@amerged/ohmyhost-mcp 0.1.28 → 0.1.30

package/src/packages/contracts/package.json

@@ -5,6 +5,11 @@
   "type": "module",
   "sideEffects": false,
   "exports": {
+    "./mcp-source-codec": {
+      "source": "./src/mcp-source-codec.ts",
+      "types": "./dist/mcp-source-codec.d.ts",
+      "import": "./dist/mcp-source-codec.js"
+    },
     "./operation-failure": {
       "source": "./src/operation-failure.ts",
       "types": "./dist/operation-failure.d.ts",
@@ -121,6 +126,11 @@
       "source": "./src/project-data-changes.ts",
       "types": "./dist/project-data-changes.d.ts",
       "import": "./dist/project-data-changes.js"
+    },
+    "./managed-sources": {
+      "source": "./src/managed-sources.ts",
+      "types": "./dist/managed-sources.d.ts",
+      "import": "./dist/managed-sources.js"
     }
   },
   "scripts": {

package/src/packages/contracts/src/database-migration-admission.ts

@@ -1,23 +1,23 @@
+import { DatabaseMigrationAdmissionError } from "./database-migration-errors.js";
+import {
+  readMigrationSql,
+  rejectMigrationSqlReferences,
+  type MigrationSqlToken,
+} from "./database-migration-lexical.js";
+import {
+  readMigrationRlsTarget,
+  type DatabaseMigrationRlsTarget,
+} from "./database-migration-policies.js";
+
+export { DatabaseMigrationAdmissionError } from "./database-migration-errors.js";
+export type { DatabaseMigrationAdmissionReason } from "./database-migration-errors.js";
+export type { DatabaseMigrationRlsTarget } from "./database-migration-policies.js";
+
 const MAX_MIGRATION_COUNT = 128;
 const MAX_MIGRATION_BYTES = 256 * 1024;
 const MAX_MIGRATION_TOTAL_BYTES = 2 * 1024 * 1024;
 const MIGRATION_PATH = /^(?:[A-Za-z0-9][A-Za-z0-9._-]*\/)*\d{14}_[a-z0-9][a-z0-9_-]*\.sql$/u;
 
-export type DatabaseMigrationAdmissionReason =
-  | "destructive"
-  | "invalid"
-  | "provider_specific"
-  | "unsupported";
-
-export class DatabaseMigrationAdmissionError extends Error {
-  public readonly code = "database_migration_not_admitted";
-
-  public constructor(public readonly reason: DatabaseMigrationAdmissionReason) {
-    super("Database migration is not admitted");
-    this.name = "DatabaseMigrationAdmissionError";
-  }
-}
-
 export interface DatabaseMigrationInput {
   readonly path: string;
   readonly body: Uint8Array;
@@ -67,127 +67,76 @@ export function admitExpandOnlyMigrations(
     if (sql.length === 0 || sql.includes("\r") || sql.charCodeAt(0) === 0xfeff) {
       throw new DatabaseMigrationAdmissionError("invalid");
     }
-    if (/\bohmyhost\b/iu.test(sql)) throw new DatabaseMigrationAdmissionError("unsupported");
-    rejectProviderSpecificSql(sql);
-    const statements = splitSqlStatements(sql);
-    if (statements.length === 0) throw new DatabaseMigrationAdmissionError("invalid");
-    for (const statement of statements) admitStatement(statement);
+    const statements = parseDatabaseMigrationStatements(sql);
     statementCount += statements.length;
     return Object.freeze({ path: migration.path, statementCount: statements.length });
   });
   return Object.freeze({ files: Object.freeze(files), statementCount });
 }
 
-function rejectProviderSpecificSql(sql: string): void {
+export interface DatabaseMigrationStatement {
+  readonly sql: string;
+  readonly rlsTarget?: DatabaseMigrationRlsTarget;
+}
+
+export function parseDatabaseMigrationStatements(
+  sql: string,
+): readonly DatabaseMigrationStatement[] {
+  if (
+    sql.length === 0 ||
+    sql.includes("\0") ||
+    sql.includes("\r") ||
+    sql.charCodeAt(0) === 0xfeff
+  ) {
+    throw new DatabaseMigrationAdmissionError("invalid");
+  }
+  const statements = readMigrationSql(sql);
+  if (statements.length === 0) throw new DatabaseMigrationAdmissionError("invalid");
+  return Object.freeze(
+    statements.map((statement) => {
+      // Provider references are forbidden throughout executable policy SQL, while
+      // the native helper exception is narrowed by the policy reader below.
+      rejectMigrationSqlReferences(statement.tokens, true);
+      const rlsTarget = readMigrationRlsTarget(statement.tokens);
+      if (rlsTarget !== undefined) return Object.freeze({ sql: statement.sql, rlsTarget });
+      rejectMigrationSqlReferences(statement.tokens);
+      admitStatement(statement.tokens, statement.sql);
+      return Object.freeze({ sql: statement.sql });
+    }),
+  );
+}
+
+function rejectFunctionBodyReferences(sql: string): void {
+  if (
+    /\bohmyhost\b|\brow\s+level\s+security\b|\b(?:create|alter|drop)\s+policy\b|\bu&['"]/iu.test(
+      sql,
+    )
+  ) {
+    throw new DatabaseMigrationAdmissionError("unsupported");
+  }
   const normalized = sql.toLowerCase();
   const withoutPortableAuth = normalized.replace(
-    /\bauth\s*\.\s*"(?:account|ratelimit|session|user|verification)"/gu,
+    /(?:\bauth|"auth")\s*\.\s*"(?:account|ratelimit|session|user|verification)"/gu,
     "",
   );
   if (
-    /\bauth\s*\./u.test(withoutPortableAuth) ||
-    /\bstorage\s*\./u.test(normalized) ||
+    /(?:\bauth|"auth")\s*\./u.test(withoutPortableAuth) ||
+    /(?:\bstorage|"storage")\s*\./u.test(normalized) ||
     /\b(?:to|from)\s+(?:anon|authenticated|service_role)\b/u.test(normalized) ||
-    /\bcreate\s+policy\b/u.test(normalized) ||
-    /\brow\s+level\s+security\b/u.test(normalized) ||
     /\bsupabase\b/u.test(normalized)
   ) {
     throw new DatabaseMigrationAdmissionError("provider_specific");
   }
 }
 
-function splitSqlStatements(sql: string): readonly string[] {
-  const statements: string[] = [];
-  let start = 0;
-  let index = 0;
-  while (index < sql.length) {
-    const character = sql[index];
-    const next = sql[index + 1];
-    if (character === "-" && next === "-") {
-      index = skipLineComment(sql, index + 2);
-      continue;
-    }
-    if (character === "/" && next === "*") {
-      index = skipBlockComment(sql, index + 2);
-      continue;
-    }
-    if (character === "'") {
-      index = skipQuoted(sql, index + 1, "'");
-      continue;
-    }
-    if (character === '"') {
-      index = skipQuoted(sql, index + 1, '"');
-      continue;
-    }
-    if (character === "$") {
-      const delimiter = dollarDelimiter(sql, index);
-      if (delimiter !== null) {
-        const end = sql.indexOf(delimiter, index + delimiter.length);
-        if (end < 0) throw new DatabaseMigrationAdmissionError("invalid");
-        index = end + delimiter.length;
-        continue;
-      }
-    }
-    if (character === ";") {
-      const statement = sql.slice(start, index).trim();
-      if (statement.length > 0) statements.push(statement);
-      start = index + 1;
-    }
-    index += 1;
-  }
-  const tail = sql.slice(start).trim();
-  if (tail.length > 0) statements.push(tail);
-  return Object.freeze(statements);
-}
-
-function skipLineComment(sql: string, index: number): number {
-  const newline = sql.indexOf("\n", index);
-  return newline < 0 ? sql.length : newline + 1;
-}
-
-function skipBlockComment(sql: string, index: number): number {
-  let depth = 1;
-  while (index < sql.length) {
-    if (sql[index] === "/" && sql[index + 1] === "*") {
-      depth += 1;
-      index += 2;
-      continue;
-    }
-    if (sql[index] === "*" && sql[index + 1] === "/") {
-      depth -= 1;
-      index += 2;
-      if (depth === 0) return index;
-      continue;
-    }
-    index += 1;
-  }
-  throw new DatabaseMigrationAdmissionError("invalid");
-}
-
-function skipQuoted(sql: string, index: number, quote: "'" | '"'): number {
-  while (index < sql.length) {
-    if (sql[index] !== quote) {
-      index += 1;
-      continue;
-    }
-    if (sql[index + 1] === quote) {
-      index += 2;
-      continue;
-    }
-    return index + 1;
-  }
-  throw new DatabaseMigrationAdmissionError("invalid");
-}
-
-function dollarDelimiter(sql: string, index: number): string | null {
-  const match = /^\$(?:[A-Za-z_][A-Za-z0-9_]*)?\$/u.exec(sql.slice(index));
-  return match?.[0] ?? null;
-}
-
-function admitStatement(statement: string): void {
-  const normalized = normalizeStatement(statement);
+function admitStatement(tokens: readonly MigrationSqlToken[], sql: string): void {
+  const normalized = tokens
+    .map((token) => (token.kind === "string" ? "'literal'" : token.text.toLowerCase()))
+    .join(" ")
+    .replace(/\s*\.\s*/gu, ".");
   if (normalized === "set check_function_bodies = false") return;
   if (/^create\s+function\b/u.test(normalized)) {
+    rejectFunctionBodyReferences(sql);
     if (
       !/\blanguage\s+(?:sql|plpgsql)\b/u.test(normalized) ||
       (/\bsecurity\s+definer\b/u.test(normalized) &&
@@ -224,12 +173,3 @@ function admitStatement(statement: string): void {
   }
   throw new DatabaseMigrationAdmissionError("unsupported");
 }
-
-function normalizeStatement(statement: string): string {
-  return statement
-    .replace(/--[^\n]*(?:\n|$)/gu, " ")
-    .replace(/\/\*[\s\S]*?\*\//gu, " ")
-    .trim()
-    .replace(/\s+/gu, " ")
-    .toLowerCase();
-}

package/src/packages/contracts/src/database-migration-errors.ts

@@ -0,0 +1,14 @@
+export type DatabaseMigrationAdmissionReason =
+  | "destructive"
+  | "invalid"
+  | "provider_specific"
+  | "unsupported";
+
+export class DatabaseMigrationAdmissionError extends Error {
+  public readonly code = "database_migration_not_admitted";
+
+  public constructor(public readonly reason: DatabaseMigrationAdmissionReason) {
+    super("Database migration is not admitted");
+    this.name = "DatabaseMigrationAdmissionError";
+  }
+}

package/src/packages/contracts/src/database-migration-lexical.ts

@@ -0,0 +1,180 @@
+import { DatabaseMigrationAdmissionError } from "./database-migration-errors.js";
+
+export interface MigrationSqlToken {
+  readonly kind: "word" | "identifier" | "string" | "symbol";
+  readonly value: string;
+  readonly text: string;
+}
+
+export interface MigrationSqlStatement {
+  readonly sql: string;
+  readonly tokens: readonly MigrationSqlToken[];
+}
+
+/** SQL-aware boundaries only; PostgreSQL remains the expression parser. */
+export function readMigrationSql(sql: string): readonly MigrationSqlStatement[] {
+  const statements: MigrationSqlStatement[] = [];
+  let tokens: MigrationSqlToken[] = [];
+  let start = 0;
+  let index = 0;
+  while (index < sql.length) {
+    const character = sql[index] ?? "";
+    const next = sql[index + 1];
+    if (/\s/u.test(character)) {
+      index += 1;
+      continue;
+    }
+    if (character === "-" && next === "-") {
+      const newline = sql.indexOf("\n", index + 2);
+      index = newline < 0 ? sql.length : newline + 1;
+      continue;
+    }
+    if (character === "/" && next === "*") {
+      index = skipBlockComment(sql, index + 2);
+      continue;
+    }
+    if (character === ";") {
+      if (tokens.length > 0) {
+        statements.push(Object.freeze({ sql: sql.slice(start, index + 1).trim(), tokens }));
+      }
+      tokens = [];
+      start = ++index;
+      continue;
+    }
+    const tokenStart = index;
+    let kind: MigrationSqlToken["kind"] = "symbol";
+    let value = character;
+    if (/[uU]/u.test(character) && next === "&" && /['"]/u.test(sql[index + 2] ?? "")) {
+      // Unicode escapes can conceal reserved schema identifiers.
+      throw new DatabaseMigrationAdmissionError("unsupported");
+    }
+    if (character === "'" || character === '"' || (/[eE]/u.test(character) && next === "'")) {
+      const escaped = character !== "'" && character !== '"';
+      const quote = character === '"' ? '"' : "'";
+      const quoteStart = index + (escaped ? 1 : 0);
+      index = skipQuoted(sql, quoteStart + 1, quote, escaped);
+      kind = quote === '"' ? "identifier" : "string";
+      value = sql.slice(quoteStart + 1, index - 1).replace(/""/gu, '"');
+    } else if (character === "$" && /^\$(?:[A-Za-z_][A-Za-z0-9_]*)?\$/u.test(sql.slice(index))) {
+      const delimiter = /^\$(?:[A-Za-z_][A-Za-z0-9_]*)?\$/u.exec(sql.slice(index))?.[0] ?? "";
+      const end = sql.indexOf(delimiter, index + delimiter.length);
+      if (end < 0) throw new DatabaseMigrationAdmissionError("invalid");
+      index = end + delimiter.length;
+      kind = "string";
+      value = sql.slice(tokenStart, index);
+    } else if (/[\p{L}_]/u.test(character)) {
+      index += 1;
+      while (index < sql.length && /[\p{L}\p{N}_$]/u.test(sql[index] ?? "")) index += 1;
+      kind = "word";
+      value = sql.slice(tokenStart, index).toLowerCase();
+    } else {
+      index += 1;
+    }
+    tokens.push(Object.freeze({ kind, value, text: sql.slice(tokenStart, index) }));
+  }
+  if (tokens.length > 0) statements.push(Object.freeze({ sql: sql.slice(start).trim(), tokens }));
+  return Object.freeze(statements);
+}
+
+function skipBlockComment(sql: string, index: number): number {
+  let depth = 1;
+  while (index < sql.length) {
+    if (sql[index] === "/" && sql[index + 1] === "*") {
+      depth += 1;
+      index += 2;
+    } else if (sql[index] === "*" && sql[index + 1] === "/") {
+      depth -= 1;
+      index += 2;
+      if (depth === 0) return index;
+    } else {
+      index += 1;
+    }
+  }
+  throw new DatabaseMigrationAdmissionError("invalid");
+}
+
+function skipQuoted(sql: string, index: number, quote: string, escaped: boolean): number {
+  while (index < sql.length) {
+    if (escaped && sql[index] === "\\") {
+      index += 2;
+    } else if (sql[index] === quote) {
+      if (sql[index + 1] === quote) {
+        index += 2;
+      } else {
+        const continuation = quote === "'" ? continuedStringStart(sql, index + 1) : undefined;
+        if (continuation === undefined) return index + 1;
+        // Keep the initial E-string's escape semantics in every continuation.
+        index = continuation;
+      }
+    } else {
+      index += 1;
+    }
+  }
+  throw new DatabaseMigrationAdmissionError("invalid");
+}
+
+function continuedStringStart(sql: string, index: number): number | undefined {
+  // Match PostgreSQL scan.l quotecontinue with a linear scan: at least one
+  // newline, with line comments as whitespace. Block comments end continuation.
+  let newline = false;
+  while (index < sql.length) {
+    const character = sql[index] ?? "";
+    if (/[ \t\f\v\n\r]/u.test(character)) {
+      newline ||= character === "\n" || character === "\r";
+      index += 1;
+    } else if (character === "-" && sql[index + 1] === "-") {
+      index += 2;
+      while (index < sql.length && sql[index] !== "\n" && sql[index] !== "\r") index += 1;
+    } else {
+      return character === "'" && newline ? index + 1 : undefined;
+    }
+  }
+  return undefined;
+}
+
+export function isSqlKeyword(token: MigrationSqlToken | undefined, value: string): boolean {
+  return token?.kind === "word" && token.value === value;
+}
+
+export function rejectMigrationSqlReferences(
+  tokens: readonly MigrationSqlToken[],
+  allowIdentityHelpers = false,
+): void {
+  for (let index = 0; index < tokens.length; index += 1) {
+    const token = tokens[index];
+    if (token?.kind !== "word" && token?.kind !== "identifier") continue;
+    const value = token.value.toLowerCase();
+    if (value === "ohmyhost") {
+      if (
+        allowIdentityHelpers &&
+        token.value === "ohmyhost" &&
+        tokens[index + 1]?.kind === "symbol" &&
+        tokens[index + 1]?.value === "." &&
+        ["user_id", "claims"].includes(tokens[index + 2]?.value ?? "") &&
+        ["word", "identifier"].includes(tokens[index + 2]?.kind ?? "") &&
+        tokens[index + 3]?.kind === "symbol" &&
+        tokens[index + 3]?.value === "(" &&
+        tokens[index + 4]?.kind === "symbol" &&
+        tokens[index + 4]?.value === ")"
+      )
+        continue;
+      throw new DatabaseMigrationAdmissionError("unsupported");
+    }
+    const portableAuthTable = tokens[index + 2];
+    if (
+      (value === "auth" &&
+        tokens[index + 1]?.value === "." &&
+        !(
+          portableAuthTable?.kind === "identifier" &&
+          ["account", "rateLimit", "ratelimit", "session", "user", "verification"].includes(
+            portableAuthTable.value,
+          )
+        )) ||
+      (value === "storage" && tokens[index + 1]?.value === ".") ||
+      value === "supabase" ||
+      ((value === "to" || value === "from") &&
+        ["anon", "authenticated", "service_role"].includes(tokens[index + 1]?.value ?? ""))
+    )
+      throw new DatabaseMigrationAdmissionError("provider_specific");
+  }
+}

package/src/packages/contracts/src/database-migration-policies.ts

@@ -0,0 +1,150 @@
+import { DatabaseMigrationAdmissionError } from "./database-migration-errors.js";
+import {
+  isSqlKeyword,
+  rejectMigrationSqlReferences,
+  type MigrationSqlToken,
+} from "./database-migration-lexical.js";
+
+export interface DatabaseMigrationRlsTarget {
+  readonly schema: "public" | "private";
+  readonly table: string;
+  readonly policy?: string;
+  readonly action: "create" | "alter" | "drop" | "enable" | "force";
+}
+
+class PolicyReader {
+  public position = 0;
+
+  public constructor(private readonly tokens: readonly MigrationSqlToken[]) {}
+
+  public take(keyword: string): boolean {
+    if (!isSqlKeyword(this.tokens[this.position], keyword)) return false;
+    this.position += 1;
+    return true;
+  }
+
+  public expect(keyword: string): void {
+    if (!this.take(keyword)) throw new DatabaseMigrationAdmissionError("unsupported");
+  }
+
+  public identifier(): string {
+    const token = this.tokens[this.position++];
+    if (
+      (token?.kind !== "word" && token?.kind !== "identifier") ||
+      token.value.length === 0 ||
+      new TextEncoder().encode(token.value).byteLength > 63
+    ) {
+      throw new DatabaseMigrationAdmissionError("unsupported");
+    }
+    return token.value;
+  }
+
+  public target(): Readonly<{ schema: "public" | "private"; table: string }> {
+    const schema = this.identifier();
+    const separator = this.tokens[this.position++];
+    if (
+      (schema !== "public" && schema !== "private") ||
+      separator?.kind !== "symbol" ||
+      separator.value !== "."
+    ) {
+      throw new DatabaseMigrationAdmissionError("unsupported");
+    }
+    return { schema, table: this.identifier() };
+  }
+
+  public expression(): void {
+    const opening = this.tokens[this.position++];
+    if (opening?.kind !== "symbol" || opening.value !== "(")
+      throw new DatabaseMigrationAdmissionError("invalid");
+    const start = this.position;
+    let depth = 1;
+    while (this.position < this.tokens.length) {
+      const token = this.tokens[this.position++];
+      if (token?.kind !== "symbol") continue;
+      if (token.value === "(") depth += 1;
+      if (token.value === ")") depth -= 1;
+      if (depth === 0) {
+        if (this.position - 1 === start) throw new DatabaseMigrationAdmissionError("invalid");
+        rejectMigrationSqlReferences(this.tokens.slice(start, this.position - 1), true);
+        return;
+      }
+    }
+    throw new DatabaseMigrationAdmissionError("invalid");
+  }
+
+  public end(): void {
+    if (this.position !== this.tokens.length)
+      throw new DatabaseMigrationAdmissionError("unsupported");
+  }
+}
+
+export function readMigrationRlsTarget(
+  tokens: readonly MigrationSqlToken[],
+): DatabaseMigrationRlsTarget | undefined {
+  const first = tokens[0]?.value;
+  const policy =
+    tokens[0]?.kind === "word" &&
+    isSqlKeyword(tokens[1], "policy") &&
+    ["create", "alter", "drop"].includes(first ?? "");
+  const rls =
+    isSqlKeyword(tokens[0], "alter") &&
+    isSqlKeyword(tokens[1], "table") &&
+    tokens.some(
+      (token, index) =>
+        isSqlKeyword(token, "row") &&
+        isSqlKeyword(tokens[index + 1], "level") &&
+        isSqlKeyword(tokens[index + 2], "security"),
+    );
+  if (!policy && !rls) return undefined;
+  // Header and table identifiers must never use the reserved namespace. Helpers
+  // are admitted separately, only inside balanced policy expressions.
+  const reader = new PolicyReader(tokens);
+  reader.position = 2;
+  if (rls) {
+    rejectMigrationSqlReferences(tokens);
+    const target = reader.target();
+    const action = reader.take("enable") ? "enable" : reader.take("force") ? "force" : undefined;
+    if (action === undefined) throw new DatabaseMigrationAdmissionError("destructive");
+    reader.expect("row");
+    reader.expect("level");
+    reader.expect("security");
+    reader.end();
+    return Object.freeze({ ...target, action });
+  }
+  if (first === "drop" && reader.take("if")) reader.expect("exists");
+  const policyName = reader.identifier();
+  reader.expect("on");
+  const target = reader.target();
+  rejectMigrationSqlReferences(tokens.slice(0, reader.position));
+  if (first === "drop") {
+    reader.take("restrict");
+    reader.end();
+    return Object.freeze({ ...target, policy: policyName, action: "drop" });
+  }
+  if (first === "create" && reader.take("as")) {
+    if (!reader.take("permissive")) reader.expect("restrictive");
+  }
+  if (first === "create" && reader.take("for")) {
+    if (!["all", "select", "insert", "update", "delete"].some((command) => reader.take(command))) {
+      throw new DatabaseMigrationAdmissionError("unsupported");
+    }
+  }
+  if (reader.take("to")) reader.expect("public");
+  let expression = false;
+  if (reader.take("using")) {
+    reader.expression();
+    expression = true;
+  }
+  if (reader.take("with")) {
+    reader.expect("check");
+    reader.expression();
+    expression = true;
+  }
+  reader.end();
+  if (first === "alter" && !expression) throw new DatabaseMigrationAdmissionError("unsupported");
+  return Object.freeze({
+    ...target,
+    policy: policyName,
+    action: first === "create" ? "create" : "alter",
+  });
+}

package/src/packages/contracts/src/framework-admission.ts

@@ -129,7 +129,7 @@ export interface FrameworkVersionAdmission {
 const VERIFIED_VERSIONS: Readonly<Record<AdmittedFramework, ReadonlySet<string>>> = Object.freeze({
   vite: new Set(["5.4.21", "8.0.16", "8.2.2"]),
   "tanstack-start": new Set(["1.168.26", "1.168.49"]),
-  nextjs: new Set(["15.5.26", "16.3.7"]),
+  nextjs: new Set(["15.5.26", "16.3.8"]),
 });
 
 export function classifyFrameworkVersion(

package/src/packages/contracts/src/framework-build-script.mjs

@@ -14,8 +14,7 @@ export function isAdmittedNextVersion(version) {
   const patch = Number(match[3]);
   if (![major, minor, patch].every(Number.isSafeInteger)) return false;
   return (
-    (major === 15 && minor === 5 && patch >= 26) ||
-    (major === 16 && minor === 3 && patch >= 6 && patch <= 7)
+    (major === 15 && minor === 5 && patch >= 26) || (major === 16 && minor === 3 && patch === 8)
   );
 }