@amerged/ohmyhost-mcp 0.1.31 → 0.1.33

package/dist/stdio-main.js

@@ -30,7 +30,7 @@ import {
   serverIdentityOf,
   setNegotiatedProtocolVersion,
   validateEnvelopeMeta
-} from "./chunk-QHKLOHN4.js";
+} from "./chunk-YM2ZQAGS.js";
 
 // node_modules/.pnpm/ignore@7.0.12/node_modules/ignore/index.js
 var require_ignore = __commonJS({
@@ -162,16 +162,16 @@ var require_ignore = __commonJS({
       }
     };
     var NEVER_MATCH = "[]";
-    var PLACEHOLDER = "\0";
+    var PLACEHOLDER2 = "\0";
     var REGEX_RESTORE_PLACEHOLDER = new RegExp(
-      `${PLACEHOLDER}(\\d+)${PLACEHOLDER}`,
+      `${PLACEHOLDER2}(\\d+)${PLACEHOLDER2}`,
       "g"
     );
     var TRAILING_WILDCARD = "\uE000";
     var TRAILING_DOUBLESTAR = "\uE001";
     var extractBrackets = (pattern) => {
       const sources = [];
-      const hold = (source) => `${PLACEHOLDER}${sources.push(source) - 1}${PLACEHOLDER}`;
+      const hold = (source) => `${PLACEHOLDER2}${sources.push(source) - 1}${PLACEHOLDER2}`;
       const { length } = pattern;
       let out = EMPTY;
       let index = 0;
@@ -189,8 +189,8 @@ var require_ignore = __commonJS({
             );
           }
           index += 2;
-        } else if (char === PLACEHOLDER) {
-          out += hold(`[${PLACEHOLDER}]`);
+        } else if (char === PLACEHOLDER2) {
+          out += hold(`[${PLACEHOLDER2}]`);
           index++;
         } else if (char === "[") {
           const scanned = scanBracket(pattern, index);
@@ -20232,6 +20232,398 @@ function toError(value) {
   return value instanceof Error ? value : new Error(String(value));
 }
 
+// packages/contracts/dist/framework-build-script.mjs
+var PINNED_BUN_VERSION = "1.2.22";
+var FRAMEWORK_VERSION_POLICY = Object.freeze({
+  next: Object.freeze({ floors: Object.freeze(["15.5.27", "16.3.8"]), denied: Object.freeze([]) }),
+  vite: Object.freeze({ floors: Object.freeze(["5.4.6"]), denied: Object.freeze([]) }),
+  "@tanstack/react-start": Object.freeze({
+    floors: Object.freeze(["1.168.60"]),
+    denied: Object.freeze([])
+  })
+});
+
+// packages/contracts/dist/customer-auth-admission.js
+function managedCustomerAuthDatabaseMessage(path2) {
+  return `"${path2}" selects the managed Better Auth bridge, which requires the managed PostgreSQL database. Set database.enabled: true with an admitted migrations path, or set auth.provider: none and keep the application-owned authentication configuration. Commit and push the change, then plan the new commit.`;
+}
+
+// packages/contracts/dist/framework-admission.js
+var ADMISSION_DIAGNOSTIC_CODES = Object.freeze({
+  ambiguous_config: "framework_config_ambiguous",
+  ambiguous_lockfile: "lockfile_ambiguous",
+  invalid_package_manager: "package_manager_invalid",
+  missing_lockfile: "lockfile_missing",
+  missing_package_manager: "package_manager_missing",
+  package_manager_lockfile_mismatch: "package_manager_lockfile_mismatch",
+  package_manager_version_unsupported: "package_manager_version_unsupported"
+});
+var PACKAGE_MANAGER_CONTRACTS = Object.freeze({
+  bun: Object.freeze({
+    lockfiles: Object.freeze(["bun.lock", "bun.lockb"]),
+    installCommand: "bun install --frozen-lockfile --ignore-scripts",
+    buildCommand: "bun run build"
+  }),
+  npm: Object.freeze({
+    lockfiles: Object.freeze(["package-lock.json"]),
+    installCommand: "npm ci --ignore-scripts",
+    buildCommand: "npm run build"
+  }),
+  pnpm: Object.freeze({
+    lockfiles: Object.freeze(["pnpm-lock.yaml"]),
+    installCommand: "pnpm install --frozen-lockfile --ignore-scripts",
+    buildCommand: "pnpm run build"
+  }),
+  yarn: Object.freeze({
+    lockfiles: Object.freeze(["yarn.lock"]),
+    installCommand: "yarn install --immutable --mode=skip-build",
+    buildCommand: "yarn run build"
+  })
+});
+var ALL_LOCKFILES = Object.freeze(Object.values(PACKAGE_MANAGER_CONTRACTS).flatMap(({ lockfiles }) => lockfiles));
+var PACKAGE_MANIFEST = "package.json";
+var STABLE_VERSION_SOURCE = "(?:0|[1-9][0-9]{0,5})\\.(?:0|[1-9][0-9]{0,5})\\.(?:0|[1-9][0-9]{0,5})";
+var VERSION_RANGE = new RegExp(`^([~^])(${STABLE_VERSION_SOURCE})$`, "u");
+var RESOLVED_VERSION_SOURCE = `${STABLE_VERSION_SOURCE}(?:-[0-9A-Za-z.-]{1,32})?`;
+var RESOLVED_VERSION_FIELD = anchoredPattern(RESOLVED_VERSION_SOURCE);
+var DECLARED_VERSION_FIELD = anchoredPattern(`[~^]?${RESOLVED_VERSION_SOURCE}`);
+var STABLE_VERSION_FIELD = anchoredPattern(STABLE_VERSION_SOURCE);
+var FRAMEWORK_VERSION_PACKAGES = Object.freeze([
+  "next",
+  "vite",
+  "@tanstack/react-start"
+]);
+var FRAMEWORK_DEPENDENCY_PACKAGES = Object.freeze([
+  "next",
+  "react",
+  "react-dom",
+  "vite",
+  "@tanstack/react-start",
+  "@tanstack/react-router",
+  "@vitejs/plugin-react",
+  "@cloudflare/vite-plugin"
+]);
+var REACT_PACKAGES = Object.freeze(["react", "react-dom"]);
+var BUILD_FRAMEWORKS = Object.freeze(["nextjs", "vite-static", "tanstack-start"]);
+var PUSH_AND_PLAN = "Commit and push the change, then plan the new commit.";
+var VITE_BUILD_SCRIPT = '"vite build", optionally joined with && to one "tsc", "tsc -b", "tsc --build" or "tsc --noEmit" stage';
+var FRAMEWORK_CONVERSION_DETAILS = Object.freeze({
+  managed_auth_database_required: {
+    paths: ["repository_config"],
+    template: managedCustomerAuthDatabaseMessage("{{path}}")
+  },
+  database_binding_private: {
+    paths: ["module"],
+    template: `"{{path}}" reads a database connection string (DATABASE_URL, HYPERDRIVE, connectionString or a postgres:// URL); none reaches a customer Worker. Call the database with createPrivateDatabaseClient from "@ohmyhost/customer-runtime/database". ${PUSH_AND_PLAN}`
+  },
+  database_driver_unsupported: {
+    paths: ["module"],
+    template: `"{{path}}" imports a database socket driver (pg, postgres, pg-native or mysql2); customer Workers cannot open sockets. Call the database with createPrivateDatabaseClient from "@ohmyhost/customer-runtime/database". ${PUSH_AND_PLAN}`
+  },
+  source_syntax_invalid: {
+    paths: ["module"],
+    template: 'Invalid JavaScript or TypeScript in "{{path}}". Fix the file, commit and push the change, then plan the new commit.'
+  },
+  worker_module_default_export_required: {
+    paths: ["module"],
+    template: `Worker module "{{path}}" has no default export. Export default { fetch, scheduled } with the handlers ohmyho.st invokes; named exports are never called. ${PUSH_AND_PLAN}`
+  },
+  scheduled_handler_required: {
+    paths: ["module"],
+    template: 'functions.crons is declared but "{{path}}" exports no scheduled handler. Add scheduled(controller, env, ctx) to its default export, commit and push the change, then plan the new commit.'
+  },
+  framework_base_path_unsupported: {
+    paths: ["framework_config"],
+    template: `"{{path}}" sets a Vite base. ohmyho.st serves the app at the root origin: remove base or set base: "/". ${PUSH_AND_PLAN}`
+  },
+  tanstack_prerender_required: {
+    paths: ["framework_config"],
+    template: `"{{path}}" does not call tanstackStart({ prerender: { enabled: true } }), which the static TanStack Start runtime needs; enable prerender, or set runtime.mode: edge with the Cloudflare Vite plugin. ${PUSH_AND_PLAN}`
+  },
+  tanstack_vite_plugins_required: {
+    paths: ["framework_config"],
+    template: `"{{path}}" does not follow the TanStack Start plugin contract: import tanstackStart from "@tanstack/react-start/plugin/vite"; on runtime edge also import cloudflare from "@cloudflare/vite-plugin" and call cloudflare({ viteEnvironment: { name: "ssr" } }) before tanstackStart(); on runtime static do not import the Cloudflare plugin. ${PUSH_AND_PLAN}`
+  },
+  next_tailwind_turbopack_only: {
+    paths: ["framework_config"],
+    template: `"{{path}}" loads Tailwind CSS through the Turbopack rule "@tailwindcss/turbopack", which the Webpack build on ohmyho.st ignores, and the application root has no PostCSS configuration that Webpack reads, so the site would deploy without its Tailwind classes. Add postcss.config.mjs to the application root with export default { plugins: { "@tailwindcss/postcss": {} } } and remove the Turbopack rule. Use the package manager to add @tailwindcss/postcss to devDependencies at the same version as tailwindcss and to remove @tailwindcss/turbopack, so the lockfile records both. ${PUSH_AND_PLAN}`
+  },
+  framework_version_unsupported: {
+    paths: ["manifest", "lockfile"],
+    fields: {
+      package: FRAMEWORK_VERSION_PACKAGES,
+      version: DECLARED_VERSION_FIELD,
+      minimum: STABLE_VERSION_FIELD
+    },
+    derived: { verb: { from: "path", text: { manifest: "declares", lockfile: "resolves" } } },
+    template: '"{{path}}" {{verb}} {{package}} {{version}}, which ohmyho.st does not admit; use {{package}} {{minimum}} or a later stable release, update package.json and the lockfile, commit and push the change, then plan the new commit.'
+  },
+  framework_version_declaration_unsupported: {
+    paths: ["manifest"],
+    fields: { package: FRAMEWORK_VERSION_PACKAGES },
+    template: '"{{path}}" declares {{package}} in a form ohmyho.st cannot check against its security minimum; declare an exact X.Y.Z version or a ^X.Y.Z or ~X.Y.Z range, update the lockfile, commit and push the change, then plan the new commit.'
+  },
+  framework_dependency_required: {
+    paths: ["manifest"],
+    fields: { package: FRAMEWORK_DEPENDENCY_PACKAGES },
+    template: '"{{path}}" does not declare {{package}} in dependencies, which this framework and runtime need. Add it with the package manager so the lockfile records it, commit and push the change, then plan the new commit.'
+  },
+  react_version_exact_required: {
+    paths: ["manifest"],
+    fields: { package: REACT_PACKAGES },
+    template: '"{{path}}" must declare {{package}} in dependencies at an exact version such as 19.1.0, without ^ or ~, for Next.js. Pin the version the lockfile installs, commit and push the change, then plan the new commit.'
+  },
+  build_script_unsupported: {
+    paths: ["manifest"],
+    fields: { framework: BUILD_FRAMEWORKS },
+    derived: {
+      script: {
+        from: "framework",
+        text: {
+          nextjs: 'exactly "next build" or "next build --webpack"; ohmyho.st adds the OpenNext build itself',
+          "vite-static": VITE_BUILD_SCRIPT,
+          "tanstack-start": VITE_BUILD_SCRIPT
+        }
+      }
+    },
+    template: '"{{path}}" scripts.build is missing or not admitted for the {{framework}} adapter: it must be {{script}}. Move other steps into their own scripts, commit and push the change, then plan the new commit.'
+  },
+  better_auth_version_required: {
+    paths: ["manifest"],
+    template: '"{{path}}" must declare better-auth at exactly 1.7.1 in dependencies because ohmyhost.yaml sets auth.provider: better-auth. Pin that version or set auth.provider: none, commit and push the change, then plan the new commit.'
+  },
+  package_manifest_invalid: {
+    paths: ["manifest"],
+    template: '"{{path}}" is missing or is not one JSON object. Add package.json in the applicationRoot that ohmyhost.yaml names, or fix its syntax so the whole file parses as one object; commit and push the change, then plan the new commit.'
+  },
+  framework_unsupported: {
+    paths: ["manifest"],
+    template: `"{{path}}" declares none of next, vite or @tanstack/react-start. Add the app's framework to dependencies, or set runtime.mode: functions in ohmyhost.yaml and add src/ohmyhost/worker.ts. ${PUSH_AND_PLAN}`
+  },
+  framework_ambiguous: {
+    paths: ["manifest"],
+    template: '"{{path}}" declares next together with vite or @tanstack/react-start, so ohmyho.st cannot choose one framework. Remove the packages of the framework this application does not use, commit and push the change, then plan the new commit.'
+  },
+  lockfile_missing: {
+    paths: ["manifest"],
+    template: '"{{path}}" has no lockfile beside it. Install with the packageManager it names so package-lock.json, pnpm-lock.yaml, yarn.lock or bun.lock is written, commit and push the change, then plan the new commit.'
+  },
+  lockfile_ambiguous: {
+    paths: ["manifest"],
+    template: '"{{path}}" has more than one lockfile beside it. Keep only the lockfile of the packageManager it names and delete the others, commit and push the change, then plan the new commit.'
+  },
+  package_manager_missing: {
+    paths: ["manifest"],
+    template: '"{{path}}" has no packageManager field. Set it to name@X.Y.Z for the npm, pnpm, yarn or bun version that wrote the lockfile, commit and push the change, then plan the new commit.'
+  },
+  package_manager_invalid: {
+    paths: ["manifest"],
+    template: '"{{path}}" sets packageManager to a value ohmyho.st cannot use. Write npm, pnpm, yarn or bun, then @ and an exact X.Y.Z version without a +sha suffix, matching the lockfile; commit and push the change, then plan the new commit.'
+  },
+  package_manager_lockfile_mismatch: {
+    paths: ["lockfile"],
+    template: '"{{path}}" was not written by the packageManager that package.json names. Set packageManager to the manager of this lockfile, or replace the lockfile with one from the named manager; commit and push the change, then plan the new commit.'
+  },
+  package_manager_version_unsupported: {
+    paths: ["manifest"],
+    template: `"{{path}}" pins a Bun version other than ${PINNED_BUN_VERSION}, the only Bun ohmyho.st builds with. Set packageManager to bun@${PINNED_BUN_VERSION}, reinstall to update the lockfile, commit and push the change, then plan the new commit.`
+  },
+  repository_configuration_invalid: {
+    paths: ["repository_config"],
+    template: '"{{path}}" does not match the ohmyho.st configuration schema. Run ohmyhost init --dry-run --json locally to see the exact field and fix, commit and push the change, then plan the new commit.'
+  },
+  runtime_mode_unsupported: {
+    paths: ["repository_config"],
+    fields: { framework: BUILD_FRAMEWORKS },
+    derived: {
+      mode: {
+        from: "framework",
+        text: {
+          nextjs: "runtime.mode: edge",
+          "vite-static": "runtime.mode: edge with src/ohmyhost/companion.ts when database, auth, mail, storage or functions.crons is set, and static otherwise",
+          "tanstack-start": "runtime.mode: edge, or static without functions.crons and storage"
+        }
+      }
+    },
+    template: `"{{path}}" sets a runtime.mode that the {{framework}} adapter cannot run with this configuration; use {{mode}}. ${PUSH_AND_PLAN}`
+  },
+  build_output_unsupported: {
+    paths: ["repository_config"],
+    fields: { framework: BUILD_FRAMEWORKS },
+    derived: {
+      output: {
+        from: "framework",
+        text: {
+          nextjs: ".open-next/assets",
+          "vite-static": "dist",
+          "tanstack-start": "dist/client"
+        }
+      }
+    },
+    template: `"{{path}}" sets a build.output that the {{framework}} adapter does not produce; set build.output: {{output}}. ${PUSH_AND_PLAN}`
+  },
+  build_command_mismatch: {
+    paths: ["repository_config"],
+    template: '"{{path}}" build.install or build.command differs from the commands of the packageManager in package.json (for npm: npm ci --ignore-scripts and npm run build). ohmyhost init --dry-run --json prints the exact values; set them, commit and push the change, then plan the new commit.'
+  },
+  build_option_unsupported: {
+    paths: ["repository_config"],
+    template: '"{{path}}" sets a build option this runtime ignores: build.ssg_cache_max_mib applies only to Next.js, and runtime.mode: functions takes only build.install. Remove the option, commit and push the change, then plan the new commit.'
+  },
+  application_root_missing: {
+    paths: ["repository_config"],
+    template: `"{{path}}" sets applicationRoot to a directory that is missing or empty in this commit. Set it to the directory that holds the app's package.json, or "." for the repository root; commit and push the change, then plan the new commit.`
+  },
+  framework_config_required: {
+    paths: ["framework_config"],
+    template: 'This application has no "{{path}}". Add one framework config with that name and a .js, .mjs or .ts extension that exports its config as default, commit and push the change, then plan the new commit.'
+  },
+  framework_config_ambiguous: {
+    paths: ["framework_config"],
+    template: '"{{path}}" exists beside another variant with the same name and a .js, .mjs or .ts extension. Keep exactly one and delete the others, commit and push the change, then plan the new commit.'
+  },
+  framework_config_too_large: {
+    paths: ["framework_config"],
+    template: '"{{path}}" is larger than the 256 KiB ohmyho.st inspects. Keep the config small and move large data into imported modules, commit and push the change, then plan the new commit.'
+  },
+  framework_config_default_export_required: {
+    paths: ["framework_config"],
+    template: '"{{path}}" does not export its config as default. Use export default (next.config.js may assign module.exports instead), commit and push the change, then plan the new commit.'
+  },
+  next_output_unsupported: {
+    paths: ["framework_config"],
+    template: '"{{path}}" sets output: "export" or output: "standalone", which the Next.js edge runtime on ohmyho.st cannot serve. Remove the output setting, commit and push the change, then plan the new commit.'
+  },
+  next_base_path_unsupported: {
+    paths: ["framework_config"],
+    template: `"{{path}}" sets basePath or assetPrefix. ohmyho.st serves the app at the root origin: remove both or set them to "". ${PUSH_AND_PLAN}`
+  },
+  companion_entry_required: {
+    paths: ["module"],
+    template: '"{{path}}" is missing. A Vite app with runtime.mode: edge or with database, auth, mail, storage or functions.crons needs this Worker module with export default { fetch }. Add it, or use runtime.mode: static without those settings; commit and push the change, then plan the new commit.'
+  },
+  worker_module_required: {
+    paths: ["module"],
+    template: '"{{path}}" is missing. runtime.mode: functions and functions.crons on Next.js or TanStack Start need this Worker module; export default { fetch, scheduled } with the handlers ohmyho.st invokes. Add it, commit and push the change, then plan the new commit.'
+  },
+  worker_module_fetch_handler_required: {
+    paths: ["module"],
+    template: `Worker module "{{path}}" exports no fetch handler; runtime.mode: functions serves every request and the health check through it. Add a fetch handler that receives request, env and ctx to its default export. ${PUSH_AND_PLAN}`
+  }
+});
+var DETAIL_DEFINITIONS = FRAMEWORK_CONVERSION_DETAILS;
+var PLACEHOLDER = /\{\{([a-z]+)\}\}/gu;
+var PATH_PATTERN = "[A-Za-z0-9_@()[\\]./${}-]{1,240}";
+var SAFE_PATH = new RegExp(`^${PATH_PATTERN}$`, "u");
+var MODULE_PATH = /^[A-Za-z0-9_@()[\]./${}-]+\.(?:[cm]?[jt]sx?)$/u;
+var FRAMEWORK_CONFIG_NAME = /^(?:next|open-next|vite)\.config\.(?:js|mjs|ts)$/u;
+var MAXIMUM_DETAIL_LENGTH = 2e3;
+var DETAIL_PATTERNS = Object.freeze(Object.entries(DETAIL_DEFINITIONS).map(([code, definition]) => Object.freeze({
+  code,
+  pattern: detailPattern(definition)
+})));
+function anchoredPattern(source) {
+  return new RegExp(`^(?:${source})$`, "u");
+}
+function escapePattern(text) {
+  return text.replace(/[\\^$.*+?()[\]{}|]/gu, "\\$&");
+}
+function detailPattern(definition) {
+  const placed = /* @__PURE__ */ new Set();
+  let pattern = "^";
+  let offset = 0;
+  for (const match of definition.template.matchAll(PLACEHOLDER)) {
+    const name = match[1];
+    pattern += escapePattern(definition.template.slice(offset, match.index));
+    pattern += placed.has(name) ? `\\k<${name}>` : `(?<${name}>${placeholderPattern(definition, name)})`;
+    placed.add(name);
+    offset = match.index + match[0].length;
+  }
+  return new RegExp(`${pattern}${escapePattern(definition.template.slice(offset))}$`, "u");
+}
+function placeholderPattern(definition, name) {
+  if (name === "path")
+    return PATH_PATTERN;
+  const grammar = definition.fields?.[name];
+  if (grammar instanceof RegExp)
+    return grammar.source.slice(1, -1);
+  const values = grammar ?? Object.values(definition.derived?.[name]?.text ?? {});
+  if (values.length === 0)
+    throw new TypeError("Framework conversion detail template is invalid");
+  return `(?:${[...new Set(values)].map(escapePattern).join("|")})`;
+}
+function pathClassOf(definition, path2) {
+  if (path2 === "ohmyhost.yaml" && definition.paths.includes("repository_config"))
+    return "repository_config";
+  if (!SAFE_PATH.test(path2) || path2.split("/").some((segment) => segment === "" || segment === "." || segment === ".."))
+    return null;
+  const leaf = path2.slice(path2.lastIndexOf("/") + 1);
+  return definition.paths.find((pathClass) => pathClass === "module" && MODULE_PATH.test(path2) || pathClass === "manifest" && leaf === PACKAGE_MANIFEST || pathClass === "lockfile" && ALL_LOCKFILES.includes(leaf) || pathClass === "framework_config" && FRAMEWORK_CONFIG_NAME.test(leaf)) ?? null;
+}
+function fieldMatches(grammar, value) {
+  if (typeof value !== "string")
+    return false;
+  return grammar instanceof RegExp ? grammar.test(value) : grammar.includes(value);
+}
+function isFrameworkConversionDiagnosticCode(value) {
+  return typeof value === "string" && Object.hasOwn(DETAIL_DEFINITIONS, value);
+}
+function parseFrameworkConversionDiagnostic(value) {
+  if (typeof value !== "object" || value === null || Array.isArray(value))
+    return null;
+  const record7 = value;
+  const code = Object.hasOwn(record7, "code") ? record7["code"] : void 0;
+  const path2 = Object.hasOwn(record7, "path") ? record7["path"] : void 0;
+  if (!isFrameworkConversionDiagnosticCode(code) || typeof path2 !== "string")
+    return null;
+  const definition = DETAIL_DEFINITIONS[code];
+  const fields = Object.entries(definition.fields ?? {}).map(([name, grammar]) => [name, grammar, Object.hasOwn(record7, name) ? record7[name] : void 0]);
+  if (Object.keys(record7).length !== fields.length + 2 || pathClassOf(definition, path2) === null || fields.some(([, grammar, field]) => !fieldMatches(grammar, field)))
+    return null;
+  return Object.freeze(Object.fromEntries([
+    ["code", code],
+    ["path", path2],
+    ...fields.map(([name, , field]) => [name, field])
+  ]));
+}
+function renderDetail(diagnostic) {
+  const definition = DETAIL_DEFINITIONS[diagnostic.code];
+  const values = diagnostic;
+  const pathClass = pathClassOf(definition, diagnostic.path);
+  return definition.template.replace(PLACEHOLDER, (_placeholder, name) => {
+    const derived = definition.derived?.[name];
+    const value = derived === void 0 ? values[name] : derived.text[String(derived.from === "path" ? pathClass : values[derived.from])];
+    if (typeof value !== "string")
+      throw new TypeError("Framework conversion diagnostic is invalid");
+    return value;
+  });
+}
+function frameworkConversionDetail(value) {
+  const diagnostic = parseFrameworkConversionDiagnostic(value);
+  return diagnostic === null ? null : renderDetail(diagnostic);
+}
+function frameworkConversionDiagnosticFromDetail(value) {
+  if (typeof value !== "string" || value.length > MAXIMUM_DETAIL_LENGTH)
+    return null;
+  for (const { code, pattern } of DETAIL_PATTERNS) {
+    const groups = pattern.exec(value)?.groups;
+    if (groups === void 0)
+      continue;
+    const diagnostic = parseFrameworkConversionDiagnostic({
+      code,
+      path: groups["path"],
+      ...Object.fromEntries(Object.keys(DETAIL_DEFINITIONS[code].fields ?? {}).map((name) => [name, groups[name]]))
+    });
+    if (diagnostic !== null && renderDetail(diagnostic) === value)
+      return diagnostic;
+  }
+  return null;
+}
+function parseFrameworkConversionDetail(value) {
+  const diagnostic = frameworkConversionDiagnosticFromDetail(value);
+  return diagnostic === null ? null : renderDetail(diagnostic);
+}
+
 // packages/contracts/dist/operation-failure.js
 var failures = {
   authorization_changed: [
@@ -20348,7 +20740,7 @@ var failures = {
   ],
   auto_deploy_plan_rejected: [
     "The GitHub push could not be planned for deployment.",
-    "Read project status and the operation's error or deployment diagnostics. Correct the source or configuration named there, push the new commit and plan it before deploying. Replaying this failed operation cannot start a build."
+    "Read error.detail: it names the file, the rule and the required change. Make that change, commit and push it; the next push is planned again. Without error.detail, plan the pushed commit explicitly with 'ohmyhost plan --project ULID --commit SHA --json' or MCP deployment_plan to read the reason. Replaying this failed operation cannot start a build."
   ],
   promotion_source_stale: [
     "The Dev deployment changed before promotion could start.",
@@ -20369,11 +20761,18 @@ function publicOperationReconciliation(observation) {
     suggested_action: observation.state === "required" ? "Confirm reconciliation of this same operation; preserve its existing build and resources. Do not submit another deployment." : "Reconciliation is running. Poll this same operation after 60 seconds; do not start another reconciliation or deployment."
   });
 }
-function publicOperationFailure(internalCode) {
+function publicOperationFailure(internalCode, diagnostic) {
   const normalized = internalCode.toLowerCase();
   const code = Object.hasOwn(failures, normalized) ? normalized : "operation_failed";
   const [message, suggested_action] = failures[code];
-  return Object.freeze({ code, message, retryable: false, suggested_action });
+  const detail = code === "auto_deploy_plan_rejected" ? frameworkConversionDetail(diagnostic) : null;
+  return Object.freeze({
+    code,
+    message,
+    retryable: false,
+    suggested_action,
+    ...detail === null ? {} : { detail }
+  });
 }
 
 // packages/contracts/dist/managed-sources.js
@@ -21211,111 +21610,6 @@ function invalid2() {
   throw new TypeError("Project data change plan is invalid");
 }
 
-// packages/contracts/dist/customer-auth-admission.js
-function managedCustomerAuthDatabaseMessage(path2) {
-  return `"${path2}" selects the managed Better Auth bridge, which requires the managed PostgreSQL database. Set database.enabled: true with an admitted migrations path, or set auth.provider: none and keep the application-owned authentication configuration. Commit and push the change, then plan the new commit.`;
-}
-
-// packages/contracts/dist/framework-admission.js
-var PACKAGE_MANAGER_CONTRACTS = Object.freeze({
-  bun: Object.freeze({
-    lockfiles: Object.freeze(["bun.lock", "bun.lockb"]),
-    installCommand: "bun install --frozen-lockfile --ignore-scripts",
-    buildCommand: "bun run build"
-  }),
-  npm: Object.freeze({
-    lockfiles: Object.freeze(["package-lock.json"]),
-    installCommand: "npm ci --ignore-scripts",
-    buildCommand: "npm run build"
-  }),
-  pnpm: Object.freeze({
-    lockfiles: Object.freeze(["pnpm-lock.yaml"]),
-    installCommand: "pnpm install --frozen-lockfile --ignore-scripts",
-    buildCommand: "pnpm run build"
-  }),
-  yarn: Object.freeze({
-    lockfiles: Object.freeze(["yarn.lock"]),
-    installCommand: "yarn install --immutable --mode=skip-build",
-    buildCommand: "yarn run build"
-  })
-});
-var ALL_LOCKFILES = Object.freeze(Object.values(PACKAGE_MANAGER_CONTRACTS).flatMap(({ lockfiles }) => lockfiles));
-var VERIFIED_VERSIONS = Object.freeze({
-  vite: /* @__PURE__ */ new Set(["5.4.21", "8.0.16", "8.2.2"]),
-  "tanstack-start": /* @__PURE__ */ new Set(["1.168.26", "1.168.49"]),
-  nextjs: /* @__PURE__ */ new Set(["15.5.26", "16.3.8"])
-});
-var PUSH_AND_PLAN = "Commit and push the change, then plan the new commit.";
-var FRAMEWORK_CONVERSION_DETAILS = Object.freeze({
-  managed_auth_database_required: Object.freeze({
-    render: managedCustomerAuthDatabaseMessage,
-    pattern: /^"([^"]+)" selects the managed Better Auth bridge, which requires the managed PostgreSQL database\. Set database\.enabled: true with an admitted migrations path, or set auth\.provider: none and keep the application-owned authentication configuration\. Commit and push the change, then plan the new commit\.$/u
-  }),
-  database_binding_private: Object.freeze({
-    render: (path2) => `"${path2}" reads a database connection string (DATABASE_URL, HYPERDRIVE, connectionString or a postgres:// URL); none reaches a customer Worker. Call the database with createPrivateDatabaseClient from "@ohmyhost/customer-runtime/database". ${PUSH_AND_PLAN}`,
-    pattern: /^"([^"]+)" reads a database connection string \(DATABASE_URL, HYPERDRIVE, connectionString or a postgres:\/\/ URL\); none reaches a customer Worker\. Call the database with createPrivateDatabaseClient from "@ohmyhost\/customer-runtime\/database"\. Commit and push the change, then plan the new commit\.$/u
-  }),
-  database_driver_unsupported: Object.freeze({
-    render: (path2) => `"${path2}" imports a database socket driver (pg, postgres, pg-native or mysql2); customer Workers cannot open sockets. Call the database with createPrivateDatabaseClient from "@ohmyhost/customer-runtime/database". ${PUSH_AND_PLAN}`,
-    pattern: /^"([^"]+)" imports a database socket driver \(pg, postgres, pg-native or mysql2\); customer Workers cannot open sockets\. Call the database with createPrivateDatabaseClient from "@ohmyhost\/customer-runtime\/database"\. Commit and push the change, then plan the new commit\.$/u
-  }),
-  source_syntax_invalid: Object.freeze({
-    render: (path2) => `Invalid JavaScript or TypeScript in "${path2}". Fix the file, commit and push the change, then plan the new commit.`,
-    pattern: /^Invalid JavaScript or TypeScript in "([^"]+)"\. Fix the file, commit and push the change, then plan the new commit\.$/u
-  }),
-  worker_module_default_export_required: Object.freeze({
-    render: (path2) => `Worker module "${path2}" has no default export. Export default { fetch, scheduled } with the handlers ohmyho.st invokes; named exports are never called. ${PUSH_AND_PLAN}`,
-    pattern: /^Worker module "([^"]+)" has no default export\. Export default \{ fetch, scheduled \} with the handlers ohmyho\.st invokes; named exports are never called\. Commit and push the change, then plan the new commit\.$/u
-  }),
-  scheduled_handler_required: Object.freeze({
-    render: (path2) => `functions.crons is declared but "${path2}" exports no scheduled handler. Add scheduled(controller, env, ctx) to its default export, commit and push the change, then plan the new commit.`,
-    pattern: /^functions\.crons is declared but "([^"]+)" exports no scheduled handler\. Add scheduled\(controller, env, ctx\) to its default export, commit and push the change, then plan the new commit\.$/u
-  }),
-  framework_base_path_unsupported: Object.freeze({
-    render: (path2) => `"${path2}" sets a Vite base. ohmyho.st serves the app at the root origin: remove base or set base: "/". ${PUSH_AND_PLAN}`,
-    pattern: /^"([^"]+)" sets a Vite base\. ohmyho\.st serves the app at the root origin: remove base or set base: "\/"\. Commit and push the change, then plan the new commit\.$/u
-  }),
-  tanstack_prerender_required: Object.freeze({
-    render: (path2) => `"${path2}" does not call tanstackStart({ prerender: { enabled: true } }), which the static TanStack Start runtime needs; enable prerender, or set runtime.mode: edge with the Cloudflare Vite plugin. ${PUSH_AND_PLAN}`,
-    pattern: /^"([^"]+)" does not call tanstackStart\(\{ prerender: \{ enabled: true \} \}\), which the static TanStack Start runtime needs; enable prerender, or set runtime\.mode: edge with the Cloudflare Vite plugin\. Commit and push the change, then plan the new commit\.$/u
-  }),
-  tanstack_vite_plugins_required: Object.freeze({
-    render: (path2) => `"${path2}" does not follow the TanStack Start plugin contract: import tanstackStart from "@tanstack/react-start/plugin/vite"; on runtime edge also import cloudflare from "@cloudflare/vite-plugin" and call cloudflare({ viteEnvironment: { name: "ssr" } }) before tanstackStart(); on runtime static do not import the Cloudflare plugin. ${PUSH_AND_PLAN}`,
-    pattern: /^"([^"]+)" does not follow the TanStack Start plugin contract: import tanstackStart from "@tanstack\/react-start\/plugin\/vite"; on runtime edge also import cloudflare from "@cloudflare\/vite-plugin" and call cloudflare\(\{ viteEnvironment: \{ name: "ssr" \} \}\) before tanstackStart\(\); on runtime static do not import the Cloudflare plugin\. Commit and push the change, then plan the new commit\.$/u
-  }),
-  next_cache_components_unsupported: Object.freeze({
-    render: (path2) => `"${path2}" sets cacheComponents: true, which ohmyho.st does not support; remove it or set it to false. ${PUSH_AND_PLAN}`,
-    pattern: /^"([^"]+)" sets cacheComponents: true, which ohmyho\.st does not support; remove it or set it to false\. Commit and push the change, then plan the new commit\.$/u
-  })
-});
-function isFrameworkConversionDiagnosticCode(value) {
-  return typeof value === "string" && Object.hasOwn(FRAMEWORK_CONVERSION_DETAILS, value);
-}
-function parseFrameworkConversionDiagnostic(value) {
-  if (typeof value !== "object" || value === null || Array.isArray(value))
-    return null;
-  const record7 = value;
-  const path2 = record7["path"];
-  const code = record7["code"];
-  if (Object.keys(record7).length !== 2 || !isFrameworkConversionDiagnosticCode(code) || typeof path2 !== "string" || path2.length > 240 || (code === "managed_auth_database_required" ? path2 !== "ohmyhost.yaml" : !/^[A-Za-z0-9_@()[\]./-]+\.(?:[cm]?[jt]sx?)$/u.test(path2)) || path2.split("/").some((segment) => segment === "" || segment === "." || segment === ".."))
-    return null;
-  return Object.freeze({ code, path: path2 });
-}
-function frameworkConversionDetail(value) {
-  const diagnostic = parseFrameworkConversionDiagnostic(value);
-  return diagnostic === null ? null : FRAMEWORK_CONVERSION_DETAILS[diagnostic.code].render(diagnostic.path);
-}
-function parseFrameworkConversionDetail(value) {
-  if (typeof value !== "string")
-    return null;
-  for (const [code, detail] of Object.entries(FRAMEWORK_CONVERSION_DETAILS)) {
-    const match = detail.pattern.exec(value);
-    if (match !== null)
-      return frameworkConversionDetail({ code, path: match[1] });
-  }
-  return null;
-}
-
 // packages/contracts/dist/operation-deployment-result.js
 function exactRecord(value, keys) {
   if (typeof value !== "object" || value === null || Array.isArray(value))
@@ -21743,9 +22037,9 @@ var PROBLEM_POLICY = {
   framework_conversion_required: {
     status: 409,
     retryable: false,
-    action: "Read detail for the file, reason and required change. Run ohmyhost init --dry-run --json at that commit, apply its blockers and the matching ohmyho.st framework Skill, then save or push the corrected version. Plan its commit; repeating the unchanged source cannot fix an admission error.",
+    action: "Read detail: a catalog sentence names the file, the rule and the required change. Apply it, save or push the corrected version and plan its commit. If detail names no file, run 'ohmyhost init --dry-run --json' at that commit and apply its blockers and the matching ohmyho.st framework Skill; init lists the install, build and server-only checks it cannot run locally under pending. Repeating the unchanged source cannot fix an admission error.",
     title: "Framework conversion required",
-    restAction: "Read detail for the file, reason and required change. Run ohmyhost init --dry-run --json at that commit, apply its blockers and the matching ohmyho.st framework Skill, then save or push the corrected version. Plan its commit; repeating the unchanged source cannot fix an admission error."
+    restAction: "Read detail: a catalog sentence names the file, the rule and the required change. Apply it, save or push the corrected version and plan its commit. If detail names no file, run 'ohmyhost init --dry-run --json' at that commit and apply its blockers and the matching ohmyho.st framework Skill; init lists the install, build and server-only checks it cannot run locally under pending. Repeating the unchanged source cannot fix an admission error."
   },
   repository_configuration_missing: {
     status: 409,
@@ -22207,11 +22501,13 @@ var parseOperation = (value) => {
   };
 };
 function parseOperationFailure(value) {
-  const input = exactRecord2(value, ["code", "message", "retryable", "suggested_action"]);
-  if (typeof input["code"] !== "string" || !boundedString(input["message"], 1, 512) || input["retryable"] !== false || !boundedString(input["suggested_action"], 1, 500))
+  const input = exactRecord2(value, ["code", "message", "retryable", "suggested_action", "detail"]);
+  const detail = input["detail"];
+  const diagnostic = detail === void 0 || input["code"] !== "auto_deploy_plan_rejected" ? null : frameworkConversionDiagnosticFromDetail(detail);
+  if (typeof input["code"] !== "string" || !boundedString(input["message"], 1, 512) || input["retryable"] !== false || !boundedString(input["suggested_action"], 1, 500) || detail !== void 0 && diagnostic === null)
     throw new ResponseContractError();
-  const safe = publicOperationFailure(input["code"]);
-  if (safe.code !== input["code"])
+  const safe = publicOperationFailure(input["code"], diagnostic);
+  if (safe.code !== input["code"] || safe.detail !== detail)
     throw new ResponseContractError();
   return safe;
 }
@@ -22925,7 +23221,7 @@ function exact3(v, keys) {
 // apps/product-cli/package.json
 var package_default2 = {
   name: "@ohmyhost/product-cli",
-  version: "0.1.31",
+  version: "0.1.33",
   private: true,
   ohmyhost: {
     deployment: "production",
@@ -27668,7 +27964,13 @@ var GeneratedSdkProductApi = class {
 // apps/product-cli/dist/repository-init.js
 var MAXIMUM_PACKAGE_BYTES = 1024 * 1024;
 var MAXIMUM_CONFIGURATION_BYTES = 64 * 1024;
+var MAXIMUM_INSPECTED_FILE_BYTES = 5 * 1024 * 1024;
+var UTF8 = new TextDecoder("utf-8", { fatal: true });
 var MAXIMUM_SOURCE_BYTES = 2 * 1024 * 1024;
+var UNNAMED_MODULE_MESSAGES = Object.freeze({
+  database_binding_private: 'The module at path reads a database connection string (DATABASE_URL, HYPERDRIVE, connectionString or a postgres:// URL); none reaches a customer Worker. Call the database with createPrivateDatabaseClient from "@ohmyhost/customer-runtime/database". Commit and push the change, then plan the new commit.',
+  database_driver_unsupported: 'The module at path imports a database socket driver (pg, postgres, pg-native or mysql2); customer Workers cannot open sockets. Call the database with createPrivateDatabaseClient from "@ohmyhost/customer-runtime/database". Commit and push the change, then plan the new commit.'
+});
 var STORAGE_RUNTIME_BINDINGS = Object.freeze([
   "OHMYHOST_ENVIRONMENT_ID",
   "OHMYHOST_PROJECT_ID",
@@ -27677,6 +27979,13 @@ var STORAGE_RUNTIME_BINDINGS = Object.freeze([
   "OHMYHOST_STORAGE_KEY"
 ]);
 var CUSTOMER_RUNTIME_SOURCE = `npm:@amerged/ohmyhost-runtime@${package_default2.version}`;
+var PENDING_CHECKS = Object.freeze({
+  installed_version: "compatibility.frameworks lists a version range that no lockfile ohmyho.st reads (package-lock.json v2/v3 or pnpm-lock.yaml v6/v9) resolves. Planning admits it; after the frozen install, the build checks the installed version against the same security minimum.",
+  frozen_install: "The build installs dependencies from the committed lockfile with the frozen install of the packageManager in package.json, without lifecycle scripts; init installs nothing.",
+  framework_build: "The build itself (scripts.build with the ohmyho.st adapter build, or the Worker bundle of the functions runtime) runs only on ohmyho.st; a clean init does not prove that it succeeds.",
+  reachable_runtime_sources: "Planning walks the runtime sources the build reaches for Workers-incompatible imports, database socket drivers and syntax errors; init does not walk them.",
+  project_state: "Planning also checks the project itself, such as its region against storage.jurisdiction, shared data, the mail sender domain and credits; init runs offline without it."
+});
 var APPLICATION_LOCKFILES = Object.freeze([
   "bun.lock",
   "bun.lockb",