@amerged/ohmyhost-cli 0.1.23 → 0.1.24

package/src/apps/product-cli/{user-token-file.ts → src/user-token-file.ts}

@@ -23,23 +23,28 @@ export class UserTokenFileError extends Error {
       | "token_value_unavailable",
     readonly keyId?: string,
   ) {
-    super(
-      {
-        token_file_not_ignored:
-          "Add the selected env file to .gitignore or choose a location outside the repository. No token was created or written.",
-        token_file_unsafe:
-          "Choose a private .env file owned by you. Symlinks, shared files and files larger than 64 KiB are not accepted.",
-        token_file_has_token:
-          "The selected file already contains OHMYHOST_TOKEN. Use that token or choose a new file; existing credentials were preserved.",
-        token_file_changed:
-          "The environment file changed during creation. It was not overwritten. List tokens to inspect the issued key before creating another.",
-        token_value_unavailable:
-          "This token was already issued and its full value cannot be retrieved. Use the previously saved file, or explicitly revoke the listed key before creating a replacement.",
-      }[code] + (keyId ? ` Token ID: ${keyId}.` : ""),
-    );
+    super(tokenFileAction(code, keyId));
   }
 }
 
+/** What to do next; once a key was issued, the answer names it so it can be revoked. */
+const tokenFileAction = (code: UserTokenFileError["code"], keyId: string | undefined): string => {
+  switch (code) {
+    case "token_file_not_ignored":
+      return "Add the selected env file to .gitignore or choose a location outside the repository. No token was created or written.";
+    case "token_file_unsafe":
+      return "Choose an env file whose name starts or ends with .env, for example .env.local: a regular file you own, not a symlink or hard link, at most 64 KiB.";
+    case "token_file_has_token":
+      return "The selected file already contains OHMYHOST_TOKEN. Use that token or choose a new file; existing credentials were preserved.";
+    case "token_file_changed":
+      return keyId === undefined
+        ? "The env file changed while it was being read; no key was issued. Run the same command again."
+        : `The env file changed while the token was being saved, so its value may not be in the file; key ${keyId} was issued. Revoke it with 'ohmyhost token revoke --organization ULID --key ${keyId} --yes --json' (MCP token_revoke), then create a new one with a new idempotency key.`;
+    case "token_value_unavailable":
+      return `A key was already issued for this idempotency key, and its value is shown only once. Use the file it was saved to, or revoke key ${String(keyId)} (ohmyhost token revoke, MCP token_revoke) and create a replacement with a new idempotency key.`;
+  }
+};
+
 /** Prepare before the API call; append only OHMYHOST_TOKEN and never return its value to a chat. */
 export async function prepareUserTokenFile(output: string) {
   const path = resolve(output);
@@ -77,28 +82,34 @@ export async function prepareUserTokenFile(output: string) {
         const result = parseUserApiKeyCreation(value);
         if (result.value === null)
           throw new UserTokenFileError("token_value_unavailable", result.key.id);
-        const current = await lstat(path);
-        if (
-          !current.isFile() ||
-          current.isSymbolicLink() ||
-          current.nlink !== 1 ||
-          current.ino !== identity.ino ||
-          current.dev !== identity.dev ||
-          (await tokenFileText(handle)) !== initial
-        )
-          throw new UserTokenFileError("token_file_changed");
-        await handle.appendFile(`\nOHMYHOST_TOKEN=${result.value}\n`, "utf8");
-        await handle.sync();
-        if (parseEnv(await tokenFileText(handle))["OHMYHOST_TOKEN"] !== result.value)
-          throw new UserTokenFileError("token_file_changed");
-        const saved = await lstat(path);
-        if (
-          !saved.isFile() ||
-          saved.isSymbolicLink() ||
-          saved.ino !== identity.ino ||
-          saved.dev !== identity.dev
-        )
+        try {
+          const current = await lstat(path);
+          if (
+            !current.isFile() ||
+            current.isSymbolicLink() ||
+            current.nlink !== 1 ||
+            current.ino !== identity.ino ||
+            current.dev !== identity.dev ||
+            (await tokenFileText(handle)) !== initial
+          )
+            throw new UserTokenFileError("token_file_changed");
+          await handle.appendFile(`\nOHMYHOST_TOKEN=${result.value}\n`, "utf8");
+          await handle.sync();
+          if (parseEnv(await tokenFileText(handle))["OHMYHOST_TOKEN"] !== result.value)
+            throw new UserTokenFileError("token_file_changed");
+          const saved = await lstat(path);
+          if (
+            !saved.isFile() ||
+            saved.isSymbolicLink() ||
+            saved.ino !== identity.ino ||
+            saved.dev !== identity.dev
+          )
+            throw new UserTokenFileError("token_file_changed");
+        } catch {
+          // The file was checked before the key was issued, so any refusal now means it changed,
+          // and the answer names the issued key so it can be revoked.
           throw new UserTokenFileError("token_file_changed", result.key.id);
+        }
         return { request_id: result.request_id, key: result.key, token_file: path };
       },
       close: () => handle.close(),

package/src/apps/product-cli/{workspace.ts → src/workspace.ts}

@@ -119,8 +119,14 @@ export const selectWorkspace = async (
     session.profile.userId,
     organization.id,
   );
+  // That user's existing login in the organization keeps its name; binding under this login's alias
+  // would silently rename it for every agent that selects it by name.
+  const existing = (await session.profiles.list()).find(
+    (saved) => saved.userId === session.profile.userId && saved.organizationId === organization.id,
+  );
   const bound: LocalProfile = {
     ...session.profile,
+    name: existing?.name ?? session.profile.name,
     organizationId: organization.id,
     organizationName: organization.name,
   };

package/src/packages/contracts/package.json

@@ -0,0 +1,137 @@
+{
+  "name": "@ohmyhost/contracts",
+  "version": "0.0.0",
+  "private": true,
+  "type": "module",
+  "sideEffects": false,
+  "exports": {
+    "./operation-failure": {
+      "source": "./src/operation-failure.ts",
+      "types": "./dist/operation-failure.d.ts",
+      "import": "./dist/operation-failure.js"
+    },
+    "./billing": {
+      "source": "./src/billing.ts",
+      "types": "./dist/billing.d.ts",
+      "import": "./dist/billing.js"
+    },
+    "./credit-pricing": {
+      "source": "./src/credit-pricing.ts",
+      "types": "./dist/credit-pricing.d.ts",
+      "import": "./dist/credit-pricing.js"
+    },
+    "./platform-origins": {
+      "source": "./src/platform-origins.ts",
+      "types": "./dist/platform-origins.d.ts",
+      "import": "./dist/platform-origins.js"
+    },
+    ".": {
+      "source": "./src/index.ts",
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js"
+    },
+    "./application-root": {
+      "source": "./src/application-root.ts",
+      "types": "./dist/application-root.d.ts",
+      "import": "./dist/application-root.js"
+    },
+    "./database-migration-admission": {
+      "source": "./src/database-migration-admission.ts",
+      "types": "./dist/database-migration-admission.d.ts",
+      "import": "./dist/database-migration-admission.js"
+    },
+    "./framework-family": {
+      "source": "./src/framework-family.ts",
+      "types": "./dist/framework-family.d.ts",
+      "import": "./dist/framework-family.js"
+    },
+    "./operation-deployment-result": {
+      "source": "./src/operation-deployment-result.ts",
+      "types": "./dist/operation-deployment-result.d.ts",
+      "import": "./dist/operation-deployment-result.js"
+    },
+    "./operation-data-change-result": {
+      "source": "./src/operation-data-change-result.ts",
+      "types": "./dist/operation-data-change-result.d.ts",
+      "import": "./dist/operation-data-change-result.js"
+    },
+    "./framework-admission": {
+      "source": "./src/framework-admission.ts",
+      "types": "./dist/framework-admission.d.ts",
+      "import": "./dist/framework-admission.js"
+    },
+    "./framework-build-script": {
+      "source": "./src/framework-build-script.ts",
+      "types": "./dist/framework-build-script.d.ts",
+      "import": "./dist/framework-build-script.js"
+    },
+    "./browser-capabilities": {
+      "source": "./src/browser-capabilities.ts",
+      "types": "./dist/browser-capabilities.d.ts",
+      "import": "./dist/browser-capabilities.js"
+    },
+    "./openapi.yaml": "./openapi.yaml",
+    "./ohmyhost.schema.json": "./schemas/ohmyhost.schema.json",
+    "./feedback": {
+      "source": "./src/feedback.ts",
+      "types": "./dist/feedback.d.ts",
+      "import": "./dist/feedback.js"
+    },
+    "./user-api-keys": {
+      "source": "./src/user-api-keys.ts",
+      "types": "./dist/user-api-keys.d.ts",
+      "import": "./dist/user-api-keys.js"
+    },
+    "./project-exports": {
+      "source": "./src/project-exports.ts",
+      "types": "./dist/project-exports.d.ts",
+      "import": "./dist/project-exports.js"
+    },
+    "./project-context": {
+      "source": "./src/project-context.ts",
+      "types": "./dist/project-context.d.ts",
+      "import": "./dist/project-context.js"
+    },
+    "./database-compute": {
+      "source": "./src/database-compute.ts",
+      "types": "./dist/database-compute.d.ts",
+      "import": "./dist/database-compute.js"
+    },
+    "./database-access": {
+      "source": "./src/database-access.ts",
+      "types": "./dist/database-access.d.ts",
+      "import": "./dist/database-access.js"
+    },
+    "./functions": {
+      "source": "./src/functions.ts",
+      "types": "./dist/functions.d.ts",
+      "import": "./dist/functions.js"
+    },
+    "./problem-policy": {
+      "source": "./src/problem-policy.ts",
+      "types": "./dist/problem-policy.d.ts",
+      "import": "./dist/problem-policy.js"
+    },
+    "./secret-names": {
+      "source": "./src/secret-names.ts",
+      "types": "./dist/secret-names.d.ts",
+      "import": "./dist/secret-names.js"
+    },
+    "./project-data-changes": {
+      "source": "./src/project-data-changes.ts",
+      "types": "./dist/project-data-changes.d.ts",
+      "import": "./dist/project-data-changes.js"
+    }
+  },
+  "scripts": {
+    "build": "tsc --project tsconfig.build.json",
+    "typecheck": "tsc --project tsconfig.json --noEmit",
+    "test": "vitest run --root ../.. packages/contracts/test",
+    "validate": "pnpm run typecheck && pnpm run test"
+  },
+  "dependencies": {
+    "ajv": "8.18.0",
+    "yaml": "2.8.3"
+  },
+  "license": "Apache-2.0"
+}

package/src/packages/contracts/src/browser-capabilities.ts

@@ -0,0 +1,133 @@
+const RESOURCE_GROUPS = [
+  "connect",
+  "scripts",
+  "styles",
+  "images",
+  "fonts",
+  "frames",
+  "frameAncestors",
+] as const;
+type BrowserResourceGroup = (typeof RESOURCE_GROUPS)[number];
+
+export type BrowserPolicy = Readonly<
+  Record<BrowserResourceGroup, readonly string[]> & {
+    workers: Readonly<{ self: boolean; blob: boolean }>;
+    cors: Readonly<{ origins: readonly string[]; credentials: boolean }>;
+  }
+>;
+
+const POLICY_KEYS = [...RESOURCE_GROUPS, "workers", "cors"];
+const MAX_ORIGINS = 16;
+
+/** Source declarations may omit capabilities; each omission retains the restrictive default. */
+export function normalizeBrowserPolicy(value: unknown): BrowserPolicy {
+  const input = value === undefined ? {} : policyRecord(value, POLICY_KEYS);
+  const workers =
+    input["workers"] === undefined ? {} : policyRecord(input["workers"], ["self", "blob"]);
+  const cors =
+    input["cors"] === undefined ? {} : policyRecord(input["cors"], ["origins", "credentials"]);
+  const resources = Object.fromEntries(
+    RESOURCE_GROUPS.map((group) => [group, normalizeOrigins(input[group], group === "connect")]),
+  ) as Record<BrowserResourceGroup, readonly string[]>;
+  return Object.freeze({
+    ...resources,
+    workers: Object.freeze({
+      self: normalizeBoolean(workers["self"]),
+      blob: normalizeBoolean(workers["blob"]),
+    }),
+    cors: Object.freeze({
+      origins: normalizeOrigins(cors["origins"], false),
+      credentials: normalizeBoolean(cors["credentials"]),
+    }),
+  });
+}
+
+/** Private routing and artifact custody accept the complete normalized policy only. */
+export function parseBrowserPolicy(value: unknown): BrowserPolicy {
+  const input = policyRecord(value, POLICY_KEYS, true);
+  const workers = policyRecord(input["workers"], ["self", "blob"], true);
+  const cors = policyRecord(input["cors"], ["origins", "credentials"], true);
+  if (
+    typeof workers["self"] !== "boolean" ||
+    typeof workers["blob"] !== "boolean" ||
+    typeof cors["credentials"] !== "boolean"
+  )
+    throw invalidPolicy();
+  const normalized = normalizeBrowserPolicy(input);
+  for (const group of RESOURCE_GROUPS) {
+    if (!sameOrigins(input[group], normalized[group])) throw invalidPolicy();
+  }
+  if (!sameOrigins(cors["origins"], normalized.cors.origins)) throw invalidPolicy();
+  return normalized;
+}
+
+function policyRecord(
+  value: unknown,
+  keys: readonly string[],
+  complete = false,
+): Record<string, unknown> {
+  if (
+    typeof value !== "object" ||
+    value === null ||
+    Array.isArray(value) ||
+    ![Object.prototype, null].includes(Object.getPrototypeOf(value)) ||
+    Object.keys(value).some((key) => !keys.includes(key)) ||
+    (complete && Object.keys(value).length !== keys.length)
+  )
+    throw invalidPolicy();
+  return value as Record<string, unknown>;
+}
+
+function normalizeBoolean(value: unknown): boolean {
+  if (value === undefined) return false;
+  if (typeof value !== "boolean") throw invalidPolicy();
+  return value;
+}
+
+function normalizeOrigins(value: unknown, allowWebSocket: boolean): readonly string[] {
+  if (value === undefined) return Object.freeze([]);
+  if (!Array.isArray(value) || value.length > MAX_ORIGINS) throw invalidPolicy();
+  const origins: string[] = [];
+  for (const origin of value) {
+    if (!browserOrigin(origin, allowWebSocket) || origins.includes(origin)) throw invalidPolicy();
+    origins.push(origin);
+  }
+  return Object.freeze(origins.sort());
+}
+
+function browserOrigin(value: unknown, allowWebSocket: boolean): value is string {
+  if (typeof value !== "string" || value.length > 256) return false;
+  try {
+    const url = new URL(value);
+    return (
+      (url.protocol === "https:" || (allowWebSocket && url.protocol === "wss:")) &&
+      url.origin === value &&
+      url.username === "" &&
+      url.password === "" &&
+      url.pathname === "/" &&
+      url.search === "" &&
+      url.hash === "" &&
+      url.hostname.includes(".") &&
+      !url.hostname.endsWith(".local") &&
+      !url.hostname.endsWith(".internal") &&
+      !/^\d+(?:\.\d+){3}$/u.test(url.hostname) &&
+      url.hostname
+        .split(".")
+        .every((label) => /^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/u.test(label))
+    );
+  } catch {
+    return false;
+  }
+}
+
+function sameOrigins(value: unknown, expected: readonly string[]): boolean {
+  return (
+    Array.isArray(value) &&
+    value.length === expected.length &&
+    value.every((origin, index) => origin === expected[index])
+  );
+}
+
+function invalidPolicy(): TypeError {
+  return new TypeError("Invalid browser capability policy");
+}

package/src/packages/contracts/src/customer-auth-admission.ts

@@ -0,0 +1,36 @@
+export interface ManagedCustomerAuthCapabilities {
+  readonly auth?: Readonly<{ provider: string }>;
+  readonly database?: Readonly<{ enabled: boolean }>;
+  readonly mail?: Readonly<{ enabled: boolean }>;
+}
+
+export function managedCustomerAuthMailMessage(path: string): string {
+  return `"${path}" selects the managed Better Auth bridge, which sends verification and password-reset email through ohmyhost Mail. Set mail.enabled: true and set up a verified mail sender, or set auth.provider: none and keep the application-owned Better Auth configuration and sender. Commit and push the change, then plan the new commit.`;
+}
+
+export function managedCustomerAuthDatabaseMessage(path: string): string {
+  return `"${path}" selects the managed Better Auth bridge, which requires the managed PostgreSQL database. Set database.enabled: true with an admitted migrations path, or set auth.provider: none and keep the application-owned authentication configuration. Commit and push the change, then plan the new commit.`;
+}
+
+/** Dependency inventory never selects the managed bridge; only the explicit auth capability does. */
+export function managedCustomerAuthAdmissionIssue(
+  capabilities: ManagedCustomerAuthCapabilities | null | undefined,
+): Readonly<{
+  code: "managed_auth_database_required" | "managed_auth_mail_required";
+  message: string;
+}> | null {
+  if (capabilities?.auth?.provider !== "better-auth") {
+    return null;
+  }
+  if (capabilities.database?.enabled !== true) {
+    return Object.freeze({
+      code: "managed_auth_database_required" as const,
+      message: managedCustomerAuthDatabaseMessage("ohmyhost.yaml"),
+    });
+  }
+  if (capabilities.mail?.enabled === true) return null;
+  return Object.freeze({
+    code: "managed_auth_mail_required" as const,
+    message: managedCustomerAuthMailMessage("ohmyhost.yaml"),
+  });
+}

package/src/packages/contracts/{database-access.ts → src/database-access.ts}

@@ -105,7 +105,13 @@ export interface ProjectDatabaseAccess {
   readonly issued_at: string;
   readonly expires_at: string;
   readonly revoked_at: string | null;
-  readonly revocation_reason: "principal" | "expired" | "budget" | "creation_failed" | null;
+  readonly revocation_reason:
+    | "principal"
+    | "expired"
+    | "budget"
+    | "creation_failed"
+    | "data_change"
+    | null;
 }
 export interface ProjectDatabaseAccessCredential extends ProjectDatabaseAccess {
   readonly connection_uri: string;
@@ -219,7 +225,9 @@ function assertAccessFields(value: Record<string, unknown>): void {
     (revoked !== null && !timestamp(revoked)) ||
     (revoked === null) !== (reason === null) ||
     (reason !== null &&
-      !["principal", "expired", "budget", "creation_failed"].includes(String(reason))) ||
+      !["principal", "expired", "budget", "creation_failed", "data_change"].includes(
+        String(reason),
+      )) ||
     (value["state"] === "revoked") !== (revoked !== null)
   )
     throw new TypeError("Invalid database access");

package/src/packages/contracts/{framework-admission.ts → src/framework-admission.ts}

@@ -1,3 +1,13 @@
+import { PINNED_BUN_VERSION } from "./framework-build-script.mjs";
+import {
+  managedCustomerAuthMailMessage,
+  managedCustomerAuthDatabaseMessage,
+} from "./customer-auth-admission.js";
+export {
+  managedCustomerAuthAdmissionIssue,
+  managedCustomerAuthMailMessage,
+} from "./customer-auth-admission.js";
+
 export type PackageManagerName = "bun" | "npm" | "pnpm" | "yarn";
 
 export type FrameworkAdmissionReason =
@@ -6,7 +16,8 @@ export type FrameworkAdmissionReason =
   | "invalid_package_manager"
   | "missing_lockfile"
   | "missing_package_manager"
-  | "package_manager_lockfile_mismatch";
+  | "package_manager_lockfile_mismatch"
+  | "package_manager_version_unsupported";
 
 export class FrameworkAdmissionError extends Error {
   public readonly code = "framework_admission_failed";
@@ -88,6 +99,9 @@ export function resolvePackageManager(input: PackageManagerInput): PackageManage
   if (!contract.lockfiles.includes(lockfile)) {
     throw new FrameworkAdmissionError("package_manager_lockfile_mismatch");
   }
+  if (manager === "bun" && version !== PINNED_BUN_VERSION) {
+    throw new FrameworkAdmissionError("package_manager_version_unsupported");
+  }
   return Object.freeze({
     manager,
     version,
@@ -187,17 +201,25 @@ function versionAdmission(
 }
 
 export type FrameworkConversionDiagnosticCode =
+  | "managed_auth_database_required"
+  | "managed_auth_mail_required"
   | "database_binding_private"
   | "database_driver_unsupported"
   | "source_syntax_invalid"
   | "worker_module_default_export_required"
-  | "scheduled_handler_required";
+  | "scheduled_handler_required"
+  | "framework_base_path_unsupported"
+  | "tanstack_prerender_required"
+  | "tanstack_vite_plugins_required"
+  | "next_cache_components_unsupported";
 
 export interface FrameworkConversionDiagnostic {
   readonly code: FrameworkConversionDiagnosticCode;
   readonly path: string;
 }
 
+const PUSH_AND_PLAN = "Commit and push the change, then plan the new commit.";
+
 // Detail texts are the customer-facing sentence for one diagnostic; parseFrameworkConversionDetail
 // recognizes exactly these sentences so a client can map a detail back to its typed diagnostic.
 const FRAMEWORK_CONVERSION_DETAILS: Readonly<
@@ -206,38 +228,89 @@ const FRAMEWORK_CONVERSION_DETAILS: Readonly<
     Readonly<{ render(path: string): string; pattern: RegExp }>
   >
 > = Object.freeze({
+  managed_auth_database_required: Object.freeze({
+    render: managedCustomerAuthDatabaseMessage,
+    pattern:
+      /^"([^"]+)" selects the managed Better Auth bridge, which requires the managed PostgreSQL database\. Set database\.enabled: true with an admitted migrations path, or set auth\.provider: none and keep the application-owned authentication configuration\. Commit and push the change, then plan the new commit\.$/u,
+  }),
+  managed_auth_mail_required: Object.freeze({
+    render: managedCustomerAuthMailMessage,
+    pattern:
+      /^"([^"]+)" selects the managed Better Auth bridge, which sends verification and password-reset email through ohmyhost Mail\. Set mail\.enabled: true and set up a verified mail sender, or set auth\.provider: none and keep the application-owned Better Auth configuration and sender\. Commit and push the change, then plan the new commit\.$/u,
+  }),
   database_binding_private: Object.freeze({
     render: (path: string) =>
-      `"${path}" reads a managed database connection string. HYPERDRIVE is retired; DATABASE_URL and postgres:// URLs never reach a customer Worker. Call the database with createPrivateDatabaseClient from "@ohmyhost/customer-runtime/database". Commit the change, then plan again.`,
+      `"${path}" reads a database connection string (DATABASE_URL, HYPERDRIVE, connectionString or a postgres:// URL); none reaches a customer Worker. Call the database with createPrivateDatabaseClient from "@ohmyhost/customer-runtime/database". ${PUSH_AND_PLAN}`,
     pattern:
-      /^"([^"]+)" reads a managed database connection string\. HYPERDRIVE is retired; DATABASE_URL and postgres:\/\/ URLs never reach a customer Worker\. Call the database with createPrivateDatabaseClient from "@ohmyhost\/customer-runtime\/database"\. Commit the change, then plan again\.$/u,
+      /^"([^"]+)" reads a database connection string \(DATABASE_URL, HYPERDRIVE, connectionString or a postgres:\/\/ URL\); none reaches a customer Worker\. Call the database with createPrivateDatabaseClient from "@ohmyhost\/customer-runtime\/database"\. Commit and push the change, then plan the new commit\.$/u,
   }),
   database_driver_unsupported: Object.freeze({
     render: (path: string) =>
-      `"${path}" imports a PostgreSQL socket driver. Outbound connect() is disabled for customer Workers, so it can never open a connection; call the database with createPrivateDatabaseClient from "@ohmyhost/customer-runtime/database". Commit the change, then plan again.`,
+      `"${path}" imports a database socket driver (pg, postgres, pg-native or mysql2); customer Workers cannot open sockets. Call the database with createPrivateDatabaseClient from "@ohmyhost/customer-runtime/database". ${PUSH_AND_PLAN}`,
     pattern:
-      /^"([^"]+)" imports a PostgreSQL socket driver\. Outbound connect\(\) is disabled for customer Workers, so it can never open a connection; call the database with createPrivateDatabaseClient from "@ohmyhost\/customer-runtime\/database"\. Commit the change, then plan again\.$/u,
+      /^"([^"]+)" imports a database socket driver \(pg, postgres, pg-native or mysql2\); customer Workers cannot open sockets\. Call the database with createPrivateDatabaseClient from "@ohmyhost\/customer-runtime\/database"\. Commit and push the change, then plan the new commit\.$/u,
   }),
   source_syntax_invalid: Object.freeze({
     render: (path: string) =>
-      `Invalid JavaScript or TypeScript in "${path}". Fix the file, commit the change, then plan again.`,
+      `Invalid JavaScript or TypeScript in "${path}". Fix the file, commit and push the change, then plan the new commit.`,
     pattern:
-      /^Invalid JavaScript or TypeScript in "([^"]+)"\. Fix the file, commit the change, then plan again\.$/u,
+      /^Invalid JavaScript or TypeScript in "([^"]+)"\. Fix the file, commit and push the change, then plan the new commit\.$/u,
   }),
   worker_module_default_export_required: Object.freeze({
     render: (path: string) =>
-      `Worker module "${path}" has no default export. Export default { fetch, scheduled } with the handlers ohmyho.st invokes; named exports are never called. Commit the change, then plan again.`,
+      `Worker module "${path}" has no default export. Export default { fetch, scheduled } with the handlers ohmyho.st invokes; named exports are never called. ${PUSH_AND_PLAN}`,
     pattern:
-      /^Worker module "([^"]+)" has no default export\. Export default \{ fetch, scheduled \} with the handlers ohmyho\.st invokes; named exports are never called\. Commit the change, then plan again\.$/u,
+      /^Worker module "([^"]+)" has no default export\. Export default \{ fetch, scheduled \} with the handlers ohmyho\.st invokes; named exports are never called\. Commit and push the change, then plan the new commit\.$/u,
   }),
   scheduled_handler_required: Object.freeze({
     render: (path: string) =>
-      `functions.crons is declared but "${path}" exports no scheduled handler. Add scheduled(controller, env, ctx) to its default export, commit the change, then plan again.`,
+      `functions.crons is declared but "${path}" exports no scheduled handler. Add scheduled(controller, env, ctx) to its default export, commit and push the change, then plan the new commit.`,
+    pattern:
+      /^functions\.crons is declared but "([^"]+)" exports no scheduled handler\. Add scheduled\(controller, env, ctx\) to its default export, commit and push the change, then plan the new commit\.$/u,
+  }),
+  framework_base_path_unsupported: Object.freeze({
+    render: (path: string) =>
+      `"${path}" sets a Vite base. ohmyho.st serves the app at the root origin: remove base or set base: "/". ${PUSH_AND_PLAN}`,
     pattern:
-      /^functions\.crons is declared but "([^"]+)" exports no scheduled handler\. Add scheduled\(controller, env, ctx\) to its default export, commit the change, then plan again\.$/u,
+      /^"([^"]+)" sets a Vite base\. ohmyho\.st serves the app at the root origin: remove base or set base: "\/"\. Commit and push the change, then plan the new commit\.$/u,
+  }),
+  tanstack_prerender_required: Object.freeze({
+    render: (path: string) =>
+      `"${path}" does not call tanstackStart({ prerender: { enabled: true } }), which the static TanStack Start runtime needs; enable prerender, or set runtime.mode: edge with the Cloudflare Vite plugin. ${PUSH_AND_PLAN}`,
+    pattern:
+      /^"([^"]+)" does not call tanstackStart\(\{ prerender: \{ enabled: true \} \}\), which the static TanStack Start runtime needs; enable prerender, or set runtime\.mode: edge with the Cloudflare Vite plugin\. Commit and push the change, then plan the new commit\.$/u,
+  }),
+  tanstack_vite_plugins_required: Object.freeze({
+    render: (path: string) =>
+      `"${path}" does not follow the TanStack Start plugin contract: import tanstackStart from "@tanstack/react-start/plugin/vite"; on runtime edge also import cloudflare from "@cloudflare/vite-plugin" and call cloudflare({ viteEnvironment: { name: "ssr" } }) before tanstackStart(); on runtime static do not import the Cloudflare plugin. ${PUSH_AND_PLAN}`,
+    pattern:
+      /^"([^"]+)" does not follow the TanStack Start plugin contract: import tanstackStart from "@tanstack\/react-start\/plugin\/vite"; on runtime edge also import cloudflare from "@cloudflare\/vite-plugin" and call cloudflare\(\{ viteEnvironment: \{ name: "ssr" \} \}\) before tanstackStart\(\); on runtime static do not import the Cloudflare plugin\. Commit and push the change, then plan the new commit\.$/u,
+  }),
+  next_cache_components_unsupported: Object.freeze({
+    render: (path: string) =>
+      `"${path}" sets cacheComponents: true, which ohmyho.st does not support; remove it or set it to false. ${PUSH_AND_PLAN}`,
+    pattern:
+      /^"([^"]+)" sets cacheComponents: true, which ohmyho\.st does not support; remove it or set it to false\. Commit and push the change, then plan the new commit\.$/u,
   }),
 });
 
+/**
+ * An adapter rule that `init` does not check. It stays a TypeError, so every existing caller that
+ * treats an adapter refusal as a TypeError keeps working, and carries the typed diagnostic whose
+ * detail names the file and its fix.
+ */
+export class FrameworkConversionDiagnosticError extends TypeError {
+  public readonly diagnostic: FrameworkConversionDiagnostic;
+
+  public constructor(diagnostic: unknown) {
+    const parsed = parseFrameworkConversionDiagnostic(diagnostic);
+    if (parsed === null) throw new TypeError("Framework conversion diagnostic is invalid");
+    super(FRAMEWORK_CONVERSION_DETAILS[parsed.code].render(parsed.path));
+    this.name = "FrameworkConversionDiagnosticError";
+    this.diagnostic = parsed;
+  }
+}
+
 function isFrameworkConversionDiagnosticCode(
   value: unknown,
 ): value is FrameworkConversionDiagnosticCode {
@@ -256,7 +329,9 @@ export function parseFrameworkConversionDiagnostic(
     !isFrameworkConversionDiagnosticCode(code) ||
     typeof path !== "string" ||
     path.length > 240 ||
-    !/^[A-Za-z0-9_@()[\]./-]+\.(?:[cm]?[jt]sx?)$/u.test(path) ||
+    (code === "managed_auth_mail_required" || code === "managed_auth_database_required"
+      ? path !== "ohmyhost.yaml"
+      : !/^[A-Za-z0-9_@()[\]./-]+\.(?:[cm]?[jt]sx?)$/u.test(path)) ||
     path.split("/").some((segment) => segment === "" || segment === "." || segment === "..")
   )
     return null;

package/src/packages/contracts/src/framework-build-script.mjs

@@ -0,0 +1,22 @@
+export const PINNED_BUN_VERSION = "1.2.22";
+
+const TYPESCRIPT_BUILD_STAGE = /^tsc(?:[ \t]+(?:--noEmit|-b|--build))?$/u;
+
+/**
+ * The same source is consumed by local admission, framework adapters and the build sandbox.
+ * @param {"nextjs" | "tanstack-start" | "vite"} framework
+ * @param {unknown} script
+ * @returns {boolean}
+ */
+export function isAdmittedFrameworkBuildScript(framework, script) {
+  if (typeof script !== "string") return false;
+  if (framework === "nextjs") return script === "next build" || script === "next build --webpack";
+  if (framework !== "vite" && framework !== "tanstack-start") return false;
+  const stages = script.trim().split(/[ \t]*&&[ \t]*/u);
+  if (stages.length === 1) return stages[0] === "vite build";
+  if (stages.length !== 2) return false;
+  return (
+    (stages[0] === "vite build" && TYPESCRIPT_BUILD_STAGE.test(stages[1] ?? "")) ||
+    (TYPESCRIPT_BUILD_STAGE.test(stages[0] ?? "") && stages[1] === "vite build")
+  );
+}

package/src/packages/contracts/src/framework-build-script.ts

@@ -0,0 +1 @@
+export { isAdmittedFrameworkBuildScript, PINNED_BUN_VERSION } from "./framework-build-script.mjs";