@helloleo/plugins 0.1.10 → 0.1.12

package/dist/index.js

@@ -12332,10 +12332,10 @@ function tool(input) {
 tool.schema = exports_external;
 // src/tools/inspect-http.ts
 var z = tool.schema;
-var ALLOWED_EXACT_HOSTS = new Set(["api.app.helloleo.dev"]);
-var ALLOWED_HOST_SUFFIXES = [
-  ".augustin-d60.workers.dev",
-  ".live.helloleo.dev"
+var ALLOWED_BASE_HOSTS = [
+  "helloleo.dev",
+  "helloleo.app",
+  "augustin-d60.workers.dev"
 ];
 var DEFAULT_TIMEOUT_MS = 15000;
 var MAX_TIMEOUT_MS = 30000;
@@ -12343,7 +12343,7 @@ var MAX_RESPONSE_BYTES = 1e6;
 var METHODS = ["GET", "POST", "PUT", "PATCH", "DELETE"];
 var METHODS_AUTO_JSON = new Set(["POST", "PUT", "PATCH"]);
 var argsShape = {
-  url: z.string().describe("Fully-qualified URL to request. Must be on the HelloLeo whitelist " + "(api.app.helloleo.dev, *.augustin-d60.workers.dev, *.live.helloleo.dev)."),
+  url: z.string().describe("Fully-qualified URL to request. Must be on the HelloLeo whitelist " + "(**.helloleo.dev, **.helloleo.app, **.augustin-d60.workers.dev)."),
   method: z.enum(METHODS).default("GET").describe(`HTTP method (${METHODS.join(", ")}). Defaults to GET.`),
   body: z.string().optional().describe("Request body as a string. Not valid for GET. Sent with " + "Content-Type: application/json on POST/PUT/PATCH unless a " + "different Content-Type is supplied via headers."),
   headers: z.record(z.string(), z.string()).default({}).describe("Optional additional request headers as key/value pairs (e.g. Authorization)."),
@@ -12351,7 +12351,7 @@ var argsShape = {
 };
 var argsSchema = z.object(argsShape);
 var inspectHttp = tool({
-  description: "Send an HTTP request to a HelloLeo endpoint and return the status code, " + "response headers, and response body. Use this to inspect the live behaviour " + "of HelloLeo workers, the production API, or preview deployments so you can " + "self-debug instead of operating blind. " + "Only URLs on the HelloLeo whitelist are allowed: " + "api.app.helloleo.dev, *.augustin-d60.workers.dev, *.live.helloleo.dev. " + "Supports GET, POST, PUT, PATCH and DELETE (with an optional JSON body).",
+  description: "Send an HTTP request to a HelloLeo endpoint and return the status code, " + "response headers, and response body. Use this to inspect the live behaviour " + "of HelloLeo workers, the production API, or preview deployments so you can " + "self-debug instead of operating blind. ",
   args: argsShape,
   async execute(rawArgs, context) {
     const args = argsSchema.parse(rawArgs);
@@ -12437,17 +12437,12 @@ function parseTargetUrl(raw) {
   return url2;
 }
 function allowedHostsHuman() {
-  return [
-    ...ALLOWED_EXACT_HOSTS,
-    ...ALLOWED_HOST_SUFFIXES.map((s) => `*${s}`)
-  ].join(", ");
+  return ALLOWED_BASE_HOSTS.map((base) => `**.${base}`).join(", ");
 }
 function isAllowedHost(hostname3) {
   const host = hostname3.toLowerCase().replace(/\.$/, "");
-  if (ALLOWED_EXACT_HOSTS.has(host))
-    return true;
-  for (const suffix of ALLOWED_HOST_SUFFIXES) {
-    if (host.endsWith(suffix) && host.length > suffix.length)
+  for (const base of ALLOWED_BASE_HOSTS) {
+    if (host === base || host.endsWith(`.${base}`))
       return true;
   }
   return false;
@@ -12544,74 +12539,493 @@ var RemovePlugin = async () => {
 // src/tools/scaffold.ts
 import { mkdir } from "fs/promises";
 import path2 from "path";
+function packageJson(name) {
+  return JSON.stringify({
+    name,
+    private: true,
+    version: "0.0.0",
+    type: "module",
+    scripts: {
+      dev: "vite",
+      start: "vite",
+      build: "vite build",
+      preview: "vite preview"
+    },
+    dependencies: {
+      react: "^18.3.1",
+      "react-dom": "^18.3.1",
+      clsx: "^2.1.1",
+      "tailwind-merge": "^2.6.0",
+      "lucide-react": "^1.14.0"
+    },
+    devDependencies: {
+      "@types/react": "^18.3.12",
+      "@types/react-dom": "^18.3.1",
+      "@vitejs/plugin-react": "^4.3.4",
+      autoprefixer: "^10.4.20",
+      postcss: "^8.4.49",
+      tailwindcss: "^3.4.17",
+      typescript: "^5.6.3",
+      vite: "^6.0.5"
+    }
+  }, null, 2);
+}
+function indexHtml(fontFamily) {
+  const fontParam = fontFamily.replace(/\s+/g, "+");
+  return `<!DOCTYPE html>
+<html lang="en">
+  <head>
+    <meta charset="UTF-8" />
+    <meta name="viewport" content="width=device-width, initial-scale=1.0" />
+    <link rel="preconnect" href="https://fonts.googleapis.com">
+    <link rel="preconnect" href="https://fonts.gstatic.com" crossorigin>
+    <link href="https://fonts.googleapis.com/css2?family=${fontParam}:wght@400;500;600;700&display=swap" rel="stylesheet">
+    <title>App</title>
+  </head>
+  <body>
+    <div id="root"></div>
+    <script type="module" src="/src/main.tsx"></script>
+  </body>
+</html>`;
+}
+function viteConfig() {
+  return `import { defineConfig } from 'vite'
+import react from '@vitejs/plugin-react'
+import path from 'path'
 
-// src/tools/scaffold-netsuite.ts
-function netsuiteTs() {
+export default defineConfig({
+  plugins: [react()],
+  server: {
+    allowedHosts: true,
+  },
+  resolve: {
+    alias: {
+      '@': path.resolve(__dirname, './src'),
+    },
+  },
+})`;
+}
+function tailwindConfig() {
+  return `export default {
+  darkMode: ["class"],
+  content: ["./index.html", "./src/**/*.{js,ts,jsx,tsx}"],
+  theme: {
+    extend: {
+      colors: {
+        background: "hsl(var(--background))",
+        foreground: "hsl(var(--foreground))",
+        card: { DEFAULT: "hsl(var(--card))", foreground: "hsl(var(--card-foreground))" },
+        primary: { DEFAULT: "hsl(var(--primary))", foreground: "hsl(var(--primary-foreground))" },
+        secondary: { DEFAULT: "hsl(var(--secondary))", foreground: "hsl(var(--secondary-foreground))" },
+        muted: { DEFAULT: "hsl(var(--muted))", foreground: "hsl(var(--muted-foreground))" },
+        accent: { DEFAULT: "hsl(var(--accent))", foreground: "hsl(var(--accent-foreground))" },
+        destructive: { DEFAULT: "hsl(var(--destructive))", foreground: "hsl(var(--destructive-foreground))" },
+        success: { DEFAULT: "hsl(var(--success))", foreground: "hsl(var(--success-foreground))" },
+        warning: { DEFAULT: "hsl(var(--warning))", foreground: "hsl(var(--warning-foreground))" },
+        border: "hsl(var(--border))",
+        input: "hsl(var(--input))",
+        ring: "hsl(var(--ring))",
+      },
+      fontFamily: {
+        sans: "var(--font-sans)",
+        heading: "var(--font-heading)",
+      },
+      borderRadius: {
+        lg: "var(--radius)",
+        md: "calc(var(--radius) - 2px)",
+        sm: "calc(var(--radius) - 4px)",
+      },
+      borderWidth: {
+        DEFAULT: "var(--border-width)",
+      },
+      boxShadow: {
+        DEFAULT: "var(--shadow)",
+        lg: "var(--shadow-lg)",
+      },
+    },
+  },
+  plugins: [],
+}`;
+}
+function postcssConfig() {
+  return `export default {
+  plugins: {
+    tailwindcss: {},
+    autoprefixer: {},
+  },
+}`;
+}
+function indexCss(primaryColor, fontFamily, borderRadius) {
+  const fontValue = `'${fontFamily}', ui-sans-serif, system-ui, sans-serif`;
   return `/*
- * NetSuite OAuth client helper (bearer-token-in-fragment).
+ * HelloLeo Design System -- READ BEFORE STYLING.
  *
- * Two NetSuite Integration Records back this:
- *   1. MCP (scope: mcp)            -- used by HelloLeo at build time.
- *   2. Runtime (scope: rest_webservices) -- used here at sign-in time.
- * Runtime credentials live as HelloLeo Cloud secrets on the project's Worker
- * (env.NETSUITE_ACCOUNT_ID / _CLIENT_ID / _CLIENT_SECRET). They never reach
- * the browser. Cookies are NOT used -- frontend \u2194 Worker are cross-site
- * (e.g. *.helloleo.dev <-> *.workers.dev) and Chrome partitions / drops
- * third-party cookies in the HelloLeo preview iframe.
+ * The CSS variables below are the single source of truth for the project's
+ * design tokens. They power the no-code Design panel in the HelloLeo webapp:
+ * the user edits colors / fonts / radius / shadows visually, and the panel
+ * writes back to THIS file. Keeping the conventions intact is what unlocks
+ * that round-trip.
  *
- * Flow:
- *   1. User clicks "Sign in with NetSuite".
- *   2. Browser navigates to the Worker /auth/netsuite/start.
- *   3. Worker redirects to NetSuite's OAuth UI with PKCE.
- *   4. NetSuite redirects back to the Worker /auth/netsuite/callback.
- *   5. Worker exchanges the code, mints a session id, then redirects to
- *      <return_to>#nssid=<sid>. URL fragments stay in the browser only.
- *   6. This module reads the fragment on load, stashes the sid in
- *      sessionStorage, and sends it as Authorization: Bearer on every
- *      Worker call.
+ * Conventions (do not break):
+ *   - All colors stored as raw HSL triplets (no hsl() wrapper, no #hex).
+ *     Tailwind classes wrap them via hsl(var(--token)). Never inline #hex
+ *     in components -- always use design tokens (bg-primary, text-foreground,
+ *     border-border, etc.).
+ *   - --primary / --secondary / --accent / --destructive / --success /
+ *     --warning each have a paired -foreground for text on that surface.
+ *   - --radius drives lg/md/sm via calc() in tailwind.config.js. Edit here,
+ *     not in component classes.
+ *   - --font-sans for body, --font-heading for headings. Both load from the
+ *     Google Fonts <link> in index.html.
+ *   - .dark variants mirror :root one-for-one. When adding a token, add it
+ *     to BOTH blocks or dark mode breaks.
  *
- * NEVER use a hardcoded password gate. NEVER use sessionStorage as the
- * authoritative auth state -- the only acceptable check is /api/me on the
- * Worker. sessionStorage here is just a cache of the bearer token.
+ * UI primitives (Button, Card, Input, Modal, Table, Badge, Alert, Spinner)
+ * MUST live in src/components/ui/ and consume these tokens via Tailwind
+ * classes -- never hardcoded colors. One responsibility per file, <50 lines
+ * per component.
  */
 
-export const WORKER_URL = import.meta.env.VITE_WORKER_URL ?? '';
-const TOKEN_KEY = 'nssid';
+@tailwind base;
+@tailwind components;
+@tailwind utilities;
 
-// Capture-and-strip the #nssid=... fragment as early as possible so URLs
-// shown to the user stay clean. Runs once at module load.
-(function bootstrapTokenFromHash() {
-  if (typeof window === 'undefined') return;
-  const hash = window.location.hash.replace(/^#/, '');
-  if (!hash) return;
-  const params = new URLSearchParams(hash);
-  const sid = params.get(TOKEN_KEY);
-  if (sid) {
-    try { sessionStorage.setItem(TOKEN_KEY, sid); } catch {}
-    params.delete(TOKEN_KEY);
-    const remaining = params.toString();
-    const newHash = remaining ? '#' + remaining : '';
-    window.history.replaceState(null, '', window.location.pathname + window.location.search + newHash);
+@layer base {
+  :root {
+    --background: 0 0% 100%;
+    --foreground: 222.2 84% 4.9%;
+    --card: 0 0% 100%;
+    --card-foreground: 222.2 84% 4.9%;
+    --primary: ${primaryColor};
+    --primary-foreground: 210 40% 98%;
+    --secondary: 210 40% 96.1%;
+    --secondary-foreground: 222.2 47.4% 11.2%;
+    --muted: 210 40% 96.1%;
+    --muted-foreground: 215.4 16.3% 46.9%;
+    --accent: 210 40% 96.1%;
+    --accent-foreground: 222.2 47.4% 11.2%;
+    --destructive: 0 84.2% 60.2%;
+    --destructive-foreground: 210 40% 98%;
+    --success: 142 76% 36%;
+    --success-foreground: 210 40% 98%;
+    --warning: 38 92% 50%;
+    --warning-foreground: 222.2 47.4% 11.2%;
+    --border: 214.3 31.8% 91.4%;
+    --input: 214.3 31.8% 91.4%;
+    --ring: 221.2 83.2% 53.3%;
+    --radius: ${borderRadius};
+    --border-width: 1px;
+    --shadow: 0 1px 3px 0 rgb(0 0 0 / 0.1), 0 1px 2px -1px rgb(0 0 0 / 0.1);
+    --shadow-lg: 0 10px 15px -3px rgb(0 0 0 / 0.1), 0 4px 6px -4px rgb(0 0 0 / 0.1);
+    --font-sans: ${fontValue};
+    --font-heading: ${fontValue};
   }
-})();
 
-export function getSessionToken(): string | null {
-  try { return sessionStorage.getItem(TOKEN_KEY); } catch { return null; }
+  .dark {
+    --background: 222.2 84% 4.9%;
+    --foreground: 210 40% 98%;
+    --card: 222.2 84% 4.9%;
+    --card-foreground: 210 40% 98%;
+    --primary: 217.2 91.2% 59.8%;
+    --primary-foreground: 222.2 47.4% 11.2%;
+    --secondary: 217.2 32.6% 17.5%;
+    --secondary-foreground: 210 40% 98%;
+    --muted: 217.2 32.6% 17.5%;
+    --muted-foreground: 215 20.2% 65.1%;
+    --accent: 217.2 32.6% 17.5%;
+    --accent-foreground: 210 40% 98%;
+    --destructive: 0 62.8% 30.6%;
+    --destructive-foreground: 210 40% 98%;
+    --success: 142 76% 36%;
+    --success-foreground: 210 40% 98%;
+    --warning: 38 92% 50%;
+    --warning-foreground: 222.2 47.4% 11.2%;
+    --border: 217.2 32.6% 17.5%;
+    --input: 217.2 32.6% 17.5%;
+    --ring: 224.3 76.3% 48%;
+    --border-width: 1px;
+    --shadow: 0 1px 3px 0 rgb(0 0 0 / 0.3), 0 1px 2px -1px rgb(0 0 0 / 0.3);
+    --shadow-lg: 0 10px 15px -3px rgb(0 0 0 / 0.3), 0 4px 6px -4px rgb(0 0 0 / 0.3);
+    --font-sans: ${fontValue};
+    --font-heading: ${fontValue};
+  }
 }
 
-export function signInWithNetSuite(returnTo: string = window.location.href) {
-  if (!WORKER_URL) {
-    throw new Error(
-      'VITE_WORKER_URL is not set. HelloLeo Cloud must be provisioned before sign-in works.',
-    );
-  }
-  const url = new URL(\`\${WORKER_URL.replace(/\\/$/, '')}/auth/netsuite/start\`);
-  url.searchParams.set('return_to', returnTo);
-  // The app usually renders inside the HelloLeo preview iframe. NetSuite's
-  // OAuth page sets X-Frame-Options: DENY, so navigating the iframe to the
-  // Worker (which 302s to NetSuite) ends up loading a page the browser
-  // refuses to render -- looks like "nothing happens" to the user. Navigate
-  // the top frame instead so the OAuth flow runs at the top level and the
+body {
+  @apply bg-background text-foreground font-sans;
+}`;
+}
+function utilsTs() {
+  return `import { clsx, type ClassValue } from 'clsx'
+import { twMerge } from 'tailwind-merge'
+
+export function cn(...inputs: ClassValue[]) {
+  return twMerge(clsx(inputs))
+}`;
+}
+function proxyTs() {
+  return `/*
+ * HelloLeo Integration Proxy -- runtime helper for connected integrations.
+ *
+ * All third-party APIs (Odoo, Airtable, HubSpot, Stripe, Notion, Gladia,
+ * Microsoft 365, Klaviyo, Supabase, DimoMaint, etc.) are reachable through
+ * this single proxy. The proxy handles auth and CORS using credentials the
+ * user already configured in Project Settings -- you NEVER pass an API key
+ * from frontend code, and you NEVER call third-party hosts directly.
+ *
+ * Two modes:
+ *   A) Frontend-only project -> import callIntegration() from this file.
+ *   B) HelloLeo Cloud project -> route via Worker fetch(env.INTEGRATION_PROXY).
+ *      Use Cloud whenever the project needs backend logic, automations,
+ *      webhooks, scheduled jobs, or AI agents. Keep secrets server-side.
+ *
+ * Integration slugs:
+ *   Use the exact slug from the Enabled MCP list with the "pipedream-"
+ *   prefix removed. e.g. "pipedream-gorgias_oauth" -> "gorgias_oauth".
+ *   Native integrations (odoo, airtable) keep their plain name.
+ *
+ * Response shape (always wrapped):
+ *   { success: boolean, status: number, data: <provider payload> }
+ *
+ *   Unwrap "data" by provider:
+ *     odoo            -> data.result
+ *     airtable        -> data.records
+ *     notion          -> data.results
+ *     microsoft 365   -> data.value
+ *     klaviyo         -> data.data
+ *     supabase / dimomaint -> data
+ *
+ * Pagination: put query params directly in the endpoint string,
+ *   e.g. endpoint: '/api/tickets?cursor=xyz&per_page=100'.
+ *   Read pagination metadata from the response to build the next call.
+ *   Never .filter() large lists in the frontend -- paginate server-side.
+ *
+ * Secrets for non-integration APIs (e.g. raw OpenAI): store them in
+ * HelloLeo Cloud -> Settings -> Cloud -> Secrets, and read via env.SECRET_NAME
+ * from a Worker. Never embed secrets in frontend code.
+ */
+
+const PROJECT_UUID = import.meta.env.VITE_PROJECT_UUID ?? '';
+export const INTEGRATION_PROXY_URL =
+  \`https://api.app.helloleo.dev/api/integration-proxy/\${PROJECT_UUID}\`;
+
+export interface ProxyRequest {
+  integration: string;
+  endpoint: string;
+  method?: 'GET' | 'POST' | 'PUT' | 'PATCH' | 'DELETE';
+  body?: unknown;
+  headers?: Record<string, string>;
+}
+
+export interface ProxyResponse<T = unknown> {
+  success: boolean;
+  status: number;
+  data: T;
+}
+
+export async function callIntegration<T = unknown>(
+  req: ProxyRequest,
+): Promise<ProxyResponse<T>> {
+  const res = await fetch(INTEGRATION_PROXY_URL, {
+    method: 'POST',
+    headers: { 'Content-Type': 'application/json' },
+    body: JSON.stringify({ method: 'POST', ...req }),
+  });
+  return res.json();
+}
+
+/* Example -- Odoo search_read:
+ *
+ *   const r = await callIntegration({
+ *     integration: 'odoo',
+ *     endpoint: '/jsonrpc',
+ *     body: {
+ *       model: 'product.template',
+ *       method: 'search_read',
+ *       args: [[['type', '=', 'consu']]],
+ *       kwargs: { fields: ['name', 'list_price'], limit: 50 },
+ *     },
+ *   });
+ *   const products = r.data?.result ?? [];
+ */
+`;
+}
+function hexToHslTriplet(hex3) {
+  let h = hex3.trim().replace(/^#/, "");
+  if (h.length === 3) {
+    h = h.split("").map((c) => c + c).join("");
+  }
+  if (!/^[0-9a-fA-F]{6}$/.test(h))
+    return "";
+  const r = Number.parseInt(h.slice(0, 2), 16) / 255;
+  const g = Number.parseInt(h.slice(2, 4), 16) / 255;
+  const b = Number.parseInt(h.slice(4, 6), 16) / 255;
+  const max = Math.max(r, g, b);
+  const min = Math.min(r, g, b);
+  const l = (max + min) / 2;
+  let s = 0;
+  let hue = 0;
+  if (max !== min) {
+    const d = max - min;
+    s = l > 0.5 ? d / (2 - max - min) : d / (max + min);
+    switch (max) {
+      case r:
+        hue = (g - b) / d + (g < b ? 6 : 0);
+        break;
+      case g:
+        hue = (b - r) / d + 2;
+        break;
+      default:
+        hue = (r - g) / d + 4;
+    }
+    hue *= 60;
+  }
+  return `${Math.round(hue)} ${Math.round(s * 100)}% ${Math.round(l * 100)}%`;
+}
+function normalizePrimaryColor(value) {
+  const trimmed = value.trim();
+  if (/^(#|[0-9a-fA-F]{3}$|[0-9a-fA-F]{6}$)/.test(trimmed)) {
+    const hsl = hexToHslTriplet(trimmed);
+    if (hsl)
+      return hsl;
+  }
+  return trimmed;
+}
+function mainTsx() {
+  return `import React from 'react'
+import ReactDOM from 'react-dom/client'
+import App from './App'
+import './index.css'
+
+ReactDOM.createRoot(document.getElementById('root')!).render(
+  <React.StrictMode>
+    <App />
+  </React.StrictMode>,
+)`;
+}
+async function writeBaseScaffold(opts, dir) {
+  const name = opts.name ?? "leo-project";
+  const primary = normalizePrimaryColor(opts.primaryColor ?? "221.2 83.2% 53.3%");
+  const font = opts.fontFamily ?? "Inter";
+  const radius = opts.borderRadius ?? "0.5rem";
+  await mkdir(path2.join(dir, "src", "lib"), { recursive: true });
+  const files = [
+    ["package.json", packageJson(name)],
+    ["index.html", indexHtml(font)],
+    ["vite.config.js", viteConfig()],
+    ["tailwind.config.js", tailwindConfig()],
+    ["postcss.config.js", postcssConfig()],
+    [path2.join("src", "index.css"), indexCss(primary, font, radius)],
+    [path2.join("src", "lib", "utils.ts"), utilsTs()],
+    [path2.join("src", "lib", "proxy.ts"), proxyTs()],
+    [path2.join("src", "main.tsx"), mainTsx()]
+  ];
+  const created = [];
+  for (const [filePath, content] of files) {
+    await Bun.write(path2.join(dir, filePath), content);
+    created.push(filePath);
+  }
+  return created;
+}
+var scaffold = tool({
+  description: "Scaffold a new React + Vite + Tailwind CSS project with the HelloLeo design system. " + "Creates all mandatory boilerplate: package.json, index.html (with Google Fonts), " + "vite.config.js, tailwind.config.js, postcss.config.js, src/index.css (CSS variables " + "light+dark), src/lib/utils.ts (cn helper), src/lib/proxy.ts, and src/main.tsx. " + "Call this FIRST for any new project before writing App.tsx and components. " + "For NetSuite projects (NetSuite MCP in the live list), call `setup_netsuite` " + "INSTEAD -- it bundles base scaffold + OAuth wiring in one call. Do not call both.",
+  args: {
+    name: tool.schema.string().optional().describe("Project name for package.json (default: leo-project)"),
+    primaryColor: tool.schema.string().optional().describe("Primary brand color. Prefer raw HSL triplet (no hsl() wrapper, no # prefix), " + 'e.g. "221.2 83.2% 53.3%". Hex like "#3b82f6" is also accepted and will ' + "be auto-converted. Default: blue."),
+    fontFamily: tool.schema.string().optional().describe('Google Font family name, e.g. "Inter", "Poppins" (default: Inter)'),
+    borderRadius: tool.schema.string().optional().describe('Base border radius, e.g. "0.5rem", "0.75rem" (default: 0.5rem)')
+  },
+  async execute(args, context) {
+    const created = await writeBaseScaffold(args, context.directory);
+    return [
+      `Scaffolded ${created.length} files:`,
+      ...created.map((f) => `  - ${f}`),
+      "",
+      "Next: create src/App.tsx with your application code.",
+      "Design system reference: read the header comment in src/index.css",
+      "  before adding tokens or styling primitives.",
+      "Integration calls: use callIntegration() from src/lib/proxy.ts.",
+      "  Header comment in that file documents slugs, response unwrapping,",
+      "  pagination, and frontend-only vs HelloLeo Cloud routing.",
+      "Update package.json with any extra packages you need after scaffolding."
+    ].join(`
+`);
+  }
+});
+var ScaffoldPlugin = async () => {
+  return {
+    tool: { scaffold }
+  };
+};
+// src/tools/setup-netsuite.ts
+import { mkdir as mkdir2 } from "fs/promises";
+import path3 from "path";
+function netsuiteTs() {
+  return `/*
+ * NetSuite OAuth client helper (bearer-token-in-fragment).
+ *
+ * Two NetSuite Integration Records back this:
+ *   1. MCP (scope: mcp)            -- used by HelloLeo at build time.
+ *   2. Runtime (scope: rest_webservices) -- used here at sign-in time.
+ * Runtime credentials live as HelloLeo Cloud secrets on the project's Worker
+ * (env.NETSUITE_ACCOUNT_ID / _CLIENT_ID / _CLIENT_SECRET). They never reach
+ * the browser. Cookies are NOT used -- frontend \u2194 Worker are cross-site
+ * (e.g. *.helloleo.dev <-> *.workers.dev) and Chrome partitions / drops
+ * third-party cookies in the HelloLeo preview iframe.
+ *
+ * Flow:
+ *   1. User clicks "Sign in with NetSuite".
+ *   2. Browser navigates to the Worker /auth/netsuite/start.
+ *   3. Worker redirects to NetSuite's OAuth UI with PKCE.
+ *   4. NetSuite redirects back to the Worker /auth/netsuite/callback.
+ *   5. Worker exchanges the code, mints a session id, then redirects to
+ *      <return_to>#nssid=<sid>. URL fragments stay in the browser only.
+ *   6. This module reads the fragment on load, stashes the sid in
+ *      sessionStorage, and sends it as Authorization: Bearer on every
+ *      Worker call.
+ *
+ * NEVER use a hardcoded password gate. NEVER use sessionStorage as the
+ * authoritative auth state -- the only acceptable check is /api/me on the
+ * Worker. sessionStorage here is just a cache of the bearer token.
+ */
+
+export const WORKER_URL = import.meta.env.VITE_WORKER_URL ?? '';
+const TOKEN_KEY = 'nssid';
+
+// Capture-and-strip the #nssid=... fragment as early as possible so URLs
+// shown to the user stay clean. Runs once at module load.
+(function bootstrapTokenFromHash() {
+  if (typeof window === 'undefined') return;
+  const hash = window.location.hash.replace(/^#/, '');
+  if (!hash) return;
+  const params = new URLSearchParams(hash);
+  const sid = params.get(TOKEN_KEY);
+  if (sid) {
+    try { sessionStorage.setItem(TOKEN_KEY, sid); } catch {}
+    params.delete(TOKEN_KEY);
+    const remaining = params.toString();
+    const newHash = remaining ? '#' + remaining : '';
+    window.history.replaceState(null, '', window.location.pathname + window.location.search + newHash);
+  }
+})();
+
+export function getSessionToken(): string | null {
+  try { return sessionStorage.getItem(TOKEN_KEY); } catch { return null; }
+}
+
+export function signInWithNetSuite(returnTo: string = window.location.href) {
+  if (!WORKER_URL) {
+    throw new Error(
+      'VITE_WORKER_URL is not set. HelloLeo Cloud must be provisioned before sign-in works.',
+    );
+  }
+  const url = new URL(\`\${WORKER_URL.replace(/\\/$/, '')}/auth/netsuite/start\`);
+  url.searchParams.set('return_to', returnTo);
+  // The app usually renders inside the HelloLeo preview iframe. NetSuite's
+  // OAuth page sets X-Frame-Options: DENY, so navigating the iframe to the
+  // Worker (which 302s to NetSuite) ends up loading a page the browser
+  // refuses to render -- looks like "nothing happens" to the user. Navigate
+  // the top frame instead so the OAuth flow runs at the top level and the
   // callback redirect lands on the same top frame, which then reads the
   // #nssid= fragment. Fallback to same-frame navigation if the top window
   // is cross-origin and can't be reassigned.
@@ -12799,448 +13213,73 @@ export default function App() {
 }
 `;
 }
-
-// src/tools/scaffold.ts
-function packageJson(name) {
-  return JSON.stringify({
-    name,
-    private: true,
-    version: "0.0.0",
-    type: "module",
-    scripts: {
-      dev: "vite",
-      start: "vite",
-      build: "vite build",
-      preview: "vite preview"
-    },
-    dependencies: {
-      react: "^18.3.1",
-      "react-dom": "^18.3.1",
-      clsx: "^2.1.1",
-      "tailwind-merge": "^2.6.0",
-      "lucide-react": "^1.14.0"
-    },
-    devDependencies: {
-      "@types/react": "^18.3.12",
-      "@types/react-dom": "^18.3.1",
-      "@vitejs/plugin-react": "^4.3.4",
-      autoprefixer: "^10.4.20",
-      postcss: "^8.4.49",
-      tailwindcss: "^3.4.17",
-      typescript: "^5.6.3",
-      vite: "^6.0.5"
-    }
-  }, null, 2);
-}
-function indexHtml(fontFamily) {
-  const fontParam = fontFamily.replace(/\s+/g, "+");
-  return `<!DOCTYPE html>
-<html lang="en">
-  <head>
-    <meta charset="UTF-8" />
-    <meta name="viewport" content="width=device-width, initial-scale=1.0" />
-    <link rel="preconnect" href="https://fonts.googleapis.com">
-    <link rel="preconnect" href="https://fonts.gstatic.com" crossorigin>
-    <link href="https://fonts.googleapis.com/css2?family=${fontParam}:wght@400;500;600;700&display=swap" rel="stylesheet">
-    <title>App</title>
-  </head>
-  <body>
-    <div id="root"></div>
-    <script type="module" src="/src/main.tsx"></script>
-  </body>
-</html>`;
-}
-function viteConfig() {
-  return `import { defineConfig } from 'vite'
-import react from '@vitejs/plugin-react'
-import path from 'path'
-
-export default defineConfig({
-  plugins: [react()],
-  server: {
-    allowedHosts: true,
-  },
-  resolve: {
-    alias: {
-      '@': path.resolve(__dirname, './src'),
-    },
-  },
-})`;
-}
-function tailwindConfig() {
-  return `export default {
-  darkMode: ["class"],
-  content: ["./index.html", "./src/**/*.{js,ts,jsx,tsx}"],
-  theme: {
-    extend: {
-      colors: {
-        background: "hsl(var(--background))",
-        foreground: "hsl(var(--foreground))",
-        card: { DEFAULT: "hsl(var(--card))", foreground: "hsl(var(--card-foreground))" },
-        primary: { DEFAULT: "hsl(var(--primary))", foreground: "hsl(var(--primary-foreground))" },
-        secondary: { DEFAULT: "hsl(var(--secondary))", foreground: "hsl(var(--secondary-foreground))" },
-        muted: { DEFAULT: "hsl(var(--muted))", foreground: "hsl(var(--muted-foreground))" },
-        accent: { DEFAULT: "hsl(var(--accent))", foreground: "hsl(var(--accent-foreground))" },
-        destructive: { DEFAULT: "hsl(var(--destructive))", foreground: "hsl(var(--destructive-foreground))" },
-        success: { DEFAULT: "hsl(var(--success))", foreground: "hsl(var(--success-foreground))" },
-        warning: { DEFAULT: "hsl(var(--warning))", foreground: "hsl(var(--warning-foreground))" },
-        border: "hsl(var(--border))",
-        input: "hsl(var(--input))",
-        ring: "hsl(var(--ring))",
-      },
-      fontFamily: {
-        sans: "var(--font-sans)",
-        heading: "var(--font-heading)",
-      },
-      borderRadius: {
-        lg: "var(--radius)",
-        md: "calc(var(--radius) - 2px)",
-        sm: "calc(var(--radius) - 4px)",
-      },
-      borderWidth: {
-        DEFAULT: "var(--border-width)",
-      },
-      boxShadow: {
-        DEFAULT: "var(--shadow)",
-        lg: "var(--shadow-lg)",
-      },
-    },
-  },
-  plugins: [],
-}`;
-}
-function postcssConfig() {
-  return `export default {
-  plugins: {
-    tailwindcss: {},
-    autoprefixer: {},
-  },
-}`;
-}
-function indexCss(primaryColor, fontFamily, borderRadius) {
-  const fontValue = `'${fontFamily}', ui-sans-serif, system-ui, sans-serif`;
-  return `/*
- * HelloLeo Design System -- READ BEFORE STYLING.
- *
- * The CSS variables below are the single source of truth for the project's
- * design tokens. They power the no-code Design panel in the HelloLeo webapp:
- * the user edits colors / fonts / radius / shadows visually, and the panel
- * writes back to THIS file. Keeping the conventions intact is what unlocks
- * that round-trip.
- *
- * Conventions (do not break):
- *   - All colors stored as raw HSL triplets (no hsl() wrapper, no #hex).
- *     Tailwind classes wrap them via hsl(var(--token)). Never inline #hex
- *     in components -- always use design tokens (bg-primary, text-foreground,
- *     border-border, etc.).
- *   - --primary / --secondary / --accent / --destructive / --success /
- *     --warning each have a paired -foreground for text on that surface.
- *   - --radius drives lg/md/sm via calc() in tailwind.config.js. Edit here,
- *     not in component classes.
- *   - --font-sans for body, --font-heading for headings. Both load from the
- *     Google Fonts <link> in index.html.
- *   - .dark variants mirror :root one-for-one. When adding a token, add it
- *     to BOTH blocks or dark mode breaks.
- *
- * UI primitives (Button, Card, Input, Modal, Table, Badge, Alert, Spinner)
- * MUST live in src/components/ui/ and consume these tokens via Tailwind
- * classes -- never hardcoded colors. One responsibility per file, <50 lines
- * per component.
- */
-
-@tailwind base;
-@tailwind components;
-@tailwind utilities;
-
-@layer base {
-  :root {
-    --background: 0 0% 100%;
-    --foreground: 222.2 84% 4.9%;
-    --card: 0 0% 100%;
-    --card-foreground: 222.2 84% 4.9%;
-    --primary: ${primaryColor};
-    --primary-foreground: 210 40% 98%;
-    --secondary: 210 40% 96.1%;
-    --secondary-foreground: 222.2 47.4% 11.2%;
-    --muted: 210 40% 96.1%;
-    --muted-foreground: 215.4 16.3% 46.9%;
-    --accent: 210 40% 96.1%;
-    --accent-foreground: 222.2 47.4% 11.2%;
-    --destructive: 0 84.2% 60.2%;
-    --destructive-foreground: 210 40% 98%;
-    --success: 142 76% 36%;
-    --success-foreground: 210 40% 98%;
-    --warning: 38 92% 50%;
-    --warning-foreground: 222.2 47.4% 11.2%;
-    --border: 214.3 31.8% 91.4%;
-    --input: 214.3 31.8% 91.4%;
-    --ring: 221.2 83.2% 53.3%;
-    --radius: ${borderRadius};
-    --border-width: 1px;
-    --shadow: 0 1px 3px 0 rgb(0 0 0 / 0.1), 0 1px 2px -1px rgb(0 0 0 / 0.1);
-    --shadow-lg: 0 10px 15px -3px rgb(0 0 0 / 0.1), 0 4px 6px -4px rgb(0 0 0 / 0.1);
-    --font-sans: ${fontValue};
-    --font-heading: ${fontValue};
-  }
-
-  .dark {
-    --background: 222.2 84% 4.9%;
-    --foreground: 210 40% 98%;
-    --card: 222.2 84% 4.9%;
-    --card-foreground: 210 40% 98%;
-    --primary: 217.2 91.2% 59.8%;
-    --primary-foreground: 222.2 47.4% 11.2%;
-    --secondary: 217.2 32.6% 17.5%;
-    --secondary-foreground: 210 40% 98%;
-    --muted: 217.2 32.6% 17.5%;
-    --muted-foreground: 215 20.2% 65.1%;
-    --accent: 217.2 32.6% 17.5%;
-    --accent-foreground: 210 40% 98%;
-    --destructive: 0 62.8% 30.6%;
-    --destructive-foreground: 210 40% 98%;
-    --success: 142 76% 36%;
-    --success-foreground: 210 40% 98%;
-    --warning: 38 92% 50%;
-    --warning-foreground: 222.2 47.4% 11.2%;
-    --border: 217.2 32.6% 17.5%;
-    --input: 217.2 32.6% 17.5%;
-    --ring: 224.3 76.3% 48%;
-    --border-width: 1px;
-    --shadow: 0 1px 3px 0 rgb(0 0 0 / 0.3), 0 1px 2px -1px rgb(0 0 0 / 0.3);
-    --shadow-lg: 0 10px 15px -3px rgb(0 0 0 / 0.3), 0 4px 6px -4px rgb(0 0 0 / 0.3);
-    --font-sans: ${fontValue};
-    --font-heading: ${fontValue};
-  }
-}
-
-body {
-  @apply bg-background text-foreground font-sans;
-}`;
-}
-function utilsTs() {
-  return `import { clsx, type ClassValue } from 'clsx'
-import { twMerge } from 'tailwind-merge'
-
-export function cn(...inputs: ClassValue[]) {
-  return twMerge(clsx(inputs))
-}`;
-}
-function proxyTs() {
-  return `/*
- * HelloLeo Integration Proxy -- runtime helper for connected integrations.
- *
- * All third-party APIs (Odoo, Airtable, HubSpot, Stripe, Notion, Gladia,
- * Microsoft 365, Klaviyo, Supabase, DimoMaint, etc.) are reachable through
- * this single proxy. The proxy handles auth and CORS using credentials the
- * user already configured in Project Settings -- you NEVER pass an API key
- * from frontend code, and you NEVER call third-party hosts directly.
- *
- * Two modes:
- *   A) Frontend-only project -> import callIntegration() from this file.
- *   B) HelloLeo Cloud project -> route via Worker fetch(env.INTEGRATION_PROXY).
- *      Use Cloud whenever the project needs backend logic, automations,
- *      webhooks, scheduled jobs, or AI agents. Keep secrets server-side.
- *
- * Integration slugs:
- *   Use the exact slug from the Enabled MCP list with the "pipedream-"
- *   prefix removed. e.g. "pipedream-gorgias_oauth" -> "gorgias_oauth".
- *   Native integrations (odoo, airtable) keep their plain name.
- *
- * Response shape (always wrapped):
- *   { success: boolean, status: number, data: <provider payload> }
- *
- *   Unwrap "data" by provider:
- *     odoo            -> data.result
- *     airtable        -> data.records
- *     notion          -> data.results
- *     microsoft 365   -> data.value
- *     klaviyo         -> data.data
- *     supabase / dimomaint -> data
- *
- * Pagination: put query params directly in the endpoint string,
- *   e.g. endpoint: '/api/tickets?cursor=xyz&per_page=100'.
- *   Read pagination metadata from the response to build the next call.
- *   Never .filter() large lists in the frontend -- paginate server-side.
- *
- * Secrets for non-integration APIs (e.g. raw OpenAI): store them in
- * HelloLeo Cloud -> Settings -> Cloud -> Secrets, and read via env.SECRET_NAME
- * from a Worker. Never embed secrets in frontend code.
- */
-
-const PROJECT_UUID = import.meta.env.VITE_PROJECT_UUID ?? '';
-export const INTEGRATION_PROXY_URL =
-  \`https://api.app.helloleo.dev/api/integration-proxy/\${PROJECT_UUID}\`;
-
-export interface ProxyRequest {
-  integration: string;
-  endpoint: string;
-  method?: 'GET' | 'POST' | 'PUT' | 'PATCH' | 'DELETE';
-  body?: unknown;
-  headers?: Record<string, string>;
-}
-
-export interface ProxyResponse<T = unknown> {
-  success: boolean;
-  status: number;
-  data: T;
-}
-
-export async function callIntegration<T = unknown>(
-  req: ProxyRequest,
-): Promise<ProxyResponse<T>> {
-  const res = await fetch(INTEGRATION_PROXY_URL, {
-    method: 'POST',
-    headers: { 'Content-Type': 'application/json' },
-    body: JSON.stringify({ method: 'POST', ...req }),
-  });
-  return res.json();
-}
-
-/* Example -- Odoo search_read:
- *
- *   const r = await callIntegration({
- *     integration: 'odoo',
- *     endpoint: '/jsonrpc',
- *     body: {
- *       model: 'product.template',
- *       method: 'search_read',
- *       args: [[['type', '=', 'consu']]],
- *       kwargs: { fields: ['name', 'list_price'], limit: 50 },
- *     },
- *   });
- *   const products = r.data?.result ?? [];
- */
-`;
-}
-function hexToHslTriplet(hex3) {
-  let h = hex3.trim().replace(/^#/, "");
-  if (h.length === 3) {
-    h = h.split("").map((c) => c + c).join("");
-  }
-  if (!/^[0-9a-fA-F]{6}$/.test(h))
-    return "";
-  const r = Number.parseInt(h.slice(0, 2), 16) / 255;
-  const g = Number.parseInt(h.slice(2, 4), 16) / 255;
-  const b = Number.parseInt(h.slice(4, 6), 16) / 255;
-  const max = Math.max(r, g, b);
-  const min = Math.min(r, g, b);
-  const l = (max + min) / 2;
-  let s = 0;
-  let hue = 0;
-  if (max !== min) {
-    const d = max - min;
-    s = l > 0.5 ? d / (2 - max - min) : d / (max + min);
-    switch (max) {
-      case r:
-        hue = (g - b) / d + (g < b ? 6 : 0);
-        break;
-      case g:
-        hue = (b - r) / d + 2;
-        break;
-      default:
-        hue = (r - g) / d + 4;
-    }
-    hue *= 60;
-  }
-  return `${Math.round(hue)} ${Math.round(s * 100)}% ${Math.round(l * 100)}%`;
-}
-function normalizePrimaryColor(value) {
-  const trimmed = value.trim();
-  if (/^(#|[0-9a-fA-F]{3}$|[0-9a-fA-F]{6}$)/.test(trimmed)) {
-    const hsl = hexToHslTriplet(trimmed);
-    if (hsl)
-      return hsl;
-  }
-  return trimmed;
-}
-function mainTsx() {
-  return `import React from 'react'
-import ReactDOM from 'react-dom/client'
-import App from './App'
-import './index.css'
-
-ReactDOM.createRoot(document.getElementById('root')!).render(
-  <React.StrictMode>
-    <App />
-  </React.StrictMode>,
-)`;
-}
-var scaffold = tool({
-  description: "Scaffold a new React + Vite + Tailwind CSS project with the HelloLeo design system. " + "Creates all mandatory boilerplate: package.json, index.html (with Google Fonts), " + "vite.config.js, tailwind.config.js, postcss.config.js, src/index.css (CSS variables " + "light+dark), src/lib/utils.ts (cn helper), and src/main.tsx. " + "Call this FIRST for any new project before writing App.tsx and components.",
-  args: {
-    name: tool.schema.string().optional().describe("Project name for package.json (default: leo-project)"),
-    primaryColor: tool.schema.string().optional().describe("Primary brand color. Prefer raw HSL triplet (no hsl() wrapper, no # prefix), " + 'e.g. "221.2 83.2% 53.3%". Hex like "#3b82f6" is also accepted and will ' + "be auto-converted. Default: blue."),
-    fontFamily: tool.schema.string().optional().describe('Google Font family name, e.g. "Inter", "Poppins" (default: Inter)'),
-    borderRadius: tool.schema.string().optional().describe('Base border radius, e.g. "0.5rem", "0.75rem" (default: 0.5rem)'),
-    integrations: tool.schema.array(tool.schema.string()).optional().describe("Connected integration slugs for this project (live MCP list). " + 'Pass ["netsuite"] when the project uses NetSuite -- the scaffold ' + "will add src/lib/netsuite.ts (OAuth client helper), " + "src/components/auth/{SignInWithNetSuite,LoginPage,AuthGate}.tsx " + "and a src/App.tsx wrapped in <AuthGate>. OAuth is wired from " + "day one. Forbids hardcoded password gates -- the gate IS the " + "real flow against the project's Worker.")
-  },
-  async execute(args, context) {
+var setupNetsuite = tool({
+  description: "Bootstrap a NetSuite-backed React + Vite + Tailwind project in one call. " + "Writes the full HelloLeo base scaffold AND the NetSuite OAuth wiring " + "(src/lib/netsuite.ts, src/components/auth/{SignInWithNetSuite,LoginPage,AuthGate}.tsx, " + "src/App.tsx wrapped in <AuthGate>). " + "Use this INSTEAD of `scaffold` for any project that needs NetSuite. " + "Uses default theme (Inter font, blue primary, 0.5rem radius) -- edit " + "src/index.css afterwards to customise. Real OAuth is wired from day " + "one -- never replace the gate with a password placeholder.",
+  args: {},
+  async execute(_args, context) {
     const dir = context.directory;
-    const name = args.name ?? "leo-project";
-    const primary = normalizePrimaryColor(args.primaryColor ?? "221.2 83.2% 53.3%");
-    const font = args.fontFamily ?? "Inter";
-    const radius = args.borderRadius ?? "0.5rem";
-    const integrations = (args.integrations ?? []).map((s) => s.toLowerCase());
-    const hasNetsuite = integrations.includes("netsuite");
-    await mkdir(path2.join(dir, "src", "lib"), { recursive: true });
-    if (hasNetsuite) {
-      await mkdir(path2.join(dir, "src", "components", "auth"), {
-        recursive: true
-      });
-    }
-    const files = [
-      ["package.json", packageJson(name)],
-      ["index.html", indexHtml(font)],
-      ["vite.config.js", viteConfig()],
-      ["tailwind.config.js", tailwindConfig()],
-      ["postcss.config.js", postcssConfig()],
-      [path2.join("src", "index.css"), indexCss(primary, font, radius)],
-      [path2.join("src", "lib", "utils.ts"), utilsTs()],
-      [path2.join("src", "lib", "proxy.ts"), proxyTs()],
-      [path2.join("src", "main.tsx"), mainTsx()]
-    ];
-    if (hasNetsuite) {
-      files.push([path2.join("src", "lib", "netsuite.ts"), netsuiteTs()], [
-        path2.join("src", "components", "auth", "SignInWithNetSuite.tsx"),
+    const base = await writeBaseScaffold({}, dir);
+    await mkdir2(path3.join(dir, "src", "components", "auth"), {
+      recursive: true
+    });
+    const nsFiles = [
+      [path3.join("src", "lib", "netsuite.ts"), netsuiteTs()],
+      [
+        path3.join("src", "components", "auth", "SignInWithNetSuite.tsx"),
         signInButtonTsx()
-      ], [
-        path2.join("src", "components", "auth", "LoginPage.tsx"),
+      ],
+      [
+        path3.join("src", "components", "auth", "LoginPage.tsx"),
         netsuiteLoginPageTsx()
-      ], [
-        path2.join("src", "components", "auth", "AuthGate.tsx"),
+      ],
+      [
+        path3.join("src", "components", "auth", "AuthGate.tsx"),
         netsuiteAuthGateTsx()
-      ], [path2.join("src", "App.tsx"), netsuiteAppTsx()]);
-    }
-    const created = [];
-    for (const [filePath, content] of files) {
-      await Bun.write(path2.join(dir, filePath), content);
-      created.push(filePath);
-    }
-    const out = [
-      `Scaffolded ${created.length} files:`,
-      ...created.map((f) => `  - ${f}`),
+      ],
+      [path3.join("src", "App.tsx"), netsuiteAppTsx()]
+    ];
+    const nsCreated = [];
+    for (const [filePath, content] of nsFiles) {
+      await Bun.write(path3.join(dir, filePath), content);
+      nsCreated.push(filePath);
+    }
+    const all = [...base, ...nsCreated];
+    return [
+      `Scaffolded ${all.length} files (base + NetSuite OAuth):`,
+      ...all.map((f) => `  - ${f}`),
       "",
-      "Next: create src/App.tsx with your application code.",
+      "Next: build your dashboard INSIDE <AuthGate> in src/App.tsx.",
       "Design system reference: read the header comment in src/index.css",
       "  before adding tokens or styling primitives.",
-      "Integration calls: use callIntegration() from src/lib/proxy.ts.",
-      "  Header comment in that file documents slugs, response unwrapping,",
-      "  pagination, and frontend-only vs HelloLeo Cloud routing.",
-      "Update package.json with any extra packages you need after scaffolding."
-    ];
-    if (hasNetsuite) {
-      out.push("", "NetSuite project -- auth is already wired:", "  - App.tsx wraps everything in <AuthGate>. Build your dashboard", "    INSIDE the gate. NEVER remove the gate or build a password", "    placeholder -- real OAuth is the only allowed login.", "  - LoginPage.tsx + SignInWithNetSuite.tsx are the unauthenticated", "    view. Customise the copy / imagery, keep <SignInWithNetSuite/>", "    as the call-to-action.", "  - signInWithNetSuite() in src/lib/netsuite.ts hits the Worker at", "    /auth/netsuite/start. Deploy the Worker via cloudflare-backend", "    MCP with routes:", "      GET  /auth/netsuite/start     -- redirect to NetSuite OAuth", "      GET  /auth/netsuite/callback  -- code -> token exchange", "      GET  /api/me                   -- current session", "      POST /auth/netsuite/logout    -- clear session", "    Worker reads env.NETSUITE_ACCOUNT_ID, env.NETSUITE_CLIENT_ID,", "    env.NETSUITE_CLIENT_SECRET (set by the runtime-setup wizard).", "  - VITE_WORKER_URL must be set in the project env so the frontend", "    knows where to send users. The HelloLeo Cloud provisioner", "    seeds this automatically.");
-    }
-    return out.join(`
+      "",
+      "NetSuite auth -- already wired:",
+      "  - App.tsx wraps everything in <AuthGate>. NEVER remove the gate",
+      "    or build a password placeholder -- real OAuth is the only login.",
+      "  - LoginPage.tsx + SignInWithNetSuite.tsx are the unauthenticated",
+      "    view. Customise the copy / imagery, keep <SignInWithNetSuite/>",
+      "    as the call-to-action.",
+      "  - signInWithNetSuite() in src/lib/netsuite.ts hits the Worker at",
+      "    /auth/netsuite/start. Deploy the Worker via cloudflare-backend",
+      "    MCP with routes:",
+      "      GET  /auth/netsuite/start     -- redirect to NetSuite OAuth",
+      "      GET  /auth/netsuite/callback  -- code -> token exchange",
+      "      GET  /api/me                   -- current session",
+      "      POST /auth/netsuite/logout    -- clear session",
+      "    Worker reads env.NETSUITE_ACCOUNT_ID, env.NETSUITE_CLIENT_ID,",
+      "    env.NETSUITE_CLIENT_SECRET (set by the runtime-setup wizard).",
+      "  - VITE_WORKER_URL must be set so the frontend knows where to",
+      "    send users. The HelloLeo Cloud provisioner seeds this."
+    ].join(`
 `);
   }
 });
-var ScaffoldPlugin = async () => {
+var SetupNetsuitePlugin = async () => {
   return {
-    tool: { scaffold }
+    tool: { setup_netsuite: setupNetsuite }
   };
 };
 export {
+  SetupNetsuitePlugin,
   ScaffoldPlugin,
   RemovePlugin,
   InspectHttpPlugin