@helloleo/plugins 0.2.0-beta.1 → 0.2.0-beta.2

package/dist/index.js

@@ -24886,12 +24886,16 @@ function projectUuidFromDir(dir) {
   return path3.basename(dir);
 }
 var scaffoldOptionsSchema = exports_external2.object({
-  name: exports_external2.string().describe("Short product name. Used as the page title and package name."),
+  name: exports_external2.string().describe("Human-readable name for SEO, e.g. 'Shipping Platform'"),
   description: exports_external2.string().describe("One sentence describing the app. Used as the meta description.")
 });
+function slugify(name) {
+  return name.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "") || "leo-project";
+}
 async function writeBaseScaffold({ name, description }, dir) {
   const created = await renderTemplate(SCAFFOLD_VERSION, {
     LEO_NAME: name,
+    LEO_SLUG: slugify(name),
     LEO_DESCRIPTION: description,
     LEO_PROJECT_UUID: projectUuidFromDir(dir)
   }, dir);
@@ -24917,7 +24921,7 @@ var scaffold = tool({
       "",
       "Notes:",
       "- This is a TanStack Start project. The server entry is src/server.ts. There is no index.html or client entrypoint.",
-      "- Add routes as files in src/routes/. Do not default export route components.",
+      "- Add routes as files in src/routes/. Do not default export route components. Routing and layout conventions are documented in src/routes/README.md, read it before adding routes.",
       "- For JSON/CRUD APIs, add server routes under src/routes/api/. Read src/routes/api/health.ts first, add routes as needed.",
       "- shadcn/ui components are already in src/components/ui.",
       "- Design system: edit the tokens in src/styles.css (light and dark blocks).",

package/dist/templates/tanstack-start-2026-06-18/bunfig.toml

@@ -0,0 +1,5 @@
+# Supply-chain guard: refuse npm package versions published less than 3 days
+# ago (compromised-release window). Versions already in bun.lock install
+# normally. Escape hatch: minimumReleaseAgeExcludes = ["pkg"].
+[install]
+minimumReleaseAge = 259200

package/dist/templates/tanstack-start-2026-06-18/package.json

@@ -1,5 +1,5 @@
 {
-  "name": "{{LEO_NAME}}",
+  "name": "{{LEO_SLUG}}",
   "private": true,
   "type": "module",
   "imports": {

package/dist/templates/tanstack-start-2026-06-18/src/routes/README.md

@@ -0,0 +1,85 @@
+# Routes
+
+TanStack Start uses file-based routing. Every `.ts` and `.tsx` file in this directory is a route. Do not create `src/pages/`, `app/layout.tsx`, or similar, those are Next.js / Remix conventions. The only root layout is `src/routes/__root.tsx`.
+
+## Conventions
+
+| File | URL |
+| --- | --- |
+| `index.tsx` | `/` |
+| `about.tsx` | `/about` |
+| `users/index.tsx` | `/users` |
+| `users/$id.tsx` | `/users/:id` (dynamic — bare `$`, no curly braces) |
+| `posts.$postId.tsx` | `/posts/:postId` (dots nest without folders) |
+| `admin/route.tsx` | layout for every `/admin/*` page; must render `<Outlet />` |
+| `admin_.login.tsx` | `/admin/login`, but outside the admin layout (trailing `_` escapes it) |
+| `_auth.tsx` | pathless layout; wraps `_auth/*` files without adding a URL segment |
+| `api/health.ts` | server route for defining API endpoints |
+| `__root.tsx` | app shell, wraps every page; preserve `<Outlet />` |
+
+## Rules
+
+- A layout route without `<Outlet />` renders its children nowhere.
+- Do not `export default` route components, it breaks code splitting. Use a named function passed as `component:`.
+- `routeTree.gen.ts` is auto-generated. Don't edit it by hand.
+
+## Authenticated routes
+
+Put protected pages inside a pathless `_authed` layout and keep login/signup
+at the top level, outside it. Never special-case the login pathname inside
+the layout guard.
+
+```
+routes/
+  __root.tsx          loads the session into router context (context.user)
+  _authed.tsx         pathless guard — no URL segment of its own
+  _authed/
+    dashboard.tsx     /dashboard (protected)
+    posts.tsx         /posts     (protected)
+  index.tsx           /          (public)
+  login.tsx           /login     (public)
+  logout.tsx          /logout
+```
+
+`_authed.tsx` does the guarding, all children inherit it:
+
+```tsx _authed.tsx
+export const Route = createFileRoute('/_authed')({
+  beforeLoad: ({ context }) => {
+    if (!context.user) {
+      throw redirect({ to: '/login' })
+    }
+  },
+})
+```
+
+The session is loaded once in `__root.tsx`'s `beforeLoad` and returned into
+the router context so every route can read `context.user`. `getUser()` is
+whatever your auth uses (e.g. verify a JWT from localStorage) and resolves to
+the user or null:
+
+```tsx __root.tsx
+// (keep the existing head() and component, add this)
+export const Route = createRootRouteWithContext<{ queryClient: QueryClient }>()({
+  beforeLoad: async () => {
+    const user = await getUser()
+    return { user }
+  },
+  // ...head, component unchanged
+})
+```
+
+Components read it with `Route.useRouteContext()` (e.g. to swap a Login link
+for a Logout button in the shell):
+
+```tsx
+function Route() {
+  const { user } = Route.useRouteContext()
+  
+  return (
+    <nav>
+      {user ? <Link to="/logout">Logout</Link> : <Link to="/login">Login</Link>}
+    </nav>
+  )
+}
+```

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@helloleo/plugins",
-  "version": "0.2.0-beta.1",
+  "version": "0.2.0-beta.2",
   "description": "OpenCode plugins for HelloLeo",
   "license": "UNLICENSED",
   "type": "module",

package/src/templates/tanstack-start-2026-06-18/bunfig.toml

@@ -0,0 +1,5 @@
+# Supply-chain guard: refuse npm package versions published less than 3 days
+# ago (compromised-release window). Versions already in bun.lock install
+# normally. Escape hatch: minimumReleaseAgeExcludes = ["pkg"].
+[install]
+minimumReleaseAge = 259200

package/src/templates/tanstack-start-2026-06-18/package.json

@@ -1,5 +1,5 @@
 {
-  "name": "{{LEO_NAME}}",
+  "name": "{{LEO_SLUG}}",
   "private": true,
   "type": "module",
   "imports": {

package/src/templates/tanstack-start-2026-06-18/src/routes/README.md

@@ -0,0 +1,85 @@
+# Routes
+
+TanStack Start uses file-based routing. Every `.ts` and `.tsx` file in this directory is a route. Do not create `src/pages/`, `app/layout.tsx`, or similar, those are Next.js / Remix conventions. The only root layout is `src/routes/__root.tsx`.
+
+## Conventions
+
+| File | URL |
+| --- | --- |
+| `index.tsx` | `/` |
+| `about.tsx` | `/about` |
+| `users/index.tsx` | `/users` |
+| `users/$id.tsx` | `/users/:id` (dynamic — bare `$`, no curly braces) |
+| `posts.$postId.tsx` | `/posts/:postId` (dots nest without folders) |
+| `admin/route.tsx` | layout for every `/admin/*` page; must render `<Outlet />` |
+| `admin_.login.tsx` | `/admin/login`, but outside the admin layout (trailing `_` escapes it) |
+| `_auth.tsx` | pathless layout; wraps `_auth/*` files without adding a URL segment |
+| `api/health.ts` | server route for defining API endpoints |
+| `__root.tsx` | app shell, wraps every page; preserve `<Outlet />` |
+
+## Rules
+
+- A layout route without `<Outlet />` renders its children nowhere.
+- Do not `export default` route components, it breaks code splitting. Use a named function passed as `component:`.
+- `routeTree.gen.ts` is auto-generated. Don't edit it by hand.
+
+## Authenticated routes
+
+Put protected pages inside a pathless `_authed` layout and keep login/signup
+at the top level, outside it. Never special-case the login pathname inside
+the layout guard.
+
+```
+routes/
+  __root.tsx          loads the session into router context (context.user)
+  _authed.tsx         pathless guard — no URL segment of its own
+  _authed/
+    dashboard.tsx     /dashboard (protected)
+    posts.tsx         /posts     (protected)
+  index.tsx           /          (public)
+  login.tsx           /login     (public)
+  logout.tsx          /logout
+```
+
+`_authed.tsx` does the guarding, all children inherit it:
+
+```tsx _authed.tsx
+export const Route = createFileRoute('/_authed')({
+  beforeLoad: ({ context }) => {
+    if (!context.user) {
+      throw redirect({ to: '/login' })
+    }
+  },
+})
+```
+
+The session is loaded once in `__root.tsx`'s `beforeLoad` and returned into
+the router context so every route can read `context.user`. `getUser()` is
+whatever your auth uses (e.g. verify a JWT from localStorage) and resolves to
+the user or null:
+
+```tsx __root.tsx
+// (keep the existing head() and component, add this)
+export const Route = createRootRouteWithContext<{ queryClient: QueryClient }>()({
+  beforeLoad: async () => {
+    const user = await getUser()
+    return { user }
+  },
+  // ...head, component unchanged
+})
+```
+
+Components read it with `Route.useRouteContext()` (e.g. to swap a Login link
+for a Logout button in the shell):
+
+```tsx
+function Route() {
+  const { user } = Route.useRouteContext()
+  
+  return (
+    <nav>
+      {user ? <Link to="/logout">Logout</Link> : <Link to="/login">Login</Link>}
+    </nav>
+  )
+}
+```

package/src/tools/scaffold.ts

@@ -29,12 +29,22 @@ export function projectUuidFromDir(dir: string): string {
 const scaffoldOptionsSchema = z.object({
 	name: z
 		.string()
-		.describe("Short product name. Used as the page title and package name."),
+		.describe("Human-readable name for SEO, e.g. 'Shipping Platform'"),
 	description: z
 		.string()
 		.describe("One sentence describing the app. Used as the meta description."),
 });
 
+/** Kebab-case slug of the product name, for package.json. */
+function slugify(name: string): string {
+	return (
+		name
+			.toLowerCase()
+			.replace(/[^a-z0-9]+/g, "-")
+			.replace(/^-+|-+$/g, "") || "leo-project"
+	);
+}
+
 /**
  * Write the base scaffold by rendering the TanStack Start template into dir,
  * then adding .leo/project.json (template metadata the tool owns, not part of
@@ -48,6 +58,7 @@ export async function writeBaseScaffold(
 		SCAFFOLD_VERSION,
 		{
 			LEO_NAME: name,
+			LEO_SLUG: slugify(name),
 			LEO_DESCRIPTION: description,
 			LEO_PROJECT_UUID: projectUuidFromDir(dir),
 		},
@@ -87,7 +98,7 @@ export const scaffold = tool({
 			"",
 			"Notes:",
 			"- This is a TanStack Start project. The server entry is src/server.ts. There is no index.html or client entrypoint.",
-			"- Add routes as files in src/routes/. Do not default export route components.",
+			"- Add routes as files in src/routes/. Do not default export route components. Routing and layout conventions are documented in src/routes/README.md, read it before adding routes.",
 			"- For JSON/CRUD APIs, add server routes under src/routes/api/. Read src/routes/api/health.ts first, add routes as needed.",
 			"- shadcn/ui components are already in src/components/ui.",
 			"- Design system: edit the tokens in src/styles.css (light and dark blocks).",