@helloleo/plugins 0.2.30 → 0.2.31-beta.0

package/dist/cli.js

@@ -12367,7 +12367,7 @@ async function renderTemplate(templateId, vars, destDir) {
 }
 
 // src/tools/scaffold.ts
-var SCAFFOLD_VERSION = "tanstack-start-2026-09-11";
+var SCAFFOLD_VERSION = "tanstack-start-2026-09-29";
 function resolveTemplateId() {
   return SCAFFOLD_VERSION;
 }
@@ -12427,6 +12427,7 @@ var SCAFFOLD_NOTES = [
   "- The database schema lives in src/db/schema.ts and is the single source of truth. Migration files under drizzle/ are generated and applied automatically. Never create, edit or delete them.",
   "- Never rename existing tables or columns in schema.ts. Renames cannot be auto-migrated: no migration file is generated, the database keeps the old name, and every query against the new name fails at runtime with a 500. To reshape data, add a new column or table, write to it, and migrate old values in app code (e.g. fall back to the old column on read).",
   "- Persistence goes through @helloleo/runtime exclusively: database via #/db (see src/db/index.ts), key-value store via #/lib/kv (see src/lib/kv.ts), file storage via #/lib/storage (see src/lib/storage.ts -- uploads/downloads flow through your API routes; presigned URLs are NOT available), env/secrets via env from @helloleo/runtime. Read those files before server-side data work. Never install another DB/storage client, never import from cloudflare:workers, all of it is server-side only.",
+  "- Connected integrations (Odoo, Airtable, ...) go through src/lib/proxy.server.ts (callIntegration, uploadFile). Read its header first. It is server-only: import it from server routes under src/routes/api/, never from components. One route per operation; never write a route that forwards integration, endpoint, model, method or a raw body from the request.",
   "- Add routes as files in src/routes/. Do not default export route components. Routing and layout conventions are documented in src/routes/README.md, read it before adding routes.",
   "- shadcn/ui components are already in src/components/ui.",
   "- Design system: style exclusively with the token utilities, never hardcoded colors. To change the look, edit the token values in src/styles.css (light and dark blocks).",

package/dist/index.js

@@ -14,6 +14,33 @@ var __export = (target, all) => {
     });
 };
 
+// src/hooks/image-expiry.ts
+var KEEP_TURNS = 3;
+var EXPIRED_IMAGE_NOTE = "[A screenshot the user attached here was removed from context because the conversation has moved on. Do not refer to it. If you still need it, ask the user to share it again.]";
+function isUserTurn(m) {
+  return m.info.role === "user" && m.parts.some((p) => p.type === "text" && !p.synthetic && !p.ignored);
+}
+var ImageExpiryPlugin = async () => ({
+  "experimental.chat.messages.transform": async (_input, output) => {
+    let laterTurns = 0;
+    for (let i = output.messages.length - 1;i >= 0; i--) {
+      const m = output.messages[i];
+      const age = laterTurns;
+      if (isUserTurn(m))
+        laterTurns++;
+      if (m.info.role !== "user" || age < KEEP_TURNS)
+        continue;
+      m.parts = m.parts.map((p) => p.type === "file" && p.mime.startsWith("image/") ? {
+        id: p.id,
+        sessionID: p.sessionID,
+        messageID: p.messageID,
+        type: "text",
+        text: EXPIRED_IMAGE_NOTE,
+        synthetic: true
+      } : p);
+    }
+  }
+});
 // src/hooks/syntax-check.ts
 import { readFileSync, statSync } from "fs";
 import { relative } from "path";
@@ -116,6 +143,9 @@ var SyntaxCheckPlugin = async ({ worktree, directory }) => {
     }
   };
 };
+// src/tools/inspect-http.ts
+import path from "path";
+
 // node_modules/zod/v4/classic/external.js
 var exports_external = {};
 __export(exports_external, {
@@ -12490,6 +12520,11 @@ var inspectHttp = tool({
       Origin: "https://app.helloleo.dev",
       ...args.headers
     };
+    if (!hasHeader(requestHeaders, "authorization") && isOwnProxyUrl(url, path.basename(context.directory))) {
+      const key = await readWorkspaceEnv(context.directory, "HELLOLEO_API_KEY");
+      if (key)
+        requestHeaders.Authorization = `Bearer ${key}`;
+    }
     if (METHODS_AUTO_JSON.has(args.method) && args.body !== undefined && !hasHeader(requestHeaders, "content-type")) {
       requestHeaders["Content-Type"] = "application/json";
     }
@@ -12568,6 +12603,30 @@ function isPrivateHost(hostname) {
   const base = findHostBase(hostname);
   return base !== null && hosts[base].private;
 }
+function isOwnProxyUrl(url, projectUuid) {
+  if (!projectUuid || !isPrivateHost(url.hostname))
+    return false;
+  const pathname = url.pathname.replace(/\/+$/, "");
+  if (pathname === `/api/integration-proxy/${projectUuid}`)
+    return true;
+  const host = url.hostname.toLowerCase();
+  const isProxyHost = host === "proxy.helloleo.dev" || host.endsWith(".proxy.helloleo.dev");
+  return isProxyHost && pathname === `/${projectUuid}`;
+}
+async function readWorkspaceEnv(dir, key) {
+  try {
+    const text = await Bun.file(path.join(dir, ".env")).text();
+    for (const line of text.split(`
+`)) {
+      const match = line.match(/^\s*([A-Za-z_][A-Za-z0-9_]*)\s*=\s*(.*)$/);
+      if (match?.[1] === key) {
+        const value = match[2].trim().replace(/^["']|["']$/g, "");
+        return value || null;
+      }
+    }
+  } catch {}
+  return null;
+}
 function hasHeader(headers, name) {
   const target = name.toLowerCase();
   for (const key of Object.keys(headers)) {
@@ -12625,23 +12684,23 @@ var InspectHttpPlugin = async () => {
 };
 // src/tools/remove.ts
 import { unlink } from "fs/promises";
-import path from "path";
+import path2 from "path";
 var remove = tool({
   description: "Remove a file from the project. The file path must be relative to the project root. " + "This tool will ask for permission before deleting. " + "Cannot delete files outside the project boundary.",
   args: {
     filePath: tool.schema.string().describe("Relative path to the file to remove (e.g. src/App.tsx)")
   },
   async execute(args, context) {
-    const resolved = path.resolve(context.directory, args.filePath);
-    const normalized = path.normalize(resolved);
-    if (!normalized.startsWith(context.directory + path.sep) && normalized !== context.directory) {
+    const resolved = path2.resolve(context.directory, args.filePath);
+    const normalized = path2.normalize(resolved);
+    if (!normalized.startsWith(context.directory + path2.sep) && normalized !== context.directory) {
       throw new Error(`Path "${args.filePath}" resolves outside the project boundary. Deletion blocked.`);
     }
     const file = Bun.file(resolved);
     if (!await file.exists()) {
       throw new Error(`File not found: ${args.filePath}`);
     }
-    const relative = path.relative(context.directory, resolved);
+    const relative = path2.relative(context.directory, resolved);
     await context.ask({
       permission: "remove",
       patterns: [resolved],
@@ -12659,15 +12718,15 @@ var RemovePlugin = async () => {
 };
 // src/tools/scaffold.ts
 import { mkdir } from "fs/promises";
-import path3 from "path";
+import path4 from "path";
 // src/template-render.ts
-import path2 from "path";
+import path3 from "path";
 var {Glob } = globalThis.Bun;
-var TEMPLATES_ROOT = path2.join(import.meta.dir, "templates");
+var TEMPLATES_ROOT = path3.join(import.meta.dir, "templates");
 var TOKEN_RE = /\{\{(LEO_[A-Z0-9_]+)\}\}/g;
 var SKIP = /(^|\/)(node_modules|dist|dist-ssr|\.tanstack|\.output|bun\.lockb|package-lock\.json|yarn\.lock|pnpm-lock\.yaml)(\/|$)/;
 async function renderTemplate(templateId, vars, destDir) {
-  const root = path2.join(TEMPLATES_ROOT, templateId);
+  const root = path3.join(TEMPLATES_ROOT, templateId);
   const glob = new Glob("**/*");
   const created = [];
   for await (const rel of glob.scan({
@@ -12677,21 +12736,21 @@ async function renderTemplate(templateId, vars, destDir) {
   })) {
     if (SKIP.test(rel))
       continue;
-    const raw = await Bun.file(path2.join(root, rel)).text();
+    const raw = await Bun.file(path3.join(root, rel)).text();
     const content = raw.replace(TOKEN_RE, (_m, key) => vars[key] ?? "");
-    await Bun.write(path2.join(destDir, rel), content);
+    await Bun.write(path3.join(destDir, rel), content);
     created.push(rel);
   }
   return created.sort();
 }
 
 // src/tools/scaffold.ts
-var SCAFFOLD_VERSION = "tanstack-start-2026-09-11";
+var SCAFFOLD_VERSION = "tanstack-start-2026-09-29";
 function resolveTemplateId() {
   return SCAFFOLD_VERSION;
 }
 function projectUuidFromDir(dir) {
-  return path3.basename(dir);
+  return path4.basename(dir);
 }
 function integrationProxyBase() {
   return (process.env.PLUGINS_INTEGRATION_PROXY_URL || "https://api.app.helloleo.dev").replace(/\/+$/, "");
@@ -12713,10 +12772,10 @@ class AlreadyScaffoldedError extends Error {
   }
 }
 async function existingScaffold(dir) {
-  if (!await Bun.file(path3.join(dir, "package.json")).exists())
+  if (!await Bun.file(path4.join(dir, "package.json")).exists())
     return null;
   try {
-    const meta = await Bun.file(path3.join(dir, ".leo", "project.json")).json();
+    const meta = await Bun.file(path4.join(dir, ".leo", "project.json")).json();
     return typeof meta?.scaffold === "string" ? meta.scaffold : "legacy";
   } catch {
     return "legacy";
@@ -12735,9 +12794,9 @@ async function writeBaseScaffold({ name, description }, dir) {
     LEO_PROJECT_UUID: projectUuid,
     LEO_INTEGRATION_PROXY_URL: `${integrationProxyBase()}/api/integration-proxy/${projectUuid}`
   }, dir);
-  await mkdir(path3.join(dir, ".leo"), { recursive: true });
-  const leoPath = path3.join(".leo", "project.json");
-  await Bun.write(path3.join(dir, leoPath), JSON.stringify({ $schema: 1, scaffold: templateId }, null, 2));
+  await mkdir(path4.join(dir, ".leo"), { recursive: true });
+  const leoPath = path4.join(".leo", "project.json");
+  await Bun.write(path4.join(dir, leoPath), JSON.stringify({ $schema: 1, scaffold: templateId }, null, 2));
   return [...created, leoPath];
 }
 var SCAFFOLD_NOTES = [
@@ -12746,6 +12805,7 @@ var SCAFFOLD_NOTES = [
   "- The database schema lives in src/db/schema.ts and is the single source of truth. Migration files under drizzle/ are generated and applied automatically. Never create, edit or delete them.",
   "- Never rename existing tables or columns in schema.ts. Renames cannot be auto-migrated: no migration file is generated, the database keeps the old name, and every query against the new name fails at runtime with a 500. To reshape data, add a new column or table, write to it, and migrate old values in app code (e.g. fall back to the old column on read).",
   "- Persistence goes through @helloleo/runtime exclusively: database via #/db (see src/db/index.ts), key-value store via #/lib/kv (see src/lib/kv.ts), file storage via #/lib/storage (see src/lib/storage.ts -- uploads/downloads flow through your API routes; presigned URLs are NOT available), env/secrets via env from @helloleo/runtime. Read those files before server-side data work. Never install another DB/storage client, never import from cloudflare:workers, all of it is server-side only.",
+  "- Connected integrations (Odoo, Airtable, ...) go through src/lib/proxy.server.ts (callIntegration, uploadFile). Read its header first. It is server-only: import it from server routes under src/routes/api/, never from components. One route per operation; never write a route that forwards integration, endpoint, model, method or a raw body from the request.",
   "- Add routes as files in src/routes/. Do not default export route components. Routing and layout conventions are documented in src/routes/README.md, read it before adding routes.",
   "- shadcn/ui components are already in src/components/ui.",
   "- Design system: style exclusively with the token utilities, never hardcoded colors. To change the look, edit the token values in src/styles.css (light and dark blocks).",
@@ -12800,10 +12860,10 @@ var ScaffoldPlugin = async () => {
 };
 // src/tools/setup-netsuite.ts
 import { mkdir as mkdir2, readFile } from "fs/promises";
-import path4 from "path";
+import path5 from "path";
 async function readScaffoldId(dir) {
   try {
-    const meta = await Bun.file(path4.join(dir, ".leo", "project.json")).json();
+    const meta = await Bun.file(path5.join(dir, ".leo", "project.json")).json();
     return typeof meta?.scaffold === "string" ? meta.scaffold : null;
   } catch {
     return null;
@@ -12814,7 +12874,7 @@ async function isStartScaffold(dir) {
   if (scaffoldId)
     return scaffoldId.startsWith("tanstack-start");
   try {
-    const pkg = await Bun.file(path4.join(dir, "package.json")).json();
+    const pkg = await Bun.file(path5.join(dir, "package.json")).json();
     return Boolean(pkg?.dependencies?.["@tanstack/react-start"] ?? pkg?.devDependencies?.["@tanstack/react-start"]);
   } catch {
     return false;
@@ -13975,18 +14035,18 @@ function Gate({ children }: { children: ReactNode }) {
 `;
 }
 async function executeStart(dir) {
-  await mkdir2(path4.join(dir, "src", "lib"), { recursive: true });
-  await mkdir2(path4.join(dir, "src", "components", "auth"), {
+  await mkdir2(path5.join(dir, "src", "lib"), { recursive: true });
+  await mkdir2(path5.join(dir, "src", "components", "auth"), {
     recursive: true
   });
-  await mkdir2(path4.join(dir, "src", "routes", "auth", "netsuite"), {
+  await mkdir2(path5.join(dir, "src", "routes", "auth", "netsuite"), {
     recursive: true
   });
-  await mkdir2(path4.join(dir, "src", "routes", "api"), { recursive: true });
+  await mkdir2(path5.join(dir, "src", "routes", "api"), { recursive: true });
   const schemaImports = `import { sql } from 'drizzle-orm'
 import { integer, sqliteTable, text } from 'drizzle-orm/sqlite-core'
 `;
-  const schemaPath = path4.join(dir, "src", "db", "schema.ts");
+  const schemaPath = path5.join(dir, "src", "db", "schema.ts");
   let schemaAppended = false;
   try {
     const current = await readFile(schemaPath, "utf8");
@@ -14000,41 +14060,41 @@ import { integer, sqliteTable, text } from 'drizzle-orm/sqlite-core'
     schemaAppended = true;
   }
   const files = [
-    [path4.join("src", "lib", "netsuite-server.ts"), netsuiteServerTs()],
+    [path5.join("src", "lib", "netsuite-server.ts"), netsuiteServerTs()],
     [
-      path4.join("src", "routes", "auth", "netsuite", "start.ts"),
+      path5.join("src", "routes", "auth", "netsuite", "start.ts"),
       startRouteTs()
     ],
     [
-      path4.join("src", "routes", "auth", "netsuite", "callback.ts"),
+      path5.join("src", "routes", "auth", "netsuite", "callback.ts"),
       callbackRouteTs()
     ],
     [
-      path4.join("src", "routes", "auth", "netsuite", "logout.ts"),
+      path5.join("src", "routes", "auth", "netsuite", "logout.ts"),
       logoutRouteTs()
     ],
     [
-      path4.join("src", "routes", "auth", "netsuite", "config.ts"),
+      path5.join("src", "routes", "auth", "netsuite", "config.ts"),
       configRouteTs()
     ],
-    [path4.join("src", "routes", "api", "me.ts"), meRouteTs()],
-    [path4.join("src", "lib", "netsuite.ts"), netsuiteClientTs()],
-    [path4.join("src", "lib", "auth.tsx"), startAuthTsx()],
+    [path5.join("src", "routes", "api", "me.ts"), meRouteTs()],
+    [path5.join("src", "lib", "netsuite.ts"), netsuiteClientTs()],
+    [path5.join("src", "lib", "auth.tsx"), startAuthTsx()],
     [
-      path4.join("src", "components", "auth", "AuthLayout.tsx"),
+      path5.join("src", "components", "auth", "AuthLayout.tsx"),
       startAuthLayoutTsx()
     ],
     [
-      path4.join("src", "components", "auth", "LoginPage.tsx"),
+      path5.join("src", "components", "auth", "LoginPage.tsx"),
       startLoginPageTsx()
     ],
     [
-      path4.join("src", "components", "auth", "SignInWithNetSuite.tsx"),
+      path5.join("src", "components", "auth", "SignInWithNetSuite.tsx"),
       startSignInButtonTsx()
     ]
   ];
   for (const [filePath, content] of files) {
-    await Bun.write(path4.join(dir, filePath), content);
+    await Bun.write(path5.join(dir, filePath), content);
   }
   return [
     `Wrote ${files.length} NetSuite files${schemaAppended ? " + appended src/db/schema.ts" : ""}:`,
@@ -14083,27 +14143,27 @@ import { integer, sqliteTable, text } from 'drizzle-orm/sqlite-core'
 `);
 }
 async function executeSpa(dir) {
-  await mkdir2(path4.join(dir, "src", "components", "auth"), {
+  await mkdir2(path5.join(dir, "src", "components", "auth"), {
     recursive: true
   });
   const nsFiles = [
-    [path4.join("src", "lib", "netsuite.ts"), spaNetsuiteTs()],
-    [path4.join("src", "lib", "auth.tsx"), spaAuthTsx()],
+    [path5.join("src", "lib", "netsuite.ts"), spaNetsuiteTs()],
+    [path5.join("src", "lib", "auth.tsx"), spaAuthTsx()],
     [
-      path4.join("src", "components", "auth", "AuthLayout.tsx"),
+      path5.join("src", "components", "auth", "AuthLayout.tsx"),
       spaAuthLayoutTsx()
     ],
     [
-      path4.join("src", "components", "auth", "LoginPage.tsx"),
+      path5.join("src", "components", "auth", "LoginPage.tsx"),
       spaLoginPageTsx()
     ],
     [
-      path4.join("src", "components", "auth", "SignInWithNetSuite.tsx"),
+      path5.join("src", "components", "auth", "SignInWithNetSuite.tsx"),
       spaSignInButtonTsx()
     ]
   ];
   for (const [filePath, content] of nsFiles) {
-    await Bun.write(path4.join(dir, filePath), content);
+    await Bun.write(path5.join(dir, filePath), content);
   }
   return [
     `Wrote ${nsFiles.length} NetSuite OAuth files (all additive, nothing overwritten):`,
@@ -14148,6 +14208,7 @@ var SetupNetsuitePlugin = async () => {
   };
 };
 export {
+  ImageExpiryPlugin,
   InspectHttpPlugin,
   RemovePlugin,
   ScaffoldPlugin,

package/dist/templates/{tanstack-start-2026-09-11 → tanstack-start-2026-09-29}/bun.lock

@@ -62,7 +62,7 @@
       "devDependencies": {
         "@cloudflare/vite-plugin": "1.54.4",
         "@cloudflare/workers-types": "5.20260908.1",
-        "@helloleo/vite-config": "0.1.6",
+        "@helloleo/vite-config": "0.1.7",
         "@libsql/client": "0.17.4",
         "@tailwindcss/typography": "0.5.20",
         "@tanstack/router-cli": "1.167.34",
@@ -206,7 +206,7 @@
 
     "@helloleo/runtime": ["@helloleo/runtime@0.1.6", "", { "dependencies": { "aws4fetch": "^1.0.20" }, "peerDependencies": { "@libsql/client": "*", "drizzle-orm": "^0.45.2" }, "optionalPeers": ["@libsql/client"] }, "sha512-oH5v5cZ0xMB8/IOg3VsJ2OpoG9Bod6D8UXjR2IGjFKAwx3vj62phit+3daJ9Wwpn3EuX4+BHs84swLfsOW3reg=="],
 
-    "@helloleo/vite-config": ["@helloleo/vite-config@0.1.6", "", { "peerDependencies": { "@cloudflare/vite-plugin": "*", "@tailwindcss/vite": "*", "@tanstack/react-start": "*", "@tanstack/router-plugin": "*", "@vitejs/plugin-react": "*", "vite": "*" } }, "sha512-W/B7vXXo/4qTRvisDv379fkVyoaiKu2JJ+T7+iA45PPJfct1i78pZQTomEy36V2u8beS3F7ZImYogePjfCUqSw=="],
+    "@helloleo/vite-config": ["@helloleo/vite-config@0.1.7", "", { "peerDependencies": { "@cloudflare/vite-plugin": "*", "@tailwindcss/vite": "*", "@tanstack/react-start": "*", "@tanstack/router-plugin": "*", "@vitejs/plugin-react": "*", "vite": "*" } }, "sha512-couH35PuS5qN11tYvEJBl/ccdoP0Zec3KaUwc5vMGeihNd82k2bRqIAZGEGqAF2YJPjGr74mK/0vglCGDIT8Aw=="],
 
     "@hookform/resolvers": ["@hookform/resolvers@5.9.1", "", { "dependencies": { "@standard-schema/utils": "^0.3.0" }, "peerDependencies": { "@sinclair/typebox": ">=0.25.24", "@standard-schema/spec": "^1.0.0", "@typeschema/main": ">=0.13.7", "@vinejs/vine": "^2.0.0 || ^3.0.0 || ^4.0.0", "ajv": "^8.12.0", "ajv-errors": "^3.0.0", "ajv-formats": "^2.1.1", "arktype": "^2.0.0", "ata-validator": "^1.2.0", "class-transformer": ">=0.4.0", "class-validator": ">=0.12.0", "computed-types": "^1.0.0", "effect": "^3.10.3", "fluentvalidation-ts": "^3.0.0", "fp-ts": "^2.7.0", "io-ts": "^2.0.0", "joi": "^17.0.0 || ^18.0.0", "nope-validator": ">=0.12.0", "react-hook-form": "^7.55.0", "superstruct": ">=0.12.0", "typanion": "^3.3.2", "valibot": ">=0.31.0 || ^1.0.0-beta.4 || ^1.0.0-rc", "vest": ">=6.0.0", "yup": "^1.0.0", "zod": "^3.25.0 || ^4.0.0" }, "optionalPeers": ["@sinclair/typebox", "@standard-schema/spec", "@typeschema/main", "@vinejs/vine", "ajv", "ajv-errors", "ajv-formats", "arktype", "ata-validator", "class-transformer", "class-validator", "computed-types", "effect", "fluentvalidation-ts", "fp-ts", "io-ts", "joi", "nope-validator", "superstruct", "typanion", "valibot", "vest", "yup", "zod"] }, "sha512-7b7vsbraJxKgjVSA1Nur9tLwj539WGJUBLA7QNvXnFoT2pM5Z7G+6rlukk4B2/QrTZy6huRtH6wKeESPKuIr6w=="],
 

package/dist/templates/{tanstack-start-2026-09-11 → tanstack-start-2026-09-29}/bunfig.toml

@@ -8,4 +8,4 @@
 # install the runtime it was just scaffolded against.
 [install]
 minimumReleaseAge = 259200
-minimumReleaseAgeExcludes = ["@helloleo/runtime", "@helloleo/plugins"]
+minimumReleaseAgeExcludes = ["@helloleo/runtime", "@helloleo/vite-config", "@helloleo/plugins"]

package/dist/templates/{tanstack-start-2026-09-11 → tanstack-start-2026-09-29}/package.json

@@ -72,7 +72,7 @@
   "devDependencies": {
     "@cloudflare/vite-plugin": "1.54.4",
     "@cloudflare/workers-types": "5.20260908.1",
-    "@helloleo/vite-config": "0.1.6",
+    "@helloleo/vite-config": "0.1.7",
     "@libsql/client": "0.17.4",
     "@tailwindcss/typography": "0.5.20",
     "drizzle-kit": "0.31.10",

package/dist/templates/tanstack-start-2026-09-29/src/lib/proxy.server.ts

@@ -0,0 +1,204 @@
+import '@tanstack/react-start/server-only'
+import { env } from '@helloleo/runtime'
+
+/*
+ * HelloLeo Integration Proxy: server-side helper for connected integrations.
+ *
+ * All third-party APIs (Odoo, Airtable, HubSpot, Stripe, Notion, Gladia,
+ * Microsoft 365, Klaviyo, Supabase, DimoMaint, etc.) are reachable through
+ * this single proxy. The proxy holds the credentials the user configured in
+ * Project Settings -- you NEVER pass an integration's API key yourself, and you
+ * NEVER call third-party hosts directly.
+ *
+ * SERVER-ONLY. Every call carries this project's HELLOLEO_API_KEY, which only
+ * exists on the server. Importing this file from browser code fails the build
+ * (the import above, plus the .server.ts name). Call it from a server route
+ * under src/routes/api/ and fetch that route from the page with react-query:
+ *
+ *   // src/routes/api/products.ts
+ *   import { createFileRoute } from '@tanstack/react-router'
+ *   import { callIntegration } from '#/lib/proxy.server'
+ *
+ *   export const Route = createFileRoute('/api/products')({
+ *     server: {
+ *       handlers: {
+ *         GET: async () => {
+ *           const r = await callIntegration({
+ *             integration: 'odoo',
+ *             endpoint: '/jsonrpc',
+ *             body: {
+ *               model: 'product.template',
+ *               method: 'search_read',
+ *               args: [[['type', '=', 'consu']]],
+ *               kwargs: { fields: ['name', 'list_price'], limit: 50 },
+ *             },
+ *           })
+ *           if (!r.success) return Response.json({ error: r.data }, { status: 502 })
+ *           return Response.json(r.data?.result ?? [])
+ *         },
+ *       },
+ *     },
+ *   })
+ *
+ * One route per operation the app needs. NEVER write a route that forwards
+ * `integration`, `endpoint`, `model`, `method` or a raw body from the request
+ * to callIntegration: that hands every visitor the user's full integration
+ * access, with this project's key attached.
+ *
+ * Integration slugs:
+ *   Use the exact slug from the Enabled MCP list with the "pipedream-"
+ *   prefix removed. e.g. "pipedream-gorgias_oauth" -> "gorgias_oauth".
+ *   Native integrations (odoo, airtable) keep their plain name.
+ *
+ * Response shape (always wrapped):
+ *   { success: boolean, status: number, data: <provider payload>, docs: string }
+ *
+ *   - `status` is the UPSTREAM status, not the proxy's.
+ *   - `success` is false whenever that status is >= 400.
+ *   - `data` is null when the upstream returned no body.
+ *   - `docs` links the proxy's own reference.
+ *
+ *   Unwrap "data" by provider:
+ *     odoo            -> data.result
+ *     airtable        -> data.records
+ *     notion          -> data.results
+ *     microsoft 365   -> data.value
+ *     klaviyo         -> data.data
+ *     supabase / dimomaint -> data
+ *
+ *   A 401 with code "api_key_missing" or "api_key_invalid" comes from the
+ *   proxy itself: the call ran without this project's key. Its `llm` field
+ *   says what to change.
+ *
+ * Pagination: put query params directly in the endpoint string,
+ *   e.g. endpoint: '/api/tickets?cursor=xyz&per_page=100'.
+ *   Read pagination metadata from the response to build the next call.
+ *   Never .filter() large lists in the page -- paginate in the route.
+ *
+ * Sending files:
+ *   Most APIs take a file as base64 inside the normal JSON body. Odoo is the
+ *   common case: ir.attachment.create with the bytes in `datas` and BOTH
+ *   `res_model` and `res_id` set, or the file is stored but appears on no
+ *   record. Nothing special is needed for those.
+ *
+ *   Some upload endpoints accept only multipart/form-data and answer JSON with
+ *   HTTP 415. For those set bodyEncoding: 'multipart' (see uploadFile below).
+ *   Never set a Content-Type header for multipart, the proxy lets fetch
+ *   generate the boundary. Not accepted for odoo, which has no multipart API.
+ *
+ *   Either way the browser POSTs the file to one of the app's own routes as
+ *   FormData; the route reads it with `await request.formData()` and encodes
+ *   it with fileToBase64 below.
+ *
+ * Secrets for non-integration APIs (e.g. raw OpenAI): store them in the
+ * project's Variables and read them via `env` from @helloleo/runtime, in
+ * server code only.
+ */
+
+export const INTEGRATION_PROXY_URL = '{{LEO_INTEGRATION_PROXY_URL}}'
+
+// This project's key, issued by HelloLeo per target and injected into the
+// server env: the preview holds one value, the published app another. The
+// proxy reads which one it got to pick the integration connection, so the
+// published app talks to production and the preview to development with no
+// flag to set. Not in @helloleo/runtime's RuntimeEnv, hence the local shape.
+const platformEnv = env as unknown as { HELLOLEO_API_KEY?: string }
+
+function proxyHeaders(): Record<string, string> {
+  const headers: Record<string, string> = { 'Content-Type': 'application/json' }
+  const key = platformEnv.HELLOLEO_API_KEY
+  if (key) headers.Authorization = `Bearer ${key}`
+  return headers
+}
+
+export interface MultipartFile {
+  /** Form field name the upstream expects, e.g. 'content' or 'file'. */
+  name: string
+  filename: string
+  contentType?: string
+  /** File bytes, base64-encoded (no data: prefix). */
+  dataBase64: string
+}
+
+export interface MultipartBody {
+  fields?: Record<string, string>
+  files?: MultipartFile[]
+}
+
+export interface ProxyRequest {
+  integration: string
+  endpoint: string
+  method?: 'GET' | 'POST' | 'PUT' | 'PATCH' | 'DELETE'
+  body?: unknown
+  headers?: Record<string, string>
+  /** Omit for JSON. 'multipart' when the upstream upload endpoint rejects JSON with 415. */
+  bodyEncoding?: 'json' | 'multipart'
+}
+
+export interface ProxyResponse<T = unknown> {
+  success: boolean
+  /** The UPSTREAM status, not the proxy's. */
+  status: number
+  /** Null when the upstream returned no body. */
+  data: T | null
+  /** The proxy's own reference, on every response. */
+  docs: string
+}
+
+export async function callIntegration<T = unknown>(
+  req: ProxyRequest,
+): Promise<ProxyResponse<T>> {
+  if (req.integration.toLowerCase() === 'netsuite') {
+    throw new Error(
+      "NetSuite is not proxied -- call it from this app's own /auth/netsuite + " +
+        "/api server routes with the signed-in user's session, not callIntegration().",
+    )
+  }
+  const res = await fetch(INTEGRATION_PROXY_URL, {
+    method: 'POST',
+    headers: proxyHeaders(),
+    body: JSON.stringify({ method: 'POST', ...req }),
+  })
+  return res.json()
+}
+
+/**
+ * Upload a file to an integration whose endpoint requires multipart/form-data
+ * (Zoho WorkDrive and similar). For Odoo, do NOT use this -- create an
+ * ir.attachment with the bytes base64-encoded in `datas` instead.
+ */
+export async function uploadFile<T = unknown>(
+  req: Omit<ProxyRequest, 'body' | 'bodyEncoding'> & { body: MultipartBody },
+): Promise<ProxyResponse<T>> {
+  return callIntegration<T>({ method: 'POST', ...req, bodyEncoding: 'multipart' })
+}
+
+export async function fileToBase64(file: Blob): Promise<string> {
+  const bytes = new Uint8Array(await file.arrayBuffer())
+  let binary = ''
+  for (let i = 0; i < bytes.length; i += 1) binary += String.fromCharCode(bytes[i])
+  return btoa(binary)
+}
+
+/* Example -- multipart upload (Zoho WorkDrive), inside a POST route handler:
+ *
+ *   POST: async ({ request }) => {
+ *     const form = await request.formData()
+ *     const file = form.get('file') as File
+ *     const r = await uploadFile({
+ *       integration: 'zoho_workdrive',
+ *       endpoint: '/api/v1/upload',
+ *       body: {
+ *         fields: { parent_id: FOLDER_ID, 'override-name-exist': 'true' },
+ *         files: [{
+ *           name: 'content',
+ *           filename: file.name,
+ *           contentType: file.type,
+ *           dataBase64: await fileToBase64(file),
+ *         }],
+ *       },
+ *     })
+ *     if (!r.success) return Response.json({ error: r.data }, { status: 502 })
+ *     return Response.json(r.data)
+ *   }
+ */

package/dist/templates/{tanstack-start-2026-09-11 → tanstack-start-2026-09-29}/vite.config.ts

@@ -4,14 +4,9 @@ import { defineConfig } from '@helloleo/vite-config'
 // aliases `cloudflare:workers` -> @helloleo/runtime/cf-shim (libsql .dev.db for
 // D1+KV, local disk for R2) and runs plain Vite SSR; at build it adds
 // @cloudflare/vite-plugin to emit a workerd Worker bound to wrangler.jsonc. It
-// also binds host:true/port:5173 itself (>=0.1.2).
+// also binds host:true/port:5173 itself (>=0.1.2) and blocks *.server.* files
+// from the client bundle (>=0.1.7).
 //
-// The one thing the wrapper doesn't set: HMR over the HelloLeo preview proxy,
-// which terminates HTTPS on :443 — so point the HMR client at wss://…:443.
-export default defineConfig({
-  vite: {
-    server: {
-      hmr: { clientPort: 443, protocol: 'wss' },
-    },
-  },
-})
+// No HMR override: with no clientPort set, the Vite client connects back to the
+// page's own origin, which is wss://…:443 behind the preview proxy.
+export default defineConfig()

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@helloleo/plugins",
-  "version": "0.2.30",
+  "version": "0.2.31-beta.0",
   "description": "OpenCode plugins for HelloLeo",
   "license": "UNLICENSED",
   "type": "module",

package/dist/templates/tanstack-start-2026-09-11/src/lib/proxy.ts

@@ -1,182 +0,0 @@
-/*
- * HelloLeo Integration Proxy: runtime helper for connected integrations.
- *
- * All third-party APIs (Odoo, Airtable, HubSpot, Stripe, Notion, Gladia,
- * Microsoft 365, Klaviyo, Supabase, DimoMaint, etc.) are reachable through
- * this single proxy. The proxy handles auth and CORS using credentials the
- * user already configured in Project Settings -- you NEVER pass an API key
- * from frontend code, and you NEVER call third-party hosts directly.
- *
- * Two modes:
- *   A) Frontend-only project -> import callIntegration() from this file.
- *   B) HelloLeo Cloud project -> route via Worker fetch(env.INTEGRATION_PROXY).
- *      Use Cloud whenever the project needs backend logic, automations,
- *      webhooks, scheduled jobs, or AI agents. Keep secrets server-side.
- *
- * Integration slugs:
- *   Use the exact slug from the Enabled MCP list with the "pipedream-"
- *   prefix removed. e.g. "pipedream-gorgias_oauth" -> "gorgias_oauth".
- *   Native integrations (odoo, airtable) keep their plain name.
- *
- * Response shape (always wrapped):
- *   { success: boolean, status: number, data: <provider payload>, docs: string }
- *
- *   - `status` is the UPSTREAM status, not the proxy's.
- *   - `success` is false whenever that status is >= 400.
- *   - `data` is null when the upstream returned no body.
- *   - `docs` links the proxy's own reference.
- *
- *   Unwrap "data" by provider:
- *     odoo            -> data.result
- *     airtable        -> data.records
- *     notion          -> data.results
- *     microsoft 365   -> data.value
- *     klaviyo         -> data.data
- *     supabase / dimomaint -> data
- *
- * Pagination: put query params directly in the endpoint string,
- *   e.g. endpoint: '/api/tickets?cursor=xyz&per_page=100'.
- *   Read pagination metadata from the response to build the next call.
- *   Never .filter() large lists in the frontend -- paginate server-side.
- *
- * Sending files:
- *   Most APIs take a file as base64 inside the normal JSON body. Odoo is the
- *   common case: ir.attachment.create with the bytes in `datas` and BOTH
- *   `res_model` and `res_id` set, or the file is stored but appears on no
- *   record. Nothing special is needed for those.
- *
- *   Some upload endpoints accept only multipart/form-data and answer JSON with
- *   HTTP 415. For those set bodyEncoding: 'multipart' (see uploadFile below).
- *   Never set a Content-Type header for multipart, the proxy lets fetch
- *   generate the boundary. Not accepted for odoo, which has no multipart API.
- *
- * Secrets for non-integration APIs (e.g. raw OpenAI): store them in
- * HelloLeo Cloud -> Settings -> Cloud -> Secrets, and read via env.SECRET_NAME
- * from a Worker. Never embed secrets in frontend code.
- */
-
-export const INTEGRATION_PROXY_URL = '{{LEO_INTEGRATION_PROXY_URL}}';
-
-// Multi-environment integrations: the published HelloLeo Cloud Worker has
-// HELLOLEO_ENV=production injected at publish. Forwarding `?env=production`
-// makes the proxy resolve credentials from the project's PRODUCTION integration
-// connection (e.g. your production Odoo) instead of the development one, so a
-// published app talks to production while the preview keeps talking to staging.
-//
-// Reads the flag from the server runtime (Cloudflare Worker / Node) when
-// available; in the browser it's absent and we send no param — the proxy then
-// derives the environment from the request origin, so client-side calls from
-// the published app still resolve to production. Server-side calls (SSR / Cloud
-// Worker) carry no browser origin, which is exactly why the explicit param
-// matters there.
-function proxyUrl(): string {
-  // Read via globalThis only (no bare `process` reference) so this compiles in
-  // any scaffolded project regardless of whether node types are present.
-  const g = globalThis as {
-    HELLOLEO_ENV?: string;
-    process?: { env?: Record<string, string | undefined> };
-  };
-  const env = g.HELLOLEO_ENV ?? g.process?.env?.HELLOLEO_ENV;
-  return env === 'production' ? `${INTEGRATION_PROXY_URL}?env=production` : INTEGRATION_PROXY_URL;
-}
-
-export interface MultipartFile {
-  /** Form field name the upstream expects, e.g. 'content' or 'file'. */
-  name: string;
-  filename: string;
-  contentType?: string;
-  /** File bytes, base64-encoded (no data: prefix). */
-  dataBase64: string;
-}
-
-export interface MultipartBody {
-  fields?: Record<string, string>;
-  files?: MultipartFile[];
-}
-
-export interface ProxyRequest {
-  integration: string;
-  endpoint: string;
-  method?: 'GET' | 'POST' | 'PUT' | 'PATCH' | 'DELETE';
-  body?: unknown;
-  headers?: Record<string, string>;
-  /** Omit for JSON. 'multipart' when the upstream upload endpoint rejects JSON with 415. */
-  bodyEncoding?: 'json' | 'multipart';
-}
-
-export interface ProxyResponse<T = unknown> {
-  success: boolean;
-  /** The UPSTREAM status, not the proxy's. */
-  status: number;
-  /** Null when the upstream returned no body. */
-  data: T | null;
-  /** The proxy's own reference, on every response. */
-  docs: string;
-}
-
-export async function callIntegration<T = unknown>(
-  req: ProxyRequest,
-): Promise<ProxyResponse<T>> {
-  if (req.integration.toLowerCase() === 'netsuite') {
-    throw new Error(
-      'NetSuite is not proxied -- call it from this app\'s own /auth/netsuite + ' +
-        '/api server routes with the signed-in user\'s session, not callIntegration().',
-    );
-  }
-  const res = await fetch(proxyUrl(), {
-    method: 'POST',
-    headers: { 'Content-Type': 'application/json' },
-    body: JSON.stringify({ method: 'POST', ...req }),
-  });
-  return res.json();
-}
-
-/**
- * Upload a file to an integration whose endpoint requires multipart/form-data
- * (Zoho WorkDrive and similar). For Odoo, do NOT use this -- create an
- * ir.attachment with the bytes base64-encoded in `datas` instead.
- */
-export async function uploadFile<T = unknown>(
-  req: Omit<ProxyRequest, 'body' | 'bodyEncoding'> & { body: MultipartBody },
-): Promise<ProxyResponse<T>> {
-  return callIntegration<T>({ method: 'POST', ...req, bodyEncoding: 'multipart' });
-}
-
-export async function fileToBase64(file: Blob): Promise<string> {
-  const bytes = new Uint8Array(await file.arrayBuffer());
-  let binary = '';
-  for (let i = 0; i < bytes.length; i += 1) binary += String.fromCharCode(bytes[i]);
-  return btoa(binary);
-}
-
-/* Example -- Odoo search_read:
- *
- *   const r = await callIntegration({
- *     integration: 'odoo',
- *     endpoint: '/jsonrpc',
- *     body: {
- *       model: 'product.template',
- *       method: 'search_read',
- *       args: [[['type', '=', 'consu']]],
- *       kwargs: { fields: ['name', 'list_price'], limit: 50 },
- *     },
- *   });
- *   const products = r.data?.result ?? [];
- *
- * Example -- multipart upload (Zoho WorkDrive):
- *
- *   const r = await uploadFile({
- *     integration: 'zoho_workdrive',
- *     endpoint: '/api/v1/upload',
- *     body: {
- *       fields: { parent_id: folderId, 'override-name-exist': 'true' },
- *       files: [{
- *         name: 'content',
- *         filename: file.name,
- *         contentType: file.type,
- *         dataBase64: await fileToBase64(file),
- *       }],
- *     },
- *   });
- *   if (!r.success) throw new Error(String(r.data));
- */