@amerged/ohmyhost-mcp 0.1.38 → 0.1.40

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@amerged/ohmyhost-mcp",
-  "version": "0.1.38",
+  "version": "0.1.40",
   "type": "module",
   "engines": {
     "node": ">=22"

package/src/apps/mcp/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ohmyhost/mcp",
-  "version": "0.1.38",
+  "version": "0.1.40",
   "private": true,
   "ohmyhost": {
     "deployment": "production",

package/src/apps/mcp/src/local-client.ts

@@ -12,6 +12,7 @@ import {
 } from "@ohmyhost/contracts/database-access";
 import { assertOrganizationAccount } from "@ohmyhost/contracts/credit-pricing";
 import { assertDatabaseCompute } from "@ohmyhost/contracts/database-compute";
+import type { DatabaseComputeSelection } from "@ohmyhost/contracts/database-sizes";
 import {
   assertProjectContext,
   assertProjectNotesReceipt,
@@ -279,18 +280,23 @@ export class GeneratedSdkLocalMcpClient implements LocalMcpProductClient {
     return bound;
   }
 
-  public async changeDatabaseCompute(input: {
-    projectId: string;
-    environment: "dev" | "prod";
-    profile: "standard" | "performance";
-    idempotencyKey: string;
-  }) {
+  public async changeDatabaseCompute(
+    input: {
+      projectId: string;
+      environment: "dev" | "prod";
+      idempotencyKey: string;
+    } & DatabaseComputeSelection,
+  ) {
     return changeDatabaseCompute(
       {
         project_id: input.projectId,
-        environment: input.environment,
-        profile: input.profile,
-        confirm: true,
+        body: {
+          environment: input.environment,
+          ...(input.memoryMiB === undefined
+            ? { profile: input.profile }
+            : { memory_mib: input.memoryMiB }),
+          confirm: true,
+        },
         "Idempotency-Key": input.idempotencyKey,
       },
       { client: this.#client },

package/src/apps/mcp/src/local-server.ts

@@ -1,4 +1,5 @@
 import { isUserSecretName, USER_SECRET_NAME_PATTERN } from "@ohmyhost/contracts/secret-names";
+import type { DatabaseComputeSelection } from "@ohmyhost/contracts/database-sizes";
 import {
   normalizeMcpSourceChanges,
   formatMcpSourceFileResponse,
@@ -113,12 +114,13 @@ export interface LocalMcpProductClient {
     projectId: string;
     idempotencyKey: string;
   }): Promise<import("@ohmyhost/sdk-ts").DevAccessState>;
-  changeDatabaseCompute(input: {
-    projectId: string;
-    environment: "dev" | "prod";
-    profile: "standard" | "performance";
-    idempotencyKey: string;
-  }): Promise<import("@ohmyhost/sdk-ts").Operation>;
+  changeDatabaseCompute(
+    input: {
+      projectId: string;
+      environment: "dev" | "prod";
+      idempotencyKey: string;
+    } & DatabaseComputeSelection,
+  ): Promise<import("@ohmyhost/sdk-ts").Operation>;
   getDatabaseCompute(input: {
     projectId: string;
     environment: "dev" | "prod";
@@ -513,7 +515,7 @@ export function createLocalOhmyhostMcpServer(dependencies: LocalOhmyhostMcpDepen
     server,
     dependencies,
     "database_compute_get",
-    "Read current managed database size, memory, region and compute state without running SQL or waking the database. Shared Dev/Prod resolves to one physical database. A null database means no confirmed managed placement. suspend_timeout_seconds=0 uses the provider default; -1 disables scale to zero. A configured value is not proof that an in-progress resize finished. This read never resizes or changes billing.",
+    "Read current managed database memory, total storage, region and observed state without running SQL or waking the database. Shared Dev/Prod resolves to one physical database. First provisioning is distinct from cold (sleeping) and warm (running). A null database means no confirmed placement. A configured size does not prove an in-progress resize finished. This read never resizes or changes billing.",
     z.object({ project_id: identifier, environment: z.enum(["dev", "prod"]).default("dev") }),
     (client, input) =>
       client.getDatabaseCompute({ projectId: input.project_id, environment: input.environment }),
@@ -523,19 +525,35 @@ export function createLocalOhmyhostMcpServer(dependencies: LocalOhmyhostMcpDepen
     server,
     dependencies,
     "database_compute_set",
-    "Select standard or performance compute for an existing database: Free 0.25 CU/1 GB, Paid 0.5 CU/2 GB. All profiles use provider-default idle suspension (suspend_timeout_seconds=0). First read database_compute_get and explain actual size, metered compute cost, possible brief connection interruption and that shared data changes both Dev and Prod. Require the user's decision before confirm=true. SQL data is preserved. Poll the returned operation every 60 seconds; never submit a second change while it runs. Performance requires active Paid access and selects 1 CU/4 GB at 2.5x Paid-standard compute credits per equal active minute. This affects only database compute. Read organization_credits_get for the published rate and active meter first. A successful choice is remembered per physical database; automatic Free downgrades preserve it, and an explicit standard choice clears it. Mixed/uncertain transition hours waive the premium; never multiply raw CU usage again.",
-    z.object({
-      project_id: identifier,
-      environment: z.enum(["dev", "prod"]),
-      profile: z.enum(["standard", "performance"]),
-      confirm: z.literal(true),
-      idempotency_key: idempotencyKey,
-    }),
+    "Choose fixed database RAM: 256, 512, 1024, 2048 or 4096 MiB. Free permits only 256 MiB; larger sizes require Paid. Included total disk is 500, 1024, 2048, 4096 or 8192 MiB, including PostgreSQL/WAL, plus seven-day backups. Prices are 10, 20, 40, 80 or 160 credits per active hour respectively, prorated. Sleep follows 300 idle seconds; sleeping has no active-RAM charge. No separate database CPU, network or connection charges apply. First read database_compute_get, explain the size, price, possible interruption and shared Dev/Prod scope, then obtain the user's choice before confirm=true. Smaller volumes need a separate data move. Poll the original operation; never duplicate a pending request. Legacy profile input applies only during provider transition. Supply exactly one of memory_mib and profile.",
+    z
+      .object({
+        project_id: identifier,
+        environment: z.enum(["dev", "prod"]),
+        profile: z.enum(["standard", "performance"]).optional(),
+        memory_mib: z
+          .union([
+            z.literal(256),
+            z.literal(512),
+            z.literal(1024),
+            z.literal(2048),
+            z.literal(4096),
+          ])
+          .optional(),
+        confirm: z.literal(true),
+        idempotency_key: idempotencyKey,
+      })
+      .refine(
+        (value) => (value.memory_mib === undefined) !== (value.profile === undefined),
+        "Select exactly one database size",
+      ),
     (client, input) =>
       client.changeDatabaseCompute({
         projectId: input.project_id,
         environment: input.environment,
-        profile: input.profile,
+        ...(input.memory_mib === undefined
+          ? { profile: z.enum(["standard", "performance"]).parse(input.profile) }
+          : { memoryMiB: input.memory_mib }),
         idempotencyKey: input.idempotency_key,
       }),
     mutationAnnotations(),
@@ -972,7 +990,7 @@ export function createLocalOhmyhostMcpServer(dependencies: LocalOhmyhostMcpDepen
     server,
     dependencies,
     "database_access_create",
-    "Issue a time-bound PostgreSQL credential for this project's own Dev or Prod database. THE CONNECTION URI AND psql COMMAND ARE RETURNED EXACTLY ONCE and can never be read again: use them immediately for psql or another SQL client in this same task, and never write them into files, notes, source, commit messages or later messages. Mode read (default) is read-only; mode write joins the restricted runtime role and requires confirmed: true. Neither mode can change schema, application row-level security still applies, and schema changes stay in GitHub migrations. The lifetime is 5 minutes to 24 hours (3600 seconds by default) and at most three credentials are active per environment. Database compute wakes and is metered normally. Call database_access_revoke as soon as the work is finished.",
+    "Issue a time-bound PostgreSQL credential for this project's own Dev or Prod database. The credential URI and password are RETURNED EXACTLY ONCE: never write them into files, notes, source, commit messages or later messages; keep credentials out of command arguments, logs and feedback. PGCF declares transport=wss and websocket_url; its URI is not a public TCP endpoint. Use the secret-free psql_command to run the local ohmyhost database psql helper, which creates its own access, bridges verified WSS to loopback, and closes/revokes on exit. Mode read (default) is read-only; mode write joins the restricted runtime role and requires confirmed: true. Neither mode can change schema, application row-level security still applies, and schema changes stay in GitHub migrations. The lifetime is 5 minutes to 24 hours (3600 seconds by default) and at most three credentials are active per environment. Database compute wakes and is metered normally. Call database_access_revoke as soon as the work is finished.",
     z
       .object({
         project_id: identifier,
@@ -1243,7 +1261,7 @@ export function createLocalOhmyhostMcpServer(dependencies: LocalOhmyhostMcpDepen
     server,
     dependencies,
     "project_create",
-    "Create an ohmyho.st project. Ask whether Dev should be protected (default) or public before creation; public means anyone with the Dev URL can open it, including when Dev and Prod share data. Recommend isolated Dev/Prod data, but respect the customer's choice and added database consumption. data_mode is optional and defaults to shared, using one database/file namespace; isolated separates database/Auth records and files. Later changes use project_data_plan and project_data_change; ohmyho.st never copies data and ordinary usage prices apply. region defaults to us; eu places the project's database, files and builds in the EU at the same prices. The region cannot be changed later, and ohmyhost.yaml storage.jurisdiction must equal it.",
+    "Create an ohmyho.st project. Ask whether Dev should be protected (default) or public before creation; public means anyone with the Dev URL can open it, including when Dev and Prod share data. Recommend isolated Dev/Prod data, but respect the customer's choice and added database consumption. data_mode is optional and defaults to shared, using one database/file namespace; isolated separates database/Auth records and files. Later changes use project_data_plan and project_data_change; ohmyho.st never copies data and ordinary usage prices apply. region defaults to us; new projects provision their PGCF database, new files and builds in the selected us or eu region at the same prices. Read database_compute_get for the observed database region. Existing projects migrated with their owner's authorization now use US databases; their existing R2 object locations remain unchanged. The customer API cannot change region later. ohmyhost.yaml storage.jurisdiction must match the recorded R2 bucket or reservation jurisdiction, using project region only for new storage. Read the Storage jurisdiction line in project_context_get; if unavailable, report it rather than guessing.",
     z.object({
       organization_id: identifier,
       name: z.string().min(1).max(128),

package/src/apps/product-cli/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ohmyhost/product-cli",
-  "version": "0.1.38",
+  "version": "0.1.40",
   "private": true,
   "ohmyhost": {
     "deployment": "production",
@@ -41,7 +41,8 @@
     "@ohmyhost/sdk-ts": "workspace:*",
     "@ohmyhost/workos-auth-contracts": "workspace:*",
     "ignore": "7.0.12",
-    "isomorphic-git": "1.43.0"
+    "isomorphic-git": "1.43.0",
+    "@ohmyhost/postgres-bridge": "workspace:*"
   },
   "license": "Apache-2.0"
 }

package/src/apps/product-cli/src/cli.ts

@@ -281,6 +281,7 @@ export interface ProductCliDependencies {
   readonly operationEventSink?: { write(value: string): void };
   readonly readSecretValue: (signal: AbortSignal) => Promise<string>;
   readonly spawnPsql?: (input: {
+    readonly websocketUrl?: string;
     readonly host: string;
     readonly user: string;
     readonly password: string;
@@ -321,7 +322,7 @@ type CustomerCommandLabel = Exclude<CommandLabel, "unknown" | "help" | "version"
 
 const CLI_VERSION = cliPackage.version;
 const HELP_USAGE = Object.freeze({
-  init: "ohmyhost init [--directory PATH] [--root PATH] [--project SLUG] [--region us|eu] [--dry-run] --json (pass the project's hosting region so storage.jurisdiction matches it; us when omitted)",
+  init: "ohmyhost init [--directory PATH] [--root PATH] [--project SLUG] [--region us|eu] [--dry-run] --json (preserve existing storage jurisdiction; for new storage pass the project's region, us when omitted)",
   login:
     "ohmyhost login [--organization ULID] [--user USER_ID] [--profile-name NAME] --json (adds one saved login; nothing is saved unless the browser signed in as that user and organization)",
   logout:
@@ -372,7 +373,7 @@ const HELP_USAGE = Object.freeze({
   "feedback submit":
     "ohmyhost feedback submit --organization ULID --kind bug|issue|feature_request --title TITLE --description REDACTED_REPORT [--project ULID] [--environment ULID] [--operation ULID] [--error-code CODE] [--client-version VERSION] --idempotency-key KEY --json",
   "project create":
-    "ohmyhost project create --organization ULID --name NAME [--data-mode shared|isolated] [--dev-access-mode protected|public] [--region us|eu] --idempotency-key KEY --json (data mode is optional and defaults to shared; later assignments use project data plan/change without copying data; the region is chosen once: us is the default, eu places the database, files and builds in the EU; it cannot be changed later)",
+    "ohmyhost project create --organization ULID --name NAME [--data-mode shared|isolated] [--dev-access-mode protected|public] [--region us|eu] --idempotency-key KEY --json (data mode is optional and defaults to shared; later assignments use project data plan/change without copying data; the region is chosen once: us is the default, eu selects EU database, new files and builds; existing R2 locations survive authorized region moves; the customer API cannot change region later)",
   "project data plan":
     "ohmyhost project data plan --project ULID --change isolate_prod_keeps_data|isolate_dev_keeps_data|share_prod_keeps_data|reset_dev --json (shared is the optional creation default; review which data is kept or deleted; no data is copied)",
   "project data change":
@@ -398,8 +399,8 @@ const HELP_USAGE = Object.freeze({
   "project handle set":
     "ohmyhost project handle set --project ULID --handle HANDLE --if-match ETAG --idempotency-key KEY --json (moves the project to a free address; the old one stops working and anyone may claim it)",
   "database compute set":
-    "ohmyhost database compute set --project ULID --environment dev|prod --profile standard|performance --idempotency-key KEY --yes [--wait] --json\n" +
-    "  standard: Free 0.25 CU/1 GB, Paid 0.5 CU/2 GB. performance: Paid 1 CU/4 GB, 2.5x database compute credits per equal active minute. All profiles use the provider-default idle suspension.",
+    "ohmyhost database compute set --project ULID --environment dev|prod --memory-mib 256|512|1024|2048|4096 --idempotency-key KEY --yes [--wait] --json\n" +
+    "  10/20/40/80/160 credits per active hour, prorated; includes 500 MiB/1/2/4/8 GiB total disk and seven-day backups. Free supports 256 MiB; larger sizes require Paid. Sleep after 300 idle seconds. No separate database CPU, network or connection charge. Smaller disk requires a separate data migration. Transitional --profile standard|performance is accepted only for legacy provider use; never combine it with --memory-mib.",
   "database compute get":
     "ohmyhost database compute get --project ULID [--environment dev|prod] --json",
   "database write":
@@ -1872,7 +1873,8 @@ export class ProductCli {
       exitCode = await spawnPsql({
         host: credential.host,
         user: credential.role_name,
-        password: new URL(credential.connection_uri).password,
+        password: decodeURIComponent(new URL(credential.connection_uri).password),
+        ...(credential.provider === "pgcf" ? { websocketUrl: credential.websocket_url } : {}),
         database: credential.database,
         mode: credential.mode,
         signal,

package/src/apps/product-cli/src/command.ts

@@ -1,4 +1,8 @@
 import { isUserSecretName } from "@ohmyhost/contracts/secret-names";
+import {
+  databaseSizeForMemory,
+  type DatabaseComputeSelection,
+} from "@ohmyhost/contracts/database-sizes";
 import {
   isProjectDataChangeKind,
   type ProjectDataChangeKind,
@@ -92,15 +96,14 @@ export type ProductCliCommand =
       readonly organizationId: string;
       readonly credentialStore: "native";
     }
-  | {
+  | ({
       readonly kind: "database-compute-set";
       readonly projectId: string;
       readonly environment: "dev" | "prod";
-      readonly profile: "standard" | "performance";
       readonly idempotencyKey: string;
       readonly wait: boolean;
       readonly credentialStore: "native";
-    }
+    } & DatabaseComputeSelection)
   | {
       readonly kind: "database-compute-get";
       readonly projectId: string;
@@ -1761,20 +1764,30 @@ export const parseProductCliCommand = (argv: readonly string[]): ProductCliComma
       "--project",
       "--environment",
       "--profile",
+      "--memory-mib",
       "--idempotency-key",
     ]);
     if (
       !options["--project"] ||
       !options["--idempotency-key"] ||
-      (options["--profile"] !== "standard" && options["--profile"] !== "performance") ||
+      (options["--profile"] === undefined) === (options["--memory-mib"] === undefined) ||
+      (options["--profile"] !== undefined &&
+        options["--profile"] !== "standard" &&
+        options["--profile"] !== "performance") ||
       (options["--environment"] !== "dev" && options["--environment"] !== "prod")
     )
       throw new InvalidCommandError();
+    let selection: DatabaseComputeSelection;
+    if (options["--memory-mib"] !== undefined) {
+      if (!/^(256|512|1024|2048|4096)$/u.test(options["--memory-mib"]))
+        throw new InvalidCommandError();
+      selection = { memoryMiB: databaseSizeForMemory(Number(options["--memory-mib"])).memoryMiB };
+    } else selection = { profile: options["--profile"] as "standard" | "performance" };
     return {
       kind: "database-compute-set",
       projectId: options["--project"],
       environment: options["--environment"],
-      profile: options["--profile"],
+      ...selection,
       idempotencyKey: options["--idempotency-key"],
       wait,
       credentialStore,

package/src/apps/product-cli/src/product-api.ts

@@ -20,6 +20,7 @@ import {
   type ProjectDatabaseWriteReceipt,
 } from "@ohmyhost/contracts/database-access";
 import { assertDatabaseCompute, type DatabaseCompute } from "@ohmyhost/contracts/database-compute";
+import type { DatabaseComputeSelection } from "@ohmyhost/contracts/database-sizes";
 import {
   assertProjectContext,
   assertProjectNotesReceipt,
@@ -173,12 +174,13 @@ export interface ProductApi {
     confirmationToken: string;
     idempotencyKey: string;
   }): Promise<Operation>;
-  changeDatabaseCompute(input: {
-    projectId: string;
-    environment: "dev" | "prod";
-    profile: "standard" | "performance";
-    idempotencyKey: string;
-  }): Promise<import("@ohmyhost/sdk-ts").Operation>;
+  changeDatabaseCompute(
+    input: {
+      projectId: string;
+      environment: "dev" | "prod";
+      idempotencyKey: string;
+    } & DatabaseComputeSelection,
+  ): Promise<import("@ohmyhost/sdk-ts").Operation>;
   getDatabaseCompute(input: {
     projectId: string;
     environment: "dev" | "prod";
@@ -456,18 +458,23 @@ export class GeneratedSdkProductApi implements ProductApi {
     this.managedSource = new GeneratedSdkManagedSourceApi(() => this.#client);
   }
 
-  public async changeDatabaseCompute(input: {
-    projectId: string;
-    environment: "dev" | "prod";
-    profile: "standard" | "performance";
-    idempotencyKey: string;
-  }) {
+  public async changeDatabaseCompute(
+    input: {
+      projectId: string;
+      environment: "dev" | "prod";
+      idempotencyKey: string;
+    } & DatabaseComputeSelection,
+  ) {
     return changeDatabaseCompute(
       {
         project_id: input.projectId,
-        environment: input.environment,
-        profile: input.profile,
-        confirm: true,
+        body: {
+          environment: input.environment,
+          ...(input.memoryMiB === undefined
+            ? { profile: input.profile }
+            : { memory_mib: input.memoryMiB }),
+          confirm: true,
+        },
         "Idempotency-Key": input.idempotencyKey,
       },
       { client: this.#client },

package/src/apps/product-cli/src/psql-session.ts

@@ -1,29 +1,64 @@
 import { spawn } from "node:child_process";
+import { startBridge } from "@ohmyhost/postgres-bridge";
 
 import { PsqlUnavailableError } from "./cli.js";
 
-/**
- * Starts the customer's own psql against a temporary database credential.
- * The password reaches psql only through its private environment, never through
- * argv, the terminal title or any file; no authentication credential is involved.
- */
-export const runLocalPsql = (input: {
+/** One private loopback bridge lasts exactly as long as the customer's native psql session. */
+export const runLocalPsql = async (input: {
   readonly host: string;
   readonly user: string;
   readonly password: string;
   readonly database: string;
+  readonly websocketUrl?: string;
   readonly signal: AbortSignal;
-}): Promise<number> =>
-  new Promise<number>((resolve, reject) => {
-    const child = spawn("psql", ["-h", input.host, "-U", input.user, "-d", input.database], {
-      stdio: "inherit",
-      signal: input.signal,
-      env: { ...process.env, PGPASSWORD: input.password, PGSSLMODE: "require" },
+}): Promise<number> => {
+  input.signal.throwIfAborted();
+  if (input.websocketUrl !== undefined && input.websocketUrl !== `wss://${input.host}/`)
+    throw new Error("Invalid PGCF transport");
+  const bridge =
+    input.websocketUrl === undefined
+      ? null
+      : await startBridge({
+          endpoint: input.websocketUrl,
+          database: input.database,
+          user: input.user,
+          port: 0,
+        });
+  try {
+    input.signal.throwIfAborted();
+    // A caller's libpq service/hostaddr settings must not redirect this temporary credential.
+    const environment = Object.fromEntries(
+      Object.entries(process.env).filter(([key]) => !/^PG[A-Z_]+$/iu.test(key)),
+    );
+    return await new Promise<number>((resolve, reject) => {
+      const child = spawn(
+        "psql",
+        ["-h", bridge?.host ?? input.host, "-U", input.user, "-d", input.database],
+        {
+          stdio: "inherit",
+          signal: input.signal,
+          env: {
+            ...environment,
+            PGPASSWORD: input.password,
+            PGSSLMODE: bridge ? "disable" : "require",
+            ...(bridge
+              ? {
+                  PGPORT: String(bridge.port),
+                  PGCHANNELBINDING: "disable",
+                  PGGSSENCMODE: "disable",
+                }
+              : {}),
+          },
+        },
+      );
+      child.once("error", (error: NodeJS.ErrnoException) => {
+        reject(error.code === "ENOENT" ? new PsqlUnavailableError() : error);
+      });
+      child.once("close", (code, signalName) => {
+        resolve(code ?? (signalName === null ? 1 : 130));
+      });
     });
-    child.once("error", (error: NodeJS.ErrnoException) => {
-      reject(error.code === "ENOENT" ? new PsqlUnavailableError() : error);
-    });
-    child.once("close", (code, signalName) => {
-      resolve(code ?? (signalName === null ? 1 : 130));
-    });
-  });
+  } finally {
+    await bridge?.close();
+  }
+};