@amerged/ohmyhost-mcp 0.1.48 → 0.1.50

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@amerged/ohmyhost-mcp",
-  "version": "0.1.48",
+  "version": "0.1.50",
   "type": "module",
   "engines": {
     "node": ">=22"

package/src/apps/mcp/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ohmyhost/mcp",
-  "version": "0.1.48",
+  "version": "0.1.50",
   "private": true,
   "ohmyhost": {
     "deployment": "production",

package/src/apps/mcp/src/local-client.ts

@@ -4,6 +4,7 @@ import {
   type ManagedMailCommand,
   type SharedMailCommand,
 } from "@ohmyhost/sdk-ts";
+import { executeNativeAuth, type NativeAuthCommand } from "@ohmyhost/product-cli";
 import {
   assertProjectDatabaseAccess,
   assertProjectDatabaseAccessCredential,
@@ -1156,6 +1157,10 @@ export class GeneratedSdkLocalMcpClient implements LocalMcpProductClient {
   public managedMail(input: ManagedMailCommand) {
     return executeManagedMail(this.#client, input);
   }
+
+  public nativeAuth(input: NativeAuthCommand) {
+    return executeNativeAuth(this.#client, input);
+  }
   public planDelete(projectId: string) {
     return planProjectDeletion({ project_id: projectId }, { client: this.#client });
   }

package/src/apps/mcp/src/local-server.ts

@@ -1,4 +1,5 @@
 import { isUserSecretName, USER_SECRET_NAME_PATTERN } from "@ohmyhost/contracts/secret-names";
+import { isNativeAuthRedirectPath } from "@ohmyhost/contracts/native-auth";
 import type { DatabaseComputeSelection } from "@ohmyhost/contracts/database-sizes";
 import {
   DATABASE_WEBHOOK_EVENT_TYPES,
@@ -136,6 +137,7 @@ interface DatabaseScheduleSetInput extends DatabaseScheduleTarget {
 }
 
 export interface LocalMcpProductClient {
+  nativeAuth?(input: import("@ohmyhost/product-cli").NativeAuthCommand): Promise<unknown>;
   readonly managedSource?: ManagedSourceApi;
   readonly productApiOrigin?: string;
   checkProjectHandle(input: { handle: string }): Promise<unknown>;
@@ -612,7 +614,7 @@ const deletableSecretName = z
   );
 
 const LOCAL_SERVER_INSTRUCTIONS =
-  "Continue an existing app from its reachable workspace and saved project binding. Reuse a matching local CLI/MCP profile or private token source unless the user chooses remote; verify its identity and workspace. connection_request availability alone never selects remote. If remote identity/workspace mismatches, stop the access-link loop. Unreachable local context is an access gap, not deleted credentials; never substitute an unrelated Review/demo account or change the saved source. " +
+  "Continue an existing app from its reachable workspace and saved project binding. Reuse a matching local CLI/MCP profile or private token source unless the user chooses remote; verify its identity and workspace. Remote tool availability alone never selects remote. If remote identity/workspace mismatches, stop the access-link loop. Unreachable local context is an access gap, not deleted credentials; never substitute an unrelated Review/demo account or change the saved source. " +
   "Operate the user's ohmyho.st hosting account: projects, managed or GitHub sources and deployments, databases, domains, mail, usage and budgets. " +
   "Use the existing project source binding first. A local or cloud workspace can contain Git without GitHub. If unbound current files have no relevant GitHub source, ask once whether to deploy directly with ohmyho.st saving versions or set up GitHub; do not require GitHub just because no connection exists. " +
   "Read the resource skill://ohmyhost/ohmyhost-get-started/SKILL.md and verify the chosen access with identity_get; read project_context_get before acting on a project. " +
@@ -1952,7 +1954,7 @@ export function createLocalOhmyhostMcpServer(dependencies: LocalOhmyhostMcpDepen
     server,
     dependencies,
     "deployment_plan",
-    "Plan an immutable deployment. Preserve the customer's existing authentication integration, such as Better Auth or WorkOS, and use the same generic Next.js/Vite/TanStack runtime contract. ohmyho.st login is separate. Read the app Skill's auth guidance and report actual plan blockers, required secret names/callback configuration and unverified runtime compatibility. The explicitly selected managed Better Auth bridge requires the managed database; managed mail is optional, and its verification or password-reset send actions require a configured platform sender. Application-owned Better Auth handlers can use their own sender, including Resend, with auth.provider set to none. Never assume a working platform login proves application login or silently replace its auth provider. The plan builds into Dev unless environment is prod; prod builds straight into Prod without a Dev deployment (a project with shared data and a database must deploy to Dev and promote instead). The plan stays valid for 24 hours.",
+    "Plan an immutable deployment. Preserve the customer's existing authentication integration, such as Better Auth or WorkOS, and use the same generic Next.js/Vite/TanStack runtime contract. ohmyho.st login is separate. Read the app Skill's auth guidance and report actual plan blockers, required secret names/callback configuration and unverified runtime compatibility. The explicitly selected managed Better Auth bridge requires the managed database; managed mail is optional, and its verification or password-reset send actions require a configured platform sender. Application-owned Better Auth handlers can use their own sender, including Resend, with auth.provider set to none. The unreleased omh-native capability is an explicit choice requiring Paid access, a verified sender and its separately metered Auth database; verify readiness and hosted support before claiming it works. Never assume a working platform login proves application login or silently replace its auth provider. The plan builds into Dev unless environment is prod; prod builds straight into Prod without a Dev deployment (a project with shared data and a database must deploy to Dev and promote instead). The plan stays valid for 24 hours.",
     z.object({
       project_id: identifier,
       commit_sha: commitSha,
@@ -2653,6 +2655,310 @@ export function createLocalOhmyhostMcpServer(dependencies: LocalOhmyhostMcpDepen
     },
     destructiveAnnotations(),
   );
+  const nativeScope = { project_id: identifier, environment_id: identifier };
+  const nativeProvider = z.enum(["google", "github"]);
+  const nativeRun = (
+    client: LocalMcpProductClient,
+    command: import("@ohmyhost/product-cli").NativeAuthCommand,
+  ) => {
+    if (!client.nativeAuth) throw new Error("Native Auth unavailable");
+    return client.nativeAuth(command);
+  };
+  registerProductTool(
+    server,
+    dependencies,
+    "native_auth_config_get",
+    "Read Owner Native Auth configuration and readiness.",
+    z.object(nativeScope),
+    (client, input) =>
+      nativeRun(client, {
+        action: "config_get",
+        projectId: input.project_id,
+        environmentId: input.environment_id,
+      }),
+  );
+  registerProductTool(
+    server,
+    dependencies,
+    "native_auth_config_set",
+    "Update Owner Native Auth configuration at the current revision.",
+    z.object({
+      ...nativeScope,
+      configuration_revision: z.number().int().min(0),
+      enabled: z.boolean(),
+      signup_policy: z.enum(["open", "invite-only"]),
+      application_name: z
+        .string()
+        .trim()
+        .min(1)
+        .max(128)
+        .refine((value) => !/\p{Cc}/u.test(value)),
+      canonical_origin: z
+        .string()
+        .url()
+        .refine((value) => {
+          try {
+            const url = new URL(value);
+            return (
+              url.protocol === "https:" && url.origin === value && !url.username && !url.password
+            );
+          } catch {
+            return false;
+          }
+        })
+        .nullable()
+        .optional(),
+      allowed_redirect_paths: z
+        .array(z.string().refine(isNativeAuthRedirectPath))
+        .min(1)
+        .max(16)
+        .refine((paths) => new Set(paths).size === paths.length)
+        .optional(),
+      reset_password_path: z.string().refine(isNativeAuthRedirectPath).optional(),
+      invitation_path: z.string().refine(isNativeAuthRedirectPath).optional(),
+      idempotency_key: idempotencyKey,
+    }),
+    (client, input) => {
+      const paths = input.allowed_redirect_paths;
+      if (
+        paths &&
+        [input.reset_password_path, input.invitation_path].some(
+          (path) => path !== undefined && !paths.includes(path),
+        )
+      )
+        throw new TypeError("Native Auth form path must be in the redirect allowlist");
+      return nativeRun(client, {
+        action: "config_set",
+        projectId: input.project_id,
+        environmentId: input.environment_id,
+        configurationRevision: input.configuration_revision,
+        enabled: input.enabled,
+        signupPolicy: input.signup_policy,
+        applicationName: input.application_name,
+        ...(input.canonical_origin === undefined
+          ? {}
+          : { canonicalOrigin: input.canonical_origin }),
+        ...(input.allowed_redirect_paths === undefined
+          ? {}
+          : { allowedRedirectPaths: input.allowed_redirect_paths }),
+        ...(input.reset_password_path === undefined
+          ? {}
+          : { resetPasswordPath: input.reset_password_path }),
+        ...(input.invitation_path === undefined ? {} : { invitationPath: input.invitation_path }),
+        idempotencyKey: input.idempotency_key,
+      });
+    },
+    mutationAnnotations(),
+  );
+  registerProductTool(
+    server,
+    dependencies,
+    "native_auth_provider_get",
+    "Read provider setup without its secret.",
+    z.object({ ...nativeScope, provider: nativeProvider }),
+    (client, input) =>
+      nativeRun(client, {
+        action: "provider_get",
+        projectId: input.project_id,
+        environmentId: input.environment_id,
+        provider: input.provider,
+      }),
+  );
+  registerProductTool(
+    server,
+    dependencies,
+    "native_auth_provider_set",
+    "Update provider settings without submitting a secret.",
+    z
+      .object({
+        ...nativeScope,
+        provider: nativeProvider,
+        configuration_revision: z.number().int().min(0),
+        enabled: z.boolean(),
+        client_id: z.string().min(1).max(1024).optional(),
+        idempotency_key: idempotencyKey,
+      })
+      .strict(),
+    (client, input) =>
+      nativeRun(client, {
+        action: "provider_set",
+        projectId: input.project_id,
+        environmentId: input.environment_id,
+        provider: input.provider,
+        configurationRevision: input.configuration_revision,
+        enabled: input.enabled,
+        ...(input.client_id === undefined ? {} : { clientId: input.client_id }),
+        idempotencyKey: input.idempotency_key,
+      }),
+    mutationAnnotations(),
+  );
+  registerProductTool(
+    server,
+    dependencies,
+    "native_auth_users_list",
+    "List Native Auth users with bounded pagination.",
+    z.object({
+      ...nativeScope,
+      limit: z.number().int().min(1).max(100).optional(),
+      cursor: z.string().min(1).max(512).optional(),
+      search: z.string().min(1).max(320).optional(),
+    }),
+    (client, input) =>
+      nativeRun(client, {
+        action: "users_list",
+        projectId: input.project_id,
+        environmentId: input.environment_id,
+        ...(input.limit === undefined ? {} : { limit: input.limit }),
+        ...(input.cursor === undefined ? {} : { cursor: input.cursor }),
+        ...(input.search === undefined ? {} : { search: input.search }),
+      }),
+  );
+  registerProductTool(
+    server,
+    dependencies,
+    "native_auth_user_create",
+    "Create and invite a Native Auth user without choosing a password.",
+    z.object({
+      ...nativeScope,
+      email: z.string().email().max(254),
+      idempotency_key: idempotencyKey,
+    }),
+    (client, input) =>
+      nativeRun(client, {
+        action: "user_create",
+        projectId: input.project_id,
+        environmentId: input.environment_id,
+        email: input.email,
+        idempotencyKey: input.idempotency_key,
+      }),
+    mutationAnnotations(),
+  );
+  registerProductTool(
+    server,
+    dependencies,
+    "native_auth_user_get",
+    "Read a Native Auth user.",
+    z.object({ ...nativeScope, user_id: z.string().uuid() }),
+    (client, input) =>
+      nativeRun(client, {
+        action: "user_get",
+        projectId: input.project_id,
+        environmentId: input.environment_id,
+        userId: input.user_id,
+      }),
+  );
+  const nativeUserActionInput = z.object({
+    ...nativeScope,
+    user_id: z.string().uuid(),
+    idempotency_key: idempotencyKey,
+    confirm: z.literal(true),
+  });
+  const nativeUserAction =
+    (
+      action:
+        | "user_delete"
+        | "user_invite"
+        | "user_suspend"
+        | "user_reactivate"
+        | "user_revoke_sessions",
+    ) =>
+    (client: LocalMcpProductClient, input: z.infer<typeof nativeUserActionInput>) =>
+      nativeRun(client, {
+        action,
+        projectId: input.project_id,
+        environmentId: input.environment_id,
+        userId: input.user_id,
+        idempotencyKey: input.idempotency_key,
+      });
+  registerProductTool(
+    server,
+    dependencies,
+    "native_auth_user_delete",
+    "Delete an Owner-authorized Native Auth user.",
+    nativeUserActionInput,
+    nativeUserAction("user_delete"),
+    destructiveAnnotations(),
+  );
+  registerProductTool(
+    server,
+    dependencies,
+    "native_auth_user_invite",
+    "Resend an Owner-authorized Native Auth user's invitation.",
+    nativeUserActionInput,
+    nativeUserAction("user_invite"),
+    destructiveAnnotations(),
+  );
+  registerProductTool(
+    server,
+    dependencies,
+    "native_auth_user_suspend",
+    "Suspend an Owner-authorized Native Auth user.",
+    nativeUserActionInput,
+    nativeUserAction("user_suspend"),
+    destructiveAnnotations(),
+  );
+  registerProductTool(
+    server,
+    dependencies,
+    "native_auth_user_reactivate",
+    "Reactivate an Owner-authorized Native Auth user.",
+    nativeUserActionInput,
+    nativeUserAction("user_reactivate"),
+    destructiveAnnotations(),
+  );
+  registerProductTool(
+    server,
+    dependencies,
+    "native_auth_user_revoke_sessions",
+    "Revoke an Owner-authorized Native Auth user's sessions.",
+    nativeUserActionInput,
+    nativeUserAction("user_revoke_sessions"),
+    destructiveAnnotations(),
+  );
+  registerProductTool(
+    server,
+    dependencies,
+    "native_auth_provider_secret_input_request",
+    "Return an account-bound stdin-only command; never place a provider secret in MCP arguments.",
+    z
+      .object({
+        ...nativeScope,
+        provider: nativeProvider,
+        configuration_revision: z.number().int().min(0),
+        enabled: z.boolean(),
+        client_id: z.string().min(1).max(1024).optional(),
+        idempotency_key: idempotencyKey,
+      })
+      .strict(),
+    async (client, input, signal) => {
+      await client.getProject(input.project_id);
+      const account = await handoverAccount(client, signal);
+      return {
+        command: [
+          `${commandPrefix} auth provider set`,
+          "--project",
+          shellQuote(input.project_id),
+          "--environment",
+          shellQuote(input.environment_id),
+          "--provider",
+          input.provider,
+          "--revision",
+          String(input.configuration_revision),
+          "--enabled",
+          String(input.enabled),
+          ...(input.client_id === undefined ? [] : ["--client-id", shellQuote(input.client_id)]),
+          "--idempotency-key",
+          shellQuote(input.idempotency_key),
+          ...account.flags,
+          "--stdin",
+          "--json",
+        ].join(" "),
+        acting_as: client.actingAs?.() ?? null,
+        instruction: `Pass the provider secret on stdin in a local terminal; ${account.runs}. Never put it in MCP, arguments, source, or logs.`,
+      };
+    },
+  );
+
   registerProductTool(
     server,
     dependencies,

package/src/apps/product-cli/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ohmyhost/product-cli",
-  "version": "0.1.48",
+  "version": "0.1.50",
   "private": true,
   "ohmyhost": {
     "deployment": "production",

package/src/apps/product-cli/src/cli.ts

@@ -518,6 +518,7 @@ const HELP_USAGE = Object.freeze({
     "ohmyhost function runs --project ULID --environment ENVIRONMENT_ULID [--limit 1-100] --json",
   "secret set":
     "printf '%s' \"$SECRET_VALUE\" | ohmyhost secret set NAME --project ULID --environment ENVIRONMENT_ULID --idempotency-key KEY [--profile-user USER_ID --profile-organization ULID | --token-user USER_ID --token-organization ULID] --stdin [--wait] --json (with --profile-user and --profile-organization the saved login that runs it must belong to that user and organization; with --token-user and --token-organization it runs only with an OHMYHOST_TOKEN of that user and organization, never with a saved login)",
+  auth: "ohmyhost auth config get|set --project ULID --environment ULID [--revision N --enabled true|false --signup-policy open|invite-only --application-name NAME --idempotency-key KEY] [--canonical-origin URL|primary] [--allowed-redirect-paths JSON_ARRAY --reset-password-path PATH --invitation-path PATH]; auth provider get|set --project ULID --environment ULID --provider google|github [--revision N --enabled true|false --client-id ID --idempotency-key KEY --stdin]; auth users list --project ULID --environment ULID [--limit N --cursor CURSOR --search TEXT]; auth user create|get|delete|invite|suspend|reactivate|revoke-sessions --project ULID --environment ULID [--email EMAIL | --user UUID] [--idempotency-key KEY]. Provider secrets are read only from stdin; use --json.",
   "secret delete":
     "ohmyhost secret delete NAME --project ULID --environment ENVIRONMENT_ULID --idempotency-key KEY [--wait] --json",
   "mail workspace list": "ohmyhost mail workspace list --organization ULID --json",
@@ -1276,6 +1277,26 @@ export class ProductCli {
       if (command.kind === "secret-list") return await this.listEnvironmentSecrets(command, signal);
       if (command.kind === "function-runs") return await this.listFunctionRuns(command, signal);
       if (command.kind === "secret-set") return await this.putEnvironmentSecret(command, signal);
+      if (command.kind === "native-auth") {
+        const api = await this.authenticatedApi(command.credentialStore, signal);
+        if (!api.nativeAuth) throw new Error("Native Auth unavailable");
+        if (command.stdin && command.request.action === "provider_set") {
+          const secret = await this.dependencies.readSecretValue(signal);
+          const bytes = new TextEncoder().encode(secret);
+          if (bytes.length === 0 || bytes.length > 5120) {
+            bytes.fill(0);
+            throw new SecretInputError();
+          }
+          try {
+            return success("auth", {
+              auth: await api.nativeAuth({ ...command.request, clientSecret: secret }),
+            });
+          } finally {
+            bytes.fill(0);
+          }
+        }
+        return success("auth", { auth: await api.nativeAuth(command.request) });
+      }
       if (command.kind === "shared-mail") {
         const api = await this.authenticatedApi(command.credentialStore, signal);
         if (!api.sharedMail) throw new Error("Shared mail unavailable");
@@ -3693,6 +3714,7 @@ const parsedCommandName = (command: ProductCliCommand): CommandLabel => {
   if (command.kind === "function-runs") return "function runs";
   if (command.kind === "secret-set") return "secret set";
   if (command.kind === "secret-delete") return "secret delete";
+  if (command.kind === "native-auth") return "auth";
   if (command.kind === "shared-mail" || command.kind === "managed-mail") return command.label;
   if (command.kind === "profile-list") return "profile list";
   return command.kind;