@helloleo/plugins 0.2.0-beta.6 → 0.2.0-beta.9

package/dist/index.js

@@ -24944,6 +24944,7 @@ var scaffold = tool({
       "- Always fetch data with react-query (useQuery and useMutation).",
       "",
       "Next: read src/routes/index.tsx and continue with the user's request.",
+      "For authentication (password and/or OAuth), call setup_authentication.",
       "For NetSuite projects, call setup_netsuite."
     ].join(`
 `);
@@ -24954,631 +24955,901 @@ var ScaffoldPlugin = async () => {
     tool: { scaffold }
   };
 };
-// src/tools/setup-netsuite.ts
-import { mkdir as mkdir2 } from "fs/promises";
-import path4 from "path";
-function netsuiteTs() {
-  return `/*
- * NetSuite OAuth client helper (bearer-token-in-fragment).
- *
- * Two NetSuite Integration Records back this:
- *   1. MCP (scope: mcp)            -- used by HelloLeo at build time.
- *   2. Runtime (scope: rest_webservices) -- used here at sign-in time.
- * Runtime credentials live as HelloLeo Cloud secrets on the project's Worker
- * (env.NETSUITE_ACCOUNT_ID / _CLIENT_ID / _CLIENT_SECRET). They never reach
- * the browser. Cookies are NOT used -- frontend \u2194 Worker are cross-site
- * (e.g. *.helloleo.dev <-> *.workers.dev) and Chrome partitions / drops
- * third-party cookies in the HelloLeo preview iframe.
- *
- * Flow:
- *   1. User clicks "Sign in with NetSuite".
- *   2. Browser navigates to the Worker /auth/netsuite/start.
- *   3. Worker redirects to NetSuite's OAuth UI with PKCE.
- *   4. NetSuite redirects back to the Worker /auth/netsuite/callback.
- *   5. Worker exchanges the code, mints a session id, then redirects to
- *      <return_to>#nssid=<sid>. URL fragments stay in the browser only.
- *   6. This module reads the fragment on load, stashes the sid in
- *      sessionStorage, and sends it as Authorization: Bearer on every
- *      Worker call.
- *
- * NEVER use a hardcoded password gate. NEVER use sessionStorage as the
- * authoritative auth state -- the only acceptable check is /api/me on the
- * Worker. sessionStorage here is just a cache of the bearer token.
- */
+// src/tools/setup-authentication/index.ts
+import path6 from "path";
 
-export const WORKER_URL = import.meta.env.VITE_WORKER_URL ?? '';
-const TOKEN_KEY = 'nssid';
+// src/tools/setup-authentication/auth-files.ts
+function authLibTs(providers) {
+  const hasPassword = providers.includes("password");
+  const oauth = providers.filter((p) => p !== "password");
+  const envFields = [
+    "BETTER_AUTH_SECRET?: string",
+    "HELLOLEO_URL?: string",
+    ...oauth.flatMap((p) => {
+      const prefix = p.toUpperCase();
+      return [
+        `${prefix}_CLIENT_ID?: string`,
+        `${prefix}_CLIENT_SECRET?: string`
+      ];
+    })
+  ].join(`
+    `);
+  const socialProvidersBlock = oauth.length ? `
+    socialProviders: {
+${oauth.map((p) => {
+    const prefix = p.toUpperCase();
+    return `      ${p}: { clientId: requireEnv(e.${prefix}_CLIENT_ID, '${prefix}_CLIENT_ID'), clientSecret: requireEnv(e.${prefix}_CLIENT_SECRET, '${prefix}_CLIENT_SECRET') },`;
+  }).join(`
+`)}
+    },` : "";
+  const requireEnvFn = oauth.length ? `
+function requireEnv(value: string | undefined, name: string): string {
+  if (!value) {
+    throw new Error(\`\${name} is not set. Add it to .env (dev) or run \\\`wrangler secret put \${name}\\\` (prod).\`)
+  }
+  return value
+}
+` : "";
+  return `import { betterAuth } from 'better-auth'
+import { drizzleAdapter } from '@better-auth/drizzle-adapter'
+import { tanstackStartCookies } from 'better-auth/tanstack-start'
+import { db } from '#/db'
+import * as schema from '#/db/schema'
+import { env } from '@helloleo/runtime'
 
-// Capture-and-strip the #nssid=... fragment as early as possible so URLs
-// shown to the user stay clean. Runs once at module load.
-(function bootstrapTokenFromHash() {
-  if (typeof window === 'undefined') return;
-  const hash = window.location.hash.replace(/^#/, '');
-  if (!hash) return;
-  const params = new URLSearchParams(hash);
-  const sid = params.get(TOKEN_KEY);
-  if (sid) {
-    try { sessionStorage.setItem(TOKEN_KEY, sid); } catch {}
-    params.delete(TOKEN_KEY);
-    const remaining = params.toString();
-    const newHash = remaining ? '#' + remaining : '';
-    window.history.replaceState(null, '', window.location.pathname + window.location.search + newHash);
+/*
+ * buildAuth() only runs from INSIDE a request (see getAuth() below) --
+ * never call it at module scope. \`db\` is a lazy Proxy over the D1 binding
+ * and env.* Worker secrets don't exist until a request is in flight;
+ * touching either while workerd boots the isolate throws.
+ */
+${requireEnvFn}
+function buildAuth() {
+  const e = env as {
+    ${envFields}
   }
-})();
 
-export function getSessionToken(): string | null {
-  try { return sessionStorage.getItem(TOKEN_KEY); } catch { return null; }
+  return betterAuth({
+    secret: e.BETTER_AUTH_SECRET,
+    baseURL: e.HELLOLEO_URL || 'http://localhost:3000',
+    database: drizzleAdapter(db, { provider: 'sqlite', schema }),
+    emailAndPassword: {
+      enabled: ${hasPassword},
+    },${socialProvidersBlock}
+    plugins: [tanstackStartCookies()],
+  })
 }
 
-export function signInWithNetSuite(returnTo: string = window.location.href) {
-  if (!WORKER_URL) {
-    throw new Error(
-      'VITE_WORKER_URL is not set. HelloLeo Cloud must be provisioned before sign-in works.',
-    );
-  }
-  const url = new URL(\`\${WORKER_URL.replace(/\\/$/, '')}/auth/netsuite/start\`);
-  url.searchParams.set('return_to', returnTo);
-  // The app usually renders inside the HelloLeo preview iframe. NetSuite's
-  // OAuth page sets X-Frame-Options: DENY, so navigating the iframe to the
-  // Worker (which 302s to NetSuite) ends up loading a page the browser
-  // refuses to render -- looks like "nothing happens" to the user. Navigate
-  // the top frame instead so the OAuth flow runs at the top level and the
-  // callback redirect lands on the same top frame, which then reads the
-  // #nssid= fragment. Use \`location.href =\` (NOT \`location.assign()\`):
-  // reading the \`.assign\` method off a cross-origin \`window.top.location\`
-  // throws a SecurityError, which would drop us into the same-frame fallback
-  // and load NetSuite inside the iframe (X-Frame-Options: DENY -> "refused to
-  // connect"). Assigning \`.href\` is a navigation, allowed cross-origin.
-  try {
-    if (window.top && window.top !== window) {
-      window.top.location.href = url.toString();
-      return;
-    }
-  } catch {
-    /* top window not accessible \u2014 fall through to same-frame navigation */
-  }
-  window.location.href = url.toString();
-}
+let instance: ReturnType<typeof buildAuth> | undefined
 
-export interface NetSuiteSession {
-  authenticated: boolean;
-  account_id?: string;
-  user_id?: string;
-  email?: string;
+export function getAuth() {
+  if (!instance) instance = buildAuth()
+  return instance
 }
-
-export async function getNetSuiteSession(): Promise<NetSuiteSession> {
-  if (!WORKER_URL) return { authenticated: false };
-  const sid = getSessionToken();
-  if (!sid) return { authenticated: false };
-  const res = await fetch(\`\${WORKER_URL.replace(/\\/$/, '')}/api/me\`, {
-    headers: { Authorization: 'Bearer ' + sid },
-  });
-  if (!res.ok) return { authenticated: false };
-  const data = await res.json();
-  return { authenticated: Boolean(data?.account_id), ...data };
+`;
 }
+function authClientTs() {
+  return `import { createAuthClient } from 'better-auth/react'
 
-export async function signOutNetSuite(): Promise<void> {
-  if (!WORKER_URL) return;
-  const sid = getSessionToken();
-  if (sid) {
-    try {
-      await fetch(\`\${WORKER_URL.replace(/\\/$/, '')}/auth/netsuite/logout\`, {
-        method: 'POST',
-        headers: { Authorization: 'Bearer ' + sid },
-      });
-    } catch {}
-  }
-  try { sessionStorage.removeItem(TOKEN_KEY); } catch {}
-  window.location.reload();
+export const authClient = createAuthClient()
+`;
 }
+function authServerTs() {
+  return `import { createServerFn } from '@tanstack/react-start'
+import { getRequestHeaders } from '@tanstack/react-start/server'
+import { getAuth } from '#/lib/auth'
 
-/**
- * Helper for ALL other Worker calls (your dashboard endpoints, etc.).
- * Always go through this instead of bare fetch -- it injects the bearer
- * token and routes through the Worker so NetSuite tokens stay server-side.
- */
-export async function workerFetch(pathOrUrl: string, init: RequestInit = {}): Promise<Response> {
-  if (!WORKER_URL) throw new Error('VITE_WORKER_URL is not set');
-  const url = pathOrUrl.startsWith('http')
-    ? pathOrUrl
-    : \`\${WORKER_URL.replace(/\\/$/, '')}\${pathOrUrl.startsWith('/') ? '' : '/'}\${pathOrUrl}\`;
-  const sid = getSessionToken();
-  const headers = new Headers(init.headers ?? {});
-  if (sid) headers.set('Authorization', 'Bearer ' + sid);
-  return fetch(url, { ...init, headers });
-}
+export const getSession = createServerFn({ method: 'GET' }).handler(async () => {
+  const headers = getRequestHeaders()
+  return getAuth().api.getSession({ headers })
+})
+
+export const ensureSession = createServerFn({ method: 'GET' }).handler(async () => {
+  const headers = getRequestHeaders()
+  const session = await getAuth().api.getSession({ headers })
+  if (!session) throw new Error('Unauthorized')
+  return session
+})
 `;
 }
-function signInButtonTsx() {
-  return `import { signInWithNetSuite } from '../../lib/netsuite';
+function authRouteTs() {
+  return `import { createFileRoute } from '@tanstack/react-router'
+import { getAuth } from '#/lib/auth'
 
-export function SignInWithNetSuite() {
-  return (
-    <button
-      onClick={() => signInWithNetSuite()}
-      className="inline-flex items-center justify-center gap-2 rounded-md bg-primary px-4 py-2 text-sm font-medium text-primary-foreground shadow hover:bg-primary/90 focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-ring"
-    >
-      Sign in with NetSuite
-    </button>
-  );
-}
+export const Route = createFileRoute('/api/auth/$')({
+  server: {
+    handlers: {
+      GET: ({ request }: { request: Request }) => getAuth().handler(request),
+      POST: ({ request }: { request: Request }) => getAuth().handler(request),
+    },
+  },
+})
 `;
 }
-function netsuiteLoginPageTsx() {
-  return `import { SignInWithNetSuite } from './SignInWithNetSuite';
 
-/**
- * Default unauthenticated landing page. Replaces any password gate.
- * Customise copy / imagery freely but keep <SignInWithNetSuite /> as the
- * only call-to-action -- it points to the Worker's /auth/netsuite/start.
- */
-export function LoginPage() {
-  return (
-    <div className="min-h-screen bg-background text-foreground flex">
-      <div className="hidden lg:flex lg:w-1/2 bg-primary text-primary-foreground p-12 flex-col justify-between">
-        <div className="text-xl font-semibold">NetSuite App</div>
-        <div>
-          <h1 className="text-4xl font-bold leading-tight">
-            Connect your NetSuite account
-          </h1>
-          <p className="mt-4 text-primary-foreground/80 max-w-md">
-            Sign in with your NetSuite credentials to access your data securely.
-            Tokens stay server-side on HelloLeo Cloud -- they never reach the
-            browser.
-          </p>
-        </div>
-        <div className="text-xs text-primary-foreground/60">
-          Powered by HelloLeo
-        </div>
-      </div>
-      <div className="flex-1 flex items-center justify-center px-6 py-12">
-        <div className="w-full max-w-sm space-y-6">
-          <div>
-            <h2 className="text-2xl font-semibold">Welcome</h2>
-            <p className="mt-2 text-sm text-muted-foreground">
-              Use the button below to sign in. You'll be redirected to NetSuite
-              to authorise access, then back here.
-            </p>
-          </div>
-          <SignInWithNetSuite />
-        </div>
-      </div>
-    </div>
-  );
-}
+// src/tools/setup-authentication/constants.ts
+var PROVIDERS = [
+  "password",
+  "google",
+  "github",
+  "discord",
+  "microsoft"
+];
+var PROVIDER_LABELS = {
+  google: "Google",
+  github: "GitHub",
+  discord: "Discord",
+  microsoft: "Microsoft"
+};
+var BETTER_AUTH_VERSION = "^1.6.23";
+
+// src/tools/setup-authentication/db-schema.ts
+import { readFile } from "fs/promises";
+import path4 from "path";
+var SCHEMA_MARKER = "sqliteTable('user'";
+function authTablesBlock() {
+  return `
+export const user = sqliteTable('user', {
+  id: text('id').primaryKey(),
+  name: text('name').notNull(),
+  email: text('email').notNull().unique(),
+  emailVerified: integer('email_verified', { mode: 'boolean' }).default(false).notNull(),
+  image: text('image'),
+  createdAt: integer('created_at', { mode: 'timestamp_ms' })
+    .default(sql\`(cast(unixepoch('subsecond') * 1000 as integer))\`)
+    .notNull(),
+  updatedAt: integer('updated_at', { mode: 'timestamp_ms' })
+    .default(sql\`(cast(unixepoch('subsecond') * 1000 as integer))\`)
+    .$onUpdate(() => new Date())
+    .notNull(),
+})
+
+export const session = sqliteTable('session', {
+  id: text('id').primaryKey(),
+  expiresAt: integer('expires_at', { mode: 'timestamp_ms' }).notNull(),
+  token: text('token').notNull().unique(),
+  createdAt: integer('created_at', { mode: 'timestamp_ms' })
+    .default(sql\`(cast(unixepoch('subsecond') * 1000 as integer))\`)
+    .notNull(),
+  updatedAt: integer('updated_at', { mode: 'timestamp_ms' })
+    .$onUpdate(() => new Date())
+    .notNull(),
+  ipAddress: text('ip_address'),
+  userAgent: text('user_agent'),
+  userId: text('user_id')
+    .notNull()
+    .references(() => user.id, { onDelete: 'cascade' }),
+})
+
+export const account = sqliteTable('account', {
+  id: text('id').primaryKey(),
+  accountId: text('account_id').notNull(),
+  providerId: text('provider_id').notNull(),
+  userId: text('user_id')
+    .notNull()
+    .references(() => user.id, { onDelete: 'cascade' }),
+  accessToken: text('access_token'),
+  refreshToken: text('refresh_token'),
+  idToken: text('id_token'),
+  accessTokenExpiresAt: integer('access_token_expires_at', { mode: 'timestamp_ms' }),
+  refreshTokenExpiresAt: integer('refresh_token_expires_at', { mode: 'timestamp_ms' }),
+  scope: text('scope'),
+  password: text('password'),
+  createdAt: integer('created_at', { mode: 'timestamp_ms' })
+    .default(sql\`(cast(unixepoch('subsecond') * 1000 as integer))\`)
+    .notNull(),
+  updatedAt: integer('updated_at', { mode: 'timestamp_ms' })
+    .$onUpdate(() => new Date())
+    .notNull(),
+})
+
+export const verification = sqliteTable('verification', {
+  id: text('id').primaryKey(),
+  identifier: text('identifier').notNull(),
+  value: text('value').notNull(),
+  expiresAt: integer('expires_at', { mode: 'timestamp_ms' }).notNull(),
+  createdAt: integer('created_at', { mode: 'timestamp_ms' })
+    .default(sql\`(cast(unixepoch('subsecond') * 1000 as integer))\`)
+    .notNull(),
+  updatedAt: integer('updated_at', { mode: 'timestamp_ms' })
+    .default(sql\`(cast(unixepoch('subsecond') * 1000 as integer))\`)
+    .$onUpdate(() => new Date())
+    .notNull(),
+})
 `;
 }
-function authTsx() {
-  return `import * as React from 'react';
-import {
-  getNetSuiteSession,
-  signInWithNetSuite,
-  signOutNetSuite,
-  type NetSuiteSession,
-} from './netsuite';
+async function appendAuthTables(dir) {
+  const schemaPath = path4.join(dir, "src", "db", "schema.ts");
+  const current = await readFile(schemaPath, "utf8").catch(() => null);
+  if (current === null) {
+    throw new Error("src/db/schema.ts not found -- run scaffold first.");
+  }
+  if (current.includes(SCHEMA_MARKER))
+    return false;
+  await Bun.write(schemaPath, `${current.trimEnd()}
+${authTablesBlock()}`);
+  return true;
+}
 
-/**
- * NetSuite auth context. Holds the current session (resolved from the Worker's
- * /api/me via getNetSuiteSession) and exposes sign-in / sign-out. The only
- * authoritative auth check is /api/me -- never trust sessionStorage directly.
- */
-export interface NetSuiteAuthContextValue {
-  pending: boolean;
-  isAuthenticated: boolean;
-  session: NetSuiteSession | null;
-  signIn: () => void;
-  signOut: () => Promise<void>;
-  refresh: () => Promise<void>;
+// src/tools/setup-authentication/package-json.ts
+import { readFile as readFile2 } from "fs/promises";
+import path5 from "path";
+async function addAuthDependencies(dir) {
+  const pkgPath = path5.join(dir, "package.json");
+  const pkg = JSON.parse(await readFile2(pkgPath, "utf8"));
+  pkg.dependencies ??= {};
+  if (pkg.dependencies["better-auth"])
+    return false;
+  pkg.dependencies["better-auth"] = BETTER_AUTH_VERSION;
+  pkg.dependencies["@better-auth/drizzle-adapter"] = BETTER_AUTH_VERSION;
+  await Bun.write(pkgPath, `${JSON.stringify(pkg, null, 2)}
+`);
+  return true;
 }
 
-const NetSuiteAuthContext =
-  React.createContext<NetSuiteAuthContextValue | null>(null);
+// src/tools/setup-authentication/pages.ts
+function socialButtonsJsx(oauth) {
+  return oauth.map((p) => `          <Button
+            type="button"
+            variant="outline"
+            className="w-full"
+            onClick={() => authClient.signIn.social({ provider: '${p}', callbackURL: '/' })}
+          >
+            Continue with ${PROVIDER_LABELS[p]}
+          </Button>`).join(`
+`);
+}
+function authedLayoutTsx() {
+  return `import { createFileRoute, redirect } from '@tanstack/react-router'
+import { getSession } from '#/lib/auth-server'
 
-export function NetSuiteAuthProvider({
-  children,
-}: {
-  children: React.ReactNode;
-}) {
-  const [session, setSession] = React.useState<NetSuiteSession | null>(null);
-  const [pending, setPending] = React.useState(true);
+// Pathless guard -- no URL segment of its own. Put protected pages under
+// src/routes/_authed/ (e.g. _authed/dashboard.tsx -> /dashboard) and they
+// inherit this beforeLoad. See src/routes/README.md, "Authenticated routes".
+export const Route = createFileRoute('/_authed')({
+  beforeLoad: async () => {
+    const session = await getSession()
+    if (!session) throw redirect({ to: '/login' })
+    return { user: session.user }
+  },
+})
+`;
+}
+function loginPageTsx(hasPassword, oauth) {
+  const social = oauth.length ? `
+${socialButtonsJsx(oauth)}
+` : "";
+  const divider = oauth.length && hasPassword ? `
+          <div className="relative">
+            <div className="absolute inset-0 flex items-center">
+              <span className="w-full border-t" />
+            </div>
+            <div className="relative flex justify-center text-xs uppercase">
+              <span className="bg-card px-2 text-muted-foreground">Or continue with email</span>
+            </div>
+          </div>
+` : "";
+  const passwordForm = hasPassword ? `
+          <form onSubmit={handleSubmit} className="space-y-4">
+            <div className="space-y-2">
+              <Label htmlFor="email">Email</Label>
+              <Input id="email" type="email" value={email} onChange={e => setEmail(e.target.value)} required autoComplete="email" />
+            </div>
+            <div className="space-y-2">
+              <Label htmlFor="password">Password</Label>
+              <Input id="password" type="password" value={password} onChange={e => setPassword(e.target.value)} required autoComplete="current-password" />
+            </div>
+            {error && <p className="text-sm text-destructive">{error}</p>}
+            <Button type="submit" className="w-full" disabled={loading}>
+              {loading ? 'Logging in\u2026' : 'Log in'}
+            </Button>
+            <p className="text-sm text-center text-muted-foreground">
+              No account? <Link to="/signup" className="underline">Sign up</Link>
+            </p>
+          </form>
+` : "";
+  const stateAndHandler = hasPassword ? `
+  const router = useRouter()
+  const [email, setEmail] = useState('')
+  const [password, setPassword] = useState('')
+  const [error, setError] = useState('')
+  const [loading, setLoading] = useState(false)
 
-  const refresh = React.useCallback(async () => {
-    setPending(true);
-    try {
-      setSession(await getNetSuiteSession());
-    } finally {
-      setPending(false);
+  async function handleSubmit(e: React.FormEvent) {
+    e.preventDefault()
+    setError('')
+    setLoading(true)
+    const { error } = await authClient.signIn.email({ email, password })
+    setLoading(false)
+    if (error) {
+      setError(error.message ?? 'Something went wrong.')
+      return
     }
-  }, []);
-
-  React.useEffect(() => {
-    refresh();
-  }, [refresh]);
+    router.navigate({ to: '/' })
+  }
+` : "";
+  const imports = [
+    hasPassword ? "import { createFileRoute, Link, useRouter } from '@tanstack/react-router'" : "import { createFileRoute } from '@tanstack/react-router'",
+    hasPassword ? "import { useState } from 'react'" : "",
+    "import { authClient } from '#/lib/auth-client'",
+    "import { Button } from '#/components/ui/button'",
+    hasPassword ? "import { Input } from '#/components/ui/input'" : "",
+    hasPassword ? "import { Label } from '#/components/ui/label'" : "",
+    "import { Card, CardContent, CardHeader, CardTitle } from '#/components/ui/card'"
+  ].filter(Boolean).join(`
+`);
+  return `${imports}
 
-  const value: NetSuiteAuthContextValue = {
-    pending,
-    isAuthenticated: Boolean(session?.authenticated),
-    session,
-    signIn: () => signInWithNetSuite(),
-    signOut: signOutNetSuite,
-    refresh,
-  };
+export const Route = createFileRoute('/login')({
+  component: LoginPage,
+})
 
+function LoginPage() {${stateAndHandler}
   return (
-    <NetSuiteAuthContext.Provider value={value}>
-      {children}
-    </NetSuiteAuthContext.Provider>
-  );
+    <div className="min-h-screen flex items-center justify-center bg-background p-4">
+      <Card className="w-full max-w-sm">
+        <CardHeader>
+          <CardTitle>Log in</CardTitle>
+        </CardHeader>
+        <CardContent className="space-y-4">${social}${divider}${passwordForm}
+        </CardContent>
+      </Card>
+    </div>
+  )
+}
+`;
 }
+function signupPageTsx() {
+  return `import { createFileRoute, Link, useRouter } from '@tanstack/react-router'
+import { useState } from 'react'
+import { authClient } from '#/lib/auth-client'
+import { Button } from '#/components/ui/button'
+import { Input } from '#/components/ui/input'
+import { Label } from '#/components/ui/label'
+import { Card, CardContent, CardHeader, CardTitle } from '#/components/ui/card'
 
-export function useNetSuiteAuth(): NetSuiteAuthContextValue {
-  const ctx = React.useContext(NetSuiteAuthContext);
-  if (!ctx) {
-    throw new Error('useNetSuiteAuth must be used within <NetSuiteAuthProvider>');
+export const Route = createFileRoute('/signup')({
+  component: SignupPage,
+})
+
+function SignupPage() {
+  const router = useRouter()
+  const [name, setName] = useState('')
+  const [email, setEmail] = useState('')
+  const [password, setPassword] = useState('')
+  const [error, setError] = useState('')
+  const [loading, setLoading] = useState(false)
+
+  async function handleSubmit(e: React.FormEvent) {
+    e.preventDefault()
+    setError('')
+    setLoading(true)
+    const { error } = await authClient.signUp.email({ name, email, password })
+    setLoading(false)
+    if (error) {
+      setError(error.message ?? 'Something went wrong.')
+      return
+    }
+    router.navigate({ to: '/' })
   }
-  return ctx;
+
+  return (
+    <div className="min-h-screen flex items-center justify-center bg-background p-4">
+      <Card className="w-full max-w-sm">
+        <CardHeader>
+          <CardTitle>Sign up</CardTitle>
+        </CardHeader>
+        <CardContent>
+          <form onSubmit={handleSubmit} className="space-y-4">
+            <div className="space-y-2">
+              <Label htmlFor="name">Name</Label>
+              <Input id="name" type="text" value={name} onChange={e => setName(e.target.value)} required autoComplete="name" />
+            </div>
+            <div className="space-y-2">
+              <Label htmlFor="email">Email</Label>
+              <Input id="email" type="email" value={email} onChange={e => setEmail(e.target.value)} required autoComplete="email" />
+            </div>
+            <div className="space-y-2">
+              <Label htmlFor="password">Password</Label>
+              <Input id="password" type="password" value={password} onChange={e => setPassword(e.target.value)} required autoComplete="new-password" minLength={8} />
+            </div>
+            {error && <p className="text-sm text-destructive">{error}</p>}
+            <Button type="submit" className="w-full" disabled={loading}>
+              {loading ? 'Signing up\u2026' : 'Sign up'}
+            </Button>
+            <p className="text-sm text-center text-muted-foreground">
+              Already have an account? <Link to="/login" className="underline">Log in</Link>
+            </p>
+          </form>
+        </CardContent>
+      </Card>
+    </div>
+  )
 }
 `;
 }
-function authLayoutTsx() {
-  return `import type { ReactNode } from 'react';
-import { NetSuiteAuthProvider, useNetSuiteAuth } from '../../lib/auth';
-import { LoginPage } from './LoginPage';
+function dashboardPageTsx() {
+  return `import { createFileRoute, useRouter } from '@tanstack/react-router'
+import { authClient } from '#/lib/auth-client'
+import { Button } from '#/components/ui/button'
 
-/**
- * NetSuite auth layout. This is the ONLY wiring you need to add by hand --
- * wrap the root route's <Outlet /> with it:
- *
- *   // src/routes/__root.tsx
- *   import { AuthLayout } from '../components/auth/AuthLayout';
- *   ...
- *   function RootComponent() {
- *     return (
- *       <>
- *         <AuthLayout>
- *           <Outlet />
- *         </AuthLayout>
- *         { ...devtools... }
- *       </>
- *     );
- *   }
- *
- * It provides NetSuite auth context to the whole tree and gates rendering:
- * while the session resolves it shows a spinner, unauthenticated users see
- * <LoginPage />, authenticated users see your routes. Use useNetSuiteAuth()
- * anywhere below it to read the session or sign out. NEVER swap this for a
- * password gate -- real OAuth is the only supported login.
- */
-export function AuthLayout({ children }: { children: ReactNode }) {
-  return (
-    <NetSuiteAuthProvider>
-      <Gate>{children}</Gate>
-    </NetSuiteAuthProvider>
-  );
-}
+// Example protected page -- _authed.tsx needs at least one child route or
+// it collides with index.tsx on path "/" and \`tsr generate\` fails. Replace
+// this, or add more pages alongside it under src/routes/_authed/.
+export const Route = createFileRoute('/_authed/dashboard')({
+  component: DashboardPage,
+})
 
-function Gate({ children }: { children: ReactNode }) {
-  const { pending, isAuthenticated } = useNetSuiteAuth();
+function DashboardPage() {
+  const router = useRouter()
+  const { data: session } = authClient.useSession()
 
-  if (pending) {
-    return (
-      <div className="min-h-screen flex items-center justify-center bg-background">
-        <div className="h-8 w-8 rounded-full border-2 border-primary border-t-transparent animate-spin" />
+  return (
+    <div className="min-h-screen flex items-center justify-center bg-background p-4">
+      <div className="text-center space-y-4">
+        <p className="text-lg">Signed in as {session?.user.email}</p>
+        <Button
+          onClick={() =>
+            authClient.signOut({
+              fetchOptions: { onSuccess: () => router.navigate({ to: '/login' }) },
+            })
+          }
+        >
+          Sign out
+        </Button>
       </div>
-    );
-  }
-
-  if (!isAuthenticated) return <LoginPage />;
-
-  return <>{children}</>;
+    </div>
+  )
 }
 `;
 }
-var setupNetsuite = tool({
-  description: "Add NetSuite OAuth wiring to an existing project. Call scaffold first, " + "then this. Writes the OAuth client, auth provider and login components. " + "All files are additive, nothing is overwritten. Real OAuth is wired " + "from day one, never replace <AuthLayout> with a password placeholder.",
-  args: {},
-  async execute(_args, context) {
+
+// src/tools/setup-authentication/index.ts
+var setupAuthentication = tool({
+  description: "Add authentication to an existing project via better-auth. Call scaffold first, " + "then this. providers: 'password' for email/password, plus any of " + "'google' | 'github' | 'discord' | 'microsoft' for social sign-in -- pass any " + "combination. Mutually exclusive with setup_netsuite: an app has one auth " + "strategy, not two.",
+  args: {
+    providers: exports_external2.array(exports_external2.enum(PROVIDERS)).min(1).describe("Auth methods to enable, e.g. ['password', 'google']")
+  },
+  async execute({ providers }, context) {
     const dir = context.directory;
-    await mkdir2(path4.join(dir, "src", "components", "auth"), {
-      recursive: true
-    });
-    const nsFiles = [
-      [path4.join("src", "lib", "netsuite.ts"), netsuiteTs()],
-      [path4.join("src", "lib", "auth.tsx"), authTsx()],
-      [
-        path4.join("src", "components", "auth", "AuthLayout.tsx"),
-        authLayoutTsx()
-      ],
+    const hasPassword = providers.includes("password");
+    const oauth = providers.filter((p) => p !== "password");
+    const files = [
+      [path6.join("src", "lib", "auth.ts"), authLibTs(providers)],
+      [path6.join("src", "lib", "auth-client.ts"), authClientTs()],
+      [path6.join("src", "lib", "auth-server.ts"), authServerTs()],
+      [path6.join("src", "routes", "api", "auth", "$.ts"), authRouteTs()],
+      [path6.join("src", "routes", "_authed.tsx"), authedLayoutTsx()],
       [
-        path4.join("src", "components", "auth", "LoginPage.tsx"),
-        netsuiteLoginPageTsx()
+        path6.join("src", "routes", "_authed", "dashboard.tsx"),
+        dashboardPageTsx()
       ],
       [
-        path4.join("src", "components", "auth", "SignInWithNetSuite.tsx"),
-        signInButtonTsx()
+        path6.join("src", "routes", "login.tsx"),
+        loginPageTsx(hasPassword, oauth)
       ]
     ];
-    for (const [filePath, content] of nsFiles) {
-      await Bun.write(path4.join(dir, filePath), content);
+    if (hasPassword) {
+      files.push([path6.join("src", "routes", "signup.tsx"), signupPageTsx()]);
+    }
+    for (const [filePath, content] of files) {
+      await Bun.write(path6.join(dir, filePath), content);
+    }
+    const schemaAppended = await appendAuthTables(dir);
+    const depsAdded = await addAuthDependencies(dir);
+    const envLines = [
+      "  - dev (.env): BETTER_AUTH_SECRET=<random>",
+      "  - prod: `wrangler secret put BETTER_AUTH_SECRET`",
+      "  - HELLOLEO_URL is auto-injected by the platform (preview + production) -- nothing to set for baseURL"
+    ];
+    for (const p of oauth) {
+      const prefix = p.toUpperCase();
+      envLines.push(`  - ${PROVIDER_LABELS[p]}: ${prefix}_CLIENT_ID / ${prefix}_CLIENT_SECRET (dev: .env, prod: wrangler secret put)`);
     }
     return [
-      `Wrote ${nsFiles.length} NetSuite OAuth files (all additive, nothing overwritten):`,
-      "  - src/lib/netsuite.ts (OAuth client: signIn, session, workerFetch)",
-      "  - src/lib/auth.tsx (NetSuiteAuthProvider and useNetSuiteAuth)",
-      "  - src/components/auth/AuthLayout.tsx (provider and auth gate)",
-      "  - src/components/auth/LoginPage.tsx (unauthenticated view)",
-      "  - src/components/auth/SignInWithNetSuite.tsx (sign-in button)",
+      `Wrote authentication (better-auth, providers: ${providers.join(", ")}):`,
+      "  - src/lib/auth.ts (lazy betterAuth instance -- read the comment on why it's not a module-scope export)",
+      "  - src/lib/auth-client.ts (React client -- authClient.signIn.email/social, signUp.email, signOut)",
+      "  - src/lib/auth-server.ts (getSession/ensureSession server functions, for SSR route guards)",
+      "  - src/routes/api/auth/$.ts (catch-all handler)",
+      "  - src/routes/_authed.tsx (pathless guard for protected routes)",
+      "  - src/routes/_authed/dashboard.tsx (example protected page -- _authed needs at least one child route or it collides with index.tsx on '/')",
+      `  - src/routes/login.tsx${hasPassword ? ", src/routes/signup.tsx" : ""}`,
+      `  - src/db/schema.ts ${schemaAppended ? "(appended user/session/account/verification tables)" : "(already had a `user` table, left as-is)"}`,
+      `  - package.json ${depsAdded ? "(added better-auth, @better-auth/drizzle-adapter)" : "(dependencies already present)"}`,
       "",
-      "Notes:",
-      "- AuthLayout shows LoginPage to signed-out users and renders the app's routes once they sign in with NetSuite.",
-      "- Read the session anywhere with useNetSuiteAuth() from src/lib/auth.tsx.",
-      "- Never replace AuthLayout with a password gate. Real OAuth is the only supported login.",
-      "- The auth worker (deployed via the cloudflare-backend MCP) serves /auth/netsuite/start, /auth/netsuite/callback, /api/me and /auth/netsuite/logout. It reads env.NETSUITE_ACCOUNT_ID, _CLIENT_ID and _CLIENT_SECRET. VITE_WORKER_URL must be set (HelloLeo Cloud seeds it).",
+      "Run `bun install`, then `bun run db:push` (or just `bun dev`, which runs it first) to create the new tables.",
       "",
-      "Next: in src/routes/__root.tsx, import AuthLayout and wrap <Outlet /> with it. Keep any existing providers.",
+      "Required env vars/secrets:",
+      ...envLines,
       "",
-      "    import { AuthLayout } from '../components/auth/AuthLayout'",
+      "Add more protected pages under src/routes/_authed/ (e.g. _authed/settings.tsx -> /settings); they inherit the guard.",
       "",
-      "    <AuthLayout>",
-      "      <Outlet />",
-      "    </AuthLayout>"
+      "Verify before shipping: password hashing defaults to scrypt via Node's crypto, exposed through the " + "nodejs_compat flag (already on for this template) -- confirm a real sign-up/login round-trip works in `bun dev`.",
+      "",
+      "Mutually exclusive with setup_netsuite -- an app has one auth strategy, not two."
     ].join(`
 `);
   }
 });
-var SetupNetsuitePlugin = async () => {
+var SetupAuthenticationPlugin = async () => {
   return {
-    tool: { setup_netsuite: setupNetsuite }
+    tool: { setup_authentication: setupAuthentication }
   };
 };
-// src/tools/setup-password-auth.ts
-import { readFile } from "fs/promises";
-import path5 from "path";
-var SCHEMA_MARKER = "sqliteTable('users'";
-function usersTableBlock() {
+// src/tools/setup-netsuite.ts
+import { mkdir as mkdir2, readFile as readFile3 } from "fs/promises";
+import path7 from "path";
+function schemaAppend() {
   return `
-export const users = sqliteTable('users', {
-  id: integer('id').primaryKey({ autoIncrement: true }),
-  email: text('email').notNull().unique(),
-  passwordHash: text('password_hash').notNull(),
+// --- NetSuite OAuth (added by setup_netsuite) ---
+// Short-lived PKCE + return-to state between /auth/netsuite/start and its
+// callback. Single-use: the callback deletes the row after reading it.
+export const netsuiteFlows = sqliteTable('netsuite_flows', {
+  flowId: text('flow_id').primaryKey(),
+  codeVerifier: text('code_verifier').notNull(),
+  returnTo: text('return_to').notNull(),
   createdAt: integer('created_at')
     .notNull()
     .default(sql\`(unixepoch())\`),
 })
 
-export type User = typeof users.$inferSelect
+// Opaque session id -> NetSuite tokens. Tokens stay server-side; the browser
+// only ever holds the sid (sent as a bearer).
+export const netsuiteSessions = sqliteTable('netsuite_sessions', {
+  sid: text('sid').primaryKey(),
+  accountId: text('account_id').notNull(),
+  accessToken: text('access_token').notNull(),
+  refreshToken: text('refresh_token'),
+  expiresAt: integer('expires_at'),
+  userId: text('user_id'),
+  email: text('email'),
+  createdAt: integer('created_at')
+    .notNull()
+    .default(sql\`(unixepoch())\`),
+})
 `;
 }
-function authLibTs() {
-  return `import { db } from '#/db'
-import { users } from '#/db/schema'
-import { env } from '@helloleo/runtime'
-import { eq } from 'drizzle-orm'
-
-/*
- * Password hashing, session JWTs, and user lookup. Used ONLY from
- * src/routes/api/auth/*.ts server routes -- never imported by a client
- * route file. Sessions are a stateless HMAC-signed JWT in an httpOnly
- * cookie, not a server-side session store: verifying a session costs one
- * signature check, no database or KV round-trip.
+function netsuiteServerTs() {
+  return `/*
+ * NetSuite runtime OAuth -- server side (TanStack Start server routes).
  *
- * AUTH_JWT_SECRET must be set for signing/verifying to work:
- *   - dev: add \`AUTH_JWT_SECRET=<random value>\` to .env (gitignored;
- *     the cf-shim exposes process.env vars as-is in dev).
- *   - prod: \`wrangler secret put AUTH_JWT_SECRET\`.
- * Generate a value with: openssl rand -hex 32
+ * Runs wherever the app runs: \`vite dev\` (workerd) in the Fly preview machine
+ * in dev, and the published Cloudflare Worker in prod. There is no separate
+ * backend Worker -- these helpers back the /auth/netsuite/* + /api/me routes.
+ *
+ * Config is read from the Cloudflare env binding via @helloleo/runtime.
+ * Set NETSUITE_ACCOUNT_ID / _CLIENT_ID / _CLIENT_SECRET (secret optional for a
+ * PKCE public client) and optional PUBLIC_APP_URL as HelloLeo Cloud secrets
+ * (prod) or dev vars (preview). They never reach the browser.
  */
+import { eq } from 'drizzle-orm'
+import { env as runtimeEnv } from '@helloleo/runtime'
+import { db } from '#/db'
+import { netsuiteSessions } from '#/db/schema'
 
-const encoder = new TextEncoder()
-const SESSION_COOKIE = 'session'
-const SESSION_TTL_SECONDS = 60 * 60 * 24 * 7
+interface NsEnv {
+  NETSUITE_ACCOUNT_ID?: string
+  NETSUITE_CLIENT_ID?: string
+  NETSUITE_CLIENT_SECRET?: string
+  PUBLIC_APP_URL?: string
+  HELLOLEO_URL?: string
+}
+const nsEnv = runtimeEnv as unknown as NsEnv
 
-function getAuthSecret(): string {
-  const secret = (env as { AUTH_JWT_SECRET?: string }).AUTH_JWT_SECRET
-  if (!secret) {
+// Runtime record scope. The app signs end-users in for REST/SuiteQL.
+export const SCOPE = 'rest_webservices'
+const REFRESH_LEEWAY_SECONDS = 60
+
+export function requireConfig() {
+  const accountId = nsEnv.NETSUITE_ACCOUNT_ID
+  const clientId = nsEnv.NETSUITE_CLIENT_ID
+  if (!accountId || !clientId) {
     throw new Error(
-      'AUTH_JWT_SECRET is not set. Add it to .env (dev) or run ' +
-        '\`wrangler secret put AUTH_JWT_SECRET\` (prod).',
+      'NetSuite not configured: set NETSUITE_ACCOUNT_ID and NETSUITE_CLIENT_ID (and NETSUITE_CLIENT_SECRET for a confidential client) as HelloLeo Cloud secrets / dev vars.',
     )
   }
-  return secret
+  return { accountId, clientId, clientSecret: nsEnv.NETSUITE_CLIENT_SECRET || '' }
 }
 
-function toHex(bytes: Uint8Array): string {
-  return Array.from(bytes)
-    .map(b => b.toString(16).padStart(2, '0'))
-    .join('')
+// Account id -> DNS host form: lowercase, underscores to hyphens.
+function host(accountId: string) {
+  return accountId.trim().toLowerCase().replace(/_/g, '-')
 }
-
-function timingSafeEqual(a: string, b: string): boolean {
-  if (a.length !== b.length) return false
-  let diff = 0
-  for (let i = 0; i < a.length; i++) diff |= a.charCodeAt(i) ^ b.charCodeAt(i)
-  return diff === 0
+export function authorizeUrl(accountId: string) {
+  return \`https://\${host(accountId)}.app.netsuite.com/app/login/oauth2/authorize.nl\`
 }
-
-// ---- password hashing (salted SHA-256; sufficient for a single-tenant
-// demo app -- swap for a WASM bcrypt/argon2 if this ever guards real data) ----
-
-export function generateSalt(): string {
-  return toHex(crypto.getRandomValues(new Uint8Array(16)))
+export function tokenUrl(accountId: string) {
+  return \`https://\${host(accountId)}.suitetalk.api.netsuite.com/services/rest/auth/oauth2/v1/token\`
 }
-
-async function sha256Hex(input: string): Promise<string> {
-  const digest = await crypto.subtle.digest('SHA-256', encoder.encode(input))
-  return toHex(new Uint8Array(digest))
+export function restBase(accountId: string) {
+  return \`https://\${host(accountId)}.suitetalk.api.netsuite.com\`
 }
 
-export async function hashPassword(password: string, salt: string): Promise<string> {
-  return \`\${salt}:\${await sha256Hex(salt + password)}\`
+function stripTrailingSlash(s: string) {
+  return s.endsWith('/') ? s.slice(0, -1) : s
 }
 
-export async function verifyPassword(password: string, stored: string): Promise<boolean> {
-  const [salt, hash] = stored.split(':')
-  if (!salt || !hash) return false
-  return timingSafeEqual(await sha256Hex(salt + password), hash)
+// Public origin of THIS app, used to build the redirect URI. Prefer an explicit
+// PUBLIC_APP_URL; else derive from the request (honouring the preview proxy's
+// forwarded headers). Must match a redirect URI registered on the NetSuite
+// Integration Record exactly.
+export function appOrigin(request: Request) {
+  // 1) Explicit override wins (set by the platform per environment).
+  if (nsEnv.PUBLIC_APP_URL) return stripTrailingSlash(nsEnv.PUBLIC_APP_URL)
+  // 2) HELLOLEO_URL is injected on every deploy (the app's canonical origin), so
+  //    it's set even when the NetSuite wizard's PUBLIC_APP_URL pin wasn't.
+  if (nsEnv.HELLOLEO_URL) return stripTrailingSlash(nsEnv.HELLOLEO_URL)
+  // 3) Preview/prod proxies rewrite Host, so trust the forwarded/original host
+  //    they set (HelloLeo's nginx sends X-Original-Host) \u2014 that's the public URL
+  //    the browser loaded, not an internal upstream host.
+  const url = new URL(request.url)
+  const proto = request.headers.get('x-forwarded-proto') || url.protocol.replace(':', '')
+  const hostHeader =
+    request.headers.get('x-forwarded-host') ||
+    request.headers.get('x-original-host') ||
+    url.host
+  return \`\${proto}://\${hostHeader}\`
+}
+export function redirectUri(request: Request) {
+  return \`\${appOrigin(request)}/auth/netsuite/callback\`
 }
 
-// ---- session JWT (HS256, hand-rolled -- no dependency needed for one HMAC) ----
-
-function base64url(bytes: Uint8Array): string {
-  let binary = ''
-  for (const b of bytes) binary += String.fromCharCode(b)
-  return btoa(binary).replace(/\\+/g, '-').replace(/\\//g, '_').replace(/=+$/, '')
+// Coerce ?return_to= to our OWN origin. The callback appends the session bearer
+// as a #nssid=... fragment; an off-origin return_to would leak that live
+// credential to an attacker-controlled page (open-redirect -> token theft).
+export function safeReturnTo(request: Request, raw: string | null): string {
+  const origin = appOrigin(request)
+  if (!raw) return origin
+  try {
+    const u = new URL(raw, origin)
+    return u.origin === origin ? u.toString() : origin
+  } catch {
+    return origin
+  }
 }
 
-function base64urlDecode(value: string): string {
-  const padded = value.replace(/-/g, '+').replace(/_/g, '/')
-  return atob(padded)
+// --- PKCE (Web Crypto: works on workerd and Node) ---
+function b64url(bytes: Uint8Array) {
+  let s = ''
+  for (const b of bytes) s += String.fromCharCode(b)
+  return btoa(s).replace(/\\+/g, '-').replace(/\\//g, '_').replace(/=+$/, '')
+}
+export async function pkce() {
+  const verifier = b64url(crypto.getRandomValues(new Uint8Array(48)))
+  const digest = await crypto.subtle.digest('SHA-256', new TextEncoder().encode(verifier))
+  const challenge = b64url(new Uint8Array(digest))
+  return { verifier, challenge }
 }
 
-async function hmacKey(secret: string) {
-  return crypto.subtle.importKey(
-    'raw',
-    encoder.encode(secret),
-    { name: 'HMAC', hash: 'SHA-256' },
-    false,
-    ['sign'],
-  )
+interface TokenResponse {
+  access_token?: string
+  refresh_token?: string
+  expires_in?: number
+  error?: string
+  error_description?: string
 }
 
-export async function signSession(userId: number): Promise<string> {
-  const header = base64url(encoder.encode(JSON.stringify({ alg: 'HS256', typ: 'JWT' })))
-  const payload = base64url(
-    encoder.encode(
-      JSON.stringify({ sub: userId, exp: Math.floor(Date.now() / 1000) + SESSION_TTL_SECONDS }),
-    ),
-  )
-  const key = await hmacKey(getAuthSecret())
-  const sig = await crypto.subtle.sign('HMAC', key, encoder.encode(\`\${header}.\${payload}\`))
-  return \`\${header}.\${payload}.\${base64url(new Uint8Array(sig))}\`
+// Confidential client -> HTTP Basic. Public (PKCE-only) -> client_id in body.
+function authHeaders(clientId: string, clientSecret: string, params: Record<string, string>) {
+  const headers: Record<string, string> = { 'Content-Type': 'application/x-www-form-urlencoded' }
+  if (clientSecret) headers.Authorization = 'Basic ' + btoa(\`\${clientId}:\${clientSecret}\`)
+  else params.client_id = clientId
+  return headers
 }
 
-export async function verifySession(token: string): Promise<number | null> {
-  const parts = token.split('.')
-  if (parts.length !== 3) return null
-  const [header, payload, sig] = parts
-  const key = await hmacKey(getAuthSecret())
-  const expectedSig = base64url(
-    new Uint8Array(await crypto.subtle.sign('HMAC', key, encoder.encode(\`\${header}.\${payload}\`))),
-  )
-  if (!timingSafeEqual(expectedSig, sig)) return null
+// POST the token endpoint and parse tolerantly. NetSuite returns JSON for both
+// success and OAuth errors, but a gateway (502/504) can return HTML -- never let
+// res.json() throw into the route handler (that would surface as an opaque 500
+// instead of a clean "token exchange failed").
+async function postToken(
+  accountId: string,
+  params: Record<string, string>,
+  headers: Record<string, string>,
+): Promise<TokenResponse> {
+  let res: Response
   try {
-    const claims = JSON.parse(base64urlDecode(payload)) as { sub: number; exp: number }
-    if (claims.exp < Math.floor(Date.now() / 1000)) return null
-    return claims.sub
+    res = await fetch(tokenUrl(accountId), { method: 'POST', headers, body: new URLSearchParams(params) })
+  } catch (e) {
+    return { error: 'network_error', error_description: String(e) }
+  }
+  const text = await res.text()
+  let data: TokenResponse = {}
+  try {
+    data = JSON.parse(text) as TokenResponse
   } catch {
-    return null
+    // non-JSON body (e.g. gateway HTML) -- leave data empty, fall through
+  }
+  if (!res.ok && !data.error) {
+    data = { error: 'token_request_failed', error_description: 'HTTP ' + res.status }
   }
+  return data
 }
 
-export function sessionCookieHeader(token: string): string {
-  return \`\${SESSION_COOKIE}=\${token}; Path=/; Max-Age=\${SESSION_TTL_SECONDS}; HttpOnly; SameSite=Lax\`
+export async function exchangeCode(request: Request, code: string, verifier: string) {
+  const { accountId, clientId, clientSecret } = requireConfig()
+  const params: Record<string, string> = {
+    grant_type: 'authorization_code',
+    code,
+    redirect_uri: redirectUri(request),
+    code_verifier: verifier,
+  }
+  return postToken(accountId, params, authHeaders(clientId, clientSecret, params))
 }
 
-export function clearSessionCookieHeader(): string {
-  return \`\${SESSION_COOKIE}=; Path=/; Max-Age=0; HttpOnly; SameSite=Lax\`
+async function refreshToken(refresh: string) {
+  const { accountId, clientId, clientSecret } = requireConfig()
+  const params: Record<string, string> = { grant_type: 'refresh_token', refresh_token: refresh }
+  return postToken(accountId, params, authHeaders(clientId, clientSecret, params))
 }
 
-export function readSessionToken(request: Request): string | null {
-  const cookieHeader = request.headers.get('cookie') ?? ''
-  for (const part of cookieHeader.split(/;\\s*/)) {
-    const eq = part.indexOf('=')
-    if (eq === -1) continue
-    if (part.slice(0, eq) === SESSION_COOKIE) return part.slice(eq + 1)
-  }
-  return null
+export interface NsSession {
+  sid: string
+  accountId: string
+  accessToken: string
+  refreshToken: string | null
+  expiresAt: number | null
+  userId: string | null
+  email: string | null
 }
 
-export async function getUserFromRequest(request: Request) {
-  const token = readSessionToken(request)
-  if (!token) return null
-  const userId = await verifySession(token)
-  if (userId === null) return null
-  const [user] = await db
-    .select({ id: users.id, email: users.email })
-    .from(users)
-    .where(eq(users.id, userId))
-    .limit(1)
-  return user ?? null
+// Load a session by sid, transparently refreshing the access token when it's
+// within the leeway of expiry. Returns null if unknown or unrefreshable.
+export async function getSession(sid: string): Promise<NsSession | null> {
+  if (!sid) return null
+  const rows = await db.select().from(netsuiteSessions).where(eq(netsuiteSessions.sid, sid)).limit(1)
+  const s = rows[0]
+  if (!s) return null
+  const now = Math.floor(Date.now() / 1000)
+  // A missing expiry is treated as EXPIRED (force a refresh) rather than trusting
+  // the token forever -- NetSuite normally sends expires_in, so this is defensive.
+  const expired = s.expiresAt == null ? true : now + REFRESH_LEEWAY_SECONDS >= s.expiresAt
+  if (expired) {
+    // Token expired (or about to). It MUST refresh; if it can't, the session is
+    // dead \u2014 delete it and return null so /api/me reports signed-out and the user
+    // re-auths, rather than a "logged in" app whose every NetSuite call 401s.
+    if (!s.refreshToken) { await deleteSession(sid); return null }
+    const tok = await refreshToken(s.refreshToken)
+    if (!tok.access_token) { await deleteSession(sid); return null }
+    const expiresAt = now + (tok.expires_in || 3600)
+    const refreshTok = tok.refresh_token ?? s.refreshToken
+    await db
+      .update(netsuiteSessions)
+      .set({ accessToken: tok.access_token, refreshToken: refreshTok, expiresAt })
+      .where(eq(netsuiteSessions.sid, sid))
+    return { ...s, accessToken: tok.access_token, refreshToken: refreshTok, expiresAt }
+  }
+  return s
+}
+
+export async function deleteSession(sid: string) {
+  if (sid) await db.delete(netsuiteSessions).where(eq(netsuiteSessions.sid, sid))
+}
+
+export function bearer(request: Request) {
+  const h = request.headers.get('authorization') || ''
+  return h.startsWith('Bearer ') ? h.slice(7) : ''
+}
+
+/**
+ * Call NetSuite REST / SuiteQL for the signed-in session. Use this from your
+ * data routes (src/routes/api/*). \`path\` is relative to the account's
+ * suitetalk host, e.g. '/services/rest/query/v1/suiteql'. Returns the raw
+ * fetch Response (401 if the sid is unknown). Access token is auto-refreshed.
+ */
+export async function netsuiteFetch(sid: string, path: string, init: RequestInit = {}): Promise<Response> {
+  const session = await getSession(sid)
+  if (!session) return new Response(JSON.stringify({ error: 'unauthorized' }), { status: 401 })
+  const url = path.startsWith('http') ? path : \`\${restBase(session.accountId)}\${path}\`
+  const headers = new Headers(init.headers)
+  headers.set('Authorization', \`Bearer \${session.accessToken}\`)
+  if (init.body && !headers.has('Content-Type')) headers.set('Content-Type', 'application/json')
+  return fetch(url, { ...init, headers })
 }
 `;
 }
-function signupRouteTs() {
+function startRouteTs() {
   return `import { createFileRoute } from '@tanstack/react-router'
 import { db } from '#/db'
-import { users } from '#/db/schema'
-import { generateSalt, hashPassword, sessionCookieHeader, signSession } from '#/lib/auth'
-import { eq } from 'drizzle-orm'
-import { z } from 'zod'
-
-const bodySchema = z.object({ email: z.string().email(), password: z.string().min(8) })
+import { netsuiteFlows } from '#/db/schema'
+import {
+  authorizeUrl,
+  pkce,
+  redirectUri,
+  requireConfig,
+  safeReturnTo,
+  SCOPE,
+} from '#/lib/netsuite-server'
 
-export const Route = createFileRoute('/api/auth/signup')({
+// GET /auth/netsuite/start -- begin the NetSuite OAuth (PKCE) flow.
+export const Route = createFileRoute('/auth/netsuite/start')({
   server: {
     handlers: {
-      POST: async ({ request }) => {
-        const parsed = bodySchema.safeParse(await request.json().catch(() => null))
-        if (!parsed.success) {
-          return Response.json({ error: 'Invalid email or password (min 8 characters).' }, { status: 400 })
-        }
-        const email = parsed.data.email.toLowerCase()
+      GET: async ({ request }) => {
+        const { accountId, clientId } = requireConfig()
+        const url = new URL(request.url)
+        // Same-origin only: the callback returns the bearer in a URL fragment.
+        const returnTo = safeReturnTo(request, url.searchParams.get('return_to'))
 
-        const [existing] = await db.select({ id: users.id }).from(users).where(eq(users.email, email)).limit(1)
-        if (existing) {
-          return Response.json({ error: 'An account with this email already exists.' }, { status: 409 })
-        }
+        const { verifier, challenge } = await pkce()
+        const flowId = crypto.randomUUID()
+        await db.insert(netsuiteFlows).values({ flowId, codeVerifier: verifier, returnTo })
 
-        const salt = generateSalt()
-        const passwordHash = await hashPassword(parsed.data.password, salt)
-        const [user] = await db
-          .insert(users)
-          .values({ email, passwordHash })
-          .returning({ id: users.id, email: users.email })
+        const authorize = new URL(authorizeUrl(accountId))
+        authorize.searchParams.set('response_type', 'code')
+        authorize.searchParams.set('client_id', clientId)
+        authorize.searchParams.set('redirect_uri', redirectUri(request))
+        authorize.searchParams.set('scope', SCOPE)
+        authorize.searchParams.set('state', flowId)
+        authorize.searchParams.set('code_challenge', challenge)
+        authorize.searchParams.set('code_challenge_method', 'S256')
 
-        const token = await signSession(user.id)
-        return Response.json(
-          { user },
-          { status: 201, headers: { 'Set-Cookie': sessionCookieHeader(token) } },
-        )
+        return new Response(null, { status: 302, headers: { Location: authorize.toString() } })
       },
     },
   },
 })
 `;
 }
-function loginRouteTs() {
+function callbackRouteTs() {
   return `import { createFileRoute } from '@tanstack/react-router'
-import { db } from '#/db'
-import { users } from '#/db/schema'
-import { sessionCookieHeader, signSession, verifyPassword } from '#/lib/auth'
 import { eq } from 'drizzle-orm'
-import { z } from 'zod'
-
-const bodySchema = z.object({ email: z.string().email(), password: z.string() })
+import { db } from '#/db'
+import { netsuiteFlows, netsuiteSessions } from '#/db/schema'
+import { exchangeCode, requireConfig } from '#/lib/netsuite-server'
 
-export const Route = createFileRoute('/api/auth/login')({
+// GET /auth/netsuite/callback -- exchange the code, mint a session, hand the
+// bearer back to the SPA via the URL fragment (#nssid=...). The fragment
+// survives the HelloLeo preview iframe, where third-party cookies are dropped.
+export const Route = createFileRoute('/auth/netsuite/callback')({
   server: {
     handlers: {
-      POST: async ({ request }) => {
-        const parsed = bodySchema.safeParse(await request.json().catch(() => null))
-        if (!parsed.success) {
-          return Response.json({ error: 'Invalid email or password.' }, { status: 400 })
+      GET: async ({ request }) => {
+        const url = new URL(request.url)
+        const err = url.searchParams.get('error')
+        if (err) return new Response(\`NetSuite authorization failed: \${err}\`, { status: 400 })
+
+        const code = url.searchParams.get('code')
+        const state = url.searchParams.get('state')
+        if (!code || !state) return new Response('Missing code or state', { status: 400 })
+
+        const rows = await db
+          .select()
+          .from(netsuiteFlows)
+          .where(eq(netsuiteFlows.flowId, state))
+          .limit(1)
+        const flow = rows[0]
+        if (!flow) return new Response('Unknown or expired flow -- start again', { status: 400 })
+        // Single-use: burn the flow row immediately.
+        await db.delete(netsuiteFlows).where(eq(netsuiteFlows.flowId, state))
+        // Reject stale flows: the PKCE verifier must not stay valid indefinitely
+        // for an abandoned or leaked authorize URL (createdAt is unixepoch seconds).
+        const nowSec = Math.floor(Date.now() / 1000)
+        if (flow.createdAt && nowSec - flow.createdAt > 600) {
+          return new Response('Flow expired -- start again', { status: 400 })
         }
-        const email = parsed.data.email.toLowerCase()
 
-        const [user] = await db.select().from(users).where(eq(users.email, email)).limit(1)
-        if (!user || !(await verifyPassword(parsed.data.password, user.passwordHash))) {
-          return Response.json({ error: 'Invalid email or password.' }, { status: 401 })
+        const tok = await exchangeCode(request, code, flow.codeVerifier)
+        if (!tok.access_token) {
+          return new Response(
+            \`Token exchange failed: \${tok.error_description || tok.error || 'unknown error'}\`,
+            { status: 400 },
+          )
         }
 
-        const token = await signSession(user.id)
-        return Response.json(
-          { user: { id: user.id, email: user.email } },
-          { status: 200, headers: { 'Set-Cookie': sessionCookieHeader(token) } },
-        )
+        const sid = crypto.randomUUID()
+        const now = Math.floor(Date.now() / 1000)
+        await db.insert(netsuiteSessions).values({
+          sid,
+          accountId: requireConfig().accountId,
+          accessToken: tok.access_token,
+          refreshToken: tok.refresh_token ?? null,
+          expiresAt: now + (tok.expires_in || 3600),
+        })
+
+        const dest = new URL(flow.returnTo)
+        dest.hash = \`nssid=\${sid}\`
+        return new Response(null, { status: 302, headers: { Location: dest.toString() } })
       },
     },
   },
@@ -25587,13 +25858,15 @@ export const Route = createFileRoute('/api/auth/login')({
 }
 function logoutRouteTs() {
   return `import { createFileRoute } from '@tanstack/react-router'
-import { clearSessionCookieHeader } from '#/lib/auth'
+import { bearer, deleteSession } from '#/lib/netsuite-server'
 
-export const Route = createFileRoute('/api/auth/logout')({
+// POST /auth/netsuite/logout -- destroy the current session.
+export const Route = createFileRoute('/auth/netsuite/logout')({
   server: {
     handlers: {
-      POST: async () => {
-        return Response.json({ ok: true }, { headers: { 'Set-Cookie': clearSessionCookieHeader() } })
+      POST: async ({ request }) => {
+        await deleteSession(bearer(request))
+        return Response.json({ ok: true })
       },
     },
   },
@@ -25602,279 +25875,462 @@ export const Route = createFileRoute('/api/auth/logout')({
 }
 function meRouteTs() {
   return `import { createFileRoute } from '@tanstack/react-router'
-import { getUserFromRequest } from '#/lib/auth'
+import { bearer, getSession } from '#/lib/netsuite-server'
 
-export const Route = createFileRoute('/api/auth/me')({
+// GET /api/me -- resolve the bearer sid to a session. The ONLY authoritative
+// auth check; the client must never trust sessionStorage on its own.
+export const Route = createFileRoute('/api/me')({
   server: {
     handlers: {
       GET: async ({ request }) => {
-        const user = await getUserFromRequest(request)
-        return Response.json({ user })
+        const session = await getSession(bearer(request))
+        if (!session) return Response.json({ authenticated: false })
+        return Response.json({
+          authenticated: true,
+          account_id: session.accountId,
+        })
       },
     },
   },
 })
 `;
 }
-function sessionClientTs() {
+function configRouteTs() {
+  return `import { createFileRoute } from '@tanstack/react-router'
+import { env as runtimeEnv } from '@helloleo/runtime'
+import { appOrigin, redirectUri } from '#/lib/netsuite-server'
+
+// GET /auth/netsuite/config -- single source of truth for the redirect URI.
+// Whatever this returns is EXACTLY what /auth/netsuite/start sends NetSuite, so
+// show the user THIS value to register on their Integration Record. Never
+// hardcode or guess a callback URL.
+export const Route = createFileRoute('/auth/netsuite/config')({
+  server: {
+    handlers: {
+      GET: async ({ request }) => {
+        const e = runtimeEnv as unknown as {
+          NETSUITE_ACCOUNT_ID?: string
+          NETSUITE_CLIENT_ID?: string
+        }
+        return Response.json({
+          redirect_uri: redirectUri(request),
+          origin: appOrigin(request),
+          configured: Boolean(e.NETSUITE_ACCOUNT_ID && e.NETSUITE_CLIENT_ID),
+        })
+      },
+    },
+  },
+})
+`;
+}
+function netsuiteClientTs() {
   return `/*
- * Client-side session helpers. getUser() is the getUser() referenced by the
- * "Authenticated routes" pattern in src/routes/README.md -- wire it into
- * __root.tsx's beforeLoad (see that file's manual step below).
+ * NetSuite auth -- client (same-origin). The OAuth backend is THIS app's own
+ * server routes (src/routes/auth/netsuite/* + src/routes/api/me.ts), so every
+ * call is relative -- no separate Worker, no VITE_WORKER_URL.
+ *
+ * The browser only ever holds an opaque session id (sid), handed back in the
+ * callback's URL fragment (#nssid=...) so it survives the HelloLeo preview
+ * iframe (third-party cookies are partitioned/dropped there). The sid rides as
+ * Authorization: Bearer on every call; NetSuite tokens stay server-side. The
+ * only authoritative auth check is GET /api/me.
+ *
+ * NEVER use a password gate. NEVER trust sessionStorage as the auth state --
+ * it's just a cache of the bearer.
  */
+const TOKEN_KEY = 'nssid'
+
+// Capture-and-strip #nssid=... as early as possible so URLs stay clean.
+;(function bootstrapTokenFromHash() {
+  if (typeof window === 'undefined') return
+  const hash = window.location.hash.replace(/^#/, '')
+  if (!hash) return
+  const params = new URLSearchParams(hash)
+  const sid = params.get(TOKEN_KEY)
+  if (sid) {
+    try {
+      sessionStorage.setItem(TOKEN_KEY, sid)
+    } catch {}
+    params.delete(TOKEN_KEY)
+    const rest = params.toString()
+    window.history.replaceState(
+      null,
+      '',
+      window.location.pathname + window.location.search + (rest ? '#' + rest : ''),
+    )
+  }
+})()
 
-export interface SessionUser {
-  id: number
-  email: string
+export function getSessionToken(): string | null {
+  try {
+    return sessionStorage.getItem(TOKEN_KEY)
+  } catch {
+    return null
+  }
 }
 
-export async function getUser(): Promise<SessionUser | null> {
-  if (typeof window === 'undefined') return null
-  const res = await fetch('/api/auth/me')
-  if (!res.ok) return null
-  const data = (await res.json()) as { user: SessionUser | null }
-  return data.user
+export function signInWithNetSuite(returnTo: string = window.location.href) {
+  const url = new URL('/auth/netsuite/start', window.location.origin)
+  url.searchParams.set('return_to', returnTo)
+  // The app renders inside the HelloLeo preview iframe; /start 302s to
+  // NetSuite, whose OAuth page sends X-Frame-Options: DENY. Navigate the TOP
+  // frame so the flow runs at top level and the callback lands there to read
+  // #nssid=. Assign .href (NOT .assign(): reading .assign off a cross-origin
+  // window.top.location throws, dropping us into the iframe fallback ->
+  // "refused to connect").
+  try {
+    if (window.top && window.top !== window) {
+      window.top.location.href = url.toString()
+      return
+    }
+  } catch {
+    /* top window unreachable -- fall through to same-frame navigation */
+  }
+  window.location.href = url.toString()
 }
 
-export async function login(email: string, password: string): Promise<{ user: SessionUser } | { error: string }> {
-  const res = await fetch('/api/auth/login', {
-    method: 'POST',
-    headers: { 'Content-Type': 'application/json' },
-    body: JSON.stringify({ email, password }),
-  })
+export interface NetSuiteSession {
+  authenticated: boolean
+  account_id?: string
+}
+
+export async function getNetSuiteSession(): Promise<NetSuiteSession> {
+  const sid = getSessionToken()
+  if (!sid) return { authenticated: false }
+  const res = await fetch('/api/me', { headers: { Authorization: 'Bearer ' + sid } })
+  if (!res.ok) return { authenticated: false }
   const data = await res.json()
-  return res.ok ? { user: data.user } : { error: data.error ?? 'Something went wrong.' }
+  return { authenticated: Boolean(data?.authenticated), ...data }
+}
+
+export async function signOutNetSuite(): Promise<void> {
+  const sid = getSessionToken()
+  if (sid) {
+    try {
+      await fetch('/auth/netsuite/logout', {
+        method: 'POST',
+        headers: { Authorization: 'Bearer ' + sid },
+      })
+    } catch {}
+  }
+  try {
+    sessionStorage.removeItem(TOKEN_KEY)
+  } catch {}
+  window.location.reload()
 }
 
-export async function signup(email: string, password: string): Promise<{ user: SessionUser } | { error: string }> {
-  const res = await fetch('/api/auth/signup', {
-    method: 'POST',
-    headers: { 'Content-Type': 'application/json' },
-    body: JSON.stringify({ email, password }),
-  })
-  const data = await res.json()
-  return res.ok ? { user: data.user } : { error: data.error ?? 'Something went wrong.' }
+/**
+ * Fetch YOUR data routes (src/routes/api/*) with the bearer attached. Use this
+ * instead of bare fetch for authenticated calls.
+ */
+export async function apiFetch(path: string, init: RequestInit = {}): Promise<Response> {
+  const sid = getSessionToken()
+  const headers = new Headers(init.headers)
+  if (sid) headers.set('Authorization', 'Bearer ' + sid)
+  return fetch(path, { ...init, headers })
 }
 
-export async function logout(): Promise<void> {
-  await fetch('/api/auth/logout', { method: 'POST' })
+/**
+ * The exact redirect URI this app will send NetSuite, read from the server so
+ * it can never drift from what /auth/netsuite/start actually uses. Show it to
+ * whoever registers the Integration Record; never hardcode a callback URL.
+ */
+export async function getNetSuiteRedirectUri(): Promise<string | null> {
+  try {
+    const res = await fetch('/auth/netsuite/config')
+    if (!res.ok) return null
+    const data = await res.json()
+    return data?.redirect_uri ?? null
+  } catch {
+    return null
+  }
 }
 `;
 }
-function authedLayoutTsx() {
-  return `import { createFileRoute, redirect } from '@tanstack/react-router'
+function authTsx() {
+  return `import * as React from 'react'
+import {
+  getNetSuiteSession,
+  signInWithNetSuite,
+  signOutNetSuite,
+  type NetSuiteSession,
+} from './netsuite'
 
-// Pathless guard -- no URL segment of its own. Put protected pages under
-// src/routes/_authed/ (e.g. _authed/dashboard.tsx -> /dashboard) and they
-// inherit this beforeLoad. See src/routes/README.md, "Authenticated routes".
-export const Route = createFileRoute('/_authed')({
-  beforeLoad: ({ context }) => {
-    if (!context.user) {
-      throw redirect({ to: '/login' })
-    }
-  },
-})
-`;
+/**
+ * NetSuite auth context. Holds the session (resolved client-side from /api/me
+ * via getNetSuiteSession) and exposes sign-in / sign-out. /api/me is the only
+ * authoritative check -- never trust sessionStorage directly.
+ */
+export interface NetSuiteAuthContextValue {
+  pending: boolean
+  isAuthenticated: boolean
+  session: NetSuiteSession | null
+  signIn: () => void
+  signOut: () => Promise<void>
+  refresh: () => Promise<void>
 }
-function loginPageTsx() {
-  return `import { createFileRoute, Link, redirect, useRouter } from '@tanstack/react-router'
-import { useState } from 'react'
-import { login } from '#/lib/session-client'
-import { Button } from '#/components/ui/button'
-import { Input } from '#/components/ui/input'
-import { Label } from '#/components/ui/label'
-import { Card, CardContent, CardHeader, CardTitle } from '#/components/ui/card'
 
-export const Route = createFileRoute('/login')({
-  beforeLoad: ({ context }) => {
-    if (context.user) throw redirect({ to: '/' })
-  },
-  component: LoginPage,
-})
+const NetSuiteAuthContext = React.createContext<NetSuiteAuthContextValue | null>(null)
 
-function LoginPage() {
-  const router = useRouter()
-  const [email, setEmail] = useState('')
-  const [password, setPassword] = useState('')
-  const [error, setError] = useState('')
-  const [loading, setLoading] = useState(false)
+export function NetSuiteAuthProvider({ children }: { children: React.ReactNode }) {
+  const [session, setSession] = React.useState<NetSuiteSession | null>(null)
+  // Start pending on BOTH server and client render so SSR and first paint match
+  // (a spinner), avoiding a hydration mismatch. The effect (client-only)
+  // resolves it.
+  const [pending, setPending] = React.useState(true)
 
-  async function handleSubmit(e: React.FormEvent) {
-    e.preventDefault()
-    setError('')
-    setLoading(true)
-    const result = await login(email, password)
-    setLoading(false)
-    if ('error' in result) {
-      setError(result.error)
-      return
+  const refresh = React.useCallback(async () => {
+    setPending(true)
+    try {
+      setSession(await getNetSuiteSession())
+    } finally {
+      setPending(false)
     }
-    await router.invalidate()
-    router.navigate({ to: '/' })
+  }, [])
+
+  React.useEffect(() => {
+    refresh()
+  }, [refresh])
+
+  const value: NetSuiteAuthContextValue = {
+    pending,
+    isAuthenticated: Boolean(session?.authenticated),
+    session,
+    signIn: () => signInWithNetSuite(),
+    signOut: signOutNetSuite,
+    refresh,
   }
 
-  return (
-    <div className="min-h-screen flex items-center justify-center bg-background p-4">
-      <Card className="w-full max-w-sm">
-        <CardHeader>
-          <CardTitle>Log in</CardTitle>
-        </CardHeader>
-        <CardContent>
-          <form onSubmit={handleSubmit} className="space-y-4">
-            <div className="space-y-2">
-              <Label htmlFor="email">Email</Label>
-              <Input id="email" type="email" value={email} onChange={e => setEmail(e.target.value)} required autoComplete="email" />
-            </div>
-            <div className="space-y-2">
-              <Label htmlFor="password">Password</Label>
-              <Input id="password" type="password" value={password} onChange={e => setPassword(e.target.value)} required autoComplete="current-password" />
-            </div>
-            {error && <p className="text-sm text-destructive">{error}</p>}
-            <Button type="submit" className="w-full" disabled={loading}>
-              {loading ? 'Logging in\u2026' : 'Log in'}
-            </Button>
-            <p className="text-sm text-center text-muted-foreground">
-              No account? <Link to="/signup" className="underline">Sign up</Link>
-            </p>
-          </form>
-        </CardContent>
-      </Card>
-    </div>
-  )
+  return <NetSuiteAuthContext.Provider value={value}>{children}</NetSuiteAuthContext.Provider>
+}
+
+export function useNetSuiteAuth(): NetSuiteAuthContextValue {
+  const ctx = React.useContext(NetSuiteAuthContext)
+  if (!ctx) {
+    throw new Error('useNetSuiteAuth must be used within <NetSuiteAuthProvider>')
+  }
+  return ctx
 }
 `;
 }
-function signupPageTsx() {
-  return `import { createFileRoute, Link, redirect, useRouter } from '@tanstack/react-router'
-import { useState } from 'react'
-import { signup } from '#/lib/session-client'
-import { Button } from '#/components/ui/button'
-import { Input } from '#/components/ui/input'
-import { Label } from '#/components/ui/label'
-import { Card, CardContent, CardHeader, CardTitle } from '#/components/ui/card'
+function authLayoutTsx() {
+  return `import type { ReactNode } from 'react'
+import { NetSuiteAuthProvider, useNetSuiteAuth } from '../../lib/auth'
+import { LoginPage } from './LoginPage'
 
-export const Route = createFileRoute('/signup')({
-  beforeLoad: ({ context }) => {
-    if (context.user) throw redirect({ to: '/' })
-  },
-  component: SignupPage,
-})
+/**
+ * NetSuite auth layout. The ONE manual wiring step: wrap the root route's
+ * <Outlet /> with it in src/routes/__root.tsx:
+ *
+ *   import { AuthLayout } from '../components/auth/AuthLayout'
+ *   ...
+ *   function RootComponent() {
+ *     return (
+ *       <RootDocument>
+ *         <AuthLayout>
+ *           <Outlet />
+ *         </AuthLayout>
+ *       </RootDocument>
+ *     )
+ *   }
+ *
+ * It provides auth context and gates rendering: a spinner while the session
+ * resolves, <LoginPage /> for signed-out users, your routes once signed in.
+ * NEVER swap this for a password gate -- real OAuth is the only login.
+ */
+export function AuthLayout({ children }: { children: ReactNode }) {
+  return (
+    <NetSuiteAuthProvider>
+      <Gate>{children}</Gate>
+    </NetSuiteAuthProvider>
+  )
+}
 
-function SignupPage() {
-  const router = useRouter()
-  const [email, setEmail] = useState('')
-  const [password, setPassword] = useState('')
-  const [error, setError] = useState('')
-  const [loading, setLoading] = useState(false)
+function Gate({ children }: { children: ReactNode }) {
+  const { pending, isAuthenticated } = useNetSuiteAuth()
 
-  async function handleSubmit(e: React.FormEvent) {
-    e.preventDefault()
-    setError('')
-    setLoading(true)
-    const result = await signup(email, password)
-    setLoading(false)
-    if ('error' in result) {
-      setError(result.error)
-      return
-    }
-    await router.invalidate()
-    router.navigate({ to: '/' })
+  if (pending) {
+    return (
+      <div className="min-h-screen flex items-center justify-center bg-background">
+        <div className="h-8 w-8 rounded-full border-2 border-primary border-t-transparent animate-spin" />
+      </div>
+    )
   }
 
+  if (!isAuthenticated) return <LoginPage />
+
+  return <>{children}</>
+}
+`;
+}
+function loginPageTsx2() {
+  return `import { SignInWithNetSuite } from './SignInWithNetSuite'
+
+/**
+ * Default unauthenticated landing page. Replaces any password gate. Customise
+ * the copy / imagery freely but keep <SignInWithNetSuite /> as the only
+ * call-to-action -- it points to /auth/netsuite/start.
+ */
+export function LoginPage() {
   return (
-    <div className="min-h-screen flex items-center justify-center bg-background p-4">
-      <Card className="w-full max-w-sm">
-        <CardHeader>
-          <CardTitle>Sign up</CardTitle>
-        </CardHeader>
-        <CardContent>
-          <form onSubmit={handleSubmit} className="space-y-4">
-            <div className="space-y-2">
-              <Label htmlFor="email">Email</Label>
-              <Input id="email" type="email" value={email} onChange={e => setEmail(e.target.value)} required autoComplete="email" />
-            </div>
-            <div className="space-y-2">
-              <Label htmlFor="password">Password</Label>
-              <Input id="password" type="password" value={password} onChange={e => setPassword(e.target.value)} required autoComplete="new-password" minLength={8} />
-            </div>
-            {error && <p className="text-sm text-destructive">{error}</p>}
-            <Button type="submit" className="w-full" disabled={loading}>
-              {loading ? 'Signing up\u2026' : 'Sign up'}
-            </Button>
-            <p className="text-sm text-center text-muted-foreground">
-              Already have an account? <Link to="/login" className="underline">Log in</Link>
+    <div className="min-h-screen bg-background text-foreground flex">
+      <div className="hidden lg:flex lg:w-1/2 bg-primary text-primary-foreground p-12 flex-col justify-between">
+        <div className="text-xl font-semibold">NetSuite App</div>
+        <div>
+          <h1 className="text-4xl font-bold leading-tight">Connect your NetSuite account</h1>
+          <p className="mt-4 text-primary-foreground/80 max-w-md">
+            Sign in with your NetSuite credentials to access your data securely. Tokens stay
+            server-side -- they never reach the browser.
+          </p>
+        </div>
+        <div className="text-xs text-primary-foreground/60">Powered by HelloLeo</div>
+      </div>
+      <div className="flex-1 flex items-center justify-center px-6 py-12">
+        <div className="w-full max-w-sm space-y-6">
+          <div>
+            <h2 className="text-2xl font-semibold">Welcome</h2>
+            <p className="mt-2 text-sm text-muted-foreground">
+              Use the button below to sign in. You'll be redirected to NetSuite to authorise
+              access, then back here.
             </p>
-          </form>
-        </CardContent>
-      </Card>
+          </div>
+          <SignInWithNetSuite />
+        </div>
+      </div>
     </div>
   )
 }
 `;
 }
-async function appendUsersTable(dir) {
-  const schemaPath = path5.join(dir, "src", "db", "schema.ts");
-  const current = await readFile(schemaPath, "utf8").catch(() => null);
-  if (current === null) {
-    throw new Error(`src/db/schema.ts not found -- run scaffold first.`);
-  }
-  if (current.includes(SCHEMA_MARKER))
-    return false;
-  await Bun.write(schemaPath, `${current.trimEnd()}
-${usersTableBlock()}`);
-  return true;
+function signInButtonTsx() {
+  return `import { signInWithNetSuite } from '../../lib/netsuite'
+
+export function SignInWithNetSuite() {
+  return (
+    <button
+      onClick={() => signInWithNetSuite()}
+      className="inline-flex items-center justify-center gap-2 rounded-md bg-primary px-4 py-2 text-sm font-medium text-primary-foreground shadow hover:bg-primary/90 focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-ring"
+    >
+      Sign in with NetSuite
+    </button>
+  )
 }
-var setupPasswordAuth = tool({
-  description: "Add email/password auth to an existing project. Call scaffold first, " + "then this. Writes a users table, stateless-JWT session helpers, and " + "signup/login/logout/me API routes.",
+`;
+}
+var setupNetsuite = tool({
+  description: "Add NetSuite runtime OAuth (end-user LOGIN) to a TanStack Start project. " + "Call scaffold first, then this. This login uses NetSuite Integration " + "Record #2 (scope: rest_webservices) -- a SEPARATE record from the MCP one " + "(scope: mcp) that was used only to BUILD the app; do not confuse them. " + "Emits server routes (the OAuth backend lives IN the app -- no separate " + "Worker, no VITE_WORKER_URL), the netsuite_flows + netsuite_sessions " + "drizzle tables, and the same-origin client + auth components. Config " + "(NETSUITE_ACCOUNT_ID/_CLIENT_ID/_CLIENT_SECRET) comes from the project " + ".env in dev and HelloLeo Cloud secrets in prod -- same var names, never " + "in code. Real OAuth from day one -- never replace <AuthLayout> with a " + "password placeholder. Setup guide (link the user to it): " + "https://docs.helloleo.dev/integrations/netsuite",
   args: {},
   async execute(_args, context) {
     const dir = context.directory;
-    await Promise.all([
-      Bun.write(path5.join(dir, "src", "lib", "auth.ts"), authLibTs()),
-      Bun.write(path5.join(dir, "src", "lib", "session-client.ts"), sessionClientTs()),
-      Bun.write(path5.join(dir, "src", "routes", "api", "auth", "signup.ts"), signupRouteTs()),
-      Bun.write(path5.join(dir, "src", "routes", "api", "auth", "login.ts"), loginRouteTs()),
-      Bun.write(path5.join(dir, "src", "routes", "api", "auth", "logout.ts"), logoutRouteTs()),
-      Bun.write(path5.join(dir, "src", "routes", "api", "auth", "me.ts"), meRouteTs()),
-      Bun.write(path5.join(dir, "src", "routes", "_authed.tsx"), authedLayoutTsx()),
-      Bun.write(path5.join(dir, "src", "routes", "login.tsx"), loginPageTsx()),
-      Bun.write(path5.join(dir, "src", "routes", "signup.tsx"), signupPageTsx())
-    ]);
-    const schemaAppended = await appendUsersTable(dir);
+    await mkdir2(path7.join(dir, "src", "lib"), { recursive: true });
+    await mkdir2(path7.join(dir, "src", "components", "auth"), {
+      recursive: true
+    });
+    await mkdir2(path7.join(dir, "src", "routes", "auth", "netsuite"), {
+      recursive: true
+    });
+    await mkdir2(path7.join(dir, "src", "routes", "api"), { recursive: true });
+    const schemaPath = path7.join(dir, "src", "db", "schema.ts");
+    let schemaAppended = false;
+    try {
+      const current = await readFile3(schemaPath, "utf8");
+      if (!current.includes("netsuite_flows")) {
+        await Bun.write(schemaPath, current + schemaAppend());
+        schemaAppended = true;
+      }
+    } catch {
+      await Bun.write(schemaPath, `import { sql } from 'drizzle-orm'
+import { integer, sqliteTable, text } from 'drizzle-orm/sqlite-core'
+${schemaAppend()}`);
+      schemaAppended = true;
+    }
+    const files = [
+      [path7.join("src", "lib", "netsuite-server.ts"), netsuiteServerTs()],
+      [
+        path7.join("src", "routes", "auth", "netsuite", "start.ts"),
+        startRouteTs()
+      ],
+      [
+        path7.join("src", "routes", "auth", "netsuite", "callback.ts"),
+        callbackRouteTs()
+      ],
+      [
+        path7.join("src", "routes", "auth", "netsuite", "logout.ts"),
+        logoutRouteTs()
+      ],
+      [
+        path7.join("src", "routes", "auth", "netsuite", "config.ts"),
+        configRouteTs()
+      ],
+      [path7.join("src", "routes", "api", "me.ts"), meRouteTs()],
+      [path7.join("src", "lib", "netsuite.ts"), netsuiteClientTs()],
+      [path7.join("src", "lib", "auth.tsx"), authTsx()],
+      [
+        path7.join("src", "components", "auth", "AuthLayout.tsx"),
+        authLayoutTsx()
+      ],
+      [path7.join("src", "components", "auth", "LoginPage.tsx"), loginPageTsx2()],
+      [
+        path7.join("src", "components", "auth", "SignInWithNetSuite.tsx"),
+        signInButtonTsx()
+      ]
+    ];
+    for (const [filePath, content] of files) {
+      await Bun.write(path7.join(dir, filePath), content);
+    }
     return [
-      "Wrote password auth (users table, JWT session, API routes):",
-      `  - src/db/schema.ts ${schemaAppended ? "(appended `users` table)" : "(already had a `users` table, left as-is)"}`,
-      "  - src/lib/auth.ts (hashing, JWT sign/verify, getUserFromRequest -- server-only, never import from a client route)",
-      "  - src/lib/session-client.ts (getUser, login, signup, logout -- client fetch helpers)",
-      "  - src/routes/api/auth/{signup,login,logout,me}.ts (server routes -- never createServerFn)",
-      "  - src/routes/_authed.tsx (pathless guard for protected routes)",
-      "  - src/routes/login.tsx, src/routes/signup.tsx",
+      `Wrote ${files.length} NetSuite files${schemaAppended ? " + appended src/db/schema.ts" : ""}:`,
+      "DOCS -- the authoritative setup guide is https://docs.helloleo.dev/integrations/netsuite . When you tell the user what to do in NetSuite, follow and link these steps verbatim; do not invent steps.",
+      "  - Record #2 (runtime): https://docs.helloleo.dev/integrations/netsuite#step-4-%E2%80%94-create-integration-record-2-runtime",
+      "  - Send runtime creds to Leo: https://docs.helloleo.dev/integrations/netsuite#step-5-%E2%80%94-send-the-runtime-credentials-to-leo",
+      "",
+      "  server (OAuth backend lives in the app -- no separate Worker):",
+      "  - src/lib/netsuite-server.ts (env, PKCE, token exchange, session refresh, netsuiteFetch)",
+      "  - src/routes/auth/netsuite/start.ts    GET  begin PKCE flow",
+      "  - src/routes/auth/netsuite/callback.ts GET  code -> tokens -> session",
+      "  - src/routes/auth/netsuite/logout.ts   POST destroy session",
+      "  - src/routes/auth/netsuite/config.ts   GET  the exact redirect URI to register",
+      "  - src/routes/api/me.ts                 GET  bearer -> session (auth check)",
+      "  - src/db/schema.ts += netsuite_flows + netsuite_sessions",
+      "  client:",
+      "  - src/lib/netsuite.ts (same-origin: signIn, session, apiFetch)",
+      "  - src/lib/auth.tsx (NetSuiteAuthProvider + useNetSuiteAuth)",
+      "  - src/components/auth/{AuthLayout,LoginPage,SignInWithNetSuite}.tsx",
       "",
-      "Session is a stateless HMAC-signed JWT in an httpOnly cookie (no localStorage, no server-side session store).",
+      "WIRE IT UP (one manual step): in src/routes/__root.tsx, wrap <Outlet /> with <AuthLayout>:",
+      "",
+      "    import { AuthLayout } from '../components/auth/AuthLayout'",
       "",
-      "Required: set AUTH_JWT_SECRET or every request 500s.",
-      "  - dev: add `AUTH_JWT_SECRET=<value>` to .env",
-      "  - prod: `wrangler secret put AUTH_JWT_SECRET`.",
+      "    <AuthLayout>",
+      "      <Outlet />",
+      "    </AuthLayout>",
       "",
-      "Next (manual, one edit): in src/routes/__root.tsx, load the user into router context, per src/routes/README.md's Authenticated routes section:",
+      "Then:",
+      "- Build your dashboard inside <AuthLayout>. Read the session with useNetSuiteAuth().",
+      "- Data routes: add src/routes/api/*.ts and call netsuiteFetch(bearer(request), '/services/rest/query/v1/suiteql', {...}) from the handler.",
       "",
-      "    import { getUser } from '#/lib/session-client'",
-      "    // in createRootRouteWithContext(...)({ ... }):",
-      "    beforeLoad: async () => ({ user: await getUser() }),",
+      "TWO INTEGRATION RECORDS -- do not confuse them:",
+      "- Record #1 (scope: mcp): already connected, used ONLY to build the app (schema discovery). This login does NOT use it.",
+      "- Record #2 (scope: rest_webservices): THIS login uses it -- the end user signs into NetSuite through it, and the redirect URI is registered on THIS record. If it doesn't exist yet, tell the user to create it (a second Integration Record, scope rest_webservices only).",
       "",
-      "Then put protected pages under src/routes/_authed/ (e.g. _authed/dashboard.tsx -> /dashboard); they inherit the guard."
+      "CONFIG -- NETSUITE_ACCOUNT_ID, NETSUITE_CLIENT_ID, NETSUITE_CLIENT_SECRET (secret optional for PKCE public clients). Never hardcode; never put in code. Same var names in every environment, different SOURCE:",
+      "- DEV (Fly preview): read from the project .env. HelloLeo writes them there (the setup wizard, or the env tooling). In dev the app uses .env -- do NOT tell the user to use HelloLeo Cloud here.",
+      "- PROD (published Worker): the SAME names live as HelloLeo Cloud secrets; the publish step promotes them from .env onto the Worker automatically. Same code path (@helloleo/runtime env), just a different source per environment.",
+      "- PUBLIC_APP_URL / HELLOLEO_URL are set by the platform per environment; don't hardcode them.",
+      "- REDIRECT URI -- never guess or hardcode it. It is derived server-side and auto-corrects behind the preview proxy. Read the exact value from GET /auth/netsuite/config (or getNetSuiteRedirectUri() on the client) and tell the user to register THAT on Integration Record #2 (scope: rest_webservices). Register both the preview and published URLs -- NetSuite allows multiple redirect URIs.",
+      "- Never replace <AuthLayout> with a password gate. Real OAuth is the only supported login."
     ].join(`
 `);
   }
 });
-var SetupPasswordAuthPlugin = async () => {
+var SetupNetsuitePlugin = async () => {
   return {
-    tool: { setup_password_auth: setupPasswordAuth }
+    tool: { setup_netsuite: setupNetsuite }
   };
 };
 export {
-  SetupPasswordAuthPlugin,
   SetupNetsuitePlugin,
+  SetupAuthenticationPlugin,
   ScaffoldPlugin,
   RemovePlugin,
   InspectHttpPlugin