@amerged/ohmyhost-mcp 0.1.49 → 0.1.50

package/src/packages/contracts/package.json

@@ -5,6 +5,11 @@
   "type": "module",
   "sideEffects": false,
   "exports": {
+    "./native-auth": {
+      "source": "./src/native-auth.ts",
+      "types": "./dist/native-auth.d.ts",
+      "import": "./dist/native-auth.js"
+    },
     "./database-sizes": {
       "source": "./src/database-sizes.ts",
       "types": "./dist/database-sizes.d.ts",

package/src/packages/contracts/src/framework-admission.ts

@@ -348,6 +348,11 @@ const VITE_BUILD_SCRIPT =
 // Each sentence names the file, the rule and the exact change. Render and parse both derive from
 // the template, so a client maps a detail back to exactly one typed diagnostic.
 const FRAMEWORK_CONVERSION_DETAILS = Object.freeze({
+  native_auth_route_conflict: {
+    paths: ["module"],
+    template:
+      '"{{path}}" declares a route in the reserved /api/auth/v1 namespace. Move the route or select a different authentication provider. Commit and push the change, then plan the new commit.',
+  },
   astro_template_import_unsupported: {
     paths: ["module"],
     template:

package/src/packages/contracts/src/framework-source-rules.ts

@@ -577,6 +577,15 @@ function configurationFindings(input: FrameworkSourceRuleInput): FrameworkConver
   const build = "command" in configuration.build ? configuration.build : null;
   const crons = (configuration.functions?.crons.length ?? 0) > 0;
   const findings: FrameworkConversionDiagnostic[] = [];
+  if (configuration.auth?.provider === "omh-native") {
+    for (const path of files) {
+      if (
+        /^(?:src\/)?(?:app|pages)\/api\/auth\/v1(?:\/.*)?\.(?:astro|[cm]?[jt]sx?)$/u.test(path) ||
+        /^src\/routes\/api(?:\.auth\.v1|\/auth\/v1)(?:[./].*)?\.[cm]?[jt]sx?$/u.test(path)
+      )
+        findings.push(diagnostic({ code: "native_auth_route_conflict", path }));
+    }
+  }
   // runtime.mode functions selects the functions framework, whose build is only build.install.
   if (framework !== "functions" && !runtimeModeAdmitted(framework, configuration, crons))
     findings.push(

package/src/packages/contracts/src/index.ts

@@ -45,7 +45,7 @@ export interface OhmyhostConfig {
     migrations?: string;
   }>;
   readonly auth?: Readonly<{
-    provider: "none" | "better-auth";
+    provider: "none" | "better-auth" | "omh-native";
   }>;
   readonly mail?: Readonly<{
     enabled: boolean;

package/src/packages/contracts/src/native-auth.ts

@@ -0,0 +1,158 @@
+/** Stable contracts shared by Native Auth's trusted platform boundaries. */
+export const NATIVE_AUTH_BASE_PATH = "/api/auth/v1" as const;
+export const NATIVE_AUTH_BINDING_NAME = "OHMYHOST_AUTH" as const;
+export const NATIVE_AUTH_REQUEST_DEADLINE_MS = 15_000;
+/** Immutable platform-owned Native schema cohort; a changed schema requires a new migration. */
+export const NATIVE_AUTH_SCHEMA_V1_SHA256 = // gitleaks:allow -- public migration digest
+  "65446cd8208df79d09d44513b8a22495c4b6b26012b1be6d21920037629bd147" as const;
+export const NATIVE_AUTH_SCHEMA_V2_SHA256 = // gitleaks:allow -- public migration digest
+  "dc432e4f593dffff9c7549ef00956a91d6270678d6af34a32b7344164ebd2f71" as const;
+export const NATIVE_AUTH_SCHEMA_MIGRATION_VERSION = 3 as const;
+export const NATIVE_AUTH_SCHEMA_MIGRATION_SHA256 =
+  "799e3678b725c268176abc97e61ca796ff98c3ab32f2cfb119994aa9e35d3eeb" as const;
+export const NATIVE_AUTH_DEFAULT_REDIRECT_PATHS = Object.freeze([
+  "/",
+  "/login",
+  "/reset-password",
+  "/accept-invitation",
+] as const);
+
+/** Canonical local application path, with no escapes or ambiguous path segments. */
+export function isNativeAuthRedirectPath(value: unknown): value is string {
+  return (
+    typeof value === "string" &&
+    value.length <= 256 &&
+    /^\/[A-Za-z0-9/_~.-]*$/u.test(value) &&
+    !value.includes("//") &&
+    !value.split("/").some((segment) => segment === "." || segment === "..")
+  );
+}
+
+export type NativeAuthProvider = "google" | "github";
+export type NativeAuthSignupPolicy = "open" | "invite-only";
+export type NativeAuthUserStatus = "pending" | "active" | "suspended";
+
+/** Derived from trusted routing, never from a browser-provided project or origin. */
+export interface NativeAuthRealmContext {
+  readonly projectId: string;
+  readonly environmentId: string;
+  readonly canonicalOrigin: string;
+  readonly realmGeneration: number;
+  readonly configurationRevision: number;
+}
+
+export interface NativeAuthSession {
+  readonly user: Readonly<{ id: string; email: string }>;
+  readonly session: Readonly<{ id: string; expiresAt: string }>;
+}
+
+/** Authenticated browser self projection; independent Native mailbox proof owns recovery. */
+export interface NativeAuthSelfSession extends NativeAuthSession {
+  readonly user: Readonly<{ id: string; email: string; recoveryAvailable: boolean }>;
+}
+
+/** A private read-only binding. Store or admission failures reject instead of returning null. */
+export interface NativeAuthBinding {
+  validateSession(
+    input: Readonly<{
+      cookie: string;
+    }>,
+  ): Promise<NativeAuthSession | null>;
+}
+
+export interface NativeAuthProviderStatus {
+  readonly provider: NativeAuthProvider;
+  readonly enabled: boolean;
+  readonly configured: boolean;
+  readonly clientId: string | null;
+  readonly secretPresent: boolean;
+  readonly callbackUrl: string | null;
+  readonly scopes: readonly string[];
+  readonly lastSuccessfulFlowAt: string | null;
+}
+
+/** Secret is input-only and must never be included in status or replay receipts. */
+export interface NativeAuthProviderUpdate {
+  readonly configurationRevision: number;
+  readonly enabled: boolean;
+  readonly clientId?: string;
+  readonly clientSecret?: string;
+}
+
+export interface NativeAuthConfiguration {
+  readonly enabled: boolean;
+  readonly configurationRevision: number;
+  readonly revocationEpoch: number;
+  readonly signupPolicy: NativeAuthSignupPolicy;
+  readonly canonicalOrigin: string | null;
+  readonly applicationName: string;
+  readonly allowedRedirectPaths: readonly string[];
+  readonly resetPasswordPath: string;
+  readonly invitationPath: string;
+  readonly readiness: Readonly<{
+    paid: boolean;
+    sender: boolean;
+    origin: boolean;
+    storage: boolean;
+  }>;
+}
+
+export interface NativeAuthConfigurationUpdate {
+  readonly configurationRevision: number;
+  readonly enabled: boolean;
+  readonly signupPolicy: NativeAuthSignupPolicy;
+  readonly applicationName: string;
+  readonly canonicalOrigin?: string | null;
+  readonly allowedRedirectPaths?: readonly string[];
+  readonly resetPasswordPath?: string;
+  readonly invitationPath?: string;
+}
+
+export interface NativeAuthUser {
+  readonly id: string;
+  readonly email: string;
+  readonly status: NativeAuthUserStatus;
+  readonly recoveryAvailable: boolean;
+  readonly createdAt: string;
+}
+
+export interface NativeAuthUserCreate {
+  readonly email: string;
+}
+
+export interface NativeAuthUserPage {
+  readonly items: readonly NativeAuthUser[];
+  readonly nextCursor: string | null;
+}
+
+/** Exact browser-facing methods and paths; no engine admin or token APIs are reachable. */
+const PUBLIC_ROUTES: Readonly<Record<string, readonly string[]>> = Object.freeze({
+  GET: Object.freeze([
+    "/get-session",
+    "/verify-email",
+    "/callback/google",
+    "/callback/github",
+    "/list-accounts",
+  ]),
+  POST: Object.freeze([
+    "/sign-up/email",
+    "/sign-in/email",
+    "/sign-in/social",
+    "/sign-out",
+    "/request-password-reset",
+    "/reset-password",
+    "/change-password",
+    "/send-verification-email",
+    "/link-social",
+    "/unlink-account",
+    "/accept-invitation",
+    "/reauthenticate",
+    "/enroll-recovery",
+  ]),
+});
+
+export function isNativeAuthPublicRoute(method: string, pathname: string): boolean {
+  if (!pathname.startsWith(`${NATIVE_AUTH_BASE_PATH}/`)) return false;
+  if (!Object.hasOwn(PUBLIC_ROUTES, method)) return false;
+  return PUBLIC_ROUTES[method]?.includes(pathname.slice(NATIVE_AUTH_BASE_PATH.length)) === true;
+}

package/src/packages/contracts/src/problem-policy.ts

@@ -330,7 +330,7 @@ export const PROBLEM_POLICY = {
     status: 409,
     retryable: true,
     action:
-      "Wait for the running operation to finish, read the project again, then rename with the new ETag.",
+      "Read project status and finish or retry any pending Native Auth deployment or other operation. Once preparation is complete, read the project again and rename with its current ETag.",
     title: "Project address change blocked",
   },
   project_identity_unavailable: {
@@ -638,6 +638,13 @@ export const PROBLEM_POLICY = {
     action:
       "This project still has a live or pending custom-domain connection. Read 'ohmyhost domain paid status --project ULID --json', remove that connection with 'ohmyhost domain paid delete --project ULID --hostname HOST --yes --json', then create a fresh project deletion plan. Repeating while it remains connected cannot work.",
   },
+  native_domain_sync_pending: {
+    status: 409,
+    retryable: false,
+    title: "Complete the pending domain change",
+    action:
+      "Read project status and Paid domain status to identify the pending change. If a Paid domain removal is pending, retry it as a current owner with a new idempotency key. If a project address change is pending, submit a fresh address change as a current owner. After it finishes, create a new project deletion plan.",
+  },
 } as const;
 
 export type ProblemCode = keyof typeof PROBLEM_POLICY;

package/src/packages/contracts/src/project-exports.ts

@@ -61,9 +61,17 @@ export function assertProjectExport(value: unknown): asserts value is ProjectExp
     Number(archive["bytes"]) > 536870912 ||
     typeof archive["sha256"] !== "string" ||
     !/^sha256:[a-f0-9]{64}$/u.test(archive["sha256"]) ||
-    !['["dev.sql"]', '["prod.sql"]', '["dev.sql","prod.sql"]', '["shared.sql"]'].includes(
-      JSON.stringify(archive["sql_files"]),
-    ) ||
+    ![
+      '["dev.sql"]',
+      '["prod.sql"]',
+      '["dev.sql","prod.sql"]',
+      '["shared.sql"]',
+      '["auth.sql"]',
+      '["dev.sql","auth.sql"]',
+      '["prod.sql","auth.sql"]',
+      '["dev.sql","prod.sql","auth.sql"]',
+      '["shared.sql","auth.sql"]',
+    ].includes(JSON.stringify(archive["sql_files"])) ||
     !timestamp(archive["captured_at"]) ||
     !timestamp(archive["expires_at"])
   )

package/src/packages/sdk-ts/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ohmyhost/sdk-ts",
-  "version": "0.1.49",
+  "version": "0.1.50",
   "private": true,
   "type": "module",
   "exports": {

package/src/packages/sdk-ts/src/generated/index.ts

@@ -20,6 +20,7 @@ export {
   createCloudflareDnsAuthorization,
   createDeployment,
   createManagedSourceUpload,
+  createNativeAuthUser,
   createOrganization,
   createProject,
   createProjectDatabaseAccess,
@@ -34,6 +35,7 @@ export {
   declareApplicationDomainIdentity,
   deleteEnvironmentSecret,
   deleteManagedMailDomain,
+  deleteNativeAuthUser,
   deletePaidProjectDomain,
   deleteProject,
   deleteProjectDatabaseSchedule,
@@ -60,6 +62,9 @@ export {
   getManagedMailDomain,
   getManagedMailMessage,
   getManagedSourceUpload,
+  getNativeAuthConfiguration,
+  getNativeAuthProvider,
+  getNativeAuthUser,
   getOperation,
   getOrganizationAccount,
   getOrganizationCredits,
@@ -91,6 +96,7 @@ export {
   listManagedMailMessages,
   listManagedSourceFiles,
   listManagedSourceVersions,
+  listNativeAuthUsers,
   listProjectDatabaseAccess,
   listProjectDatabaseScheduleRuns,
   listProjectDatabaseSchedules,
@@ -113,16 +119,19 @@ export {
   putManagedSourceBlob,
   putProjectMailDomainBinding,
   queryProjectDatabase,
+  reactivateNativeAuthUser,
   reconcileOperation,
   recordSignupSource,
   registerFeatureInterest,
   replayProjectDatabaseWebhookDelivery,
+  resendNativeAuthInvitation,
   restoreManagedSource,
   retireWorkspaceMailDomain,
   retryManagedMailMessage,
   revokeApplicationDomainIdentity,
   revokeApplicationDomainIdentityDnsAuthorization,
   revokeCurrentSession,
+  revokeNativeAuthUserSessions,
   revokeProjectDatabaseAccess,
   revokeProjectDevShareLink,
   revokeUserApiKey,
@@ -139,8 +148,11 @@ export {
   streamOperationEvents,
   submitContactRequest,
   submitFeedback,
+  suspendNativeAuthUser,
   switchManagedSource,
   testProjectDatabaseWebhook,
+  updateNativeAuthConfiguration,
+  updateNativeAuthProvider,
   verifyApplicationDomainIdentity,
   verifyManagedMailWebhook,
   writeProjectDatabase,
@@ -263,6 +275,11 @@ export type {
   CreateManagedSourceUploadErrors,
   CreateManagedSourceUploadResponse,
   CreateManagedSourceUploadResponses,
+  CreateNativeAuthUserData,
+  CreateNativeAuthUserError,
+  CreateNativeAuthUserErrors,
+  CreateNativeAuthUserResponse,
+  CreateNativeAuthUserResponses,
   CreateOrganizationData,
   CreateOrganizationError,
   CreateOrganizationErrors,
@@ -380,6 +397,11 @@ export type {
   DeleteManagedMailDomainErrors,
   DeleteManagedMailDomainResponse,
   DeleteManagedMailDomainResponses,
+  DeleteNativeAuthUserData,
+  DeleteNativeAuthUserError,
+  DeleteNativeAuthUserErrors,
+  DeleteNativeAuthUserResponse,
+  DeleteNativeAuthUserResponses,
   DeletePaidProjectDomainData,
   DeletePaidProjectDomainError,
   DeletePaidProjectDomainErrors,
@@ -534,6 +556,21 @@ export type {
   GetManagedSourceUploadErrors,
   GetManagedSourceUploadResponse,
   GetManagedSourceUploadResponses,
+  GetNativeAuthConfigurationData,
+  GetNativeAuthConfigurationError,
+  GetNativeAuthConfigurationErrors,
+  GetNativeAuthConfigurationResponse,
+  GetNativeAuthConfigurationResponses,
+  GetNativeAuthProviderData,
+  GetNativeAuthProviderError,
+  GetNativeAuthProviderErrors,
+  GetNativeAuthProviderResponse,
+  GetNativeAuthProviderResponses,
+  GetNativeAuthUserData,
+  GetNativeAuthUserError,
+  GetNativeAuthUserErrors,
+  GetNativeAuthUserResponse,
+  GetNativeAuthUserResponses,
   GetOperationData,
   GetOperationError,
   GetOperationErrors,
@@ -702,6 +739,11 @@ export type {
   ListManagedSourceVersionsErrors,
   ListManagedSourceVersionsResponse,
   ListManagedSourceVersionsResponses,
+  ListNativeAuthUsersData,
+  ListNativeAuthUsersError,
+  ListNativeAuthUsersErrors,
+  ListNativeAuthUsersResponse,
+  ListNativeAuthUsersResponses,
   ListProjectDatabaseAccessData,
   ListProjectDatabaseAccessError,
   ListProjectDatabaseAccessErrors,
@@ -775,6 +817,15 @@ export type {
   ManagedSourceUploadReceipt,
   ManagedSourceUploadRequest,
   ManagedSourceVersions,
+  NativeAuthConfiguration,
+  NativeAuthConfigurationUpdate,
+  NativeAuthProviderStatus,
+  NativeAuthProviderUpdate,
+  NativeAuthProviderUpdateWritable,
+  NativeAuthRedirectPath,
+  NativeAuthUser,
+  NativeAuthUserCreate,
+  NativeAuthUserPage,
   NullableCommitSha,
   Operation,
   OperationDeploymentProgress,
@@ -887,6 +938,11 @@ export type {
   QueryProjectDatabaseErrors,
   QueryProjectDatabaseResponse,
   QueryProjectDatabaseResponses,
+  ReactivateNativeAuthUserData,
+  ReactivateNativeAuthUserError,
+  ReactivateNativeAuthUserErrors,
+  ReactivateNativeAuthUserResponse,
+  ReactivateNativeAuthUserResponses,
   ReconcileOperationData,
   ReconcileOperationError,
   ReconcileOperationErrors,
@@ -908,6 +964,11 @@ export type {
   ReplayProjectDatabaseWebhookDeliveryResponse,
   ReplayProjectDatabaseWebhookDeliveryResponses,
   RequestId,
+  ResendNativeAuthInvitationData,
+  ResendNativeAuthInvitationError,
+  ResendNativeAuthInvitationErrors,
+  ResendNativeAuthInvitationResponse,
+  ResendNativeAuthInvitationResponses,
   RestoreManagedSourceData,
   RestoreManagedSourceError,
   RestoreManagedSourceErrors,
@@ -938,6 +999,11 @@ export type {
   RevokeCurrentSessionErrors,
   RevokeCurrentSessionResponse,
   RevokeCurrentSessionResponses,
+  RevokeNativeAuthUserSessionsData,
+  RevokeNativeAuthUserSessionsError,
+  RevokeNativeAuthUserSessionsErrors,
+  RevokeNativeAuthUserSessionsResponse,
+  RevokeNativeAuthUserSessionsResponses,
   RevokeProjectDatabaseAccessData,
   RevokeProjectDatabaseAccessError,
   RevokeProjectDatabaseAccessErrors,
@@ -1031,6 +1097,11 @@ export type {
   SubmitFeedbackErrors,
   SubmitFeedbackResponse,
   SubmitFeedbackResponses,
+  SuspendNativeAuthUserData,
+  SuspendNativeAuthUserError,
+  SuspendNativeAuthUserErrors,
+  SuspendNativeAuthUserResponse,
+  SuspendNativeAuthUserResponses,
   SwitchManagedSourceData,
   SwitchManagedSourceError,
   SwitchManagedSourceErrors,
@@ -1043,6 +1114,16 @@ export type {
   TestProjectDatabaseWebhookResponse,
   TestProjectDatabaseWebhookResponses,
   Ulid,
+  UpdateNativeAuthConfigurationData,
+  UpdateNativeAuthConfigurationError,
+  UpdateNativeAuthConfigurationErrors,
+  UpdateNativeAuthConfigurationResponse,
+  UpdateNativeAuthConfigurationResponses,
+  UpdateNativeAuthProviderData,
+  UpdateNativeAuthProviderError,
+  UpdateNativeAuthProviderErrors,
+  UpdateNativeAuthProviderResponse,
+  UpdateNativeAuthProviderResponses,
   UsageTotal,
   UserApiKey,
   UserApiKeyCreation,