@helloleo/plugins 0.1.13 → 0.1.14

package/src/tools/start-scaffold.ts

@@ -1,1343 +0,0 @@
-import { mkdir } from "node:fs/promises";
-import path from "node:path";
-import { type BaseScaffoldOptions, normalizePrimaryColor } from "./scaffold.ts";
-
-/**
- * TanStack Start project template (SSR React deployed as a Cloudflare Worker).
- *
- * Replaces the legacy Vite-SPA scaffold (`writeBaseScaffold`) for all new
- * non-NetSuite projects. Backend is real server-function code hitting a D1
- * binding directly -- HelloLeo Cloud IS the Start server. Dev runs in a
- * CodeSandbox microVM (`vite dev`, Miniflare-local D1); prod ships to Workers
- * for Platforms with a real D1 binding.
- *
- * NetSuite projects still use the legacy Vite-SPA scaffold (see
- * `setup-netsuite.ts`) until that OAuth flow is migrated separately.
- */
-
-function packageJson(name: string): string {
-	return JSON.stringify(
-		{
-			name,
-			private: true,
-			type: "module",
-			imports: { "#/*": "./src/*" },
-			scripts: {
-				dev: "vite dev",
-				build: "vite build",
-				preview: "vite preview",
-				deploy: "vite build && wrangler deploy",
-				check: "biome check",
-			},
-			dependencies: {
-				"@cloudflare/vite-plugin": "^1.26.0",
-				"@tailwindcss/vite": "^4.1.18",
-				"@tanstack/react-query": "latest",
-				"@tanstack/react-router": "latest",
-				"@tanstack/react-start": "latest",
-				"@tanstack/router-plugin": "^1.132.0",
-				"class-variance-authority": "^0.7.1",
-				clsx: "^2.1.1",
-				jose: "^6.1.0",
-				"lucide-react": "^0.577.0",
-				react: "^19.2.0",
-				"react-dom": "^19.2.0",
-				"tailwind-merge": "^3.0.2",
-				tailwindcss: "^4.1.18",
-				zod: "^4.3.6",
-			},
-			devDependencies: {
-				"@biomejs/biome": "2.4.5",
-				"@cloudflare/workers-types": "^4.20250906.0",
-				"@types/better-sqlite3": "^7.6.11",
-				"@types/node": "^22.10.2",
-				"better-sqlite3": "^11.8.0",
-				"@types/react": "^19.2.0",
-				"@types/react-dom": "^19.2.0",
-				"@vitejs/plugin-react": "^6.0.1",
-				typescript: "^5.9.0",
-				vite: "^8.0.0",
-				wrangler: "^4.70.0",
-			},
-		},
-		null,
-		2,
-	);
-}
-
-function viteConfig(): string {
-	return `import { fileURLToPath } from "node:url";
-import { defineConfig } from "vite";
-import { tanstackStart } from "@tanstack/react-start/plugin/vite";
-import viteReact from "@vitejs/plugin-react";
-import tailwindcss from "@tailwindcss/vite";
-import { cloudflare } from "@cloudflare/vite-plugin";
-
-const src = fileURLToPath(new URL("./src", import.meta.url));
-const cfDevShim = fileURLToPath(
-  new URL("./src/integrations/hl-cloud/cf-dev-shim.ts", import.meta.url),
-);
-
-export default defineConfig(({ command }) => {
-  const isDev = command === "serve";
-  return {
-    // allowedHosts lets the CodeSandbox preview proxy (*.csb.app) reach the
-    // dev server. Required for the HelloLeo dev preview to render.
-    server: { allowedHosts: true },
-    resolve: {
-      alias: {
-        // Match the tsconfig path aliases (#/* and @/*).
-        "@": src,
-        "#": src,
-        // Dev runs under plain node -- workerd can't run in the preview VM --
-        // so shim the worker-only "cloudflare:workers" module with a local
-        // sqlite-backed D1 + dev env. Prod build uses the real binding.
-        ...(isDev ? { "cloudflare:workers": cfDevShim } : {}),
-      },
-    },
-    plugins: [
-      // Prod: real workerd runtime + D1 binding. Dev: skipped (workerd can't
-      // run nested in the preview VM); plain vite SSR + the shim above.
-      ...(isDev ? [] : [cloudflare({ viteEnvironment: { name: "ssr" } })]),
-      tailwindcss(),
-      tanstackStart(),
-      viteReact(),
-    ],
-  };
-});
-`;
-}
-
-function tsconfigJson(): string {
-	return JSON.stringify(
-		{
-			include: ["**/*.ts", "**/*.tsx", "worker-configuration.d.ts"],
-			compilerOptions: {
-				target: "ES2022",
-				jsx: "react-jsx",
-				module: "ESNext",
-				paths: { "#/*": ["./src/*"], "@/*": ["./src/*"] },
-				lib: ["ES2022", "DOM", "DOM.Iterable"],
-				types: ["vite/client"],
-				moduleResolution: "bundler",
-				allowImportingTsExtensions: true,
-				verbatimModuleSyntax: true,
-				noEmit: true,
-				skipLibCheck: true,
-				strict: true,
-				noUnusedLocals: true,
-				noUnusedParameters: true,
-				noFallthroughCasesInSwitch: true,
-				noUncheckedSideEffectImports: true,
-			},
-		},
-		null,
-		2,
-	);
-}
-
-function biomeJson(): string {
-	return JSON.stringify(
-		{
-			$schema: "https://biomejs.dev/schemas/2.4.5/schema.json",
-			vcs: { enabled: false, clientKind: "git", useIgnoreFile: false },
-			files: {
-				ignoreUnknown: false,
-				includes: [
-					"**/src/**/*",
-					"**/vite.config.ts",
-					"!**/src/routeTree.gen.ts",
-					"!**/src/styles.css",
-				],
-			},
-			formatter: { enabled: true, indentStyle: "tab" },
-			assist: { actions: { source: { organizeImports: "on" } } },
-			linter: { enabled: true, rules: { recommended: true } },
-			javascript: { formatter: { quoteStyle: "double" } },
-		},
-		null,
-		2,
-	);
-}
-
-function componentsJson(): string {
-	return JSON.stringify(
-		{
-			$schema: "https://ui.shadcn.com/schema.json",
-			style: "new-york",
-			rsc: false,
-			tsx: true,
-			tailwind: {
-				config: "",
-				css: "src/styles.css",
-				baseColor: "zinc",
-				cssVariables: true,
-				prefix: "",
-			},
-			aliases: {
-				components: "#/components",
-				utils: "#/lib/utils",
-				ui: "#/components/ui",
-				lib: "#/lib",
-				hooks: "#/hooks",
-			},
-			iconLibrary: "lucide",
-		},
-		null,
-		2,
-	);
-}
-
-function wranglerJsonc(name: string): string {
-	return `{
-  "$schema": "node_modules/wrangler/config-schema.json",
-  "name": "${name}",
-  "compatibility_date": "2025-09-02",
-  "compatibility_flags": ["nodejs_compat"],
-  // src/server.ts wraps the TanStack Start server-entry to render graceful
-  // 500 pages instead of leaking raw SSR stack traces.
-  "main": "src/server.ts",
-  // HelloLeo Cloud database. In dev, @cloudflare/vite-plugin emulates this
-  // with a local Miniflare sqlite file. The real prod database_id is injected
-  // by the HelloLeo deploy pipeline -- do not hardcode a prod id here.
-  "d1_databases": [
-    { "binding": "DB", "database_id": "local-dev-placeholder" }
-  ]
-}
-`;
-}
-
-function workerConfigurationDts(): string {
-	return `/// <reference types="@cloudflare/workers-types" />
-
-// Cloudflare bindings for this project's Worker. \`wrangler types\` can
-// regenerate this. The HelloLeo deploy pipeline injects the real D1
-// database_id at publish time.
-interface Env {
-  // HelloLeo Cloud database (D1). Access request-scoped via getDb() in
-  // src/integrations/hl-cloud/db.server.ts -- never read at module scope.
-  DB: D1Database;
-  // HMAC secret used to sign/verify HelloLeo Cloud auth JWTs. Set as a Worker
-  // secret. The issuer/verify mechanism is the auth integration point -- see
-  // src/integrations/hl-cloud/auth.functions.ts.
-  HL_CLOUD_JWT_SECRET: string;
-  // This project's HelloLeo UUID, used by the server-side integration proxy.
-  PROJECT_UUID?: string;
-}
-
-declare module "cloudflare:workers" {
-  export const env: Env;
-}
-`;
-}
-
-function gitignore(): string {
-	return `node_modules
-dist
-.output
-.vinxi
-.wrangler
-.dev.db
-.dev.db-*
-.env
-.env.*
-!.env.example
-*.local
-.DS_Store
-`;
-}
-
-// DEV-ONLY shim for "cloudflare:workers" (aliased in vite.config when
-// command==="serve"). workerd can't run in the preview VM, so back the DB
-// binding with a local sqlite file; SSR + server functions behave like prod.
-function cfDevShimTs(): string {
-	return `import Database from "better-sqlite3";
-import { existsSync, readFileSync } from "node:fs";
-
-const sqlite = new Database(".dev.db");
-sqlite.pragma("journal_mode = WAL");
-if (existsSync("schema.sql")) {
-  try {
-    sqlite.exec(readFileSync("schema.sql", "utf-8"));
-  } catch (e) {
-    console.error("[cf-dev-shim] failed to apply schema.sql:", e);
-  }
-}
-
-// Minimal D1Database-compatible adapter over better-sqlite3 (sync), presented
-// with D1's async prepare().bind().all()/first()/run() surface.
-function makeDb() {
-  return {
-    prepare(sql: string) {
-      const stmt = sqlite.prepare(sql);
-      const bound = (params: unknown[]) => ({
-        async all<T = unknown>() {
-          return { results: stmt.all(...params) as T[], success: true, meta: {} };
-        },
-        async first<T = unknown>() {
-          return (stmt.get(...params) as T) ?? null;
-        },
-        async run() {
-          const r = stmt.run(...params);
-          return {
-            success: true,
-            meta: { changes: r.changes, last_row_id: Number(r.lastInsertRowid) },
-          };
-        },
-      });
-      return { bind: (...params: unknown[]) => bound(params), ...bound([]) };
-    },
-  };
-}
-
-export const env = {
-  DB: makeDb(),
-  HL_CLOUD_JWT_SECRET:
-    process.env.HL_CLOUD_JWT_SECRET ?? "dev-insecure-secret-change-me",
-  PROJECT_UUID: process.env.PROJECT_UUID ?? "dev",
-} as unknown as Env;
-`;
-}
-
-function schemaSql(): string {
-	return `-- HelloLeo Cloud schema (D1 / sqlite).
--- Dev: apply to the local Miniflare DB. Prod: applied by the deploy pipeline.
---   wrangler d1 execute DB --local --file=./schema.sql
---   wrangler d1 execute DB --remote --file=./schema.sql
-
-CREATE TABLE IF NOT EXISTS users (
-  id TEXT PRIMARY KEY,
-  email TEXT NOT NULL UNIQUE,
-  password_hash TEXT NOT NULL,
-  created_at INTEGER NOT NULL
-);
-
--- Example domain table. Every row is owned by a user; server functions always
--- filter by context.userId so users never see each other's data.
-CREATE TABLE IF NOT EXISTS items (
-  id TEXT PRIMARY KEY,
-  user_id TEXT NOT NULL,
-  title TEXT NOT NULL DEFAULT '',
-  created_at INTEGER NOT NULL
-);
-CREATE INDEX IF NOT EXISTS items_user_id_idx ON items (user_id);
-`;
-}
-
-function stylesCss(primary: string, font: string, radius: string): string {
-	const fontValue = `'${font}', ui-sans-serif, system-ui, sans-serif`;
-	return `@import 'tailwindcss';
-
-@custom-variant dark (&:is(.dark *));
-
-/*
- * HelloLeo Design System -- READ BEFORE STYLING.
- *
- * The CSS variables below are the single source of truth for the project's
- * design tokens. They power the no-code Design panel in the HelloLeo webapp:
- * the user edits colors / fonts / radius / shadows visually, and the panel
- * writes back to THIS file (src/styles.css). Keeping the conventions intact
- * is what unlocks that round-trip.
- *
- * Conventions (do not break):
- *   - Colors are stored as raw HSL triplets (no hsl() wrapper, no #hex).
- *     The @theme block below wraps them via hsl(var(--token)) so Tailwind v4
- *     utilities (bg-primary, text-foreground, border-border, ...) resolve.
- *     Never inline #hex in components -- always use the token utilities.
- *   - --primary / --secondary / --accent / --destructive / --success /
- *     --warning each have a paired -foreground for text on that surface.
- *   - --radius drives radius-lg/md/sm via calc() in @theme. Edit here.
- *   - --font-sans for body, --font-heading for headings. Both load from the
- *     Google Fonts <link> in src/routes/__root.tsx.
- *   - .dark mirrors :root one-for-one. When adding a token, add it to BOTH
- *     blocks or dark mode breaks.
- *
- * UI primitives (Button, Card, Input, ...) MUST live in src/components/ui/
- * and consume these tokens via Tailwind classes -- never hardcoded colors.
- */
-
-:root {
-  --background: 0 0% 100%;
-  --foreground: 222.2 84% 4.9%;
-  --card: 0 0% 100%;
-  --card-foreground: 222.2 84% 4.9%;
-  --primary: ${primary};
-  --primary-foreground: 210 40% 98%;
-  --secondary: 210 40% 96.1%;
-  --secondary-foreground: 222.2 47.4% 11.2%;
-  --muted: 210 40% 96.1%;
-  --muted-foreground: 215.4 16.3% 46.9%;
-  --accent: 210 40% 96.1%;
-  --accent-foreground: 222.2 47.4% 11.2%;
-  --destructive: 0 84.2% 60.2%;
-  --destructive-foreground: 210 40% 98%;
-  --success: 142 76% 36%;
-  --success-foreground: 210 40% 98%;
-  --warning: 38 92% 50%;
-  --warning-foreground: 222.2 47.4% 11.2%;
-  --border: 214.3 31.8% 91.4%;
-  --input: 214.3 31.8% 91.4%;
-  --ring: 221.2 83.2% 53.3%;
-  --radius: ${radius};
-  --font-sans: ${fontValue};
-  --font-heading: ${fontValue};
-}
-
-.dark {
-  --background: 222.2 84% 4.9%;
-  --foreground: 210 40% 98%;
-  --card: 222.2 84% 4.9%;
-  --card-foreground: 210 40% 98%;
-  --primary: 217.2 91.2% 59.8%;
-  --primary-foreground: 222.2 47.4% 11.2%;
-  --secondary: 217.2 32.6% 17.5%;
-  --secondary-foreground: 210 40% 98%;
-  --muted: 217.2 32.6% 17.5%;
-  --muted-foreground: 215 20.2% 65.1%;
-  --accent: 217.2 32.6% 17.5%;
-  --accent-foreground: 210 40% 98%;
-  --destructive: 0 62.8% 30.6%;
-  --destructive-foreground: 210 40% 98%;
-  --success: 142 76% 36%;
-  --success-foreground: 210 40% 98%;
-  --warning: 38 92% 50%;
-  --warning-foreground: 222.2 47.4% 11.2%;
-  --border: 217.2 32.6% 17.5%;
-  --input: 217.2 32.6% 17.5%;
-  --ring: 224.3 76.3% 48%;
-  --font-sans: ${fontValue};
-  --font-heading: ${fontValue};
-}
-
-@theme inline {
-  --color-background: hsl(var(--background));
-  --color-foreground: hsl(var(--foreground));
-  --color-card: hsl(var(--card));
-  --color-card-foreground: hsl(var(--card-foreground));
-  --color-primary: hsl(var(--primary));
-  --color-primary-foreground: hsl(var(--primary-foreground));
-  --color-secondary: hsl(var(--secondary));
-  --color-secondary-foreground: hsl(var(--secondary-foreground));
-  --color-muted: hsl(var(--muted));
-  --color-muted-foreground: hsl(var(--muted-foreground));
-  --color-accent: hsl(var(--accent));
-  --color-accent-foreground: hsl(var(--accent-foreground));
-  --color-destructive: hsl(var(--destructive));
-  --color-destructive-foreground: hsl(var(--destructive-foreground));
-  --color-success: hsl(var(--success));
-  --color-success-foreground: hsl(var(--success-foreground));
-  --color-warning: hsl(var(--warning));
-  --color-warning-foreground: hsl(var(--warning-foreground));
-  --color-border: hsl(var(--border));
-  --color-input: hsl(var(--input));
-  --color-ring: hsl(var(--ring));
-  --radius-sm: calc(var(--radius) - 4px);
-  --radius-md: calc(var(--radius) - 2px);
-  --radius-lg: var(--radius);
-  --radius-xl: calc(var(--radius) + 4px);
-  --font-sans: var(--font-sans);
-  --font-heading: var(--font-heading);
-}
-
-@layer base {
-  * {
-    @apply border-border;
-  }
-  body {
-    @apply bg-background text-foreground font-sans antialiased;
-  }
-}
-`;
-}
-
-function utilsTs(): string {
-	return `import { clsx, type ClassValue } from "clsx";
-import { twMerge } from "tailwind-merge";
-
-export function cn(...inputs: ClassValue[]) {
-  return twMerge(clsx(inputs));
-}
-`;
-}
-
-function routerTsx(): string {
-	return `import { QueryClient } from "@tanstack/react-query";
-import { createRouter as createTanStackRouter } from "@tanstack/react-router";
-import { routeTree } from "./routeTree.gen";
-
-export function getRouter() {
-  const queryClient = new QueryClient();
-
-  const router = createTanStackRouter({
-    routeTree,
-    context: { queryClient },
-    scrollRestoration: true,
-    defaultPreload: "intent",
-    defaultPreloadStaleTime: 0,
-  });
-
-  return router;
-}
-
-declare module "@tanstack/react-router" {
-  interface Register {
-    router: ReturnType<typeof getRouter>;
-  }
-}
-`;
-}
-
-function serverTs(): string {
-	return `// Cloudflare Worker entry. Wraps the TanStack Start server-entry so SSR
-// failures render a clean 500 page instead of leaking a raw stack trace.
-type ServerEntry = {
-  fetch: (
-    request: Request,
-    env: unknown,
-    ctx: unknown,
-  ) => Promise<Response> | Response;
-};
-
-let serverEntryPromise: Promise<ServerEntry> | undefined;
-
-async function getServerEntry(): Promise<ServerEntry> {
-  if (!serverEntryPromise) {
-    serverEntryPromise = import("@tanstack/react-start/server-entry").then(
-      (m) => ((m as { default?: ServerEntry }).default ?? m) as ServerEntry,
-    );
-  }
-  return serverEntryPromise;
-}
-
-function errorPage(): Response {
-  const html =
-    "<!doctype html><html><head><meta charset='utf-8'>" +
-    "<meta name='viewport' content='width=device-width, initial-scale=1'>" +
-    "<title>Something went wrong</title></head>" +
-    "<body style='font-family:system-ui;display:grid;place-items:center;" +
-    "min-height:100vh;margin:0;color:#0f172a'>" +
-    "<div style='text-align:center'><h1>Something went wrong</h1>" +
-    "<p>The server hit an unexpected error. Try again.</p></div></body></html>";
-  return new Response(html, {
-    status: 500,
-    headers: { "content-type": "text/html; charset=utf-8" },
-  });
-}
-
-export default {
-  async fetch(request: Request, env: unknown, ctx: unknown) {
-    try {
-      const handler = await getServerEntry();
-      return await handler.fetch(request, env, ctx);
-    } catch (error) {
-      console.error(error);
-      return errorPage();
-    }
-  },
-};
-`;
-}
-
-function startTs(): string {
-	return `import { createStart, createMiddleware } from "@tanstack/react-start";
-import { attachHlCloudAuth } from "./integrations/hl-cloud/auth-attacher";
-
-// Re-throw framework redirects/notFound; turn anything else into a 500 so a
-// thrown error in a server function never crashes the whole request.
-const errorMiddleware = createMiddleware().server(async ({ next }) => {
-  return await next();
-});
-
-export const startInstance = createStart(() => ({
-  requestMiddleware: [errorMiddleware],
-  // Global client middleware: attaches the HelloLeo Cloud bearer token to
-  // every server-function RPC. Without this, authenticated calls are rejected.
-  functionMiddleware: [attachHlCloudAuth],
-}));
-`;
-}
-
-function rootTsx(font: string): string {
-	const fontParam = font.replace(/\s+/g, "+");
-	return `import {
-  HeadContent,
-  Link,
-  Outlet,
-  Scripts,
-  createRootRouteWithContext,
-} from "@tanstack/react-router";
-import {
-  QueryClient,
-  QueryClientProvider,
-} from "@tanstack/react-query";
-import type { ReactNode } from "react";
-
-import appCss from "../styles.css?url";
-
-const THEME_INIT = "(function(){try{var m=localStorage.getItem('theme');var d=window.matchMedia('(prefers-color-scheme: dark)').matches;var r=(m==='dark'||(m!=='light'&&d))?'dark':'light';document.documentElement.classList.add(r);document.documentElement.style.colorScheme=r;}catch(e){}})();";
-
-export const Route = createRootRouteWithContext<{ queryClient: QueryClient }>()({
-  head: () => ({
-    meta: [
-      { charSet: "utf-8" },
-      { name: "viewport", content: "width=device-width, initial-scale=1" },
-      { title: "App" },
-    ],
-    links: [
-      { rel: "stylesheet", href: appCss },
-      { rel: "preconnect", href: "https://fonts.googleapis.com" },
-      { rel: "preconnect", href: "https://fonts.gstatic.com", crossOrigin: "" },
-      {
-        rel: "stylesheet",
-        href: "https://fonts.googleapis.com/css2?family=${fontParam}:wght@400;500;600;700&display=swap",
-      },
-    ],
-  }),
-  shellComponent: RootShell,
-  component: RootComponent,
-  notFoundComponent: NotFound,
-  errorComponent: ErrorPage,
-});
-
-function RootShell({ children }: { children: ReactNode }) {
-  return (
-    <html lang="en" suppressHydrationWarning>
-      <head>
-        <script dangerouslySetInnerHTML={{ __html: THEME_INIT }} />
-        <HeadContent />
-      </head>
-      <body>
-        {children}
-        <Scripts />
-      </body>
-    </html>
-  );
-}
-
-function RootComponent() {
-  const { queryClient } = Route.useRouteContext();
-  return (
-    <QueryClientProvider client={queryClient}>
-      <Outlet />
-    </QueryClientProvider>
-  );
-}
-
-function NotFound() {
-  return (
-    <div className="grid min-h-screen place-items-center px-4 text-center">
-      <div>
-        <h1 className="text-6xl font-bold">404</h1>
-        <p className="mt-2 text-muted-foreground">This page does not exist.</p>
-        <Link to="/" className="mt-4 inline-block text-primary underline">
-          Go home
-        </Link>
-      </div>
-    </div>
-  );
-}
-
-function ErrorPage({ error }: { error: Error }) {
-  return (
-    <div className="grid min-h-screen place-items-center px-4 text-center">
-      <div>
-        <h1 className="text-xl font-semibold">Something went wrong</h1>
-        <p className="mt-2 text-sm text-muted-foreground">{error.message}</p>
-      </div>
-    </div>
-  );
-}
-`;
-}
-
-function indexRouteTsx(name: string): string {
-	return `import { createFileRoute, Link } from "@tanstack/react-router";
-
-export const Route = createFileRoute("/")({ component: Home });
-
-function Home() {
-  return (
-    <main className="mx-auto flex min-h-screen max-w-2xl flex-col items-center justify-center gap-6 px-6 text-center">
-      <h1 className="text-4xl font-bold tracking-tight sm:text-5xl">
-        ${name}
-      </h1>
-      <p className="max-w-md text-muted-foreground">
-        A TanStack Start app on HelloLeo Cloud. Data lives in D1 and is read
-        through type-safe server functions. Edit src/routes to build your app.
-      </p>
-      <div className="flex gap-3">
-        <Link
-          to="/dashboard"
-          className="rounded-md bg-primary px-5 py-2.5 text-sm font-semibold text-primary-foreground hover:opacity-90"
-        >
-          Open dashboard
-        </Link>
-        <Link
-          to="/login"
-          className="rounded-md border border-input px-5 py-2.5 text-sm font-semibold hover:bg-accent"
-        >
-          Sign in
-        </Link>
-      </div>
-    </main>
-  );
-}
-`;
-}
-
-function authenticatedLayoutTsx(): string {
-	return `import { Outlet, createFileRoute, redirect } from "@tanstack/react-router";
-import { getToken } from "../integrations/hl-cloud/client";
-
-// Route guard for everything under /_authenticated. Runs on the client before
-// load: no token -> redirect to /login. Server functions independently
-// re-verify the JWT (requireHlCloudAuth), so this is UX, not the security
-// boundary -- never rely on a client guard alone to protect data.
-export const Route = createFileRoute("/_authenticated")({
-  beforeLoad: ({ location }) => {
-    if (typeof window === "undefined") return;
-    if (!getToken()) {
-      throw redirect({ to: "/login", search: { redirect: location.href } });
-    }
-  },
-  component: () => <Outlet />,
-});
-`;
-}
-
-function dashboardRouteTsx(): string {
-	return `import { createFileRoute } from "@tanstack/react-router";
-import { useMutation, useQuery, useQueryClient } from "@tanstack/react-query";
-import { useState } from "react";
-import { createItem, listItems } from "../../lib/example.functions";
-import { signOut } from "../../integrations/hl-cloud/client";
-
-export const Route = createFileRoute("/_authenticated/dashboard")({
-  component: Dashboard,
-});
-
-function Dashboard() {
-  const qc = useQueryClient();
-  const [title, setTitle] = useState("");
-  const items = useQuery({
-    queryKey: ["items"],
-    queryFn: () => listItems(),
-  });
-  const add = useMutation({
-    mutationFn: (t: string) => createItem({ data: { title: t } }),
-    onSuccess: () => {
-      setTitle("");
-      qc.invalidateQueries({ queryKey: ["items"] });
-    },
-  });
-
-  return (
-    <main className="mx-auto max-w-xl px-6 py-12">
-      <div className="mb-6 flex items-center justify-between">
-        <h1 className="text-2xl font-bold">Your items</h1>
-        <button
-          type="button"
-          onClick={() => signOut()}
-          className="text-sm text-muted-foreground underline"
-        >
-          Sign out
-        </button>
-      </div>
-
-      <form
-        onSubmit={(e) => {
-          e.preventDefault();
-          if (title.trim()) add.mutate(title.trim());
-        }}
-        className="mb-6 flex gap-2"
-      >
-        <input
-          value={title}
-          onChange={(e) => setTitle(e.target.value)}
-          placeholder="New item title"
-          className="flex-1 rounded-md border border-input bg-background px-3 py-2 text-sm"
-        />
-        <button
-          type="submit"
-          disabled={add.isPending}
-          className="rounded-md bg-primary px-4 py-2 text-sm font-semibold text-primary-foreground disabled:opacity-50"
-        >
-          Add
-        </button>
-      </form>
-
-      {items.isLoading ? (
-        <p className="text-sm text-muted-foreground">Loading...</p>
-      ) : (
-        <ul className="space-y-2">
-          {(items.data ?? []).map((item) => (
-            <li
-              key={item.id}
-              className="rounded-md border border-border px-3 py-2 text-sm"
-            >
-              {item.title}
-            </li>
-          ))}
-        </ul>
-      )}
-    </main>
-  );
-}
-`;
-}
-
-function loginRouteTsx(): string {
-	return `import { createFileRoute, useNavigate } from "@tanstack/react-router";
-import { type FormEvent, useState } from "react";
-import { signIn, signUp } from "../integrations/hl-cloud/client";
-
-export const Route = createFileRoute("/login")({
-  validateSearch: (search: Record<string, unknown>) => ({
-    redirect: typeof search.redirect === "string" ? search.redirect : "/dashboard",
-  }),
-  component: LoginPage,
-});
-
-function LoginPage() {
-  const navigate = useNavigate();
-  const { redirect } = Route.useSearch();
-  const [mode, setMode] = useState<"signin" | "signup">("signin");
-  const [email, setEmail] = useState("");
-  const [password, setPassword] = useState("");
-  const [error, setError] = useState<string | null>(null);
-  const [loading, setLoading] = useState(false);
-
-  async function submit(e: FormEvent) {
-    e.preventDefault();
-    setLoading(true);
-    setError(null);
-    try {
-      if (mode === "signin") {
-        await signIn(email, password);
-      } else {
-        await signUp(email, password);
-      }
-      navigate({ to: redirect as "/dashboard", replace: true });
-    } catch (err) {
-      setError(err instanceof Error ? err.message : "Authentication failed");
-    } finally {
-      setLoading(false);
-    }
-  }
-
-  return (
-    <div className="flex min-h-screen items-center justify-center px-4">
-      <div className="w-full max-w-sm">
-        <div className="mb-6 text-center">
-          <h1 className="text-2xl font-bold">Welcome</h1>
-          <p className="mt-1 text-sm text-muted-foreground">
-            {mode === "signin" ? "Sign in to continue" : "Create your account"}
-          </p>
-        </div>
-        <form onSubmit={submit} className="space-y-4">
-          <input
-            type="email"
-            required
-            placeholder="Email"
-            value={email}
-            onChange={(e) => setEmail(e.target.value)}
-            autoComplete="email"
-            className="w-full rounded-md border border-input bg-background px-3 py-2 text-sm"
-          />
-          <input
-            type="password"
-            required
-            minLength={8}
-            placeholder="Password"
-            value={password}
-            onChange={(e) => setPassword(e.target.value)}
-            autoComplete={mode === "signin" ? "current-password" : "new-password"}
-            className="w-full rounded-md border border-input bg-background px-3 py-2 text-sm"
-          />
-          {error ? <p className="text-sm text-destructive">{error}</p> : null}
-          <button
-            type="submit"
-            disabled={loading}
-            className="w-full rounded-md bg-primary px-4 py-2 text-sm font-semibold text-primary-foreground disabled:opacity-50"
-          >
-            {loading ? "Please wait..." : mode === "signin" ? "Sign in" : "Sign up"}
-          </button>
-        </form>
-        <button
-          type="button"
-          onClick={() => setMode(mode === "signin" ? "signup" : "signin")}
-          className="mt-4 w-full text-center text-sm text-muted-foreground underline"
-        >
-          {mode === "signin"
-            ? "Need an account? Sign up"
-            : "Have an account? Sign in"}
-        </button>
-      </div>
-    </div>
-  );
-}
-`;
-}
-
-function dbServerTs(): string {
-	return `// Request-scoped accessors for Cloudflare bindings. On Workers, env binds at
-// REQUEST time -- reading bindings at module scope yields undefined. Always
-// call these INSIDE a server function / handler, never at the top level.
-import { env } from "cloudflare:workers";
-
-export function getEnv(): Env {
-  return env;
-}
-
-export function getDb(): D1Database {
-  const db = env.DB;
-  if (!db) {
-    throw new Error(
-      "D1 binding 'DB' is not configured. Check wrangler.jsonc d1_databases.",
-    );
-  }
-  return db;
-}
-`;
-}
-
-function authMiddlewareTs(): string {
-	return `import { createMiddleware } from "@tanstack/react-start";
-import { getRequest } from "@tanstack/react-start/server";
-import { jwtVerify } from "jose";
-import { getDb, getEnv } from "./db.server";
-
-// Server-side gate for any server function that touches user data. Validates
-// the HelloLeo Cloud JWT from the Authorization header, resolves the user id,
-// and exposes { db, userId, claims } on context. This is the real security
-// boundary -- the client route guard is only UX.
-//
-// AUTH INTEGRATION POINT: this verifies an HMAC (HS256) JWT signed with
-// env.HL_CLOUD_JWT_SECRET (see auth.functions.ts). To back identity with an
-// external provider (Odoo / NetSuite / Salesforce) instead, swap the verify
-// step here and resolve claims from that provider.
-export const requireHlCloudAuth = createMiddleware({ type: "function" }).server(
-  async ({ next }) => {
-    const { HL_CLOUD_JWT_SECRET } = getEnv();
-    if (!HL_CLOUD_JWT_SECRET) {
-      throw new Error("Server auth is not configured: missing HL_CLOUD_JWT_SECRET");
-    }
-
-    const request = getRequest();
-    const authHeader = request?.headers.get("authorization");
-    if (!authHeader || !authHeader.startsWith("Bearer ")) {
-      throw new Error("Unauthorized: missing bearer token");
-    }
-    const token = authHeader.slice("Bearer ".length).trim();
-    if (!token) {
-      throw new Error("Unauthorized: empty bearer token");
-    }
-
-    let userId: string;
-    let claims: Record<string, unknown>;
-    try {
-      const { payload } = await jwtVerify(
-        token,
-        new TextEncoder().encode(HL_CLOUD_JWT_SECRET),
-      );
-      if (!payload.sub) throw new Error("no sub");
-      userId = payload.sub;
-      claims = payload as Record<string, unknown>;
-    } catch {
-      throw new Error("Unauthorized: invalid or expired token");
-    }
-
-    return next({ context: { db: getDb(), userId, claims } });
-  },
-);
-`;
-}
-
-function authAttacherTs(): string {
-	return `import { createMiddleware } from "@tanstack/react-start";
-import { getToken } from "./client";
-
-// Global client middleware (registered in src/start.ts). Attaches the stored
-// HelloLeo Cloud bearer token to every server-function RPC so requireHlCloudAuth
-// can authenticate it. Without this, authenticated server functions reject.
-export const attachHlCloudAuth = createMiddleware({ type: "function" }).client(
-  async ({ next }) => {
-    const token = getToken();
-    return next({
-      headers: token ? { Authorization: "Bearer " + token } : {},
-    });
-  },
-);
-`;
-}
-
-function clientTs(): string {
-	return `// Client-side HelloLeo Cloud auth. Holds the bearer token in localStorage and
-// wraps the auth server functions. The token is attached to every server-fn
-// RPC by attachHlCloudAuth (src/integrations/hl-cloud/auth-attacher.ts).
-//
-// NOTE: localStorage is readable by any script on the page (XSS exposure). It
-// is used here for simplicity and to survive the cross-site preview iframe.
-// Harden per your threat model before shipping sensitive data.
-import { signInFn, signUpFn } from "./auth.functions";
-
-const TOKEN_KEY = "hl_token";
-const listeners = new Set<() => void>();
-
-export function getToken(): string | null {
-  if (typeof window === "undefined") return null;
-  try {
-    return window.localStorage.getItem(TOKEN_KEY);
-  } catch {
-    return null;
-  }
-}
-
-function setToken(token: string | null) {
-  try {
-    if (token) window.localStorage.setItem(TOKEN_KEY, token);
-    else window.localStorage.removeItem(TOKEN_KEY);
-  } catch {
-    /* ignore storage failures */
-  }
-  for (const fn of listeners) fn();
-}
-
-export function onAuthChange(fn: () => void): () => void {
-  listeners.add(fn);
-  return () => listeners.delete(fn);
-}
-
-export async function signIn(email: string, password: string) {
-  const { token } = await signInFn({ data: { email, password } });
-  setToken(token);
-  return token;
-}
-
-export async function signUp(email: string, password: string) {
-  const { token } = await signUpFn({ data: { email, password } });
-  setToken(token);
-  return token;
-}
-
-export function signOut() {
-  setToken(null);
-  if (typeof window !== "undefined") window.location.assign("/login");
-}
-`;
-}
-
-function authFunctionsTs(): string {
-	return `import { createServerFn } from "@tanstack/react-start";
-import { SignJWT } from "jose";
-import { z } from "zod";
-import { getDb, getEnv } from "./db.server";
-
-// HelloLeo Cloud auth issuer: D1-backed identity + HMAC (HS256) JWTs.
-//
-// AUTH INTEGRATION POINT: this is the default, self-contained identity store.
-// To back identity with an external provider (Odoo / NetSuite / Salesforce),
-// replace signInFn/signUpFn with that provider's login and keep issueToken so
-// the rest of the app (requireHlCloudAuth) stays unchanged.
-
-const credentials = z.object({
-  email: z.string().email().max(320),
-  password: z.string().min(8).max(200),
-});
-
-type UserRow = { id: string; email: string; password_hash: string };
-
-function toHex(bytes: Uint8Array): string {
-  let out = "";
-  for (const b of bytes) out += b.toString(16).padStart(2, "0");
-  return out;
-}
-
-function fromHex(hex: string): Uint8Array {
-  const out = new Uint8Array(hex.length / 2);
-  for (let i = 0; i < out.length; i++) {
-    out[i] = Number.parseInt(hex.slice(i * 2, i * 2 + 2), 16);
-  }
-  return out;
-}
-
-// PBKDF2-SHA256 via Web Crypto (Workers-native, no node deps). Stored as
-// "<saltHex>:<hashHex>".
-async function hashPassword(password: string, saltHex?: string): Promise<string> {
-  const enc = new TextEncoder();
-  const salt = saltHex ? fromHex(saltHex) : crypto.getRandomValues(new Uint8Array(16));
-  const key = await crypto.subtle.importKey(
-    "raw",
-    enc.encode(password),
-    "PBKDF2",
-    false,
-    ["deriveBits"],
-  );
-  const bits = await crypto.subtle.deriveBits(
-    { name: "PBKDF2", salt, iterations: 100000, hash: "SHA-256" },
-    key,
-    256,
-  );
-  return toHex(salt) + ":" + toHex(new Uint8Array(bits));
-}
-
-function timingSafeEqual(a: string, b: string): boolean {
-  if (a.length !== b.length) return false;
-  let diff = 0;
-  for (let i = 0; i < a.length; i++) diff |= a.charCodeAt(i) ^ b.charCodeAt(i);
-  return diff === 0;
-}
-
-async function verifyPassword(password: string, stored: string): Promise<boolean> {
-  const saltHex = stored.split(":")[0];
-  if (!saltHex) return false;
-  return timingSafeEqual(await hashPassword(password, saltHex), stored);
-}
-
-async function issueToken(userId: string, email: string): Promise<string> {
-  const { HL_CLOUD_JWT_SECRET } = getEnv();
-  if (!HL_CLOUD_JWT_SECRET) {
-    throw new Error("Server auth is not configured: missing HL_CLOUD_JWT_SECRET");
-  }
-  return await new SignJWT({ email })
-    .setProtectedHeader({ alg: "HS256" })
-    .setSubject(userId)
-    .setIssuedAt()
-    .setExpirationTime("7d")
-    .sign(new TextEncoder().encode(HL_CLOUD_JWT_SECRET));
-}
-
-export const signUpFn = createServerFn({ method: "POST" })
-  .inputValidator((input: { email: string; password: string }) =>
-    credentials.parse(input),
-  )
-  .handler(async ({ data }) => {
-    const db = getDb();
-    const email = data.email.toLowerCase();
-    const existing = await db
-      .prepare("SELECT id FROM users WHERE email = ?")
-      .bind(email)
-      .first<{ id: string }>();
-    if (existing) throw new Error("An account with that email already exists");
-
-    const id = crypto.randomUUID();
-    const passwordHash = await hashPassword(data.password);
-    await db
-      .prepare(
-        "INSERT INTO users (id, email, password_hash, created_at) VALUES (?, ?, ?, ?)",
-      )
-      .bind(id, email, passwordHash, Date.now())
-      .run();
-
-    return { token: await issueToken(id, email), user: { id, email } };
-  });
-
-export const signInFn = createServerFn({ method: "POST" })
-  .inputValidator((input: { email: string; password: string }) =>
-    credentials.parse(input),
-  )
-  .handler(async ({ data }) => {
-    const db = getDb();
-    const email = data.email.toLowerCase();
-    const user = await db
-      .prepare("SELECT id, email, password_hash FROM users WHERE email = ?")
-      .bind(email)
-      .first<UserRow>();
-    if (!user || !(await verifyPassword(data.password, user.password_hash))) {
-      throw new Error("Invalid email or password");
-    }
-    return {
-      token: await issueToken(user.id, user.email),
-      user: { id: user.id, email: user.email },
-    };
-  });
-`;
-}
-
-function exampleFunctionsTs(): string {
-	return `import { createServerFn } from "@tanstack/react-start";
-import { z } from "zod";
-import { requireHlCloudAuth } from "../integrations/hl-cloud/auth-middleware";
-
-// The HelloLeo Cloud data pattern: server functions guarded by
-// requireHlCloudAuth, querying the D1 binding directly via context.db. Every
-// query filters by context.userId so users only ever see their own rows.
-// This replaces the old MCP execute() REST path -- data is real backend code.
-
-export type Item = { id: string; title: string; created_at: number };
-
-export const listItems = createServerFn({ method: "GET" })
-  .middleware([requireHlCloudAuth])
-  .handler(async ({ context }) => {
-    const { results } = await context.db
-      .prepare(
-        "SELECT id, title, created_at FROM items WHERE user_id = ? ORDER BY created_at DESC LIMIT 500",
-      )
-      .bind(context.userId)
-      .all<Item>();
-    return results;
-  });
-
-export const createItem = createServerFn({ method: "POST" })
-  .middleware([requireHlCloudAuth])
-  .inputValidator((input: { title: string }) =>
-    z.object({ title: z.string().min(1).max(500) }).parse(input),
-  )
-  .handler(async ({ data, context }) => {
-    const id = crypto.randomUUID();
-    await context.db
-      .prepare("INSERT INTO items (id, user_id, title, created_at) VALUES (?, ?, ?, ?)")
-      .bind(id, context.userId, data.title, Date.now())
-      .run();
-    return { id, title: data.title, created_at: Date.now() } satisfies Item;
-  });
-`;
-}
-
-function integrationServerTs(): string {
-	return `// HelloLeo Integration Proxy -- SERVER-SIDE helper for connected integrations.
-//
-// All third-party APIs (Odoo, Airtable, HubSpot, Stripe, Notion, Gladia,
-// Microsoft 365, Klaviyo, Supabase, DimoMaint, etc.) are reachable through this
-// single proxy. The proxy handles auth and CORS using credentials the user
-// configured in Project Settings -- you NEVER pass an API key from code, and
-// you NEVER call third-party hosts directly.
-//
-// On TanStack Start, integration calls run SERVER-SIDE (inside server
-// functions), so secrets stay on the Worker and never reach the browser.
-// Call callIntegration() from a createServerFn().handler, not from a component.
-//
-// Integration slugs:
-//   Use the exact slug from the Enabled MCP list with the "pipedream-" prefix
-//   removed, e.g. "pipedream-gorgias_oauth" -> "gorgias_oauth". Native
-//   integrations (odoo, airtable) keep their plain name.
-//
-// Response shape (always wrapped): { success, status, data }. Unwrap data by
-// provider:
-//   odoo -> data.result ; airtable -> data.records ; notion -> data.results ;
-//   microsoft 365 -> data.value ; klaviyo -> data.data ;
-//   supabase / dimomaint -> data
-//
-// Pagination: put query params directly in the endpoint string, e.g.
-//   endpoint: "/api/tickets?cursor=xyz&per_page=100". Never fetch-everything
-//   then filter -- paginate at the source.
-import { getEnv } from "../integrations/hl-cloud/db.server";
-
-export interface ProxyRequest {
-  integration: string;
-  endpoint: string;
-  method?: "GET" | "POST" | "PUT" | "PATCH" | "DELETE";
-  body?: unknown;
-  headers?: Record<string, string>;
-}
-
-export interface ProxyResponse<T = unknown> {
-  success: boolean;
-  status: number;
-  data: T;
-}
-
-export async function callIntegration<T = unknown>(
-  req: ProxyRequest,
-): Promise<ProxyResponse<T>> {
-  const uuid = getEnv().PROJECT_UUID;
-  if (!uuid) {
-    throw new Error(
-      "PROJECT_UUID is not set. HelloLeo Cloud must be provisioned for integrations.",
-    );
-  }
-  const res = await fetch(
-    "https://api.app.helloleo.dev/api/integration-proxy/" + uuid,
-    {
-      method: "POST",
-      headers: { "Content-Type": "application/json" },
-      body: JSON.stringify({ method: "POST", ...req }),
-    },
-  );
-  return (await res.json()) as ProxyResponse<T>;
-}
-`;
-}
-
-/**
- * Write the TanStack Start project template. Returns the list of relative
- * file paths written. Used by the `scaffold` tool for all new non-NetSuite
- * projects.
- */
-export async function writeStartScaffold(
-	opts: BaseScaffoldOptions,
-	dir: string,
-): Promise<string[]> {
-	const name = opts.name ?? "leo-project";
-	const primary = normalizePrimaryColor(
-		opts.primaryColor ?? "221.2 83.2% 53.3%",
-	);
-	const font = opts.fontFamily ?? "Inter";
-	const radius = opts.borderRadius ?? "0.5rem";
-
-	await mkdir(path.join(dir, "src", "routes", "_authenticated"), {
-		recursive: true,
-	});
-	await mkdir(path.join(dir, "src", "lib"), { recursive: true });
-	await mkdir(path.join(dir, "src", "integrations", "hl-cloud"), {
-		recursive: true,
-	});
-
-	const files: [string, string][] = [
-		["package.json", packageJson(name)],
-		["vite.config.ts", viteConfig()],
-		["tsconfig.json", tsconfigJson()],
-		["biome.json", biomeJson()],
-		["components.json", componentsJson()],
-		["wrangler.jsonc", wranglerJsonc(name)],
-		["worker-configuration.d.ts", workerConfigurationDts()],
-		[".gitignore", gitignore()],
-		["schema.sql", schemaSql()],
-		[path.join("src", "styles.css"), stylesCss(primary, font, radius)],
-		[path.join("src", "router.tsx"), routerTsx()],
-		[path.join("src", "server.ts"), serverTs()],
-		[path.join("src", "start.ts"), startTs()],
-		[path.join("src", "routes", "__root.tsx"), rootTsx(font)],
-		[path.join("src", "routes", "index.tsx"), indexRouteTsx(name)],
-		[path.join("src", "routes", "login.tsx"), loginRouteTsx()],
-		[
-			path.join("src", "routes", "_authenticated.tsx"),
-			authenticatedLayoutTsx(),
-		],
-		[
-			path.join("src", "routes", "_authenticated", "dashboard.tsx"),
-			dashboardRouteTsx(),
-		],
-		[path.join("src", "lib", "utils.ts"), utilsTs()],
-		[path.join("src", "lib", "example.functions.ts"), exampleFunctionsTs()],
-		[path.join("src", "lib", "integration.server.ts"), integrationServerTs()],
-		[
-			path.join("src", "integrations", "hl-cloud", "db.server.ts"),
-			dbServerTs(),
-		],
-		[
-			path.join("src", "integrations", "hl-cloud", "auth-middleware.ts"),
-			authMiddlewareTs(),
-		],
-		[
-			path.join("src", "integrations", "hl-cloud", "auth-attacher.ts"),
-			authAttacherTs(),
-		],
-		[path.join("src", "integrations", "hl-cloud", "client.ts"), clientTs()],
-		[
-			path.join("src", "integrations", "hl-cloud", "auth.functions.ts"),
-			authFunctionsTs(),
-		],
-		[
-			path.join("src", "integrations", "hl-cloud", "cf-dev-shim.ts"),
-			cfDevShimTs(),
-		],
-	];
-
-	const created: string[] = [];
-	for (const [filePath, content] of files) {
-		await Bun.write(path.join(dir, filePath), content);
-		created.push(filePath);
-	}
-	return created;
-}