@amerged/ohmyhost-mcp 0.1.22 → 0.1.24

package/src/packages/agent-skills/{index.ts → src/index.ts}

@@ -1,6 +1,6 @@
 import { GENERATED_SKILL_RESOURCES } from "./generated-skill-resources.js";
 
-export const OHMYHOST_SKILL_INSTALL_SOURCE = "amerged/docs";
+export const OHMYHOST_SKILL_INSTALL_SOURCE = "amerged-org/docs";
 
 export interface OhmyhostSkillResource {
   readonly skillName: string;

package/src/packages/contracts/package.json

@@ -0,0 +1,137 @@
+{
+  "name": "@ohmyhost/contracts",
+  "version": "0.0.0",
+  "private": true,
+  "type": "module",
+  "sideEffects": false,
+  "exports": {
+    "./operation-failure": {
+      "source": "./src/operation-failure.ts",
+      "types": "./dist/operation-failure.d.ts",
+      "import": "./dist/operation-failure.js"
+    },
+    "./billing": {
+      "source": "./src/billing.ts",
+      "types": "./dist/billing.d.ts",
+      "import": "./dist/billing.js"
+    },
+    "./credit-pricing": {
+      "source": "./src/credit-pricing.ts",
+      "types": "./dist/credit-pricing.d.ts",
+      "import": "./dist/credit-pricing.js"
+    },
+    "./platform-origins": {
+      "source": "./src/platform-origins.ts",
+      "types": "./dist/platform-origins.d.ts",
+      "import": "./dist/platform-origins.js"
+    },
+    ".": {
+      "source": "./src/index.ts",
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js"
+    },
+    "./application-root": {
+      "source": "./src/application-root.ts",
+      "types": "./dist/application-root.d.ts",
+      "import": "./dist/application-root.js"
+    },
+    "./database-migration-admission": {
+      "source": "./src/database-migration-admission.ts",
+      "types": "./dist/database-migration-admission.d.ts",
+      "import": "./dist/database-migration-admission.js"
+    },
+    "./framework-family": {
+      "source": "./src/framework-family.ts",
+      "types": "./dist/framework-family.d.ts",
+      "import": "./dist/framework-family.js"
+    },
+    "./operation-deployment-result": {
+      "source": "./src/operation-deployment-result.ts",
+      "types": "./dist/operation-deployment-result.d.ts",
+      "import": "./dist/operation-deployment-result.js"
+    },
+    "./operation-data-change-result": {
+      "source": "./src/operation-data-change-result.ts",
+      "types": "./dist/operation-data-change-result.d.ts",
+      "import": "./dist/operation-data-change-result.js"
+    },
+    "./framework-admission": {
+      "source": "./src/framework-admission.ts",
+      "types": "./dist/framework-admission.d.ts",
+      "import": "./dist/framework-admission.js"
+    },
+    "./framework-build-script": {
+      "source": "./src/framework-build-script.ts",
+      "types": "./dist/framework-build-script.d.ts",
+      "import": "./dist/framework-build-script.js"
+    },
+    "./browser-capabilities": {
+      "source": "./src/browser-capabilities.ts",
+      "types": "./dist/browser-capabilities.d.ts",
+      "import": "./dist/browser-capabilities.js"
+    },
+    "./openapi.yaml": "./openapi.yaml",
+    "./ohmyhost.schema.json": "./schemas/ohmyhost.schema.json",
+    "./feedback": {
+      "source": "./src/feedback.ts",
+      "types": "./dist/feedback.d.ts",
+      "import": "./dist/feedback.js"
+    },
+    "./user-api-keys": {
+      "source": "./src/user-api-keys.ts",
+      "types": "./dist/user-api-keys.d.ts",
+      "import": "./dist/user-api-keys.js"
+    },
+    "./project-exports": {
+      "source": "./src/project-exports.ts",
+      "types": "./dist/project-exports.d.ts",
+      "import": "./dist/project-exports.js"
+    },
+    "./project-context": {
+      "source": "./src/project-context.ts",
+      "types": "./dist/project-context.d.ts",
+      "import": "./dist/project-context.js"
+    },
+    "./database-compute": {
+      "source": "./src/database-compute.ts",
+      "types": "./dist/database-compute.d.ts",
+      "import": "./dist/database-compute.js"
+    },
+    "./database-access": {
+      "source": "./src/database-access.ts",
+      "types": "./dist/database-access.d.ts",
+      "import": "./dist/database-access.js"
+    },
+    "./functions": {
+      "source": "./src/functions.ts",
+      "types": "./dist/functions.d.ts",
+      "import": "./dist/functions.js"
+    },
+    "./problem-policy": {
+      "source": "./src/problem-policy.ts",
+      "types": "./dist/problem-policy.d.ts",
+      "import": "./dist/problem-policy.js"
+    },
+    "./secret-names": {
+      "source": "./src/secret-names.ts",
+      "types": "./dist/secret-names.d.ts",
+      "import": "./dist/secret-names.js"
+    },
+    "./project-data-changes": {
+      "source": "./src/project-data-changes.ts",
+      "types": "./dist/project-data-changes.d.ts",
+      "import": "./dist/project-data-changes.js"
+    }
+  },
+  "scripts": {
+    "build": "tsc --project tsconfig.build.json",
+    "typecheck": "tsc --project tsconfig.json --noEmit",
+    "test": "vitest run --root ../.. packages/contracts/test",
+    "validate": "pnpm run typecheck && pnpm run test"
+  },
+  "dependencies": {
+    "ajv": "8.18.0",
+    "yaml": "2.8.3"
+  },
+  "license": "Apache-2.0"
+}

package/src/packages/contracts/src/browser-capabilities.ts

@@ -0,0 +1,133 @@
+const RESOURCE_GROUPS = [
+  "connect",
+  "scripts",
+  "styles",
+  "images",
+  "fonts",
+  "frames",
+  "frameAncestors",
+] as const;
+type BrowserResourceGroup = (typeof RESOURCE_GROUPS)[number];
+
+export type BrowserPolicy = Readonly<
+  Record<BrowserResourceGroup, readonly string[]> & {
+    workers: Readonly<{ self: boolean; blob: boolean }>;
+    cors: Readonly<{ origins: readonly string[]; credentials: boolean }>;
+  }
+>;
+
+const POLICY_KEYS = [...RESOURCE_GROUPS, "workers", "cors"];
+const MAX_ORIGINS = 16;
+
+/** Source declarations may omit capabilities; each omission retains the restrictive default. */
+export function normalizeBrowserPolicy(value: unknown): BrowserPolicy {
+  const input = value === undefined ? {} : policyRecord(value, POLICY_KEYS);
+  const workers =
+    input["workers"] === undefined ? {} : policyRecord(input["workers"], ["self", "blob"]);
+  const cors =
+    input["cors"] === undefined ? {} : policyRecord(input["cors"], ["origins", "credentials"]);
+  const resources = Object.fromEntries(
+    RESOURCE_GROUPS.map((group) => [group, normalizeOrigins(input[group], group === "connect")]),
+  ) as Record<BrowserResourceGroup, readonly string[]>;
+  return Object.freeze({
+    ...resources,
+    workers: Object.freeze({
+      self: normalizeBoolean(workers["self"]),
+      blob: normalizeBoolean(workers["blob"]),
+    }),
+    cors: Object.freeze({
+      origins: normalizeOrigins(cors["origins"], false),
+      credentials: normalizeBoolean(cors["credentials"]),
+    }),
+  });
+}
+
+/** Private routing and artifact custody accept the complete normalized policy only. */
+export function parseBrowserPolicy(value: unknown): BrowserPolicy {
+  const input = policyRecord(value, POLICY_KEYS, true);
+  const workers = policyRecord(input["workers"], ["self", "blob"], true);
+  const cors = policyRecord(input["cors"], ["origins", "credentials"], true);
+  if (
+    typeof workers["self"] !== "boolean" ||
+    typeof workers["blob"] !== "boolean" ||
+    typeof cors["credentials"] !== "boolean"
+  )
+    throw invalidPolicy();
+  const normalized = normalizeBrowserPolicy(input);
+  for (const group of RESOURCE_GROUPS) {
+    if (!sameOrigins(input[group], normalized[group])) throw invalidPolicy();
+  }
+  if (!sameOrigins(cors["origins"], normalized.cors.origins)) throw invalidPolicy();
+  return normalized;
+}
+
+function policyRecord(
+  value: unknown,
+  keys: readonly string[],
+  complete = false,
+): Record<string, unknown> {
+  if (
+    typeof value !== "object" ||
+    value === null ||
+    Array.isArray(value) ||
+    ![Object.prototype, null].includes(Object.getPrototypeOf(value)) ||
+    Object.keys(value).some((key) => !keys.includes(key)) ||
+    (complete && Object.keys(value).length !== keys.length)
+  )
+    throw invalidPolicy();
+  return value as Record<string, unknown>;
+}
+
+function normalizeBoolean(value: unknown): boolean {
+  if (value === undefined) return false;
+  if (typeof value !== "boolean") throw invalidPolicy();
+  return value;
+}
+
+function normalizeOrigins(value: unknown, allowWebSocket: boolean): readonly string[] {
+  if (value === undefined) return Object.freeze([]);
+  if (!Array.isArray(value) || value.length > MAX_ORIGINS) throw invalidPolicy();
+  const origins: string[] = [];
+  for (const origin of value) {
+    if (!browserOrigin(origin, allowWebSocket) || origins.includes(origin)) throw invalidPolicy();
+    origins.push(origin);
+  }
+  return Object.freeze(origins.sort());
+}
+
+function browserOrigin(value: unknown, allowWebSocket: boolean): value is string {
+  if (typeof value !== "string" || value.length > 256) return false;
+  try {
+    const url = new URL(value);
+    return (
+      (url.protocol === "https:" || (allowWebSocket && url.protocol === "wss:")) &&
+      url.origin === value &&
+      url.username === "" &&
+      url.password === "" &&
+      url.pathname === "/" &&
+      url.search === "" &&
+      url.hash === "" &&
+      url.hostname.includes(".") &&
+      !url.hostname.endsWith(".local") &&
+      !url.hostname.endsWith(".internal") &&
+      !/^\d+(?:\.\d+){3}$/u.test(url.hostname) &&
+      url.hostname
+        .split(".")
+        .every((label) => /^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/u.test(label))
+    );
+  } catch {
+    return false;
+  }
+}
+
+function sameOrigins(value: unknown, expected: readonly string[]): boolean {
+  return (
+    Array.isArray(value) &&
+    value.length === expected.length &&
+    value.every((origin, index) => origin === expected[index])
+  );
+}
+
+function invalidPolicy(): TypeError {
+  return new TypeError("Invalid browser capability policy");
+}

package/src/packages/contracts/src/customer-auth-admission.ts

@@ -0,0 +1,36 @@
+export interface ManagedCustomerAuthCapabilities {
+  readonly auth?: Readonly<{ provider: string }>;
+  readonly database?: Readonly<{ enabled: boolean }>;
+  readonly mail?: Readonly<{ enabled: boolean }>;
+}
+
+export function managedCustomerAuthMailMessage(path: string): string {
+  return `"${path}" selects the managed Better Auth bridge, which sends verification and password-reset email through ohmyhost Mail. Set mail.enabled: true and set up a verified mail sender, or set auth.provider: none and keep the application-owned Better Auth configuration and sender. Commit and push the change, then plan the new commit.`;
+}
+
+export function managedCustomerAuthDatabaseMessage(path: string): string {
+  return `"${path}" selects the managed Better Auth bridge, which requires the managed PostgreSQL database. Set database.enabled: true with an admitted migrations path, or set auth.provider: none and keep the application-owned authentication configuration. Commit and push the change, then plan the new commit.`;
+}
+
+/** Dependency inventory never selects the managed bridge; only the explicit auth capability does. */
+export function managedCustomerAuthAdmissionIssue(
+  capabilities: ManagedCustomerAuthCapabilities | null | undefined,
+): Readonly<{
+  code: "managed_auth_database_required" | "managed_auth_mail_required";
+  message: string;
+}> | null {
+  if (capabilities?.auth?.provider !== "better-auth") {
+    return null;
+  }
+  if (capabilities.database?.enabled !== true) {
+    return Object.freeze({
+      code: "managed_auth_database_required" as const,
+      message: managedCustomerAuthDatabaseMessage("ohmyhost.yaml"),
+    });
+  }
+  if (capabilities.mail?.enabled === true) return null;
+  return Object.freeze({
+    code: "managed_auth_mail_required" as const,
+    message: managedCustomerAuthMailMessage("ohmyhost.yaml"),
+  });
+}

package/src/packages/contracts/{database-access.ts → src/database-access.ts}

@@ -105,7 +105,13 @@ export interface ProjectDatabaseAccess {
   readonly issued_at: string;
   readonly expires_at: string;
   readonly revoked_at: string | null;
-  readonly revocation_reason: "principal" | "expired" | "budget" | "creation_failed" | null;
+  readonly revocation_reason:
+    | "principal"
+    | "expired"
+    | "budget"
+    | "creation_failed"
+    | "data_change"
+    | null;
 }
 export interface ProjectDatabaseAccessCredential extends ProjectDatabaseAccess {
   readonly connection_uri: string;
@@ -219,7 +225,9 @@ function assertAccessFields(value: Record<string, unknown>): void {
     (revoked !== null && !timestamp(revoked)) ||
     (revoked === null) !== (reason === null) ||
     (reason !== null &&
-      !["principal", "expired", "budget", "creation_failed"].includes(String(reason))) ||
+      !["principal", "expired", "budget", "creation_failed", "data_change"].includes(
+        String(reason),
+      )) ||
     (value["state"] === "revoked") !== (revoked !== null)
   )
     throw new TypeError("Invalid database access");

package/src/packages/contracts/{framework-admission.ts → src/framework-admission.ts}

@@ -1,3 +1,13 @@
+import { PINNED_BUN_VERSION } from "./framework-build-script.mjs";
+import {
+  managedCustomerAuthMailMessage,
+  managedCustomerAuthDatabaseMessage,
+} from "./customer-auth-admission.js";
+export {
+  managedCustomerAuthAdmissionIssue,
+  managedCustomerAuthMailMessage,
+} from "./customer-auth-admission.js";
+
 export type PackageManagerName = "bun" | "npm" | "pnpm" | "yarn";
 
 export type FrameworkAdmissionReason =
@@ -6,7 +16,8 @@ export type FrameworkAdmissionReason =
   | "invalid_package_manager"
   | "missing_lockfile"
   | "missing_package_manager"
-  | "package_manager_lockfile_mismatch";
+  | "package_manager_lockfile_mismatch"
+  | "package_manager_version_unsupported";
 
 export class FrameworkAdmissionError extends Error {
   public readonly code = "framework_admission_failed";
@@ -88,6 +99,9 @@ export function resolvePackageManager(input: PackageManagerInput): PackageManage
   if (!contract.lockfiles.includes(lockfile)) {
     throw new FrameworkAdmissionError("package_manager_lockfile_mismatch");
   }
+  if (manager === "bun" && version !== PINNED_BUN_VERSION) {
+    throw new FrameworkAdmissionError("package_manager_version_unsupported");
+  }
   return Object.freeze({
     manager,
     version,
@@ -187,17 +201,25 @@ function versionAdmission(
 }
 
 export type FrameworkConversionDiagnosticCode =
+  | "managed_auth_database_required"
+  | "managed_auth_mail_required"
   | "database_binding_private"
   | "database_driver_unsupported"
   | "source_syntax_invalid"
   | "worker_module_default_export_required"
-  | "scheduled_handler_required";
+  | "scheduled_handler_required"
+  | "framework_base_path_unsupported"
+  | "tanstack_prerender_required"
+  | "tanstack_vite_plugins_required"
+  | "next_cache_components_unsupported";
 
 export interface FrameworkConversionDiagnostic {
   readonly code: FrameworkConversionDiagnosticCode;
   readonly path: string;
 }
 
+const PUSH_AND_PLAN = "Commit and push the change, then plan the new commit.";
+
 // Detail texts are the customer-facing sentence for one diagnostic; parseFrameworkConversionDetail
 // recognizes exactly these sentences so a client can map a detail back to its typed diagnostic.
 const FRAMEWORK_CONVERSION_DETAILS: Readonly<
@@ -206,38 +228,89 @@ const FRAMEWORK_CONVERSION_DETAILS: Readonly<
     Readonly<{ render(path: string): string; pattern: RegExp }>
   >
 > = Object.freeze({
+  managed_auth_database_required: Object.freeze({
+    render: managedCustomerAuthDatabaseMessage,
+    pattern:
+      /^"([^"]+)" selects the managed Better Auth bridge, which requires the managed PostgreSQL database\. Set database\.enabled: true with an admitted migrations path, or set auth\.provider: none and keep the application-owned authentication configuration\. Commit and push the change, then plan the new commit\.$/u,
+  }),
+  managed_auth_mail_required: Object.freeze({
+    render: managedCustomerAuthMailMessage,
+    pattern:
+      /^"([^"]+)" selects the managed Better Auth bridge, which sends verification and password-reset email through ohmyhost Mail\. Set mail\.enabled: true and set up a verified mail sender, or set auth\.provider: none and keep the application-owned Better Auth configuration and sender\. Commit and push the change, then plan the new commit\.$/u,
+  }),
   database_binding_private: Object.freeze({
     render: (path: string) =>
-      `"${path}" reads a managed database connection string. HYPERDRIVE is retired; DATABASE_URL and postgres:// URLs never reach a customer Worker. Call the database with createPrivateDatabaseClient from "@ohmyhost/customer-runtime/database". Commit the change, then plan again.`,
+      `"${path}" reads a database connection string (DATABASE_URL, HYPERDRIVE, connectionString or a postgres:// URL); none reaches a customer Worker. Call the database with createPrivateDatabaseClient from "@ohmyhost/customer-runtime/database". ${PUSH_AND_PLAN}`,
     pattern:
-      /^"([^"]+)" reads a managed database connection string\. HYPERDRIVE is retired; DATABASE_URL and postgres:\/\/ URLs never reach a customer Worker\. Call the database with createPrivateDatabaseClient from "@ohmyhost\/customer-runtime\/database"\. Commit the change, then plan again\.$/u,
+      /^"([^"]+)" reads a database connection string \(DATABASE_URL, HYPERDRIVE, connectionString or a postgres:\/\/ URL\); none reaches a customer Worker\. Call the database with createPrivateDatabaseClient from "@ohmyhost\/customer-runtime\/database"\. Commit and push the change, then plan the new commit\.$/u,
   }),
   database_driver_unsupported: Object.freeze({
     render: (path: string) =>
-      `"${path}" imports a PostgreSQL socket driver. Outbound connect() is disabled for customer Workers, so it can never open a connection; call the database with createPrivateDatabaseClient from "@ohmyhost/customer-runtime/database". Commit the change, then plan again.`,
+      `"${path}" imports a database socket driver (pg, postgres, pg-native or mysql2); customer Workers cannot open sockets. Call the database with createPrivateDatabaseClient from "@ohmyhost/customer-runtime/database". ${PUSH_AND_PLAN}`,
     pattern:
-      /^"([^"]+)" imports a PostgreSQL socket driver\. Outbound connect\(\) is disabled for customer Workers, so it can never open a connection; call the database with createPrivateDatabaseClient from "@ohmyhost\/customer-runtime\/database"\. Commit the change, then plan again\.$/u,
+      /^"([^"]+)" imports a database socket driver \(pg, postgres, pg-native or mysql2\); customer Workers cannot open sockets\. Call the database with createPrivateDatabaseClient from "@ohmyhost\/customer-runtime\/database"\. Commit and push the change, then plan the new commit\.$/u,
   }),
   source_syntax_invalid: Object.freeze({
     render: (path: string) =>
-      `Invalid JavaScript or TypeScript in "${path}". Fix the file, commit the change, then plan again.`,
+      `Invalid JavaScript or TypeScript in "${path}". Fix the file, commit and push the change, then plan the new commit.`,
     pattern:
-      /^Invalid JavaScript or TypeScript in "([^"]+)"\. Fix the file, commit the change, then plan again\.$/u,
+      /^Invalid JavaScript or TypeScript in "([^"]+)"\. Fix the file, commit and push the change, then plan the new commit\.$/u,
   }),
   worker_module_default_export_required: Object.freeze({
     render: (path: string) =>
-      `Worker module "${path}" has no default export. Export default { fetch, scheduled } with the handlers ohmyho.st invokes; named exports are never called. Commit the change, then plan again.`,
+      `Worker module "${path}" has no default export. Export default { fetch, scheduled } with the handlers ohmyho.st invokes; named exports are never called. ${PUSH_AND_PLAN}`,
     pattern:
-      /^Worker module "([^"]+)" has no default export\. Export default \{ fetch, scheduled \} with the handlers ohmyho\.st invokes; named exports are never called\. Commit the change, then plan again\.$/u,
+      /^Worker module "([^"]+)" has no default export\. Export default \{ fetch, scheduled \} with the handlers ohmyho\.st invokes; named exports are never called\. Commit and push the change, then plan the new commit\.$/u,
   }),
   scheduled_handler_required: Object.freeze({
     render: (path: string) =>
-      `functions.crons is declared but "${path}" exports no scheduled handler. Add scheduled(controller, env, ctx) to its default export, commit the change, then plan again.`,
+      `functions.crons is declared but "${path}" exports no scheduled handler. Add scheduled(controller, env, ctx) to its default export, commit and push the change, then plan the new commit.`,
+    pattern:
+      /^functions\.crons is declared but "([^"]+)" exports no scheduled handler\. Add scheduled\(controller, env, ctx\) to its default export, commit and push the change, then plan the new commit\.$/u,
+  }),
+  framework_base_path_unsupported: Object.freeze({
+    render: (path: string) =>
+      `"${path}" sets a Vite base. ohmyho.st serves the app at the root origin: remove base or set base: "/". ${PUSH_AND_PLAN}`,
     pattern:
-      /^functions\.crons is declared but "([^"]+)" exports no scheduled handler\. Add scheduled\(controller, env, ctx\) to its default export, commit the change, then plan again\.$/u,
+      /^"([^"]+)" sets a Vite base\. ohmyho\.st serves the app at the root origin: remove base or set base: "\/"\. Commit and push the change, then plan the new commit\.$/u,
+  }),
+  tanstack_prerender_required: Object.freeze({
+    render: (path: string) =>
+      `"${path}" does not call tanstackStart({ prerender: { enabled: true } }), which the static TanStack Start runtime needs; enable prerender, or set runtime.mode: edge with the Cloudflare Vite plugin. ${PUSH_AND_PLAN}`,
+    pattern:
+      /^"([^"]+)" does not call tanstackStart\(\{ prerender: \{ enabled: true \} \}\), which the static TanStack Start runtime needs; enable prerender, or set runtime\.mode: edge with the Cloudflare Vite plugin\. Commit and push the change, then plan the new commit\.$/u,
+  }),
+  tanstack_vite_plugins_required: Object.freeze({
+    render: (path: string) =>
+      `"${path}" does not follow the TanStack Start plugin contract: import tanstackStart from "@tanstack/react-start/plugin/vite"; on runtime edge also import cloudflare from "@cloudflare/vite-plugin" and call cloudflare({ viteEnvironment: { name: "ssr" } }) before tanstackStart(); on runtime static do not import the Cloudflare plugin. ${PUSH_AND_PLAN}`,
+    pattern:
+      /^"([^"]+)" does not follow the TanStack Start plugin contract: import tanstackStart from "@tanstack\/react-start\/plugin\/vite"; on runtime edge also import cloudflare from "@cloudflare\/vite-plugin" and call cloudflare\(\{ viteEnvironment: \{ name: "ssr" \} \}\) before tanstackStart\(\); on runtime static do not import the Cloudflare plugin\. Commit and push the change, then plan the new commit\.$/u,
+  }),
+  next_cache_components_unsupported: Object.freeze({
+    render: (path: string) =>
+      `"${path}" sets cacheComponents: true, which ohmyho.st does not support; remove it or set it to false. ${PUSH_AND_PLAN}`,
+    pattern:
+      /^"([^"]+)" sets cacheComponents: true, which ohmyho\.st does not support; remove it or set it to false\. Commit and push the change, then plan the new commit\.$/u,
   }),
 });
 
+/**
+ * An adapter rule that `init` does not check. It stays a TypeError, so every existing caller that
+ * treats an adapter refusal as a TypeError keeps working, and carries the typed diagnostic whose
+ * detail names the file and its fix.
+ */
+export class FrameworkConversionDiagnosticError extends TypeError {
+  public readonly diagnostic: FrameworkConversionDiagnostic;
+
+  public constructor(diagnostic: unknown) {
+    const parsed = parseFrameworkConversionDiagnostic(diagnostic);
+    if (parsed === null) throw new TypeError("Framework conversion diagnostic is invalid");
+    super(FRAMEWORK_CONVERSION_DETAILS[parsed.code].render(parsed.path));
+    this.name = "FrameworkConversionDiagnosticError";
+    this.diagnostic = parsed;
+  }
+}
+
 function isFrameworkConversionDiagnosticCode(
   value: unknown,
 ): value is FrameworkConversionDiagnosticCode {
@@ -256,7 +329,9 @@ export function parseFrameworkConversionDiagnostic(
     !isFrameworkConversionDiagnosticCode(code) ||
     typeof path !== "string" ||
     path.length > 240 ||
-    !/^[A-Za-z0-9_@()[\]./-]+\.(?:[cm]?[jt]sx?)$/u.test(path) ||
+    (code === "managed_auth_mail_required" || code === "managed_auth_database_required"
+      ? path !== "ohmyhost.yaml"
+      : !/^[A-Za-z0-9_@()[\]./-]+\.(?:[cm]?[jt]sx?)$/u.test(path)) ||
     path.split("/").some((segment) => segment === "" || segment === "." || segment === "..")
   )
     return null;

package/src/packages/contracts/src/framework-build-script.mjs

@@ -0,0 +1,22 @@
+export const PINNED_BUN_VERSION = "1.2.22";
+
+const TYPESCRIPT_BUILD_STAGE = /^tsc(?:[ \t]+(?:--noEmit|-b|--build))?$/u;
+
+/**
+ * The same source is consumed by local admission, framework adapters and the build sandbox.
+ * @param {"nextjs" | "tanstack-start" | "vite"} framework
+ * @param {unknown} script
+ * @returns {boolean}
+ */
+export function isAdmittedFrameworkBuildScript(framework, script) {
+  if (typeof script !== "string") return false;
+  if (framework === "nextjs") return script === "next build" || script === "next build --webpack";
+  if (framework !== "vite" && framework !== "tanstack-start") return false;
+  const stages = script.trim().split(/[ \t]*&&[ \t]*/u);
+  if (stages.length === 1) return stages[0] === "vite build";
+  if (stages.length !== 2) return false;
+  return (
+    (stages[0] === "vite build" && TYPESCRIPT_BUILD_STAGE.test(stages[1] ?? "")) ||
+    (TYPESCRIPT_BUILD_STAGE.test(stages[0] ?? "") && stages[1] === "vite build")
+  );
+}

package/src/packages/contracts/src/framework-build-script.ts

@@ -0,0 +1 @@
+export { isAdmittedFrameworkBuildScript, PINNED_BUN_VERSION } from "./framework-build-script.mjs";

package/src/packages/contracts/{index.ts → src/index.ts}

@@ -4,12 +4,18 @@ import { parse as parseYaml } from "yaml";
 import schema from "../schemas/ohmyhost.schema.json" with { type: "json" };
 import { normalizeApplicationRoot, type ApplicationRoot } from "./application-root.js";
 import { normalizeCrons } from "./functions.js";
+import { normalizeBrowserPolicy, type BrowserPolicy } from "./browser-capabilities.js";
 
 export * from "./application-root.js";
 export * from "./framework-admission.js";
 export * from "./operation-deployment-result.js";
+export * from "./operation-data-change-result.js";
 export * from "./operation-failure.js";
 export * from "./functions.js";
+export * from "./browser-capabilities.js";
+export * from "./problem-policy.js";
+export * from "./secret-names.js";
+export * from "./project-data-changes.js";
 
 export type OhmyhostRuntimeMode = "static" | "edge" | "functions" | "auto";
 
@@ -30,6 +36,7 @@ export interface OhmyhostConfig {
     mode: OhmyhostRuntimeMode;
     healthcheck: string;
     egress: Readonly<{ allow: readonly string[] }>;
+    browser?: BrowserPolicy;
   }>;
   readonly database?: Readonly<{
     enabled: boolean;
@@ -88,6 +95,9 @@ export function parseOhmyhostConfig(value: unknown): OhmyhostConfig {
       egress: Object.freeze({
         allow: normalizeEgressOrigins(input.runtime.egress?.allow),
       }),
+      ...(input.runtime.browser === undefined
+        ? {}
+        : { browser: normalizeBrowserPolicy(input.runtime.browser) }),
     }),
     ...(input.database === undefined
       ? {}
@@ -173,6 +183,7 @@ function normalizeEgressOrigins(value: readonly string[] | undefined): readonly
     }
     if (
       parsed.protocol !== "https:" ||
+      parsed.port !== "" ||
       parsed.username !== "" ||
       parsed.password !== "" ||
       parsed.origin !== origin ||
@@ -188,28 +199,18 @@ function normalizeEgressOrigins(value: readonly string[] | undefined): readonly
   return Object.freeze(origins);
 }
 
+// Egress is routed and staged by DNS name on the default HTTPS port: an IP literal (public or
+// private, v4 or v6) can never become a working origin, and a local name never resolves.
 function forbiddenEgressHostname(hostname: string): boolean {
   const normalized = hostname.toLowerCase();
-  if (
+  return (
     normalized === "localhost" ||
     normalized.endsWith(".localhost") ||
     normalized.endsWith(".local") ||
     normalized.endsWith(".internal") ||
-    normalized === "0.0.0.0" ||
-    normalized === "::1"
-  ) {
-    return true;
-  }
-  const ipv4 = /^(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})$/u.exec(normalized);
-  if (ipv4 === null) return normalized.startsWith("[") || normalized.endsWith("]");
-  const octets = ipv4.slice(1).map(Number);
-  if (octets.some((octet) => octet > 255)) return true;
-  return (
-    octets[0] === 10 ||
-    octets[0] === 127 ||
-    (octets[0] === 169 && octets[1] === 254) ||
-    (octets[0] === 172 && (octets[1] ?? 0) >= 16 && (octets[1] ?? 0) <= 31) ||
-    (octets[0] === 192 && octets[1] === 168)
+    /^\d{1,3}(?:\.\d{1,3}){3}$/u.test(normalized) ||
+    normalized.startsWith("[") ||
+    normalized.endsWith("]")
   );
 }