@helloleo/plugins 0.2.19 → 0.2.21

package/dist/index.js

@@ -25561,6 +25561,17 @@ async function readScaffoldId2(dir) {
     return null;
   }
 }
+async function isStartScaffold(dir) {
+  const scaffoldId = await readScaffoldId2(dir);
+  if (scaffoldId)
+    return scaffoldId.startsWith("tanstack-start");
+  try {
+    const pkg = await Bun.file(path7.join(dir, "package.json")).json();
+    return Boolean(pkg?.dependencies?.["@tanstack/react-start"] ?? pkg?.devDependencies?.["@tanstack/react-start"]);
+  } catch {
+    return false;
+  }
+}
 function schemaAppend() {
   return `
 // --- NetSuite OAuth (added by setup_netsuite) ---
@@ -25602,7 +25613,9 @@ function netsuiteServerTs() {
  * Config is read from the Cloudflare env binding via @helloleo/runtime.
  * Set NETSUITE_ACCOUNT_ID / _CLIENT_ID / _CLIENT_SECRET (secret optional for a
  * PKCE public client) and optional PUBLIC_APP_URL as HelloLeo Cloud secrets
- * (prod) or dev vars (preview). They never reach the browser.
+ * (prod) or dev vars (preview). NETSUITE_BROKER_CALLBACK (written by the
+ * HelloLeo wizard) switches the redirect URI to the shared OAuth broker so
+ * one URI serves every app/environment. They never reach the browser.
  */
 import { eq } from 'drizzle-orm'
 import { env as runtimeEnv } from '@helloleo/runtime'
@@ -25613,6 +25626,7 @@ interface NsEnv {
   NETSUITE_ACCOUNT_ID?: string
   NETSUITE_CLIENT_ID?: string
   NETSUITE_CLIENT_SECRET?: string
+  NETSUITE_BROKER_CALLBACK?: string
   PUBLIC_APP_URL?: string
   HELLOLEO_URL?: string
 }
@@ -25673,8 +25687,47 @@ export function appOrigin(request: Request) {
     url.host
   return \`\${proto}://\${hostHeader}\`
 }
+/**
+ * HelloLeo's shared OAuth broker (integration-proxy Worker). When
+ * NETSUITE_BROKER_CALLBACK is set (the platform writes it to the project env),
+ * customers register that ONE stable URI on their Integration Record instead
+ * of one URI per app/environment: the authorize redirect goes to the broker,
+ * the broker 302s the callback back to THIS app (looked up by the state
+ * nonce), and the token exchange passes the same broker URI. Unset (self-host
+ * / standalone), the app falls back to its own origin's callback.
+ */
+export function brokerCallback(): string | null {
+  const raw = nsEnv.NETSUITE_BROKER_CALLBACK
+  if (!raw) return null
+  try {
+    const u = new URL(raw)
+    return u.protocol === 'https:' ? u.toString() : null
+  } catch {
+    return null
+  }
+}
+
 export function redirectUri(request: Request) {
-  return \`\${appOrigin(request)}/auth/netsuite/callback\`
+  return brokerCallback() ?? \`\${appOrigin(request)}/auth/netsuite/callback\`
+}
+
+/**
+ * Tell the broker where to send this flow's callback: nonce -> this app's
+ * origin. MUST succeed before redirecting to NetSuite, otherwise the callback
+ * dead-ends at the broker. No-op when the broker isn't configured.
+ */
+export async function registerWithBroker(request: Request, flowId: string): Promise<void> {
+  const callback = brokerCallback()
+  if (!callback) return
+  const registerUrl = new URL('/auth/netsuite/register', callback)
+  const res = await fetch(registerUrl.toString(), {
+    method: 'POST',
+    headers: { 'Content-Type': 'application/json' },
+    body: JSON.stringify({ nonce: flowId, target: appOrigin(request) }),
+  })
+  if (!res.ok) {
+    throw new Error(\`NetSuite broker registration failed (HTTP \${res.status}) -- cannot start sign-in\`)
+  }
 }
 
 // Coerce ?return_to= to our OWN origin. The callback appends the session bearer
@@ -25838,6 +25891,7 @@ import {
   authorizeUrl,
   pkce,
   redirectUri,
+  registerWithBroker,
   requireConfig,
   safeReturnTo,
   SCOPE,
@@ -25855,6 +25909,10 @@ export const Route = createFileRoute('/auth/netsuite/start')({
 
         const { verifier, challenge } = await pkce()
         const flowId = crypto.randomUUID()
+        // With the shared broker, NetSuite redirects to the broker's fixed
+        // callback and the broker forwards here -- it must know this flow's
+        // target before the user leaves for NetSuite.
+        await registerWithBroker(request, flowId)
         await db.insert(netsuiteFlows).values({ flowId, codeVerifier: verifier, returnTo })
 
         const authorize = new URL(authorizeUrl(accountId))
@@ -26717,8 +26775,8 @@ import { integer, sqliteTable, text } from 'drizzle-orm/sqlite-core'
     "CONFIG -- NETSUITE_ACCOUNT_ID, NETSUITE_CLIENT_ID, NETSUITE_CLIENT_SECRET (secret optional for PKCE public clients). Never hardcode; never put in code. Same var names in every environment, different SOURCE:",
     "- DEV (Fly preview): read from the project .env. HelloLeo writes them there (the setup wizard, or the env tooling). In dev the app uses .env -- do NOT tell the user to use HelloLeo Cloud here.",
     "- PROD (published Worker): the SAME names live as HelloLeo Cloud secrets; the publish step promotes them from .env onto the Worker automatically. Same code path (@helloleo/runtime env), just a different source per environment.",
-    "- PUBLIC_APP_URL / HELLOLEO_URL are set by the platform per environment; don't hardcode them.",
-    "- REDIRECT URI -- never guess or hardcode it. It is derived server-side and auto-corrects behind the preview proxy. Read the exact value from GET /auth/netsuite/config (or getNetSuiteRedirectUri() on the client) and tell the user to register THAT on Integration Record #2 (scope: rest_webservices). ONE redirect URI per record: register exactly the value /auth/netsuite/config returns for the environment the user signs into. If login must work in BOTH the preview and the published app, use a separate Integration Record per environment (same env var names, different NETSUITE_CLIENT_ID/_SECRET values per environment) -- do not stack URLs on one record.",
+    "- PUBLIC_APP_URL / HELLOLEO_URL / NETSUITE_BROKER_CALLBACK are set by the platform per environment; don't hardcode them.",
+    "- REDIRECT URI -- never guess or hardcode it. When NETSUITE_BROKER_CALLBACK is set (the HelloLeo wizard writes it), the redirect URI is HelloLeo's shared OAuth broker: ONE stable URI the user registers ONCE on Integration Record #2 (scope: rest_webservices), valid for both the preview and the published app -- the broker routes each callback back to this app. Without it, the app falls back to its own origin's callback. Either way, read the exact value from GET /auth/netsuite/config (or getNetSuiteRedirectUri() on the client) and tell the user to register THAT.",
     "- Never replace <AuthLayout> with a password gate. Real OAuth is the only supported login."
   ].join(`
 `);
@@ -26773,13 +26831,11 @@ async function executeSpa(dir) {
 `);
 }
 var setupNetsuite = tool({
-  description: "Add NetSuite runtime OAuth (end-user LOGIN) to an existing project. " + "Call scaffold first, then this. Works on both scaffold types: it " + "writes the client + auth components, and the OAuth backend is the " + "project's HelloLeo Cloud Worker (VITE_WORKER_URL) -- the platform " + "wizard registers the Worker's fixed /auth/netsuite/callback on the " + "Integration Record, so the app never hosts the OAuth routes itself. " + "This login uses NetSuite Integration Record #2 " + "(scope: rest_webservices) -- a SEPARATE record from the MCP one " + "(scope: mcp) that was used only to BUILD the app; do not confuse " + "them. Real OAuth from day one -- never replace <AuthLayout> with a " + "password placeholder. Setup guide (link the user to it): " + "https://docs.helloleo.dev/integrations/netsuite",
+  description: "Add NetSuite runtime OAuth (end-user LOGIN) to an existing project. " + "Call scaffold first, then this. Works on both scaffold types and " + "picks the variant automatically: on tanstack-start the app hosts " + "its own OAuth routes (/auth/netsuite/* + /api/me, same-origin " + "client); on tanstack-router (SPA) it writes the client + auth " + "components and the OAuth backend is the project's HelloLeo Cloud " + "Worker (VITE_WORKER_URL). This login uses NetSuite Integration " + "Record #2 (scope: rest_webservices) -- a SEPARATE record from the " + "MCP one (scope: mcp) that was used only to BUILD the app; do not " + "confuse them. Real OAuth from day one -- never replace <AuthLayout> " + "with a password placeholder. Setup guide (link the user to it): " + "https://docs.helloleo.dev/integrations/netsuite",
   args: {},
   async execute(_args, context) {
     const dir = context.directory;
-    const scaffoldId = await readScaffoldId2(dir);
-    const inAppOptIn = process.env.PLUGINS_NETSUITE_IN_APP === "1";
-    if (inAppOptIn && scaffoldId?.startsWith("tanstack-start")) {
+    if (await isStartScaffold(dir)) {
       return executeStart(dir);
     }
     return executeSpa(dir);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@helloleo/plugins",
-  "version": "0.2.19",
+  "version": "0.2.21",
   "description": "OpenCode plugins for HelloLeo",
   "license": "UNLICENSED",
   "type": "module",

package/src/tools/setup-netsuite.ts

@@ -4,19 +4,20 @@ import type { Plugin } from "@opencode-ai/plugin";
 import { tool } from "@opencode-ai/plugin";
 
 /**
- * NetSuite runtime OAuth (end-user LOGIN). Two variants:
+ * NetSuite runtime OAuth (end-user LOGIN). Two variants, picked automatically
+ * from the project's scaffold -- never from env:
  *
- * - DEFAULT (every scaffold type): client-only files; the OAuth backend is
- *   the per-project HelloLeo Cloud Worker (VITE_WORKER_URL), sign-in runs in
+ * - tanstack-start (SSR): the app IS the backend. Emits server routes
+ *   (/auth/netsuite/* + /api/me), netsuite_flows + netsuite_sessions drizzle
+ *   tables, and a same-origin client. The redirect URI registered on
+ *   Integration Record #2 must be the APP's own /auth/netsuite/callback
+ *   (read it from GET /auth/netsuite/config).
+ * - tanstack-router (SPA): client-only files; the OAuth backend is the
+ *   per-project HelloLeo Cloud Worker (VITE_WORKER_URL), sign-in runs in
  *   a popup + postMessage so it works inside the HelloLeo preview iframe.
- *   This matches prod: the platform wizard registers the Worker's fixed
- *   /auth/netsuite/callback as the ONE redirect URI on Integration Record #2
- *   (provision-first, see webapp netsuiteRuntimeSetup).
- * - IN-APP (opt-in: PLUGINS_NETSUITE_IN_APP=1 + tanstack-start scaffold):
- *   the app IS the backend. Emits server routes (/auth/netsuite/* + /api/me),
- *   netsuite_flows + netsuite_sessions drizzle tables, and a same-origin
- *   client. Only valid when the deployment registers the APP's own callback
- *   on the Integration Record instead of the Worker's.
+ *   The wizard registers the Worker's fixed /auth/netsuite/callback as the
+ *   ONE redirect URI on Integration Record #2 (provision-first, see webapp
+ *   netsuiteRuntimeSetup).
  *
  * Both variants share the same component names (AuthLayout / LoginPage /
  * SignInWithNetSuite) and the same wiring step: wrap the root route's
@@ -42,6 +43,26 @@ async function readScaffoldId(dir: string): Promise<string | null> {
 	}
 }
 
+/**
+ * Is this project a tanstack-start (SSR) app? Primary signal: the scaffold id
+ * in .leo/project.json. Fallback for pre-project.json workspaces: only the
+ * start scaffold depends on @tanstack/react-start -- the router SPA ships
+ * @tanstack/react-router alone.
+ */
+async function isStartScaffold(dir: string): Promise<boolean> {
+	const scaffoldId = await readScaffoldId(dir);
+	if (scaffoldId) return scaffoldId.startsWith("tanstack-start");
+	try {
+		const pkg = await Bun.file(path.join(dir, "package.json")).json();
+		return Boolean(
+			pkg?.dependencies?.["@tanstack/react-start"] ??
+				pkg?.devDependencies?.["@tanstack/react-start"],
+		);
+	} catch {
+		return false;
+	}
+}
+
 // --- emitted: src/db/schema.ts (appended) --------------------------------
 function schemaAppend(): string {
 	return `
@@ -86,7 +107,9 @@ function netsuiteServerTs(): string {
  * Config is read from the Cloudflare env binding via @helloleo/runtime.
  * Set NETSUITE_ACCOUNT_ID / _CLIENT_ID / _CLIENT_SECRET (secret optional for a
  * PKCE public client) and optional PUBLIC_APP_URL as HelloLeo Cloud secrets
- * (prod) or dev vars (preview). They never reach the browser.
+ * (prod) or dev vars (preview). NETSUITE_BROKER_CALLBACK (written by the
+ * HelloLeo wizard) switches the redirect URI to the shared OAuth broker so
+ * one URI serves every app/environment. They never reach the browser.
  */
 import { eq } from 'drizzle-orm'
 import { env as runtimeEnv } from '@helloleo/runtime'
@@ -97,6 +120,7 @@ interface NsEnv {
   NETSUITE_ACCOUNT_ID?: string
   NETSUITE_CLIENT_ID?: string
   NETSUITE_CLIENT_SECRET?: string
+  NETSUITE_BROKER_CALLBACK?: string
   PUBLIC_APP_URL?: string
   HELLOLEO_URL?: string
 }
@@ -157,8 +181,47 @@ export function appOrigin(request: Request) {
     url.host
   return \`\${proto}://\${hostHeader}\`
 }
+/**
+ * HelloLeo's shared OAuth broker (integration-proxy Worker). When
+ * NETSUITE_BROKER_CALLBACK is set (the platform writes it to the project env),
+ * customers register that ONE stable URI on their Integration Record instead
+ * of one URI per app/environment: the authorize redirect goes to the broker,
+ * the broker 302s the callback back to THIS app (looked up by the state
+ * nonce), and the token exchange passes the same broker URI. Unset (self-host
+ * / standalone), the app falls back to its own origin's callback.
+ */
+export function brokerCallback(): string | null {
+  const raw = nsEnv.NETSUITE_BROKER_CALLBACK
+  if (!raw) return null
+  try {
+    const u = new URL(raw)
+    return u.protocol === 'https:' ? u.toString() : null
+  } catch {
+    return null
+  }
+}
+
 export function redirectUri(request: Request) {
-  return \`\${appOrigin(request)}/auth/netsuite/callback\`
+  return brokerCallback() ?? \`\${appOrigin(request)}/auth/netsuite/callback\`
+}
+
+/**
+ * Tell the broker where to send this flow's callback: nonce -> this app's
+ * origin. MUST succeed before redirecting to NetSuite, otherwise the callback
+ * dead-ends at the broker. No-op when the broker isn't configured.
+ */
+export async function registerWithBroker(request: Request, flowId: string): Promise<void> {
+  const callback = brokerCallback()
+  if (!callback) return
+  const registerUrl = new URL('/auth/netsuite/register', callback)
+  const res = await fetch(registerUrl.toString(), {
+    method: 'POST',
+    headers: { 'Content-Type': 'application/json' },
+    body: JSON.stringify({ nonce: flowId, target: appOrigin(request) }),
+  })
+  if (!res.ok) {
+    throw new Error(\`NetSuite broker registration failed (HTTP \${res.status}) -- cannot start sign-in\`)
+  }
 }
 
 // Coerce ?return_to= to our OWN origin. The callback appends the session bearer
@@ -324,6 +387,7 @@ import {
   authorizeUrl,
   pkce,
   redirectUri,
+  registerWithBroker,
   requireConfig,
   safeReturnTo,
   SCOPE,
@@ -341,6 +405,10 @@ export const Route = createFileRoute('/auth/netsuite/start')({
 
         const { verifier, challenge } = await pkce()
         const flowId = crypto.randomUUID()
+        // With the shared broker, NetSuite redirects to the broker's fixed
+        // callback and the broker forwards here -- it must know this flow's
+        // target before the user leaves for NetSuite.
+        await registerWithBroker(request, flowId)
         await db.insert(netsuiteFlows).values({ flowId, codeVerifier: verifier, returnTo })
 
         const authorize = new URL(authorizeUrl(accountId))
@@ -1239,8 +1307,8 @@ async function executeStart(dir: string): Promise<string> {
 		"CONFIG -- NETSUITE_ACCOUNT_ID, NETSUITE_CLIENT_ID, NETSUITE_CLIENT_SECRET (secret optional for PKCE public clients). Never hardcode; never put in code. Same var names in every environment, different SOURCE:",
 		"- DEV (Fly preview): read from the project .env. HelloLeo writes them there (the setup wizard, or the env tooling). In dev the app uses .env -- do NOT tell the user to use HelloLeo Cloud here.",
 		"- PROD (published Worker): the SAME names live as HelloLeo Cloud secrets; the publish step promotes them from .env onto the Worker automatically. Same code path (@helloleo/runtime env), just a different source per environment.",
-		"- PUBLIC_APP_URL / HELLOLEO_URL are set by the platform per environment; don't hardcode them.",
-		"- REDIRECT URI -- never guess or hardcode it. It is derived server-side and auto-corrects behind the preview proxy. Read the exact value from GET /auth/netsuite/config (or getNetSuiteRedirectUri() on the client) and tell the user to register THAT on Integration Record #2 (scope: rest_webservices). ONE redirect URI per record: register exactly the value /auth/netsuite/config returns for the environment the user signs into. If login must work in BOTH the preview and the published app, use a separate Integration Record per environment (same env var names, different NETSUITE_CLIENT_ID/_SECRET values per environment) -- do not stack URLs on one record.",
+		"- PUBLIC_APP_URL / HELLOLEO_URL / NETSUITE_BROKER_CALLBACK are set by the platform per environment; don't hardcode them.",
+		"- REDIRECT URI -- never guess or hardcode it. When NETSUITE_BROKER_CALLBACK is set (the HelloLeo wizard writes it), the redirect URI is HelloLeo's shared OAuth broker: ONE stable URI the user registers ONCE on Integration Record #2 (scope: rest_webservices), valid for both the preview and the published app -- the broker routes each callback back to this app. Without it, the app falls back to its own origin's callback. Either way, read the exact value from GET /auth/netsuite/config (or getNetSuiteRedirectUri() on the client) and tell the user to register THAT.",
 		"- Never replace <AuthLayout> with a password gate. Real OAuth is the only supported login.",
 	].join("\n");
 }
@@ -1302,31 +1370,27 @@ async function executeSpa(dir: string): Promise<string> {
 export const setupNetsuite = tool({
 	description:
 		"Add NetSuite runtime OAuth (end-user LOGIN) to an existing project. " +
-		"Call scaffold first, then this. Works on both scaffold types: it " +
-		"writes the client + auth components, and the OAuth backend is the " +
-		"project's HelloLeo Cloud Worker (VITE_WORKER_URL) -- the platform " +
-		"wizard registers the Worker's fixed /auth/netsuite/callback on the " +
-		"Integration Record, so the app never hosts the OAuth routes itself. " +
-		"This login uses NetSuite Integration Record #2 " +
-		"(scope: rest_webservices) -- a SEPARATE record from the MCP one " +
-		"(scope: mcp) that was used only to BUILD the app; do not confuse " +
-		"them. Real OAuth from day one -- never replace <AuthLayout> with a " +
-		"password placeholder. Setup guide (link the user to it): " +
+		"Call scaffold first, then this. Works on both scaffold types and " +
+		"picks the variant automatically: on tanstack-start the app hosts " +
+		"its own OAuth routes (/auth/netsuite/* + /api/me, same-origin " +
+		"client); on tanstack-router (SPA) it writes the client + auth " +
+		"components and the OAuth backend is the project's HelloLeo Cloud " +
+		"Worker (VITE_WORKER_URL). This login uses NetSuite Integration " +
+		"Record #2 (scope: rest_webservices) -- a SEPARATE record from the " +
+		"MCP one (scope: mcp) that was used only to BUILD the app; do not " +
+		"confuse them. Real OAuth from day one -- never replace <AuthLayout> " +
+		"with a password placeholder. Setup guide (link the user to it): " +
 		"https://docs.helloleo.dev/integrations/netsuite",
 	args: {},
 	async execute(_args, context) {
 		const dir = context.directory;
-		// Prod model: Integration Record #2 carries ONE fixed redirect URI --
-		// the per-project HelloLeo Cloud Worker's /auth/netsuite/callback
-		// (provision-first wizard, see webapp netsuiteRuntimeSetup). So the
-		// Worker variant is the default for EVERY scaffold type. The in-app
-		// server-route variant (app-origin redirect URI) only makes sense when
-		// a deployment's wizard registers the app's own callback instead --
-		// opt in per deployment with PLUGINS_NETSUITE_IN_APP=1 on a
-		// tanstack-start scaffold.
-		const scaffoldId = await readScaffoldId(dir);
-		const inAppOptIn = process.env.PLUGINS_NETSUITE_IN_APP === "1";
-		if (inAppOptIn && scaffoldId?.startsWith("tanstack-start")) {
+		// The variant follows the scaffold, never an env flag: a start app has
+		// a server (TanStack Start routes + D1) so it hosts the OAuth itself;
+		// the router SPA has no server, so the per-project HelloLeo Cloud
+		// Worker is the backend. The redirect URI registered on Integration
+		// Record #2 must match: the app's own /auth/netsuite/callback for
+		// start, the Worker's fixed callback for the SPA.
+		if (await isStartScaffold(dir)) {
 			return executeStart(dir);
 		}
 		return executeSpa(dir);