@amerged/ohmyhost-cli 0.1.30 → 0.1.32

package/dist/{chunk-PRLVV4ZG.js → chunk-EPW2O2ZL.js}

@@ -140,16 +140,16 @@ var require_ignore = __commonJS({
       }
     };
     var NEVER_MATCH = "[]";
-    var PLACEHOLDER = "\0";
+    var PLACEHOLDER2 = "\0";
     var REGEX_RESTORE_PLACEHOLDER = new RegExp(
-      `${PLACEHOLDER}(\\d+)${PLACEHOLDER}`,
+      `${PLACEHOLDER2}(\\d+)${PLACEHOLDER2}`,
       "g"
     );
     var TRAILING_WILDCARD = "\uE000";
     var TRAILING_DOUBLESTAR = "\uE001";
     var extractBrackets = (pattern) => {
       const sources = [];
-      const hold = (source) => `${PLACEHOLDER}${sources.push(source) - 1}${PLACEHOLDER}`;
+      const hold = (source) => `${PLACEHOLDER2}${sources.push(source) - 1}${PLACEHOLDER2}`;
       const { length } = pattern;
       let out = EMPTY;
       let index = 0;
@@ -167,8 +167,8 @@ var require_ignore = __commonJS({
             );
           }
           index += 2;
-        } else if (char === PLACEHOLDER) {
-          out += hold(`[${PLACEHOLDER}]`);
+        } else if (char === PLACEHOLDER2) {
+          out += hold(`[${PLACEHOLDER2}]`);
           index++;
         } else if (char === "[") {
           const scanned = scanBracket(pattern, index);
@@ -25491,20 +25491,20 @@ var require_dependencies = __commonJS({
         const deps = propertyDeps[prop];
         if (deps.length === 0)
           continue;
-        const hasProperty = (0, code_1.propertyInData)(gen, data, prop, it.opts.ownProperties);
+        const hasProperty2 = (0, code_1.propertyInData)(gen, data, prop, it.opts.ownProperties);
         cxt.setParams({
           property: prop,
           depsCount: deps.length,
           deps: deps.join(", ")
         });
         if (it.allErrors) {
-          gen.if(hasProperty, () => {
+          gen.if(hasProperty2, () => {
             for (const depProp of deps) {
               (0, code_1.checkReportMissingProp)(cxt, depProp);
             }
           });
         } else {
-          gen.if((0, codegen_1._)`${hasProperty} && (${(0, code_1.checkMissingProp)(cxt, deps, missing2)})`);
+          gen.if((0, codegen_1._)`${hasProperty2} && (${(0, code_1.checkMissingProp)(cxt, deps, missing2)})`);
           (0, code_1.reportMissingProp)(cxt, missing2);
           gen.else();
         }
@@ -34333,7 +34333,7 @@ var require_public_api = __commonJS({
         return docs;
       return Object.assign([], { empty: true }, composer$1.streamInfo());
     }
-    function parseDocument(source, options = {}) {
+    function parseDocument2(source, options = {}) {
       const { lineCounter: lineCounter2, prettyErrors } = parseOptions2(options);
       const parser$1 = new parser.Parser(lineCounter2?.addNewLine);
       const composer$1 = new composer.Composer(options);
@@ -34359,7 +34359,7 @@ var require_public_api = __commonJS({
       } else if (options === void 0 && reviver && typeof reviver === "object") {
         options = reviver;
       }
-      const doc = parseDocument(src, options);
+      const doc = parseDocument2(src, options);
       if (!doc)
         return null;
       doc.warnings.forEach((warning) => log.warn(doc.options.logLevel, warning));
@@ -34395,7 +34395,7 @@ var require_public_api = __commonJS({
     }
     exports.parse = parse;
     exports.parseAllDocuments = parseAllDocuments;
-    exports.parseDocument = parseDocument;
+    exports.parseDocument = parseDocument2;
     exports.stringify = stringify;
   }
 });
@@ -34459,6 +34459,625 @@ import { createHash } from "node:crypto";
 import { constants, promises as fs } from "node:fs";
 import { dirname, isAbsolute, join, relative, resolve, sep } from "node:path";
 
+// packages/contracts/dist/framework-build-script.mjs
+var PINNED_BUN_VERSION = "1.2.22";
+var FRAMEWORK_VERSION_POLICY = Object.freeze({
+  next: Object.freeze({ floors: Object.freeze(["15.5.27", "16.3.8"]), denied: Object.freeze([]) }),
+  vite: Object.freeze({ floors: Object.freeze(["5.4.6"]), denied: Object.freeze([]) }),
+  "@tanstack/react-start": Object.freeze({
+    floors: Object.freeze(["1.168.60"]),
+    denied: Object.freeze([])
+  })
+});
+var STABLE_VERSION = /^(0|[1-9][0-9]{0,5})\.(0|[1-9][0-9]{0,5})\.(0|[1-9][0-9]{0,5})$/u;
+function parseStableVersion(version2) {
+  if (typeof version2 !== "string")
+    return null;
+  const match = STABLE_VERSION.exec(version2);
+  return match === null ? null : Object.freeze([Number(match[1]), Number(match[2]), Number(match[3])]);
+}
+function compareStableVersions(left, right) {
+  return left[0] - right[0] || left[1] - right[1] || left[2] - right[2];
+}
+function packagePolicy(packageName, policy) {
+  return typeof packageName === "string" && Object.hasOwn(policy, packageName) ? policy[
+    /** @type {FrameworkVersionPackage} */
+    packageName
+  ] : null;
+}
+function applicableFloor(entry, version2) {
+  let floor = null;
+  for (const candidate of entry.floors) {
+    const parsed = parseStableVersion(candidate);
+    if (parsed !== null && parsed[0] <= version2[0])
+      floor = parsed;
+  }
+  return floor;
+}
+function frameworkVersionVerdict(packageName, version2, policy = FRAMEWORK_VERSION_POLICY) {
+  const entry = packagePolicy(packageName, policy);
+  const parsed = parseStableVersion(version2);
+  if (entry === null || parsed === null)
+    return "invalid_version";
+  const floor = applicableFloor(entry, parsed);
+  if (floor === null || compareStableVersions(parsed, floor) < 0)
+    return "below_security_minimum";
+  for (const [introduced, fixed] of entry.denied) {
+    const from = parseStableVersion(introduced);
+    const to = fixed === null ? null : parseStableVersion(fixed);
+    if (from !== null && compareStableVersions(parsed, from) >= 0 && (to === null || compareStableVersions(parsed, to) < 0))
+      return "known_vulnerable";
+  }
+  return "admitted";
+}
+function frameworkVersionMinimum(packageName, version2, policy = FRAMEWORK_VERSION_POLICY) {
+  const entry = packagePolicy(packageName, policy);
+  if (entry === null)
+    throw new TypeError("Framework version package is not governed");
+  const lowest = parseStableVersion(entry.floors[0]);
+  if (lowest === null)
+    throw new TypeError("Framework version policy is invalid");
+  const core = typeof version2 === "string" ? /^[~^]?((?:0|[1-9][0-9]{0,5})\.(?:0|[1-9][0-9]{0,5})\.(?:0|[1-9][0-9]{0,5}))(?:[-+].*)?$/u.exec(version2) : null;
+  const parsed = parseStableVersion(core?.[1]);
+  let minimum = (parsed === null ? null : applicableFloor(entry, parsed)) ?? lowest;
+  let candidate = parsed !== null && compareStableVersions(parsed, minimum) >= 0 ? parsed : minimum;
+  for (let raised = true; raised; ) {
+    raised = false;
+    for (const [introduced, fixed] of entry.denied) {
+      const from = parseStableVersion(introduced);
+      const to = fixed === null ? null : parseStableVersion(fixed);
+      if (from !== null && to !== null && compareStableVersions(candidate, from) >= 0 && compareStableVersions(candidate, to) < 0) {
+        candidate = to;
+        minimum = to;
+        raised = true;
+      }
+    }
+  }
+  return minimum.join(".");
+}
+var TYPESCRIPT_BUILD_STAGE = /^tsc(?:[ \t]+(?:--noEmit|-b|--build))?$/u;
+function isAdmittedFrameworkBuildScript(framework, script) {
+  if (typeof script !== "string")
+    return false;
+  if (framework === "nextjs")
+    return script === "next build" || script === "next build --webpack";
+  if (framework !== "vite" && framework !== "tanstack-start")
+    return false;
+  const stages = script.trim().split(/[ \t]*&&[ \t]*/u);
+  if (stages.length === 1)
+    return stages[0] === "vite build";
+  if (stages.length !== 2)
+    return false;
+  return stages[0] === "vite build" && TYPESCRIPT_BUILD_STAGE.test(stages[1] ?? "") || TYPESCRIPT_BUILD_STAGE.test(stages[0] ?? "") && stages[1] === "vite build";
+}
+
+// packages/contracts/dist/customer-auth-admission.js
+function managedCustomerAuthDatabaseMessage(path2) {
+  return `"${path2}" selects the managed Better Auth bridge, which requires the managed PostgreSQL database. Set database.enabled: true with an admitted migrations path, or set auth.provider: none and keep the application-owned authentication configuration. Commit and push the change, then plan the new commit.`;
+}
+function managedCustomerAuthAdmissionIssue(capabilities) {
+  if (capabilities?.auth?.provider !== "better-auth") {
+    return null;
+  }
+  if (capabilities.database?.enabled !== true) {
+    return Object.freeze({
+      code: "managed_auth_database_required",
+      message: managedCustomerAuthDatabaseMessage("ohmyhost.yaml")
+    });
+  }
+  return null;
+}
+
+// packages/contracts/dist/framework-admission.js
+var ADMISSION_DIAGNOSTIC_CODES = Object.freeze({
+  ambiguous_config: "framework_config_ambiguous",
+  ambiguous_lockfile: "lockfile_ambiguous",
+  invalid_package_manager: "package_manager_invalid",
+  missing_lockfile: "lockfile_missing",
+  missing_package_manager: "package_manager_missing",
+  package_manager_lockfile_mismatch: "package_manager_lockfile_mismatch",
+  package_manager_version_unsupported: "package_manager_version_unsupported"
+});
+var FrameworkAdmissionError = class extends Error {
+  reason;
+  code = "framework_admission_failed";
+  /** The catalog diagnostic of the refused file, relative to the application root. */
+  diagnostic;
+  constructor(reason, path2) {
+    super("Framework source is not admitted");
+    this.reason = reason;
+    this.name = "FrameworkAdmissionError";
+    this.diagnostic = requiredDiagnostic({ code: ADMISSION_DIAGNOSTIC_CODES[reason], path: path2 });
+  }
+};
+var PACKAGE_MANAGER_CONTRACTS = Object.freeze({
+  bun: Object.freeze({
+    lockfiles: Object.freeze(["bun.lock", "bun.lockb"]),
+    installCommand: "bun install --frozen-lockfile --ignore-scripts",
+    buildCommand: "bun run build"
+  }),
+  npm: Object.freeze({
+    lockfiles: Object.freeze(["package-lock.json"]),
+    installCommand: "npm ci --ignore-scripts",
+    buildCommand: "npm run build"
+  }),
+  pnpm: Object.freeze({
+    lockfiles: Object.freeze(["pnpm-lock.yaml"]),
+    installCommand: "pnpm install --frozen-lockfile --ignore-scripts",
+    buildCommand: "pnpm run build"
+  }),
+  yarn: Object.freeze({
+    lockfiles: Object.freeze(["yarn.lock"]),
+    installCommand: "yarn install --immutable --mode=skip-build",
+    buildCommand: "yarn run build"
+  })
+});
+var ALL_LOCKFILES = Object.freeze(Object.values(PACKAGE_MANAGER_CONTRACTS).flatMap(({ lockfiles }) => lockfiles));
+var PACKAGE_MANIFEST = "package.json";
+var PACKAGE_MANAGER_DECLARATION = /^(bun|npm|pnpm|yarn)@((?:0|[1-9][0-9]*)\.(?:0|[1-9][0-9]*)\.(?:0|[1-9][0-9]*))$/u;
+function resolvePackageManager(input) {
+  const presentLockfiles = ALL_LOCKFILES.filter((lockfile2) => input.files.includes(lockfile2));
+  if (presentLockfiles.length === 0) {
+    throw new FrameworkAdmissionError("missing_lockfile", PACKAGE_MANIFEST);
+  }
+  if (presentLockfiles.length !== 1) {
+    throw new FrameworkAdmissionError("ambiguous_lockfile", PACKAGE_MANIFEST);
+  }
+  if (input.packageManager === void 0) {
+    throw new FrameworkAdmissionError("missing_package_manager", PACKAGE_MANIFEST);
+  }
+  const declaration = PACKAGE_MANAGER_DECLARATION.exec(input.packageManager);
+  if (declaration === null) {
+    throw new FrameworkAdmissionError("invalid_package_manager", PACKAGE_MANIFEST);
+  }
+  const manager = declaration[1];
+  const version2 = declaration[2];
+  const contract = PACKAGE_MANAGER_CONTRACTS[manager];
+  const lockfile = presentLockfiles[0];
+  if (!contract.lockfiles.includes(lockfile)) {
+    throw new FrameworkAdmissionError("package_manager_lockfile_mismatch", lockfile);
+  }
+  if (manager === "bun" && version2 !== PINNED_BUN_VERSION) {
+    throw new FrameworkAdmissionError("package_manager_version_unsupported", PACKAGE_MANIFEST);
+  }
+  return Object.freeze({
+    manager,
+    version: version2,
+    lockfile,
+    installCommand: contract.installCommand,
+    buildCommand: contract.buildCommand
+  });
+}
+function resolveFrameworkConfig(basename2, files) {
+  const supported = [`${basename2}.js`, `${basename2}.mjs`, `${basename2}.ts`];
+  const matches = supported.filter((candidate) => files.includes(candidate));
+  if (matches.length > 1) {
+    throw new FrameworkAdmissionError("ambiguous_config", matches[0]);
+  }
+  return matches[0] ?? null;
+}
+var STABLE_VERSION_SOURCE = "(?:0|[1-9][0-9]{0,5})\\.(?:0|[1-9][0-9]{0,5})\\.(?:0|[1-9][0-9]{0,5})";
+var VERSION_RANGE = new RegExp(`^([~^])(${STABLE_VERSION_SOURCE})$`, "u");
+function classifyFrameworkVersion(packageName, declared, resolved = null, policy = FRAMEWORK_VERSION_POLICY) {
+  const judged = resolved ?? declared;
+  const range = resolved === null ? VERSION_RANGE.exec(declared) : null;
+  let status;
+  if (range === null) {
+    status = frameworkVersionVerdict(packageName, judged, policy) === "admitted" ? "admitted" : "unsupported";
+  } else {
+    status = rangeStatus(packageName, range[1] === "^", range[2], policy);
+  }
+  return Object.freeze({
+    package: packageName,
+    status,
+    declared,
+    resolved,
+    minimum: frameworkVersionMinimum(packageName, judged, policy)
+  });
+}
+function rangeStatus(packageName, caret, base, policy) {
+  const lower = policyVersion(base);
+  const upper = caret ? [lower[0] + 1, 0, 0] : [lower[0], lower[1] + 1, 0];
+  if (frameworkVersionVerdict(packageName, base, policy) === "admitted" && !policy[packageName].denied.some(([introduced, fixed]) => {
+    const from = parseStableVersion(introduced);
+    const to = fixed === null ? null : parseStableVersion(fixed);
+    return from !== null && compareStableVersions(from, upper) < 0 && (to === null || compareStableVersions(to, lower) > 0);
+  }))
+    return "admitted";
+  const minimum = policyVersion(frameworkVersionMinimum(packageName, base, policy));
+  const candidate = compareStableVersions(minimum, lower) > 0 ? minimum : lower;
+  return compareStableVersions(candidate, upper) < 0 && frameworkVersionVerdict(packageName, candidate.join("."), policy) === "admitted" ? "pending" : "unsupported";
+}
+function policyVersion(version2) {
+  const parsed = parseStableVersion(version2);
+  if (parsed === null)
+    throw new TypeError("Framework version policy is invalid");
+  return parsed;
+}
+var RESOLVED_VERSION_SOURCE = `${STABLE_VERSION_SOURCE}(?:-[0-9A-Za-z.-]{1,32})?`;
+var RESOLVED_VERSION_FIELD = anchoredPattern(RESOLVED_VERSION_SOURCE);
+var DECLARED_VERSION_FIELD = anchoredPattern(`[~^]?${RESOLVED_VERSION_SOURCE}`);
+var STABLE_VERSION_FIELD = anchoredPattern(STABLE_VERSION_SOURCE);
+function isResolvedFrameworkVersion(value) {
+  return typeof value === "string" && RESOLVED_VERSION_FIELD.test(value);
+}
+function frameworkVersionDiagnostic(admission, lockfile) {
+  if (admission.status !== "unsupported")
+    return null;
+  if (admission.resolved !== null) {
+    if (lockfile === null)
+      throw new TypeError("Framework version lockfile is required");
+    return requiredDiagnostic({
+      code: "framework_version_unsupported",
+      path: lockfile,
+      package: admission.package,
+      version: admission.resolved,
+      minimum: admission.minimum
+    });
+  }
+  return DECLARED_VERSION_FIELD.test(admission.declared) ? requiredDiagnostic({
+    code: "framework_version_unsupported",
+    path: PACKAGE_MANIFEST,
+    package: admission.package,
+    version: admission.declared,
+    minimum: admission.minimum
+  }) : requiredDiagnostic({
+    code: "framework_version_declaration_unsupported",
+    path: PACKAGE_MANIFEST,
+    package: admission.package
+  });
+}
+var FRAMEWORK_VERSION_PACKAGES = Object.freeze([
+  "next",
+  "vite",
+  "@tanstack/react-start"
+]);
+var FRAMEWORK_DEPENDENCY_PACKAGES = Object.freeze([
+  "next",
+  "react",
+  "react-dom",
+  "vite",
+  "@tanstack/react-start",
+  "@tanstack/react-router",
+  "@vitejs/plugin-react",
+  "@cloudflare/vite-plugin"
+]);
+var REACT_PACKAGES = Object.freeze(["react", "react-dom"]);
+var BUILD_FRAMEWORKS = Object.freeze(["nextjs", "vite-static", "tanstack-start"]);
+var PUSH_AND_PLAN = "Commit and push the change, then plan the new commit.";
+var VITE_BUILD_SCRIPT = '"vite build", optionally joined with && to one "tsc", "tsc -b", "tsc --build" or "tsc --noEmit" stage';
+var FRAMEWORK_CONVERSION_DETAILS = Object.freeze({
+  managed_auth_database_required: {
+    paths: ["repository_config"],
+    template: managedCustomerAuthDatabaseMessage("{{path}}")
+  },
+  database_binding_private: {
+    paths: ["module"],
+    template: `"{{path}}" reads a database connection string (DATABASE_URL, HYPERDRIVE, connectionString or a postgres:// URL); none reaches a customer Worker. Call the database with createPrivateDatabaseClient from "@ohmyhost/customer-runtime/database". ${PUSH_AND_PLAN}`
+  },
+  database_driver_unsupported: {
+    paths: ["module"],
+    template: `"{{path}}" imports a database socket driver (pg, postgres, pg-native or mysql2); customer Workers cannot open sockets. Call the database with createPrivateDatabaseClient from "@ohmyhost/customer-runtime/database". ${PUSH_AND_PLAN}`
+  },
+  source_syntax_invalid: {
+    paths: ["module"],
+    template: 'Invalid JavaScript or TypeScript in "{{path}}". Fix the file, commit and push the change, then plan the new commit.'
+  },
+  worker_module_default_export_required: {
+    paths: ["module"],
+    template: `Worker module "{{path}}" has no default export. Export default { fetch, scheduled } with the handlers ohmyho.st invokes; named exports are never called. ${PUSH_AND_PLAN}`
+  },
+  scheduled_handler_required: {
+    paths: ["module"],
+    template: 'functions.crons is declared but "{{path}}" exports no scheduled handler. Add scheduled(controller, env, ctx) to its default export, commit and push the change, then plan the new commit.'
+  },
+  framework_base_path_unsupported: {
+    paths: ["framework_config"],
+    template: `"{{path}}" sets a Vite base. ohmyho.st serves the app at the root origin: remove base or set base: "/". ${PUSH_AND_PLAN}`
+  },
+  tanstack_prerender_required: {
+    paths: ["framework_config"],
+    template: `"{{path}}" does not call tanstackStart({ prerender: { enabled: true } }), which the static TanStack Start runtime needs; enable prerender, or set runtime.mode: edge with the Cloudflare Vite plugin. ${PUSH_AND_PLAN}`
+  },
+  tanstack_vite_plugins_required: {
+    paths: ["framework_config"],
+    template: `"{{path}}" does not follow the TanStack Start plugin contract: import tanstackStart from "@tanstack/react-start/plugin/vite"; on runtime edge also import cloudflare from "@cloudflare/vite-plugin" and call cloudflare({ viteEnvironment: { name: "ssr" } }) before tanstackStart(); on runtime static do not import the Cloudflare plugin. ${PUSH_AND_PLAN}`
+  },
+  next_cache_components_unsupported: {
+    paths: ["framework_config"],
+    template: `"{{path}}" sets cacheComponents: true, which ohmyho.st does not support; remove it or set it to false. ${PUSH_AND_PLAN}`
+  },
+  framework_version_unsupported: {
+    paths: ["manifest", "lockfile"],
+    fields: {
+      package: FRAMEWORK_VERSION_PACKAGES,
+      version: DECLARED_VERSION_FIELD,
+      minimum: STABLE_VERSION_FIELD
+    },
+    derived: { verb: { from: "path", text: { manifest: "declares", lockfile: "resolves" } } },
+    template: '"{{path}}" {{verb}} {{package}} {{version}}, which ohmyho.st does not admit; use {{package}} {{minimum}} or a later stable release, update package.json and the lockfile, commit and push the change, then plan the new commit.'
+  },
+  framework_version_declaration_unsupported: {
+    paths: ["manifest"],
+    fields: { package: FRAMEWORK_VERSION_PACKAGES },
+    template: '"{{path}}" declares {{package}} in a form ohmyho.st cannot check against its security minimum; declare an exact X.Y.Z version or a ^X.Y.Z or ~X.Y.Z range, update the lockfile, commit and push the change, then plan the new commit.'
+  },
+  framework_dependency_required: {
+    paths: ["manifest"],
+    fields: { package: FRAMEWORK_DEPENDENCY_PACKAGES },
+    template: '"{{path}}" does not declare {{package}} in dependencies, which this framework and runtime need. Add it with the package manager so the lockfile records it, commit and push the change, then plan the new commit.'
+  },
+  react_version_exact_required: {
+    paths: ["manifest"],
+    fields: { package: REACT_PACKAGES },
+    template: '"{{path}}" must declare {{package}} in dependencies at an exact version such as 19.1.0, without ^ or ~, for Next.js. Pin the version the lockfile installs, commit and push the change, then plan the new commit.'
+  },
+  build_script_unsupported: {
+    paths: ["manifest"],
+    fields: { framework: BUILD_FRAMEWORKS },
+    derived: {
+      script: {
+        from: "framework",
+        text: {
+          nextjs: 'exactly "next build" or "next build --webpack"; ohmyho.st adds the OpenNext build itself',
+          "vite-static": VITE_BUILD_SCRIPT,
+          "tanstack-start": VITE_BUILD_SCRIPT
+        }
+      }
+    },
+    template: '"{{path}}" scripts.build is missing or not admitted for the {{framework}} adapter: it must be {{script}}. Move other steps into their own scripts, commit and push the change, then plan the new commit.'
+  },
+  better_auth_version_required: {
+    paths: ["manifest"],
+    template: '"{{path}}" must declare better-auth at exactly 1.7.1 in dependencies because ohmyhost.yaml sets auth.provider: better-auth. Pin that version or set auth.provider: none, commit and push the change, then plan the new commit.'
+  },
+  package_manifest_invalid: {
+    paths: ["manifest"],
+    template: '"{{path}}" is missing or is not one JSON object. Add package.json in the applicationRoot that ohmyhost.yaml names, or fix its syntax so the whole file parses as one object; commit and push the change, then plan the new commit.'
+  },
+  framework_unsupported: {
+    paths: ["manifest"],
+    template: `"{{path}}" declares none of next, vite or @tanstack/react-start. Add the app's framework to dependencies, or set runtime.mode: functions in ohmyhost.yaml and add src/ohmyhost/worker.ts. ${PUSH_AND_PLAN}`
+  },
+  framework_ambiguous: {
+    paths: ["manifest"],
+    template: '"{{path}}" declares next together with vite or @tanstack/react-start, so ohmyho.st cannot choose one framework. Remove the packages of the framework this application does not use, commit and push the change, then plan the new commit.'
+  },
+  lockfile_missing: {
+    paths: ["manifest"],
+    template: '"{{path}}" has no lockfile beside it. Install with the packageManager it names so package-lock.json, pnpm-lock.yaml, yarn.lock or bun.lock is written, commit and push the change, then plan the new commit.'
+  },
+  lockfile_ambiguous: {
+    paths: ["manifest"],
+    template: '"{{path}}" has more than one lockfile beside it. Keep only the lockfile of the packageManager it names and delete the others, commit and push the change, then plan the new commit.'
+  },
+  package_manager_missing: {
+    paths: ["manifest"],
+    template: '"{{path}}" has no packageManager field. Set it to name@X.Y.Z for the npm, pnpm, yarn or bun version that wrote the lockfile, commit and push the change, then plan the new commit.'
+  },
+  package_manager_invalid: {
+    paths: ["manifest"],
+    template: '"{{path}}" sets packageManager to a value ohmyho.st cannot use. Write npm, pnpm, yarn or bun, then @ and an exact X.Y.Z version without a +sha suffix, matching the lockfile; commit and push the change, then plan the new commit.'
+  },
+  package_manager_lockfile_mismatch: {
+    paths: ["lockfile"],
+    template: '"{{path}}" was not written by the packageManager that package.json names. Set packageManager to the manager of this lockfile, or replace the lockfile with one from the named manager; commit and push the change, then plan the new commit.'
+  },
+  package_manager_version_unsupported: {
+    paths: ["manifest"],
+    template: `"{{path}}" pins a Bun version other than ${PINNED_BUN_VERSION}, the only Bun ohmyho.st builds with. Set packageManager to bun@${PINNED_BUN_VERSION}, reinstall to update the lockfile, commit and push the change, then plan the new commit.`
+  },
+  repository_configuration_invalid: {
+    paths: ["repository_config"],
+    template: '"{{path}}" does not match the ohmyho.st configuration schema. Run ohmyhost init --dry-run --json locally to see the exact field and fix, commit and push the change, then plan the new commit.'
+  },
+  runtime_mode_unsupported: {
+    paths: ["repository_config"],
+    fields: { framework: BUILD_FRAMEWORKS },
+    derived: {
+      mode: {
+        from: "framework",
+        text: {
+          nextjs: "runtime.mode: edge",
+          "vite-static": "runtime.mode: edge with src/ohmyhost/companion.ts when database, auth, mail, storage or functions.crons is set, and static otherwise",
+          "tanstack-start": "runtime.mode: edge, or static without functions.crons and storage"
+        }
+      }
+    },
+    template: `"{{path}}" sets a runtime.mode that the {{framework}} adapter cannot run with this configuration; use {{mode}}. ${PUSH_AND_PLAN}`
+  },
+  build_output_unsupported: {
+    paths: ["repository_config"],
+    fields: { framework: BUILD_FRAMEWORKS },
+    derived: {
+      output: {
+        from: "framework",
+        text: {
+          nextjs: ".open-next/assets",
+          "vite-static": "dist",
+          "tanstack-start": "dist/client"
+        }
+      }
+    },
+    template: `"{{path}}" sets a build.output that the {{framework}} adapter does not produce; set build.output: {{output}}. ${PUSH_AND_PLAN}`
+  },
+  build_command_mismatch: {
+    paths: ["repository_config"],
+    template: '"{{path}}" build.install or build.command differs from the commands of the packageManager in package.json (for npm: npm ci --ignore-scripts and npm run build). ohmyhost init --dry-run --json prints the exact values; set them, commit and push the change, then plan the new commit.'
+  },
+  build_option_unsupported: {
+    paths: ["repository_config"],
+    template: '"{{path}}" sets a build option this runtime ignores: build.ssg_cache_max_mib applies only to Next.js, and runtime.mode: functions takes only build.install. Remove the option, commit and push the change, then plan the new commit.'
+  },
+  application_root_missing: {
+    paths: ["repository_config"],
+    template: `"{{path}}" sets applicationRoot to a directory that is missing or empty in this commit. Set it to the directory that holds the app's package.json, or "." for the repository root; commit and push the change, then plan the new commit.`
+  },
+  framework_config_required: {
+    paths: ["framework_config"],
+    template: 'This application has no "{{path}}". Add one framework config with that name and a .js, .mjs or .ts extension that exports its config as default, commit and push the change, then plan the new commit.'
+  },
+  framework_config_ambiguous: {
+    paths: ["framework_config"],
+    template: '"{{path}}" exists beside another variant with the same name and a .js, .mjs or .ts extension. Keep exactly one and delete the others, commit and push the change, then plan the new commit.'
+  },
+  framework_config_too_large: {
+    paths: ["framework_config"],
+    template: '"{{path}}" is larger than the 256 KiB ohmyho.st inspects. Keep the config small and move large data into imported modules, commit and push the change, then plan the new commit.'
+  },
+  framework_config_default_export_required: {
+    paths: ["framework_config"],
+    template: '"{{path}}" does not export its config as default. Use export default (next.config.js may assign module.exports instead), commit and push the change, then plan the new commit.'
+  },
+  next_output_unsupported: {
+    paths: ["framework_config"],
+    template: '"{{path}}" sets output: "export" or output: "standalone", which the Next.js edge runtime on ohmyho.st cannot serve. Remove the output setting, commit and push the change, then plan the new commit.'
+  },
+  next_base_path_unsupported: {
+    paths: ["framework_config"],
+    template: `"{{path}}" sets basePath or assetPrefix. ohmyho.st serves the app at the root origin: remove both or set them to "". ${PUSH_AND_PLAN}`
+  },
+  companion_entry_required: {
+    paths: ["module"],
+    template: '"{{path}}" is missing. A Vite app with runtime.mode: edge or with database, auth, mail, storage or functions.crons needs this Worker module with export default { fetch }. Add it, or use runtime.mode: static without those settings; commit and push the change, then plan the new commit.'
+  },
+  worker_module_required: {
+    paths: ["module"],
+    template: '"{{path}}" is missing. runtime.mode: functions and functions.crons on Next.js or TanStack Start need this Worker module; export default { fetch, scheduled } with the handlers ohmyho.st invokes. Add it, commit and push the change, then plan the new commit.'
+  },
+  worker_module_fetch_handler_required: {
+    paths: ["module"],
+    template: `Worker module "{{path}}" exports no fetch handler; runtime.mode: functions serves every request and the health check through it. Add a fetch handler that receives request, env and ctx to its default export. ${PUSH_AND_PLAN}`
+  }
+});
+var DETAIL_DEFINITIONS = FRAMEWORK_CONVERSION_DETAILS;
+var PLACEHOLDER = /\{\{([a-z]+)\}\}/gu;
+var PATH_PATTERN = "[A-Za-z0-9_@()[\\]./${}-]{1,240}";
+var SAFE_PATH = new RegExp(`^${PATH_PATTERN}$`, "u");
+var MODULE_PATH = /^[A-Za-z0-9_@()[\]./${}-]+\.(?:[cm]?[jt]sx?)$/u;
+var FRAMEWORK_CONFIG_NAME = /^(?:next|open-next|vite)\.config\.(?:js|mjs|ts)$/u;
+var MAXIMUM_DETAIL_LENGTH = 2e3;
+var DETAIL_PATTERNS = Object.freeze(Object.entries(DETAIL_DEFINITIONS).map(([code, definition]) => Object.freeze({
+  code,
+  pattern: detailPattern(definition)
+})));
+function anchoredPattern(source) {
+  return new RegExp(`^(?:${source})$`, "u");
+}
+function escapePattern(text) {
+  return text.replace(/[\\^$.*+?()[\]{}|]/gu, "\\$&");
+}
+function detailPattern(definition) {
+  const placed = /* @__PURE__ */ new Set();
+  let pattern = "^";
+  let offset = 0;
+  for (const match of definition.template.matchAll(PLACEHOLDER)) {
+    const name = match[1];
+    pattern += escapePattern(definition.template.slice(offset, match.index));
+    pattern += placed.has(name) ? `\\k<${name}>` : `(?<${name}>${placeholderPattern(definition, name)})`;
+    placed.add(name);
+    offset = match.index + match[0].length;
+  }
+  return new RegExp(`${pattern}${escapePattern(definition.template.slice(offset))}$`, "u");
+}
+function placeholderPattern(definition, name) {
+  if (name === "path")
+    return PATH_PATTERN;
+  const grammar = definition.fields?.[name];
+  if (grammar instanceof RegExp)
+    return grammar.source.slice(1, -1);
+  const values = grammar ?? Object.values(definition.derived?.[name]?.text ?? {});
+  if (values.length === 0)
+    throw new TypeError("Framework conversion detail template is invalid");
+  return `(?:${[...new Set(values)].map(escapePattern).join("|")})`;
+}
+function pathClassOf(definition, path2) {
+  if (path2 === "ohmyhost.yaml" && definition.paths.includes("repository_config"))
+    return "repository_config";
+  if (!SAFE_PATH.test(path2) || path2.split("/").some((segment) => segment === "" || segment === "." || segment === ".."))
+    return null;
+  const leaf = path2.slice(path2.lastIndexOf("/") + 1);
+  return definition.paths.find((pathClass) => pathClass === "module" && MODULE_PATH.test(path2) || pathClass === "manifest" && leaf === PACKAGE_MANIFEST || pathClass === "lockfile" && ALL_LOCKFILES.includes(leaf) || pathClass === "framework_config" && FRAMEWORK_CONFIG_NAME.test(leaf)) ?? null;
+}
+function fieldMatches(grammar, value) {
+  if (typeof value !== "string")
+    return false;
+  return grammar instanceof RegExp ? grammar.test(value) : grammar.includes(value);
+}
+function isFrameworkConversionDiagnosticCode(value) {
+  return typeof value === "string" && Object.hasOwn(DETAIL_DEFINITIONS, value);
+}
+function parseFrameworkConversionDiagnostic(value) {
+  if (typeof value !== "object" || value === null || Array.isArray(value))
+    return null;
+  const record6 = value;
+  const code = Object.hasOwn(record6, "code") ? record6["code"] : void 0;
+  const path2 = Object.hasOwn(record6, "path") ? record6["path"] : void 0;
+  if (!isFrameworkConversionDiagnosticCode(code) || typeof path2 !== "string")
+    return null;
+  const definition = DETAIL_DEFINITIONS[code];
+  const fields = Object.entries(definition.fields ?? {}).map(([name, grammar]) => [name, grammar, Object.hasOwn(record6, name) ? record6[name] : void 0]);
+  if (Object.keys(record6).length !== fields.length + 2 || pathClassOf(definition, path2) === null || fields.some(([, grammar, field]) => !fieldMatches(grammar, field)))
+    return null;
+  return Object.freeze(Object.fromEntries([
+    ["code", code],
+    ["path", path2],
+    ...fields.map(([name, , field]) => [name, field])
+  ]));
+}
+function requiredDiagnostic(value) {
+  const diagnostic2 = parseFrameworkConversionDiagnostic(value);
+  if (diagnostic2 === null)
+    throw new TypeError("Framework conversion diagnostic is invalid");
+  return diagnostic2;
+}
+function renderDetail(diagnostic2) {
+  const definition = DETAIL_DEFINITIONS[diagnostic2.code];
+  const values = diagnostic2;
+  const pathClass = pathClassOf(definition, diagnostic2.path);
+  return definition.template.replace(PLACEHOLDER, (_placeholder, name) => {
+    const derived = definition.derived?.[name];
+    const value = derived === void 0 ? values[name] : derived.text[String(derived.from === "path" ? pathClass : values[derived.from])];
+    if (typeof value !== "string")
+      throw new TypeError("Framework conversion diagnostic is invalid");
+    return value;
+  });
+}
+function frameworkConversionDetail(value) {
+  const diagnostic2 = parseFrameworkConversionDiagnostic(value);
+  return diagnostic2 === null ? null : renderDetail(diagnostic2);
+}
+function frameworkConversionDiagnosticFromDetail(value) {
+  if (typeof value !== "string" || value.length > MAXIMUM_DETAIL_LENGTH)
+    return null;
+  for (const { code, pattern } of DETAIL_PATTERNS) {
+    const groups = pattern.exec(value)?.groups;
+    if (groups === void 0)
+      continue;
+    const diagnostic2 = parseFrameworkConversionDiagnostic({
+      code,
+      path: groups["path"],
+      ...Object.fromEntries(Object.keys(DETAIL_DEFINITIONS[code].fields ?? {}).map((name) => [name, groups[name]]))
+    });
+    if (diagnostic2 !== null && renderDetail(diagnostic2) === value)
+      return diagnostic2;
+  }
+  return null;
+}
+function parseFrameworkConversionDetail(value) {
+  const diagnostic2 = frameworkConversionDiagnosticFromDetail(value);
+  return diagnostic2 === null ? null : renderDetail(diagnostic2);
+}
+function rootFrameworkConversionDiagnostic(value, applicationRoot) {
+  const diagnostic2 = parseFrameworkConversionDiagnostic(value);
+  if (diagnostic2 === null || applicationRoot === "." || DETAIL_DEFINITIONS[diagnostic2.code].paths.includes("repository_config"))
+    return diagnostic2;
+  return parseFrameworkConversionDiagnostic({
+    ...diagnostic2,
+    path: `${applicationRoot}/${diagnostic2.path}`
+  });
+}
+
 // packages/contracts/dist/operation-failure.js
 var failures = {
   authorization_changed: [
@@ -34575,7 +35194,7 @@ var failures = {
   ],
   auto_deploy_plan_rejected: [
     "The GitHub push could not be planned for deployment.",
-    "Read project status and the operation's error or deployment diagnostics. Correct the source or configuration named there, push the new commit and plan it before deploying. Replaying this failed operation cannot start a build."
+    "Read error.detail: it names the file, the rule and the required change. Make that change, commit and push it; the next push is planned again. Without error.detail, plan the pushed commit explicitly with 'ohmyhost plan --project ULID --commit SHA --json' or MCP deployment_plan to read the reason. Replaying this failed operation cannot start a build."
   ],
   promotion_source_stale: [
     "The Dev deployment changed before promotion could start.",
@@ -34596,11 +35215,18 @@ function publicOperationReconciliation(observation) {
     suggested_action: observation.state === "required" ? "Confirm reconciliation of this same operation; preserve its existing build and resources. Do not submit another deployment." : "Reconciliation is running. Poll this same operation after 60 seconds; do not start another reconciliation or deployment."
   });
 }
-function publicOperationFailure(internalCode) {
+function publicOperationFailure(internalCode, diagnostic2) {
   const normalized = internalCode.toLowerCase();
   const code = Object.hasOwn(failures, normalized) ? normalized : "operation_failed";
   const [message, suggested_action] = failures[code];
-  return Object.freeze({ code, message, retryable: false, suggested_action });
+  const detail = code === "auto_deploy_plan_rejected" ? frameworkConversionDetail(diagnostic2) : null;
+  return Object.freeze({
+    code,
+    message,
+    retryable: false,
+    suggested_action,
+    ...detail === null ? {} : { detail }
+  });
 }
 
 // packages/contracts/dist/managed-sources.js
@@ -35587,242 +36213,6 @@ function invalid2() {
   throw new TypeError("Project data change plan is invalid");
 }
 
-// packages/contracts/dist/framework-build-script.mjs
-var PINNED_BUN_VERSION = "1.2.22";
-function isAdmittedNextVersion(version2) {
-  if (typeof version2 !== "string")
-    return false;
-  const match = /^(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)$/u.exec(version2);
-  if (match === null)
-    return false;
-  const major = Number(match[1]);
-  const minor = Number(match[2]);
-  const patch = Number(match[3]);
-  if (![major, minor, patch].every(Number.isSafeInteger))
-    return false;
-  return major === 15 && minor === 5 && patch >= 26 || major === 16 && minor === 3 && patch === 8;
-}
-var TYPESCRIPT_BUILD_STAGE = /^tsc(?:[ \t]+(?:--noEmit|-b|--build))?$/u;
-function isAdmittedFrameworkBuildScript(framework, script) {
-  if (typeof script !== "string")
-    return false;
-  if (framework === "nextjs")
-    return script === "next build" || script === "next build --webpack";
-  if (framework !== "vite" && framework !== "tanstack-start")
-    return false;
-  const stages = script.trim().split(/[ \t]*&&[ \t]*/u);
-  if (stages.length === 1)
-    return stages[0] === "vite build";
-  if (stages.length !== 2)
-    return false;
-  return stages[0] === "vite build" && TYPESCRIPT_BUILD_STAGE.test(stages[1] ?? "") || TYPESCRIPT_BUILD_STAGE.test(stages[0] ?? "") && stages[1] === "vite build";
-}
-
-// packages/contracts/dist/customer-auth-admission.js
-function managedCustomerAuthDatabaseMessage(path2) {
-  return `"${path2}" selects the managed Better Auth bridge, which requires the managed PostgreSQL database. Set database.enabled: true with an admitted migrations path, or set auth.provider: none and keep the application-owned authentication configuration. Commit and push the change, then plan the new commit.`;
-}
-function managedCustomerAuthAdmissionIssue(capabilities) {
-  if (capabilities?.auth?.provider !== "better-auth") {
-    return null;
-  }
-  if (capabilities.database?.enabled !== true) {
-    return Object.freeze({
-      code: "managed_auth_database_required",
-      message: managedCustomerAuthDatabaseMessage("ohmyhost.yaml")
-    });
-  }
-  return null;
-}
-
-// packages/contracts/dist/framework-admission.js
-var FrameworkAdmissionError = class extends Error {
-  reason;
-  code = "framework_admission_failed";
-  constructor(reason) {
-    super("Framework source is not admitted");
-    this.reason = reason;
-    this.name = "FrameworkAdmissionError";
-  }
-};
-var PACKAGE_MANAGER_CONTRACTS = Object.freeze({
-  bun: Object.freeze({
-    lockfiles: Object.freeze(["bun.lock", "bun.lockb"]),
-    installCommand: "bun install --frozen-lockfile --ignore-scripts",
-    buildCommand: "bun run build"
-  }),
-  npm: Object.freeze({
-    lockfiles: Object.freeze(["package-lock.json"]),
-    installCommand: "npm ci --ignore-scripts",
-    buildCommand: "npm run build"
-  }),
-  pnpm: Object.freeze({
-    lockfiles: Object.freeze(["pnpm-lock.yaml"]),
-    installCommand: "pnpm install --frozen-lockfile --ignore-scripts",
-    buildCommand: "pnpm run build"
-  }),
-  yarn: Object.freeze({
-    lockfiles: Object.freeze(["yarn.lock"]),
-    installCommand: "yarn install --immutable --mode=skip-build",
-    buildCommand: "yarn run build"
-  })
-});
-var ALL_LOCKFILES = Object.freeze(Object.values(PACKAGE_MANAGER_CONTRACTS).flatMap(({ lockfiles }) => lockfiles));
-var EXACT_VERSION = /^(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)$/u;
-var PACKAGE_MANAGER_DECLARATION = /^(bun|npm|pnpm|yarn)@((?:0|[1-9][0-9]*)\.(?:0|[1-9][0-9]*)\.(?:0|[1-9][0-9]*))$/u;
-function resolvePackageManager(input) {
-  const presentLockfiles = ALL_LOCKFILES.filter((lockfile2) => input.files.includes(lockfile2));
-  if (presentLockfiles.length === 0)
-    throw new FrameworkAdmissionError("missing_lockfile");
-  if (presentLockfiles.length !== 1)
-    throw new FrameworkAdmissionError("ambiguous_lockfile");
-  if (input.packageManager === void 0) {
-    throw new FrameworkAdmissionError("missing_package_manager");
-  }
-  const declaration = PACKAGE_MANAGER_DECLARATION.exec(input.packageManager);
-  if (declaration === null)
-    throw new FrameworkAdmissionError("invalid_package_manager");
-  const manager = declaration[1];
-  const version2 = declaration[2];
-  const contract = PACKAGE_MANAGER_CONTRACTS[manager];
-  const lockfile = presentLockfiles[0];
-  if (!contract.lockfiles.includes(lockfile)) {
-    throw new FrameworkAdmissionError("package_manager_lockfile_mismatch");
-  }
-  if (manager === "bun" && version2 !== PINNED_BUN_VERSION) {
-    throw new FrameworkAdmissionError("package_manager_version_unsupported");
-  }
-  return Object.freeze({
-    manager,
-    version: version2,
-    lockfile,
-    installCommand: contract.installCommand,
-    buildCommand: contract.buildCommand
-  });
-}
-function resolveFrameworkConfig(basename2, files) {
-  const supported = [`${basename2}.js`, `${basename2}.mjs`, `${basename2}.ts`];
-  const matches = supported.filter((candidate) => files.includes(candidate));
-  if (matches.length > 1)
-    throw new FrameworkAdmissionError("ambiguous_config");
-  return matches[0] ?? null;
-}
-var VERIFIED_VERSIONS = Object.freeze({
-  vite: /* @__PURE__ */ new Set(["5.4.21", "8.0.16", "8.2.2"]),
-  "tanstack-start": /* @__PURE__ */ new Set(["1.168.26", "1.168.49"]),
-  nextjs: /* @__PURE__ */ new Set(["15.5.26", "16.3.8"])
-});
-function classifyFrameworkVersion(framework, version2) {
-  const parsed = parseVersionSpec(version2);
-  if (parsed === null)
-    return versionAdmission("unsupported", "invalid_version");
-  if (!insideAdmittedWindow(framework, parsed.version)) {
-    return versionAdmission("unsupported", "outside_admitted_window");
-  }
-  if (!parsed.exact) {
-    return versionAdmission("experimental", "range_inside_admitted_window");
-  }
-  return VERIFIED_VERSIONS[framework].has(version2) ? versionAdmission("verified", "verified_fixture") : versionAdmission("experimental", "inside_admitted_window");
-}
-function parseVersionSpec(version2) {
-  const exact5 = EXACT_VERSION.exec(version2);
-  const match = exact5 ?? (/^[~^](.*)$/u.exec(version2)?.[1] ? EXACT_VERSION.exec(version2.slice(1)) : null);
-  if (match === null)
-    return null;
-  const tuple = [Number(match[1]), Number(match[2]), Number(match[3])];
-  return tuple.every(Number.isSafeInteger) ? Object.freeze({ exact: exact5 !== null, version: tuple }) : null;
-}
-function insideAdmittedWindow(framework, version2) {
-  switch (framework) {
-    case "vite":
-      return compareVersions(version2, [5, 4, 0]) >= 0 && compareVersions(version2, [8, 2, 2]) <= 0;
-    case "tanstack-start":
-      return compareVersions(version2, [1, 168, 26]) >= 0 && compareVersions(version2, [1, 168, 49]) <= 0;
-    case "nextjs":
-      return isAdmittedNextVersion(version2.join("."));
-  }
-}
-function compareVersions(left, right) {
-  const majorDifference = left[0] - right[0];
-  if (majorDifference !== 0)
-    return majorDifference;
-  const minorDifference = left[1] - right[1];
-  return minorDifference !== 0 ? minorDifference : left[2] - right[2];
-}
-function versionAdmission(classification, reason) {
-  return Object.freeze({ classification, reason });
-}
-var PUSH_AND_PLAN = "Commit and push the change, then plan the new commit.";
-var FRAMEWORK_CONVERSION_DETAILS = Object.freeze({
-  managed_auth_database_required: Object.freeze({
-    render: managedCustomerAuthDatabaseMessage,
-    pattern: /^"([^"]+)" selects the managed Better Auth bridge, which requires the managed PostgreSQL database\. Set database\.enabled: true with an admitted migrations path, or set auth\.provider: none and keep the application-owned authentication configuration\. Commit and push the change, then plan the new commit\.$/u
-  }),
-  database_binding_private: Object.freeze({
-    render: (path2) => `"${path2}" reads a database connection string (DATABASE_URL, HYPERDRIVE, connectionString or a postgres:// URL); none reaches a customer Worker. Call the database with createPrivateDatabaseClient from "@ohmyhost/customer-runtime/database". ${PUSH_AND_PLAN}`,
-    pattern: /^"([^"]+)" reads a database connection string \(DATABASE_URL, HYPERDRIVE, connectionString or a postgres:\/\/ URL\); none reaches a customer Worker\. Call the database with createPrivateDatabaseClient from "@ohmyhost\/customer-runtime\/database"\. Commit and push the change, then plan the new commit\.$/u
-  }),
-  database_driver_unsupported: Object.freeze({
-    render: (path2) => `"${path2}" imports a database socket driver (pg, postgres, pg-native or mysql2); customer Workers cannot open sockets. Call the database with createPrivateDatabaseClient from "@ohmyhost/customer-runtime/database". ${PUSH_AND_PLAN}`,
-    pattern: /^"([^"]+)" imports a database socket driver \(pg, postgres, pg-native or mysql2\); customer Workers cannot open sockets\. Call the database with createPrivateDatabaseClient from "@ohmyhost\/customer-runtime\/database"\. Commit and push the change, then plan the new commit\.$/u
-  }),
-  source_syntax_invalid: Object.freeze({
-    render: (path2) => `Invalid JavaScript or TypeScript in "${path2}". Fix the file, commit and push the change, then plan the new commit.`,
-    pattern: /^Invalid JavaScript or TypeScript in "([^"]+)"\. Fix the file, commit and push the change, then plan the new commit\.$/u
-  }),
-  worker_module_default_export_required: Object.freeze({
-    render: (path2) => `Worker module "${path2}" has no default export. Export default { fetch, scheduled } with the handlers ohmyho.st invokes; named exports are never called. ${PUSH_AND_PLAN}`,
-    pattern: /^Worker module "([^"]+)" has no default export\. Export default \{ fetch, scheduled \} with the handlers ohmyho\.st invokes; named exports are never called\. Commit and push the change, then plan the new commit\.$/u
-  }),
-  scheduled_handler_required: Object.freeze({
-    render: (path2) => `functions.crons is declared but "${path2}" exports no scheduled handler. Add scheduled(controller, env, ctx) to its default export, commit and push the change, then plan the new commit.`,
-    pattern: /^functions\.crons is declared but "([^"]+)" exports no scheduled handler\. Add scheduled\(controller, env, ctx\) to its default export, commit and push the change, then plan the new commit\.$/u
-  }),
-  framework_base_path_unsupported: Object.freeze({
-    render: (path2) => `"${path2}" sets a Vite base. ohmyho.st serves the app at the root origin: remove base or set base: "/". ${PUSH_AND_PLAN}`,
-    pattern: /^"([^"]+)" sets a Vite base\. ohmyho\.st serves the app at the root origin: remove base or set base: "\/"\. Commit and push the change, then plan the new commit\.$/u
-  }),
-  tanstack_prerender_required: Object.freeze({
-    render: (path2) => `"${path2}" does not call tanstackStart({ prerender: { enabled: true } }), which the static TanStack Start runtime needs; enable prerender, or set runtime.mode: edge with the Cloudflare Vite plugin. ${PUSH_AND_PLAN}`,
-    pattern: /^"([^"]+)" does not call tanstackStart\(\{ prerender: \{ enabled: true \} \}\), which the static TanStack Start runtime needs; enable prerender, or set runtime\.mode: edge with the Cloudflare Vite plugin\. Commit and push the change, then plan the new commit\.$/u
-  }),
-  tanstack_vite_plugins_required: Object.freeze({
-    render: (path2) => `"${path2}" does not follow the TanStack Start plugin contract: import tanstackStart from "@tanstack/react-start/plugin/vite"; on runtime edge also import cloudflare from "@cloudflare/vite-plugin" and call cloudflare({ viteEnvironment: { name: "ssr" } }) before tanstackStart(); on runtime static do not import the Cloudflare plugin. ${PUSH_AND_PLAN}`,
-    pattern: /^"([^"]+)" does not follow the TanStack Start plugin contract: import tanstackStart from "@tanstack\/react-start\/plugin\/vite"; on runtime edge also import cloudflare from "@cloudflare\/vite-plugin" and call cloudflare\(\{ viteEnvironment: \{ name: "ssr" \} \}\) before tanstackStart\(\); on runtime static do not import the Cloudflare plugin\. Commit and push the change, then plan the new commit\.$/u
-  }),
-  next_cache_components_unsupported: Object.freeze({
-    render: (path2) => `"${path2}" sets cacheComponents: true, which ohmyho.st does not support; remove it or set it to false. ${PUSH_AND_PLAN}`,
-    pattern: /^"([^"]+)" sets cacheComponents: true, which ohmyho\.st does not support; remove it or set it to false\. Commit and push the change, then plan the new commit\.$/u
-  })
-});
-function isFrameworkConversionDiagnosticCode(value) {
-  return typeof value === "string" && Object.hasOwn(FRAMEWORK_CONVERSION_DETAILS, value);
-}
-function parseFrameworkConversionDiagnostic(value) {
-  if (typeof value !== "object" || value === null || Array.isArray(value))
-    return null;
-  const record6 = value;
-  const path2 = record6["path"];
-  const code = record6["code"];
-  if (Object.keys(record6).length !== 2 || !isFrameworkConversionDiagnosticCode(code) || typeof path2 !== "string" || path2.length > 240 || (code === "managed_auth_database_required" ? path2 !== "ohmyhost.yaml" : !/^[A-Za-z0-9_@()[\]./-]+\.(?:[cm]?[jt]sx?)$/u.test(path2)) || path2.split("/").some((segment) => segment === "" || segment === "." || segment === ".."))
-    return null;
-  return Object.freeze({ code, path: path2 });
-}
-function frameworkConversionDetail(value) {
-  const diagnostic = parseFrameworkConversionDiagnostic(value);
-  return diagnostic === null ? null : FRAMEWORK_CONVERSION_DETAILS[diagnostic.code].render(diagnostic.path);
-}
-function parseFrameworkConversionDetail(value) {
-  if (typeof value !== "string")
-    return null;
-  for (const [code, detail] of Object.entries(FRAMEWORK_CONVERSION_DETAILS)) {
-    const match = detail.pattern.exec(value);
-    if (match !== null)
-      return frameworkConversionDetail({ code, path: match[1] });
-  }
-  return null;
-}
-
 // packages/contracts/dist/operation-deployment-result.js
 function exactRecord(value, keys) {
   if (typeof value !== "object" || value === null || Array.isArray(value))
@@ -36288,9 +36678,9 @@ var PROBLEM_POLICY = {
   framework_conversion_required: {
     status: 409,
     retryable: false,
-    action: "Read detail for the file, reason and required change. Run ohmyhost init --dry-run --json at that commit, apply its blockers and the matching ohmyho.st framework Skill, then save or push the corrected version. Plan its commit; repeating the unchanged source cannot fix an admission error.",
+    action: "Read detail: a catalog sentence names the file, the rule and the required change. Apply it, save or push the corrected version and plan its commit. If detail names no file, run 'ohmyhost init --dry-run --json' at that commit and apply its blockers and the matching ohmyho.st framework Skill; init lists the install, build and server-only checks it cannot run locally under pending. Repeating the unchanged source cannot fix an admission error.",
     title: "Framework conversion required",
-    restAction: "Read detail for the file, reason and required change. Run ohmyhost init --dry-run --json at that commit, apply its blockers and the matching ohmyho.st framework Skill, then save or push the corrected version. Plan its commit; repeating the unchanged source cannot fix an admission error."
+    restAction: "Read detail: a catalog sentence names the file, the rule and the required change. Apply it, save or push the corrected version and plan its commit. If detail names no file, run 'ohmyhost init --dry-run --json' at that commit and apply its blockers and the matching ohmyho.st framework Skill; init lists the install, build and server-only checks it cannot run locally under pending. Repeating the unchanged source cannot fix an admission error."
   },
   repository_configuration_missing: {
     status: 409,
@@ -37216,11 +37606,13 @@ var parseOperation = (value) => {
   };
 };
 function parseOperationFailure(value) {
-  const input = exactRecord2(value, ["code", "message", "retryable", "suggested_action"]);
-  if (typeof input["code"] !== "string" || !boundedString(input["message"], 1, 512) || input["retryable"] !== false || !boundedString(input["suggested_action"], 1, 500))
+  const input = exactRecord2(value, ["code", "message", "retryable", "suggested_action", "detail"]);
+  const detail = input["detail"];
+  const diagnostic2 = detail === void 0 || input["code"] !== "auto_deploy_plan_rejected" ? null : frameworkConversionDiagnosticFromDetail(detail);
+  if (typeof input["code"] !== "string" || !boundedString(input["message"], 1, 512) || input["retryable"] !== false || !boundedString(input["suggested_action"], 1, 500) || detail !== void 0 && diagnostic2 === null)
     throw new ResponseContractError();
-  const safe = publicOperationFailure(input["code"]);
-  if (safe.code !== input["code"])
+  const safe = publicOperationFailure(input["code"], diagnostic2);
+  if (safe.code !== input["code"] || safe.detail !== detail)
     throw new ResponseContractError();
   return safe;
 }
@@ -40236,7 +40628,7 @@ function exact3(v, keys) {
 // apps/product-cli/package.json
 var package_default = {
   name: "@ohmyhost/product-cli",
-  version: "0.1.30",
+  version: "0.1.32",
   private: true,
   ohmyhost: {
     deployment: "production",
@@ -46739,6 +47131,9 @@ function formatErrors(errors) {
   return (errors ?? []).map(({ instancePath, message }) => `${instancePath || "/"} ${message ?? "is invalid"}`).join("; ");
 }
 
+// packages/contracts/dist/framework-source-rules.js
+var import_yaml2 = __toESM(require_dist(), 1);
+
 // packages/contracts/dist/framework-family.js
 function classifyFrameworkFamily(dependencies) {
   const next = dependencies.has("next");
@@ -46753,6 +47148,690 @@ function classifyFrameworkFamily(dependencies) {
   return vite ? "vite" : "unknown";
 }
 
+// packages/contracts/dist/framework-source-rules.js
+var MANAGED_BETTER_AUTH_VERSION = "1.7.1";
+var MAXIMUM_FRAMEWORK_CONFIG_BYTES = 256 * 1024;
+var WORKER_MODULE_PATH = "src/ohmyhost/worker.ts";
+var VITE_COMPANION_ENTRY_PATH = "src/ohmyhost/companion.ts";
+var PACKAGE_MANIFEST2 = "package.json";
+var REPOSITORY_CONFIG = "ohmyhost.yaml";
+var TANSTACK_START_PLUGIN = "@tanstack/react-start/plugin/vite";
+var CLOUDFLARE_PLUGIN = "@cloudflare/vite-plugin";
+var EXACT_VERSION = /^\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?$/u;
+var DEPENDENCY_FIELDS = Object.freeze({
+  runtime: Object.freeze(["dependencies"]),
+  build: Object.freeze(["dependencies", "devDependencies"]),
+  any: Object.freeze(["dependencies", "devDependencies", "optionalDependencies"])
+});
+var REQUIRED_DEPENDENCIES = Object.freeze({
+  nextjs: Object.freeze([
+    ["next", "runtime"],
+    ["react", "runtime"],
+    ["react-dom", "runtime"]
+  ]),
+  "vite-static": Object.freeze([["vite", "build"]]),
+  "tanstack-start": Object.freeze([
+    ["@tanstack/react-start", "runtime"],
+    ["@tanstack/react-router", "runtime"],
+    ["react", "runtime"],
+    ["react-dom", "runtime"],
+    ["@vitejs/plugin-react", "build"],
+    ["vite", "build"]
+  ]),
+  functions: Object.freeze([])
+});
+var TANSTACK_EDGE_DEPENDENCY = Object.freeze([CLOUDFLARE_PLUGIN, "build"]);
+var BUILD_SCRIPT_FRAMEWORKS = Object.freeze({
+  nextjs: "nextjs",
+  "vite-static": "vite",
+  "tanstack-start": "tanstack-start"
+});
+var BUILD_OUTPUTS = Object.freeze({
+  "vite-static": "dist",
+  "tanstack-start": "dist/client"
+});
+var REQUIRED_CONFIG_PATHS = Object.freeze({ nextjs: "next.config.ts", "tanstack-start": "vite.config.ts" });
+var MAXIMUM_LOCKFILE_LENGTH = 5 * 1024 * 1024;
+var MAXIMUM_PNPM_LOCKFILE_HEAD = 256 * 1024;
+var PNPM_LOCKFILE_BODY = /^(?:packages|snapshots):/mu;
+var PNPM_LOCKFILE_VERSION = /^(?:6|9)\.[0-9]{1,3}$/u;
+var PNPM_RESOLVED_VERSION = /^([^()]+)(?:\(.*\))?$/u;
+var DEFAULT_EXPORT_PATTERN = /\bexport\s+default\b/u;
+var FETCH_HANDLER_PATTERN = /(?:[{,;}]|\basync)\s*fetch\s*(?:\(|:|,|\})/u;
+var SCHEDULED_HANDLER_PATTERN = /\bscheduled\s*(?:\(|:|,|\})/u;
+var DATABASE_CONTRACT_PATTERNS = Object.freeze([
+  [
+    /\bHYPERDRIVE\b|\bconnectionString\b|\bDATABASE_URL\b|postgres(?:ql)?:\/\//u,
+    "database_binding_private"
+  ],
+  [
+    /\bfrom\s*["'](?:pg|postgres|mysql2|pg-native)["']|\brequire\(\s*["'](?:pg|postgres|pg-native)["']/u,
+    "database_driver_unsupported"
+  ]
+]);
+function parsePackageManifest(value) {
+  let parsed = value;
+  if (typeof value === "string") {
+    try {
+      parsed = JSON.parse(value);
+    } catch {
+      return null;
+    }
+  }
+  return isRecord4(parsed) ? parsed : null;
+}
+function packageManagerDeclaration(manifest2) {
+  const value = manifest2["packageManager"];
+  return typeof value === "string" ? value : void 0;
+}
+function declaredDependency(manifest2, name, placement) {
+  for (const field of DEPENDENCY_FIELDS[placement]) {
+    const version2 = ownValue(manifest2[field], name);
+    if (typeof version2 === "string" && version2.length > 0)
+      return version2;
+  }
+  return null;
+}
+function declaredDependencyNames(manifest2) {
+  const names = /* @__PURE__ */ new Set();
+  for (const field of DEPENDENCY_FIELDS.any) {
+    const dependencies = manifest2[field];
+    if (!isRecord4(dependencies))
+      continue;
+    for (const [name, version2] of Object.entries(dependencies))
+      if (typeof version2 === "string" && version2.length > 0)
+        names.add(name);
+  }
+  return names;
+}
+function viteCompanionRequired(configuration) {
+  return configuration.runtime.mode === "edge" || configuration.database?.enabled === true || configuration.auth?.provider === "better-auth" || configuration.mail?.enabled === true || configuration.storage !== void 0 || (configuration.functions?.crons.length ?? 0) > 0;
+}
+function frameworkVersionAdmissions(framework, manifest2, lockfile) {
+  const admissions = [];
+  let locked;
+  for (const [name, placement] of REQUIRED_DEPENDENCIES[framework]) {
+    if (!isFrameworkVersionPackage(name))
+      continue;
+    const declared = declaredDependency(manifest2, name, placement);
+    if (declared === null)
+      continue;
+    locked ??= lockfile === null ? () => null : lockedPackageVersions(lockfile);
+    admissions.push(classifyFrameworkVersion(name, declared, locked(name)));
+  }
+  return Object.freeze(admissions);
+}
+function lockedPackageVersions(lockfile) {
+  const { name, text } = lockfile;
+  const npm = name === "package-lock.json";
+  if (!npm && name !== "pnpm-lock.yaml" || typeof text !== "string" || text.length > MAXIMUM_LOCKFILE_LENGTH)
+    return () => null;
+  const document2 = npm ? parseJsonLockfile(text) : parsePnpmLockfileHead(text);
+  return (packageName) => {
+    const version2 = npm ? npmLockedVersion(document2, packageName) : pnpmLockedVersion(document2, packageName);
+    return isResolvedFrameworkVersion(version2) ? version2 : null;
+  };
+}
+function frameworkSourceFindings(input) {
+  const versions = frameworkVersionAdmissions(input.framework, input.manifest, input.lockfile);
+  return Object.freeze({
+    findings: Object.freeze([
+      ...manifestFindings(input, versions),
+      ...configurationFindings(input),
+      ...betterAuthFindings(input.configuration, input.manifest),
+      ...frameworkConfigFindings(input)
+    ]),
+    versions
+  });
+}
+function repositorySourceFindings(files) {
+  const configuration = repositoryConfiguration(files.get(REPOSITORY_CONFIG));
+  if (configuration === null)
+    return refused("repository_configuration_invalid", REPOSITORY_CONFIG);
+  const prefix = configuration.applicationRoot === "." ? "" : `${configuration.applicationRoot}/`;
+  const applicationFiles = [...files.keys()].filter((path2) => path2.length > prefix.length && path2.startsWith(prefix)).map((path2) => path2.slice(prefix.length));
+  if (applicationFiles.length === 0)
+    return refused("application_root_missing", REPOSITORY_CONFIG);
+  const text = (path2) => files.get(`${prefix}${path2}`) ?? null;
+  const manifest2 = parsePackageManifest(text(PACKAGE_MANIFEST2));
+  if (manifest2 === null)
+    return refused("package_manifest_invalid", PACKAGE_MANIFEST2);
+  const family = configuration.runtime.mode === "functions" ? "functions" : classifyFrameworkFamily(declaredDependencyNames(manifest2));
+  if (family === "ambiguous")
+    return refused("framework_ambiguous", PACKAGE_MANIFEST2);
+  if (family === "unknown")
+    return refused("framework_unsupported", PACKAGE_MANIFEST2);
+  const framework = family === "vite" ? "vite-static" : family;
+  const findings = [];
+  const packageManager = admitted(findings, () => resolvePackageManager({
+    packageManager: packageManagerDeclaration(manifest2),
+    files: applicationFiles
+  })) ?? null;
+  const configPath = frameworkConfigPath(framework, applicationFiles, findings);
+  const configText = configPath === null ? null : text(configPath);
+  if (configPath !== null && configText === null)
+    findings.push(diagnostic({ code: "source_syntax_invalid", path: configPath }));
+  const lockfileText = packageManager === null ? null : text(packageManager.lockfile);
+  const result = frameworkSourceFindings({
+    framework,
+    files: applicationFiles,
+    configuration,
+    manifest: manifest2,
+    packageManager,
+    lockfile: packageManager === null || lockfileText === null ? null : Object.freeze({ name: packageManager.lockfile, text: lockfileText }),
+    frameworkConfig: configPath === null || configText === null ? null : Object.freeze({ path: configPath, text: configText })
+  });
+  return Object.freeze({
+    framework,
+    findings: Object.freeze([...findings, ...result.findings]),
+    versions: result.versions
+  });
+}
+function nextConfigFindings(text, path2) {
+  const lexed = lexFrameworkConfig(text, path2);
+  if ("finding" in lexed)
+    return Object.freeze([lexed.finding]);
+  const { tokens } = lexed;
+  const findings = [];
+  if (hasNonRootProperty(tokens, ["basePath", "assetPrefix"], ["", "/"]))
+    findings.push(diagnostic({ code: "next_base_path_unsupported", path: path2 }));
+  if (hasProperty(tokens, "output", "export") || hasProperty(tokens, "output", "standalone"))
+    findings.push(diagnostic({ code: "next_output_unsupported", path: path2 }));
+  if (hasProperty(tokens, "cacheComponents", "true"))
+    findings.push(diagnostic({ code: "next_cache_components_unsupported", path: path2 }));
+  if (!hasExportDefault(tokens) && !(path2.slice(path2.lastIndexOf("/") + 1) === "next.config.js" && hasModuleExports(tokens)))
+    findings.push(diagnostic({ code: "framework_config_default_export_required", path: path2 }));
+  return Object.freeze(findings);
+}
+function viteConfigFindings(text, path2) {
+  const lexed = lexFrameworkConfig(text, path2);
+  if ("finding" in lexed)
+    return Object.freeze([lexed.finding]);
+  return Object.freeze(hasNonRootProperty(lexed.tokens, ["base"], ["/"]) ? [diagnostic({ code: "framework_base_path_unsupported", path: path2 })] : []);
+}
+function tanStackViteConfigFindings(text, path2, runtime) {
+  const lexed = lexFrameworkConfig(text, path2);
+  if ("finding" in lexed)
+    return Object.freeze([lexed.finding]);
+  const findings = [];
+  if (hasNonRootProperty(lexed.tokens, ["base"], ["/"]))
+    findings.push(diagnostic({ code: "framework_base_path_unsupported", path: path2 }));
+  if (runtime === null)
+    return Object.freeze(findings);
+  const contract = tanStackPluginContract(lexed.tokens, runtime);
+  if (contract === null)
+    return Object.freeze([diagnostic({ code: "source_syntax_invalid", path: path2 })]);
+  if (!contract.plugins)
+    findings.push(diagnostic({ code: "tanstack_vite_plugins_required", path: path2 }));
+  if (!contract.prerender)
+    findings.push(diagnostic({ code: "tanstack_prerender_required", path: path2 }));
+  return Object.freeze(findings);
+}
+function tanStackViteConfigRuntime(text) {
+  const tokens = exceedsConfigBytes(text) ? null : configTokens(text);
+  if (tokens === null)
+    return null;
+  for (const runtime of ["static", "edge"]) {
+    const contract = tanStackPluginContract(tokens, runtime);
+    if (contract?.plugins === true && contract.prerender)
+      return runtime;
+  }
+  return null;
+}
+function databaseContractCodes(source) {
+  const code = sourceWithoutComments(source);
+  return Object.freeze(DATABASE_CONTRACT_PATTERNS.filter(([pattern]) => pattern.test(code)).map(([, found]) => found));
+}
+function workerModuleFindings(worker) {
+  const { path: path2 } = worker;
+  const code = sourceWithoutComments(worker.source);
+  if (!DEFAULT_EXPORT_PATTERN.test(code))
+    return Object.freeze([diagnostic({ code: "worker_module_default_export_required", path: path2 })]);
+  const findings = [];
+  if (worker.fetch && !FETCH_HANDLER_PATTERN.test(code))
+    findings.push(diagnostic({ code: "worker_module_fetch_handler_required", path: path2 }));
+  if (worker.scheduled && !SCHEDULED_HANDLER_PATTERN.test(code))
+    findings.push(diagnostic({ code: "scheduled_handler_required", path: path2 }));
+  return Object.freeze(findings);
+}
+function sourceWithoutComments(source) {
+  let result = "";
+  let quote = null;
+  for (let index = 0; index < source.length; index += 1) {
+    const character = source[index];
+    const next = source[index + 1];
+    if (quote !== null) {
+      result += character;
+      if (character === "\\") {
+        index += 1;
+        result += source[index] ?? "";
+      } else if (character === quote || character === "\n" && quote !== "`")
+        quote = null;
+      continue;
+    }
+    if (character === "'" || character === '"' || character === "`") {
+      quote = character;
+      result += character;
+      continue;
+    }
+    if (character === "/" && next === "/" && source[index - 1] !== "\\") {
+      while (index < source.length && source[index] !== "\n") {
+        result += " ";
+        index += 1;
+      }
+      result += "\n";
+      continue;
+    }
+    if (character === "/" && next === "*" && source[index - 1] !== "\\") {
+      result += "  ";
+      index += 2;
+      while (index < source.length && !(source[index] === "*" && source[index + 1] === "/")) {
+        result += source[index] === "\n" ? "\n" : " ";
+        index += 1;
+      }
+      result += "  ";
+      index += 1;
+      continue;
+    }
+    result += character;
+  }
+  return result;
+}
+function isDatabaseContractModule(path2) {
+  return /\.(?:ts|tsx|js|jsx|mjs|mts)$/u.test(path2) && !/\.d\.[cm]?ts$/u.test(path2);
+}
+function manifestFindings(input, versions) {
+  const { configuration, framework, manifest: manifest2 } = input;
+  const findings = [];
+  if (framework !== "functions" && !isAdmittedFrameworkBuildScript(BUILD_SCRIPT_FRAMEWORKS[framework], ownValue(manifest2["scripts"], "build")))
+    findings.push(diagnostic({ code: "build_script_unsupported", path: PACKAGE_MANIFEST2, framework }));
+  const required = framework === "tanstack-start" && configuration.runtime.mode === "edge" ? [...REQUIRED_DEPENDENCIES[framework], TANSTACK_EDGE_DEPENDENCY] : REQUIRED_DEPENDENCIES[framework];
+  for (const [name, placement] of required)
+    if (declaredDependency(manifest2, name, placement) === null)
+      findings.push(diagnostic({
+        code: "framework_dependency_required",
+        path: PACKAGE_MANIFEST2,
+        package: name
+      }));
+  for (const admission of versions) {
+    const finding = frameworkVersionDiagnostic(admission, input.lockfile?.name ?? null);
+    if (finding !== null)
+      findings.push(finding);
+  }
+  if (framework === "nextjs")
+    for (const name of ["react", "react-dom"]) {
+      const version2 = declaredDependency(manifest2, name, "runtime");
+      if (version2 !== null && !EXACT_VERSION.test(version2))
+        findings.push(diagnostic({
+          code: "react_version_exact_required",
+          path: PACKAGE_MANIFEST2,
+          package: name
+        }));
+    }
+  return findings;
+}
+function configurationFindings(input) {
+  const { configuration, files, framework, packageManager } = input;
+  const build = "command" in configuration.build ? configuration.build : null;
+  const crons = (configuration.functions?.crons.length ?? 0) > 0;
+  const findings = [];
+  if (framework !== "functions" && !runtimeModeAdmitted(framework, configuration, crons))
+    findings.push(diagnostic({ code: "runtime_mode_unsupported", path: REPOSITORY_CONFIG, framework }));
+  if (build !== null && framework !== "nextjs" && build.ssg_cache_max_mib !== void 0)
+    findings.push(diagnostic({ code: "build_option_unsupported", path: REPOSITORY_CONFIG }));
+  const output = BUILD_OUTPUTS[framework];
+  if (build !== null && output !== void 0 && build.output !== output)
+    findings.push(diagnostic({ code: "build_output_unsupported", path: REPOSITORY_CONFIG, framework }));
+  if (packageManager !== null && framework !== "nextjs" && (configuration.build.install !== packageManager.installCommand || build !== null && build.command !== packageManager.buildCommand))
+    findings.push(diagnostic({ code: "build_command_mismatch", path: REPOSITORY_CONFIG }));
+  if (framework === "vite-static" && viteCompanionRequired(configuration) && !files.includes(VITE_COMPANION_ENTRY_PATH))
+    findings.push(diagnostic({ code: "companion_entry_required", path: VITE_COMPANION_ENTRY_PATH }));
+  if ((framework === "functions" || crons && (framework === "nextjs" || framework === "tanstack-start" && configuration.runtime.mode === "edge")) && !files.includes(WORKER_MODULE_PATH))
+    findings.push(diagnostic({ code: "worker_module_required", path: WORKER_MODULE_PATH }));
+  if (managedCustomerAuthAdmissionIssue(configuration) !== null)
+    findings.push(diagnostic({ code: "managed_auth_database_required", path: REPOSITORY_CONFIG }));
+  return findings;
+}
+function runtimeModeAdmitted(framework, configuration, crons) {
+  const mode = configuration.runtime.mode;
+  if (framework === "nextjs")
+    return mode === "edge";
+  if (framework === "vite-static")
+    return mode === (viteCompanionRequired(configuration) ? "edge" : "static");
+  return mode === "edge" || mode === "static" && !crons && configuration.storage === void 0;
+}
+function betterAuthFindings(configuration, manifest2) {
+  return configuration.auth?.provider === "better-auth" && declaredDependency(manifest2, "better-auth", "any") !== MANAGED_BETTER_AUTH_VERSION ? [diagnostic({ code: "better_auth_version_required", path: PACKAGE_MANIFEST2 })] : [];
+}
+function frameworkConfigFindings(input) {
+  const { frameworkConfig, framework } = input;
+  if (frameworkConfig === null || framework === "functions")
+    return [];
+  const { path: path2, text } = frameworkConfig;
+  if (framework === "nextjs")
+    return nextConfigFindings(text, path2);
+  if (framework === "vite-static")
+    return viteConfigFindings(text, path2);
+  const mode = input.configuration.runtime.mode;
+  return tanStackViteConfigFindings(text, path2, mode === "edge" || mode === "static" ? mode : null);
+}
+function repositoryConfiguration(text) {
+  if (typeof text !== "string")
+    return null;
+  try {
+    return parseOhmyhostConfigYaml(text);
+  } catch (error) {
+    if (error instanceof TypeError)
+      return null;
+    throw error;
+  }
+}
+function frameworkConfigPath(framework, files, findings) {
+  if (framework === "functions")
+    return null;
+  const path2 = admitted(findings, () => resolveFrameworkConfig(framework === "nextjs" ? "next.config" : "vite.config", files));
+  if (framework === "nextjs")
+    admitted(findings, () => resolveFrameworkConfig("open-next.config", files));
+  const required = REQUIRED_CONFIG_PATHS[framework];
+  if (path2 === null && required !== void 0)
+    findings.push(diagnostic({ code: "framework_config_required", path: required }));
+  return path2 ?? null;
+}
+function admitted(findings, admit) {
+  try {
+    return admit();
+  } catch (error) {
+    if (!(error instanceof FrameworkAdmissionError))
+      throw error;
+    findings.push(error.diagnostic);
+    return void 0;
+  }
+}
+function refused(code, path2) {
+  return Object.freeze({
+    framework: null,
+    findings: Object.freeze([diagnostic({ code, path: path2 })]),
+    versions: Object.freeze([])
+  });
+}
+function diagnostic(value) {
+  const parsed = parseFrameworkConversionDiagnostic(value);
+  if (parsed === null)
+    throw new TypeError("Framework source diagnostic is invalid");
+  return parsed;
+}
+function isFrameworkVersionPackage(name) {
+  return Object.hasOwn(FRAMEWORK_VERSION_POLICY, name);
+}
+function parseJsonLockfile(text) {
+  try {
+    return JSON.parse(text);
+  } catch {
+    return null;
+  }
+}
+function parsePnpmLockfileHead(text) {
+  const end = text.search(PNPM_LOCKFILE_BODY);
+  const head = end === -1 ? text : text.slice(0, end);
+  if (head.length > MAXIMUM_PNPM_LOCKFILE_HEAD)
+    return null;
+  try {
+    const document2 = (0, import_yaml2.parseDocument)(head, {
+      customTags: [],
+      logLevel: "error",
+      merge: false,
+      prettyErrors: false,
+      resolveKnownTags: false,
+      schema: "core",
+      strict: true,
+      stringKeys: true,
+      // The parser compares every key with every earlier one; pnpm refuses repeated keys itself.
+      uniqueKeys: false,
+      version: "1.2"
+    });
+    return document2.errors.length === 0 && document2.warnings.length === 0 ? document2.toJS({ maxAliasCount: 0 }) : null;
+  } catch {
+    return null;
+  }
+}
+function npmLockedVersion(document2, packageName) {
+  if (!isRecord4(document2) || document2["lockfileVersion"] !== 2 && document2["lockfileVersion"] !== 3)
+    return null;
+  const entry = ownValue(document2["packages"], `node_modules/${packageName}`);
+  return isRecord4(entry) && !Object.hasOwn(entry, "link") && (entry["name"] === void 0 || entry["name"] === packageName) ? entry["version"] : null;
+}
+function pnpmLockedVersion(document2, packageName) {
+  if (!isRecord4(document2))
+    return null;
+  const lockfileVersion = document2["lockfileVersion"];
+  if (typeof lockfileVersion !== "string" || !PNPM_LOCKFILE_VERSION.test(lockfileVersion))
+    return null;
+  const importers = document2["importers"];
+  const root = importers === void 0 && lockfileVersion.startsWith("6.") ? document2 : ownValue(importers, ".");
+  if (!isRecord4(root))
+    return null;
+  for (const group of ["dependencies", "devDependencies", "optionalDependencies"]) {
+    const dependencies = root[group];
+    if (!isRecord4(dependencies) || !Object.hasOwn(dependencies, packageName))
+      continue;
+    const entry = dependencies[packageName];
+    return isRecord4(entry) && typeof entry["version"] === "string" ? PNPM_RESOLVED_VERSION.exec(entry["version"])?.[1] ?? null : null;
+  }
+  return null;
+}
+function ownValue(record6, key) {
+  return isRecord4(record6) && Object.hasOwn(record6, key) ? record6[key] : void 0;
+}
+function isRecord4(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+var PUNCTUATION = "{}[]():,.;?=-!";
+function lexFrameworkConfig(text, path2) {
+  const tooLarge = diagnostic({ code: "framework_config_too_large", path: path2 });
+  if (exceedsConfigBytes(text))
+    return { finding: tooLarge };
+  const tokens = configTokens(text);
+  return tokens === null ? { finding: diagnostic({ code: "source_syntax_invalid", path: path2 }) } : { tokens };
+}
+function exceedsConfigBytes(text) {
+  return text.length > MAXIMUM_FRAMEWORK_CONFIG_BYTES || new TextEncoder().encode(text).byteLength > MAXIMUM_FRAMEWORK_CONFIG_BYTES;
+}
+function configTokens(source) {
+  const tokens = [];
+  let index = 0;
+  while (index < source.length) {
+    const character = source[index];
+    const next = source[index + 1];
+    if (character === "/" && next === "/") {
+      const end = source.indexOf("\n", index + 2);
+      index = end === -1 ? source.length : end + 1;
+    } else if (character === "/" && next === "*") {
+      const end = source.indexOf("*/", index + 2);
+      if (end === -1)
+        return null;
+      index = end + 2;
+    } else if (character === "'" || character === '"' || character === "`") {
+      const string = readString(source, index, character);
+      if (string === null)
+        return null;
+      tokens.push(string.token);
+      index = string.nextIndex;
+    } else if (isIdentifierStart(character) || isDigit(character)) {
+      const start = index;
+      const part = isDigit(character) ? isDigit : isIdentifierPart;
+      index += 1;
+      while (index < source.length && part(source[index]))
+        index += 1;
+      tokens.push({
+        kind: isDigit(character) ? "number" : "identifier",
+        value: source.slice(start, index)
+      });
+    } else {
+      if (PUNCTUATION.includes(character))
+        tokens.push({ kind: "punctuation", value: character });
+      index += 1;
+    }
+  }
+  return tokens;
+}
+function readString(source, index, quote) {
+  let cursor = index + 1;
+  let value = "";
+  while (cursor < source.length) {
+    const character = source[cursor];
+    if (character === quote)
+      return { token: { kind: "string", value }, nextIndex: cursor + 1 };
+    if (character === "\\") {
+      const escaped = source[cursor + 1];
+      if (escaped === void 0)
+        return null;
+      value += escaped;
+      cursor += 2;
+    } else {
+      value += character;
+      cursor += 1;
+    }
+  }
+  return null;
+}
+function isIdentifierStart(character) {
+  return character >= "A" && character <= "Z" || character >= "a" && character <= "z" || character === "_" || character === "$";
+}
+function isIdentifierPart(character) {
+  return isIdentifierStart(character) || isDigit(character);
+}
+function isDigit(character) {
+  return character >= "0" && character <= "9";
+}
+function hasNonRootProperty(tokens, names, rootStrings) {
+  let objectDepth = 0;
+  for (let index = 0; index < tokens.length; index += 1) {
+    const token = tokens[index];
+    if (token.value === "{" || token.value === "}") {
+      objectDepth += token.value === "{" ? 1 : -1;
+      continue;
+    }
+    const before = tokens[index - 1]?.value;
+    const directKey = before === "{" || before === ",";
+    const computedKey = before === "[" && tokens[index + 1]?.value === "]" && (tokens[index - 2]?.value === "{" || tokens[index - 2]?.value === ",");
+    if (objectDepth < 1 || !names.includes(token.value) || !directKey && !computedKey)
+      continue;
+    const separator = tokens[index + (computedKey ? 2 : 1)]?.value;
+    const value = tokens[index + (computedKey ? 3 : 2)];
+    const root = separator === ":" && (value?.kind === "string" && rootStrings.includes(value.value) || value?.kind === "identifier" && value.value === "undefined");
+    if (!root)
+      return true;
+  }
+  return false;
+}
+function hasProperty(tokens, name, value) {
+  return tokens.some((token, index) => token.value === name && tokens[index + 1]?.value === ":" && tokens[index + 2]?.value === value);
+}
+function hasExportDefault(tokens) {
+  return tokens.some((token, index) => token.value === "export" && tokens[index + 1]?.value === "default");
+}
+function hasModuleExports(tokens) {
+  return tokens.some((token, index) => {
+    if (token.kind !== "identifier" || token.value !== "module")
+      return false;
+    const property = tokens[index + 2];
+    const direct = tokens[index + 1]?.value === "." && property?.kind === "identifier" && property.value === "exports";
+    const computed = tokens[index + 1]?.value === "[" && property?.kind === "string" && property.value === "exports" && tokens[index + 3]?.value === "]";
+    const assignment = index + (computed ? 4 : 3);
+    return (direct || computed) && tokens[assignment]?.value === "=" && tokens[assignment + 1]?.value !== "=";
+  });
+}
+function tanStackPluginContract(tokens, runtime) {
+  const closing = closingBraces(tokens);
+  const imported = hasNamedImport(tokens, "tanstackStart", TANSTACK_START_PLUGIN);
+  if (runtime === "static") {
+    const calls2 = callOptions(tokens, closing, "tanstackStart");
+    return calls2 === null ? null : {
+      plugins: imported && !hasModuleImport(tokens, CLOUDFLARE_PLUGIN),
+      prerender: calls2.some(([start, end]) => nestedPropertyValue(tokens, closing, start, end, "prerender", "enabled") === "true")
+    };
+  }
+  const calls = callOptions(tokens, closing, "cloudflare");
+  return calls === null ? null : {
+    plugins: imported && hasNamedImport(tokens, "cloudflare", CLOUDFLARE_PLUGIN) && calls.some(([start, end]) => nestedPropertyValue(tokens, closing, start, end, "viteEnvironment", "name") === "ssr") && callIndex(tokens, "cloudflare") < callIndex(tokens, "tanstackStart"),
+    prerender: true
+  };
+}
+function closingBraces(tokens) {
+  const closing = tokens.map(() => -1);
+  const open5 = [];
+  tokens.forEach((token, index) => {
+    if (token.value === "{")
+      open5.push(index);
+    if (token.value !== "}")
+      return;
+    const start = open5.pop();
+    if (start !== void 0)
+      closing[start] = index;
+  });
+  return closing;
+}
+function callOptions(tokens, closing, name) {
+  const calls = [];
+  for (let index = 0; index < tokens.length - 2; index += 1) {
+    if (tokens[index]?.value !== name || tokens[index + 1]?.value !== "(" || tokens[index + 2]?.value !== "{")
+      continue;
+    const end = closing[index + 2] ?? -1;
+    if (end === -1)
+      return null;
+    calls.push([index + 2, end]);
+  }
+  return calls;
+}
+function nestedPropertyValue(tokens, closing, start, end, outer, inner) {
+  const object3 = directProperty(tokens, closing, start, end, outer);
+  if (object3?.value !== "{")
+    return null;
+  return directProperty(tokens, closing, object3.start, object3.end, inner)?.value ?? null;
+}
+function directProperty(tokens, closing, start, end, name) {
+  let depth = 0;
+  for (let index = start + 1; index < end; index += 1) {
+    const value = tokens[index]?.value;
+    if (value === "{") {
+      index = Math.max(index, closing[index] ?? -1);
+      continue;
+    }
+    if (value === "[" || value === "(")
+      depth += 1;
+    if (value === "]" || value === ")")
+      depth -= 1;
+    if (depth !== 0 || value !== name || tokens[index + 1]?.value !== ":")
+      continue;
+    const candidate = tokens[index + 2]?.value ?? "";
+    const close = candidate === "{" ? closing[index + 2] ?? -1 : index + 2;
+    return { start: index + 2, end: close, value: candidate };
+  }
+  return null;
+}
+function callIndex(tokens, name) {
+  return tokens.findIndex((token, index) => token.value === name && tokens[index + 1]?.value === "(");
+}
+function hasNamedImport(tokens, name, moduleName) {
+  for (let index = 0; index < tokens.length; index += 1) {
+    if (tokens[index]?.value !== "import")
+      continue;
+    let from = index + 1;
+    while (from < tokens.length && tokens[from]?.value !== "from")
+      from += 1;
+    if (from === tokens.length)
+      return false;
+    const source = tokens[from + 1];
+    if (source?.kind === "string" && source.value === moduleName && tokens.slice(index + 1, from).some((token) => token.value === name))
+      return true;
+    index = from;
+  }
+  return false;
+}
+function hasModuleImport(tokens, moduleName) {
+  return tokens.some((token, index) => token.value === "from" && tokens[index + 1]?.kind === "string" && tokens[index + 1]?.value === moduleName);
+}
+
 // packages/contracts/dist/database-migration-errors.js
 var DatabaseMigrationAdmissionError = class extends Error {
   reason;
@@ -47117,28 +48196,31 @@ function admitStatement(tokens, sql) {
 // apps/product-cli/dist/repository-init.js
 var MAXIMUM_PACKAGE_BYTES = 1024 * 1024;
 var MAXIMUM_CONFIGURATION_BYTES = 64 * 1024;
+var MAXIMUM_INSPECTED_FILE_BYTES = 5 * 1024 * 1024;
 var MAXIMUM_REPOSITORY_FILES = 2e4;
-var SUPPORTED_BETTER_AUTH_VERSION = "1.7.1";
 var PROJECT_PATTERN = /^[a-z](?:[a-z0-9-]*[a-z0-9])?$/u;
 var IGNORED_DIRECTORIES = /* @__PURE__ */ new Set([
   ".git",
   ".next",
+  ".open-next",
   ".supabase",
   ".turbo",
   ".vercel",
+  ".wrangler",
   "coverage",
   "dist",
   "node_modules"
 ]);
-var WORKER_MODULE_PATH = "src/ohmyhost/worker.ts";
+var UTF8 = new TextDecoder("utf-8", { fatal: true });
 var MAXIMUM_SOURCE_BYTES = 2 * 1024 * 1024;
 var SOURCE_MODULE_PATTERN = /\.(?:[cm]?[jt]s|[jt]sx)$/u;
 var STORAGE_CLIENT_CALL_PATTERN = /\bcreatePrivateStorageClient\s*\(/u;
-var DATABASE_PRIVATE_BINDING_PATTERN = /\bHYPERDRIVE\b|\bconnectionString\b|\bDATABASE_URL\b|postgres(?:ql)?:\/\//u;
-var DATABASE_SOCKET_DRIVER_PATTERN = /\bfrom\s*["'](?:pg|postgres|mysql2|pg-native)["']|\brequire\(\s*["'](?:pg|postgres|pg-native)["']/u;
-var INERT_SOURCE_PATTERN = /\/\*[\s\S]*?\*\/|\/\/[^\n]*|\bimport\s+type\b[^;]*;/gu;
+var UNNAMED_MODULE_MESSAGES = Object.freeze({
+  database_binding_private: 'The module at path reads a database connection string (DATABASE_URL, HYPERDRIVE, connectionString or a postgres:// URL); none reaches a customer Worker. Call the database with createPrivateDatabaseClient from "@ohmyhost/customer-runtime/database". Commit and push the change, then plan the new commit.',
+  database_driver_unsupported: 'The module at path imports a database socket driver (pg, postgres, pg-native or mysql2); customer Workers cannot open sockets. Call the database with createPrivateDatabaseClient from "@ohmyhost/customer-runtime/database". Commit and push the change, then plan the new commit.'
+});
 function callsStorageClient(source) {
-  return STORAGE_CLIENT_CALL_PATTERN.test(source.replaceAll(INERT_SOURCE_PATTERN, " "));
+  return STORAGE_CLIENT_CALL_PATTERN.test(sourceWithoutComments(source));
 }
 var STORAGE_RUNTIME_BINDINGS = Object.freeze([
   "OHMYHOST_ENVIRONMENT_ID",
@@ -47148,14 +48230,13 @@ var STORAGE_RUNTIME_BINDINGS = Object.freeze([
   "OHMYHOST_STORAGE_KEY"
 ]);
 var CUSTOMER_RUNTIME_SOURCE = `npm:@amerged/ohmyhost-runtime@${package_default.version}`;
-var SCHEDULED_HANDLER_PATTERN = /\bscheduled\s*(?:\(|:|,|\})/u;
-var DEFAULT_EXPORT_PATTERN = /\bexport\s+default\b/u;
-function defaultExportBlocker(modulePath) {
-  return {
-    code: "worker_module_default_export_required",
-    message: `${modulePath} has no default export. Export its handlers as the default export (export default { fetch, scheduled }); named exports are never invoked.`
-  };
-}
+var PENDING_CHECKS = Object.freeze({
+  installed_version: "compatibility.frameworks lists a version range that no lockfile ohmyho.st reads (package-lock.json v2/v3 or pnpm-lock.yaml v6/v9) resolves. Planning admits it; after the frozen install, the build checks the installed version against the same security minimum.",
+  frozen_install: "The build installs dependencies from the committed lockfile with the frozen install of the packageManager in package.json, without lifecycle scripts; init installs nothing.",
+  framework_build: "The build itself (scripts.build with the ohmyho.st adapter build, or the Worker bundle of the functions runtime) runs only on ohmyho.st; a clean init does not prove that it succeeds.",
+  reachable_runtime_sources: "Planning walks the runtime sources the build reaches for Workers-incompatible imports, database socket drivers and syntax errors; init does not walk them.",
+  project_state: "Planning also checks the project itself, such as its region against storage.jurisdiction, shared data, the mail sender domain and credits; init runs offline without it."
+});
 var RepositoryInitError = class extends Error {
   code;
   constructor(code, message) {
@@ -47186,18 +48267,15 @@ async function initializeRepository(input) {
   const applicationDirectory = resolve5(root, selection.applicationRoot);
   const applicationFiles = applicationRelativeFiles(files, selection.applicationRoot);
   const packageJson = await readPackageJson(applicationDirectory);
-  const dependencies = dependencyNames(packageJson);
-  const existingConfigurationYaml = await readExistingConfiguration(root, files, selection.applicationRoot);
-  const existingConfiguration = existingConfigurationYaml === null ? null : parseOhmyhostConfigYaml(existingConfigurationYaml);
+  const manifest2 = packageJson.manifest;
+  const dependencies = declaredDependencyNames(manifest2);
+  const existing2 = await readExistingConfiguration(root, files, selection.applicationRoot);
+  const existingConfiguration = existing2?.configuration ?? null;
   const framework = detectRepositoryFramework(dependencies, applicationFiles, existingConfiguration);
-  const packageManagerAdmission = packageManagerAdmissionFor(packageJson, applicationFiles);
-  const packageManager = packageManagerInventory(packageManagerAdmission, packageJson, applicationFiles);
-  const frameworkConfigs = frameworkConfigurations(applicationFiles);
-  const compatibility = frameworkCompatibility(packageJson, framework);
-  const nextStandaloneOutput = await detectNextStandaloneOutput(applicationDirectory, framework, frameworkConfigs.next);
-  const tanStackRuntime = await detectTanStackRuntime(applicationDirectory, applicationFiles, framework, packageJson, frameworkConfigs.vite);
-  const project = projectName(input.project, packageJson);
-  const repositoryAdmissionBlockers = repositoryBlockers(packageJson, framework, nextStandaloneOutput, tanStackRuntime, applicationFiles, packageManagerAdmission, frameworkConfigs, compatibility, existingConfiguration);
+  const packageManagerAdmission = packageManagerAdmissionFor(manifest2, applicationFiles);
+  const packageManager = packageManagerInventory(packageManagerAdmission, manifest2, applicationFiles);
+  const frameworkConfig = await readFrameworkConfig(applicationDirectory, applicationFiles, framework);
+  const project = projectName(input.project, manifest2);
   const supabaseMigrationCount = applicationFiles.filter((path2) => /^supabase\/migrations\/[^/]+\.sql$/u.test(path2)).length;
   const postgresMigrationRoot = existingConfiguration?.database?.migrations ?? "postgres/migrations";
   const postgresMigrationCount = applicationFiles.filter((path2) => path2.startsWith(`${postgresMigrationRoot}/`) && path2.endsWith(".sql")).length;
@@ -47245,8 +48323,8 @@ async function initializeRepository(input) {
   const targetBetterAuth = existingConfiguration?.auth?.provider === "better-auth";
   const targetMail = existingConfiguration?.mail?.enabled === true;
   const targetStorage = r2 || supabaseStorage;
-  const configuredCompanionRequired = existingConfiguration !== null && (existingConfiguration.database?.enabled === true || existingConfiguration.auth?.provider === "better-auth" || existingConfiguration.mail?.enabled === true || existingConfiguration.storage !== void 0 || (existingConfiguration.functions?.crons.length ?? 0) > 0);
-  const companionRequired = framework === "vite" && (existingConfiguration === null ? databaseProvider !== "none" || targetBetterAuth || targetMail || targetStorage || edgeFunctionNames.size > 0 || applicationFiles.includes("src/ohmyhost/companion.ts") : configuredCompanionRequired);
+  const tanStackRuntime = framework !== "tanstack-start" ? null : targetStorage ? "edge" : proposedTanStackRuntime(frameworkConfig, dependencies);
+  const companionRequired = framework === "vite" && (existingConfiguration === null ? databaseProvider !== "none" || targetBetterAuth || targetMail || targetStorage || edgeFunctionNames.size > 0 || applicationFiles.includes(VITE_COMPANION_ENTRY_PATH) : viteCompanionRequired(existingConfiguration));
   const generatedConfigurationYaml = renderConfiguration({
     project,
     framework,
@@ -47261,7 +48339,7 @@ async function initializeRepository(input) {
     tanStackRuntime,
     applicationRoot: selection.applicationRoot
   });
-  const configurationYaml = existingConfigurationYaml ?? generatedConfigurationYaml;
+  const configurationYaml = existing2?.yaml ?? generatedConfigurationYaml;
   const capabilities = Object.freeze({
     database: selectedDatabaseProvider !== "none",
     auth: targetBetterAuth,
@@ -47270,16 +48348,19 @@ async function initializeRepository(input) {
   });
   const companion = companionRequired ? viteCompanionScaffold(applicationFiles, capabilities) : null;
   const companionSourcePresent = companion !== null && applicationFiles.includes(companion.sourceEntryPoint);
-  const migrationSqlAdmissionBlockers = await migrationSqlBlockers(applicationDirectory, applicationFiles, existingConfiguration?.database?.migrations, selectedDatabaseProvider);
-  const blockers = [
-    ...repositoryAdmissionBlockers,
-    ...await workerModuleBlockers(framework, applicationDirectory, applicationFiles),
-    ...await cronBlockers(framework, existingConfiguration, applicationDirectory, applicationFiles),
-    ...selectedDatabaseProvider === "none" ? [] : migrationFilenameBlockers(applicationFiles, existingConfiguration?.database?.migrations, selectedDatabaseProvider),
-    ...migrationSqlAdmissionBlockers,
-    ...await storageClientBlockers(existingConfiguration, applicationDirectory, applicationFiles),
-    ...await databaseContractBlockers(existingConfiguration, applicationDirectory, applicationFiles)
-  ].sort((left, right) => left.code.localeCompare(right.code));
+  const { blockers, versions } = existing2 !== null && existing2.blocker !== null ? { blockers: [existing2.blocker], versions: [] } : await judgeSource({
+    framework,
+    config: existingConfiguration,
+    applicationDirectory,
+    files: applicationFiles,
+    applicationRoot: selection.applicationRoot,
+    provider: selectedDatabaseProvider,
+    texts: sourceTexts(files, selection.applicationRoot, configurationYaml, [
+      ["package.json", packageJson.text],
+      ...lockfileTexts(await readResolvingLockfile(applicationDirectory, packageManagerAdmission)),
+      ...frameworkConfig === null ? [] : [[frameworkConfig.path, frameworkConfig.text]]
+    ])
+  });
   const requirements = requirementsFor(inventory, companion !== null && !companionSourcePresent, mailDetected, targetBetterAuth);
   const configurationSha256 = createHash4("sha256").update(configurationYaml).digest("hex");
   if (!input.dryRun) {
@@ -47296,8 +48377,17 @@ async function initializeRepository(input) {
     applicationRoot: selection.applicationRoot,
     applicationRootSource: selection.source,
     inventory,
-    compatibility,
+    compatibility: Object.freeze({
+      frameworks: Object.freeze(versions.map((version2) => Object.freeze({
+        package: version2.package,
+        declared: version2.declared,
+        resolved: version2.resolved,
+        status: version2.status,
+        minimum: version2.minimum
+      })))
+    }),
     blockers: Object.freeze(blockers),
+    pending: pendingChecks(versions),
     requirements: Object.freeze(requirements),
     companion,
     worker: framework === "functions" ? Object.freeze({
@@ -47309,6 +48399,20 @@ async function initializeRepository(input) {
     runtime: Object.values(capabilities).some(Boolean) ? runtimeContract(capabilities) : null
   });
 }
+async function judgeSource(context) {
+  const source = repositorySourceFindings(context.texts);
+  return {
+    blockers: [
+      ...migrationFilenameBlockers(context, context.provider),
+      ...source.findings.map((finding) => requiredCatalogBlocker(finding, context.applicationRoot)),
+      ...await workerModuleBlockers(context),
+      ...await databaseContractBlockers(context, context.provider),
+      ...await storageClientBlockers(context),
+      ...await migrationSqlBlockers(context, context.provider)
+    ],
+    versions: source.versions
+  };
+}
 function detectRepositoryFramework(dependencies, files, existingConfiguration) {
   const detected = detectFramework(dependencies);
   if (existingConfiguration?.runtime.mode === "functions")
@@ -47317,41 +48421,47 @@ function detectRepositoryFramework(dependencies, files, existingConfiguration) {
     return "functions";
   return detected;
 }
-async function cronBlockers(framework, config, applicationDirectory, files) {
-  if ((config?.functions?.crons.length ?? 0) === 0)
-    return [];
+function sourceTexts(files, applicationRoot, configurationYaml, applicationTexts) {
+  const texts = new Map(files.map((path2) => [path2, null]));
+  texts.set("ohmyhost.yaml", configurationYaml);
+  for (const [path2, text] of applicationTexts)
+    texts.set(repositoryPath(applicationRoot, path2), text);
+  return texts;
+}
+function lockfileTexts(lockfile) {
+  return lockfile === null ? [] : [[lockfile.name, lockfile.text]];
+}
+function repositoryPath(applicationRoot, path2) {
+  return applicationRoot === "." ? path2 : `${applicationRoot}/${path2}`;
+}
+function catalogBlocker(diagnostic2, applicationRoot) {
+  const rooted = rootFrameworkConversionDiagnostic(diagnostic2, applicationRoot);
+  const message = frameworkConversionDetail(rooted);
+  return rooted === null || message === null ? null : Object.freeze({ code: rooted.code, path: rooted.path, message });
+}
+function requiredCatalogBlocker(diagnostic2, applicationRoot) {
+  const blocker = catalogBlocker(diagnostic2, applicationRoot);
+  if (blocker === null)
+    throw new TypeError("Repository init diagnostic is invalid");
+  return blocker;
+}
+async function workerModuleBlockers(context) {
+  const { config, framework, files } = context;
   const mode = config?.runtime.mode;
-  const runtimeSupported = mode === "edge" && (framework === "vite" || framework === "nextjs" || framework === "tanstack-start") || mode === "functions" && framework === "functions";
-  if (!runtimeSupported) {
-    return [
-      {
-        code: "scheduled_functions_runtime_unsupported",
-        message: "functions.crons needs runtime.mode edge (Next.js, TanStack Start, or Vite with src/ohmyhost/companion.ts) or functions (src/ohmyhost/worker.ts) in ohmyhost.yaml. Change runtime.mode, or remove functions.crons."
-      }
-    ];
-  }
-  const modulePath = framework === "vite" ? "src/ohmyhost/companion.ts" : WORKER_MODULE_PATH;
-  const source = files.includes(modulePath) ? await readFile3(resolve5(applicationDirectory, modulePath), "utf8") : null;
-  if (framework !== "functions" && source !== null && !DEFAULT_EXPORT_PATTERN.test(source)) {
-    return [defaultExportBlocker(modulePath)];
-  }
-  if (source === null || !SCHEDULED_HANDLER_PATTERN.test(source)) {
-    return [
-      {
-        code: "scheduled_handler_missing",
-        message: `Keep a scheduled handler in the default export of ${modulePath} to run the declared crons.`
-      }
-    ];
-  }
-  return [];
+  const scheduled = (config?.functions?.crons.length ?? 0) > 0 && (mode === "edge" && (framework === "vite" || framework === "nextjs" || framework === "tanstack-start") || mode === "functions" && framework === "functions");
+  const path2 = framework === "vite" ? VITE_COMPANION_ENTRY_PATH : WORKER_MODULE_PATH;
+  if (framework !== "functions" && !scheduled || !files.includes(path2))
+    return [];
+  const source = await readFile3(resolve5(context.applicationDirectory, path2), "utf8");
+  return workerModuleFindings({ path: path2, source, fetch: framework === "functions", scheduled }).map((finding) => requiredCatalogBlocker(finding, context.applicationRoot));
 }
-async function storageClientBlockers(config, applicationDirectory, files) {
-  if (config?.storage === void 0)
+async function storageClientBlockers(context) {
+  if (context.config?.storage === void 0)
     return [];
-  for (const path2 of files) {
+  for (const path2 of context.files) {
     if (!SOURCE_MODULE_PATTERN.test(path2))
       continue;
-    const absolute = resolve5(applicationDirectory, path2);
+    const absolute = resolve5(context.applicationDirectory, path2);
     const information = await stat2(absolute);
     if (!information.isFile() || information.size > MAXIMUM_SOURCE_BYTES)
       continue;
@@ -47361,52 +48471,41 @@ async function storageClientBlockers(config, applicationDirectory, files) {
   return [
     {
       code: "storage_client_missing",
+      path: null,
       message: 'ohmyhost.yaml declares storage, but no application source calls createPrivateStorageClient. Import it from "@ohmyhost/customer-runtime/storage" and build it in server code from OHMYHOST_STORAGE_GATEWAY, OHMYHOST_STORAGE_GATEWAY_URL, OHMYHOST_PROJECT_ID, OHMYHOST_ENVIRONMENT_ID and OHMYHOST_STORAGE_KEY, then reserve an upload, PUT the bytes to the returned signed URL, complete it, and serve reads with createSignedRead. There is no FILES bucket binding.'
     }
   ];
 }
-async function databaseContractBlockers(config, applicationDirectory, files) {
-  if (config?.database === void 0)
+async function databaseContractBlockers(context, provider) {
+  if (provider === "none")
     return [];
   const blockers = [];
-  for (const path2 of files) {
-    if (!SOURCE_MODULE_PATTERN.test(path2))
+  for (const path2 of context.files) {
+    if (!isDatabaseContractModule(path2))
       continue;
-    const absolute = resolve5(applicationDirectory, path2);
+    const absolute = resolve5(context.applicationDirectory, path2);
     const information = await stat2(absolute);
     if (!information.isFile() || information.size > MAXIMUM_SOURCE_BYTES)
       continue;
-    const source = (await readFile3(absolute, "utf8")).replaceAll(INERT_SOURCE_PATTERN, " ");
-    if (DATABASE_PRIVATE_BINDING_PATTERN.test(source)) {
-      blockers.push({
-        code: "database_binding_private",
-        message: `${path2} reaches for a managed database connection string. HYPERDRIVE is retired; DATABASE_URL and postgres:// URLs never reach a customer Worker. Call the database with createPrivateDatabaseClient from "@ohmyhost/customer-runtime/database".`
-      });
-    }
-    if (DATABASE_SOCKET_DRIVER_PATTERN.test(source)) {
-      blockers.push({
-        code: "database_driver_unsupported",
-        message: `${path2} imports a PostgreSQL socket driver. Outbound connect() is disabled for customer Workers, so the driver can never open a connection. Call the database with createPrivateDatabaseClient from "@ohmyhost/customer-runtime/database".`
-      });
-    }
+    for (const code of databaseContractCodes(await readFile3(absolute, "utf8")))
+      blockers.push(catalogBlocker({ code, path: path2 }, context.applicationRoot) ?? Object.freeze({
+        code,
+        path: repositoryPath(context.applicationRoot, path2),
+        message: UNNAMED_MODULE_MESSAGES[code]
+      }));
   }
   return blockers;
 }
-async function workerModuleBlockers(framework, applicationDirectory, files) {
-  if (framework !== "functions" || !files.includes(WORKER_MODULE_PATH))
-    return [];
-  const source = await readFile3(resolve5(applicationDirectory, WORKER_MODULE_PATH), "utf8");
-  return DEFAULT_EXPORT_PATTERN.test(source) ? [] : [defaultExportBlocker(WORKER_MODULE_PATH)];
-}
-function migrationFilenameBlockers(files, configuredPath, provider) {
+function migrationFilenameBlockers(context, provider) {
   if (provider !== "postgresql")
     return [];
-  const root = configuredPath ?? "postgres/migrations";
+  const root = context.config?.database?.migrations ?? "postgres/migrations";
   const prefix = `${root}/`;
-  const invalid6 = files.filter((path2) => path2.startsWith(prefix)).map((path2) => path2.slice(prefix.length)).find((path2) => !/^(?:[A-Za-z0-9][A-Za-z0-9._-]*\/)*\d{14}_[a-z0-9][a-z0-9_-]*\.sql$/u.test(path2));
+  const invalid6 = context.files.filter((path2) => path2.startsWith(prefix)).map((path2) => path2.slice(prefix.length)).find((path2) => !/^(?:[A-Za-z0-9][A-Za-z0-9._-]*\/)*\d{14}_[a-z0-9][a-z0-9_-]*\.sql$/u.test(path2));
   return invalid6 === void 0 ? [] : [
     {
       code: "migration_filename_noncanonical",
+      path: repositoryPath(context.applicationRoot, `${prefix}${invalid6}`),
       message: `Migration file '${invalid6}' in ${root} is not named YYYYMMDDHHMMSS_name.sql (14 digits, an underscore, then lowercase letters, digits, _ or -). Every file in that directory must match, README and .gitkeep included: rename or move it, keeping the run order.`
     }
   ];
@@ -47417,18 +48516,18 @@ var MIGRATION_REJECTION = {
   unsupported: "It has a statement other than CREATE TABLE, TYPE, DOMAIN, SEQUENCE, VIEW, MATERIALIZED VIEW, TRIGGER, INDEX or FUNCTION, ALTER TABLE ... ADD, COMMENT ON, CREATE SCHEMA IF NOT EXISTS auth|extensions|private or CREATE EXTENSION IF NOT EXISTS pgcrypto|btree_gist|unaccent; or a function not in LANGUAGE sql or plpgsql, SECURITY DEFINER without SET search_path, or the word ohmyhost, comments included.",
   invalid: "It is empty, not UTF-8 with LF line endings, has a BOM or NUL byte or an unterminated quote or comment, or exceeds 256 KiB (at most 128 files and 2 MiB in total)."
 };
-async function migrationSqlBlockers(applicationDirectory, files, configuredPath, provider) {
+async function migrationSqlBlockers(context, provider) {
   if (provider !== "postgresql")
     return [];
-  const root = configuredPath ?? "postgres/migrations";
+  const root = context.config?.database?.migrations ?? "postgres/migrations";
   const prefix = `${root}/`;
-  const migrationPaths = files.filter((path2) => path2.startsWith(prefix) && path2.endsWith(".sql")).map((path2) => path2.slice(prefix.length));
+  const migrationPaths = context.files.filter((path2) => path2.startsWith(prefix) && path2.endsWith(".sql")).map((path2) => path2.slice(prefix.length));
   if (migrationPaths.some((path2) => !/^(?:[A-Za-z0-9][A-Za-z0-9._-]*\/)*\d{14}_[a-z0-9][a-z0-9_-]*\.sql$/u.test(path2))) {
     return [];
   }
   const migrations = await Promise.all(migrationPaths.map(async (path2) => Object.freeze({
     path: path2,
-    body: new Uint8Array(await readFile3(resolve5(applicationDirectory, root, path2)))
+    body: new Uint8Array(await readFile3(resolve5(context.applicationDirectory, root, path2)))
   })));
   const blockers = [];
   for (const migration of migrations) {
@@ -47439,6 +48538,7 @@ async function migrationSqlBlockers(applicationDirectory, files, configuredPath,
         throw error;
       blockers.push({
         code: "migration_sql_not_admitted",
+        path: repositoryPath(context.applicationRoot, `${prefix}${migration.path}`),
         message: `PostgreSQL migration '${migration.path}' is not admitted (${error.reason}): ${MIGRATION_REJECTION[error.reason]} Migrations are expand-only. Fix the file before its first deployment; never edit a migration a deployment already applied.`
       });
     }
@@ -47454,11 +48554,22 @@ async function migrationSqlBlockers(applicationDirectory, files, configuredPath,
     return [
       {
         code: "migration_sql_not_admitted",
+        path: null,
         message: `The migration set is not admitted (${error.reason}): ${MIGRATION_REJECTION[error.reason]}`
       }
     ];
   }
 }
+function pendingChecks(versions) {
+  const codes = [
+    ...versions.some(({ status }) => status === "pending") ? ["installed_version"] : [],
+    "frozen_install",
+    "framework_build",
+    "reachable_runtime_sources",
+    "project_state"
+  ];
+  return Object.freeze(codes.map((code) => Object.freeze({ code, message: PENDING_CHECKS[code] })));
+}
 async function readExistingConfiguration(repositoryRoot, repositoryFiles, applicationRoot) {
   if (!repositoryFiles.includes("ohmyhost.yaml"))
     return null;
@@ -47467,17 +48578,30 @@ async function readExistingConfiguration(repositoryRoot, repositoryFiles, applic
   if (!information.isFile() || information.size > MAXIMUM_CONFIGURATION_BYTES) {
     throw new RepositoryInitError("repository_configuration_invalid", "ohmyhost.yaml must be one regular file of at most 64 KiB");
   }
-  const configuration = await readFile3(configurationPath, "utf8");
+  const bytes = await readFile3(configurationPath);
+  const text = utf8(bytes);
+  const yaml = text ?? new TextDecoder().decode(bytes);
   let parsed;
   try {
-    parsed = parseOhmyhostConfigYaml(configuration);
+    if (text === null)
+      throw new TypeError("ohmyhost.yaml is not valid UTF-8");
+    parsed = parseOhmyhostConfigYaml(text);
   } catch (error) {
-    throw new RepositoryInitError("repository_configuration_invalid", error instanceof TypeError ? error.message : "ohmyhost.yaml is invalid");
+    const reason = (error instanceof TypeError ? error.message : "ohmyhost.yaml is invalid").replace(/\.$/u, "");
+    return Object.freeze({
+      yaml,
+      configuration: null,
+      blocker: Object.freeze({
+        code: "repository_configuration_invalid",
+        path: "ohmyhost.yaml",
+        message: `${reason}. Fix that in ohmyhost.yaml and run init again; init never rewrites an existing ohmyhost.yaml, so do not delete it.`
+      })
+    });
   }
   if (parsed.applicationRoot !== applicationRoot) {
     throw new RepositoryInitError("repository_configuration_root_mismatch", `ohmyhost.yaml sets applicationRoot to '${parsed.applicationRoot}', but init selected '${applicationRoot}'. Run 'ohmyhost init --root ${parsed.applicationRoot} --dry-run --json', or correct applicationRoot.`);
   }
-  return configuration;
+  return Object.freeze({ yaml, configuration: parsed, blocker: null });
 }
 var APPLICATION_LOCKFILES = Object.freeze([
   "bun.lock",
@@ -47555,7 +48679,7 @@ async function isApplicationCandidate(repositoryRoot, repositoryFiles, applicati
   const packageJson = await tryReadPackageJson(applicationDirectory);
   if (packageJson === null)
     return false;
-  const framework = detectFramework(dependencyNames(packageJson));
+  const framework = detectFramework(declaredDependencyNames(packageJson.manifest));
   return framework !== "unknown" || files.includes(WORKER_MODULE_PATH);
 }
 async function hasDirectApplicationShape(repositoryRoot, repositoryFiles, applicationRoot) {
@@ -47567,10 +48691,10 @@ async function hasDirectApplicationShape(repositoryRoot, repositoryFiles, applic
   const packageJson = await tryReadPackageJson(applicationDirectory);
   if (packageJson === null)
     return false;
-  const framework = detectFramework(dependencyNames(packageJson));
+  const framework = detectFramework(declaredDependencyNames(packageJson.manifest));
   if (framework === "unknown")
     return files.includes(WORKER_MODULE_PATH);
-  return hasDirectSafeBuildCommand(packageJson, framework);
+  return hasDirectSafeBuildCommand(packageJson.manifest, framework);
 }
 async function isRealDirectory(path2) {
   try {
@@ -47593,18 +48717,12 @@ async function tryReadPackageJson(root) {
     return null;
   }
 }
-function hasDirectSafeBuildCommand(packageJson, framework) {
-  const scripts = packageJson["scripts"];
-  if (!isRecord4(scripts) || typeof scripts["build"] !== "string")
+function hasDirectSafeBuildCommand(manifest2, framework) {
+  const scripts = manifest2["scripts"];
+  if (!isRecord5(scripts) || typeof scripts["build"] !== "string")
     return false;
   return (framework === "nextjs" || framework === "vite" || framework === "tanstack-start") && isAdmittedFrameworkBuildScript(framework, scripts["build"]);
 }
-function buildScriptMessage(framework, command) {
-  const quoted = command.slice(0, 200);
-  if (framework === "nextjs")
-    return `package.json scripts.build must be exactly "next build" or "next build --webpack", not "${quoted}". Move other steps into their own scripts, then commit and push.`;
-  return `package.json scripts.build must be "vite build", optionally joined with && to exactly one "tsc", "tsc -b", "tsc --build" or "tsc --noEmit" stage before or after it, not "${quoted}". Move other steps into their own scripts, then commit and push.`;
-}
 async function assertRepositoryRoot(root) {
   let information;
   try {
@@ -47676,105 +48794,95 @@ async function readPackageJson(root) {
   if (!information.isFile() || information.size > MAXIMUM_PACKAGE_BYTES) {
     throw new RepositoryInitError("package_manifest_invalid", "package.json is invalid");
   }
+  const text = utf8(await readFile3(path2));
+  const manifest2 = text === null ? null : parsePackageManifest(text);
+  if (text === null || manifest2 === null) {
+    throw new RepositoryInitError("package_manifest_invalid", "package.json is invalid");
+  }
+  return Object.freeze({ text, manifest: manifest2 });
+}
+function utf8(bytes) {
   try {
-    const value = JSON.parse(await readFile3(path2, "utf8"));
-    if (!isRecord4(value))
-      throw new TypeError();
-    return value;
+    return UTF8.decode(bytes);
   } catch {
-    throw new RepositoryInitError("package_manifest_invalid", "package.json is invalid");
+    return null;
   }
 }
-function dependencyNames(packageJson) {
-  const names = /* @__PURE__ */ new Set();
-  for (const field of ["dependencies", "devDependencies", "optionalDependencies"]) {
-    const value = packageJson[field];
-    if (!isRecord4(value))
-      continue;
-    for (const [name, version2] of Object.entries(value)) {
-      if (typeof version2 === "string" && version2.length > 0)
-        names.add(name);
-    }
+async function readLeadingBytes(path2) {
+  const handle = await open4(path2, "r");
+  try {
+    const { size } = await handle.stat();
+    const bytes = new Uint8Array(Math.min(size, MAXIMUM_INSPECTED_FILE_BYTES));
+    const { bytesRead } = await handle.read(bytes, 0, bytes.byteLength, 0);
+    return Object.freeze({ bytes: bytes.subarray(0, bytesRead), complete: bytesRead === size });
+  } finally {
+    await handle.close();
   }
-  return names;
+}
+async function readResolvingLockfile(applicationDirectory, admission) {
+  if (admission instanceof FrameworkAdmissionError || admission.lockfile !== "package-lock.json" && admission.lockfile !== "pnpm-lock.yaml")
+    return null;
+  const { bytes, complete } = await readLeadingBytes(resolve5(applicationDirectory, admission.lockfile));
+  const text = complete ? utf8(bytes) : null;
+  return text === null ? null : Object.freeze({ name: admission.lockfile, text });
+}
+async function readFrameworkConfig(applicationDirectory, files, framework) {
+  if (framework !== "nextjs" && framework !== "vite" && framework !== "tanstack-start")
+    return null;
+  let path2;
+  try {
+    path2 = resolveFrameworkConfig(framework === "nextjs" ? "next.config" : "vite.config", files);
+  } catch (error) {
+    if (error instanceof FrameworkAdmissionError)
+      return null;
+    throw error;
+  }
+  if (path2 === null)
+    return null;
+  const { bytes, complete } = await readLeadingBytes(resolve5(applicationDirectory, path2));
+  return Object.freeze({ path: path2, text: complete ? utf8(bytes) : new TextDecoder().decode(bytes) });
+}
+function proposedTanStackRuntime(config, dependencies) {
+  const followed = config === null || config.text === null ? null : tanStackViteConfigRuntime(config.text);
+  return followed ?? (dependencies.has("@cloudflare/vite-plugin") ? "edge" : "static");
 }
 function detectFramework(dependencies) {
   const classification = classifyFrameworkFamily(dependencies);
   return classification === "ambiguous" ? "unknown" : classification;
 }
-function packageManagerAdmissionFor(packageJson, files) {
+function packageManagerAdmissionFor(manifest2, files) {
   try {
-    return resolvePackageManager({
-      packageManager: typeof packageJson["packageManager"] === "string" ? packageJson["packageManager"] : void 0,
-      files
-    });
+    return resolvePackageManager({ packageManager: packageManagerDeclaration(manifest2), files });
   } catch (error) {
     if (error instanceof FrameworkAdmissionError)
       return error;
     throw error;
   }
 }
-function packageManagerInventory(admission, packageJson, files) {
+function packageManagerInventory(admission, manifest2, files) {
   if (!(admission instanceof FrameworkAdmissionError)) {
     return {
       name: admission.manager,
       version: admission.version,
-      lockfile: admission.lockfile
+      lockfile: admission.lockfile,
+      installCommand: admission.installCommand,
+      buildCommand: admission.buildCommand
     };
   }
-  const declaration = packageJson["packageManager"];
-  const match = typeof declaration === "string" ? /^(bun|npm|pnpm|yarn)@([^\s]+)$/u.exec(declaration) : null;
+  const declaration = packageManagerDeclaration(manifest2);
+  const match = declaration === void 0 ? null : /^(bun|npm|pnpm|yarn)@([^\s]+)$/u.exec(declaration);
   const lockfile = APPLICATION_LOCKFILES.find((candidate) => files.includes(candidate)) ?? null;
   const inferredName = lockfile === "package-lock.json" ? "npm" : lockfile === "pnpm-lock.yaml" ? "pnpm" : lockfile === "yarn.lock" ? "yarn" : lockfile === "bun.lock" || lockfile === "bun.lockb" ? "bun" : "unknown";
   return {
     name: match === null ? inferredName : match[1],
     version: match?.[2] ?? null,
-    lockfile
-  };
-}
-function frameworkConfigurations(files) {
-  const ambiguous = [];
-  const resolve7 = (basename2) => {
-    try {
-      return resolveFrameworkConfig(basename2, files);
-    } catch (error) {
-      if (!(error instanceof FrameworkAdmissionError) || error.reason !== "ambiguous_config") {
-        throw error;
-      }
-      ambiguous.push(basename2.slice(0, -".config".length));
-      return null;
-    }
+    lockfile,
+    installCommand: null,
+    buildCommand: null
   };
-  return Object.freeze({
-    next: resolve7("next.config"),
-    openNext: resolve7("open-next.config"),
-    vite: resolve7("vite.config"),
-    ambiguous: Object.freeze(ambiguous)
-  });
 }
-var FRAMEWORK_PACKAGE = {
-  nextjs: "next",
-  "tanstack-start": "@tanstack/react-start",
-  vite: "vite"
-};
-function frameworkCompatibility(packageJson, framework) {
-  const targets = framework === "tanstack-start" ? [
-    { framework: "tanstack-start", packageName: FRAMEWORK_PACKAGE["tanstack-start"] },
-    { framework: "vite", packageName: FRAMEWORK_PACKAGE.vite }
-  ] : framework === "nextjs" ? [{ framework: "nextjs", packageName: FRAMEWORK_PACKAGE.nextjs }] : framework === "vite" ? [{ framework: "vite", packageName: FRAMEWORK_PACKAGE.vite }] : [];
-  const frameworks = targets.map(({ framework: targetFramework, packageName }) => {
-    const version2 = dependencyVersion(packageJson, packageName) ?? "";
-    return Object.freeze({
-      framework: targetFramework,
-      version: version2,
-      ...classifyFrameworkVersion(targetFramework, version2)
-    });
-  });
-  const classification = frameworks.some((entry) => entry.classification === "unsupported") ? "unsupported" : frameworks.some((entry) => entry.classification === "experimental") ? "experimental" : frameworks.length > 0 || framework === "functions" ? "verified" : "unsupported";
-  return Object.freeze({ classification, frameworks: Object.freeze(frameworks) });
-}
-function projectName(explicit, packageJson) {
-  const packageName = packageJson["name"];
+function projectName(explicit, manifest2) {
+  const packageName = manifest2["name"];
   const inferred = typeof packageName === "string" ? (packageName.split("/").at(-1) ?? "").toLowerCase().replace(/[^a-z0-9]+/gu, "-").replace(/^-+|-+$/gu, "") : packageName;
   const value = explicit ?? inferred;
   if (typeof value !== "string" || value.length > 63 || !PROJECT_PATTERN.test(value)) {
@@ -47782,117 +48890,6 @@ function projectName(explicit, packageJson) {
   }
   return value;
 }
-function repositoryBlockers(packageJson, framework, nextStandaloneOutput, tanStackRuntime, files, packageManagerAdmission, frameworkConfigs, compatibility, existingConfiguration) {
-  const blockers = [];
-  if (framework !== "nextjs" && existingConfiguration !== null && "command" in existingConfiguration.build && existingConfiguration.build.ssg_cache_max_mib !== void 0) {
-    blockers.push({
-      code: "framework_unsupported",
-      message: "build.ssg_cache_max_mib is supported only by Next.js; remove it from this application's configuration."
-    });
-  }
-  if (framework === "unknown") {
-    blockers.push({
-      code: "framework_unsupported",
-      message: "Declare exactly one supported Vite, TanStack Start, or Next.js framework, or add src/ohmyhost/worker.ts for the functions runtime."
-    });
-  }
-  if (framework === "functions" && !files.includes(WORKER_MODULE_PATH)) {
-    blockers.push({
-      code: "worker_module_missing",
-      message: `The functions runtime needs ${WORKER_MODULE_PATH} exporting fetch and optional scheduled handlers.`
-    });
-  }
-  if (tanStackRuntime === "ambiguous") {
-    blockers.push({
-      code: "framework_ambiguous",
-      message: 'TanStack Start needs one vite.config.js, .mjs or .ts that selects a mode. Static: tanstackStart({ prerender: { enabled: true } }) from "@tanstack/react-start/plugin/vite" and no "@cloudflare/vite-plugin". Server: cloudflare({ viteEnvironment: { name: "ssr" } }) from "@cloudflare/vite-plugin" listed before tanstackStart() in plugins, with @cloudflare/vite-plugin, @tanstack/react-router, @tanstack/react-start, react, react-dom, @vitejs/plugin-react and vite in package.json.'
-    });
-  }
-  const relevantAmbiguousConfigs = frameworkConfigs.ambiguous.filter((config) => framework === "nextjs" ? config === "next" || config === "open-next" : config === "vite");
-  for (const config of relevantAmbiguousConfigs) {
-    blockers.push({
-      code: "framework_ambiguous",
-      message: `Keep exactly one supported ${config}.config.js, ${config}.config.mjs, or ${config}.config.ts file.`
-    });
-  }
-  if (packageManagerAdmission instanceof FrameworkAdmissionError && packageManagerAdmission.reason === "ambiguous_lockfile") {
-    blockers.push({
-      code: "package_manager_ambiguous",
-      message: "Keep exactly one supported lockfile in the application root."
-    });
-  } else if (packageManagerAdmission instanceof FrameworkAdmissionError) {
-    blockers.push({
-      code: "package_manager_unpinned",
-      message: packageManagerAdmission.reason === "package_manager_version_unsupported" ? `This build image runs Bun ${PINNED_BUN_VERSION}; pin packageManager to bun@${PINNED_BUN_VERSION} and commit its matching lockfile. Repeating the unchanged version cannot work.` : "Declare one exact npm, pnpm, Yarn, or Bun packageManager version and commit its matching lockfile."
-    });
-  } else if (existingConfiguration !== null && (existingConfiguration.build.install !== packageManagerAdmission.installCommand || "command" in existingConfiguration.build && existingConfiguration.build.command !== packageManagerAdmission.buildCommand)) {
-    blockers.push({
-      code: "build_command_unsupported",
-      message: `ohmyhost.yaml build.install must be exactly "${packageManagerAdmission.installCommand}"${"command" in existingConfiguration.build ? ` and build.command "${packageManagerAdmission.buildCommand}"` : ""} for the packageManager in package.json. Set them, then commit and push.`
-    });
-  }
-  if (compatibility.classification === "unsupported" && compatibility.frameworks.length > 0) {
-    const unsupported = compatibility.frameworks.filter((entry) => entry.classification === "unsupported").map((entry) => `${FRAMEWORK_PACKAGE[entry.framework]}@${entry.version || "missing"}`).join(", ");
-    blockers.push({
-      code: "framework_version_unsupported",
-      message: `${unsupported} is outside the versions ohmyho.st builds: next 15.5.26+ (15.5.x) or 16.3.8, vite 5.4.0\u20138.2.2, @tanstack/react-start 1.168.26\u20131.168.49, as an exact version or a ^ or ~ range whose base version is inside. Pin a version in that range in package.json, update the lockfile, commit and push.`
-    });
-  }
-  const scripts = packageJson["scripts"];
-  const scriptRecord = isRecord4(scripts) ? scripts : {};
-  if (framework === "functions") {
-  } else if (!isRecord4(scripts) || typeof scripts["build"] !== "string" || scripts["build"].length === 0) {
-    blockers.push({ code: "build_script_missing", message: "Declare a non-empty build script." });
-  } else if (!hasDirectSafeBuildCommand(packageJson, framework)) {
-    blockers.push({
-      code: "build_command_unsupported",
-      message: buildScriptMessage(framework, scripts["build"])
-    });
-  }
-  const betterAuthVersion = dependencyVersion(packageJson, "better-auth");
-  const managedAuthIssue = managedCustomerAuthAdmissionIssue(existingConfiguration);
-  if (managedAuthIssue !== null)
-    blockers.push(managedAuthIssue);
-  if (existingConfiguration?.auth?.provider === "better-auth" && betterAuthVersion !== null && betterAuthVersion !== SUPPORTED_BETTER_AUTH_VERSION) {
-    blockers.push({
-      code: "better_auth_version_unsupported",
-      message: "Pin better-auth to exactly 1.7.1 before enabling portable customer auth."
-    });
-  }
-  if (framework === "nextjs") {
-    const dependencies = isRecord4(packageJson["dependencies"]) ? packageJson["dependencies"] : {};
-    const nextBuild = scriptRecord["build"] === "next build" || scriptRecord["build"] === "next build --webpack";
-    const nextPackageConfigured = nextBuild && compatibility.frameworks[0]?.classification !== "unsupported" && exactVersion(dependencies["react"]) && exactVersion(dependencies["react-dom"]) && frameworkConfigs.next !== null;
-    const nextConfigured = nextPackageConfigured && frameworkConfigs.ambiguous.every((config) => config !== "open-next");
-    if (nextStandaloneOutput) {
-      blockers.push({
-        code: "workers_runtime_incompatible",
-        message: "Next.js output: standalone does not function on Workers. Remove the output setting from the Next.js config, commit the change, then create a new plan."
-      });
-    }
-    if (!nextConfigured) {
-      blockers.push({
-        code: "next_adapter_unconfigured",
-        message: 'Next.js needs scripts.build exactly "next build" or "next build --webpack", react and react-dom at exact versions such as "19.1.0" (no ^ or ~), next within 15.5.26+ (15.5.x) or 16.3.8, and exactly one next.config.js, .mjs or .ts, with at most one open-next.config file. ohmyho.st adds the OpenNext build itself; do not make it the build script.'
-      });
-    }
-  }
-  return blockers.sort((left, right) => left.code.localeCompare(right.code));
-}
-function exactVersion(value) {
-  return typeof value === "string" && /^\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?$/u.test(value);
-}
-function dependencyVersion(packageJson, name) {
-  for (const field of ["dependencies", "devDependencies", "optionalDependencies"]) {
-    const dependencies = packageJson[field];
-    if (!isRecord4(dependencies))
-      continue;
-    const version2 = dependencies[name];
-    if (typeof version2 === "string" && version2.length > 0)
-      return version2;
-  }
-  return null;
-}
 function renderConfiguration(input) {
   const descriptor = packageManagerDescriptorFromInventory(input.packageManager);
   const install = descriptor?.installCommand ?? "pnpm install --frozen-lockfile --ignore-scripts";
@@ -47949,66 +48946,6 @@ function packageManagerDescriptorFromInventory(packageManager) {
     return null;
   }
 }
-async function detectNextStandaloneOutput(root, framework, nextConfigPath) {
-  if (framework !== "nextjs" || nextConfigPath === null)
-    return false;
-  const path2 = resolve5(root, nextConfigPath);
-  const information = await stat2(path2);
-  if (!information.isFile() || information.size > MAXIMUM_CONFIGURATION_BYTES)
-    return false;
-  return declaresStandaloneOutput(await readFile3(path2, "utf8"));
-}
-function declaresStandaloneOutput(source) {
-  const tokens = sourceTokens(source);
-  return tokens.some((token, index) => token === "output" && tokens[index + 1] === ":" && tokens[index + 2] === "standalone");
-}
-function sourceTokens(source) {
-  const tokens = [];
-  let index = 0;
-  while (index < source.length) {
-    const character = source[index];
-    const next = source[index + 1];
-    if (character === "/" && next === "/") {
-      const end = source.indexOf("\n", index + 2);
-      index = end === -1 ? source.length : end + 1;
-      continue;
-    }
-    if (character === "/" && next === "*") {
-      const end = source.indexOf("*/", index + 2);
-      if (end === -1)
-        return Object.freeze([]);
-      index = end + 2;
-      continue;
-    }
-    if (character === "'" || character === '"' || character === "`") {
-      let value = "";
-      index += 1;
-      while (index < source.length && source[index] !== character) {
-        if (source[index] === "\\" && source[index + 1] !== void 0)
-          index += 1;
-        value += source[index] ?? "";
-        index += 1;
-      }
-      if (source[index] !== character)
-        return Object.freeze([]);
-      tokens.push(value);
-      index += 1;
-      continue;
-    }
-    if (character !== void 0 && /[A-Za-z_$]/u.test(character)) {
-      const start = index;
-      index += 1;
-      while (/[A-Za-z0-9_$]/u.test(source[index] ?? ""))
-        index += 1;
-      tokens.push(source.slice(start, index));
-      continue;
-    }
-    if (character !== void 0 && "{}[]():,.".includes(character))
-      tokens.push(character);
-    index += 1;
-  }
-  return Object.freeze(tokens);
-}
 function databaseMigrationPath(provider) {
   if (provider === "supabase")
     return "postgres/migrations";
@@ -48016,99 +48953,6 @@ function databaseMigrationPath(provider) {
     return "postgres/migrations";
   return null;
 }
-async function detectTanStackRuntime(root, files, framework, packageJson, viteConfigPath) {
-  if (framework !== "tanstack-start")
-    return null;
-  if (viteConfigPath === null)
-    return "ambiguous";
-  const path2 = resolve5(root, viteConfigPath);
-  const information = await stat2(path2);
-  if (!information.isFile() || information.size > MAXIMUM_PACKAGE_BYTES)
-    return "ambiguous";
-  const source = await readFile3(path2, "utf8");
-  const tokens = sourceTokens(source);
-  if (isCompleteTanStackStatic(tokens))
-    return "static";
-  if (isCompleteTanStackEdgePackage(packageJson) && isCompleteTanStackEdgeConfig(tokens)) {
-    return "edge";
-  }
-  return "ambiguous";
-}
-function isCompleteTanStackStatic(tokens) {
-  return hasNamedSourceImport(tokens, "tanstackStart", "@tanstack/react-start/plugin/vite") && !hasSourceModuleImport(tokens, "@cloudflare/vite-plugin") && hasNestedObjectValue(tokens, "tanstackStart", "prerender", "enabled", "true");
-}
-function isCompleteTanStackEdgePackage(packageJson) {
-  return dependencyVersion(packageJson, "@cloudflare/vite-plugin") !== null && ["@tanstack/react-router", "@tanstack/react-start", "react", "react-dom"].every((name) => dependencyVersion(packageJson, name) !== null) && ["@vitejs/plugin-react", "vite"].every((name) => dependencyVersion(packageJson, name) !== null);
-}
-function isCompleteTanStackEdgeConfig(tokens) {
-  const cloudflareCall = sourceCallIndex(tokens, "cloudflare");
-  const tanStackCall = sourceCallIndex(tokens, "tanstackStart");
-  return hasNamedSourceImport(tokens, "cloudflare", "@cloudflare/vite-plugin") && hasNamedSourceImport(tokens, "tanstackStart", "@tanstack/react-start/plugin/vite") && cloudflareCall !== -1 && tanStackCall !== -1 && cloudflareCall < tanStackCall && hasNestedObjectValue(tokens, "cloudflare", "viteEnvironment", "name", "ssr");
-}
-function hasNamedSourceImport(tokens, name, moduleName) {
-  for (let index = 0; index < tokens.length; index += 1) {
-    if (tokens[index] !== "import")
-      continue;
-    const fromIndex = tokens.findIndex((token, candidate) => candidate > index && token === "from");
-    if (fromIndex === -1)
-      return false;
-    if (tokens[fromIndex + 1] === moduleName && tokens.slice(index + 1, fromIndex).includes(name)) {
-      return true;
-    }
-    index = fromIndex;
-  }
-  return false;
-}
-function hasSourceModuleImport(tokens, moduleName) {
-  return tokens.some((token, index) => token === "from" && tokens[index + 1] === moduleName);
-}
-function sourceCallIndex(tokens, name) {
-  return tokens.findIndex((token, index) => token === name && tokens[index + 1] === "(");
-}
-function hasNestedObjectValue(tokens, call, outerProperty, innerProperty, expectedValue) {
-  const callIndex = sourceCallIndex(tokens, call);
-  if (callIndex === -1 || tokens[callIndex + 2] !== "{")
-    return false;
-  const callEnd = matchingSourceDelimiter(tokens, callIndex + 2, "{", "}");
-  const outer = directSourceObjectProperty(tokens, callIndex + 2, callEnd, outerProperty);
-  if (outer === null || outer.value !== "object")
-    return false;
-  return directSourceObjectProperty(tokens, outer.start, outer.end, innerProperty)?.value === expectedValue;
-}
-function directSourceObjectProperty(tokens, start, end, name) {
-  let depth = 0;
-  for (let index = start + 1; index < end; index += 1) {
-    const value = tokens[index];
-    if (value === "{" || value === "[" || value === "(")
-      depth += 1;
-    if (value === "}" || value === "]" || value === ")")
-      depth -= 1;
-    if (depth !== 0 || value !== name || tokens[index + 1] !== ":")
-      continue;
-    if (tokens[index + 2] === "{") {
-      const candidateEnd = matchingSourceDelimiter(tokens, index + 2, "{", "}");
-      return Object.freeze({ start: index + 2, end: candidateEnd, value: "object" });
-    }
-    return Object.freeze({
-      start: index + 2,
-      end: index + 2,
-      value: tokens[index + 2] ?? ""
-    });
-  }
-  return null;
-}
-function matchingSourceDelimiter(tokens, start, open5, close) {
-  let depth = 0;
-  for (let index = start; index < tokens.length; index += 1) {
-    if (tokens[index] === open5)
-      depth += 1;
-    if (tokens[index] === close)
-      depth -= 1;
-    if (depth === 0)
-      return index;
-  }
-  return -1;
-}
 function requirementsFor(inventory, viteCompanion, mailConversionRequired, managedAuthSelected) {
   const requirements = /* @__PURE__ */ new Set();
   if (inventory.framework === "nextjs")
@@ -48149,7 +48993,7 @@ function runtimeContract(capabilities) {
       ...capabilities.mail ? ["OHMYHOST_MAIL_KEY"] : []
     ].sort()),
     packages: Object.freeze({
-      ...capabilities.auth ? { betterAuth: "1.7.1" } : {},
+      ...capabilities.auth ? { betterAuth: MANAGED_BETTER_AUTH_VERSION } : {},
       // A database project was told to install pg, which cannot open a socket from a Worker at all,
       // and was never offered the package that actually holds the client it needs.
       ...capabilities.database || capabilities.storage || capabilities.mail ? { customerRuntime: CUSTOMER_RUNTIME_SOURCE } : {}
@@ -48157,7 +49001,7 @@ function runtimeContract(capabilities) {
   });
 }
 function viteCompanionScaffold(files, capabilities) {
-  const sourceEntryPoint = "src/ohmyhost/companion.ts";
+  const sourceEntryPoint = VITE_COMPANION_ENTRY_PATH;
   const contract = runtimeContract(capabilities);
   return Object.freeze({
     schemaVersion: "ohmyhost.vite-api-companion/v1",
@@ -48189,7 +49033,7 @@ async function createConfiguration(root, configuration) {
     await handle?.close();
   }
 }
-function isRecord4(value) {
+function isRecord5(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function isNodeError(value) {
@@ -48951,6 +49795,7 @@ var runOfflineInit = async (command, io, diagnostics) => {
       inventory: result.inventory,
       compatibility: result.compatibility,
       blockers: result.blockers,
+      pending: result.pending,
       requirements: result.requirements,
       companion: result.companion,
       // The functions runtime reports its own bindings and packages; dropping it left a