@helloleo/plugins 0.2.0-beta.0 → 0.2.0-beta.2

package/dist/index.js

@@ -24886,12 +24886,16 @@ function projectUuidFromDir(dir) {
   return path3.basename(dir);
 }
 var scaffoldOptionsSchema = exports_external2.object({
-  name: exports_external2.string().describe("Short product name. Used as the page title and package name."),
+  name: exports_external2.string().describe("Human-readable name for SEO, e.g. 'Shipping Platform'"),
   description: exports_external2.string().describe("One sentence describing the app. Used as the meta description.")
 });
+function slugify(name) {
+  return name.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "") || "leo-project";
+}
 async function writeBaseScaffold({ name, description }, dir) {
   const created = await renderTemplate(SCAFFOLD_VERSION, {
     LEO_NAME: name,
+    LEO_SLUG: slugify(name),
     LEO_DESCRIPTION: description,
     LEO_PROJECT_UUID: projectUuidFromDir(dir)
   }, dir);
@@ -24917,7 +24921,8 @@ var scaffold = tool({
       "",
       "Notes:",
       "- This is a TanStack Start project. The server entry is src/server.ts. There is no index.html or client entrypoint.",
-      "- Add routes as files in src/routes/. Do not default export route components.",
+      "- Add routes as files in src/routes/. Do not default export route components. Routing and layout conventions are documented in src/routes/README.md, read it before adding routes.",
+      "- For JSON/CRUD APIs, add server routes under src/routes/api/. Read src/routes/api/health.ts first, add routes as needed.",
       "- shadcn/ui components are already in src/components/ui.",
       "- Design system: edit the tokens in src/styles.css (light and dark blocks).",
       "- The database schema lives in src/db/schema.ts. Migrations run automatically.",
@@ -25004,17 +25009,20 @@ export function signInWithNetSuite(returnTo: string = window.location.href) {
   // refuses to render -- looks like "nothing happens" to the user. Navigate
   // the top frame instead so the OAuth flow runs at the top level and the
   // callback redirect lands on the same top frame, which then reads the
-  // #nssid= fragment. Fallback to same-frame navigation if the top window
-  // is cross-origin and can't be reassigned.
+  // #nssid= fragment. Use \`location.href =\` (NOT \`location.assign()\`):
+  // reading the \`.assign\` method off a cross-origin \`window.top.location\`
+  // throws a SecurityError, which would drop us into the same-frame fallback
+  // and load NetSuite inside the iframe (X-Frame-Options: DENY -> "refused to
+  // connect"). Assigning \`.href\` is a navigation, allowed cross-origin.
   try {
     if (window.top && window.top !== window) {
-      window.top.location.assign(url.toString());
+      window.top.location.href = url.toString();
       return;
     }
   } catch {
     /* top window not accessible \u2014 fall through to same-frame navigation */
   }
-  window.location.assign(url.toString());
+  window.location.href = url.toString();
 }
 
 export interface NetSuiteSession {

package/dist/templates/tanstack-start-2026-06-18/bunfig.toml

@@ -0,0 +1,5 @@
+# Supply-chain guard: refuse npm package versions published less than 3 days
+# ago (compromised-release window). Versions already in bun.lock install
+# normally. Escape hatch: minimumReleaseAgeExcludes = ["pkg"].
+[install]
+minimumReleaseAge = 259200

package/dist/templates/tanstack-start-2026-06-18/package.json

@@ -1,5 +1,5 @@
 {
-  "name": "{{LEO_NAME}}",
+  "name": "{{LEO_SLUG}}",
   "private": true,
   "type": "module",
   "imports": {

package/dist/templates/tanstack-start-2026-06-18/src/routes/README.md

@@ -0,0 +1,85 @@
+# Routes
+
+TanStack Start uses file-based routing. Every `.ts` and `.tsx` file in this directory is a route. Do not create `src/pages/`, `app/layout.tsx`, or similar, those are Next.js / Remix conventions. The only root layout is `src/routes/__root.tsx`.
+
+## Conventions
+
+| File | URL |
+| --- | --- |
+| `index.tsx` | `/` |
+| `about.tsx` | `/about` |
+| `users/index.tsx` | `/users` |
+| `users/$id.tsx` | `/users/:id` (dynamic — bare `$`, no curly braces) |
+| `posts.$postId.tsx` | `/posts/:postId` (dots nest without folders) |
+| `admin/route.tsx` | layout for every `/admin/*` page; must render `<Outlet />` |
+| `admin_.login.tsx` | `/admin/login`, but outside the admin layout (trailing `_` escapes it) |
+| `_auth.tsx` | pathless layout; wraps `_auth/*` files without adding a URL segment |
+| `api/health.ts` | server route for defining API endpoints |
+| `__root.tsx` | app shell, wraps every page; preserve `<Outlet />` |
+
+## Rules
+
+- A layout route without `<Outlet />` renders its children nowhere.
+- Do not `export default` route components, it breaks code splitting. Use a named function passed as `component:`.
+- `routeTree.gen.ts` is auto-generated. Don't edit it by hand.
+
+## Authenticated routes
+
+Put protected pages inside a pathless `_authed` layout and keep login/signup
+at the top level, outside it. Never special-case the login pathname inside
+the layout guard.
+
+```
+routes/
+  __root.tsx          loads the session into router context (context.user)
+  _authed.tsx         pathless guard — no URL segment of its own
+  _authed/
+    dashboard.tsx     /dashboard (protected)
+    posts.tsx         /posts     (protected)
+  index.tsx           /          (public)
+  login.tsx           /login     (public)
+  logout.tsx          /logout
+```
+
+`_authed.tsx` does the guarding, all children inherit it:
+
+```tsx _authed.tsx
+export const Route = createFileRoute('/_authed')({
+  beforeLoad: ({ context }) => {
+    if (!context.user) {
+      throw redirect({ to: '/login' })
+    }
+  },
+})
+```
+
+The session is loaded once in `__root.tsx`'s `beforeLoad` and returned into
+the router context so every route can read `context.user`. `getUser()` is
+whatever your auth uses (e.g. verify a JWT from localStorage) and resolves to
+the user or null:
+
+```tsx __root.tsx
+// (keep the existing head() and component, add this)
+export const Route = createRootRouteWithContext<{ queryClient: QueryClient }>()({
+  beforeLoad: async () => {
+    const user = await getUser()
+    return { user }
+  },
+  // ...head, component unchanged
+})
+```
+
+Components read it with `Route.useRouteContext()` (e.g. to swap a Login link
+for a Logout button in the shell):
+
+```tsx
+function Route() {
+  const { user } = Route.useRouteContext()
+  
+  return (
+    <nav>
+      {user ? <Link to="/logout">Logout</Link> : <Link to="/login">Login</Link>}
+    </nav>
+  )
+}
+```

package/dist/templates/tanstack-start-2026-06-18/src/routes/api/health.ts

@@ -0,0 +1,81 @@
+import { createFileRoute } from '@tanstack/react-router'
+import { db } from '#/db'
+import { entries } from '#/db/schema'
+
+/**
+ * Server route example: GET /api/health. Use this file as the base for
+ * building JSON APIs (CRUD endpoints, webhooks) with TanStack Start
+ * server routes:
+ * https://tanstack.com/start/latest/docs/framework/react/guide/server-routes
+ *
+ * How server routes work:
+ * - Files under src/routes/ can export server handlers. The URL matches
+ *   the file path: src/routes/api/health.ts serves /api/health.
+ * - Add one handler per HTTP method under server.handlers (GET, POST,
+ *   PUT, PATCH, DELETE). A handler receives ({ request, params }) and
+ *   returns a Response, usually Response.json().
+ * - Dynamic segments use $: src/routes/api/todos/$id.ts serves
+ *   /api/todos/:id and the handler reads params.id.
+ * - Read the request body with await request.json() and validate it
+ *   before use. Return proper status codes (201 created, 404 not found).
+ * - Query the database with `import { db } from '#/db'` INSIDE the
+ *   handler, never at module scope (the binding only exists per request).
+ */
+export const Route = createFileRoute('/api/health')({
+  server: {
+    handlers: {
+      GET: async () => {
+        const startedAt = Date.now()
+
+        const server = {
+          status: 'ok' as const,
+          uptimeSeconds: Math.round(
+            typeof process !== 'undefined' &&
+              typeof process.uptime === 'function'
+              ? process.uptime()
+              : 0,
+          ),
+          timestamp: new Date().toISOString(),
+          runtime: 'cloudflare-workers',
+        }
+
+        // Database health: lightweight query against a known table
+        let database: {
+          status: 'ok' | 'error'
+          latencyMs: number
+          error: string | null
+        }
+        const dbStart = Date.now()
+        try {
+          await db.select({ id: entries.id }).from(entries).limit(1)
+          database = {
+            status: 'ok',
+            latencyMs: Date.now() - dbStart,
+            error: null,
+          }
+        } catch (err) {
+          database = {
+            status: 'error',
+            latencyMs: Date.now() - dbStart,
+            error: err instanceof Error ? err.message : String(err),
+          }
+        }
+
+        const overall =
+          server.status === 'ok' && database.status === 'ok'
+            ? 'ok'
+            : 'degraded'
+
+        return Response.json(
+          {
+            status: overall,
+            server,
+            database,
+            checkedInMs: Date.now() - startedAt,
+          },
+          { status: overall === 'ok' ? 200 : 503 },
+        )
+      },
+    },
+  },
+})

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@helloleo/plugins",
-  "version": "0.2.0-beta.0",
+  "version": "0.2.0-beta.2",
   "description": "OpenCode plugins for HelloLeo",
   "license": "UNLICENSED",
   "type": "module",

package/src/templates/tanstack-start-2026-06-18/bunfig.toml

@@ -0,0 +1,5 @@
+# Supply-chain guard: refuse npm package versions published less than 3 days
+# ago (compromised-release window). Versions already in bun.lock install
+# normally. Escape hatch: minimumReleaseAgeExcludes = ["pkg"].
+[install]
+minimumReleaseAge = 259200

package/src/templates/tanstack-start-2026-06-18/package.json

@@ -1,5 +1,5 @@
 {
-  "name": "{{LEO_NAME}}",
+  "name": "{{LEO_SLUG}}",
   "private": true,
   "type": "module",
   "imports": {

package/src/templates/tanstack-start-2026-06-18/src/routes/README.md

@@ -0,0 +1,85 @@
+# Routes
+
+TanStack Start uses file-based routing. Every `.ts` and `.tsx` file in this directory is a route. Do not create `src/pages/`, `app/layout.tsx`, or similar, those are Next.js / Remix conventions. The only root layout is `src/routes/__root.tsx`.
+
+## Conventions
+
+| File | URL |
+| --- | --- |
+| `index.tsx` | `/` |
+| `about.tsx` | `/about` |
+| `users/index.tsx` | `/users` |
+| `users/$id.tsx` | `/users/:id` (dynamic — bare `$`, no curly braces) |
+| `posts.$postId.tsx` | `/posts/:postId` (dots nest without folders) |
+| `admin/route.tsx` | layout for every `/admin/*` page; must render `<Outlet />` |
+| `admin_.login.tsx` | `/admin/login`, but outside the admin layout (trailing `_` escapes it) |
+| `_auth.tsx` | pathless layout; wraps `_auth/*` files without adding a URL segment |
+| `api/health.ts` | server route for defining API endpoints |
+| `__root.tsx` | app shell, wraps every page; preserve `<Outlet />` |
+
+## Rules
+
+- A layout route without `<Outlet />` renders its children nowhere.
+- Do not `export default` route components, it breaks code splitting. Use a named function passed as `component:`.
+- `routeTree.gen.ts` is auto-generated. Don't edit it by hand.
+
+## Authenticated routes
+
+Put protected pages inside a pathless `_authed` layout and keep login/signup
+at the top level, outside it. Never special-case the login pathname inside
+the layout guard.
+
+```
+routes/
+  __root.tsx          loads the session into router context (context.user)
+  _authed.tsx         pathless guard — no URL segment of its own
+  _authed/
+    dashboard.tsx     /dashboard (protected)
+    posts.tsx         /posts     (protected)
+  index.tsx           /          (public)
+  login.tsx           /login     (public)
+  logout.tsx          /logout
+```
+
+`_authed.tsx` does the guarding, all children inherit it:
+
+```tsx _authed.tsx
+export const Route = createFileRoute('/_authed')({
+  beforeLoad: ({ context }) => {
+    if (!context.user) {
+      throw redirect({ to: '/login' })
+    }
+  },
+})
+```
+
+The session is loaded once in `__root.tsx`'s `beforeLoad` and returned into
+the router context so every route can read `context.user`. `getUser()` is
+whatever your auth uses (e.g. verify a JWT from localStorage) and resolves to
+the user or null:
+
+```tsx __root.tsx
+// (keep the existing head() and component, add this)
+export const Route = createRootRouteWithContext<{ queryClient: QueryClient }>()({
+  beforeLoad: async () => {
+    const user = await getUser()
+    return { user }
+  },
+  // ...head, component unchanged
+})
+```
+
+Components read it with `Route.useRouteContext()` (e.g. to swap a Login link
+for a Logout button in the shell):
+
+```tsx
+function Route() {
+  const { user } = Route.useRouteContext()
+  
+  return (
+    <nav>
+      {user ? <Link to="/logout">Logout</Link> : <Link to="/login">Login</Link>}
+    </nav>
+  )
+}
+```

package/src/templates/tanstack-start-2026-06-18/src/routes/api/health.ts

@@ -0,0 +1,81 @@
+import { createFileRoute } from '@tanstack/react-router'
+import { db } from '#/db'
+import { entries } from '#/db/schema'
+
+/**
+ * Server route example: GET /api/health. Use this file as the base for
+ * building JSON APIs (CRUD endpoints, webhooks) with TanStack Start
+ * server routes:
+ * https://tanstack.com/start/latest/docs/framework/react/guide/server-routes
+ *
+ * How server routes work:
+ * - Files under src/routes/ can export server handlers. The URL matches
+ *   the file path: src/routes/api/health.ts serves /api/health.
+ * - Add one handler per HTTP method under server.handlers (GET, POST,
+ *   PUT, PATCH, DELETE). A handler receives ({ request, params }) and
+ *   returns a Response, usually Response.json().
+ * - Dynamic segments use $: src/routes/api/todos/$id.ts serves
+ *   /api/todos/:id and the handler reads params.id.
+ * - Read the request body with await request.json() and validate it
+ *   before use. Return proper status codes (201 created, 404 not found).
+ * - Query the database with `import { db } from '#/db'` INSIDE the
+ *   handler, never at module scope (the binding only exists per request).
+ */
+export const Route = createFileRoute('/api/health')({
+  server: {
+    handlers: {
+      GET: async () => {
+        const startedAt = Date.now()
+
+        const server = {
+          status: 'ok' as const,
+          uptimeSeconds: Math.round(
+            typeof process !== 'undefined' &&
+              typeof process.uptime === 'function'
+              ? process.uptime()
+              : 0,
+          ),
+          timestamp: new Date().toISOString(),
+          runtime: 'cloudflare-workers',
+        }
+
+        // Database health: lightweight query against a known table
+        let database: {
+          status: 'ok' | 'error'
+          latencyMs: number
+          error: string | null
+        }
+        const dbStart = Date.now()
+        try {
+          await db.select({ id: entries.id }).from(entries).limit(1)
+          database = {
+            status: 'ok',
+            latencyMs: Date.now() - dbStart,
+            error: null,
+          }
+        } catch (err) {
+          database = {
+            status: 'error',
+            latencyMs: Date.now() - dbStart,
+            error: err instanceof Error ? err.message : String(err),
+          }
+        }
+
+        const overall =
+          server.status === 'ok' && database.status === 'ok'
+            ? 'ok'
+            : 'degraded'
+
+        return Response.json(
+          {
+            status: overall,
+            server,
+            database,
+            checkedInMs: Date.now() - startedAt,
+          },
+          { status: overall === 'ok' ? 200 : 503 },
+        )
+      },
+    },
+  },
+})

package/src/tools/scaffold.ts

@@ -29,12 +29,22 @@ export function projectUuidFromDir(dir: string): string {
 const scaffoldOptionsSchema = z.object({
 	name: z
 		.string()
-		.describe("Short product name. Used as the page title and package name."),
+		.describe("Human-readable name for SEO, e.g. 'Shipping Platform'"),
 	description: z
 		.string()
 		.describe("One sentence describing the app. Used as the meta description."),
 });
 
+/** Kebab-case slug of the product name, for package.json. */
+function slugify(name: string): string {
+	return (
+		name
+			.toLowerCase()
+			.replace(/[^a-z0-9]+/g, "-")
+			.replace(/^-+|-+$/g, "") || "leo-project"
+	);
+}
+
 /**
  * Write the base scaffold by rendering the TanStack Start template into dir,
  * then adding .leo/project.json (template metadata the tool owns, not part of
@@ -48,6 +58,7 @@ export async function writeBaseScaffold(
 		SCAFFOLD_VERSION,
 		{
 			LEO_NAME: name,
+			LEO_SLUG: slugify(name),
 			LEO_DESCRIPTION: description,
 			LEO_PROJECT_UUID: projectUuidFromDir(dir),
 		},
@@ -87,7 +98,8 @@ export const scaffold = tool({
 			"",
 			"Notes:",
 			"- This is a TanStack Start project. The server entry is src/server.ts. There is no index.html or client entrypoint.",
-			"- Add routes as files in src/routes/. Do not default export route components.",
+			"- Add routes as files in src/routes/. Do not default export route components. Routing and layout conventions are documented in src/routes/README.md, read it before adding routes.",
+			"- For JSON/CRUD APIs, add server routes under src/routes/api/. Read src/routes/api/health.ts first, add routes as needed.",
 			"- shadcn/ui components are already in src/components/ui.",
 			"- Design system: edit the tokens in src/styles.css (light and dark blocks).",
 			"- The database schema lives in src/db/schema.ts. Migrations run automatically.",

package/src/tools/setup-netsuite.ts

@@ -82,17 +82,20 @@ export function signInWithNetSuite(returnTo: string = window.location.href) {
   // refuses to render -- looks like "nothing happens" to the user. Navigate
   // the top frame instead so the OAuth flow runs at the top level and the
   // callback redirect lands on the same top frame, which then reads the
-  // #nssid= fragment. Fallback to same-frame navigation if the top window
-  // is cross-origin and can't be reassigned.
+  // #nssid= fragment. Use \`location.href =\` (NOT \`location.assign()\`):
+  // reading the \`.assign\` method off a cross-origin \`window.top.location\`
+  // throws a SecurityError, which would drop us into the same-frame fallback
+  // and load NetSuite inside the iframe (X-Frame-Options: DENY -> "refused to
+  // connect"). Assigning \`.href\` is a navigation, allowed cross-origin.
   try {
     if (window.top && window.top !== window) {
-      window.top.location.assign(url.toString());
+      window.top.location.href = url.toString();
       return;
     }
   } catch {
     /* top window not accessible — fall through to same-frame navigation */
   }
-  window.location.assign(url.toString());
+  window.location.href = url.toString();
 }
 
 export interface NetSuiteSession {

package/dist/templates/tanstack-start-2026-06-18/src/api/health.ts

@@ -1,66 +0,0 @@
-import { createFileRoute } from "@tanstack/react-router";
-import { supabaseAdmin } from "@/integrations/supabase/client.server";
-
-export const Route = createFileRoute("/api/health")({
-  server: {
-    handlers: {
-      GET: async () => {
-        const startedAt = Date.now();
-
-        // Server health
-        const server = {
-          status: "ok" as const,
-          uptimeSeconds: Math.round(
-            typeof process !== "undefined" &&
-              typeof process.uptime === "function"
-              ? process.uptime()
-              : 0,
-          ),
-          timestamp: new Date().toISOString(),
-          runtime: "cloudflare-workers",
-        };
-
-        // Database health — lightweight query against a known table
-        let database: {
-          status: "ok" | "error";
-          latencyMs: number;
-          error: string | null;
-        };
-        const dbStart = Date.now();
-        try {
-          const { error } = await supabaseAdmin
-            .from("notes")
-            .select("id", { count: "exact", head: true })
-            .limit(1);
-          if (error) throw error;
-          database = {
-            status: "ok",
-            latencyMs: Date.now() - dbStart,
-            error: null,
-          };
-        } catch (err) {
-          database = {
-            status: "error",
-            latencyMs: Date.now() - dbStart,
-            error: err instanceof Error ? err.message : String(err),
-          };
-        }
-
-        const overall =
-          server.status === "ok" && database.status === "ok"
-            ? "ok"
-            : "degraded";
-
-        return Response.json(
-          {
-            status: overall,
-            server,
-            database,
-            checkedInMs: Date.now() - startedAt,
-          },
-          { status: overall === "ok" ? 200 : 503 },
-        );
-      },
-    },
-  },
-});

package/src/templates/tanstack-start-2026-06-18/src/api/health.ts

@@ -1,66 +0,0 @@
-import { createFileRoute } from "@tanstack/react-router";
-import { supabaseAdmin } from "@/integrations/supabase/client.server";
-
-export const Route = createFileRoute("/api/health")({
-  server: {
-    handlers: {
-      GET: async () => {
-        const startedAt = Date.now();
-
-        // Server health
-        const server = {
-          status: "ok" as const,
-          uptimeSeconds: Math.round(
-            typeof process !== "undefined" &&
-              typeof process.uptime === "function"
-              ? process.uptime()
-              : 0,
-          ),
-          timestamp: new Date().toISOString(),
-          runtime: "cloudflare-workers",
-        };
-
-        // Database health — lightweight query against a known table
-        let database: {
-          status: "ok" | "error";
-          latencyMs: number;
-          error: string | null;
-        };
-        const dbStart = Date.now();
-        try {
-          const { error } = await supabaseAdmin
-            .from("notes")
-            .select("id", { count: "exact", head: true })
-            .limit(1);
-          if (error) throw error;
-          database = {
-            status: "ok",
-            latencyMs: Date.now() - dbStart,
-            error: null,
-          };
-        } catch (err) {
-          database = {
-            status: "error",
-            latencyMs: Date.now() - dbStart,
-            error: err instanceof Error ? err.message : String(err),
-          };
-        }
-
-        const overall =
-          server.status === "ok" && database.status === "ok"
-            ? "ok"
-            : "degraded";
-
-        return Response.json(
-          {
-            status: overall,
-            server,
-            database,
-            checkedInMs: Date.now() - startedAt,
-          },
-          { status: overall === "ok" ? 200 : 503 },
-        );
-      },
-    },
-  },
-});