@helloleo/plugins 0.2.0-beta.5 → 0.2.0-beta.7

package/dist/index.js

@@ -24944,6 +24944,7 @@ var scaffold = tool({
       "- Always fetch data with react-query (useQuery and useMutation).",
       "",
       "Next: read src/routes/index.tsx and continue with the user's request.",
+      "For authentication (password and/or OAuth), call setup_authentication.",
       "For NetSuite projects, call setup_netsuite."
     ].join(`
 `);
@@ -24954,9 +24955,530 @@ var ScaffoldPlugin = async () => {
     tool: { scaffold }
   };
 };
+// src/tools/setup-authentication/index.ts
+import path6 from "path";
+
+// src/tools/setup-authentication/auth-files.ts
+function authLibTs(providers) {
+  const hasPassword = providers.includes("password");
+  const oauth = providers.filter((p) => p !== "password");
+  const envFields = [
+    "BETTER_AUTH_SECRET?: string",
+    "BETTER_AUTH_URL?: string",
+    ...oauth.flatMap((p) => {
+      const prefix = p.toUpperCase();
+      return [
+        `${prefix}_CLIENT_ID?: string`,
+        `${prefix}_CLIENT_SECRET?: string`
+      ];
+    })
+  ].join(`
+    `);
+  const socialProvidersBlock = oauth.length ? `
+    socialProviders: {
+${oauth.map((p) => {
+    const prefix = p.toUpperCase();
+    return `      ${p}: { clientId: requireEnv(e.${prefix}_CLIENT_ID, '${prefix}_CLIENT_ID'), clientSecret: requireEnv(e.${prefix}_CLIENT_SECRET, '${prefix}_CLIENT_SECRET') },`;
+  }).join(`
+`)}
+    },` : "";
+  const requireEnvFn = oauth.length ? `
+function requireEnv(value: string | undefined, name: string): string {
+  if (!value) {
+    throw new Error(\`\${name} is not set. Add it to .env (dev) or run \\\`wrangler secret put \${name}\\\` (prod).\`)
+  }
+  return value
+}
+` : "";
+  return `import { betterAuth } from 'better-auth'
+import { drizzleAdapter } from '@better-auth/drizzle-adapter'
+import { tanstackStartCookies } from 'better-auth/tanstack-start'
+import { db } from '#/db'
+import * as schema from '#/db/schema'
+import { env } from '@helloleo/runtime'
+
+/*
+ * buildAuth() only runs from INSIDE a request (see getAuth() below) --
+ * never call it at module scope. \`db\` is a lazy Proxy over the D1 binding
+ * and env.* Worker secrets don't exist until a request is in flight;
+ * touching either while workerd boots the isolate throws.
+ */
+${requireEnvFn}
+function buildAuth() {
+  const e = env as {
+    ${envFields}
+  }
+
+  return betterAuth({
+    secret: e.BETTER_AUTH_SECRET,
+    baseURL: e.BETTER_AUTH_URL,
+    database: drizzleAdapter(db, { provider: 'sqlite', schema }),
+    emailAndPassword: {
+      enabled: ${hasPassword},
+    },${socialProvidersBlock}
+    plugins: [tanstackStartCookies()],
+  })
+}
+
+let instance: ReturnType<typeof buildAuth> | undefined
+
+export function getAuth() {
+  if (!instance) instance = buildAuth()
+  return instance
+}
+`;
+}
+function authClientTs() {
+  return `import { createAuthClient } from 'better-auth/react'
+
+export const authClient = createAuthClient()
+`;
+}
+function authServerTs() {
+  return `import { createServerFn } from '@tanstack/react-start'
+import { getRequestHeaders } from '@tanstack/react-start/server'
+import { getAuth } from '#/lib/auth'
+
+export const getSession = createServerFn({ method: 'GET' }).handler(async () => {
+  const headers = getRequestHeaders()
+  return getAuth().api.getSession({ headers })
+})
+
+export const ensureSession = createServerFn({ method: 'GET' }).handler(async () => {
+  const headers = getRequestHeaders()
+  const session = await getAuth().api.getSession({ headers })
+  if (!session) throw new Error('Unauthorized')
+  return session
+})
+`;
+}
+function authRouteTs() {
+  return `import { createFileRoute } from '@tanstack/react-router'
+import { getAuth } from '#/lib/auth'
+
+export const Route = createFileRoute('/api/auth/$')({
+  server: {
+    handlers: {
+      GET: ({ request }: { request: Request }) => getAuth().handler(request),
+      POST: ({ request }: { request: Request }) => getAuth().handler(request),
+    },
+  },
+})
+`;
+}
+
+// src/tools/setup-authentication/constants.ts
+var PROVIDERS = [
+  "password",
+  "google",
+  "github",
+  "discord",
+  "microsoft"
+];
+var PROVIDER_LABELS = {
+  google: "Google",
+  github: "GitHub",
+  discord: "Discord",
+  microsoft: "Microsoft"
+};
+var BETTER_AUTH_VERSION = "^1.6.23";
+
+// src/tools/setup-authentication/db-schema.ts
+import { readFile } from "fs/promises";
+import path4 from "path";
+var SCHEMA_MARKER = "sqliteTable('user'";
+function authTablesBlock() {
+  return `
+export const user = sqliteTable('user', {
+  id: text('id').primaryKey(),
+  name: text('name').notNull(),
+  email: text('email').notNull().unique(),
+  emailVerified: integer('email_verified', { mode: 'boolean' }).default(false).notNull(),
+  image: text('image'),
+  createdAt: integer('created_at', { mode: 'timestamp_ms' })
+    .default(sql\`(cast(unixepoch('subsecond') * 1000 as integer))\`)
+    .notNull(),
+  updatedAt: integer('updated_at', { mode: 'timestamp_ms' })
+    .default(sql\`(cast(unixepoch('subsecond') * 1000 as integer))\`)
+    .$onUpdate(() => new Date())
+    .notNull(),
+})
+
+export const session = sqliteTable('session', {
+  id: text('id').primaryKey(),
+  expiresAt: integer('expires_at', { mode: 'timestamp_ms' }).notNull(),
+  token: text('token').notNull().unique(),
+  createdAt: integer('created_at', { mode: 'timestamp_ms' })
+    .default(sql\`(cast(unixepoch('subsecond') * 1000 as integer))\`)
+    .notNull(),
+  updatedAt: integer('updated_at', { mode: 'timestamp_ms' })
+    .$onUpdate(() => new Date())
+    .notNull(),
+  ipAddress: text('ip_address'),
+  userAgent: text('user_agent'),
+  userId: text('user_id')
+    .notNull()
+    .references(() => user.id, { onDelete: 'cascade' }),
+})
+
+export const account = sqliteTable('account', {
+  id: text('id').primaryKey(),
+  accountId: text('account_id').notNull(),
+  providerId: text('provider_id').notNull(),
+  userId: text('user_id')
+    .notNull()
+    .references(() => user.id, { onDelete: 'cascade' }),
+  accessToken: text('access_token'),
+  refreshToken: text('refresh_token'),
+  idToken: text('id_token'),
+  accessTokenExpiresAt: integer('access_token_expires_at', { mode: 'timestamp_ms' }),
+  refreshTokenExpiresAt: integer('refresh_token_expires_at', { mode: 'timestamp_ms' }),
+  scope: text('scope'),
+  password: text('password'),
+  createdAt: integer('created_at', { mode: 'timestamp_ms' })
+    .default(sql\`(cast(unixepoch('subsecond') * 1000 as integer))\`)
+    .notNull(),
+  updatedAt: integer('updated_at', { mode: 'timestamp_ms' })
+    .$onUpdate(() => new Date())
+    .notNull(),
+})
+
+export const verification = sqliteTable('verification', {
+  id: text('id').primaryKey(),
+  identifier: text('identifier').notNull(),
+  value: text('value').notNull(),
+  expiresAt: integer('expires_at', { mode: 'timestamp_ms' }).notNull(),
+  createdAt: integer('created_at', { mode: 'timestamp_ms' })
+    .default(sql\`(cast(unixepoch('subsecond') * 1000 as integer))\`)
+    .notNull(),
+  updatedAt: integer('updated_at', { mode: 'timestamp_ms' })
+    .default(sql\`(cast(unixepoch('subsecond') * 1000 as integer))\`)
+    .$onUpdate(() => new Date())
+    .notNull(),
+})
+`;
+}
+async function appendAuthTables(dir) {
+  const schemaPath = path4.join(dir, "src", "db", "schema.ts");
+  const current = await readFile(schemaPath, "utf8").catch(() => null);
+  if (current === null) {
+    throw new Error("src/db/schema.ts not found -- run scaffold first.");
+  }
+  if (current.includes(SCHEMA_MARKER))
+    return false;
+  await Bun.write(schemaPath, `${current.trimEnd()}
+${authTablesBlock()}`);
+  return true;
+}
+
+// src/tools/setup-authentication/package-json.ts
+import { readFile as readFile2 } from "fs/promises";
+import path5 from "path";
+async function addAuthDependencies(dir) {
+  const pkgPath = path5.join(dir, "package.json");
+  const pkg = JSON.parse(await readFile2(pkgPath, "utf8"));
+  pkg.dependencies ??= {};
+  if (pkg.dependencies["better-auth"])
+    return false;
+  pkg.dependencies["better-auth"] = BETTER_AUTH_VERSION;
+  pkg.dependencies["@better-auth/drizzle-adapter"] = BETTER_AUTH_VERSION;
+  await Bun.write(pkgPath, `${JSON.stringify(pkg, null, 2)}
+`);
+  return true;
+}
+
+// src/tools/setup-authentication/pages.ts
+function socialButtonsJsx(oauth) {
+  return oauth.map((p) => `          <Button
+            type="button"
+            variant="outline"
+            className="w-full"
+            onClick={() => authClient.signIn.social({ provider: '${p}', callbackURL: '/' })}
+          >
+            Continue with ${PROVIDER_LABELS[p]}
+          </Button>`).join(`
+`);
+}
+function authedLayoutTsx() {
+  return `import { createFileRoute, redirect } from '@tanstack/react-router'
+import { getSession } from '#/lib/auth-server'
+
+// Pathless guard -- no URL segment of its own. Put protected pages under
+// src/routes/_authed/ (e.g. _authed/dashboard.tsx -> /dashboard) and they
+// inherit this beforeLoad. See src/routes/README.md, "Authenticated routes".
+export const Route = createFileRoute('/_authed')({
+  beforeLoad: async () => {
+    const session = await getSession()
+    if (!session) throw redirect({ to: '/login' })
+    return { user: session.user }
+  },
+})
+`;
+}
+function loginPageTsx(hasPassword, oauth) {
+  const social = oauth.length ? `
+${socialButtonsJsx(oauth)}
+` : "";
+  const divider = oauth.length && hasPassword ? `
+          <div className="relative">
+            <div className="absolute inset-0 flex items-center">
+              <span className="w-full border-t" />
+            </div>
+            <div className="relative flex justify-center text-xs uppercase">
+              <span className="bg-card px-2 text-muted-foreground">Or continue with email</span>
+            </div>
+          </div>
+` : "";
+  const passwordForm = hasPassword ? `
+          <form onSubmit={handleSubmit} className="space-y-4">
+            <div className="space-y-2">
+              <Label htmlFor="email">Email</Label>
+              <Input id="email" type="email" value={email} onChange={e => setEmail(e.target.value)} required autoComplete="email" />
+            </div>
+            <div className="space-y-2">
+              <Label htmlFor="password">Password</Label>
+              <Input id="password" type="password" value={password} onChange={e => setPassword(e.target.value)} required autoComplete="current-password" />
+            </div>
+            {error && <p className="text-sm text-destructive">{error}</p>}
+            <Button type="submit" className="w-full" disabled={loading}>
+              {loading ? 'Logging in\u2026' : 'Log in'}
+            </Button>
+            <p className="text-sm text-center text-muted-foreground">
+              No account? <Link to="/signup" className="underline">Sign up</Link>
+            </p>
+          </form>
+` : "";
+  const stateAndHandler = hasPassword ? `
+  const router = useRouter()
+  const [email, setEmail] = useState('')
+  const [password, setPassword] = useState('')
+  const [error, setError] = useState('')
+  const [loading, setLoading] = useState(false)
+
+  async function handleSubmit(e: React.FormEvent) {
+    e.preventDefault()
+    setError('')
+    setLoading(true)
+    const { error } = await authClient.signIn.email({ email, password })
+    setLoading(false)
+    if (error) {
+      setError(error.message ?? 'Something went wrong.')
+      return
+    }
+    router.navigate({ to: '/' })
+  }
+` : "";
+  const imports = [
+    hasPassword ? "import { createFileRoute, Link, useRouter } from '@tanstack/react-router'" : "import { createFileRoute } from '@tanstack/react-router'",
+    hasPassword ? "import { useState } from 'react'" : "",
+    "import { authClient } from '#/lib/auth-client'",
+    "import { Button } from '#/components/ui/button'",
+    hasPassword ? "import { Input } from '#/components/ui/input'" : "",
+    hasPassword ? "import { Label } from '#/components/ui/label'" : "",
+    "import { Card, CardContent, CardHeader, CardTitle } from '#/components/ui/card'"
+  ].filter(Boolean).join(`
+`);
+  return `${imports}
+
+export const Route = createFileRoute('/login')({
+  component: LoginPage,
+})
+
+function LoginPage() {${stateAndHandler}
+  return (
+    <div className="min-h-screen flex items-center justify-center bg-background p-4">
+      <Card className="w-full max-w-sm">
+        <CardHeader>
+          <CardTitle>Log in</CardTitle>
+        </CardHeader>
+        <CardContent className="space-y-4">${social}${divider}${passwordForm}
+        </CardContent>
+      </Card>
+    </div>
+  )
+}
+`;
+}
+function signupPageTsx() {
+  return `import { createFileRoute, Link, useRouter } from '@tanstack/react-router'
+import { useState } from 'react'
+import { authClient } from '#/lib/auth-client'
+import { Button } from '#/components/ui/button'
+import { Input } from '#/components/ui/input'
+import { Label } from '#/components/ui/label'
+import { Card, CardContent, CardHeader, CardTitle } from '#/components/ui/card'
+
+export const Route = createFileRoute('/signup')({
+  component: SignupPage,
+})
+
+function SignupPage() {
+  const router = useRouter()
+  const [name, setName] = useState('')
+  const [email, setEmail] = useState('')
+  const [password, setPassword] = useState('')
+  const [error, setError] = useState('')
+  const [loading, setLoading] = useState(false)
+
+  async function handleSubmit(e: React.FormEvent) {
+    e.preventDefault()
+    setError('')
+    setLoading(true)
+    const { error } = await authClient.signUp.email({ name, email, password })
+    setLoading(false)
+    if (error) {
+      setError(error.message ?? 'Something went wrong.')
+      return
+    }
+    router.navigate({ to: '/' })
+  }
+
+  return (
+    <div className="min-h-screen flex items-center justify-center bg-background p-4">
+      <Card className="w-full max-w-sm">
+        <CardHeader>
+          <CardTitle>Sign up</CardTitle>
+        </CardHeader>
+        <CardContent>
+          <form onSubmit={handleSubmit} className="space-y-4">
+            <div className="space-y-2">
+              <Label htmlFor="name">Name</Label>
+              <Input id="name" type="text" value={name} onChange={e => setName(e.target.value)} required autoComplete="name" />
+            </div>
+            <div className="space-y-2">
+              <Label htmlFor="email">Email</Label>
+              <Input id="email" type="email" value={email} onChange={e => setEmail(e.target.value)} required autoComplete="email" />
+            </div>
+            <div className="space-y-2">
+              <Label htmlFor="password">Password</Label>
+              <Input id="password" type="password" value={password} onChange={e => setPassword(e.target.value)} required autoComplete="new-password" minLength={8} />
+            </div>
+            {error && <p className="text-sm text-destructive">{error}</p>}
+            <Button type="submit" className="w-full" disabled={loading}>
+              {loading ? 'Signing up\u2026' : 'Sign up'}
+            </Button>
+            <p className="text-sm text-center text-muted-foreground">
+              Already have an account? <Link to="/login" className="underline">Log in</Link>
+            </p>
+          </form>
+        </CardContent>
+      </Card>
+    </div>
+  )
+}
+`;
+}
+function dashboardPageTsx() {
+  return `import { createFileRoute, useRouter } from '@tanstack/react-router'
+import { authClient } from '#/lib/auth-client'
+import { Button } from '#/components/ui/button'
+
+// Example protected page -- _authed.tsx needs at least one child route or
+// it collides with index.tsx on path "/" and \`tsr generate\` fails. Replace
+// this, or add more pages alongside it under src/routes/_authed/.
+export const Route = createFileRoute('/_authed/dashboard')({
+  component: DashboardPage,
+})
+
+function DashboardPage() {
+  const router = useRouter()
+  const { data: session } = authClient.useSession()
+
+  return (
+    <div className="min-h-screen flex items-center justify-center bg-background p-4">
+      <div className="text-center space-y-4">
+        <p className="text-lg">Signed in as {session?.user.email}</p>
+        <Button
+          onClick={() =>
+            authClient.signOut({
+              fetchOptions: { onSuccess: () => router.navigate({ to: '/login' }) },
+            })
+          }
+        >
+          Sign out
+        </Button>
+      </div>
+    </div>
+  )
+}
+`;
+}
+
+// src/tools/setup-authentication/index.ts
+var setupAuthentication = tool({
+  description: "Add authentication to an existing project via better-auth. Call scaffold first, " + "then this. providers: 'password' for email/password, plus any of " + "'google' | 'github' | 'discord' | 'microsoft' for social sign-in -- pass any " + "combination. Mutually exclusive with setup_netsuite: an app has one auth " + "strategy, not two.",
+  args: {
+    providers: exports_external2.array(exports_external2.enum(PROVIDERS)).min(1).describe("Auth methods to enable, e.g. ['password', 'google']")
+  },
+  async execute({ providers }, context) {
+    const dir = context.directory;
+    const hasPassword = providers.includes("password");
+    const oauth = providers.filter((p) => p !== "password");
+    const files = [
+      [path6.join("src", "lib", "auth.ts"), authLibTs(providers)],
+      [path6.join("src", "lib", "auth-client.ts"), authClientTs()],
+      [path6.join("src", "lib", "auth-server.ts"), authServerTs()],
+      [path6.join("src", "routes", "api", "auth", "$.ts"), authRouteTs()],
+      [path6.join("src", "routes", "_authed.tsx"), authedLayoutTsx()],
+      [
+        path6.join("src", "routes", "_authed", "dashboard.tsx"),
+        dashboardPageTsx()
+      ],
+      [
+        path6.join("src", "routes", "login.tsx"),
+        loginPageTsx(hasPassword, oauth)
+      ]
+    ];
+    if (hasPassword) {
+      files.push([path6.join("src", "routes", "signup.tsx"), signupPageTsx()]);
+    }
+    for (const [filePath, content] of files) {
+      await Bun.write(path6.join(dir, filePath), content);
+    }
+    const schemaAppended = await appendAuthTables(dir);
+    const depsAdded = await addAuthDependencies(dir);
+    const envLines = [
+      "  - dev (.env): BETTER_AUTH_SECRET=<random>, BETTER_AUTH_URL=http://localhost:3000",
+      "  - prod: `wrangler secret put BETTER_AUTH_SECRET`, and BETTER_AUTH_URL as a var in wrangler.jsonc"
+    ];
+    for (const p of oauth) {
+      const prefix = p.toUpperCase();
+      envLines.push(`  - ${PROVIDER_LABELS[p]}: ${prefix}_CLIENT_ID / ${prefix}_CLIENT_SECRET (dev: .env, prod: wrangler secret put)`);
+    }
+    return [
+      `Wrote authentication (better-auth, providers: ${providers.join(", ")}):`,
+      "  - src/lib/auth.ts (lazy betterAuth instance -- read the comment on why it's not a module-scope export)",
+      "  - src/lib/auth-client.ts (React client -- authClient.signIn.email/social, signUp.email, signOut)",
+      "  - src/lib/auth-server.ts (getSession/ensureSession server functions, for SSR route guards)",
+      "  - src/routes/api/auth/$.ts (catch-all handler)",
+      "  - src/routes/_authed.tsx (pathless guard for protected routes)",
+      "  - src/routes/_authed/dashboard.tsx (example protected page -- _authed needs at least one child route or it collides with index.tsx on '/')",
+      `  - src/routes/login.tsx${hasPassword ? ", src/routes/signup.tsx" : ""}`,
+      `  - src/db/schema.ts ${schemaAppended ? "(appended user/session/account/verification tables)" : "(already had a `user` table, left as-is)"}`,
+      `  - package.json ${depsAdded ? "(added better-auth, @better-auth/drizzle-adapter)" : "(dependencies already present)"}`,
+      "",
+      "Run `bun install`, then `bun run db:push` (or just `bun dev`, which runs it first) to create the new tables.",
+      "",
+      "Required env vars/secrets:",
+      ...envLines,
+      "",
+      "Add more protected pages under src/routes/_authed/ (e.g. _authed/settings.tsx -> /settings); they inherit the guard.",
+      "",
+      "Verify before shipping: password hashing defaults to scrypt via Node's crypto, exposed through the " + "nodejs_compat flag (already on for this template) -- confirm a real sign-up/login round-trip works in `bun dev`.",
+      "",
+      "Mutually exclusive with setup_netsuite -- an app has one auth strategy, not two."
+    ].join(`
+`);
+  }
+});
+var SetupAuthenticationPlugin = async () => {
+  return {
+    tool: { setup_authentication: setupAuthentication }
+  };
+};
 // src/tools/setup-netsuite.ts
 import { mkdir as mkdir2 } from "fs/promises";
-import path4 from "path";
+import path7 from "path";
 function netsuiteTs() {
   return `/*
  * NetSuite OAuth client helper (bearer-token-in-fragment).
@@ -25281,27 +25803,27 @@ var setupNetsuite = tool({
   args: {},
   async execute(_args, context) {
     const dir = context.directory;
-    await mkdir2(path4.join(dir, "src", "components", "auth"), {
+    await mkdir2(path7.join(dir, "src", "components", "auth"), {
       recursive: true
     });
     const nsFiles = [
-      [path4.join("src", "lib", "netsuite.ts"), netsuiteTs()],
-      [path4.join("src", "lib", "auth.tsx"), authTsx()],
+      [path7.join("src", "lib", "netsuite.ts"), netsuiteTs()],
+      [path7.join("src", "lib", "auth.tsx"), authTsx()],
       [
-        path4.join("src", "components", "auth", "AuthLayout.tsx"),
+        path7.join("src", "components", "auth", "AuthLayout.tsx"),
         authLayoutTsx()
       ],
       [
-        path4.join("src", "components", "auth", "LoginPage.tsx"),
+        path7.join("src", "components", "auth", "LoginPage.tsx"),
         netsuiteLoginPageTsx()
       ],
       [
-        path4.join("src", "components", "auth", "SignInWithNetSuite.tsx"),
+        path7.join("src", "components", "auth", "SignInWithNetSuite.tsx"),
         signInButtonTsx()
       ]
     ];
     for (const [filePath, content] of nsFiles) {
-      await Bun.write(path4.join(dir, filePath), content);
+      await Bun.write(path7.join(dir, filePath), content);
     }
     return [
       `Wrote ${nsFiles.length} NetSuite OAuth files (all additive, nothing overwritten):`,
@@ -25333,547 +25855,9 @@ var SetupNetsuitePlugin = async () => {
     tool: { setup_netsuite: setupNetsuite }
   };
 };
-// src/tools/setup-password-auth.ts
-import { readFile } from "fs/promises";
-import path5 from "path";
-var SCHEMA_MARKER = "sqliteTable('users'";
-function usersTableBlock() {
-  return `
-export const users = sqliteTable('users', {
-  id: integer('id').primaryKey({ autoIncrement: true }),
-  email: text('email').notNull().unique(),
-  passwordHash: text('password_hash').notNull(),
-  createdAt: integer('created_at')
-    .notNull()
-    .default(sql\`(unixepoch())\`),
-})
-
-export type User = typeof users.$inferSelect
-`;
-}
-function authLibTs() {
-  return `import { db } from '#/db'
-import { users } from '#/db/schema'
-import { env } from '@helloleo/runtime'
-import { eq } from 'drizzle-orm'
-
-/*
- * Password hashing, session JWTs, and user lookup. Used ONLY from
- * src/routes/api/auth/*.ts server routes -- never imported by a client
- * route file. Sessions are a stateless HMAC-signed JWT in an httpOnly
- * cookie, not a server-side session store: verifying a session costs one
- * signature check, no database or KV round-trip.
- *
- * AUTH_JWT_SECRET must be set for signing/verifying to work:
- *   - dev: add \`AUTH_JWT_SECRET=<random value>\` to .env (gitignored;
- *     the cf-shim exposes process.env vars as-is in dev).
- *   - prod: \`wrangler secret put AUTH_JWT_SECRET\`.
- * Generate a value with: openssl rand -hex 32
- */
-
-const encoder = new TextEncoder()
-const SESSION_COOKIE = 'session'
-const SESSION_TTL_SECONDS = 60 * 60 * 24 * 7
-
-function getAuthSecret(): string {
-  const secret = (env as { AUTH_JWT_SECRET?: string }).AUTH_JWT_SECRET
-  if (!secret) {
-    throw new Error(
-      'AUTH_JWT_SECRET is not set. Add it to .env (dev) or run ' +
-        '\`wrangler secret put AUTH_JWT_SECRET\` (prod).',
-    )
-  }
-  return secret
-}
-
-function toHex(bytes: Uint8Array): string {
-  return Array.from(bytes)
-    .map(b => b.toString(16).padStart(2, '0'))
-    .join('')
-}
-
-function timingSafeEqual(a: string, b: string): boolean {
-  if (a.length !== b.length) return false
-  let diff = 0
-  for (let i = 0; i < a.length; i++) diff |= a.charCodeAt(i) ^ b.charCodeAt(i)
-  return diff === 0
-}
-
-// ---- password hashing (salted SHA-256; sufficient for a single-tenant
-// demo app -- swap for a WASM bcrypt/argon2 if this ever guards real data) ----
-
-export function generateSalt(): string {
-  return toHex(crypto.getRandomValues(new Uint8Array(16)))
-}
-
-async function sha256Hex(input: string): Promise<string> {
-  const digest = await crypto.subtle.digest('SHA-256', encoder.encode(input))
-  return toHex(new Uint8Array(digest))
-}
-
-export async function hashPassword(password: string, salt: string): Promise<string> {
-  return \`\${salt}:\${await sha256Hex(salt + password)}\`
-}
-
-export async function verifyPassword(password: string, stored: string): Promise<boolean> {
-  const [salt, hash] = stored.split(':')
-  if (!salt || !hash) return false
-  return timingSafeEqual(await sha256Hex(salt + password), hash)
-}
-
-// ---- session JWT (HS256, hand-rolled -- no dependency needed for one HMAC) ----
-
-function base64url(bytes: Uint8Array): string {
-  let binary = ''
-  for (const b of bytes) binary += String.fromCharCode(b)
-  return btoa(binary).replace(/\\+/g, '-').replace(/\\//g, '_').replace(/=+$/, '')
-}
-
-function base64urlDecode(value: string): string {
-  const padded = value.replace(/-/g, '+').replace(/_/g, '/')
-  return atob(padded)
-}
-
-async function hmacKey(secret: string) {
-  return crypto.subtle.importKey(
-    'raw',
-    encoder.encode(secret),
-    { name: 'HMAC', hash: 'SHA-256' },
-    false,
-    ['sign'],
-  )
-}
-
-export async function signSession(userId: number): Promise<string> {
-  const header = base64url(encoder.encode(JSON.stringify({ alg: 'HS256', typ: 'JWT' })))
-  const payload = base64url(
-    encoder.encode(
-      JSON.stringify({ sub: userId, exp: Math.floor(Date.now() / 1000) + SESSION_TTL_SECONDS }),
-    ),
-  )
-  const key = await hmacKey(getAuthSecret())
-  const sig = await crypto.subtle.sign('HMAC', key, encoder.encode(\`\${header}.\${payload}\`))
-  return \`\${header}.\${payload}.\${base64url(new Uint8Array(sig))}\`
-}
-
-export async function verifySession(token: string): Promise<number | null> {
-  const parts = token.split('.')
-  if (parts.length !== 3) return null
-  const [header, payload, sig] = parts
-  const key = await hmacKey(getAuthSecret())
-  const expectedSig = base64url(
-    new Uint8Array(await crypto.subtle.sign('HMAC', key, encoder.encode(\`\${header}.\${payload}\`))),
-  )
-  if (!timingSafeEqual(expectedSig, sig)) return null
-  try {
-    const claims = JSON.parse(base64urlDecode(payload)) as { sub: number; exp: number }
-    if (claims.exp < Math.floor(Date.now() / 1000)) return null
-    return claims.sub
-  } catch {
-    return null
-  }
-}
-
-export function sessionCookieHeader(token: string): string {
-  return \`\${SESSION_COOKIE}=\${token}; Path=/; Max-Age=\${SESSION_TTL_SECONDS}; HttpOnly; SameSite=Lax\`
-}
-
-export function clearSessionCookieHeader(): string {
-  return \`\${SESSION_COOKIE}=; Path=/; Max-Age=0; HttpOnly; SameSite=Lax\`
-}
-
-export function readSessionToken(request: Request): string | null {
-  const cookieHeader = request.headers.get('cookie') ?? ''
-  for (const part of cookieHeader.split(/;\\s*/)) {
-    const eq = part.indexOf('=')
-    if (eq === -1) continue
-    if (part.slice(0, eq) === SESSION_COOKIE) return part.slice(eq + 1)
-  }
-  return null
-}
-
-export async function getUserFromRequest(request: Request) {
-  const token = readSessionToken(request)
-  if (!token) return null
-  const userId = await verifySession(token)
-  if (userId === null) return null
-  const [user] = await db
-    .select({ id: users.id, email: users.email })
-    .from(users)
-    .where(eq(users.id, userId))
-    .limit(1)
-  return user ?? null
-}
-`;
-}
-function signupRouteTs() {
-  return `import { createFileRoute } from '@tanstack/react-router'
-import { db } from '#/db'
-import { users } from '#/db/schema'
-import { generateSalt, hashPassword, sessionCookieHeader, signSession } from '#/lib/auth'
-import { eq } from 'drizzle-orm'
-import { z } from 'zod'
-
-const bodySchema = z.object({ email: z.string().email(), password: z.string().min(8) })
-
-export const Route = createFileRoute('/api/auth/signup')({
-  server: {
-    handlers: {
-      POST: async ({ request }) => {
-        const parsed = bodySchema.safeParse(await request.json().catch(() => null))
-        if (!parsed.success) {
-          return Response.json({ error: 'Invalid email or password (min 8 characters).' }, { status: 400 })
-        }
-        const email = parsed.data.email.toLowerCase()
-
-        const [existing] = await db.select({ id: users.id }).from(users).where(eq(users.email, email)).limit(1)
-        if (existing) {
-          return Response.json({ error: 'An account with this email already exists.' }, { status: 409 })
-        }
-
-        const salt = generateSalt()
-        const passwordHash = await hashPassword(parsed.data.password, salt)
-        const [user] = await db
-          .insert(users)
-          .values({ email, passwordHash })
-          .returning({ id: users.id, email: users.email })
-
-        const token = await signSession(user.id)
-        return Response.json(
-          { user },
-          { status: 201, headers: { 'Set-Cookie': sessionCookieHeader(token) } },
-        )
-      },
-    },
-  },
-})
-`;
-}
-function loginRouteTs() {
-  return `import { createFileRoute } from '@tanstack/react-router'
-import { db } from '#/db'
-import { users } from '#/db/schema'
-import { sessionCookieHeader, signSession, verifyPassword } from '#/lib/auth'
-import { eq } from 'drizzle-orm'
-import { z } from 'zod'
-
-const bodySchema = z.object({ email: z.string().email(), password: z.string() })
-
-export const Route = createFileRoute('/api/auth/login')({
-  server: {
-    handlers: {
-      POST: async ({ request }) => {
-        const parsed = bodySchema.safeParse(await request.json().catch(() => null))
-        if (!parsed.success) {
-          return Response.json({ error: 'Invalid email or password.' }, { status: 400 })
-        }
-        const email = parsed.data.email.toLowerCase()
-
-        const [user] = await db.select().from(users).where(eq(users.email, email)).limit(1)
-        if (!user || !(await verifyPassword(parsed.data.password, user.passwordHash))) {
-          return Response.json({ error: 'Invalid email or password.' }, { status: 401 })
-        }
-
-        const token = await signSession(user.id)
-        return Response.json(
-          { user: { id: user.id, email: user.email } },
-          { status: 200, headers: { 'Set-Cookie': sessionCookieHeader(token) } },
-        )
-      },
-    },
-  },
-})
-`;
-}
-function logoutRouteTs() {
-  return `import { createFileRoute } from '@tanstack/react-router'
-import { clearSessionCookieHeader } from '#/lib/auth'
-
-export const Route = createFileRoute('/api/auth/logout')({
-  server: {
-    handlers: {
-      POST: async () => {
-        return Response.json({ ok: true }, { headers: { 'Set-Cookie': clearSessionCookieHeader() } })
-      },
-    },
-  },
-})
-`;
-}
-function meRouteTs() {
-  return `import { createFileRoute } from '@tanstack/react-router'
-import { getUserFromRequest } from '#/lib/auth'
-
-export const Route = createFileRoute('/api/auth/me')({
-  server: {
-    handlers: {
-      GET: async ({ request }) => {
-        const user = await getUserFromRequest(request)
-        return Response.json({ user })
-      },
-    },
-  },
-})
-`;
-}
-function sessionClientTs() {
-  return `/*
- * Client-side session helpers. getUser() is the getUser() referenced by the
- * "Authenticated routes" pattern in src/routes/README.md -- wire it into
- * __root.tsx's beforeLoad (see that file's manual step below).
- */
-
-export interface SessionUser {
-  id: number
-  email: string
-}
-
-export async function getUser(): Promise<SessionUser | null> {
-  const res = await fetch('/api/auth/me')
-  if (!res.ok) return null
-  const data = (await res.json()) as { user: SessionUser | null }
-  return data.user
-}
-
-export async function login(email: string, password: string): Promise<{ user: SessionUser } | { error: string }> {
-  const res = await fetch('/api/auth/login', {
-    method: 'POST',
-    headers: { 'Content-Type': 'application/json' },
-    body: JSON.stringify({ email, password }),
-  })
-  const data = await res.json()
-  return res.ok ? { user: data.user } : { error: data.error ?? 'Something went wrong.' }
-}
-
-export async function signup(email: string, password: string): Promise<{ user: SessionUser } | { error: string }> {
-  const res = await fetch('/api/auth/signup', {
-    method: 'POST',
-    headers: { 'Content-Type': 'application/json' },
-    body: JSON.stringify({ email, password }),
-  })
-  const data = await res.json()
-  return res.ok ? { user: data.user } : { error: data.error ?? 'Something went wrong.' }
-}
-
-export async function logout(): Promise<void> {
-  await fetch('/api/auth/logout', { method: 'POST' })
-}
-`;
-}
-function authedLayoutTsx() {
-  return `import { createFileRoute, redirect } from '@tanstack/react-router'
-
-// Pathless guard -- no URL segment of its own. Put protected pages under
-// src/routes/_authed/ (e.g. _authed/dashboard.tsx -> /dashboard) and they
-// inherit this beforeLoad. See src/routes/README.md, "Authenticated routes".
-export const Route = createFileRoute('/_authed')({
-  beforeLoad: ({ context }) => {
-    if (!context.user) {
-      throw redirect({ to: '/login' })
-    }
-  },
-})
-`;
-}
-function loginPageTsx() {
-  return `import { createFileRoute, Link, redirect, useRouter } from '@tanstack/react-router'
-import { useState } from 'react'
-import { login } from '#/lib/session-client'
-import { Button } from '#/components/ui/button'
-import { Input } from '#/components/ui/input'
-import { Label } from '#/components/ui/label'
-import { Card, CardContent, CardHeader, CardTitle } from '#/components/ui/card'
-
-export const Route = createFileRoute('/login')({
-  beforeLoad: ({ context }) => {
-    if (context.user) throw redirect({ to: '/' })
-  },
-  component: LoginPage,
-})
-
-function LoginPage() {
-  const router = useRouter()
-  const [email, setEmail] = useState('')
-  const [password, setPassword] = useState('')
-  const [error, setError] = useState('')
-  const [loading, setLoading] = useState(false)
-
-  async function handleSubmit(e: React.FormEvent) {
-    e.preventDefault()
-    setError('')
-    setLoading(true)
-    const result = await login(email, password)
-    setLoading(false)
-    if ('error' in result) {
-      setError(result.error)
-      return
-    }
-    await router.invalidate()
-    router.navigate({ to: '/' })
-  }
-
-  return (
-    <div className="min-h-screen flex items-center justify-center bg-background p-4">
-      <Card className="w-full max-w-sm">
-        <CardHeader>
-          <CardTitle>Log in</CardTitle>
-        </CardHeader>
-        <CardContent>
-          <form onSubmit={handleSubmit} className="space-y-4">
-            <div className="space-y-2">
-              <Label htmlFor="email">Email</Label>
-              <Input id="email" type="email" value={email} onChange={e => setEmail(e.target.value)} required autoComplete="email" />
-            </div>
-            <div className="space-y-2">
-              <Label htmlFor="password">Password</Label>
-              <Input id="password" type="password" value={password} onChange={e => setPassword(e.target.value)} required autoComplete="current-password" />
-            </div>
-            {error && <p className="text-sm text-destructive">{error}</p>}
-            <Button type="submit" className="w-full" disabled={loading}>
-              {loading ? 'Logging in\u2026' : 'Log in'}
-            </Button>
-            <p className="text-sm text-center text-muted-foreground">
-              No account? <Link to="/signup" className="underline">Sign up</Link>
-            </p>
-          </form>
-        </CardContent>
-      </Card>
-    </div>
-  )
-}
-`;
-}
-function signupPageTsx() {
-  return `import { createFileRoute, Link, redirect, useRouter } from '@tanstack/react-router'
-import { useState } from 'react'
-import { signup } from '#/lib/session-client'
-import { Button } from '#/components/ui/button'
-import { Input } from '#/components/ui/input'
-import { Label } from '#/components/ui/label'
-import { Card, CardContent, CardHeader, CardTitle } from '#/components/ui/card'
-
-export const Route = createFileRoute('/signup')({
-  beforeLoad: ({ context }) => {
-    if (context.user) throw redirect({ to: '/' })
-  },
-  component: SignupPage,
-})
-
-function SignupPage() {
-  const router = useRouter()
-  const [email, setEmail] = useState('')
-  const [password, setPassword] = useState('')
-  const [error, setError] = useState('')
-  const [loading, setLoading] = useState(false)
-
-  async function handleSubmit(e: React.FormEvent) {
-    e.preventDefault()
-    setError('')
-    setLoading(true)
-    const result = await signup(email, password)
-    setLoading(false)
-    if ('error' in result) {
-      setError(result.error)
-      return
-    }
-    await router.invalidate()
-    router.navigate({ to: '/' })
-  }
-
-  return (
-    <div className="min-h-screen flex items-center justify-center bg-background p-4">
-      <Card className="w-full max-w-sm">
-        <CardHeader>
-          <CardTitle>Sign up</CardTitle>
-        </CardHeader>
-        <CardContent>
-          <form onSubmit={handleSubmit} className="space-y-4">
-            <div className="space-y-2">
-              <Label htmlFor="email">Email</Label>
-              <Input id="email" type="email" value={email} onChange={e => setEmail(e.target.value)} required autoComplete="email" />
-            </div>
-            <div className="space-y-2">
-              <Label htmlFor="password">Password</Label>
-              <Input id="password" type="password" value={password} onChange={e => setPassword(e.target.value)} required autoComplete="new-password" minLength={8} />
-            </div>
-            {error && <p className="text-sm text-destructive">{error}</p>}
-            <Button type="submit" className="w-full" disabled={loading}>
-              {loading ? 'Signing up\u2026' : 'Sign up'}
-            </Button>
-            <p className="text-sm text-center text-muted-foreground">
-              Already have an account? <Link to="/login" className="underline">Log in</Link>
-            </p>
-          </form>
-        </CardContent>
-      </Card>
-    </div>
-  )
-}
-`;
-}
-async function appendUsersTable(dir) {
-  const schemaPath = path5.join(dir, "src", "db", "schema.ts");
-  const current = await readFile(schemaPath, "utf8").catch(() => null);
-  if (current === null) {
-    throw new Error(`src/db/schema.ts not found -- run scaffold first.`);
-  }
-  if (current.includes(SCHEMA_MARKER))
-    return false;
-  await Bun.write(schemaPath, `${current.trimEnd()}
-${usersTableBlock()}`);
-  return true;
-}
-var setupPasswordAuth = tool({
-  description: "Add email/password auth to an existing project. Call scaffold first, " + "then this. Writes a users table, stateless-JWT session helpers, and " + "signup/login/logout/me API routes.",
-  args: {},
-  async execute(_args, context) {
-    const dir = context.directory;
-    await Promise.all([
-      Bun.write(path5.join(dir, "src", "lib", "auth.ts"), authLibTs()),
-      Bun.write(path5.join(dir, "src", "lib", "session-client.ts"), sessionClientTs()),
-      Bun.write(path5.join(dir, "src", "routes", "api", "auth", "signup.ts"), signupRouteTs()),
-      Bun.write(path5.join(dir, "src", "routes", "api", "auth", "login.ts"), loginRouteTs()),
-      Bun.write(path5.join(dir, "src", "routes", "api", "auth", "logout.ts"), logoutRouteTs()),
-      Bun.write(path5.join(dir, "src", "routes", "api", "auth", "me.ts"), meRouteTs()),
-      Bun.write(path5.join(dir, "src", "routes", "_authed.tsx"), authedLayoutTsx()),
-      Bun.write(path5.join(dir, "src", "routes", "login.tsx"), loginPageTsx()),
-      Bun.write(path5.join(dir, "src", "routes", "signup.tsx"), signupPageTsx())
-    ]);
-    const schemaAppended = await appendUsersTable(dir);
-    return [
-      "Wrote password auth (users table, JWT session, API routes):",
-      `  - src/db/schema.ts ${schemaAppended ? "(appended `users` table)" : "(already had a `users` table, left as-is)"}`,
-      "  - src/lib/auth.ts (hashing, JWT sign/verify, getUserFromRequest -- server-only, never import from a client route)",
-      "  - src/lib/session-client.ts (getUser, login, signup, logout -- client fetch helpers)",
-      "  - src/routes/api/auth/{signup,login,logout,me}.ts (server routes -- never createServerFn)",
-      "  - src/routes/_authed.tsx (pathless guard for protected routes)",
-      "  - src/routes/login.tsx, src/routes/signup.tsx",
-      "",
-      "Session is a stateless HMAC-signed JWT in an httpOnly cookie (no localStorage, no server-side session store).",
-      "",
-      "Required: set AUTH_JWT_SECRET or every request 500s.",
-      "  - dev: add `AUTH_JWT_SECRET=<value>` to .env",
-      "  - prod: `wrangler secret put AUTH_JWT_SECRET`.",
-      "",
-      "Next (manual, one edit): in src/routes/__root.tsx, load the user into router context, per src/routes/README.md's Authenticated routes section:",
-      "",
-      "    import { getUser } from '#/lib/session-client'",
-      "    // in createRootRouteWithContext(...)({ ... }):",
-      "    beforeLoad: async () => ({ user: await getUser() }),",
-      "",
-      "Then put protected pages under src/routes/_authed/ (e.g. _authed/dashboard.tsx -> /dashboard); they inherit the guard."
-    ].join(`
-`);
-  }
-});
-var SetupPasswordAuthPlugin = async () => {
-  return {
-    tool: { setup_password_auth: setupPasswordAuth }
-  };
-};
 export {
-  SetupPasswordAuthPlugin,
   SetupNetsuitePlugin,
+  SetupAuthenticationPlugin,
   ScaffoldPlugin,
   RemovePlugin,
   InspectHttpPlugin