@helloleo/plugins 0.2.15 → 0.2.16

package/dist/index.js

@@ -24955,8 +24955,9 @@ var scaffold = tool({
     const typeNotes = isStart ? [
       "- This is a TanStack Start project. The server entry is src/server.ts. There is no index.html or client entrypoint.",
       "- For JSON/CRUD APIs, add server routes under src/routes/api/. Read src/routes/api/health.ts first, add routes as needed.",
-      "- The database schema lives in src/db/schema.ts and is the single source of truth. Migration files under drizzle/ are generated and applied automatically. Never create, edit or delete them. Prefer adding new columns/tables over renaming existing ones.",
-      "- Persistence goes through @helloleo/runtime exclusively: database via #/db (see src/db/index.ts), key-value store via #/lib/kv (see src/lib/kv.ts), file storage + presigned browser uploads via #/lib/storage (see src/lib/storage.ts), env/secrets via env from @helloleo/runtime. Read those files before server-side data work. Never install another DB/storage client, never import from cloudflare:workers, all of it is server-side only."
+      "- The database schema lives in src/db/schema.ts and is the single source of truth. Migration files under drizzle/ are generated and applied automatically. Never create, edit or delete them.",
+      "- Never rename existing tables or columns in schema.ts. Renames cannot be auto-migrated: no migration file is generated, the database keeps the old name, and every query against the new name fails at runtime with a 500. To reshape data, add a new column or table, write to it, and migrate old values in app code (e.g. fall back to the old column on read).",
+      "- Persistence goes through @helloleo/runtime exclusively: database via #/db (see src/db/index.ts), key-value store via #/lib/kv (see src/lib/kv.ts), file storage via #/lib/storage (see src/lib/storage.ts -- uploads/downloads flow through your API routes; presigned URLs are NOT available), env/secrets via env from @helloleo/runtime. Read those files before server-side data work. Never install another DB/storage client, never import from cloudflare:workers, all of it is server-side only."
     ] : [
       "- This is a TanStack Router SPA. The client entry is index.html -> src/main.tsx. There is no server: no API routes, no server functions, no database.",
       "- Fetch data from external APIs only. If the app needs its own persistence or server-side code, it should have been scaffolded as tanstack-start."
@@ -25052,6 +25053,17 @@ function buildAuth() {
     emailAndPassword: {
       enabled: ${hasPassword},
     },${socialProvidersBlock}
+    // The preview runs inside an iframe on another site, so the session
+    // cookie lives in a third-party context: it MUST be SameSite=None +
+    // Secure + Partitioned (CHIPS) or Chrome/Safari silently drop it and
+    // login never sticks.
+    advanced: {
+      defaultCookieAttributes: {
+        sameSite: 'none',
+        secure: true,
+        partitioned: true,
+      },
+    },
     plugins: [tanstackStartCookies()],
   })
 }

package/dist/templates/tanstack-start-2026-07-30/src/db/schema.ts

@@ -1,20 +1,34 @@
+/* oxlint-disable no-unused-vars */
+// ^ keeps the drizzle imports below from being stripped while unused.
+// Remove this disable once your own tables use them.
 // Single source of truth for the database schema. Define tables here — the
 // SQL migration files under drizzle/ are generated and applied automatically
 // (dev on server start, production on publish). Never hand-write SQL or touch
 // drizzle/. Prefer ADDING columns/tables over renaming or deleting existing
 // ones: renames cannot be migrated automatically.
-//
-// Example:
-//
-//   import { sql } from 'drizzle-orm'
-//   import { integer, sqliteTable, text } from 'drizzle-orm/sqlite-core'
-//
-//   export const notes = sqliteTable('notes', {
-//     id: integer('id').primaryKey({ autoIncrement: true }),
-//     title: text('title').notNull(),
-//     createdAt: integer('created_at')
-//       .notNull()
-//       .default(sql`(unixepoch())`),
-//   })
-//
-//   export type Note = typeof notes.$inferSelect
+
+/**
+ * Important note (do not remove):
+ * 
+ * Never rename existing tables or columns in schema.ts. Renames cannot be
+ * auto-migrated: no migration file is generated, the database keeps the old
+ * name, and every query against the new name fails at runtime with a 500. 
+ * To reshape data, add a new column or table, write to it, and migrate old
+ * values in app code (e.g. fall back to the old column on read).
+ */
+
+
+// Example (change before deploying!) :
+
+import { sql } from 'drizzle-orm'
+import { integer, sqliteTable, text } from 'drizzle-orm/sqlite-core'
+
+export const notes = sqliteTable('notes', {
+  id: integer('id').primaryKey({ autoIncrement: true }),
+  title: text('title').notNull(),
+  createdAt: integer('created_at')
+    .notNull()
+    .default(sql`(unixepoch())`),
+})
+
+export type Note = typeof notes.$inferSelect

package/dist/templates/tanstack-start-2026-07-30/src/lib/storage.ts

@@ -15,30 +15,31 @@ import { storage } from '@helloleo/runtime'
  *
  * Rules:
  * - Server-side only (route handlers, loaders, server functions).
- * - Browser uploads/downloads go through PRESIGNED URLS (below) — never
- *   stream file bytes through your own API route when a presigned URL works:
- *   the browser talks to storage directly.
+ * - Files flow THROUGH YOUR API ROUTES: upload = POST route reads the body
+ *   and `storage.put`s it; download = GET route streams `obj.body` back.
+ *   Do NOT use presignGet/presignPut — presigned URLs are not available.
  * - Key layout is up to the app — namespace with prefixes ('avatars/',
- *   'exports/').
- */
-
-/**
- * Presign an upload: the server hands the browser a short-lived URL it can
- * `fetch(url, { method: 'PUT', body: file })` to directly. Pair with a DB row
- * that records the key.
+ *   'exports/'). Store the key in a database row to reference the file.
+ *
+ * Upload route example (src/routes/api/images/upload.ts):
+ *
+ *   POST: async ({ request }) => {
+ *     const form = await request.formData()
+ *     const file = form.get('file') as File
+ *     const key = `images/${crypto.randomUUID()}-${file.name}`
+ *     await storage.put(key, file.stream(), { contentType: file.type })
+ *     return Response.json({ key }, { status: 201 })
+ *   }
+ *
+ * Download/serve route example (src/routes/api/images/$key.ts):
+ *
+ *   GET: async ({ params }) => {
+ *     const obj = await storage.get(`images/${params.key}`)
+ *     if (!obj) return new Response('Not found', { status: 404 })
+ *     return new Response(obj.body, {
+ *       headers: { 'content-type': obj.contentType ?? 'application/octet-stream' },
+ *     })
+ *   }
  */
-export function getUploadUrl(
-  key: string,
-  opts?: { ttlSeconds?: number; contentType?: string },
-): Promise<string> {
-  return storage.presignPut(key, opts?.ttlSeconds ?? 600, {
-    contentType: opts?.contentType,
-  })
-}
-
-/** Presign a download — short-lived direct GET URL for the browser. */
-export function getDownloadUrl(key: string, ttlSeconds = 600): Promise<string> {
-  return storage.presignGet(key, ttlSeconds)
-}
 
 export { storage }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@helloleo/plugins",
-  "version": "0.2.15",
+  "version": "0.2.16",
   "description": "OpenCode plugins for HelloLeo",
   "license": "UNLICENSED",
   "type": "module",

package/src/templates/tanstack-start-2026-07-30/src/db/schema.ts

@@ -1,20 +1,34 @@
+/* oxlint-disable no-unused-vars */
+// ^ keeps the drizzle imports below from being stripped while unused.
+// Remove this disable once your own tables use them.
 // Single source of truth for the database schema. Define tables here — the
 // SQL migration files under drizzle/ are generated and applied automatically
 // (dev on server start, production on publish). Never hand-write SQL or touch
 // drizzle/. Prefer ADDING columns/tables over renaming or deleting existing
 // ones: renames cannot be migrated automatically.
-//
-// Example:
-//
-//   import { sql } from 'drizzle-orm'
-//   import { integer, sqliteTable, text } from 'drizzle-orm/sqlite-core'
-//
-//   export const notes = sqliteTable('notes', {
-//     id: integer('id').primaryKey({ autoIncrement: true }),
-//     title: text('title').notNull(),
-//     createdAt: integer('created_at')
-//       .notNull()
-//       .default(sql`(unixepoch())`),
-//   })
-//
-//   export type Note = typeof notes.$inferSelect
+
+/**
+ * Important note (do not remove):
+ * 
+ * Never rename existing tables or columns in schema.ts. Renames cannot be
+ * auto-migrated: no migration file is generated, the database keeps the old
+ * name, and every query against the new name fails at runtime with a 500. 
+ * To reshape data, add a new column or table, write to it, and migrate old
+ * values in app code (e.g. fall back to the old column on read).
+ */
+
+
+// Example (change before deploying!) :
+
+import { sql } from 'drizzle-orm'
+import { integer, sqliteTable, text } from 'drizzle-orm/sqlite-core'
+
+export const notes = sqliteTable('notes', {
+  id: integer('id').primaryKey({ autoIncrement: true }),
+  title: text('title').notNull(),
+  createdAt: integer('created_at')
+    .notNull()
+    .default(sql`(unixepoch())`),
+})
+
+export type Note = typeof notes.$inferSelect

package/src/templates/tanstack-start-2026-07-30/src/lib/storage.ts

@@ -15,30 +15,31 @@ import { storage } from '@helloleo/runtime'
  *
  * Rules:
  * - Server-side only (route handlers, loaders, server functions).
- * - Browser uploads/downloads go through PRESIGNED URLS (below) — never
- *   stream file bytes through your own API route when a presigned URL works:
- *   the browser talks to storage directly.
+ * - Files flow THROUGH YOUR API ROUTES: upload = POST route reads the body
+ *   and `storage.put`s it; download = GET route streams `obj.body` back.
+ *   Do NOT use presignGet/presignPut — presigned URLs are not available.
  * - Key layout is up to the app — namespace with prefixes ('avatars/',
- *   'exports/').
- */
-
-/**
- * Presign an upload: the server hands the browser a short-lived URL it can
- * `fetch(url, { method: 'PUT', body: file })` to directly. Pair with a DB row
- * that records the key.
+ *   'exports/'). Store the key in a database row to reference the file.
+ *
+ * Upload route example (src/routes/api/images/upload.ts):
+ *
+ *   POST: async ({ request }) => {
+ *     const form = await request.formData()
+ *     const file = form.get('file') as File
+ *     const key = `images/${crypto.randomUUID()}-${file.name}`
+ *     await storage.put(key, file.stream(), { contentType: file.type })
+ *     return Response.json({ key }, { status: 201 })
+ *   }
+ *
+ * Download/serve route example (src/routes/api/images/$key.ts):
+ *
+ *   GET: async ({ params }) => {
+ *     const obj = await storage.get(`images/${params.key}`)
+ *     if (!obj) return new Response('Not found', { status: 404 })
+ *     return new Response(obj.body, {
+ *       headers: { 'content-type': obj.contentType ?? 'application/octet-stream' },
+ *     })
+ *   }
  */
-export function getUploadUrl(
-  key: string,
-  opts?: { ttlSeconds?: number; contentType?: string },
-): Promise<string> {
-  return storage.presignPut(key, opts?.ttlSeconds ?? 600, {
-    contentType: opts?.contentType,
-  })
-}
-
-/** Presign a download — short-lived direct GET URL for the browser. */
-export function getDownloadUrl(key: string, ttlSeconds = 600): Promise<string> {
-  return storage.presignGet(key, ttlSeconds)
-}
 
 export { storage }

package/src/tools/scaffold.ts

@@ -152,8 +152,9 @@ export const scaffold = tool({
 			? [
 					"- This is a TanStack Start project. The server entry is src/server.ts. There is no index.html or client entrypoint.",
 					"- For JSON/CRUD APIs, add server routes under src/routes/api/. Read src/routes/api/health.ts first, add routes as needed.",
-					"- The database schema lives in src/db/schema.ts and is the single source of truth. Migration files under drizzle/ are generated and applied automatically. Never create, edit or delete them. Prefer adding new columns/tables over renaming existing ones.",
-					"- Persistence goes through @helloleo/runtime exclusively: database via #/db (see src/db/index.ts), key-value store via #/lib/kv (see src/lib/kv.ts), file storage + presigned browser uploads via #/lib/storage (see src/lib/storage.ts), env/secrets via env from @helloleo/runtime. Read those files before server-side data work. Never install another DB/storage client, never import from cloudflare:workers, all of it is server-side only.",
+					"- The database schema lives in src/db/schema.ts and is the single source of truth. Migration files under drizzle/ are generated and applied automatically. Never create, edit or delete them.",
+					"- Never rename existing tables or columns in schema.ts. Renames cannot be auto-migrated: no migration file is generated, the database keeps the old name, and every query against the new name fails at runtime with a 500. To reshape data, add a new column or table, write to it, and migrate old values in app code (e.g. fall back to the old column on read).",
+					"- Persistence goes through @helloleo/runtime exclusively: database via #/db (see src/db/index.ts), key-value store via #/lib/kv (see src/lib/kv.ts), file storage via #/lib/storage (see src/lib/storage.ts -- uploads/downloads flow through your API routes; presigned URLs are NOT available), env/secrets via env from @helloleo/runtime. Read those files before server-side data work. Never install another DB/storage client, never import from cloudflare:workers, all of it is server-side only.",
 				]
 			: [
 					"- This is a TanStack Router SPA. The client entry is index.html -> src/main.tsx. There is no server: no API routes, no server functions, no database.",

package/src/tools/setup-authentication/auth-files.ts

@@ -78,6 +78,17 @@ function buildAuth() {
     emailAndPassword: {
       enabled: ${hasPassword},
     },${socialProvidersBlock}
+    // The preview runs inside an iframe on another site, so the session
+    // cookie lives in a third-party context: it MUST be SameSite=None +
+    // Secure + Partitioned (CHIPS) or Chrome/Safari silently drop it and
+    // login never sticks.
+    advanced: {
+      defaultCookieAttributes: {
+        sameSite: 'none',
+        secure: true,
+        partitioned: true,
+      },
+    },
     plugins: [tanstackStartCookies()],
   })
 }