@helloleo/plugins 0.2.21 → 0.2.23

package/src/tools/scaffold.ts

@@ -1,213 +0,0 @@
-import { mkdir } from "node:fs/promises";
-import path from "node:path";
-import type { Plugin } from "@opencode-ai/plugin";
-import { tool } from "@opencode-ai/plugin";
-import { z } from "zod/v4";
-import { renderTemplate } from "../template-render.ts";
-
-/**
- * Scaffold template identifiers, keyed by project type. Each value is the
- * directory name under src/templates/ and is written to .leo/project.json so
- * the webapp / leo-core can tell which template (and therefore which
- * conventions) a workspace was bootstrapped with. Bump a value (and add a new
- * templates/<id>/ dir) when that scaffold's shape changes.
- *
- * - tanstack-start: SSR Worker with file routing, API routes, and a database,
- *   KV and bucket via @helloleo/runtime.
- * - tanstack-router: client-only SPA (Vite + index.html entry), no server and
- *   no database.
- */
-export const SCAFFOLD_TEMPLATES = {
-	"tanstack-start": "tanstack-start-2026-07-30",
-	"tanstack-router": "tanstack-router-2026-06-15",
-} as const;
-
-export type ScaffoldType = keyof typeof SCAFFOLD_TEMPLATES;
-
-/**
- * Older template ids that still ship under src/templates/ and stay valid
- * PLUGINS_SCAFFOLD_VERSION pins (a deployment may hold back a version).
- */
-export const LEGACY_TEMPLATES = ["tanstack-start-2026-06-18"] as const;
-
-/** Default template id, kept for callers that predate the `type` param. */
-export const SCAFFOLD_VERSION = SCAFFOLD_TEMPLATES["tanstack-start"];
-
-/**
- * Resolve which template to render.
- *
- * The container can pin the template via PLUGINS_SCAFFOLD_VERSION (a versioned
- * template id, e.g. "tanstack-start-2026-06-18"); unknown values are ignored
- * so a stale env var can never reproduce the ENOENT-on-missing-template
- * failure. An explicit `type` from the tool call wins the FAMILY (start vs
- * router); the pin still supplies the version when it points inside that
- * family. With neither, the pin decides, falling back to the router template.
- */
-export function resolveTemplateId(type?: ScaffoldType): string {
-	const version = process.env.PLUGINS_SCAFFOLD_VERSION;
-	const known: string[] = [
-		...Object.values(SCAFFOLD_TEMPLATES),
-		...LEGACY_TEMPLATES,
-	];
-	const pinned = version && known.includes(version) ? version : undefined;
-	if (type) {
-		return pinned?.startsWith(type) ? pinned : SCAFFOLD_TEMPLATES[type];
-	}
-	return pinned ?? SCAFFOLD_TEMPLATES["tanstack-router"];
-}
-
-/**
- * The project workspace directory is named after the project UUID -- the
- * webapp generates `<slugified-name>-<uuidv4>` (actions.ts createProject)
- * and leo-core mounts the project at /workspace/<uuid>. Baking it into
- * proxy.ts at scaffold time removes the VITE_PROJECT_UUID env var, which
- * nothing in the infrastructure ever set and which Leo kept mis-generating.
- */
-export function projectUuidFromDir(dir: string): string {
-	return path.basename(dir);
-}
-
-/**
- * Integration-proxy base URL, provided by the opencode container via
- * PLUGINS_INTEGRATION_PROXY_URL (like PLUGINS_SCAFFOLD_VERSION) so each deployment
- * (dev | preprod | prod) bakes its own proxy host into proxy.ts at scaffold
- * time -- previews and published apps use the same value. Unset falls back
- * to prod so a missing env var can never break production scaffolds.
- */
-export function integrationProxyUrl(projectUuid: string): string {
-	const base = (
-		process.env.PLUGINS_INTEGRATION_PROXY_URL || "https://api.app.helloleo.dev"
-	).replace(/\/+$/, "");
-
-	return `${base}/api/integration-proxy/${projectUuid}`;
-}
-
-const scaffoldOptionsSchema = z.object({
-	name: z
-		.string()
-		.describe("Human-readable name for SEO, e.g. 'Shipping Platform'"),
-	description: z
-		.string()
-		.describe("One sentence describing the app. Used as the meta description."),
-	type: z
-		.enum(["tanstack-start", "tanstack-router"])
-		.optional()
-		.describe(
-			"Project type. 'tanstack-start': SSR app with API routes and a " +
-				"database, KV and bucket — use it whenever the app needs to " +
-				"persist data or run server-side code, and always for " +
-				"setup_authentication (it needs server routes). " +
-				"'tanstack-router': client-only SPA with no server and no database " +
-				"— use it only for pure frontends that talk to external APIs. " +
-				"Omit to use the deployment's default.",
-		),
-});
-
-/** Kebab-case slug of the product name, for package.json. */
-function slugify(name: string): string {
-	return (
-		name
-			.toLowerCase()
-			.replace(/[^a-z0-9]+/g, "-")
-			.replace(/^-+|-+$/g, "") || "leo-project"
-	);
-}
-
-/**
- * Write the base scaffold by rendering the template for the requested type
- * into dir, then adding .leo/project.json (template metadata the tool owns,
- * not part of the template tree). Returns the relative paths written.
- */
-export async function writeBaseScaffold(
-	{ name, description, type }: z.infer<typeof scaffoldOptionsSchema>,
-	dir: string,
-): Promise<string[]> {
-	const templateId = resolveTemplateId(type);
-	const projectUuid = projectUuidFromDir(dir);
-	const created = await renderTemplate(
-		templateId,
-		{
-			LEO_NAME: name,
-			LEO_SLUG: slugify(name),
-			LEO_DESCRIPTION: description,
-			LEO_PROJECT_UUID: projectUuid,
-			LEO_INTEGRATION_PROXY_URL: integrationProxyUrl(projectUuid),
-		},
-		dir,
-	);
-
-	await mkdir(path.join(dir, ".leo"), { recursive: true });
-	const leoPath = path.join(".leo", "project.json");
-	await Bun.write(
-		path.join(dir, leoPath),
-		JSON.stringify({ $schema: 1, scaffold: templateId }, null, 2),
-	);
-
-	return [...created, leoPath];
-}
-
-export const scaffold = tool({
-	description:
-		"Scaffold a new project with React 19, file-based routing (TanStack), " +
-		"Tailwind v4, shadcn/ui, and react-query. Two types: 'tanstack-start' " +
-		"(SSR, API routes, and a database, KV and bucket via @helloleo/runtime) " +
-		"or 'tanstack-router' (client-only SPA, no server, no database). Call " +
-		"this first for any new project, before writing routes or components.",
-	args: {
-		name: scaffoldOptionsSchema.shape.name,
-		description: scaffoldOptionsSchema.shape.description,
-		type: scaffoldOptionsSchema.shape.type,
-	},
-	async execute(args, context) {
-		const isStart = resolveTemplateId(args.type).startsWith("tanstack-start");
-		const created = await writeBaseScaffold(args, context.directory);
-		const uiComponents = created.filter((f) =>
-			f.startsWith("src/components/ui/"),
-		);
-		const rest = created.filter((f) => !f.startsWith("src/components/ui/"));
-
-		const typeNotes = isStart
-			? [
-					"- This is a TanStack Start project. The server entry is src/server.ts. There is no index.html or client entrypoint.",
-					"- For JSON/CRUD APIs, add server routes under src/routes/api/. Read src/routes/api/health.ts first, add routes as needed.",
-					"- The database schema lives in src/db/schema.ts and is the single source of truth. Migration files under drizzle/ are generated and applied automatically. Never create, edit or delete them.",
-					"- Never rename existing tables or columns in schema.ts. Renames cannot be auto-migrated: no migration file is generated, the database keeps the old name, and every query against the new name fails at runtime with a 500. To reshape data, add a new column or table, write to it, and migrate old values in app code (e.g. fall back to the old column on read).",
-					"- Persistence goes through @helloleo/runtime exclusively: database via #/db (see src/db/index.ts), key-value store via #/lib/kv (see src/lib/kv.ts), file storage via #/lib/storage (see src/lib/storage.ts -- uploads/downloads flow through your API routes; presigned URLs are NOT available), env/secrets via env from @helloleo/runtime. Read those files before server-side data work. Never install another DB/storage client, never import from cloudflare:workers, all of it is server-side only.",
-				]
-			: [
-					"- This is a TanStack Router SPA. The client entry is index.html -> src/main.tsx. There is no server: no API routes, no server functions, no database.",
-					"- Fetch data from external APIs only. If the app needs its own persistence or server-side code, it should have been scaffolded as tanstack-start.",
-				];
-
-		const nextSteps = isStart
-			? [
-					"Next: read src/routes/index.tsx and continue with the user's request.",
-					"For authentication (password and/or OAuth), call setup_authentication.",
-					"For NetSuite projects, call setup_netsuite.",
-				]
-			: [
-					"Next: read src/routes/index.tsx and continue with the user's request.",
-				];
-
-		return [
-			`Scaffolded ${created.length} files:`,
-			...rest.map((f) => `  - ${f}`),
-			`  - src/components/ui/ (${uiComponents.length} shadcn/ui components)`,
-			"",
-			"Notes:",
-			...typeNotes,
-			"- Add routes as files in src/routes/. Do not default export route components. Routing and layout conventions are documented in src/routes/README.md, read it before adding routes.",
-			"- shadcn/ui components are already in src/components/ui.",
-			"- Design system: style exclusively with the token utilities, never hardcoded colors. To change the look, edit the token values in src/styles.css (light and dark blocks).",
-			"- Always fetch data with react-query (useQuery and useMutation).",
-			"",
-			...nextSteps,
-		].join("\n");
-	},
-});
-
-export const ScaffoldPlugin: Plugin = async () => {
-	return {
-		tool: { scaffold: scaffold },
-	};
-};

package/src/tools/setup-authentication/auth-files.ts

@@ -1,144 +0,0 @@
-import type { OAuthProvider, Provider } from "./constants.ts";
-
-/**
- * getAuth() builds the betterAuth instance lazily, on first call from
- * INSIDE a request -- never a module-scope `export const auth =
- * betterAuth(...)` like better-auth's own docs show. `db` (the app's #/db)
- * is a lazy Proxy over the D1 binding, and env.* Worker secrets don't exist
- * until a request is in flight; touching either while workerd boots the
- * isolate throws. `instance`'s type is inferred from `buildAuth`'s own
- * return type (not a hand-written `BetterAuthOptions` annotation) -- with
- * secret/clientId/clientSecret resolved to plain `string` at runtime via
- * requireEnv, an explicit `ReturnType<typeof betterAuth>` annotation
- * mismatches on optionality and fails to typecheck.
- */
-export function authLibTs(providers: Provider[]): string {
-	const hasPassword = providers.includes("password");
-	const oauth = providers.filter((p): p is OAuthProvider => p !== "password");
-
-	const envFields = [
-		"BETTER_AUTH_SECRET?: string",
-		"HELLOLEO_URL?: string",
-		...oauth.flatMap((p) => {
-			const prefix = p.toUpperCase();
-			return [
-				`${prefix}_CLIENT_ID?: string`,
-				`${prefix}_CLIENT_SECRET?: string`,
-			];
-		}),
-	].join("\n    ");
-
-	const socialProvidersBlock = oauth.length
-		? `
-    socialProviders: {
-${oauth
-	.map((p) => {
-		const prefix = p.toUpperCase();
-		return `      ${p}: { clientId: requireEnv(e.${prefix}_CLIENT_ID, '${prefix}_CLIENT_ID'), clientSecret: requireEnv(e.${prefix}_CLIENT_SECRET, '${prefix}_CLIENT_SECRET') },`;
-	})
-	.join("\n")}
-    },`
-		: "";
-
-	const requireEnvFn = oauth.length
-		? `
-function requireEnv(value: string | undefined, name: string): string {
-  if (!value) {
-    throw new Error(\`\${name} is not set. Add it to .env.\`)
-  }
-  return value
-}
-`
-		: "";
-
-	return `import { betterAuth } from 'better-auth'
-import { drizzleAdapter } from '@better-auth/drizzle-adapter'
-import { tanstackStartCookies } from 'better-auth/tanstack-start'
-import { db } from '#/db'
-import * as schema from '#/db/schema'
-import { env } from '@helloleo/runtime'
-
-/*
- * buildAuth() only runs from INSIDE a request (see getAuth() below) --
- * never call it at module scope. \`db\` is a lazy Proxy over the D1 binding
- * and env.* Worker secrets don't exist until a request is in flight;
- * touching either while workerd boots the isolate throws.
- */
-${requireEnvFn}
-function buildAuth() {
-  const e = env as {
-    ${envFields}
-  }
-
-  // HELLOLEO_URL is injected by the platform as a bare host, no scheme.
-  return betterAuth({
-    secret: e.BETTER_AUTH_SECRET,
-    baseURL: e.HELLOLEO_URL ? \`https://\${e.HELLOLEO_URL}\` : 'http://localhost:3000',
-    database: drizzleAdapter(db, { provider: 'sqlite', schema }),
-    emailAndPassword: {
-      enabled: ${hasPassword},
-    },${socialProvidersBlock}
-    // The preview runs inside an iframe on another site, so the session
-    // cookie lives in a third-party context: it MUST be SameSite=None +
-    // Secure + Partitioned (CHIPS) or Chrome/Safari silently drop it and
-    // login never sticks.
-    advanced: {
-      defaultCookieAttributes: {
-        sameSite: 'none',
-        secure: true,
-        partitioned: true,
-      },
-    },
-    plugins: [tanstackStartCookies()],
-  })
-}
-
-let instance: ReturnType<typeof buildAuth> | undefined
-
-export function getAuth() {
-  if (!instance) instance = buildAuth()
-  return instance
-}
-`;
-}
-
-export function authClientTs(): string {
-	return `import { createAuthClient } from 'better-auth/react'
-
-export const authClient = createAuthClient()
-`;
-}
-
-export function authServerTs(): string {
-	return `import { createServerFn } from '@tanstack/react-start'
-import { getRequestHeaders } from '@tanstack/react-start/server'
-import { getAuth } from '#/lib/auth'
-
-export const getSession = createServerFn({ method: 'GET' }).handler(async () => {
-  const headers = getRequestHeaders()
-  return getAuth().api.getSession({ headers })
-})
-
-export const ensureSession = createServerFn({ method: 'GET' }).handler(async () => {
-  const headers = getRequestHeaders()
-  const session = await getAuth().api.getSession({ headers })
-  if (!session) throw new Error('Unauthorized')
-  return session
-})
-`;
-}
-
-export function authRouteTs(): string {
-	return `import { createFileRoute } from '@tanstack/react-router'
-import { getAuth } from '#/lib/auth'
-
-export const Route = createFileRoute('/api/auth/$')({
-  server: {
-    handlers: {
-      GET: ({ request }: { request: Request }) => getAuth().handler(request),
-      POST: ({ request }: { request: Request }) => getAuth().handler(request),
-    },
-  },
-})
-`;
-}

package/src/tools/setup-authentication/constants.ts

@@ -1,19 +0,0 @@
-export const PROVIDERS = [
-	"password",
-	"google",
-	"github",
-	"discord",
-	"microsoft",
-] as const;
-
-export type Provider = (typeof PROVIDERS)[number];
-export type OAuthProvider = Exclude<Provider, "password">;
-
-export const PROVIDER_LABELS: Record<OAuthProvider, string> = {
-	google: "Google",
-	github: "GitHub",
-	discord: "Discord",
-	microsoft: "Microsoft",
-};
-
-export const BETTER_AUTH_VERSION = "^1.6.23";

package/src/tools/setup-authentication/db-schema.ts

@@ -1,96 +0,0 @@
-import { readFile } from "node:fs/promises";
-import path from "node:path";
-
-/**
- * user/session/account/verification, hand-written to match better-auth's
- * documented drizzle/sqlite schema exactly (text ids, no relations --
- * experimental.joins is not enabled). Appended into src/db/schema.ts --
- * drizzle.config.ts hardcodes that file as the one schema source, and this
- * template's dev/prod pipeline is drizzle-kit push / wrangler d1
- * migrations, not better-auth's own Kysely-based migration runner.
- */
-const SCHEMA_MARKER = "sqliteTable('user'";
-
-function authTablesBlock(): string {
-	return `
-export const user = sqliteTable('user', {
-  id: text('id').primaryKey(),
-  name: text('name').notNull(),
-  email: text('email').notNull().unique(),
-  emailVerified: integer('email_verified', { mode: 'boolean' }).default(false).notNull(),
-  image: text('image'),
-  createdAt: integer('created_at', { mode: 'timestamp_ms' })
-    .default(sql\`(cast(unixepoch('subsecond') * 1000 as integer))\`)
-    .notNull(),
-  updatedAt: integer('updated_at', { mode: 'timestamp_ms' })
-    .default(sql\`(cast(unixepoch('subsecond') * 1000 as integer))\`)
-    .$onUpdate(() => new Date())
-    .notNull(),
-})
-
-export const session = sqliteTable('session', {
-  id: text('id').primaryKey(),
-  expiresAt: integer('expires_at', { mode: 'timestamp_ms' }).notNull(),
-  token: text('token').notNull().unique(),
-  createdAt: integer('created_at', { mode: 'timestamp_ms' })
-    .default(sql\`(cast(unixepoch('subsecond') * 1000 as integer))\`)
-    .notNull(),
-  updatedAt: integer('updated_at', { mode: 'timestamp_ms' })
-    .$onUpdate(() => new Date())
-    .notNull(),
-  ipAddress: text('ip_address'),
-  userAgent: text('user_agent'),
-  userId: text('user_id')
-    .notNull()
-    .references(() => user.id, { onDelete: 'cascade' }),
-})
-
-export const account = sqliteTable('account', {
-  id: text('id').primaryKey(),
-  accountId: text('account_id').notNull(),
-  providerId: text('provider_id').notNull(),
-  userId: text('user_id')
-    .notNull()
-    .references(() => user.id, { onDelete: 'cascade' }),
-  accessToken: text('access_token'),
-  refreshToken: text('refresh_token'),
-  idToken: text('id_token'),
-  accessTokenExpiresAt: integer('access_token_expires_at', { mode: 'timestamp_ms' }),
-  refreshTokenExpiresAt: integer('refresh_token_expires_at', { mode: 'timestamp_ms' }),
-  scope: text('scope'),
-  password: text('password'),
-  createdAt: integer('created_at', { mode: 'timestamp_ms' })
-    .default(sql\`(cast(unixepoch('subsecond') * 1000 as integer))\`)
-    .notNull(),
-  updatedAt: integer('updated_at', { mode: 'timestamp_ms' })
-    .$onUpdate(() => new Date())
-    .notNull(),
-})
-
-export const verification = sqliteTable('verification', {
-  id: text('id').primaryKey(),
-  identifier: text('identifier').notNull(),
-  value: text('value').notNull(),
-  expiresAt: integer('expires_at', { mode: 'timestamp_ms' }).notNull(),
-  createdAt: integer('created_at', { mode: 'timestamp_ms' })
-    .default(sql\`(cast(unixepoch('subsecond') * 1000 as integer))\`)
-    .notNull(),
-  updatedAt: integer('updated_at', { mode: 'timestamp_ms' })
-    .default(sql\`(cast(unixepoch('subsecond') * 1000 as integer))\`)
-    .$onUpdate(() => new Date())
-    .notNull(),
-})
-`;
-}
-
-/** Appends the auth tables to src/db/schema.ts. Idempotent; returns whether it wrote anything. */
-export async function appendAuthTables(dir: string): Promise<boolean> {
-	const schemaPath = path.join(dir, "src", "db", "schema.ts");
-	const current = await readFile(schemaPath, "utf8").catch(() => null);
-	if (current === null) {
-		throw new Error("src/db/schema.ts not found -- run scaffold first.");
-	}
-	if (current.includes(SCHEMA_MARKER)) return false;
-	await Bun.write(schemaPath, `${current.trimEnd()}\n${authTablesBlock()}`);
-	return true;
-}

package/src/tools/setup-authentication/index.ts

@@ -1,148 +0,0 @@
-import path from "node:path";
-import type { Plugin } from "@opencode-ai/plugin";
-import { tool } from "@opencode-ai/plugin";
-import { z } from "zod/v4";
-import {
-	authClientTs,
-	authLibTs,
-	authRouteTs,
-	authServerTs,
-} from "./auth-files.ts";
-import type { OAuthProvider } from "./constants.ts";
-import { PROVIDER_LABELS, PROVIDERS } from "./constants.ts";
-import { appendAuthTables } from "./db-schema.ts";
-import { addAuthDependencies } from "./package-json.ts";
-import {
-	authedLayoutTsx,
-	dashboardPageTsx,
-	loginPageTsx,
-	signupPageTsx,
-} from "./pages.ts";
-
-/**
- * Adds authentication on top of an existing scaffold via better-auth:
- * email/password and/or social sign-in (google/github/discord/microsoft),
- * a drizzle-backed session store, and login/signup routes.
- *
- * Only additive files are written, except `src/db/schema.ts` (appended,
- * never replaced) and `package.json` (two deps added if missing).
- *
- * Mutually exclusive with setup_netsuite: both own src/routes/login.tsx and
- * the app's one auth strategy. Called AFTER `scaffold`, never instead of it.
- *
- * Only applies to full-stack (tanstack-start) scaffolds: the files it writes
- * assume a server (API routes, drizzle schema). On a tanstack-router SPA it
- * returns an error instead of writing broken server code.
- */
-
-/**
- * Scaffold id recorded by the scaffold tool in .leo/project.json, or null if
- * the file is missing/unreadable (pre-project.json workspaces: don't block).
- */
-async function readScaffoldId(dir: string): Promise<string | null> {
-	try {
-		const meta = await Bun.file(path.join(dir, ".leo", "project.json")).json();
-		return typeof meta?.scaffold === "string" ? meta.scaffold : null;
-	} catch {
-		return null;
-	}
-}
-export const setupAuthentication = tool({
-	description:
-		"Add authentication to an existing project via better-auth. Call scaffold first, " +
-		"then this. providers: 'password' for email/password, plus any of " +
-		"'google' | 'github' | 'discord' | 'microsoft' for social sign-in -- pass any " +
-		"combination. Mutually exclusive with setup_netsuite: an app has one auth " +
-		"strategy, not two. Only for full-stack (tanstack-start) scaffolds; errors " +
-		"on client-only SPA projects.",
-	args: {
-		providers: z
-			.array(z.enum(PROVIDERS))
-			.min(1)
-			.describe("Auth methods to enable, e.g. ['password', 'google']"),
-	},
-	async execute({ providers }, context) {
-		const dir = context.directory;
-
-		const scaffoldId = await readScaffoldId(dir);
-		if (scaffoldId !== null && !scaffoldId.startsWith("tanstack-start")) {
-			return [
-				"Error: setup_authentication is for full-stack applications and is not applicable to HelloLeo Cloud.",
-				"This project is a client-only SPA (tanstack-router): no server, no API routes, no database, so the files this tool writes cannot work here.",
-				"Do not mention this error to the user. Continue by setting up authentication manually by activating HelloLeo Backend and using the MCP.",
-			].join("\n");
-		}
-
-		const hasPassword = providers.includes("password");
-		const oauth = providers.filter((p): p is OAuthProvider => p !== "password");
-
-		const files: [string, string][] = [
-			[path.join("src", "lib", "auth.ts"), authLibTs(providers)],
-			[path.join("src", "lib", "auth-client.ts"), authClientTs()],
-			[path.join("src", "lib", "auth-server.ts"), authServerTs()],
-			[path.join("src", "routes", "api", "auth", "$.ts"), authRouteTs()],
-			[path.join("src", "routes", "_authed.tsx"), authedLayoutTsx()],
-			[
-				path.join("src", "routes", "_authed", "dashboard.tsx"),
-				dashboardPageTsx(),
-			],
-			[
-				path.join("src", "routes", "login.tsx"),
-				loginPageTsx(hasPassword, oauth),
-			],
-		];
-		if (hasPassword) {
-			files.push([path.join("src", "routes", "signup.tsx"), signupPageTsx()]);
-		}
-
-		for (const [filePath, content] of files) {
-			await Bun.write(path.join(dir, filePath), content);
-		}
-
-		const schemaAppended = await appendAuthTables(dir);
-		const depsAdded = await addAuthDependencies(dir);
-
-		const envLines = [
-			"  - dev (.env): BETTER_AUTH_SECRET=<random>",
-			"  - prod: `wrangler secret put BETTER_AUTH_SECRET`",
-			"  - HELLOLEO_URL is auto-injected by the platform (preview + production) -- nothing to set for baseURL",
-		];
-		for (const p of oauth) {
-			const prefix = p.toUpperCase();
-			envLines.push(
-				`  - ${PROVIDER_LABELS[p]}: ${prefix}_CLIENT_ID / ${prefix}_CLIENT_SECRET (dev: .env, prod: wrangler secret put)`,
-			);
-		}
-
-		return [
-			`Wrote authentication (better-auth, providers: ${providers.join(", ")}):`,
-			"  - src/lib/auth.ts (lazy betterAuth instance -- read the comment on why it's not a module-scope export)",
-			"  - src/lib/auth-client.ts (React client -- authClient.signIn.email/social, signUp.email, signOut)",
-			"  - src/lib/auth-server.ts (getSession/ensureSession server functions, for SSR route guards)",
-			"  - src/routes/api/auth/$.ts (catch-all handler)",
-			"  - src/routes/_authed.tsx (pathless guard for protected routes)",
-			"  - src/routes/_authed/dashboard.tsx (example protected page -- _authed needs at least one child route or it collides with index.tsx on '/')",
-			`  - src/routes/login.tsx${hasPassword ? ", src/routes/signup.tsx" : ""}`,
-			`  - src/db/schema.ts ${schemaAppended ? "(appended user/session/account/verification tables)" : "(already had a `user` table, left as-is)"}`,
-			`  - package.json ${depsAdded ? "(added better-auth, @better-auth/drizzle-adapter)" : "(dependencies already present)"}`,
-			"",
-			"Run `bun install`, then `bun run db:push` (or just `bun dev`, which runs it first) to create the new tables.",
-			"",
-			"Required env vars/secrets:",
-			...envLines,
-			"",
-			"Add more protected pages under src/routes/_authed/ (e.g. _authed/settings.tsx -> /settings); they inherit the guard.",
-			"",
-			"Verify before shipping: password hashing defaults to scrypt via Node's crypto, exposed through the " +
-				"nodejs_compat flag (already on for this template) -- confirm a real sign-up/login round-trip works in `bun dev`.",
-			"",
-			"Mutually exclusive with setup_netsuite -- an app has one auth strategy, not two.",
-		].join("\n");
-	},
-});
-
-export const SetupAuthenticationPlugin: Plugin = async () => {
-	return {
-		tool: { setup_authentication: setupAuthentication },
-	};
-};

package/src/tools/setup-authentication/package-json.ts

@@ -1,17 +0,0 @@
-import { readFile } from "node:fs/promises";
-import path from "node:path";
-import { BETTER_AUTH_VERSION } from "./constants.ts";
-
-/** Adds better-auth + its drizzle adapter to the project's package.json. Idempotent. */
-export async function addAuthDependencies(dir: string): Promise<boolean> {
-	const pkgPath = path.join(dir, "package.json");
-	const pkg = JSON.parse(await readFile(pkgPath, "utf8")) as {
-		dependencies?: Record<string, string>;
-	};
-	pkg.dependencies ??= {};
-	if (pkg.dependencies["better-auth"]) return false;
-	pkg.dependencies["better-auth"] = BETTER_AUTH_VERSION;
-	pkg.dependencies["@better-auth/drizzle-adapter"] = BETTER_AUTH_VERSION;
-	await Bun.write(pkgPath, `${JSON.stringify(pkg, null, 2)}\n`);
-	return true;
-}