user gesture. Never request it automatically during initial application load. Handle unsupported, default, denied, granted, registered, expired, and failed-registration states.
+
+Register the service worker and provider subscription through a small browser integration, then persist the token/subscription through the generated authenticated user API. Clean up or detach the current device registration on logout when required by the security model.
+
+Keep push payloads minimal and privacy-safe. Validate internal deep links before navigation. Never depend on push as the only record of an important event; provide a paginated in-app notification list and unread state.
+
+Use generated mutation invalidation options for unread counts, mark-read actions, preferences, and token changes. Do not access the query client directly for generated API state.
+
+Use `@povio/ui` for permission prompts, notification lists, menus/popovers, tags, forms, confirmations, and toasts. Use `povio-ui-styling` for styling-layer decisions.

package/templates/povio/.rulesync/rules/frontend-povio-components.md

@@ -0,0 +1,42 @@
+---
+root: false
+targets: ["claudecode", "codexcli", "cursor"]
+description: "Frontend interactive controls and typography must use Povio UI primitives instead of native replacements."
+globs: ["apps/fe/src/**/*.{ts,tsx}"]
+cursor:
+  alwaysApply: false
+  description: "Apply when creating or editing React components, controls, forms, tables, overlays, or user-facing text."
+  globs: ["apps/fe/src/**/*.{ts,tsx}"]
+---
+
+# Use Povio UI Components
+
+Use a component from `@povio/ui` whenever it provides the required primitive. Do not recreate an available Povio component with a native element plus Tailwind or custom CSS.
+
+Required replacements include:
+
+- `Button`, `TextButton`, or the appropriate Povio action component instead of a styled `<button>`.
+- `TextInput`, `PasswordInput`, `TextArea`, checkbox, radio, select, autocomplete, and other Povio form controls instead of native form controls.
+- `Typography` instead of directly styling user-facing headings, paragraphs, labels, or spans.
+- `Table` or `InfiniteTable` instead of a hand-built native data table.
+- `Modal`, `Confirmation`, `Drawer`, `BottomSheet`, `Menu`, `Tooltip`, or `ResponsivePopover` instead of custom overlay primitives.
+- `FileUpload` instead of a directly exposed file input.
+- Povio hooks such as `useForm` and `useToast` instead of parallel custom infrastructure.
+
+Before creating a control:
+
+1. Search `@povio/ui` usage in the repository.
+2. Inspect existing feature components for the same primitive.
+3. Use the existing Povio props and variants.
+4. Apply the `povio-ui-styling` skill when choosing between local Tailwind, `UIConfig`, `UIOverrides`, a shared wrapper, or scoped CSS.
+
+Native semantic and structural elements such as `<main>`, `<section>`, `<article>`, `<nav>`, `<form>`, `<div>`, and list elements remain appropriate for document structure and layout. Use TanStack Router navigation primitives for routing. This rule prohibits native replacements for available Povio UI behavior; it does not prohibit semantic HTML.
+
+If Povio UI has no suitable primitive:
+
+- Compose existing Povio components first.
+- Put a reusable project-specific primitive under `apps/fe/src/components/shared/ui`.
+- Preserve keyboard behavior, focus visibility, accessible names, disabled state, validation state, and loading state.
+- Keep the exception narrow; do not introduce another general-purpose UI library.
+
+When touching an existing native control that has a Povio equivalent, migrate it when the change is safely within scope. Do not expand a narrowly requested fix into a broad unrelated rewrite.