@helloleo/plugins 0.2.29 → 0.2.31-beta.0

package/dist/templates/{tanstack-start-2026-09-11 → tanstack-start-2026-09-29}/bun.lock

@@ -62,7 +62,7 @@
       "devDependencies": {
         "@cloudflare/vite-plugin": "1.54.4",
         "@cloudflare/workers-types": "5.20260908.1",
-        "@helloleo/vite-config": "0.1.6",
+        "@helloleo/vite-config": "0.1.7",
         "@libsql/client": "0.17.4",
         "@tailwindcss/typography": "0.5.20",
         "@tanstack/router-cli": "1.167.34",
@@ -206,7 +206,7 @@
 
     "@helloleo/runtime": ["@helloleo/runtime@0.1.6", "", { "dependencies": { "aws4fetch": "^1.0.20" }, "peerDependencies": { "@libsql/client": "*", "drizzle-orm": "^0.45.2" }, "optionalPeers": ["@libsql/client"] }, "sha512-oH5v5cZ0xMB8/IOg3VsJ2OpoG9Bod6D8UXjR2IGjFKAwx3vj62phit+3daJ9Wwpn3EuX4+BHs84swLfsOW3reg=="],
 
-    "@helloleo/vite-config": ["@helloleo/vite-config@0.1.6", "", { "peerDependencies": { "@cloudflare/vite-plugin": "*", "@tailwindcss/vite": "*", "@tanstack/react-start": "*", "@tanstack/router-plugin": "*", "@vitejs/plugin-react": "*", "vite": "*" } }, "sha512-W/B7vXXo/4qTRvisDv379fkVyoaiKu2JJ+T7+iA45PPJfct1i78pZQTomEy36V2u8beS3F7ZImYogePjfCUqSw=="],
+    "@helloleo/vite-config": ["@helloleo/vite-config@0.1.7", "", { "peerDependencies": { "@cloudflare/vite-plugin": "*", "@tailwindcss/vite": "*", "@tanstack/react-start": "*", "@tanstack/router-plugin": "*", "@vitejs/plugin-react": "*", "vite": "*" } }, "sha512-couH35PuS5qN11tYvEJBl/ccdoP0Zec3KaUwc5vMGeihNd82k2bRqIAZGEGqAF2YJPjGr74mK/0vglCGDIT8Aw=="],
 
     "@hookform/resolvers": ["@hookform/resolvers@5.9.1", "", { "dependencies": { "@standard-schema/utils": "^0.3.0" }, "peerDependencies": { "@sinclair/typebox": ">=0.25.24", "@standard-schema/spec": "^1.0.0", "@typeschema/main": ">=0.13.7", "@vinejs/vine": "^2.0.0 || ^3.0.0 || ^4.0.0", "ajv": "^8.12.0", "ajv-errors": "^3.0.0", "ajv-formats": "^2.1.1", "arktype": "^2.0.0", "ata-validator": "^1.2.0", "class-transformer": ">=0.4.0", "class-validator": ">=0.12.0", "computed-types": "^1.0.0", "effect": "^3.10.3", "fluentvalidation-ts": "^3.0.0", "fp-ts": "^2.7.0", "io-ts": "^2.0.0", "joi": "^17.0.0 || ^18.0.0", "nope-validator": ">=0.12.0", "react-hook-form": "^7.55.0", "superstruct": ">=0.12.0", "typanion": "^3.3.2", "valibot": ">=0.31.0 || ^1.0.0-beta.4 || ^1.0.0-rc", "vest": ">=6.0.0", "yup": "^1.0.0", "zod": "^3.25.0 || ^4.0.0" }, "optionalPeers": ["@sinclair/typebox", "@standard-schema/spec", "@typeschema/main", "@vinejs/vine", "ajv", "ajv-errors", "ajv-formats", "arktype", "ata-validator", "class-transformer", "class-validator", "computed-types", "effect", "fluentvalidation-ts", "fp-ts", "io-ts", "joi", "nope-validator", "superstruct", "typanion", "valibot", "vest", "yup", "zod"] }, "sha512-7b7vsbraJxKgjVSA1Nur9tLwj539WGJUBLA7QNvXnFoT2pM5Z7G+6rlukk4B2/QrTZy6huRtH6wKeESPKuIr6w=="],
 

package/dist/templates/{tanstack-start-2026-09-11 → tanstack-start-2026-09-29}/bunfig.toml

@@ -8,4 +8,4 @@
 # install the runtime it was just scaffolded against.
 [install]
 minimumReleaseAge = 259200
-minimumReleaseAgeExcludes = ["@helloleo/runtime", "@helloleo/plugins"]
+minimumReleaseAgeExcludes = ["@helloleo/runtime", "@helloleo/vite-config", "@helloleo/plugins"]

package/dist/templates/{tanstack-start-2026-09-11 → tanstack-start-2026-09-29}/package.json

@@ -72,7 +72,7 @@
   "devDependencies": {
     "@cloudflare/vite-plugin": "1.54.4",
     "@cloudflare/workers-types": "5.20260908.1",
-    "@helloleo/vite-config": "0.1.6",
+    "@helloleo/vite-config": "0.1.7",
     "@libsql/client": "0.17.4",
     "@tailwindcss/typography": "0.5.20",
     "drizzle-kit": "0.31.10",

package/dist/templates/tanstack-start-2026-09-29/src/lib/proxy.server.ts

@@ -0,0 +1,204 @@
+import '@tanstack/react-start/server-only'
+import { env } from '@helloleo/runtime'
+
+/*
+ * HelloLeo Integration Proxy: server-side helper for connected integrations.
+ *
+ * All third-party APIs (Odoo, Airtable, HubSpot, Stripe, Notion, Gladia,
+ * Microsoft 365, Klaviyo, Supabase, DimoMaint, etc.) are reachable through
+ * this single proxy. The proxy holds the credentials the user configured in
+ * Project Settings -- you NEVER pass an integration's API key yourself, and you
+ * NEVER call third-party hosts directly.
+ *
+ * SERVER-ONLY. Every call carries this project's HELLOLEO_API_KEY, which only
+ * exists on the server. Importing this file from browser code fails the build
+ * (the import above, plus the .server.ts name). Call it from a server route
+ * under src/routes/api/ and fetch that route from the page with react-query:
+ *
+ *   // src/routes/api/products.ts
+ *   import { createFileRoute } from '@tanstack/react-router'
+ *   import { callIntegration } from '#/lib/proxy.server'
+ *
+ *   export const Route = createFileRoute('/api/products')({
+ *     server: {
+ *       handlers: {
+ *         GET: async () => {
+ *           const r = await callIntegration({
+ *             integration: 'odoo',
+ *             endpoint: '/jsonrpc',
+ *             body: {
+ *               model: 'product.template',
+ *               method: 'search_read',
+ *               args: [[['type', '=', 'consu']]],
+ *               kwargs: { fields: ['name', 'list_price'], limit: 50 },
+ *             },
+ *           })
+ *           if (!r.success) return Response.json({ error: r.data }, { status: 502 })
+ *           return Response.json(r.data?.result ?? [])
+ *         },
+ *       },
+ *     },
+ *   })
+ *
+ * One route per operation the app needs. NEVER write a route that forwards
+ * `integration`, `endpoint`, `model`, `method` or a raw body from the request
+ * to callIntegration: that hands every visitor the user's full integration
+ * access, with this project's key attached.
+ *
+ * Integration slugs:
+ *   Use the exact slug from the Enabled MCP list with the "pipedream-"
+ *   prefix removed. e.g. "pipedream-gorgias_oauth" -> "gorgias_oauth".
+ *   Native integrations (odoo, airtable) keep their plain name.
+ *
+ * Response shape (always wrapped):
+ *   { success: boolean, status: number, data: <provider payload>, docs: string }
+ *
+ *   - `status` is the UPSTREAM status, not the proxy's.
+ *   - `success` is false whenever that status is >= 400.
+ *   - `data` is null when the upstream returned no body.
+ *   - `docs` links the proxy's own reference.
+ *
+ *   Unwrap "data" by provider:
+ *     odoo            -> data.result
+ *     airtable        -> data.records
+ *     notion          -> data.results
+ *     microsoft 365   -> data.value
+ *     klaviyo         -> data.data
+ *     supabase / dimomaint -> data
+ *
+ *   A 401 with code "api_key_missing" or "api_key_invalid" comes from the
+ *   proxy itself: the call ran without this project's key. Its `llm` field
+ *   says what to change.
+ *
+ * Pagination: put query params directly in the endpoint string,
+ *   e.g. endpoint: '/api/tickets?cursor=xyz&per_page=100'.
+ *   Read pagination metadata from the response to build the next call.
+ *   Never .filter() large lists in the page -- paginate in the route.
+ *
+ * Sending files:
+ *   Most APIs take a file as base64 inside the normal JSON body. Odoo is the
+ *   common case: ir.attachment.create with the bytes in `datas` and BOTH
+ *   `res_model` and `res_id` set, or the file is stored but appears on no
+ *   record. Nothing special is needed for those.
+ *
+ *   Some upload endpoints accept only multipart/form-data and answer JSON with
+ *   HTTP 415. For those set bodyEncoding: 'multipart' (see uploadFile below).
+ *   Never set a Content-Type header for multipart, the proxy lets fetch
+ *   generate the boundary. Not accepted for odoo, which has no multipart API.
+ *
+ *   Either way the browser POSTs the file to one of the app's own routes as
+ *   FormData; the route reads it with `await request.formData()` and encodes
+ *   it with fileToBase64 below.
+ *
+ * Secrets for non-integration APIs (e.g. raw OpenAI): store them in the
+ * project's Variables and read them via `env` from @helloleo/runtime, in
+ * server code only.
+ */
+
+export const INTEGRATION_PROXY_URL = '{{LEO_INTEGRATION_PROXY_URL}}'
+
+// This project's key, issued by HelloLeo per target and injected into the
+// server env: the preview holds one value, the published app another. The
+// proxy reads which one it got to pick the integration connection, so the
+// published app talks to production and the preview to development with no
+// flag to set. Not in @helloleo/runtime's RuntimeEnv, hence the local shape.
+const platformEnv = env as unknown as { HELLOLEO_API_KEY?: string }
+
+function proxyHeaders(): Record<string, string> {
+  const headers: Record<string, string> = { 'Content-Type': 'application/json' }
+  const key = platformEnv.HELLOLEO_API_KEY
+  if (key) headers.Authorization = `Bearer ${key}`
+  return headers
+}
+
+export interface MultipartFile {
+  /** Form field name the upstream expects, e.g. 'content' or 'file'. */
+  name: string
+  filename: string
+  contentType?: string
+  /** File bytes, base64-encoded (no data: prefix). */
+  dataBase64: string
+}
+
+export interface MultipartBody {
+  fields?: Record<string, string>
+  files?: MultipartFile[]
+}
+
+export interface ProxyRequest {
+  integration: string
+  endpoint: string
+  method?: 'GET' | 'POST' | 'PUT' | 'PATCH' | 'DELETE'
+  body?: unknown
+  headers?: Record<string, string>
+  /** Omit for JSON. 'multipart' when the upstream upload endpoint rejects JSON with 415. */
+  bodyEncoding?: 'json' | 'multipart'
+}
+
+export interface ProxyResponse<T = unknown> {
+  success: boolean
+  /** The UPSTREAM status, not the proxy's. */
+  status: number
+  /** Null when the upstream returned no body. */
+  data: T | null
+  /** The proxy's own reference, on every response. */
+  docs: string
+}
+
+export async function callIntegration<T = unknown>(
+  req: ProxyRequest,
+): Promise<ProxyResponse<T>> {
+  if (req.integration.toLowerCase() === 'netsuite') {
+    throw new Error(
+      "NetSuite is not proxied -- call it from this app's own /auth/netsuite + " +
+        "/api server routes with the signed-in user's session, not callIntegration().",
+    )
+  }
+  const res = await fetch(INTEGRATION_PROXY_URL, {
+    method: 'POST',
+    headers: proxyHeaders(),
+    body: JSON.stringify({ method: 'POST', ...req }),
+  })
+  return res.json()
+}
+
+/**
+ * Upload a file to an integration whose endpoint requires multipart/form-data
+ * (Zoho WorkDrive and similar). For Odoo, do NOT use this -- create an
+ * ir.attachment with the bytes base64-encoded in `datas` instead.
+ */
+export async function uploadFile<T = unknown>(
+  req: Omit<ProxyRequest, 'body' | 'bodyEncoding'> & { body: MultipartBody },
+): Promise<ProxyResponse<T>> {
+  return callIntegration<T>({ method: 'POST', ...req, bodyEncoding: 'multipart' })
+}
+
+export async function fileToBase64(file: Blob): Promise<string> {
+  const bytes = new Uint8Array(await file.arrayBuffer())
+  let binary = ''
+  for (let i = 0; i < bytes.length; i += 1) binary += String.fromCharCode(bytes[i])
+  return btoa(binary)
+}
+
+/* Example -- multipart upload (Zoho WorkDrive), inside a POST route handler:
+ *
+ *   POST: async ({ request }) => {
+ *     const form = await request.formData()
+ *     const file = form.get('file') as File
+ *     const r = await uploadFile({
+ *       integration: 'zoho_workdrive',
+ *       endpoint: '/api/v1/upload',
+ *       body: {
+ *         fields: { parent_id: FOLDER_ID, 'override-name-exist': 'true' },
+ *         files: [{
+ *           name: 'content',
+ *           filename: file.name,
+ *           contentType: file.type,
+ *           dataBase64: await fileToBase64(file),
+ *         }],
+ *       },
+ *     })
+ *     if (!r.success) return Response.json({ error: r.data }, { status: 502 })
+ *     return Response.json(r.data)
+ *   }
+ */

package/dist/templates/{tanstack-start-2026-09-11 → tanstack-start-2026-09-29}/vite.config.ts

@@ -4,14 +4,9 @@ import { defineConfig } from '@helloleo/vite-config'
 // aliases `cloudflare:workers` -> @helloleo/runtime/cf-shim (libsql .dev.db for
 // D1+KV, local disk for R2) and runs plain Vite SSR; at build it adds
 // @cloudflare/vite-plugin to emit a workerd Worker bound to wrangler.jsonc. It
-// also binds host:true/port:5173 itself (>=0.1.2).
+// also binds host:true/port:5173 itself (>=0.1.2) and blocks *.server.* files
+// from the client bundle (>=0.1.7).
 //
-// The one thing the wrapper doesn't set: HMR over the HelloLeo preview proxy,
-// which terminates HTTPS on :443 — so point the HMR client at wss://…:443.
-export default defineConfig({
-  vite: {
-    server: {
-      hmr: { clientPort: 443, protocol: 'wss' },
-    },
-  },
-})
+// No HMR override: with no clientPort set, the Vite client connects back to the
+// page's own origin, which is wss://…:443 behind the preview proxy.
+export default defineConfig()

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@helloleo/plugins",
-  "version": "0.2.29",
+  "version": "0.2.31-beta.0",
   "description": "OpenCode plugins for HelloLeo",
   "license": "UNLICENSED",
   "type": "module",
@@ -15,7 +15,7 @@
     "access": "public"
   },
   "scripts": {
-    "build": "rm -rf dist && bun build src/index.ts --outdir dist --target bun --format esm && bun run scripts/copy-templates.ts",
+    "build": "rm -rf dist && bun build src/index.ts src/cli.ts --outdir dist --target bun --format esm && bun run scripts/copy-templates.ts",
     "format": "bunx --bun @biomejs/biome format --write src",
     "lint": "bunx --bun @biomejs/biome lint --write src",
     "check": "bunx --bun @biomejs/biome check --write src",

package/dist/templates/tanstack-start-2026-09-11/src/lib/proxy.ts

@@ -1,182 +0,0 @@
-/*
- * HelloLeo Integration Proxy: runtime helper for connected integrations.
- *
- * All third-party APIs (Odoo, Airtable, HubSpot, Stripe, Notion, Gladia,
- * Microsoft 365, Klaviyo, Supabase, DimoMaint, etc.) are reachable through
- * this single proxy. The proxy handles auth and CORS using credentials the
- * user already configured in Project Settings -- you NEVER pass an API key
- * from frontend code, and you NEVER call third-party hosts directly.
- *
- * Two modes:
- *   A) Frontend-only project -> import callIntegration() from this file.
- *   B) HelloLeo Cloud project -> route via Worker fetch(env.INTEGRATION_PROXY).
- *      Use Cloud whenever the project needs backend logic, automations,
- *      webhooks, scheduled jobs, or AI agents. Keep secrets server-side.
- *
- * Integration slugs:
- *   Use the exact slug from the Enabled MCP list with the "pipedream-"
- *   prefix removed. e.g. "pipedream-gorgias_oauth" -> "gorgias_oauth".
- *   Native integrations (odoo, airtable) keep their plain name.
- *
- * Response shape (always wrapped):
- *   { success: boolean, status: number, data: <provider payload>, docs: string }
- *
- *   - `status` is the UPSTREAM status, not the proxy's.
- *   - `success` is false whenever that status is >= 400.
- *   - `data` is null when the upstream returned no body.
- *   - `docs` links the proxy's own reference.
- *
- *   Unwrap "data" by provider:
- *     odoo            -> data.result
- *     airtable        -> data.records
- *     notion          -> data.results
- *     microsoft 365   -> data.value
- *     klaviyo         -> data.data
- *     supabase / dimomaint -> data
- *
- * Pagination: put query params directly in the endpoint string,
- *   e.g. endpoint: '/api/tickets?cursor=xyz&per_page=100'.
- *   Read pagination metadata from the response to build the next call.
- *   Never .filter() large lists in the frontend -- paginate server-side.
- *
- * Sending files:
- *   Most APIs take a file as base64 inside the normal JSON body. Odoo is the
- *   common case: ir.attachment.create with the bytes in `datas` and BOTH
- *   `res_model` and `res_id` set, or the file is stored but appears on no
- *   record. Nothing special is needed for those.
- *
- *   Some upload endpoints accept only multipart/form-data and answer JSON with
- *   HTTP 415. For those set bodyEncoding: 'multipart' (see uploadFile below).
- *   Never set a Content-Type header for multipart, the proxy lets fetch
- *   generate the boundary. Not accepted for odoo, which has no multipart API.
- *
- * Secrets for non-integration APIs (e.g. raw OpenAI): store them in
- * HelloLeo Cloud -> Settings -> Cloud -> Secrets, and read via env.SECRET_NAME
- * from a Worker. Never embed secrets in frontend code.
- */
-
-export const INTEGRATION_PROXY_URL = '{{LEO_INTEGRATION_PROXY_URL}}';
-
-// Multi-environment integrations: the published HelloLeo Cloud Worker has
-// HELLOLEO_ENV=production injected at publish. Forwarding `?env=production`
-// makes the proxy resolve credentials from the project's PRODUCTION integration
-// connection (e.g. your production Odoo) instead of the development one, so a
-// published app talks to production while the preview keeps talking to staging.
-//
-// Reads the flag from the server runtime (Cloudflare Worker / Node) when
-// available; in the browser it's absent and we send no param — the proxy then
-// derives the environment from the request origin, so client-side calls from
-// the published app still resolve to production. Server-side calls (SSR / Cloud
-// Worker) carry no browser origin, which is exactly why the explicit param
-// matters there.
-function proxyUrl(): string {
-  // Read via globalThis only (no bare `process` reference) so this compiles in
-  // any scaffolded project regardless of whether node types are present.
-  const g = globalThis as {
-    HELLOLEO_ENV?: string;
-    process?: { env?: Record<string, string | undefined> };
-  };
-  const env = g.HELLOLEO_ENV ?? g.process?.env?.HELLOLEO_ENV;
-  return env === 'production' ? `${INTEGRATION_PROXY_URL}?env=production` : INTEGRATION_PROXY_URL;
-}
-
-export interface MultipartFile {
-  /** Form field name the upstream expects, e.g. 'content' or 'file'. */
-  name: string;
-  filename: string;
-  contentType?: string;
-  /** File bytes, base64-encoded (no data: prefix). */
-  dataBase64: string;
-}
-
-export interface MultipartBody {
-  fields?: Record<string, string>;
-  files?: MultipartFile[];
-}
-
-export interface ProxyRequest {
-  integration: string;
-  endpoint: string;
-  method?: 'GET' | 'POST' | 'PUT' | 'PATCH' | 'DELETE';
-  body?: unknown;
-  headers?: Record<string, string>;
-  /** Omit for JSON. 'multipart' when the upstream upload endpoint rejects JSON with 415. */
-  bodyEncoding?: 'json' | 'multipart';
-}
-
-export interface ProxyResponse<T = unknown> {
-  success: boolean;
-  /** The UPSTREAM status, not the proxy's. */
-  status: number;
-  /** Null when the upstream returned no body. */
-  data: T | null;
-  /** The proxy's own reference, on every response. */
-  docs: string;
-}
-
-export async function callIntegration<T = unknown>(
-  req: ProxyRequest,
-): Promise<ProxyResponse<T>> {
-  if (req.integration.toLowerCase() === 'netsuite') {
-    throw new Error(
-      'NetSuite is not proxied -- call it from this app\'s own /auth/netsuite + ' +
-        '/api server routes with the signed-in user\'s session, not callIntegration().',
-    );
-  }
-  const res = await fetch(proxyUrl(), {
-    method: 'POST',
-    headers: { 'Content-Type': 'application/json' },
-    body: JSON.stringify({ method: 'POST', ...req }),
-  });
-  return res.json();
-}
-
-/**
- * Upload a file to an integration whose endpoint requires multipart/form-data
- * (Zoho WorkDrive and similar). For Odoo, do NOT use this -- create an
- * ir.attachment with the bytes base64-encoded in `datas` instead.
- */
-export async function uploadFile<T = unknown>(
-  req: Omit<ProxyRequest, 'body' | 'bodyEncoding'> & { body: MultipartBody },
-): Promise<ProxyResponse<T>> {
-  return callIntegration<T>({ method: 'POST', ...req, bodyEncoding: 'multipart' });
-}
-
-export async function fileToBase64(file: Blob): Promise<string> {
-  const bytes = new Uint8Array(await file.arrayBuffer());
-  let binary = '';
-  for (let i = 0; i < bytes.length; i += 1) binary += String.fromCharCode(bytes[i]);
-  return btoa(binary);
-}
-
-/* Example -- Odoo search_read:
- *
- *   const r = await callIntegration({
- *     integration: 'odoo',
- *     endpoint: '/jsonrpc',
- *     body: {
- *       model: 'product.template',
- *       method: 'search_read',
- *       args: [[['type', '=', 'consu']]],
- *       kwargs: { fields: ['name', 'list_price'], limit: 50 },
- *     },
- *   });
- *   const products = r.data?.result ?? [];
- *
- * Example -- multipart upload (Zoho WorkDrive):
- *
- *   const r = await uploadFile({
- *     integration: 'zoho_workdrive',
- *     endpoint: '/api/v1/upload',
- *     body: {
- *       fields: { parent_id: folderId, 'override-name-exist': 'true' },
- *       files: [{
- *         name: 'content',
- *         filename: file.name,
- *         contentType: file.type,
- *         dataBase64: await fileToBase64(file),
- *       }],
- *     },
- *   });
- *   if (!r.success) throw new Error(String(r.data));
- */