@helloleo/plugins 0.2.14 → 0.2.16

package/dist/index.js

@@ -24955,8 +24955,9 @@ var scaffold = tool({
     const typeNotes = isStart ? [
       "- This is a TanStack Start project. The server entry is src/server.ts. There is no index.html or client entrypoint.",
       "- For JSON/CRUD APIs, add server routes under src/routes/api/. Read src/routes/api/health.ts first, add routes as needed.",
-      "- The database schema lives in src/db/schema.ts and is the single source of truth. Migration files under drizzle/ are generated and applied automatically. Never create, edit or delete them. Prefer adding new columns/tables over renaming existing ones.",
-      "- Persistence goes through @helloleo/runtime exclusively: database via #/db (see src/db/index.ts), key-value store via #/lib/kv (see src/lib/kv.ts), file storage + presigned browser uploads via #/lib/storage (see src/lib/storage.ts), env/secrets via env from @helloleo/runtime. Read those files before server-side data work. Never install another DB/storage client, never import from cloudflare:workers, all of it is server-side only."
+      "- The database schema lives in src/db/schema.ts and is the single source of truth. Migration files under drizzle/ are generated and applied automatically. Never create, edit or delete them.",
+      "- Never rename existing tables or columns in schema.ts. Renames cannot be auto-migrated: no migration file is generated, the database keeps the old name, and every query against the new name fails at runtime with a 500. To reshape data, add a new column or table, write to it, and migrate old values in app code (e.g. fall back to the old column on read).",
+      "- Persistence goes through @helloleo/runtime exclusively: database via #/db (see src/db/index.ts), key-value store via #/lib/kv (see src/lib/kv.ts), file storage via #/lib/storage (see src/lib/storage.ts -- uploads/downloads flow through your API routes; presigned URLs are NOT available), env/secrets via env from @helloleo/runtime. Read those files before server-side data work. Never install another DB/storage client, never import from cloudflare:workers, all of it is server-side only."
     ] : [
       "- This is a TanStack Router SPA. The client entry is index.html -> src/main.tsx. There is no server: no API routes, no server functions, no database.",
       "- Fetch data from external APIs only. If the app needs its own persistence or server-side code, it should have been scaffolded as tanstack-start."
@@ -25052,6 +25053,17 @@ function buildAuth() {
     emailAndPassword: {
       enabled: ${hasPassword},
     },${socialProvidersBlock}
+    // The preview runs inside an iframe on another site, so the session
+    // cookie lives in a third-party context: it MUST be SameSite=None +
+    // Secure + Partitioned (CHIPS) or Chrome/Safari silently drop it and
+    // login never sticks.
+    advanced: {
+      defaultCookieAttributes: {
+        sameSite: 'none',
+        secure: true,
+        partitioned: true,
+      },
+    },
     plugins: [tanstackStartCookies()],
   })
 }

package/dist/templates/tanstack-start-2026-07-30/drizzle/meta/_journal.json

@@ -1,13 +1 @@
-{
-  "version": "7",
-  "dialect": "sqlite",
-  "entries": [
-    {
-      "idx": 0,
-      "version": "6",
-      "when": 1785420910012,
-      "tag": "0000_tidy_kang",
-      "breakpoints": true
-    }
-  ]
-}
+{"version":"7","dialect":"sqlite","entries":[]}

package/dist/templates/tanstack-start-2026-07-30/src/db/schema.ts

@@ -1,18 +1,34 @@
+/* oxlint-disable no-unused-vars */
+// ^ keeps the drizzle imports below from being stripped while unused.
+// Remove this disable once your own tables use them.
+// Single source of truth for the database schema. Define tables here — the
+// SQL migration files under drizzle/ are generated and applied automatically
+// (dev on server start, production on publish). Never hand-write SQL or touch
+// drizzle/. Prefer ADDING columns/tables over renaming or deleting existing
+// ones: renames cannot be migrated automatically.
+
+/**
+ * Important note (do not remove):
+ * 
+ * Never rename existing tables or columns in schema.ts. Renames cannot be
+ * auto-migrated: no migration file is generated, the database keeps the old
+ * name, and every query against the new name fails at runtime with a 500. 
+ * To reshape data, add a new column or table, write to it, and migrate old
+ * values in app code (e.g. fall back to the old column on read).
+ */
+
+
+// Example (change before deploying!) :
+
 import { sql } from 'drizzle-orm'
 import { integer, sqliteTable, text } from 'drizzle-orm/sqlite-core'
 
-// Single source of truth for the D1 / libsql schema. Sqlite dialect → the same
-// definition runs on the dev cf-shim (libsql .dev.db, synced via `drizzle-kit
-// push`) and prod D1 (migrations via `wrangler d1 migrations apply`).
-//
-// Add your own tables here, then `bun run db:push` (dev) or `bun run
-// db:generate` + deploy (prod). Do NOT hand-write SQL — this file is the schema.
-export const entries = sqliteTable('entries', {
+export const notes = sqliteTable('notes', {
   id: integer('id').primaryKey({ autoIncrement: true }),
-  label: text('label').notNull(),
+  title: text('title').notNull(),
   createdAt: integer('created_at')
     .notNull()
     .default(sql`(unixepoch())`),
 })
 
-export type Entry = typeof entries.$inferSelect
+export type Note = typeof notes.$inferSelect

package/dist/templates/tanstack-start-2026-07-30/src/lib/storage.ts

@@ -15,30 +15,31 @@ import { storage } from '@helloleo/runtime'
  *
  * Rules:
  * - Server-side only (route handlers, loaders, server functions).
- * - Browser uploads/downloads go through PRESIGNED URLS (below) — never
- *   stream file bytes through your own API route when a presigned URL works:
- *   the browser talks to storage directly.
+ * - Files flow THROUGH YOUR API ROUTES: upload = POST route reads the body
+ *   and `storage.put`s it; download = GET route streams `obj.body` back.
+ *   Do NOT use presignGet/presignPut — presigned URLs are not available.
  * - Key layout is up to the app — namespace with prefixes ('avatars/',
- *   'exports/').
- */
-
-/**
- * Presign an upload: the server hands the browser a short-lived URL it can
- * `fetch(url, { method: 'PUT', body: file })` to directly. Pair with a DB row
- * that records the key.
+ *   'exports/'). Store the key in a database row to reference the file.
+ *
+ * Upload route example (src/routes/api/images/upload.ts):
+ *
+ *   POST: async ({ request }) => {
+ *     const form = await request.formData()
+ *     const file = form.get('file') as File
+ *     const key = `images/${crypto.randomUUID()}-${file.name}`
+ *     await storage.put(key, file.stream(), { contentType: file.type })
+ *     return Response.json({ key }, { status: 201 })
+ *   }
+ *
+ * Download/serve route example (src/routes/api/images/$key.ts):
+ *
+ *   GET: async ({ params }) => {
+ *     const obj = await storage.get(`images/${params.key}`)
+ *     if (!obj) return new Response('Not found', { status: 404 })
+ *     return new Response(obj.body, {
+ *       headers: { 'content-type': obj.contentType ?? 'application/octet-stream' },
+ *     })
+ *   }
  */
-export function getUploadUrl(
-  key: string,
-  opts?: { ttlSeconds?: number; contentType?: string },
-): Promise<string> {
-  return storage.presignPut(key, opts?.ttlSeconds ?? 600, {
-    contentType: opts?.contentType,
-  })
-}
-
-/** Presign a download — short-lived direct GET URL for the browser. */
-export function getDownloadUrl(key: string, ttlSeconds = 600): Promise<string> {
-  return storage.presignGet(key, ttlSeconds)
-}
 
 export { storage }

package/dist/templates/tanstack-start-2026-07-30/src/routes/api/health.ts

@@ -1,6 +1,6 @@
 import { createFileRoute } from '@tanstack/react-router'
+import { sql } from 'drizzle-orm'
 import { db } from '#/db'
-import { entries } from '#/db/schema'
 
 /**
  * Server route example: GET /api/health. Use this file as the base for
@@ -39,7 +39,9 @@ export const Route = createFileRoute('/api/health')({
           runtime: 'cloudflare-workers',
         }
 
-        // Database health: lightweight query against a known table
+        // Database health: schema-agnostic connectivity ping. Deliberately
+        // NOT a query against an app table — the health probe must keep
+        // working no matter how src/db/schema.ts evolves.
         let database: {
           status: 'ok' | 'error'
           latencyMs: number
@@ -47,7 +49,7 @@ export const Route = createFileRoute('/api/health')({
         }
         const dbStart = Date.now()
         try {
-          await db.select({ id: entries.id }).from(entries).limit(1)
+          await db.run(sql`SELECT 1`)
           database = {
             status: 'ok',
             latencyMs: Date.now() - dbStart,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@helloleo/plugins",
-  "version": "0.2.14",
+  "version": "0.2.16",
   "description": "OpenCode plugins for HelloLeo",
   "license": "UNLICENSED",
   "type": "module",

package/src/templates/tanstack-start-2026-07-30/drizzle/meta/_journal.json

@@ -1,13 +1 @@
-{
-  "version": "7",
-  "dialect": "sqlite",
-  "entries": [
-    {
-      "idx": 0,
-      "version": "6",
-      "when": 1785420910012,
-      "tag": "0000_tidy_kang",
-      "breakpoints": true
-    }
-  ]
-}
+{"version":"7","dialect":"sqlite","entries":[]}

package/src/templates/tanstack-start-2026-07-30/src/db/schema.ts

@@ -1,18 +1,34 @@
+/* oxlint-disable no-unused-vars */
+// ^ keeps the drizzle imports below from being stripped while unused.
+// Remove this disable once your own tables use them.
+// Single source of truth for the database schema. Define tables here — the
+// SQL migration files under drizzle/ are generated and applied automatically
+// (dev on server start, production on publish). Never hand-write SQL or touch
+// drizzle/. Prefer ADDING columns/tables over renaming or deleting existing
+// ones: renames cannot be migrated automatically.
+
+/**
+ * Important note (do not remove):
+ * 
+ * Never rename existing tables or columns in schema.ts. Renames cannot be
+ * auto-migrated: no migration file is generated, the database keeps the old
+ * name, and every query against the new name fails at runtime with a 500. 
+ * To reshape data, add a new column or table, write to it, and migrate old
+ * values in app code (e.g. fall back to the old column on read).
+ */
+
+
+// Example (change before deploying!) :
+
 import { sql } from 'drizzle-orm'
 import { integer, sqliteTable, text } from 'drizzle-orm/sqlite-core'
 
-// Single source of truth for the D1 / libsql schema. Sqlite dialect → the same
-// definition runs on the dev cf-shim (libsql .dev.db, synced via `drizzle-kit
-// push`) and prod D1 (migrations via `wrangler d1 migrations apply`).
-//
-// Add your own tables here, then `bun run db:push` (dev) or `bun run
-// db:generate` + deploy (prod). Do NOT hand-write SQL — this file is the schema.
-export const entries = sqliteTable('entries', {
+export const notes = sqliteTable('notes', {
   id: integer('id').primaryKey({ autoIncrement: true }),
-  label: text('label').notNull(),
+  title: text('title').notNull(),
   createdAt: integer('created_at')
     .notNull()
     .default(sql`(unixepoch())`),
 })
 
-export type Entry = typeof entries.$inferSelect
+export type Note = typeof notes.$inferSelect

package/src/templates/tanstack-start-2026-07-30/src/lib/storage.ts

@@ -15,30 +15,31 @@ import { storage } from '@helloleo/runtime'
  *
  * Rules:
  * - Server-side only (route handlers, loaders, server functions).
- * - Browser uploads/downloads go through PRESIGNED URLS (below) — never
- *   stream file bytes through your own API route when a presigned URL works:
- *   the browser talks to storage directly.
+ * - Files flow THROUGH YOUR API ROUTES: upload = POST route reads the body
+ *   and `storage.put`s it; download = GET route streams `obj.body` back.
+ *   Do NOT use presignGet/presignPut — presigned URLs are not available.
  * - Key layout is up to the app — namespace with prefixes ('avatars/',
- *   'exports/').
- */
-
-/**
- * Presign an upload: the server hands the browser a short-lived URL it can
- * `fetch(url, { method: 'PUT', body: file })` to directly. Pair with a DB row
- * that records the key.
+ *   'exports/'). Store the key in a database row to reference the file.
+ *
+ * Upload route example (src/routes/api/images/upload.ts):
+ *
+ *   POST: async ({ request }) => {
+ *     const form = await request.formData()
+ *     const file = form.get('file') as File
+ *     const key = `images/${crypto.randomUUID()}-${file.name}`
+ *     await storage.put(key, file.stream(), { contentType: file.type })
+ *     return Response.json({ key }, { status: 201 })
+ *   }
+ *
+ * Download/serve route example (src/routes/api/images/$key.ts):
+ *
+ *   GET: async ({ params }) => {
+ *     const obj = await storage.get(`images/${params.key}`)
+ *     if (!obj) return new Response('Not found', { status: 404 })
+ *     return new Response(obj.body, {
+ *       headers: { 'content-type': obj.contentType ?? 'application/octet-stream' },
+ *     })
+ *   }
  */
-export function getUploadUrl(
-  key: string,
-  opts?: { ttlSeconds?: number; contentType?: string },
-): Promise<string> {
-  return storage.presignPut(key, opts?.ttlSeconds ?? 600, {
-    contentType: opts?.contentType,
-  })
-}
-
-/** Presign a download — short-lived direct GET URL for the browser. */
-export function getDownloadUrl(key: string, ttlSeconds = 600): Promise<string> {
-  return storage.presignGet(key, ttlSeconds)
-}
 
 export { storage }

package/src/templates/tanstack-start-2026-07-30/src/routes/api/health.ts

@@ -1,6 +1,6 @@
 import { createFileRoute } from '@tanstack/react-router'
+import { sql } from 'drizzle-orm'
 import { db } from '#/db'
-import { entries } from '#/db/schema'
 
 /**
  * Server route example: GET /api/health. Use this file as the base for
@@ -39,7 +39,9 @@ export const Route = createFileRoute('/api/health')({
           runtime: 'cloudflare-workers',
         }
 
-        // Database health: lightweight query against a known table
+        // Database health: schema-agnostic connectivity ping. Deliberately
+        // NOT a query against an app table — the health probe must keep
+        // working no matter how src/db/schema.ts evolves.
         let database: {
           status: 'ok' | 'error'
           latencyMs: number
@@ -47,7 +49,7 @@ export const Route = createFileRoute('/api/health')({
         }
         const dbStart = Date.now()
         try {
-          await db.select({ id: entries.id }).from(entries).limit(1)
+          await db.run(sql`SELECT 1`)
           database = {
             status: 'ok',
             latencyMs: Date.now() - dbStart,

package/src/tools/scaffold.ts

@@ -152,8 +152,9 @@ export const scaffold = tool({
 			? [
 					"- This is a TanStack Start project. The server entry is src/server.ts. There is no index.html or client entrypoint.",
 					"- For JSON/CRUD APIs, add server routes under src/routes/api/. Read src/routes/api/health.ts first, add routes as needed.",
-					"- The database schema lives in src/db/schema.ts and is the single source of truth. Migration files under drizzle/ are generated and applied automatically. Never create, edit or delete them. Prefer adding new columns/tables over renaming existing ones.",
-					"- Persistence goes through @helloleo/runtime exclusively: database via #/db (see src/db/index.ts), key-value store via #/lib/kv (see src/lib/kv.ts), file storage + presigned browser uploads via #/lib/storage (see src/lib/storage.ts), env/secrets via env from @helloleo/runtime. Read those files before server-side data work. Never install another DB/storage client, never import from cloudflare:workers, all of it is server-side only.",
+					"- The database schema lives in src/db/schema.ts and is the single source of truth. Migration files under drizzle/ are generated and applied automatically. Never create, edit or delete them.",
+					"- Never rename existing tables or columns in schema.ts. Renames cannot be auto-migrated: no migration file is generated, the database keeps the old name, and every query against the new name fails at runtime with a 500. To reshape data, add a new column or table, write to it, and migrate old values in app code (e.g. fall back to the old column on read).",
+					"- Persistence goes through @helloleo/runtime exclusively: database via #/db (see src/db/index.ts), key-value store via #/lib/kv (see src/lib/kv.ts), file storage via #/lib/storage (see src/lib/storage.ts -- uploads/downloads flow through your API routes; presigned URLs are NOT available), env/secrets via env from @helloleo/runtime. Read those files before server-side data work. Never install another DB/storage client, never import from cloudflare:workers, all of it is server-side only.",
 				]
 			: [
 					"- This is a TanStack Router SPA. The client entry is index.html -> src/main.tsx. There is no server: no API routes, no server functions, no database.",

package/src/tools/setup-authentication/auth-files.ts

@@ -78,6 +78,17 @@ function buildAuth() {
     emailAndPassword: {
       enabled: ${hasPassword},
     },${socialProvidersBlock}
+    // The preview runs inside an iframe on another site, so the session
+    // cookie lives in a third-party context: it MUST be SameSite=None +
+    // Secure + Partitioned (CHIPS) or Chrome/Safari silently drop it and
+    // login never sticks.
+    advanced: {
+      defaultCookieAttributes: {
+        sameSite: 'none',
+        secure: true,
+        partitioned: true,
+      },
+    },
     plugins: [tanstackStartCookies()],
   })
 }

package/dist/templates/tanstack-start-2026-07-30/drizzle/0000_tidy_kang.sql

@@ -1,5 +0,0 @@
-CREATE TABLE `entries` (
-	`id` integer PRIMARY KEY AUTOINCREMENT NOT NULL,
-	`label` text NOT NULL,
-	`created_at` integer DEFAULT (unixepoch()) NOT NULL
-);

package/dist/templates/tanstack-start-2026-07-30/drizzle/meta/0000_snapshot.json

@@ -1,50 +0,0 @@
-{
-  "version": "6",
-  "dialect": "sqlite",
-  "id": "ec5ce3c5-da3c-496c-942e-72a9a9579093",
-  "prevId": "00000000-0000-0000-0000-000000000000",
-  "tables": {
-    "entries": {
-      "name": "entries",
-      "columns": {
-        "id": {
-          "name": "id",
-          "type": "integer",
-          "primaryKey": true,
-          "notNull": true,
-          "autoincrement": true
-        },
-        "label": {
-          "name": "label",
-          "type": "text",
-          "primaryKey": false,
-          "notNull": true,
-          "autoincrement": false
-        },
-        "created_at": {
-          "name": "created_at",
-          "type": "integer",
-          "primaryKey": false,
-          "notNull": true,
-          "autoincrement": false,
-          "default": "(unixepoch())"
-        }
-      },
-      "indexes": {},
-      "foreignKeys": {},
-      "compositePrimaryKeys": {},
-      "uniqueConstraints": {},
-      "checkConstraints": {}
-    }
-  },
-  "views": {},
-  "enums": {},
-  "_meta": {
-    "schemas": {},
-    "tables": {},
-    "columns": {}
-  },
-  "internal": {
-    "indexes": {}
-  }
-}

package/src/templates/tanstack-start-2026-07-30/drizzle/0000_tidy_kang.sql

@@ -1,5 +0,0 @@
-CREATE TABLE `entries` (
-	`id` integer PRIMARY KEY AUTOINCREMENT NOT NULL,
-	`label` text NOT NULL,
-	`created_at` integer DEFAULT (unixepoch()) NOT NULL
-);

package/src/templates/tanstack-start-2026-07-30/drizzle/meta/0000_snapshot.json

@@ -1,50 +0,0 @@
-{
-  "version": "6",
-  "dialect": "sqlite",
-  "id": "ec5ce3c5-da3c-496c-942e-72a9a9579093",
-  "prevId": "00000000-0000-0000-0000-000000000000",
-  "tables": {
-    "entries": {
-      "name": "entries",
-      "columns": {
-        "id": {
-          "name": "id",
-          "type": "integer",
-          "primaryKey": true,
-          "notNull": true,
-          "autoincrement": true
-        },
-        "label": {
-          "name": "label",
-          "type": "text",
-          "primaryKey": false,
-          "notNull": true,
-          "autoincrement": false
-        },
-        "created_at": {
-          "name": "created_at",
-          "type": "integer",
-          "primaryKey": false,
-          "notNull": true,
-          "autoincrement": false,
-          "default": "(unixepoch())"
-        }
-      },
-      "indexes": {},
-      "foreignKeys": {},
-      "compositePrimaryKeys": {},
-      "uniqueConstraints": {},
-      "checkConstraints": {}
-    }
-  },
-  "views": {},
-  "enums": {},
-  "_meta": {
-    "schemas": {},
-    "tables": {},
-    "columns": {}
-  },
-  "internal": {
-    "indexes": {}
-  }
-}