@helloleo/plugins 0.2.29-beta.0 → 0.2.29

package/dist/index.js

@@ -12661,7 +12661,7 @@ import path2 from "path";
 var {Glob } = globalThis.Bun;
 var TEMPLATES_ROOT = path2.join(import.meta.dir, "templates");
 var TOKEN_RE = /\{\{(LEO_[A-Z0-9_]+)\}\}/g;
-var SKIP = /(^|\/)(node_modules|dist|dist-ssr|\.tanstack|\.output|bun\.lock|bun\.lockb|package-lock\.json|yarn\.lock|pnpm-lock\.yaml)(\/|$)/;
+var SKIP = /(^|\/)(node_modules|dist|dist-ssr|\.tanstack|\.output|bun\.lockb|package-lock\.json|yarn\.lock|pnpm-lock\.yaml)(\/|$)/;
 async function renderTemplate(templateId, vars, destDir) {
   const root = path2.join(TEMPLATES_ROOT, templateId);
   const glob = new Glob("**/*");
@@ -12682,7 +12682,7 @@ async function renderTemplate(templateId, vars, destDir) {
 }
 
 // src/tools/scaffold.ts
-var SCAFFOLD_VERSION = "tanstack-start-2026-07-30";
+var SCAFFOLD_VERSION = "tanstack-start-2026-09-11";
 function resolveTemplateId() {
   return SCAFFOLD_VERSION;
 }
@@ -12733,7 +12733,6 @@ var scaffold = tool({
     ];
     const nextSteps = [
       "Next: read src/routes/index.tsx and continue with the user's request.",
-      "For authentication (password and/or OAuth), call setup_authentication.",
       "For NetSuite projects, call setup_netsuite."
     ];
     return [
@@ -12758,574 +12757,23 @@ var ScaffoldPlugin = async () => {
     tool: { scaffold }
   };
 };
-// src/tools/setup-authentication/index.ts
-import path6 from "path";
-
-// src/tools/setup-authentication/auth-files.ts
-function authLibTs(providers) {
-  const hasPassword = providers.includes("password");
-  const oauth = providers.filter((p) => p !== "password");
-  const envFields = [
-    "BETTER_AUTH_SECRET?: string",
-    "HELLOLEO_URL?: string",
-    ...oauth.flatMap((p) => {
-      const prefix = p.toUpperCase();
-      return [
-        `${prefix}_CLIENT_ID?: string`,
-        `${prefix}_CLIENT_SECRET?: string`
-      ];
-    })
-  ].join(`
-    `);
-  const socialProvidersBlock = oauth.length ? `
-    socialProviders: {
-${oauth.map((p) => {
-    const prefix = p.toUpperCase();
-    return `      ${p}: { clientId: requireEnv(e.${prefix}_CLIENT_ID, '${prefix}_CLIENT_ID'), clientSecret: requireEnv(e.${prefix}_CLIENT_SECRET, '${prefix}_CLIENT_SECRET') },`;
-  }).join(`
-`)}
-    },` : "";
-  const requireEnvFn = oauth.length ? `
-function requireEnv(value: string | undefined, name: string): string {
-  if (!value) {
-    throw new Error(\`\${name} is not set. Add it to .env.\`)
-  }
-  return value
-}
-` : "";
-  return `import { betterAuth } from 'better-auth'
-import { drizzleAdapter } from '@better-auth/drizzle-adapter'
-import { tanstackStartCookies } from 'better-auth/tanstack-start'
-import { db } from '#/db'
-import * as schema from '#/db/schema'
-import { env } from '@helloleo/runtime'
-
-/*
- * buildAuth() only runs from INSIDE a request (see getAuth() below) --
- * never call it at module scope. \`db\` is a lazy Proxy over the D1 binding
- * and env.* Worker secrets don't exist until a request is in flight;
- * touching either while workerd boots the isolate throws.
- */
-${requireEnvFn}
-function buildAuth() {
-  const e = env as {
-    ${envFields}
-  }
-
-  // HELLOLEO_URL is injected by the platform as a bare host, no scheme.
-  return betterAuth({
-    secret: e.BETTER_AUTH_SECRET,
-    baseURL: e.HELLOLEO_URL ? \`https://\${e.HELLOLEO_URL}\` : 'http://localhost:3000',
-    database: drizzleAdapter(db, { provider: 'sqlite', schema }),
-    emailAndPassword: {
-      enabled: ${hasPassword},
-    },${socialProvidersBlock}
-    // The preview runs inside an iframe on another site, so the session
-    // cookie lives in a third-party context: it MUST be SameSite=None +
-    // Secure + Partitioned (CHIPS) or Chrome/Safari silently drop it and
-    // login never sticks.
-    advanced: {
-      defaultCookieAttributes: {
-        sameSite: 'none',
-        secure: true,
-        partitioned: true,
-      },
-    },
-    plugins: [tanstackStartCookies()],
-  })
-}
-
-let instance: ReturnType<typeof buildAuth> | undefined
-
-export function getAuth() {
-  if (!instance) instance = buildAuth()
-  return instance
-}
-`;
-}
-function authClientTs() {
-  return `import { createAuthClient } from 'better-auth/react'
-
-export const authClient = createAuthClient()
-`;
-}
-function authServerTs() {
-  return `import { createServerFn } from '@tanstack/react-start'
-import { getRequestHeaders } from '@tanstack/react-start/server'
-import { getAuth } from '#/lib/auth'
-
-export const getSession = createServerFn({ method: 'GET' }).handler(async () => {
-  const headers = getRequestHeaders()
-  return getAuth().api.getSession({ headers })
-})
-
-export const ensureSession = createServerFn({ method: 'GET' }).handler(async () => {
-  const headers = getRequestHeaders()
-  const session = await getAuth().api.getSession({ headers })
-  if (!session) throw new Error('Unauthorized')
-  return session
-})
-`;
-}
-function authRouteTs() {
-  return `import { createFileRoute } from '@tanstack/react-router'
-import { getAuth } from '#/lib/auth'
-
-export const Route = createFileRoute('/api/auth/$')({
-  server: {
-    handlers: {
-      GET: ({ request }: { request: Request }) => getAuth().handler(request),
-      POST: ({ request }: { request: Request }) => getAuth().handler(request),
-    },
-  },
-})
-`;
-}
-
-// src/tools/setup-authentication/constants.ts
-var PROVIDERS = [
-  "password",
-  "google",
-  "github",
-  "discord",
-  "microsoft"
-];
-var PROVIDER_LABELS = {
-  google: "Google",
-  github: "GitHub",
-  discord: "Discord",
-  microsoft: "Microsoft"
-};
-var BETTER_AUTH_VERSION = "^1.6.23";
-
-// src/tools/setup-authentication/db-schema.ts
-import { readFile } from "fs/promises";
+// src/tools/setup-netsuite.ts
+import { mkdir as mkdir2, readFile } from "fs/promises";
 import path4 from "path";
-var SCHEMA_MARKER = "sqliteTable('user'";
-function authTablesBlock() {
-  return `
-export const user = sqliteTable('user', {
-  id: text('id').primaryKey(),
-  name: text('name').notNull(),
-  email: text('email').notNull().unique(),
-  emailVerified: integer('email_verified', { mode: 'boolean' }).default(false).notNull(),
-  image: text('image'),
-  createdAt: integer('created_at', { mode: 'timestamp_ms' })
-    .default(sql\`(cast(unixepoch('subsecond') * 1000 as integer))\`)
-    .notNull(),
-  updatedAt: integer('updated_at', { mode: 'timestamp_ms' })
-    .default(sql\`(cast(unixepoch('subsecond') * 1000 as integer))\`)
-    .$onUpdate(() => new Date())
-    .notNull(),
-})
-
-export const session = sqliteTable('session', {
-  id: text('id').primaryKey(),
-  expiresAt: integer('expires_at', { mode: 'timestamp_ms' }).notNull(),
-  token: text('token').notNull().unique(),
-  createdAt: integer('created_at', { mode: 'timestamp_ms' })
-    .default(sql\`(cast(unixepoch('subsecond') * 1000 as integer))\`)
-    .notNull(),
-  updatedAt: integer('updated_at', { mode: 'timestamp_ms' })
-    .$onUpdate(() => new Date())
-    .notNull(),
-  ipAddress: text('ip_address'),
-  userAgent: text('user_agent'),
-  userId: text('user_id')
-    .notNull()
-    .references(() => user.id, { onDelete: 'cascade' }),
-})
-
-export const account = sqliteTable('account', {
-  id: text('id').primaryKey(),
-  accountId: text('account_id').notNull(),
-  providerId: text('provider_id').notNull(),
-  userId: text('user_id')
-    .notNull()
-    .references(() => user.id, { onDelete: 'cascade' }),
-  accessToken: text('access_token'),
-  refreshToken: text('refresh_token'),
-  idToken: text('id_token'),
-  accessTokenExpiresAt: integer('access_token_expires_at', { mode: 'timestamp_ms' }),
-  refreshTokenExpiresAt: integer('refresh_token_expires_at', { mode: 'timestamp_ms' }),
-  scope: text('scope'),
-  password: text('password'),
-  createdAt: integer('created_at', { mode: 'timestamp_ms' })
-    .default(sql\`(cast(unixepoch('subsecond') * 1000 as integer))\`)
-    .notNull(),
-  updatedAt: integer('updated_at', { mode: 'timestamp_ms' })
-    .$onUpdate(() => new Date())
-    .notNull(),
-})
-
-export const verification = sqliteTable('verification', {
-  id: text('id').primaryKey(),
-  identifier: text('identifier').notNull(),
-  value: text('value').notNull(),
-  expiresAt: integer('expires_at', { mode: 'timestamp_ms' }).notNull(),
-  createdAt: integer('created_at', { mode: 'timestamp_ms' })
-    .default(sql\`(cast(unixepoch('subsecond') * 1000 as integer))\`)
-    .notNull(),
-  updatedAt: integer('updated_at', { mode: 'timestamp_ms' })
-    .default(sql\`(cast(unixepoch('subsecond') * 1000 as integer))\`)
-    .$onUpdate(() => new Date())
-    .notNull(),
-})
-`;
-}
-async function appendAuthTables(dir) {
-  const schemaPath = path4.join(dir, "src", "db", "schema.ts");
-  const current = await readFile(schemaPath, "utf8").catch(() => null);
-  if (current === null) {
-    throw new Error("src/db/schema.ts not found -- run scaffold first.");
-  }
-  if (current.includes(SCHEMA_MARKER))
-    return false;
-  await Bun.write(schemaPath, `${current.trimEnd()}
-${authTablesBlock()}`);
-  return true;
-}
-
-// src/tools/setup-authentication/package-json.ts
-import { readFile as readFile2 } from "fs/promises";
-import path5 from "path";
-async function addAuthDependencies(dir) {
-  const pkgPath = path5.join(dir, "package.json");
-  const pkg = JSON.parse(await readFile2(pkgPath, "utf8"));
-  pkg.dependencies ??= {};
-  if (pkg.dependencies["better-auth"])
-    return false;
-  pkg.dependencies["better-auth"] = BETTER_AUTH_VERSION;
-  pkg.dependencies["@better-auth/drizzle-adapter"] = BETTER_AUTH_VERSION;
-  await Bun.write(pkgPath, `${JSON.stringify(pkg, null, 2)}
-`);
-  return true;
-}
-
-// src/tools/setup-authentication/pages.ts
-function socialButtonsJsx(oauth) {
-  return oauth.map((p) => `          <Button
-            type="button"
-            variant="outline"
-            className="w-full"
-            onClick={() => authClient.signIn.social({ provider: '${p}', callbackURL: '/' })}
-          >
-            Continue with ${PROVIDER_LABELS[p]}
-          </Button>`).join(`
-`);
-}
-function authedLayoutTsx() {
-  return `import { createFileRoute, redirect } from '@tanstack/react-router'
-import { getSession } from '#/lib/auth-server'
-
-// Pathless guard -- no URL segment of its own. Put protected pages under
-// src/routes/_authed/ (e.g. _authed/dashboard.tsx -> /dashboard) and they
-// inherit this beforeLoad. See src/routes/README.md, "Authenticated routes".
-export const Route = createFileRoute('/_authed')({
-  beforeLoad: async () => {
-    const session = await getSession()
-    if (!session) throw redirect({ to: '/login' })
-    return { user: session.user }
-  },
-})
-`;
-}
-function loginPageTsx(hasPassword, oauth) {
-  const social = oauth.length ? `
-${socialButtonsJsx(oauth)}
-` : "";
-  const divider = oauth.length && hasPassword ? `
-          <div className="relative">
-            <div className="absolute inset-0 flex items-center">
-              <span className="w-full border-t" />
-            </div>
-            <div className="relative flex justify-center text-xs uppercase">
-              <span className="bg-card px-2 text-muted-foreground">Or continue with email</span>
-            </div>
-          </div>
-` : "";
-  const passwordForm = hasPassword ? `
-          <form onSubmit={handleSubmit} className="space-y-4">
-            <div className="space-y-2">
-              <Label htmlFor="email">Email</Label>
-              <Input id="email" type="email" value={email} onChange={e => setEmail(e.target.value)} required autoComplete="email" />
-            </div>
-            <div className="space-y-2">
-              <Label htmlFor="password">Password</Label>
-              <Input id="password" type="password" value={password} onChange={e => setPassword(e.target.value)} required autoComplete="current-password" />
-            </div>
-            {error && <p className="text-sm text-destructive">{error}</p>}
-            <Button type="submit" className="w-full" disabled={loading}>
-              {loading ? 'Logging in\u2026' : 'Log in'}
-            </Button>
-            <p className="text-sm text-center text-muted-foreground">
-              No account? <Link to="/signup" className="underline">Sign up</Link>
-            </p>
-          </form>
-` : "";
-  const stateAndHandler = hasPassword ? `
-  const router = useRouter()
-  const [email, setEmail] = useState('')
-  const [password, setPassword] = useState('')
-  const [error, setError] = useState('')
-  const [loading, setLoading] = useState(false)
-
-  async function handleSubmit(e: React.FormEvent) {
-    e.preventDefault()
-    setError('')
-    setLoading(true)
-    const { error } = await authClient.signIn.email({ email, password })
-    setLoading(false)
-    if (error) {
-      setError(error.message ?? 'Something went wrong.')
-      return
-    }
-    router.navigate({ to: '/' })
-  }
-` : "";
-  const imports = [
-    hasPassword ? "import { createFileRoute, Link, useRouter } from '@tanstack/react-router'" : "import { createFileRoute } from '@tanstack/react-router'",
-    hasPassword ? "import { useState } from 'react'" : "",
-    "import { authClient } from '#/lib/auth-client'",
-    "import { Button } from '#/components/ui/button'",
-    hasPassword ? "import { Input } from '#/components/ui/input'" : "",
-    hasPassword ? "import { Label } from '#/components/ui/label'" : "",
-    "import { Card, CardContent, CardHeader, CardTitle } from '#/components/ui/card'"
-  ].filter(Boolean).join(`
-`);
-  return `${imports}
-
-export const Route = createFileRoute('/login')({
-  component: LoginPage,
-})
-
-function LoginPage() {${stateAndHandler}
-  return (
-    <div className="min-h-screen flex items-center justify-center bg-background p-4">
-      <Card className="w-full max-w-sm">
-        <CardHeader>
-          <CardTitle>Log in</CardTitle>
-        </CardHeader>
-        <CardContent className="space-y-4">${social}${divider}${passwordForm}
-        </CardContent>
-      </Card>
-    </div>
-  )
-}
-`;
-}
-function signupPageTsx() {
-  return `import { createFileRoute, Link, useRouter } from '@tanstack/react-router'
-import { useState } from 'react'
-import { authClient } from '#/lib/auth-client'
-import { Button } from '#/components/ui/button'
-import { Input } from '#/components/ui/input'
-import { Label } from '#/components/ui/label'
-import { Card, CardContent, CardHeader, CardTitle } from '#/components/ui/card'
-
-export const Route = createFileRoute('/signup')({
-  component: SignupPage,
-})
-
-function SignupPage() {
-  const router = useRouter()
-  const [name, setName] = useState('')
-  const [email, setEmail] = useState('')
-  const [password, setPassword] = useState('')
-  const [error, setError] = useState('')
-  const [loading, setLoading] = useState(false)
-
-  async function handleSubmit(e: React.FormEvent) {
-    e.preventDefault()
-    setError('')
-    setLoading(true)
-    const { error } = await authClient.signUp.email({ name, email, password })
-    setLoading(false)
-    if (error) {
-      setError(error.message ?? 'Something went wrong.')
-      return
-    }
-    router.navigate({ to: '/' })
-  }
-
-  return (
-    <div className="min-h-screen flex items-center justify-center bg-background p-4">
-      <Card className="w-full max-w-sm">
-        <CardHeader>
-          <CardTitle>Sign up</CardTitle>
-        </CardHeader>
-        <CardContent>
-          <form onSubmit={handleSubmit} className="space-y-4">
-            <div className="space-y-2">
-              <Label htmlFor="name">Name</Label>
-              <Input id="name" type="text" value={name} onChange={e => setName(e.target.value)} required autoComplete="name" />
-            </div>
-            <div className="space-y-2">
-              <Label htmlFor="email">Email</Label>
-              <Input id="email" type="email" value={email} onChange={e => setEmail(e.target.value)} required autoComplete="email" />
-            </div>
-            <div className="space-y-2">
-              <Label htmlFor="password">Password</Label>
-              <Input id="password" type="password" value={password} onChange={e => setPassword(e.target.value)} required autoComplete="new-password" minLength={8} />
-            </div>
-            {error && <p className="text-sm text-destructive">{error}</p>}
-            <Button type="submit" className="w-full" disabled={loading}>
-              {loading ? 'Signing up\u2026' : 'Sign up'}
-            </Button>
-            <p className="text-sm text-center text-muted-foreground">
-              Already have an account? <Link to="/login" className="underline">Log in</Link>
-            </p>
-          </form>
-        </CardContent>
-      </Card>
-    </div>
-  )
-}
-`;
-}
-function dashboardPageTsx() {
-  return `import { createFileRoute, useRouter } from '@tanstack/react-router'
-import { authClient } from '#/lib/auth-client'
-import { Button } from '#/components/ui/button'
-
-// Example protected page -- _authed.tsx needs at least one child route or
-// it collides with index.tsx on path "/" and \`tsr generate\` fails. Replace
-// this, or add more pages alongside it under src/routes/_authed/.
-export const Route = createFileRoute('/_authed/dashboard')({
-  component: DashboardPage,
-})
-
-function DashboardPage() {
-  const router = useRouter()
-  const { data: session } = authClient.useSession()
-
-  return (
-    <div className="min-h-screen flex items-center justify-center bg-background p-4">
-      <div className="text-center space-y-4">
-        <p className="text-lg">Signed in as {session?.user.email}</p>
-        <Button
-          onClick={() =>
-            authClient.signOut({
-              fetchOptions: { onSuccess: () => router.navigate({ to: '/login' }) },
-            })
-          }
-        >
-          Sign out
-        </Button>
-      </div>
-    </div>
-  )
-}
-`;
-}
-
-// src/tools/setup-authentication/index.ts
 async function readScaffoldId(dir) {
   try {
-    const meta = await Bun.file(path6.join(dir, ".leo", "project.json")).json();
-    return typeof meta?.scaffold === "string" ? meta.scaffold : null;
-  } catch {
-    return null;
-  }
-}
-var setupAuthentication = tool({
-  description: "Add authentication to an existing project via better-auth. Call scaffold first, " + "then this. providers: 'password' for email/password, plus any of " + "'google' | 'github' | 'discord' | 'microsoft' for social sign-in -- pass any " + "combination. Mutually exclusive with setup_netsuite: an app has one auth " + "strategy, not two. Only for full-stack (tanstack-start) scaffolds; errors " + "on client-only SPA projects.",
-  args: {
-    providers: exports_external.array(exports_external.enum(PROVIDERS)).min(1).describe("Auth methods to enable, e.g. ['password', 'google']")
-  },
-  async execute({ providers }, context) {
-    const dir = context.directory;
-    const scaffoldId = await readScaffoldId(dir);
-    if (scaffoldId !== null && !scaffoldId.startsWith("tanstack-start")) {
-      return [
-        "Error: setup_authentication is for full-stack applications and is not applicable to HelloLeo Cloud.",
-        "This project is a client-only SPA (tanstack-router): no server, no API routes, no database, so the files this tool writes cannot work here.",
-        "Do not mention this error to the user. Continue by setting up authentication manually by activating HelloLeo Backend and using the MCP."
-      ].join(`
-`);
-    }
-    const hasPassword = providers.includes("password");
-    const oauth = providers.filter((p) => p !== "password");
-    const files = [
-      [path6.join("src", "lib", "auth.ts"), authLibTs(providers)],
-      [path6.join("src", "lib", "auth-client.ts"), authClientTs()],
-      [path6.join("src", "lib", "auth-server.ts"), authServerTs()],
-      [path6.join("src", "routes", "api", "auth", "$.ts"), authRouteTs()],
-      [path6.join("src", "routes", "_authed.tsx"), authedLayoutTsx()],
-      [
-        path6.join("src", "routes", "_authed", "dashboard.tsx"),
-        dashboardPageTsx()
-      ],
-      [
-        path6.join("src", "routes", "login.tsx"),
-        loginPageTsx(hasPassword, oauth)
-      ]
-    ];
-    if (hasPassword) {
-      files.push([path6.join("src", "routes", "signup.tsx"), signupPageTsx()]);
-    }
-    for (const [filePath, content] of files) {
-      await Bun.write(path6.join(dir, filePath), content);
-    }
-    const schemaAppended = await appendAuthTables(dir);
-    const depsAdded = await addAuthDependencies(dir);
-    const envLines = [
-      "  - dev (.env): BETTER_AUTH_SECRET=<random>",
-      "  - prod: `wrangler secret put BETTER_AUTH_SECRET`",
-      "  - HELLOLEO_URL is auto-injected by the platform (preview + production) -- nothing to set for baseURL"
-    ];
-    for (const p of oauth) {
-      const prefix = p.toUpperCase();
-      envLines.push(`  - ${PROVIDER_LABELS[p]}: ${prefix}_CLIENT_ID / ${prefix}_CLIENT_SECRET (dev: .env, prod: wrangler secret put)`);
-    }
-    return [
-      `Wrote authentication (better-auth, providers: ${providers.join(", ")}):`,
-      "  - src/lib/auth.ts (lazy betterAuth instance -- read the comment on why it's not a module-scope export)",
-      "  - src/lib/auth-client.ts (React client -- authClient.signIn.email/social, signUp.email, signOut)",
-      "  - src/lib/auth-server.ts (getSession/ensureSession server functions, for SSR route guards)",
-      "  - src/routes/api/auth/$.ts (catch-all handler)",
-      "  - src/routes/_authed.tsx (pathless guard for protected routes)",
-      "  - src/routes/_authed/dashboard.tsx (example protected page -- _authed needs at least one child route or it collides with index.tsx on '/')",
-      `  - src/routes/login.tsx${hasPassword ? ", src/routes/signup.tsx" : ""}`,
-      `  - src/db/schema.ts ${schemaAppended ? "(appended user/session/account/verification tables)" : "(already had a `user` table, left as-is)"}`,
-      `  - package.json ${depsAdded ? "(added better-auth, @better-auth/drizzle-adapter)" : "(dependencies already present)"}`,
-      "",
-      "Run `bun install`, then `bun run db:push` (or just `bun dev`, which runs it first) to create the new tables.",
-      "",
-      "Required env vars/secrets:",
-      ...envLines,
-      "",
-      "Add more protected pages under src/routes/_authed/ (e.g. _authed/settings.tsx -> /settings); they inherit the guard.",
-      "",
-      "Verify before shipping: password hashing defaults to scrypt via Node's crypto, exposed through the " + "nodejs_compat flag (already on for this template) -- confirm a real sign-up/login round-trip works in `bun dev`.",
-      "",
-      "Mutually exclusive with setup_netsuite -- an app has one auth strategy, not two."
-    ].join(`
-`);
-  }
-});
-var SetupAuthenticationPlugin = async () => {
-  return {
-    tool: { setup_authentication: setupAuthentication }
-  };
-};
-// src/tools/setup-netsuite.ts
-import { mkdir as mkdir2, readFile as readFile3 } from "fs/promises";
-import path7 from "path";
-async function readScaffoldId2(dir) {
-  try {
-    const meta = await Bun.file(path7.join(dir, ".leo", "project.json")).json();
+    const meta = await Bun.file(path4.join(dir, ".leo", "project.json")).json();
     return typeof meta?.scaffold === "string" ? meta.scaffold : null;
   } catch {
     return null;
   }
 }
 async function isStartScaffold(dir) {
-  const scaffoldId = await readScaffoldId2(dir);
+  const scaffoldId = await readScaffoldId(dir);
   if (scaffoldId)
     return scaffoldId.startsWith("tanstack-start");
   try {
-    const pkg = await Bun.file(path7.join(dir, "package.json")).json();
+    const pkg = await Bun.file(path4.join(dir, "package.json")).json();
     return Boolean(pkg?.dependencies?.["@tanstack/react-start"] ?? pkg?.devDependencies?.["@tanstack/react-start"]);
   } catch {
     return false;
@@ -14486,21 +13934,21 @@ function Gate({ children }: { children: ReactNode }) {
 `;
 }
 async function executeStart(dir) {
-  await mkdir2(path7.join(dir, "src", "lib"), { recursive: true });
-  await mkdir2(path7.join(dir, "src", "components", "auth"), {
+  await mkdir2(path4.join(dir, "src", "lib"), { recursive: true });
+  await mkdir2(path4.join(dir, "src", "components", "auth"), {
     recursive: true
   });
-  await mkdir2(path7.join(dir, "src", "routes", "auth", "netsuite"), {
+  await mkdir2(path4.join(dir, "src", "routes", "auth", "netsuite"), {
     recursive: true
   });
-  await mkdir2(path7.join(dir, "src", "routes", "api"), { recursive: true });
+  await mkdir2(path4.join(dir, "src", "routes", "api"), { recursive: true });
   const schemaImports = `import { sql } from 'drizzle-orm'
 import { integer, sqliteTable, text } from 'drizzle-orm/sqlite-core'
 `;
-  const schemaPath = path7.join(dir, "src", "db", "schema.ts");
+  const schemaPath = path4.join(dir, "src", "db", "schema.ts");
   let schemaAppended = false;
   try {
-    const current = await readFile3(schemaPath, "utf8");
+    const current = await readFile(schemaPath, "utf8");
     if (!current.includes("netsuite_flows")) {
       const hasImports = /^import .*drizzle-orm/m.test(current);
       await Bun.write(schemaPath, (hasImports ? current : schemaImports + current) + schemaAppend());
@@ -14511,41 +13959,41 @@ import { integer, sqliteTable, text } from 'drizzle-orm/sqlite-core'
     schemaAppended = true;
   }
   const files = [
-    [path7.join("src", "lib", "netsuite-server.ts"), netsuiteServerTs()],
+    [path4.join("src", "lib", "netsuite-server.ts"), netsuiteServerTs()],
     [
-      path7.join("src", "routes", "auth", "netsuite", "start.ts"),
+      path4.join("src", "routes", "auth", "netsuite", "start.ts"),
       startRouteTs()
     ],
     [
-      path7.join("src", "routes", "auth", "netsuite", "callback.ts"),
+      path4.join("src", "routes", "auth", "netsuite", "callback.ts"),
       callbackRouteTs()
     ],
     [
-      path7.join("src", "routes", "auth", "netsuite", "logout.ts"),
+      path4.join("src", "routes", "auth", "netsuite", "logout.ts"),
       logoutRouteTs()
     ],
     [
-      path7.join("src", "routes", "auth", "netsuite", "config.ts"),
+      path4.join("src", "routes", "auth", "netsuite", "config.ts"),
       configRouteTs()
     ],
-    [path7.join("src", "routes", "api", "me.ts"), meRouteTs()],
-    [path7.join("src", "lib", "netsuite.ts"), netsuiteClientTs()],
-    [path7.join("src", "lib", "auth.tsx"), startAuthTsx()],
+    [path4.join("src", "routes", "api", "me.ts"), meRouteTs()],
+    [path4.join("src", "lib", "netsuite.ts"), netsuiteClientTs()],
+    [path4.join("src", "lib", "auth.tsx"), startAuthTsx()],
     [
-      path7.join("src", "components", "auth", "AuthLayout.tsx"),
+      path4.join("src", "components", "auth", "AuthLayout.tsx"),
       startAuthLayoutTsx()
     ],
     [
-      path7.join("src", "components", "auth", "LoginPage.tsx"),
+      path4.join("src", "components", "auth", "LoginPage.tsx"),
       startLoginPageTsx()
     ],
     [
-      path7.join("src", "components", "auth", "SignInWithNetSuite.tsx"),
+      path4.join("src", "components", "auth", "SignInWithNetSuite.tsx"),
       startSignInButtonTsx()
     ]
   ];
   for (const [filePath, content] of files) {
-    await Bun.write(path7.join(dir, filePath), content);
+    await Bun.write(path4.join(dir, filePath), content);
   }
   return [
     `Wrote ${files.length} NetSuite files${schemaAppended ? " + appended src/db/schema.ts" : ""}:`,
@@ -14594,27 +14042,27 @@ import { integer, sqliteTable, text } from 'drizzle-orm/sqlite-core'
 `);
 }
 async function executeSpa(dir) {
-  await mkdir2(path7.join(dir, "src", "components", "auth"), {
+  await mkdir2(path4.join(dir, "src", "components", "auth"), {
     recursive: true
   });
   const nsFiles = [
-    [path7.join("src", "lib", "netsuite.ts"), spaNetsuiteTs()],
-    [path7.join("src", "lib", "auth.tsx"), spaAuthTsx()],
+    [path4.join("src", "lib", "netsuite.ts"), spaNetsuiteTs()],
+    [path4.join("src", "lib", "auth.tsx"), spaAuthTsx()],
     [
-      path7.join("src", "components", "auth", "AuthLayout.tsx"),
+      path4.join("src", "components", "auth", "AuthLayout.tsx"),
       spaAuthLayoutTsx()
     ],
     [
-      path7.join("src", "components", "auth", "LoginPage.tsx"),
+      path4.join("src", "components", "auth", "LoginPage.tsx"),
       spaLoginPageTsx()
     ],
     [
-      path7.join("src", "components", "auth", "SignInWithNetSuite.tsx"),
+      path4.join("src", "components", "auth", "SignInWithNetSuite.tsx"),
       spaSignInButtonTsx()
     ]
   ];
   for (const [filePath, content] of nsFiles) {
-    await Bun.write(path7.join(dir, filePath), content);
+    await Bun.write(path4.join(dir, filePath), content);
   }
   return [
     `Wrote ${nsFiles.length} NetSuite OAuth files (all additive, nothing overwritten):`,
@@ -14661,7 +14109,6 @@ var SetupNetsuitePlugin = async () => {
 export {
   SyntaxCheckPlugin,
   SetupNetsuitePlugin,
-  SetupAuthenticationPlugin,
   ScaffoldPlugin,
   RemovePlugin,
   InspectHttpPlugin