@amerged/ohmyhost-mcp 0.1.48 → 0.1.50

package/dist/stdio-main.js

@@ -30,7 +30,7 @@ import {
   serverIdentityOf,
   setNegotiatedProtocolVersion,
   validateEnvelopeMeta
-} from "./chunk-AHSHRANX.js";
+} from "./chunk-MYCLNNZ7.js";
 
 // node_modules/.pnpm/ignore@7.0.12/node_modules/ignore/index.js
 var require_ignore = __commonJS({
@@ -24019,6 +24019,10 @@ var BUILD_FRAMEWORKS = Object.freeze([
 var PUSH_AND_PLAN = "Commit and push the change, then plan the new commit.";
 var VITE_BUILD_SCRIPT = '"vite build", optionally joined with && to one "tsc", "tsc -b", "tsc --build" or "tsc --noEmit" stage';
 var FRAMEWORK_CONVERSION_DETAILS = Object.freeze({
+  native_auth_route_conflict: {
+    paths: ["module"],
+    template: '"{{path}}" declares a route in the reserved /api/auth/v1 namespace. Move the route or select a different authentication provider. Commit and push the change, then plan the new commit.'
+  },
   astro_template_import_unsupported: {
     paths: ["module"],
     template: '"{{path}}" uses a dynamic import, import.meta or require in an Astro template. Move server imports into frontmatter and dynamic browser imports into a normal statically imported browser module, then commit and push the change and plan the new commit.'
@@ -25688,7 +25692,7 @@ var PROBLEM_POLICY = {
   project_rename_blocked: {
     status: 409,
     retryable: true,
-    action: "Wait for the running operation to finish, read the project again, then rename with the new ETag.",
+    action: "Read project status and finish or retry any pending Native Auth deployment or other operation. Once preparation is complete, read the project again and rename with its current ETag.",
     title: "Project address change blocked"
   },
   project_identity_unavailable: {
@@ -25947,6 +25951,12 @@ var PROBLEM_POLICY = {
     retryable: false,
     title: "Remove the project domain first",
     action: "This project still has a live or pending custom-domain connection. Read 'ohmyhost domain paid status --project ULID --json', remove that connection with 'ohmyhost domain paid delete --project ULID --hostname HOST --yes --json', then create a fresh project deletion plan. Repeating while it remains connected cannot work."
+  },
+  native_domain_sync_pending: {
+    status: 409,
+    retryable: false,
+    title: "Complete the pending domain change",
+    action: "Read project status and Paid domain status to identify the pending change. If a Paid domain removal is pending, retry it as a current owner with a new idempotency key. If a project address change is pending, submit a fresh address change as a current owner. After it finishes, create a new project deletion plan."
   }
 };
 
@@ -27413,7 +27423,7 @@ function exact4(value, keys) {
 // apps/product-cli/package.json
 var package_default2 = {
   name: "@ohmyhost/product-cli",
-  version: "0.1.48",
+  version: "0.1.50",
   private: true,
   ohmyhost: {
     deployment: "production",
@@ -27523,7 +27533,17 @@ function assertProjectExport(value) {
       invalid4();
     return;
   }
-  if (value["state"] !== "succeeded" || !record6(archive) || Object.keys(archive).sort().join(",") !== "bytes,captured_at,download_expires_at,download_url,expires_at,sha256,sql_files" || !Number.isSafeInteger(archive["bytes"]) || Number(archive["bytes"]) < 1 || Number(archive["bytes"]) > 536870912 || typeof archive["sha256"] !== "string" || !/^sha256:[a-f0-9]{64}$/u.test(archive["sha256"]) || !['["dev.sql"]', '["prod.sql"]', '["dev.sql","prod.sql"]', '["shared.sql"]'].includes(JSON.stringify(archive["sql_files"])) || !timestamp5(archive["captured_at"]) || !timestamp5(archive["expires_at"]))
+  if (value["state"] !== "succeeded" || !record6(archive) || Object.keys(archive).sort().join(",") !== "bytes,captured_at,download_expires_at,download_url,expires_at,sha256,sql_files" || !Number.isSafeInteger(archive["bytes"]) || Number(archive["bytes"]) < 1 || Number(archive["bytes"]) > 536870912 || typeof archive["sha256"] !== "string" || !/^sha256:[a-f0-9]{64}$/u.test(archive["sha256"]) || ![
+    '["dev.sql"]',
+    '["prod.sql"]',
+    '["dev.sql","prod.sql"]',
+    '["shared.sql"]',
+    '["auth.sql"]',
+    '["dev.sql","auth.sql"]',
+    '["prod.sql","auth.sql"]',
+    '["dev.sql","prod.sql","auth.sql"]',
+    '["shared.sql","auth.sql"]'
+  ].includes(JSON.stringify(archive["sql_files"])) || !timestamp5(archive["captured_at"]) || !timestamp5(archive["expires_at"]))
     invalid4();
   if (archive["download_url"] === null) {
     if (archive["download_expires_at"] !== null)
@@ -28027,6 +28047,41 @@ function onlyKeys(value, allowed) {
   return Object.keys(value).every((key) => allowed.includes(key));
 }
 
+// packages/contracts/dist/native-auth.js
+var NATIVE_AUTH_DEFAULT_REDIRECT_PATHS = Object.freeze([
+  "/",
+  "/login",
+  "/reset-password",
+  "/accept-invitation"
+]);
+function isNativeAuthRedirectPath(value) {
+  return typeof value === "string" && value.length <= 256 && /^\/[A-Za-z0-9/_~.-]*$/u.test(value) && !value.includes("//") && !value.split("/").some((segment) => segment === "." || segment === "..");
+}
+var PUBLIC_ROUTES = Object.freeze({
+  GET: Object.freeze([
+    "/get-session",
+    "/verify-email",
+    "/callback/google",
+    "/callback/github",
+    "/list-accounts"
+  ]),
+  POST: Object.freeze([
+    "/sign-up/email",
+    "/sign-in/email",
+    "/sign-in/social",
+    "/sign-out",
+    "/request-password-reset",
+    "/reset-password",
+    "/change-password",
+    "/send-verification-email",
+    "/link-social",
+    "/unlink-account",
+    "/accept-invitation",
+    "/reauthenticate",
+    "/enroll-recovery"
+  ])
+});
+
 // packages/workos-auth-contracts/dist/user-api-keys.js
 var WORKOS_USER_API_KEY_PATTERN = /^sk_[A-Za-z0-9_-]{20,128}$/u;
 
@@ -28745,6 +28800,7 @@ var HELP_USAGE = Object.freeze({
   "secret list": "ohmyhost secret list --project ULID --environment ENVIRONMENT_ULID --json",
   "function runs": "ohmyhost function runs --project ULID --environment ENVIRONMENT_ULID [--limit 1-100] --json",
   "secret set": `printf '%s' "$SECRET_VALUE" | ohmyhost secret set NAME --project ULID --environment ENVIRONMENT_ULID --idempotency-key KEY [--profile-user USER_ID --profile-organization ULID | --token-user USER_ID --token-organization ULID] --stdin [--wait] --json (with --profile-user and --profile-organization the saved login that runs it must belong to that user and organization; with --token-user and --token-organization it runs only with an OHMYHOST_TOKEN of that user and organization, never with a saved login)`,
+  auth: "ohmyhost auth config get|set --project ULID --environment ULID [--revision N --enabled true|false --signup-policy open|invite-only --application-name NAME --idempotency-key KEY] [--canonical-origin URL|primary] [--allowed-redirect-paths JSON_ARRAY --reset-password-path PATH --invitation-path PATH]; auth provider get|set --project ULID --environment ULID --provider google|github [--revision N --enabled true|false --client-id ID --idempotency-key KEY --stdin]; auth users list --project ULID --environment ULID [--limit N --cursor CURSOR --search TEXT]; auth user create|get|delete|invite|suspend|reactivate|revoke-sessions --project ULID --environment ULID [--email EMAIL | --user UUID] [--idempotency-key KEY]. Provider secrets are read only from stdin; use --json.",
   "secret delete": "ohmyhost secret delete NAME --project ULID --environment ENVIRONMENT_ULID --idempotency-key KEY [--wait] --json",
   "mail workspace list": "ohmyhost mail workspace list --organization ULID --json",
   "mail workspace create": "ohmyhost mail workspace create --organization ULID --domain DOMAIN --sending true --idempotency-key KEY --json",
@@ -29623,6 +29679,259 @@ var createClient = (config = {}) => {
 var client = createClient(createConfig({ throwOnError: true }));
 
 // packages/sdk-ts/dist/generated/sdk.gen.js
+var getNativeAuthConfiguration = (parameters, options) => {
+  const params = buildClientParams([parameters], [
+    {
+      args: [
+        { in: "headers", key: "X-Request-Id" },
+        { in: "path", key: "project_id" },
+        { in: "path", key: "environment_id" }
+      ]
+    }
+  ]);
+  return (options?.client ?? client).get({
+    responseStyle: "data",
+    security: [{ scheme: "bearer", type: "http" }],
+    url: "/v1/projects/{project_id}/environments/{environment_id}/auth",
+    ...options,
+    ...params
+  });
+};
+var updateNativeAuthConfiguration = (parameters, options) => {
+  const params = buildClientParams([parameters], [
+    {
+      args: [
+        { in: "headers", key: "X-Request-Id" },
+        { in: "headers", key: "Idempotency-Key" },
+        { in: "path", key: "project_id" },
+        { in: "path", key: "environment_id" },
+        { key: "nativeAuthConfigurationUpdate", map: "body" }
+      ]
+    }
+  ]);
+  return (options?.client ?? client).put({
+    responseStyle: "data",
+    security: [{ scheme: "bearer", type: "http" }],
+    url: "/v1/projects/{project_id}/environments/{environment_id}/auth",
+    ...options,
+    ...params,
+    headers: {
+      "Content-Type": "application/json",
+      ...options?.headers,
+      ...params.headers
+    }
+  });
+};
+var getNativeAuthProvider = (parameters, options) => {
+  const params = buildClientParams([parameters], [
+    {
+      args: [
+        { in: "headers", key: "X-Request-Id" },
+        { in: "path", key: "project_id" },
+        { in: "path", key: "environment_id" },
+        { in: "path", key: "provider" }
+      ]
+    }
+  ]);
+  return (options?.client ?? client).get({
+    responseStyle: "data",
+    security: [{ scheme: "bearer", type: "http" }],
+    url: "/v1/projects/{project_id}/environments/{environment_id}/auth/providers/{provider}",
+    ...options,
+    ...params
+  });
+};
+var updateNativeAuthProvider = (parameters, options) => {
+  const params = buildClientParams([parameters], [
+    {
+      args: [
+        { in: "headers", key: "X-Request-Id" },
+        { in: "headers", key: "Idempotency-Key" },
+        { in: "path", key: "project_id" },
+        { in: "path", key: "environment_id" },
+        { in: "path", key: "provider" },
+        { key: "nativeAuthProviderUpdateWritable", map: "body" }
+      ]
+    }
+  ]);
+  return (options?.client ?? client).put({
+    responseStyle: "data",
+    security: [{ scheme: "bearer", type: "http" }],
+    url: "/v1/projects/{project_id}/environments/{environment_id}/auth/providers/{provider}",
+    ...options,
+    ...params,
+    headers: {
+      "Content-Type": "application/json",
+      ...options?.headers,
+      ...params.headers
+    }
+  });
+};
+var listNativeAuthUsers = (parameters, options) => {
+  const params = buildClientParams([parameters], [
+    {
+      args: [
+        { in: "headers", key: "X-Request-Id" },
+        { in: "path", key: "project_id" },
+        { in: "path", key: "environment_id" },
+        { in: "query", key: "limit" },
+        { in: "query", key: "cursor" },
+        { in: "query", key: "search" }
+      ]
+    }
+  ]);
+  return (options?.client ?? client).get({
+    responseStyle: "data",
+    security: [{ scheme: "bearer", type: "http" }],
+    url: "/v1/projects/{project_id}/environments/{environment_id}/auth/users",
+    ...options,
+    ...params
+  });
+};
+var createNativeAuthUser = (parameters, options) => {
+  const params = buildClientParams([parameters], [
+    {
+      args: [
+        { in: "headers", key: "X-Request-Id" },
+        { in: "headers", key: "Idempotency-Key" },
+        { in: "path", key: "project_id" },
+        { in: "path", key: "environment_id" },
+        { key: "nativeAuthUserCreate", map: "body" }
+      ]
+    }
+  ]);
+  return (options?.client ?? client).post({
+    responseStyle: "data",
+    security: [{ scheme: "bearer", type: "http" }],
+    url: "/v1/projects/{project_id}/environments/{environment_id}/auth/users",
+    ...options,
+    ...params,
+    headers: {
+      "Content-Type": "application/json",
+      ...options?.headers,
+      ...params.headers
+    }
+  });
+};
+var deleteNativeAuthUser = (parameters, options) => {
+  const params = buildClientParams([parameters], [
+    {
+      args: [
+        { in: "headers", key: "X-Request-Id" },
+        { in: "headers", key: "Idempotency-Key" },
+        { in: "path", key: "project_id" },
+        { in: "path", key: "environment_id" },
+        { in: "path", key: "user_id" }
+      ]
+    }
+  ]);
+  return (options?.client ?? client).delete({
+    responseStyle: "data",
+    security: [{ scheme: "bearer", type: "http" }],
+    url: "/v1/projects/{project_id}/environments/{environment_id}/auth/users/{user_id}",
+    ...options,
+    ...params
+  });
+};
+var getNativeAuthUser = (parameters, options) => {
+  const params = buildClientParams([parameters], [
+    {
+      args: [
+        { in: "headers", key: "X-Request-Id" },
+        { in: "path", key: "project_id" },
+        { in: "path", key: "environment_id" },
+        { in: "path", key: "user_id" }
+      ]
+    }
+  ]);
+  return (options?.client ?? client).get({
+    responseStyle: "data",
+    security: [{ scheme: "bearer", type: "http" }],
+    url: "/v1/projects/{project_id}/environments/{environment_id}/auth/users/{user_id}",
+    ...options,
+    ...params
+  });
+};
+var resendNativeAuthInvitation = (parameters, options) => {
+  const params = buildClientParams([parameters], [
+    {
+      args: [
+        { in: "headers", key: "X-Request-Id" },
+        { in: "headers", key: "Idempotency-Key" },
+        { in: "path", key: "project_id" },
+        { in: "path", key: "environment_id" },
+        { in: "path", key: "user_id" }
+      ]
+    }
+  ]);
+  return (options?.client ?? client).post({
+    responseStyle: "data",
+    security: [{ scheme: "bearer", type: "http" }],
+    url: "/v1/projects/{project_id}/environments/{environment_id}/auth/users/{user_id}/invite",
+    ...options,
+    ...params
+  });
+};
+var suspendNativeAuthUser = (parameters, options) => {
+  const params = buildClientParams([parameters], [
+    {
+      args: [
+        { in: "headers", key: "X-Request-Id" },
+        { in: "headers", key: "Idempotency-Key" },
+        { in: "path", key: "project_id" },
+        { in: "path", key: "environment_id" },
+        { in: "path", key: "user_id" }
+      ]
+    }
+  ]);
+  return (options?.client ?? client).post({
+    responseStyle: "data",
+    security: [{ scheme: "bearer", type: "http" }],
+    url: "/v1/projects/{project_id}/environments/{environment_id}/auth/users/{user_id}/suspend",
+    ...options,
+    ...params
+  });
+};
+var reactivateNativeAuthUser = (parameters, options) => {
+  const params = buildClientParams([parameters], [
+    {
+      args: [
+        { in: "headers", key: "X-Request-Id" },
+        { in: "headers", key: "Idempotency-Key" },
+        { in: "path", key: "project_id" },
+        { in: "path", key: "environment_id" },
+        { in: "path", key: "user_id" }
+      ]
+    }
+  ]);
+  return (options?.client ?? client).post({
+    responseStyle: "data",
+    security: [{ scheme: "bearer", type: "http" }],
+    url: "/v1/projects/{project_id}/environments/{environment_id}/auth/users/{user_id}/reactivate",
+    ...options,
+    ...params
+  });
+};
+var revokeNativeAuthUserSessions = (parameters, options) => {
+  const params = buildClientParams([parameters], [
+    {
+      args: [
+        { in: "headers", key: "X-Request-Id" },
+        { in: "headers", key: "Idempotency-Key" },
+        { in: "path", key: "project_id" },
+        { in: "path", key: "environment_id" },
+        { in: "path", key: "user_id" }
+      ]
+    }
+  ]);
+  return (options?.client ?? client).post({
+    responseStyle: "data",
+    security: [{ scheme: "bearer", type: "http" }],
+    url: "/v1/projects/{project_id}/environments/{environment_id}/auth/users/{user_id}/revoke-sessions",
+    ...options,
+    ...params
+  });
+};
 var listWorkspaceMailDomains = (parameters, options) => {
   const params = buildClientParams([parameters], [
     {
@@ -32863,6 +33172,87 @@ var parseDeviceTokens = (value) => {
   };
 };
 
+// apps/product-cli/dist/native-auth.js
+async function executeNativeAuth(client2, command) {
+  const scope = { project_id: command.projectId, environment_id: command.environmentId };
+  const options = { client: client2 };
+  switch (command.action) {
+    case "config_get":
+      return getNativeAuthConfiguration(scope, options);
+    case "config_set":
+      return updateNativeAuthConfiguration({
+        ...scope,
+        "Idempotency-Key": command.idempotencyKey,
+        nativeAuthConfigurationUpdate: {
+          configurationRevision: command.configurationRevision,
+          enabled: command.enabled,
+          signupPolicy: command.signupPolicy,
+          applicationName: command.applicationName,
+          ...command.canonicalOrigin === void 0 ? {} : { canonicalOrigin: command.canonicalOrigin },
+          ...command.allowedRedirectPaths === void 0 ? {} : { allowedRedirectPaths: [...command.allowedRedirectPaths] },
+          ...command.resetPasswordPath === void 0 ? {} : { resetPasswordPath: command.resetPasswordPath },
+          ...command.invitationPath === void 0 ? {} : { invitationPath: command.invitationPath }
+        }
+      }, options);
+    case "provider_get": {
+      const result = await getNativeAuthProvider({ ...scope, provider: command.provider }, options);
+      return providerStatus(result);
+    }
+    case "provider_set": {
+      const result = await updateNativeAuthProvider({
+        ...scope,
+        provider: command.provider,
+        "Idempotency-Key": command.idempotencyKey,
+        nativeAuthProviderUpdateWritable: {
+          configurationRevision: command.configurationRevision,
+          enabled: command.enabled,
+          ...command.clientId === void 0 ? {} : { clientId: command.clientId },
+          ...command.clientSecret === void 0 ? {} : { clientSecret: command.clientSecret }
+        }
+      }, options);
+      return providerStatus(result);
+    }
+    case "users_list":
+      return listNativeAuthUsers({
+        ...scope,
+        ...command.limit === void 0 ? {} : { limit: command.limit },
+        ...command.cursor === void 0 ? {} : { cursor: command.cursor },
+        ...command.search === void 0 ? {} : { search: command.search }
+      }, options);
+    case "user_create":
+      return createNativeAuthUser({
+        ...scope,
+        "Idempotency-Key": command.idempotencyKey,
+        nativeAuthUserCreate: { email: command.email }
+      }, options);
+    case "user_get":
+      return getNativeAuthUser({ ...scope, user_id: command.userId }, options);
+    case "user_delete":
+      return deleteNativeAuthUser({ ...scope, user_id: command.userId, "Idempotency-Key": command.idempotencyKey }, options);
+    case "user_invite":
+      return resendNativeAuthInvitation({ ...scope, user_id: command.userId, "Idempotency-Key": command.idempotencyKey }, options);
+    case "user_suspend":
+      return suspendNativeAuthUser({ ...scope, user_id: command.userId, "Idempotency-Key": command.idempotencyKey }, options);
+    case "user_reactivate":
+      return reactivateNativeAuthUser({ ...scope, user_id: command.userId, "Idempotency-Key": command.idempotencyKey }, options);
+    case "user_revoke_sessions":
+      return revokeNativeAuthUserSessions({ ...scope, user_id: command.userId, "Idempotency-Key": command.idempotencyKey }, options);
+  }
+}
+function providerStatus(result) {
+  const { provider, enabled, configured, clientId, secretPresent, callbackUrl, scopes, lastSuccessfulFlowAt } = result;
+  return {
+    provider,
+    enabled,
+    configured,
+    clientId,
+    secretPresent,
+    callbackUrl,
+    scopes,
+    lastSuccessfulFlowAt
+  };
+}
+
 // apps/product-cli/dist/source-managed-client.js
 var GeneratedSdkManagedSourceApi = class {
   client;
@@ -33631,6 +34021,9 @@ var GeneratedSdkProductApi = class {
   managedMail(input) {
     return executeManagedMail(this.#client, input);
   }
+  nativeAuth(input) {
+    return executeNativeAuth(this.#client, input);
+  }
 };
 
 // apps/product-cli/dist/repository-init.js
@@ -34725,6 +35118,9 @@ var GeneratedSdkLocalMcpClient = class {
   managedMail(input) {
     return executeManagedMail(this.#client, input);
   }
+  nativeAuth(input) {
+    return executeNativeAuth(this.#client, input);
+  }
   planDelete(projectId) {
     return planProjectDeletion({ project_id: projectId }, { client: this.#client });
   }
@@ -35012,7 +35408,7 @@ var commitSha = external_exports.string().regex(/^[a-f0-9]{40}$/u);
 var domainName = external_exports.string().regex(/^(?=.{1,253}$)(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\.)+[a-z]{2,63}$/u);
 var secretName = external_exports.string().regex(USER_SECRET_NAME_PATTERN).refine((value) => isUserSecretName(value), "The secret name is platform-managed");
 var deletableSecretName = external_exports.string().regex(USER_SECRET_NAME_PATTERN).refine((value) => isUserSecretName(value, "delete"), "The secret key is installed by the platform");
-var LOCAL_SERVER_INSTRUCTIONS = "Continue an existing app from its reachable workspace and saved project binding. Reuse a matching local CLI/MCP profile or private token source unless the user chooses remote; verify its identity and workspace. connection_request availability alone never selects remote. If remote identity/workspace mismatches, stop the access-link loop. Unreachable local context is an access gap, not deleted credentials; never substitute an unrelated Review/demo account or change the saved source. Operate the user's ohmyho.st hosting account: projects, managed or GitHub sources and deployments, databases, domains, mail, usage and budgets. Use the existing project source binding first. A local or cloud workspace can contain Git without GitHub. If unbound current files have no relevant GitHub source, ask once whether to deploy directly with ohmyho.st saving versions or set up GitHub; do not require GitHub just because no connection exists. Read the resource skill://ohmyhost/ohmyhost-get-started/SKILL.md and verify the chosen access with identity_get; read project_context_get before acting on a project. This server is also ohmyho.st support: report a bug, issue or feature request with feedback_submit, give the user the receipt ID and follow up with feedback_status (https://docs.ohmyho.st/support).";
+var LOCAL_SERVER_INSTRUCTIONS = "Continue an existing app from its reachable workspace and saved project binding. Reuse a matching local CLI/MCP profile or private token source unless the user chooses remote; verify its identity and workspace. Remote tool availability alone never selects remote. If remote identity/workspace mismatches, stop the access-link loop. Unreachable local context is an access gap, not deleted credentials; never substitute an unrelated Review/demo account or change the saved source. Operate the user's ohmyho.st hosting account: projects, managed or GitHub sources and deployments, databases, domains, mail, usage and budgets. Use the existing project source binding first. A local or cloud workspace can contain Git without GitHub. If unbound current files have no relevant GitHub source, ask once whether to deploy directly with ohmyho.st saving versions or set up GitHub; do not require GitHub just because no connection exists. Read the resource skill://ohmyhost/ohmyhost-get-started/SKILL.md and verify the chosen access with identity_get; read project_context_get before acting on a project. This server is also ohmyho.st support: report a bug, issue or feature request with feedback_submit, give the user the receipt ID and follow up with feedback_status (https://docs.ohmyho.st/support).";
 function createLocalOhmyhostMcpServer(dependencies) {
   const { commandPrefix } = resolveProductCliEnvironment(dependencies.environment);
   const server = createOhmyhostMcpServer("ohmyhost-local", LOCAL_SERVER_INSTRUCTIONS);
@@ -35621,7 +36017,7 @@ function createLocalOhmyhostMcpServer(dependencies) {
       throw new Error("Managed source client is unavailable");
     return client2.managedSource.getSource(input.project_id);
   });
-  registerProductTool(server, dependencies, "deployment_plan", "Plan an immutable deployment. Preserve the customer's existing authentication integration, such as Better Auth or WorkOS, and use the same generic Next.js/Vite/TanStack runtime contract. ohmyho.st login is separate. Read the app Skill's auth guidance and report actual plan blockers, required secret names/callback configuration and unverified runtime compatibility. The explicitly selected managed Better Auth bridge requires the managed database; managed mail is optional, and its verification or password-reset send actions require a configured platform sender. Application-owned Better Auth handlers can use their own sender, including Resend, with auth.provider set to none. Never assume a working platform login proves application login or silently replace its auth provider. The plan builds into Dev unless environment is prod; prod builds straight into Prod without a Dev deployment (a project with shared data and a database must deploy to Dev and promote instead). The plan stays valid for 24 hours.", external_exports.object({
+  registerProductTool(server, dependencies, "deployment_plan", "Plan an immutable deployment. Preserve the customer's existing authentication integration, such as Better Auth or WorkOS, and use the same generic Next.js/Vite/TanStack runtime contract. ohmyho.st login is separate. Read the app Skill's auth guidance and report actual plan blockers, required secret names/callback configuration and unverified runtime compatibility. The explicitly selected managed Better Auth bridge requires the managed database; managed mail is optional, and its verification or password-reset send actions require a configured platform sender. Application-owned Better Auth handlers can use their own sender, including Resend, with auth.provider set to none. The unreleased omh-native capability is an explicit choice requiring Paid access, a verified sender and its separately metered Auth database; verify readiness and hosted support before claiming it works. Never assume a working platform login proves application login or silently replace its auth provider. The plan builds into Dev unless environment is prod; prod builds straight into Prod without a Dev deployment (a project with shared data and a database must deploy to Dev and promote instead). The plan stays valid for 24 hours.", external_exports.object({
     project_id: identifier2,
     commit_sha: commitSha,
     environment: external_exports.enum(["dev", "prod"]).optional()
@@ -36048,6 +36444,160 @@ function createLocalOhmyhostMcpServer(dependencies) {
       idempotencyKey: input.idempotency_key
     });
   }, destructiveAnnotations());
+  const nativeScope = { project_id: identifier2, environment_id: identifier2 };
+  const nativeProvider = external_exports.enum(["google", "github"]);
+  const nativeRun = (client2, command) => {
+    if (!client2.nativeAuth)
+      throw new Error("Native Auth unavailable");
+    return client2.nativeAuth(command);
+  };
+  registerProductTool(server, dependencies, "native_auth_config_get", "Read Owner Native Auth configuration and readiness.", external_exports.object(nativeScope), (client2, input) => nativeRun(client2, {
+    action: "config_get",
+    projectId: input.project_id,
+    environmentId: input.environment_id
+  }));
+  registerProductTool(server, dependencies, "native_auth_config_set", "Update Owner Native Auth configuration at the current revision.", external_exports.object({
+    ...nativeScope,
+    configuration_revision: external_exports.number().int().min(0),
+    enabled: external_exports.boolean(),
+    signup_policy: external_exports.enum(["open", "invite-only"]),
+    application_name: external_exports.string().trim().min(1).max(128).refine((value) => !new RegExp("\\p{Cc}", "u").test(value)),
+    canonical_origin: external_exports.string().url().refine((value) => {
+      try {
+        const url = new URL(value);
+        return url.protocol === "https:" && url.origin === value && !url.username && !url.password;
+      } catch {
+        return false;
+      }
+    }).nullable().optional(),
+    allowed_redirect_paths: external_exports.array(external_exports.string().refine(isNativeAuthRedirectPath)).min(1).max(16).refine((paths) => new Set(paths).size === paths.length).optional(),
+    reset_password_path: external_exports.string().refine(isNativeAuthRedirectPath).optional(),
+    invitation_path: external_exports.string().refine(isNativeAuthRedirectPath).optional(),
+    idempotency_key: idempotencyKey
+  }), (client2, input) => {
+    const paths = input.allowed_redirect_paths;
+    if (paths && [input.reset_password_path, input.invitation_path].some((path2) => path2 !== void 0 && !paths.includes(path2)))
+      throw new TypeError("Native Auth form path must be in the redirect allowlist");
+    return nativeRun(client2, {
+      action: "config_set",
+      projectId: input.project_id,
+      environmentId: input.environment_id,
+      configurationRevision: input.configuration_revision,
+      enabled: input.enabled,
+      signupPolicy: input.signup_policy,
+      applicationName: input.application_name,
+      ...input.canonical_origin === void 0 ? {} : { canonicalOrigin: input.canonical_origin },
+      ...input.allowed_redirect_paths === void 0 ? {} : { allowedRedirectPaths: input.allowed_redirect_paths },
+      ...input.reset_password_path === void 0 ? {} : { resetPasswordPath: input.reset_password_path },
+      ...input.invitation_path === void 0 ? {} : { invitationPath: input.invitation_path },
+      idempotencyKey: input.idempotency_key
+    });
+  }, mutationAnnotations());
+  registerProductTool(server, dependencies, "native_auth_provider_get", "Read provider setup without its secret.", external_exports.object({ ...nativeScope, provider: nativeProvider }), (client2, input) => nativeRun(client2, {
+    action: "provider_get",
+    projectId: input.project_id,
+    environmentId: input.environment_id,
+    provider: input.provider
+  }));
+  registerProductTool(server, dependencies, "native_auth_provider_set", "Update provider settings without submitting a secret.", external_exports.object({
+    ...nativeScope,
+    provider: nativeProvider,
+    configuration_revision: external_exports.number().int().min(0),
+    enabled: external_exports.boolean(),
+    client_id: external_exports.string().min(1).max(1024).optional(),
+    idempotency_key: idempotencyKey
+  }).strict(), (client2, input) => nativeRun(client2, {
+    action: "provider_set",
+    projectId: input.project_id,
+    environmentId: input.environment_id,
+    provider: input.provider,
+    configurationRevision: input.configuration_revision,
+    enabled: input.enabled,
+    ...input.client_id === void 0 ? {} : { clientId: input.client_id },
+    idempotencyKey: input.idempotency_key
+  }), mutationAnnotations());
+  registerProductTool(server, dependencies, "native_auth_users_list", "List Native Auth users with bounded pagination.", external_exports.object({
+    ...nativeScope,
+    limit: external_exports.number().int().min(1).max(100).optional(),
+    cursor: external_exports.string().min(1).max(512).optional(),
+    search: external_exports.string().min(1).max(320).optional()
+  }), (client2, input) => nativeRun(client2, {
+    action: "users_list",
+    projectId: input.project_id,
+    environmentId: input.environment_id,
+    ...input.limit === void 0 ? {} : { limit: input.limit },
+    ...input.cursor === void 0 ? {} : { cursor: input.cursor },
+    ...input.search === void 0 ? {} : { search: input.search }
+  }));
+  registerProductTool(server, dependencies, "native_auth_user_create", "Create and invite a Native Auth user without choosing a password.", external_exports.object({
+    ...nativeScope,
+    email: external_exports.string().email().max(254),
+    idempotency_key: idempotencyKey
+  }), (client2, input) => nativeRun(client2, {
+    action: "user_create",
+    projectId: input.project_id,
+    environmentId: input.environment_id,
+    email: input.email,
+    idempotencyKey: input.idempotency_key
+  }), mutationAnnotations());
+  registerProductTool(server, dependencies, "native_auth_user_get", "Read a Native Auth user.", external_exports.object({ ...nativeScope, user_id: external_exports.string().uuid() }), (client2, input) => nativeRun(client2, {
+    action: "user_get",
+    projectId: input.project_id,
+    environmentId: input.environment_id,
+    userId: input.user_id
+  }));
+  const nativeUserActionInput = external_exports.object({
+    ...nativeScope,
+    user_id: external_exports.string().uuid(),
+    idempotency_key: idempotencyKey,
+    confirm: external_exports.literal(true)
+  });
+  const nativeUserAction = (action) => (client2, input) => nativeRun(client2, {
+    action,
+    projectId: input.project_id,
+    environmentId: input.environment_id,
+    userId: input.user_id,
+    idempotencyKey: input.idempotency_key
+  });
+  registerProductTool(server, dependencies, "native_auth_user_delete", "Delete an Owner-authorized Native Auth user.", nativeUserActionInput, nativeUserAction("user_delete"), destructiveAnnotations());
+  registerProductTool(server, dependencies, "native_auth_user_invite", "Resend an Owner-authorized Native Auth user's invitation.", nativeUserActionInput, nativeUserAction("user_invite"), destructiveAnnotations());
+  registerProductTool(server, dependencies, "native_auth_user_suspend", "Suspend an Owner-authorized Native Auth user.", nativeUserActionInput, nativeUserAction("user_suspend"), destructiveAnnotations());
+  registerProductTool(server, dependencies, "native_auth_user_reactivate", "Reactivate an Owner-authorized Native Auth user.", nativeUserActionInput, nativeUserAction("user_reactivate"), destructiveAnnotations());
+  registerProductTool(server, dependencies, "native_auth_user_revoke_sessions", "Revoke an Owner-authorized Native Auth user's sessions.", nativeUserActionInput, nativeUserAction("user_revoke_sessions"), destructiveAnnotations());
+  registerProductTool(server, dependencies, "native_auth_provider_secret_input_request", "Return an account-bound stdin-only command; never place a provider secret in MCP arguments.", external_exports.object({
+    ...nativeScope,
+    provider: nativeProvider,
+    configuration_revision: external_exports.number().int().min(0),
+    enabled: external_exports.boolean(),
+    client_id: external_exports.string().min(1).max(1024).optional(),
+    idempotency_key: idempotencyKey
+  }).strict(), async (client2, input, signal) => {
+    await client2.getProject(input.project_id);
+    const account = await handoverAccount(client2, signal);
+    return {
+      command: [
+        `${commandPrefix} auth provider set`,
+        "--project",
+        shellQuote(input.project_id),
+        "--environment",
+        shellQuote(input.environment_id),
+        "--provider",
+        input.provider,
+        "--revision",
+        String(input.configuration_revision),
+        "--enabled",
+        String(input.enabled),
+        ...input.client_id === void 0 ? [] : ["--client-id", shellQuote(input.client_id)],
+        "--idempotency-key",
+        shellQuote(input.idempotency_key),
+        ...account.flags,
+        "--stdin",
+        "--json"
+      ].join(" "),
+      acting_as: client2.actingAs?.() ?? null,
+      instruction: `Pass the provider secret on stdin in a local terminal; ${account.runs}. Never put it in MCP, arguments, source, or logs.`
+    };
+  });
   registerProductTool(server, dependencies, "secrets_list", "List secret metadata without values", external_exports.object({ project_id: identifier2, environment_id: identifier2 }), (client2, input) => client2.listEnvironmentSecrets({
     projectId: input.project_id,
     environmentId: input.environment_id