@amerged/ohmyhost-mcp 0.1.49 → 0.1.50

package/dist/index.js

@@ -2,7 +2,7 @@ import { createRequire as __ohmyhostCreateRequire } from "node:module"; const re
 import {
   createOhmyhostMcpServer,
   ohmyhostMcpHandler
-} from "./chunk-GLPFLQD6.js";
+} from "./chunk-MYCLNNZ7.js";
 export {
   createOhmyhostMcpServer,
   ohmyhostMcpHandler

package/dist/stdio-main.js

@@ -30,7 +30,7 @@ import {
   serverIdentityOf,
   setNegotiatedProtocolVersion,
   validateEnvelopeMeta
-} from "./chunk-GLPFLQD6.js";
+} from "./chunk-MYCLNNZ7.js";
 
 // node_modules/.pnpm/ignore@7.0.12/node_modules/ignore/index.js
 var require_ignore = __commonJS({
@@ -24019,6 +24019,10 @@ var BUILD_FRAMEWORKS = Object.freeze([
 var PUSH_AND_PLAN = "Commit and push the change, then plan the new commit.";
 var VITE_BUILD_SCRIPT = '"vite build", optionally joined with && to one "tsc", "tsc -b", "tsc --build" or "tsc --noEmit" stage';
 var FRAMEWORK_CONVERSION_DETAILS = Object.freeze({
+  native_auth_route_conflict: {
+    paths: ["module"],
+    template: '"{{path}}" declares a route in the reserved /api/auth/v1 namespace. Move the route or select a different authentication provider. Commit and push the change, then plan the new commit.'
+  },
   astro_template_import_unsupported: {
     paths: ["module"],
     template: '"{{path}}" uses a dynamic import, import.meta or require in an Astro template. Move server imports into frontmatter and dynamic browser imports into a normal statically imported browser module, then commit and push the change and plan the new commit.'
@@ -25688,7 +25692,7 @@ var PROBLEM_POLICY = {
   project_rename_blocked: {
     status: 409,
     retryable: true,
-    action: "Wait for the running operation to finish, read the project again, then rename with the new ETag.",
+    action: "Read project status and finish or retry any pending Native Auth deployment or other operation. Once preparation is complete, read the project again and rename with its current ETag.",
     title: "Project address change blocked"
   },
   project_identity_unavailable: {
@@ -25947,6 +25951,12 @@ var PROBLEM_POLICY = {
     retryable: false,
     title: "Remove the project domain first",
     action: "This project still has a live or pending custom-domain connection. Read 'ohmyhost domain paid status --project ULID --json', remove that connection with 'ohmyhost domain paid delete --project ULID --hostname HOST --yes --json', then create a fresh project deletion plan. Repeating while it remains connected cannot work."
+  },
+  native_domain_sync_pending: {
+    status: 409,
+    retryable: false,
+    title: "Complete the pending domain change",
+    action: "Read project status and Paid domain status to identify the pending change. If a Paid domain removal is pending, retry it as a current owner with a new idempotency key. If a project address change is pending, submit a fresh address change as a current owner. After it finishes, create a new project deletion plan."
   }
 };
 
@@ -27413,7 +27423,7 @@ function exact4(value, keys) {
 // apps/product-cli/package.json
 var package_default2 = {
   name: "@ohmyhost/product-cli",
-  version: "0.1.49",
+  version: "0.1.50",
   private: true,
   ohmyhost: {
     deployment: "production",
@@ -27523,7 +27533,17 @@ function assertProjectExport(value) {
       invalid4();
     return;
   }
-  if (value["state"] !== "succeeded" || !record6(archive) || Object.keys(archive).sort().join(",") !== "bytes,captured_at,download_expires_at,download_url,expires_at,sha256,sql_files" || !Number.isSafeInteger(archive["bytes"]) || Number(archive["bytes"]) < 1 || Number(archive["bytes"]) > 536870912 || typeof archive["sha256"] !== "string" || !/^sha256:[a-f0-9]{64}$/u.test(archive["sha256"]) || !['["dev.sql"]', '["prod.sql"]', '["dev.sql","prod.sql"]', '["shared.sql"]'].includes(JSON.stringify(archive["sql_files"])) || !timestamp5(archive["captured_at"]) || !timestamp5(archive["expires_at"]))
+  if (value["state"] !== "succeeded" || !record6(archive) || Object.keys(archive).sort().join(",") !== "bytes,captured_at,download_expires_at,download_url,expires_at,sha256,sql_files" || !Number.isSafeInteger(archive["bytes"]) || Number(archive["bytes"]) < 1 || Number(archive["bytes"]) > 536870912 || typeof archive["sha256"] !== "string" || !/^sha256:[a-f0-9]{64}$/u.test(archive["sha256"]) || ![
+    '["dev.sql"]',
+    '["prod.sql"]',
+    '["dev.sql","prod.sql"]',
+    '["shared.sql"]',
+    '["auth.sql"]',
+    '["dev.sql","auth.sql"]',
+    '["prod.sql","auth.sql"]',
+    '["dev.sql","prod.sql","auth.sql"]',
+    '["shared.sql","auth.sql"]'
+  ].includes(JSON.stringify(archive["sql_files"])) || !timestamp5(archive["captured_at"]) || !timestamp5(archive["expires_at"]))
     invalid4();
   if (archive["download_url"] === null) {
     if (archive["download_expires_at"] !== null)
@@ -28027,6 +28047,41 @@ function onlyKeys(value, allowed) {
   return Object.keys(value).every((key) => allowed.includes(key));
 }
 
+// packages/contracts/dist/native-auth.js
+var NATIVE_AUTH_DEFAULT_REDIRECT_PATHS = Object.freeze([
+  "/",
+  "/login",
+  "/reset-password",
+  "/accept-invitation"
+]);
+function isNativeAuthRedirectPath(value) {
+  return typeof value === "string" && value.length <= 256 && /^\/[A-Za-z0-9/_~.-]*$/u.test(value) && !value.includes("//") && !value.split("/").some((segment) => segment === "." || segment === "..");
+}
+var PUBLIC_ROUTES = Object.freeze({
+  GET: Object.freeze([
+    "/get-session",
+    "/verify-email",
+    "/callback/google",
+    "/callback/github",
+    "/list-accounts"
+  ]),
+  POST: Object.freeze([
+    "/sign-up/email",
+    "/sign-in/email",
+    "/sign-in/social",
+    "/sign-out",
+    "/request-password-reset",
+    "/reset-password",
+    "/change-password",
+    "/send-verification-email",
+    "/link-social",
+    "/unlink-account",
+    "/accept-invitation",
+    "/reauthenticate",
+    "/enroll-recovery"
+  ])
+});
+
 // packages/workos-auth-contracts/dist/user-api-keys.js
 var WORKOS_USER_API_KEY_PATTERN = /^sk_[A-Za-z0-9_-]{20,128}$/u;
 
@@ -28745,6 +28800,7 @@ var HELP_USAGE = Object.freeze({
   "secret list": "ohmyhost secret list --project ULID --environment ENVIRONMENT_ULID --json",
   "function runs": "ohmyhost function runs --project ULID --environment ENVIRONMENT_ULID [--limit 1-100] --json",
   "secret set": `printf '%s' "$SECRET_VALUE" | ohmyhost secret set NAME --project ULID --environment ENVIRONMENT_ULID --idempotency-key KEY [--profile-user USER_ID --profile-organization ULID | --token-user USER_ID --token-organization ULID] --stdin [--wait] --json (with --profile-user and --profile-organization the saved login that runs it must belong to that user and organization; with --token-user and --token-organization it runs only with an OHMYHOST_TOKEN of that user and organization, never with a saved login)`,
+  auth: "ohmyhost auth config get|set --project ULID --environment ULID [--revision N --enabled true|false --signup-policy open|invite-only --application-name NAME --idempotency-key KEY] [--canonical-origin URL|primary] [--allowed-redirect-paths JSON_ARRAY --reset-password-path PATH --invitation-path PATH]; auth provider get|set --project ULID --environment ULID --provider google|github [--revision N --enabled true|false --client-id ID --idempotency-key KEY --stdin]; auth users list --project ULID --environment ULID [--limit N --cursor CURSOR --search TEXT]; auth user create|get|delete|invite|suspend|reactivate|revoke-sessions --project ULID --environment ULID [--email EMAIL | --user UUID] [--idempotency-key KEY]. Provider secrets are read only from stdin; use --json.",
   "secret delete": "ohmyhost secret delete NAME --project ULID --environment ENVIRONMENT_ULID --idempotency-key KEY [--wait] --json",
   "mail workspace list": "ohmyhost mail workspace list --organization ULID --json",
   "mail workspace create": "ohmyhost mail workspace create --organization ULID --domain DOMAIN --sending true --idempotency-key KEY --json",
@@ -29623,6 +29679,259 @@ var createClient = (config = {}) => {
 var client = createClient(createConfig({ throwOnError: true }));
 
 // packages/sdk-ts/dist/generated/sdk.gen.js
+var getNativeAuthConfiguration = (parameters, options) => {
+  const params = buildClientParams([parameters], [
+    {
+      args: [
+        { in: "headers", key: "X-Request-Id" },
+        { in: "path", key: "project_id" },
+        { in: "path", key: "environment_id" }
+      ]
+    }
+  ]);
+  return (options?.client ?? client).get({
+    responseStyle: "data",
+    security: [{ scheme: "bearer", type: "http" }],
+    url: "/v1/projects/{project_id}/environments/{environment_id}/auth",
+    ...options,
+    ...params
+  });
+};
+var updateNativeAuthConfiguration = (parameters, options) => {
+  const params = buildClientParams([parameters], [
+    {
+      args: [
+        { in: "headers", key: "X-Request-Id" },
+        { in: "headers", key: "Idempotency-Key" },
+        { in: "path", key: "project_id" },
+        { in: "path", key: "environment_id" },
+        { key: "nativeAuthConfigurationUpdate", map: "body" }
+      ]
+    }
+  ]);
+  return (options?.client ?? client).put({
+    responseStyle: "data",
+    security: [{ scheme: "bearer", type: "http" }],
+    url: "/v1/projects/{project_id}/environments/{environment_id}/auth",
+    ...options,
+    ...params,
+    headers: {
+      "Content-Type": "application/json",
+      ...options?.headers,
+      ...params.headers
+    }
+  });
+};
+var getNativeAuthProvider = (parameters, options) => {
+  const params = buildClientParams([parameters], [
+    {
+      args: [
+        { in: "headers", key: "X-Request-Id" },
+        { in: "path", key: "project_id" },
+        { in: "path", key: "environment_id" },
+        { in: "path", key: "provider" }
+      ]
+    }
+  ]);
+  return (options?.client ?? client).get({
+    responseStyle: "data",
+    security: [{ scheme: "bearer", type: "http" }],
+    url: "/v1/projects/{project_id}/environments/{environment_id}/auth/providers/{provider}",
+    ...options,
+    ...params
+  });
+};
+var updateNativeAuthProvider = (parameters, options) => {
+  const params = buildClientParams([parameters], [
+    {
+      args: [
+        { in: "headers", key: "X-Request-Id" },
+        { in: "headers", key: "Idempotency-Key" },
+        { in: "path", key: "project_id" },
+        { in: "path", key: "environment_id" },
+        { in: "path", key: "provider" },
+        { key: "nativeAuthProviderUpdateWritable", map: "body" }
+      ]
+    }
+  ]);
+  return (options?.client ?? client).put({
+    responseStyle: "data",
+    security: [{ scheme: "bearer", type: "http" }],
+    url: "/v1/projects/{project_id}/environments/{environment_id}/auth/providers/{provider}",
+    ...options,
+    ...params,
+    headers: {
+      "Content-Type": "application/json",
+      ...options?.headers,
+      ...params.headers
+    }
+  });
+};
+var listNativeAuthUsers = (parameters, options) => {
+  const params = buildClientParams([parameters], [
+    {
+      args: [
+        { in: "headers", key: "X-Request-Id" },
+        { in: "path", key: "project_id" },
+        { in: "path", key: "environment_id" },
+        { in: "query", key: "limit" },
+        { in: "query", key: "cursor" },
+        { in: "query", key: "search" }
+      ]
+    }
+  ]);
+  return (options?.client ?? client).get({
+    responseStyle: "data",
+    security: [{ scheme: "bearer", type: "http" }],
+    url: "/v1/projects/{project_id}/environments/{environment_id}/auth/users",
+    ...options,
+    ...params
+  });
+};
+var createNativeAuthUser = (parameters, options) => {
+  const params = buildClientParams([parameters], [
+    {
+      args: [
+        { in: "headers", key: "X-Request-Id" },
+        { in: "headers", key: "Idempotency-Key" },
+        { in: "path", key: "project_id" },
+        { in: "path", key: "environment_id" },
+        { key: "nativeAuthUserCreate", map: "body" }
+      ]
+    }
+  ]);
+  return (options?.client ?? client).post({
+    responseStyle: "data",
+    security: [{ scheme: "bearer", type: "http" }],
+    url: "/v1/projects/{project_id}/environments/{environment_id}/auth/users",
+    ...options,
+    ...params,
+    headers: {
+      "Content-Type": "application/json",
+      ...options?.headers,
+      ...params.headers
+    }
+  });
+};
+var deleteNativeAuthUser = (parameters, options) => {
+  const params = buildClientParams([parameters], [
+    {
+      args: [
+        { in: "headers", key: "X-Request-Id" },
+        { in: "headers", key: "Idempotency-Key" },
+        { in: "path", key: "project_id" },
+        { in: "path", key: "environment_id" },
+        { in: "path", key: "user_id" }
+      ]
+    }
+  ]);
+  return (options?.client ?? client).delete({
+    responseStyle: "data",
+    security: [{ scheme: "bearer", type: "http" }],
+    url: "/v1/projects/{project_id}/environments/{environment_id}/auth/users/{user_id}",
+    ...options,
+    ...params
+  });
+};
+var getNativeAuthUser = (parameters, options) => {
+  const params = buildClientParams([parameters], [
+    {
+      args: [
+        { in: "headers", key: "X-Request-Id" },
+        { in: "path", key: "project_id" },
+        { in: "path", key: "environment_id" },
+        { in: "path", key: "user_id" }
+      ]
+    }
+  ]);
+  return (options?.client ?? client).get({
+    responseStyle: "data",
+    security: [{ scheme: "bearer", type: "http" }],
+    url: "/v1/projects/{project_id}/environments/{environment_id}/auth/users/{user_id}",
+    ...options,
+    ...params
+  });
+};
+var resendNativeAuthInvitation = (parameters, options) => {
+  const params = buildClientParams([parameters], [
+    {
+      args: [
+        { in: "headers", key: "X-Request-Id" },
+        { in: "headers", key: "Idempotency-Key" },
+        { in: "path", key: "project_id" },
+        { in: "path", key: "environment_id" },
+        { in: "path", key: "user_id" }
+      ]
+    }
+  ]);
+  return (options?.client ?? client).post({
+    responseStyle: "data",
+    security: [{ scheme: "bearer", type: "http" }],
+    url: "/v1/projects/{project_id}/environments/{environment_id}/auth/users/{user_id}/invite",
+    ...options,
+    ...params
+  });
+};
+var suspendNativeAuthUser = (parameters, options) => {
+  const params = buildClientParams([parameters], [
+    {
+      args: [
+        { in: "headers", key: "X-Request-Id" },
+        { in: "headers", key: "Idempotency-Key" },
+        { in: "path", key: "project_id" },
+        { in: "path", key: "environment_id" },
+        { in: "path", key: "user_id" }
+      ]
+    }
+  ]);
+  return (options?.client ?? client).post({
+    responseStyle: "data",
+    security: [{ scheme: "bearer", type: "http" }],
+    url: "/v1/projects/{project_id}/environments/{environment_id}/auth/users/{user_id}/suspend",
+    ...options,
+    ...params
+  });
+};
+var reactivateNativeAuthUser = (parameters, options) => {
+  const params = buildClientParams([parameters], [
+    {
+      args: [
+        { in: "headers", key: "X-Request-Id" },
+        { in: "headers", key: "Idempotency-Key" },
+        { in: "path", key: "project_id" },
+        { in: "path", key: "environment_id" },
+        { in: "path", key: "user_id" }
+      ]
+    }
+  ]);
+  return (options?.client ?? client).post({
+    responseStyle: "data",
+    security: [{ scheme: "bearer", type: "http" }],
+    url: "/v1/projects/{project_id}/environments/{environment_id}/auth/users/{user_id}/reactivate",
+    ...options,
+    ...params
+  });
+};
+var revokeNativeAuthUserSessions = (parameters, options) => {
+  const params = buildClientParams([parameters], [
+    {
+      args: [
+        { in: "headers", key: "X-Request-Id" },
+        { in: "headers", key: "Idempotency-Key" },
+        { in: "path", key: "project_id" },
+        { in: "path", key: "environment_id" },
+        { in: "path", key: "user_id" }
+      ]
+    }
+  ]);
+  return (options?.client ?? client).post({
+    responseStyle: "data",
+    security: [{ scheme: "bearer", type: "http" }],
+    url: "/v1/projects/{project_id}/environments/{environment_id}/auth/users/{user_id}/revoke-sessions",
+    ...options,
+    ...params
+  });
+};
 var listWorkspaceMailDomains = (parameters, options) => {
   const params = buildClientParams([parameters], [
     {
@@ -32863,6 +33172,87 @@ var parseDeviceTokens = (value) => {
   };
 };
 
+// apps/product-cli/dist/native-auth.js
+async function executeNativeAuth(client2, command) {
+  const scope = { project_id: command.projectId, environment_id: command.environmentId };
+  const options = { client: client2 };
+  switch (command.action) {
+    case "config_get":
+      return getNativeAuthConfiguration(scope, options);
+    case "config_set":
+      return updateNativeAuthConfiguration({
+        ...scope,
+        "Idempotency-Key": command.idempotencyKey,
+        nativeAuthConfigurationUpdate: {
+          configurationRevision: command.configurationRevision,
+          enabled: command.enabled,
+          signupPolicy: command.signupPolicy,
+          applicationName: command.applicationName,
+          ...command.canonicalOrigin === void 0 ? {} : { canonicalOrigin: command.canonicalOrigin },
+          ...command.allowedRedirectPaths === void 0 ? {} : { allowedRedirectPaths: [...command.allowedRedirectPaths] },
+          ...command.resetPasswordPath === void 0 ? {} : { resetPasswordPath: command.resetPasswordPath },
+          ...command.invitationPath === void 0 ? {} : { invitationPath: command.invitationPath }
+        }
+      }, options);
+    case "provider_get": {
+      const result = await getNativeAuthProvider({ ...scope, provider: command.provider }, options);
+      return providerStatus(result);
+    }
+    case "provider_set": {
+      const result = await updateNativeAuthProvider({
+        ...scope,
+        provider: command.provider,
+        "Idempotency-Key": command.idempotencyKey,
+        nativeAuthProviderUpdateWritable: {
+          configurationRevision: command.configurationRevision,
+          enabled: command.enabled,
+          ...command.clientId === void 0 ? {} : { clientId: command.clientId },
+          ...command.clientSecret === void 0 ? {} : { clientSecret: command.clientSecret }
+        }
+      }, options);
+      return providerStatus(result);
+    }
+    case "users_list":
+      return listNativeAuthUsers({
+        ...scope,
+        ...command.limit === void 0 ? {} : { limit: command.limit },
+        ...command.cursor === void 0 ? {} : { cursor: command.cursor },
+        ...command.search === void 0 ? {} : { search: command.search }
+      }, options);
+    case "user_create":
+      return createNativeAuthUser({
+        ...scope,
+        "Idempotency-Key": command.idempotencyKey,
+        nativeAuthUserCreate: { email: command.email }
+      }, options);
+    case "user_get":
+      return getNativeAuthUser({ ...scope, user_id: command.userId }, options);
+    case "user_delete":
+      return deleteNativeAuthUser({ ...scope, user_id: command.userId, "Idempotency-Key": command.idempotencyKey }, options);
+    case "user_invite":
+      return resendNativeAuthInvitation({ ...scope, user_id: command.userId, "Idempotency-Key": command.idempotencyKey }, options);
+    case "user_suspend":
+      return suspendNativeAuthUser({ ...scope, user_id: command.userId, "Idempotency-Key": command.idempotencyKey }, options);
+    case "user_reactivate":
+      return reactivateNativeAuthUser({ ...scope, user_id: command.userId, "Idempotency-Key": command.idempotencyKey }, options);
+    case "user_revoke_sessions":
+      return revokeNativeAuthUserSessions({ ...scope, user_id: command.userId, "Idempotency-Key": command.idempotencyKey }, options);
+  }
+}
+function providerStatus(result) {
+  const { provider, enabled, configured, clientId, secretPresent, callbackUrl, scopes, lastSuccessfulFlowAt } = result;
+  return {
+    provider,
+    enabled,
+    configured,
+    clientId,
+    secretPresent,
+    callbackUrl,
+    scopes,
+    lastSuccessfulFlowAt
+  };
+}
+
 // apps/product-cli/dist/source-managed-client.js
 var GeneratedSdkManagedSourceApi = class {
   client;
@@ -33631,6 +34021,9 @@ var GeneratedSdkProductApi = class {
   managedMail(input) {
     return executeManagedMail(this.#client, input);
   }
+  nativeAuth(input) {
+    return executeNativeAuth(this.#client, input);
+  }
 };
 
 // apps/product-cli/dist/repository-init.js
@@ -34725,6 +35118,9 @@ var GeneratedSdkLocalMcpClient = class {
   managedMail(input) {
     return executeManagedMail(this.#client, input);
   }
+  nativeAuth(input) {
+    return executeNativeAuth(this.#client, input);
+  }
   planDelete(projectId) {
     return planProjectDeletion({ project_id: projectId }, { client: this.#client });
   }
@@ -35621,7 +36017,7 @@ function createLocalOhmyhostMcpServer(dependencies) {
       throw new Error("Managed source client is unavailable");
     return client2.managedSource.getSource(input.project_id);
   });
-  registerProductTool(server, dependencies, "deployment_plan", "Plan an immutable deployment. Preserve the customer's existing authentication integration, such as Better Auth or WorkOS, and use the same generic Next.js/Vite/TanStack runtime contract. ohmyho.st login is separate. Read the app Skill's auth guidance and report actual plan blockers, required secret names/callback configuration and unverified runtime compatibility. The explicitly selected managed Better Auth bridge requires the managed database; managed mail is optional, and its verification or password-reset send actions require a configured platform sender. Application-owned Better Auth handlers can use their own sender, including Resend, with auth.provider set to none. Never assume a working platform login proves application login or silently replace its auth provider. The plan builds into Dev unless environment is prod; prod builds straight into Prod without a Dev deployment (a project with shared data and a database must deploy to Dev and promote instead). The plan stays valid for 24 hours.", external_exports.object({
+  registerProductTool(server, dependencies, "deployment_plan", "Plan an immutable deployment. Preserve the customer's existing authentication integration, such as Better Auth or WorkOS, and use the same generic Next.js/Vite/TanStack runtime contract. ohmyho.st login is separate. Read the app Skill's auth guidance and report actual plan blockers, required secret names/callback configuration and unverified runtime compatibility. The explicitly selected managed Better Auth bridge requires the managed database; managed mail is optional, and its verification or password-reset send actions require a configured platform sender. Application-owned Better Auth handlers can use their own sender, including Resend, with auth.provider set to none. The unreleased omh-native capability is an explicit choice requiring Paid access, a verified sender and its separately metered Auth database; verify readiness and hosted support before claiming it works. Never assume a working platform login proves application login or silently replace its auth provider. The plan builds into Dev unless environment is prod; prod builds straight into Prod without a Dev deployment (a project with shared data and a database must deploy to Dev and promote instead). The plan stays valid for 24 hours.", external_exports.object({
     project_id: identifier2,
     commit_sha: commitSha,
     environment: external_exports.enum(["dev", "prod"]).optional()
@@ -36048,6 +36444,160 @@ function createLocalOhmyhostMcpServer(dependencies) {
       idempotencyKey: input.idempotency_key
     });
   }, destructiveAnnotations());
+  const nativeScope = { project_id: identifier2, environment_id: identifier2 };
+  const nativeProvider = external_exports.enum(["google", "github"]);
+  const nativeRun = (client2, command) => {
+    if (!client2.nativeAuth)
+      throw new Error("Native Auth unavailable");
+    return client2.nativeAuth(command);
+  };
+  registerProductTool(server, dependencies, "native_auth_config_get", "Read Owner Native Auth configuration and readiness.", external_exports.object(nativeScope), (client2, input) => nativeRun(client2, {
+    action: "config_get",
+    projectId: input.project_id,
+    environmentId: input.environment_id
+  }));
+  registerProductTool(server, dependencies, "native_auth_config_set", "Update Owner Native Auth configuration at the current revision.", external_exports.object({
+    ...nativeScope,
+    configuration_revision: external_exports.number().int().min(0),
+    enabled: external_exports.boolean(),
+    signup_policy: external_exports.enum(["open", "invite-only"]),
+    application_name: external_exports.string().trim().min(1).max(128).refine((value) => !new RegExp("\\p{Cc}", "u").test(value)),
+    canonical_origin: external_exports.string().url().refine((value) => {
+      try {
+        const url = new URL(value);
+        return url.protocol === "https:" && url.origin === value && !url.username && !url.password;
+      } catch {
+        return false;
+      }
+    }).nullable().optional(),
+    allowed_redirect_paths: external_exports.array(external_exports.string().refine(isNativeAuthRedirectPath)).min(1).max(16).refine((paths) => new Set(paths).size === paths.length).optional(),
+    reset_password_path: external_exports.string().refine(isNativeAuthRedirectPath).optional(),
+    invitation_path: external_exports.string().refine(isNativeAuthRedirectPath).optional(),
+    idempotency_key: idempotencyKey
+  }), (client2, input) => {
+    const paths = input.allowed_redirect_paths;
+    if (paths && [input.reset_password_path, input.invitation_path].some((path2) => path2 !== void 0 && !paths.includes(path2)))
+      throw new TypeError("Native Auth form path must be in the redirect allowlist");
+    return nativeRun(client2, {
+      action: "config_set",
+      projectId: input.project_id,
+      environmentId: input.environment_id,
+      configurationRevision: input.configuration_revision,
+      enabled: input.enabled,
+      signupPolicy: input.signup_policy,
+      applicationName: input.application_name,
+      ...input.canonical_origin === void 0 ? {} : { canonicalOrigin: input.canonical_origin },
+      ...input.allowed_redirect_paths === void 0 ? {} : { allowedRedirectPaths: input.allowed_redirect_paths },
+      ...input.reset_password_path === void 0 ? {} : { resetPasswordPath: input.reset_password_path },
+      ...input.invitation_path === void 0 ? {} : { invitationPath: input.invitation_path },
+      idempotencyKey: input.idempotency_key
+    });
+  }, mutationAnnotations());
+  registerProductTool(server, dependencies, "native_auth_provider_get", "Read provider setup without its secret.", external_exports.object({ ...nativeScope, provider: nativeProvider }), (client2, input) => nativeRun(client2, {
+    action: "provider_get",
+    projectId: input.project_id,
+    environmentId: input.environment_id,
+    provider: input.provider
+  }));
+  registerProductTool(server, dependencies, "native_auth_provider_set", "Update provider settings without submitting a secret.", external_exports.object({
+    ...nativeScope,
+    provider: nativeProvider,
+    configuration_revision: external_exports.number().int().min(0),
+    enabled: external_exports.boolean(),
+    client_id: external_exports.string().min(1).max(1024).optional(),
+    idempotency_key: idempotencyKey
+  }).strict(), (client2, input) => nativeRun(client2, {
+    action: "provider_set",
+    projectId: input.project_id,
+    environmentId: input.environment_id,
+    provider: input.provider,
+    configurationRevision: input.configuration_revision,
+    enabled: input.enabled,
+    ...input.client_id === void 0 ? {} : { clientId: input.client_id },
+    idempotencyKey: input.idempotency_key
+  }), mutationAnnotations());
+  registerProductTool(server, dependencies, "native_auth_users_list", "List Native Auth users with bounded pagination.", external_exports.object({
+    ...nativeScope,
+    limit: external_exports.number().int().min(1).max(100).optional(),
+    cursor: external_exports.string().min(1).max(512).optional(),
+    search: external_exports.string().min(1).max(320).optional()
+  }), (client2, input) => nativeRun(client2, {
+    action: "users_list",
+    projectId: input.project_id,
+    environmentId: input.environment_id,
+    ...input.limit === void 0 ? {} : { limit: input.limit },
+    ...input.cursor === void 0 ? {} : { cursor: input.cursor },
+    ...input.search === void 0 ? {} : { search: input.search }
+  }));
+  registerProductTool(server, dependencies, "native_auth_user_create", "Create and invite a Native Auth user without choosing a password.", external_exports.object({
+    ...nativeScope,
+    email: external_exports.string().email().max(254),
+    idempotency_key: idempotencyKey
+  }), (client2, input) => nativeRun(client2, {
+    action: "user_create",
+    projectId: input.project_id,
+    environmentId: input.environment_id,
+    email: input.email,
+    idempotencyKey: input.idempotency_key
+  }), mutationAnnotations());
+  registerProductTool(server, dependencies, "native_auth_user_get", "Read a Native Auth user.", external_exports.object({ ...nativeScope, user_id: external_exports.string().uuid() }), (client2, input) => nativeRun(client2, {
+    action: "user_get",
+    projectId: input.project_id,
+    environmentId: input.environment_id,
+    userId: input.user_id
+  }));
+  const nativeUserActionInput = external_exports.object({
+    ...nativeScope,
+    user_id: external_exports.string().uuid(),
+    idempotency_key: idempotencyKey,
+    confirm: external_exports.literal(true)
+  });
+  const nativeUserAction = (action) => (client2, input) => nativeRun(client2, {
+    action,
+    projectId: input.project_id,
+    environmentId: input.environment_id,
+    userId: input.user_id,
+    idempotencyKey: input.idempotency_key
+  });
+  registerProductTool(server, dependencies, "native_auth_user_delete", "Delete an Owner-authorized Native Auth user.", nativeUserActionInput, nativeUserAction("user_delete"), destructiveAnnotations());
+  registerProductTool(server, dependencies, "native_auth_user_invite", "Resend an Owner-authorized Native Auth user's invitation.", nativeUserActionInput, nativeUserAction("user_invite"), destructiveAnnotations());
+  registerProductTool(server, dependencies, "native_auth_user_suspend", "Suspend an Owner-authorized Native Auth user.", nativeUserActionInput, nativeUserAction("user_suspend"), destructiveAnnotations());
+  registerProductTool(server, dependencies, "native_auth_user_reactivate", "Reactivate an Owner-authorized Native Auth user.", nativeUserActionInput, nativeUserAction("user_reactivate"), destructiveAnnotations());
+  registerProductTool(server, dependencies, "native_auth_user_revoke_sessions", "Revoke an Owner-authorized Native Auth user's sessions.", nativeUserActionInput, nativeUserAction("user_revoke_sessions"), destructiveAnnotations());
+  registerProductTool(server, dependencies, "native_auth_provider_secret_input_request", "Return an account-bound stdin-only command; never place a provider secret in MCP arguments.", external_exports.object({
+    ...nativeScope,
+    provider: nativeProvider,
+    configuration_revision: external_exports.number().int().min(0),
+    enabled: external_exports.boolean(),
+    client_id: external_exports.string().min(1).max(1024).optional(),
+    idempotency_key: idempotencyKey
+  }).strict(), async (client2, input, signal) => {
+    await client2.getProject(input.project_id);
+    const account = await handoverAccount(client2, signal);
+    return {
+      command: [
+        `${commandPrefix} auth provider set`,
+        "--project",
+        shellQuote(input.project_id),
+        "--environment",
+        shellQuote(input.environment_id),
+        "--provider",
+        input.provider,
+        "--revision",
+        String(input.configuration_revision),
+        "--enabled",
+        String(input.enabled),
+        ...input.client_id === void 0 ? [] : ["--client-id", shellQuote(input.client_id)],
+        "--idempotency-key",
+        shellQuote(input.idempotency_key),
+        ...account.flags,
+        "--stdin",
+        "--json"
+      ].join(" "),
+      acting_as: client2.actingAs?.() ?? null,
+      instruction: `Pass the provider secret on stdin in a local terminal; ${account.runs}. Never put it in MCP, arguments, source, or logs.`
+    };
+  });
   registerProductTool(server, dependencies, "secrets_list", "List secret metadata without values", external_exports.object({ project_id: identifier2, environment_id: identifier2 }), (client2, input) => client2.listEnvironmentSecrets({
     projectId: input.project_id,
     environmentId: input.environment_id

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@amerged/ohmyhost-mcp",
-  "version": "0.1.49",
+  "version": "0.1.50",
   "type": "module",
   "engines": {
     "node": ">=22"