@amerged/ohmyhost-mcp 0.1.28 → 0.1.29

package/src/apps/product-cli/src/command.ts

@@ -7,7 +7,63 @@ import type { ManagedMailCommand } from "@ohmyhost/sdk-ts";
 import { USER_API_KEY_ID } from "@ohmyhost/contracts/user-api-keys";
 import { WORKOS_USER_API_KEY_PATTERN } from "@ohmyhost/workos-auth-contracts/user-api-keys";
 import { isProfileName, isProfileUserId } from "./profile-store.js";
+import {
+  isManagedSourcePath,
+  parseManagedSourceRequest,
+  type ManagedSourceUploadRequest,
+  type ManagedSourceRestoreRequest,
+  type ManagedSourceInitializeRequest,
+} from "@ohmyhost/contracts/managed-sources";
+export type SourceCliCommand =
+  | { readonly kind: "source-inspect"; readonly directory: string }
+  | {
+      readonly kind: "source-read";
+      readonly action: "status" | "files" | "file" | "versions" | "diff" | "upload";
+      readonly projectId: string;
+      readonly commitSha?: string;
+      readonly path?: string;
+      readonly limit?: number;
+      readonly beforeCommitSha?: string;
+      readonly fromCommitSha?: string;
+      readonly toCommitSha?: string;
+      readonly operationId?: string;
+      readonly credentialStore: "native";
+    }
+  | {
+      readonly kind: "source-publish";
+      readonly projectId: string;
+      readonly directory: string;
+      readonly request: ManagedSourceUploadRequest;
+      readonly explicitExpectedCommit: boolean;
+      readonly idempotencyKey: string;
+      readonly wait: boolean;
+      readonly credentialStore: "native";
+    }
+  | {
+      readonly kind: "source-complete";
+      readonly projectId: string;
+      readonly directory: string;
+      readonly operationId?: string;
+      readonly credentialStore: "native";
+    }
+  | {
+      readonly kind: "source-initialize";
+      readonly projectId: string;
+      readonly request: ManagedSourceInitializeRequest;
+      readonly idempotencyKey: string;
+      readonly wait: boolean;
+      readonly credentialStore: "native";
+    }
+  | {
+      readonly kind: "source-restore";
+      readonly projectId: string;
+      readonly request: ManagedSourceRestoreRequest;
+      readonly idempotencyKey: string;
+      readonly wait: boolean;
+      readonly credentialStore: "native";
+    };
 export type ProductCliCommand =
+  | SourceCliCommand
   | {
       readonly kind: "project-data-plan";
       readonly projectId: string;
@@ -571,7 +627,190 @@ export class InvalidCommandError extends Error {
   }
 }
 
+function parseSourceCommand(values: string[], wait: boolean): SourceCliCommand {
+  const action = values.shift();
+  if (action === "publish" && values[0] === "complete") {
+    values.shift();
+    if (wait) throw new InvalidCommandError();
+    const options = parseOptionalOptions(values, ["--project", "--directory", "--operation"]);
+    const projectId = options["--project"],
+      operationId = options["--operation"];
+    if (
+      projectId === undefined ||
+      !/^[0-7][0-9A-HJKMNP-TV-Z]{25}$/u.test(projectId) ||
+      (operationId !== undefined && !/^[0-7][0-9A-HJKMNP-TV-Z]{25}$/u.test(operationId))
+    )
+      throw new InvalidCommandError();
+    return {
+      kind: "source-complete",
+      projectId,
+      directory: options["--directory"] ?? ".",
+      operationId,
+      credentialStore: "native",
+    };
+  }
+  if (action === "inspect") {
+    if (wait) throw new InvalidCommandError();
+    const options = parseOptionalOptions(values, ["--directory"]);
+    return { kind: "source-inspect", directory: options["--directory"] ?? "." };
+  }
+  const allowed =
+    action === "publish"
+      ? [
+          "--project",
+          "--directory",
+          "--mode",
+          "--expected-source-generation",
+          "--expected-source-connection",
+          "--expected-commit",
+          "--message",
+          "--idempotency-key",
+        ]
+      : action === "restore"
+        ? [
+            "--project",
+            "--expected-source-generation",
+            "--expected-commit",
+            "--restore-commit",
+            "--message",
+            "--idempotency-key",
+          ]
+        : action === "initialize"
+          ? ["--project", "--template", "--expected-source-generation", "--idempotency-key"]
+          : [
+              "--project",
+              "--commit",
+              "--path",
+              "--limit",
+              "--before",
+              "--from",
+              "--to",
+              "--operation",
+            ];
+  const options = parseOptionalOptions(values, allowed);
+  const projectId = options["--project"];
+  if (projectId === undefined || !/^[0-7][0-9A-HJKMNP-TV-Z]{25}$/u.test(projectId))
+    throw new InvalidCommandError();
+  const credentialStore = "native" as const;
+  if (action === "publish" || action === "restore" || action === "initialize") {
+    const idempotencyKey = options["--idempotency-key"];
+    const rawGeneration = options["--expected-source-generation"];
+    if (
+      idempotencyKey === undefined ||
+      rawGeneration === undefined ||
+      !/^(?:0|[1-9][0-9]*)$/u.test(rawGeneration)
+    )
+      throw new InvalidCommandError();
+    const expected_source_generation = Number(rawGeneration);
+    try {
+      if (action === "initialize")
+        return {
+          kind: "source-initialize",
+          projectId,
+          request: parseManagedSourceRequest("initialize", {
+            expected_source_generation,
+            template: options["--template"] ?? "vite-react",
+          }),
+          idempotencyKey,
+          wait,
+          credentialStore,
+        };
+      const common = {
+        expected_source_generation,
+        expected_commit_sha: options["--expected-commit"] ?? null,
+        message: options["--message"],
+      };
+      if (action === "restore")
+        return {
+          kind: "source-restore",
+          projectId,
+          request: parseManagedSourceRequest("restore", {
+            ...common,
+            restore_commit_sha: options["--restore-commit"],
+          }),
+          idempotencyKey,
+          wait,
+          credentialStore,
+        };
+      return {
+        kind: "source-publish",
+        projectId,
+        directory: options["--directory"] ?? ".",
+        request: parseManagedSourceRequest("upload", {
+          ...common,
+          mode: options["--mode"],
+          expected_source_connection_id: options["--expected-source-connection"] ?? null,
+        }),
+        explicitExpectedCommit: options["--expected-commit"] !== undefined,
+        idempotencyKey,
+        wait,
+        credentialStore,
+      };
+    } catch {
+      throw new InvalidCommandError();
+    }
+  }
+  if (wait || !["status", "files", "file", "versions", "diff", "upload"].includes(action ?? ""))
+    throw new InvalidCommandError();
+  const commitSha = options["--commit"],
+    path = options["--path"],
+    beforeCommitSha = options["--before"],
+    fromCommitSha = options["--from"],
+    toCommitSha = options["--to"],
+    operationId = options["--operation"];
+  const permitted =
+    action === "status"
+      ? ["--project"]
+      : action === "versions"
+        ? ["--project", "--limit", "--before"]
+        : action === "diff"
+          ? ["--project", "--from", "--to"]
+          : action === "upload"
+            ? ["--project", "--operation"]
+            : action === "file"
+              ? ["--project", "--commit", "--path"]
+              : ["--project", "--commit"];
+  if (
+    Object.keys(options).some((key) => !permitted.includes(key)) ||
+    [commitSha, beforeCommitSha, fromCommitSha, toCommitSha].some(
+      (value) => value !== undefined && !/^[a-f0-9]{40}$/u.test(value),
+    ) ||
+    (action === "file" && !isManagedSourcePath(path)) ||
+    (action === "diff" && (fromCommitSha === undefined || toCommitSha === undefined)) ||
+    (action === "upload" &&
+      (operationId === undefined || !/^[0-7][0-9A-HJKMNP-TV-Z]{25}$/u.test(operationId)))
+  )
+    throw new InvalidCommandError();
+  const limit = options["--limit"] === undefined ? undefined : Number(options["--limit"]);
+  if (limit !== undefined && (!Number.isSafeInteger(limit) || limit < 1 || limit > 100))
+    throw new InvalidCommandError();
+  return {
+    kind: "source-read",
+    action: action as Extract<SourceCliCommand, { kind: "source-read" }>["action"],
+    projectId,
+    commitSha,
+    path,
+    beforeCommitSha,
+    fromCommitSha,
+    toCommitSha,
+    operationId,
+    limit,
+    credentialStore,
+  };
+}
+
 export type RecognizedCommandLabel =
+  | "source inspect"
+  | "source status"
+  | "source files"
+  | "source file"
+  | "source versions"
+  | "source diff"
+  | "source upload"
+  | "source publish"
+  | "source publish complete"
+  | "source initialize"
+  | "source restore"
   | "project data plan"
   | "project data change"
   | "database compute set"
@@ -768,6 +1007,24 @@ export const recognizedCommandLabel = (argv: readonly string[]): RecognizedComma
     if (value === "database" && values[0] === "psql") return "database psql";
     if (value === "link" || value === "plan" || value === "deploy" || value === "logs")
       return value;
+    if (value === "source" && values[0] === "publish" && values[1] === "complete")
+      return "source publish complete";
+    if (
+      value === "source" &&
+      [
+        "inspect",
+        "status",
+        "files",
+        "file",
+        "versions",
+        "diff",
+        "upload",
+        "publish",
+        "initialize",
+        "restore",
+      ].includes(values[0] ?? "")
+    )
+      return `source ${values[0]}` as RecognizedCommandLabel;
     if (value === "source" && values[0] === "auto-deploy") {
       if (values[1] === "set") return "source auto-deploy set";
       if (values[1] === "status") return "source auto-deploy status";
@@ -842,6 +1099,10 @@ export const parseProductCliCommand = (argv: readonly string[]): ProductCliComma
   const follow = removeFlag(values, "--follow");
   const stdin = removeFlag(values, "--stdin");
   const first = values.shift();
+  if (first === "source" && values[0] !== "auto-deploy") {
+    if (dryRun || revoke || yes || follow || stdin) throw new InvalidCommandError();
+    return parseSourceCommand(values, wait);
+  }
   if (
     first === "whoami" &&
     !dryRun &&

package/src/apps/product-cli/src/composition.ts

@@ -1,9 +1,15 @@
 import { randomUUID } from "node:crypto";
-import { join } from "node:path";
+import { join, resolve } from "node:path";
+import { inspectSourceWorkspace, SourceWorkspaceError } from "./source-workspace.js";
+import {
+  inspectLocalSourcePublications,
+  LocalSourcePublicationError,
+} from "./source-publication-store.js";
 import {
   createClient,
   getGithubOrganizationConnection,
   getProject,
+  getProjectSource,
   revokeCurrentSession,
 } from "@ohmyhost/sdk-ts";
 import { WORKOS_USER_API_KEY_PATTERN } from "@ohmyhost/workos-auth-contracts/user-api-keys";
@@ -558,6 +564,14 @@ export const runProductionCli = async (
     return written(invalidCommandFailure(argv, environment));
   }
   const workingDirectory = overrides.workingDirectory ?? process.cwd();
+  const directoryOption = args.indexOf("--directory");
+  const selectedSourceDirectory =
+    args[0] === "source" &&
+    args[1] === "publish" &&
+    directoryOption !== -1 &&
+    args[directoryOption + 1] !== undefined
+      ? resolve(workingDirectory, args[directoryOption + 1] as string)
+      : workingDirectory;
   let command: ProductCliCommand;
   let linked: Extract<LinkedProject, { outcome: "linked" }> | null;
   let links: DirectoryLinks = { links: [], legacy: null };
@@ -570,7 +584,7 @@ export const runProductionCli = async (
         return { outcome: "none" };
       }
       links = await readProjectLinks(
-        join(workingDirectory, platform.linkDirectory),
+        join(selectedSourceDirectory, platform.linkDirectory),
         platform.apiOrigin,
       );
       let named = profileName;
@@ -649,6 +663,22 @@ export const runProductionCli = async (
       );
     return runOfflineInit(command, io, diagnostics);
   }
+  if (command.kind === "source-inspect") {
+    try {
+      const workspace = await inspectSourceWorkspace(resolve(workingDirectory, command.directory));
+      return written({
+        exitCode: 0,
+        stdout: `${JSON.stringify({ version: 1, command: "source inspect", status: "inspected", workspace, pending_publications: await inspectLocalSourcePublications(workspace.directory) })}\n`,
+        stderr: "",
+      });
+    } catch (error) {
+      return written(
+        error instanceof SourceWorkspaceError || error instanceof LocalSourcePublicationError
+          ? errorDocument("source inspect", 2, error.code, false, error.message)
+          : classifyCliFailure("source inspect", error, signal),
+      );
+    }
+  }
   if (command.kind === "help" || command.kind === "version") {
     return written(
       cliMetadataResult(command.kind, command.kind === "help" ? command.topic : undefined),
@@ -726,7 +756,7 @@ export const runProductionCli = async (
     );
   const registry =
     overrides.profiles ?? new NativeKeyringProfileRegistry(undefined, platform.credentialService);
-  const linkDirectory = join(workingDirectory, platform.linkDirectory);
+  const linkDirectory = join(selectedSourceDirectory, platform.linkDirectory);
   const projectId = commandProjectId(command);
   // A command that named its project read no link yet, but the link still says whose project it is.
   if (projectId !== undefined && linked === null)
@@ -843,6 +873,16 @@ export const runProductionCli = async (
     return written(result);
   }
   const selected = profile;
+  if (command.kind === "whoami" || command.kind === "login")
+    links = await readProjectLinks(linkDirectory, platform.apiOrigin);
+  const sourceOrganizationId =
+    selected?.organizationId ?? (command.kind === "login" ? command.organizationId : undefined);
+  const boundSource =
+    sourceOrganizationId === null || sourceOrganizationId === undefined
+      ? links.links.length === 1
+        ? links.links[0]
+        : undefined
+      : links.links.find((link) => link.organization_id === sourceOrganizationId);
   const productApiOrigin = platform.apiOrigin;
   const lifecycle = new GeneratedSdkSessionRevoker({
     environment,
@@ -850,6 +890,15 @@ export const runProductionCli = async (
     ...(selected === undefined ? {} : { request: { name: selected.name } }),
   });
   const cli = new ProductCli({
+    sourceDirectory: workingDirectory,
+    sourceMetadataDirectory: platform.linkDirectory,
+    sourceWorkspace: () => inspectSourceWorkspace(workingDirectory),
+    ...(boundSource === undefined
+      ? {}
+      : {
+          linkedSourceProvider: boundSource.version === 3 ? boundSource.source.provider : "github",
+          linkedProjectId: boundSource.project_id,
+        }),
     ...(apiToken === undefined ? {} : { apiToken }),
     commandPrefix: platform.commandPrefix,
     profiles: registry,
@@ -895,6 +944,19 @@ export const runProductionCli = async (
           signal,
         },
       ),
+    projectSourceStatus: (accessToken, projectId) =>
+      getProjectSource(
+        { project_id: projectId, include_binding: true },
+        {
+          client: createClient({
+            baseUrl: productApiOrigin,
+            auth: accessToken,
+            throwOnError: true,
+            fetch: boundedFetch(),
+          }),
+          signal,
+        },
+      ),
     projectLinkStore: new OwnerOnlyProjectLinkStore(linkDirectory, workingDirectory),
     productApiOrigin,
     tokenRefresher: refresher,
@@ -1351,7 +1413,15 @@ export const createBoundedFetch =
       if (isAbortOrTimeout(error)) throw error;
       throw new NetworkTransportError();
     }
-    return streaming ? response : bufferBoundedResponse(response, responseLimit);
+    const requestUrl = new URL(input instanceof Request ? input.url : String(input));
+    const sourceRead =
+      /^\/v1\/projects\/[0-7][0-9A-HJKMNP-TV-Z]{25}\/source\/(?:files|diff|versions)$/u.test(
+        requestUrl.pathname,
+      );
+    const limit = sourceRead
+      ? Math.max(responseLimit, Math.ceil((2 * 1024 * 1024) / 3) * 4 + 64 * 1024)
+      : responseLimit;
+    return streaming ? response : bufferBoundedResponse(response, limit);
   };
 
 const bufferBoundedResponse = async (response: Response, limit: number): Promise<Response> => {

package/src/apps/product-cli/src/index.ts

@@ -8,6 +8,10 @@ export * from "./profile-store.js";
 export * from "./project-link-store.js";
 export * from "./repository-init.js";
 export * from "./workspace.js";
+export * from "./source-workspace.js";
+export * from "./source-publisher.js";
+export * from "./source-managed-client.js";
+export * from "./source-publication-store.js";
 export type { PublicAccount } from "./runtime-contract.js";
 export {
   parseAccountProfile,
@@ -24,6 +28,8 @@ export {
   parseOperationEvent,
   parseSafeProblem,
   parseProjectDataChangePlan,
+  parseProjectSource,
+  parseProjectSourceBinding,
 } from "./runtime-contract.js";
 
 export * from "./user-token-file.js";

package/src/apps/product-cli/src/product-api.ts

@@ -143,6 +143,8 @@ import {
   parseOperation,
   type PublicAccount,
 } from "./runtime-contract.js";
+import { GeneratedSdkManagedSourceApi } from "./source-managed-client.js";
+import type { ManagedSourceApi } from "./source-publisher.js";
 
 export interface ProjectCreateInput {
   readonly organizationId: string;
@@ -154,6 +156,7 @@ export interface ProjectCreateInput {
 }
 
 export interface ProductApi {
+  readonly managedSource?: ManagedSourceApi;
   planProjectDataChange(input: {
     projectId: string;
     change: ProjectDataChangeKind;
@@ -436,6 +439,7 @@ export interface ProductApi {
 
 export class GeneratedSdkProductApi implements ProductApi {
   readonly #client: OhMyHostClient;
+  public readonly managedSource: ManagedSourceApi;
 
   public constructor(
     baseUrl: string,
@@ -443,6 +447,7 @@ export class GeneratedSdkProductApi implements ProductApi {
     fetch: typeof globalThis.fetch,
   ) {
     this.#client = createClient({ auth: accessToken, baseUrl, fetch, throwOnError: true });
+    this.managedSource = new GeneratedSdkManagedSourceApi(() => this.#client);
   }
 
   public async changeDatabaseCompute(input: {

package/src/apps/product-cli/src/project-link-store.ts

@@ -15,7 +15,7 @@ import { join } from "node:path";
  * Which project this working copy deploys to for one organization. The same checkout may be linked
  * once per organization, so a second account never overwrites or inherits the first one's link.
  */
-export interface ProjectLinkMetadata {
+export interface LegacyScopedProjectLink {
   readonly version: 2;
   readonly api_origin: string;
   readonly organization_id: string;
@@ -24,6 +24,33 @@ export interface ProjectLinkMetadata {
   readonly repository_full_name: string;
 }
 
+/** Provider binding follows the project; managed sources also cache this directory's confirmed base. */
+export interface CurrentProjectLink {
+  readonly version: 3;
+  readonly api_origin: string;
+  readonly organization_id: string;
+  readonly project_id: string;
+  readonly source:
+    | {
+        readonly provider: "managed";
+        readonly source_connection_id: string;
+        readonly source_generation: number;
+        readonly namespace: string;
+        readonly repository_name: string;
+        readonly branch: "main";
+        readonly last_confirmed_commit_sha: string | null;
+      }
+    | {
+        readonly provider: "github";
+        readonly source_connection_id: string;
+        readonly source_generation: number;
+        readonly installation_id: string;
+        readonly repository_full_name: string;
+      };
+}
+
+export type ProjectLinkMetadata = LegacyScopedProjectLink | CurrentProjectLink;
+
 /** A link written before links named their organization; it is verified before any use. */
 export interface LegacyProjectLink {
   readonly project_id: string;
@@ -60,6 +87,10 @@ export async function readProjectLinks(
     const organizationId = /^([0-7][0-9A-HJKMNP-TV-Z]{25})\.json$/u.exec(name)?.[1];
     if (organizationId === undefined) continue;
     const link = await readJson(join(directory, LINKS, name));
+    if (isCurrentLink(link, apiOrigin, organizationId)) {
+      links.push(link);
+      continue;
+    }
     if (
       isRecord(link, [
         "version",
@@ -100,6 +131,66 @@ export async function readProjectLinks(
   };
 }
 
+function isCurrentLink(
+  value: Record<string, unknown> | null,
+  apiOrigin: string,
+  organizationId: string,
+): value is unknown & CurrentProjectLink & Record<string, unknown> {
+  if (
+    !isRecord(value, ["version", "api_origin", "organization_id", "project_id", "source"]) ||
+    value["version"] !== 3 ||
+    value["api_origin"] !== apiOrigin ||
+    value["organization_id"] !== organizationId ||
+    typeof value["project_id"] !== "string" ||
+    !ULID.test(value["project_id"])
+  )
+    return false;
+  const candidate = value["source"];
+  if (typeof candidate !== "object" || candidate === null || !("provider" in candidate))
+    return false;
+  const source = candidate as Record<string, unknown>;
+  const keys =
+    source["provider"] === "managed"
+      ? [
+          "provider",
+          "source_connection_id",
+          "source_generation",
+          "namespace",
+          "repository_name",
+          "branch",
+          "last_confirmed_commit_sha",
+        ]
+      : [
+          "provider",
+          "source_connection_id",
+          "source_generation",
+          "installation_id",
+          "repository_full_name",
+        ];
+  if (
+    !isRecord(source, keys) ||
+    typeof source["source_connection_id"] !== "string" ||
+    !ULID.test(source["source_connection_id"]) ||
+    !Number.isSafeInteger(source["source_generation"]) ||
+    Number(source["source_generation"]) < 1
+  )
+    return false;
+  return source["provider"] === "managed"
+    ? source["branch"] === "main" &&
+        (source["last_confirmed_commit_sha"] === null ||
+          (typeof source["last_confirmed_commit_sha"] === "string" &&
+            /^[a-f0-9]{40}$/u.test(source["last_confirmed_commit_sha"]))) &&
+        typeof source["namespace"] === "string" &&
+        typeof source["repository_name"] === "string" &&
+        /^[a-z0-9][a-z0-9_-]{0,127}$/u.test(source["namespace"]) &&
+        /^[a-z0-9][a-z0-9_-]{0,127}$/u.test(source["repository_name"])
+    : source["provider"] === "github" &&
+        typeof source["installation_id"] === "string" &&
+        /^[1-9][0-9]{0,19}$/u.test(source["installation_id"]) &&
+        typeof source["repository_full_name"] === "string" &&
+        /^[^/]+\/[^/]+$/u.test(source["repository_full_name"]);
+}
+
 export type LinkedProject =
   | {
       readonly outcome: "linked";

package/src/apps/product-cli/src/runtime-contract.ts

@@ -1,4 +1,8 @@
 import { parseFeedbackSubmissionDetail } from "@ohmyhost/contracts/feedback";
+import {
+  assertGithubSourceResponse,
+  assertManagedSourceResponse,
+} from "@ohmyhost/contracts/managed-sources";
 import {
   parseProjectDataChangePlan as readProjectDataChangePlan,
   type ProjectDataChangePlan,
@@ -822,7 +826,20 @@ export const parseProjectStatus = (value: unknown): Readonly<Record<string, unkn
   return input;
 };
 
-const parseProjectSource = (value: unknown): void => {
+export const parseProjectSource = (value: unknown): void => {
+  if (
+    typeof value === "object" &&
+    value !== null &&
+    "provider" in value &&
+    value.provider === "managed"
+  ) {
+    try {
+      assertManagedSourceResponse("source", value);
+    } catch {
+      throw new ResponseContractError();
+    }
+    return;
+  }
   const input = exactRecord(value, [
     "provider",
     "installation_id",
@@ -850,6 +867,22 @@ const parseProjectSource = (value: unknown): void => {
   }
 };
 
+/** Binding-aware reads opt in explicitly; a legacy GitHub projection cannot supply a fence. */
+export const parseProjectSourceBinding = (value: unknown): void => {
+  try {
+    if (
+      typeof value === "object" &&
+      value !== null &&
+      "provider" in value &&
+      value.provider === "managed"
+    )
+      assertManagedSourceResponse("source", value);
+    else assertGithubSourceResponse("binding", value);
+  } catch {
+    throw new ResponseContractError();
+  }
+};
+
 const parseProjectDeployment = (value: unknown): void => {
   const input = exactRecord(value, [
     "id",