@helloleo/plugins 0.2.2 → 0.2.4

package/dist/index.js

@@ -24989,7 +24989,7 @@ ${oauth.map((p) => {
   const requireEnvFn = oauth.length ? `
 function requireEnv(value: string | undefined, name: string): string {
   if (!value) {
-    throw new Error(\`\${name} is not set. Add it to .env (dev) or run \\\`wrangler secret put \${name}\\\` (prod).\`)
+    throw new Error(\`\${name} is not set. Add it to .env.\`)
   }
   return value
 }
@@ -25013,9 +25013,10 @@ function buildAuth() {
     ${envFields}
   }
 
+  // HELLOLEO_URL is injected by the platform as a bare host, no scheme.
   return betterAuth({
     secret: e.BETTER_AUTH_SECRET,
-    baseURL: e.HELLOLEO_URL || 'http://localhost:3000',
+    baseURL: e.HELLOLEO_URL ? \`https://\${e.HELLOLEO_URL}\` : 'http://localhost:3000',
     database: drizzleAdapter(db, { provider: 'sqlite', schema }),
     emailAndPassword: {
       enabled: ${hasPassword},
@@ -25581,9 +25582,10 @@ function stripTrailingSlash(s: string) {
 export function appOrigin(request: Request) {
   // 1) Explicit override wins (set by the platform per environment).
   if (nsEnv.PUBLIC_APP_URL) return stripTrailingSlash(nsEnv.PUBLIC_APP_URL)
-  // 2) HELLOLEO_URL is injected on every deploy (the app's canonical origin), so
-  //    it's set even when the NetSuite wizard's PUBLIC_APP_URL pin wasn't.
-  if (nsEnv.HELLOLEO_URL) return stripTrailingSlash(nsEnv.HELLOLEO_URL)
+  // 2) HELLOLEO_URL is injected on every deploy (the app's canonical origin,
+  //    a bare host with no scheme), so it's set even when the NetSuite
+  //    wizard's PUBLIC_APP_URL pin wasn't.
+  if (nsEnv.HELLOLEO_URL) return \`https://\${stripTrailingSlash(nsEnv.HELLOLEO_URL)}\`
   // 3) Preview/prod proxies rewrite Host, so trust the forwarded/original host
   //    they set (HelloLeo's nginx sends X-Original-Host) \u2014 that's the public URL
   //    the browser loaded, not an internal upstream host.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@helloleo/plugins",
-  "version": "0.2.2",
+  "version": "0.2.4",
   "description": "OpenCode plugins for HelloLeo",
   "license": "UNLICENSED",
   "type": "module",

package/src/tools/setup-authentication/auth-files.ts

@@ -44,7 +44,7 @@ ${oauth
 		? `
 function requireEnv(value: string | undefined, name: string): string {
   if (!value) {
-    throw new Error(\`\${name} is not set. Add it to .env (dev) or run \\\`wrangler secret put \${name}\\\` (prod).\`)
+    throw new Error(\`\${name} is not set. Add it to .env.\`)
   }
   return value
 }
@@ -70,9 +70,10 @@ function buildAuth() {
     ${envFields}
   }
 
+  // HELLOLEO_URL is injected by the platform as a bare host, no scheme.
   return betterAuth({
     secret: e.BETTER_AUTH_SECRET,
-    baseURL: e.HELLOLEO_URL || 'http://localhost:3000',
+    baseURL: e.HELLOLEO_URL ? \`https://\${e.HELLOLEO_URL}\` : 'http://localhost:3000',
     database: drizzleAdapter(db, { provider: 'sqlite', schema }),
     emailAndPassword: {
       enabled: ${hasPassword},

package/src/tools/setup-netsuite.ts

@@ -142,9 +142,10 @@ function stripTrailingSlash(s: string) {
 export function appOrigin(request: Request) {
   // 1) Explicit override wins (set by the platform per environment).
   if (nsEnv.PUBLIC_APP_URL) return stripTrailingSlash(nsEnv.PUBLIC_APP_URL)
-  // 2) HELLOLEO_URL is injected on every deploy (the app's canonical origin), so
-  //    it's set even when the NetSuite wizard's PUBLIC_APP_URL pin wasn't.
-  if (nsEnv.HELLOLEO_URL) return stripTrailingSlash(nsEnv.HELLOLEO_URL)
+  // 2) HELLOLEO_URL is injected on every deploy (the app's canonical origin,
+  //    a bare host with no scheme), so it's set even when the NetSuite
+  //    wizard's PUBLIC_APP_URL pin wasn't.
+  if (nsEnv.HELLOLEO_URL) return \`https://\${stripTrailingSlash(nsEnv.HELLOLEO_URL)}\`
   // 3) Preview/prod proxies rewrite Host, so trust the forwarded/original host
   //    they set (HelloLeo's nginx sends X-Original-Host) — that's the public URL
   //    the browser loaded, not an internal upstream host.