@amerged/ohmyhost-mcp 0.1.49 → 0.1.52

package/src/apps/mcp/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ohmyhost/mcp",
-  "version": "0.1.49",
+  "version": "0.1.52",
   "private": true,
   "ohmyhost": {
     "deployment": "production",

package/src/apps/mcp/src/local-client.ts

@@ -4,6 +4,7 @@ import {
   type ManagedMailCommand,
   type SharedMailCommand,
 } from "@ohmyhost/sdk-ts";
+import { executeNativeAuth, type NativeAuthCommand } from "@ohmyhost/product-cli";
 import {
   assertProjectDatabaseAccess,
   assertProjectDatabaseAccessCredential,
@@ -1156,6 +1157,10 @@ export class GeneratedSdkLocalMcpClient implements LocalMcpProductClient {
   public managedMail(input: ManagedMailCommand) {
     return executeManagedMail(this.#client, input);
   }
+
+  public nativeAuth(input: NativeAuthCommand) {
+    return executeNativeAuth(this.#client, input);
+  }
   public planDelete(projectId: string) {
     return planProjectDeletion({ project_id: projectId }, { client: this.#client });
   }

package/src/apps/mcp/src/local-server.ts

@@ -1,4 +1,5 @@
 import { isUserSecretName, USER_SECRET_NAME_PATTERN } from "@ohmyhost/contracts/secret-names";
+import { isNativeAuthRedirectPath } from "@ohmyhost/contracts/native-auth";
 import type { DatabaseComputeSelection } from "@ohmyhost/contracts/database-sizes";
 import {
   DATABASE_WEBHOOK_EVENT_TYPES,
@@ -136,6 +137,7 @@ interface DatabaseScheduleSetInput extends DatabaseScheduleTarget {
 }
 
 export interface LocalMcpProductClient {
+  nativeAuth?(input: import("@ohmyhost/product-cli").NativeAuthCommand): Promise<unknown>;
   readonly managedSource?: ManagedSourceApi;
   readonly productApiOrigin?: string;
   checkProjectHandle(input: { handle: string }): Promise<unknown>;
@@ -1952,7 +1954,7 @@ export function createLocalOhmyhostMcpServer(dependencies: LocalOhmyhostMcpDepen
     server,
     dependencies,
     "deployment_plan",
-    "Plan an immutable deployment. Preserve the customer's existing authentication integration, such as Better Auth or WorkOS, and use the same generic Next.js/Vite/TanStack runtime contract. ohmyho.st login is separate. Read the app Skill's auth guidance and report actual plan blockers, required secret names/callback configuration and unverified runtime compatibility. The explicitly selected managed Better Auth bridge requires the managed database; managed mail is optional, and its verification or password-reset send actions require a configured platform sender. Application-owned Better Auth handlers can use their own sender, including Resend, with auth.provider set to none. Never assume a working platform login proves application login or silently replace its auth provider. The plan builds into Dev unless environment is prod; prod builds straight into Prod without a Dev deployment (a project with shared data and a database must deploy to Dev and promote instead). The plan stays valid for 24 hours.",
+    "Plan an immutable deployment. Preserve the customer's existing authentication integration, such as Better Auth or WorkOS, and use the same generic Next.js/Vite/TanStack runtime contract. ohmyho.st login is separate. Read the app Skill's auth guidance and report actual plan blockers, required secret names/callback configuration and unverified runtime compatibility. The explicitly selected managed Better Auth bridge requires the managed database; managed mail is optional, and its verification or password-reset send actions require a configured platform sender. Application-owned Better Auth handlers can use their own sender, including Resend, with auth.provider set to none. The unreleased omh-native capability is an explicit choice requiring Paid access, a verified sender and its separately metered Auth database; verify readiness and hosted support before claiming it works. Never assume a working platform login proves application login or silently replace its auth provider. The plan builds into Dev unless environment is prod; prod builds straight into Prod without a Dev deployment (a project with shared data and a database must deploy to Dev and promote instead). The plan stays valid for 24 hours.",
     z.object({
       project_id: identifier,
       commit_sha: commitSha,
@@ -2653,6 +2655,310 @@ export function createLocalOhmyhostMcpServer(dependencies: LocalOhmyhostMcpDepen
     },
     destructiveAnnotations(),
   );
+  const nativeScope = { project_id: identifier, environment_id: identifier };
+  const nativeProvider = z.enum(["google", "github"]);
+  const nativeRun = (
+    client: LocalMcpProductClient,
+    command: import("@ohmyhost/product-cli").NativeAuthCommand,
+  ) => {
+    if (!client.nativeAuth) throw new Error("Native Auth unavailable");
+    return client.nativeAuth(command);
+  };
+  registerProductTool(
+    server,
+    dependencies,
+    "native_auth_config_get",
+    "Read Owner Native Auth configuration and readiness.",
+    z.object(nativeScope),
+    (client, input) =>
+      nativeRun(client, {
+        action: "config_get",
+        projectId: input.project_id,
+        environmentId: input.environment_id,
+      }),
+  );
+  registerProductTool(
+    server,
+    dependencies,
+    "native_auth_config_set",
+    "Update Owner Native Auth configuration at the current revision.",
+    z.object({
+      ...nativeScope,
+      configuration_revision: z.number().int().min(0),
+      enabled: z.boolean(),
+      signup_policy: z.enum(["open", "invite-only"]),
+      application_name: z
+        .string()
+        .trim()
+        .min(1)
+        .max(128)
+        .refine((value) => !/\p{Cc}/u.test(value)),
+      canonical_origin: z
+        .string()
+        .url()
+        .refine((value) => {
+          try {
+            const url = new URL(value);
+            return (
+              url.protocol === "https:" && url.origin === value && !url.username && !url.password
+            );
+          } catch {
+            return false;
+          }
+        })
+        .nullable()
+        .optional(),
+      allowed_redirect_paths: z
+        .array(z.string().refine(isNativeAuthRedirectPath))
+        .min(1)
+        .max(16)
+        .refine((paths) => new Set(paths).size === paths.length)
+        .optional(),
+      reset_password_path: z.string().refine(isNativeAuthRedirectPath).optional(),
+      invitation_path: z.string().refine(isNativeAuthRedirectPath).optional(),
+      idempotency_key: idempotencyKey,
+    }),
+    (client, input) => {
+      const paths = input.allowed_redirect_paths;
+      if (
+        paths &&
+        [input.reset_password_path, input.invitation_path].some(
+          (path) => path !== undefined && !paths.includes(path),
+        )
+      )
+        throw new TypeError("Native Auth form path must be in the redirect allowlist");
+      return nativeRun(client, {
+        action: "config_set",
+        projectId: input.project_id,
+        environmentId: input.environment_id,
+        configurationRevision: input.configuration_revision,
+        enabled: input.enabled,
+        signupPolicy: input.signup_policy,
+        applicationName: input.application_name,
+        ...(input.canonical_origin === undefined
+          ? {}
+          : { canonicalOrigin: input.canonical_origin }),
+        ...(input.allowed_redirect_paths === undefined
+          ? {}
+          : { allowedRedirectPaths: input.allowed_redirect_paths }),
+        ...(input.reset_password_path === undefined
+          ? {}
+          : { resetPasswordPath: input.reset_password_path }),
+        ...(input.invitation_path === undefined ? {} : { invitationPath: input.invitation_path }),
+        idempotencyKey: input.idempotency_key,
+      });
+    },
+    mutationAnnotations(),
+  );
+  registerProductTool(
+    server,
+    dependencies,
+    "native_auth_provider_get",
+    "Read provider setup without its secret.",
+    z.object({ ...nativeScope, provider: nativeProvider }),
+    (client, input) =>
+      nativeRun(client, {
+        action: "provider_get",
+        projectId: input.project_id,
+        environmentId: input.environment_id,
+        provider: input.provider,
+      }),
+  );
+  registerProductTool(
+    server,
+    dependencies,
+    "native_auth_provider_set",
+    "Update provider settings without submitting a secret.",
+    z
+      .object({
+        ...nativeScope,
+        provider: nativeProvider,
+        configuration_revision: z.number().int().min(0),
+        enabled: z.boolean(),
+        client_id: z.string().min(1).max(1024).optional(),
+        idempotency_key: idempotencyKey,
+      })
+      .strict(),
+    (client, input) =>
+      nativeRun(client, {
+        action: "provider_set",
+        projectId: input.project_id,
+        environmentId: input.environment_id,
+        provider: input.provider,
+        configurationRevision: input.configuration_revision,
+        enabled: input.enabled,
+        ...(input.client_id === undefined ? {} : { clientId: input.client_id }),
+        idempotencyKey: input.idempotency_key,
+      }),
+    mutationAnnotations(),
+  );
+  registerProductTool(
+    server,
+    dependencies,
+    "native_auth_users_list",
+    "List Native Auth users with bounded pagination.",
+    z.object({
+      ...nativeScope,
+      limit: z.number().int().min(1).max(100).optional(),
+      cursor: z.string().min(1).max(512).optional(),
+      search: z.string().min(1).max(320).optional(),
+    }),
+    (client, input) =>
+      nativeRun(client, {
+        action: "users_list",
+        projectId: input.project_id,
+        environmentId: input.environment_id,
+        ...(input.limit === undefined ? {} : { limit: input.limit }),
+        ...(input.cursor === undefined ? {} : { cursor: input.cursor }),
+        ...(input.search === undefined ? {} : { search: input.search }),
+      }),
+  );
+  registerProductTool(
+    server,
+    dependencies,
+    "native_auth_user_create",
+    "Create and invite a Native Auth user without choosing a password.",
+    z.object({
+      ...nativeScope,
+      email: z.string().email().max(254),
+      idempotency_key: idempotencyKey,
+    }),
+    (client, input) =>
+      nativeRun(client, {
+        action: "user_create",
+        projectId: input.project_id,
+        environmentId: input.environment_id,
+        email: input.email,
+        idempotencyKey: input.idempotency_key,
+      }),
+    mutationAnnotations(),
+  );
+  registerProductTool(
+    server,
+    dependencies,
+    "native_auth_user_get",
+    "Read a Native Auth user.",
+    z.object({ ...nativeScope, user_id: z.string().uuid() }),
+    (client, input) =>
+      nativeRun(client, {
+        action: "user_get",
+        projectId: input.project_id,
+        environmentId: input.environment_id,
+        userId: input.user_id,
+      }),
+  );
+  const nativeUserActionInput = z.object({
+    ...nativeScope,
+    user_id: z.string().uuid(),
+    idempotency_key: idempotencyKey,
+    confirm: z.literal(true),
+  });
+  const nativeUserAction =
+    (
+      action:
+        | "user_delete"
+        | "user_invite"
+        | "user_suspend"
+        | "user_reactivate"
+        | "user_revoke_sessions",
+    ) =>
+    (client: LocalMcpProductClient, input: z.infer<typeof nativeUserActionInput>) =>
+      nativeRun(client, {
+        action,
+        projectId: input.project_id,
+        environmentId: input.environment_id,
+        userId: input.user_id,
+        idempotencyKey: input.idempotency_key,
+      });
+  registerProductTool(
+    server,
+    dependencies,
+    "native_auth_user_delete",
+    "Delete an Owner-authorized Native Auth user.",
+    nativeUserActionInput,
+    nativeUserAction("user_delete"),
+    destructiveAnnotations(),
+  );
+  registerProductTool(
+    server,
+    dependencies,
+    "native_auth_user_invite",
+    "Resend an Owner-authorized Native Auth user's invitation.",
+    nativeUserActionInput,
+    nativeUserAction("user_invite"),
+    destructiveAnnotations(),
+  );
+  registerProductTool(
+    server,
+    dependencies,
+    "native_auth_user_suspend",
+    "Suspend an Owner-authorized Native Auth user.",
+    nativeUserActionInput,
+    nativeUserAction("user_suspend"),
+    destructiveAnnotations(),
+  );
+  registerProductTool(
+    server,
+    dependencies,
+    "native_auth_user_reactivate",
+    "Reactivate an Owner-authorized Native Auth user.",
+    nativeUserActionInput,
+    nativeUserAction("user_reactivate"),
+    destructiveAnnotations(),
+  );
+  registerProductTool(
+    server,
+    dependencies,
+    "native_auth_user_revoke_sessions",
+    "Revoke an Owner-authorized Native Auth user's sessions.",
+    nativeUserActionInput,
+    nativeUserAction("user_revoke_sessions"),
+    destructiveAnnotations(),
+  );
+  registerProductTool(
+    server,
+    dependencies,
+    "native_auth_provider_secret_input_request",
+    "Return an account-bound stdin-only command; never place a provider secret in MCP arguments.",
+    z
+      .object({
+        ...nativeScope,
+        provider: nativeProvider,
+        configuration_revision: z.number().int().min(0),
+        enabled: z.boolean(),
+        client_id: z.string().min(1).max(1024).optional(),
+        idempotency_key: idempotencyKey,
+      })
+      .strict(),
+    async (client, input, signal) => {
+      await client.getProject(input.project_id);
+      const account = await handoverAccount(client, signal);
+      return {
+        command: [
+          `${commandPrefix} auth provider set`,
+          "--project",
+          shellQuote(input.project_id),
+          "--environment",
+          shellQuote(input.environment_id),
+          "--provider",
+          input.provider,
+          "--revision",
+          String(input.configuration_revision),
+          "--enabled",
+          String(input.enabled),
+          ...(input.client_id === undefined ? [] : ["--client-id", shellQuote(input.client_id)]),
+          "--idempotency-key",
+          shellQuote(input.idempotency_key),
+          ...account.flags,
+          "--stdin",
+          "--json",
+        ].join(" "),
+        acting_as: client.actingAs?.() ?? null,
+        instruction: `Pass the provider secret on stdin in a local terminal; ${account.runs}. Never put it in MCP, arguments, source, or logs.`,
+      };
+    },
+  );
+
   registerProductTool(
     server,
     dependencies,

package/src/apps/product-cli/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ohmyhost/product-cli",
-  "version": "0.1.49",
+  "version": "0.1.52",
   "private": true,
   "ohmyhost": {
     "deployment": "production",

package/src/apps/product-cli/src/cli.ts

@@ -518,6 +518,7 @@ const HELP_USAGE = Object.freeze({
     "ohmyhost function runs --project ULID --environment ENVIRONMENT_ULID [--limit 1-100] --json",
   "secret set":
     "printf '%s' \"$SECRET_VALUE\" | ohmyhost secret set NAME --project ULID --environment ENVIRONMENT_ULID --idempotency-key KEY [--profile-user USER_ID --profile-organization ULID | --token-user USER_ID --token-organization ULID] --stdin [--wait] --json (with --profile-user and --profile-organization the saved login that runs it must belong to that user and organization; with --token-user and --token-organization it runs only with an OHMYHOST_TOKEN of that user and organization, never with a saved login)",
+  auth: "ohmyhost auth config get|set --project ULID --environment ULID [--revision N --enabled true|false --signup-policy open|invite-only --application-name NAME --idempotency-key KEY] [--canonical-origin URL|primary] [--allowed-redirect-paths JSON_ARRAY --reset-password-path PATH --invitation-path PATH]; auth provider get|set --project ULID --environment ULID --provider google|github [--revision N --enabled true|false --client-id ID --idempotency-key KEY --stdin]; auth users list --project ULID --environment ULID [--limit N --cursor CURSOR --search TEXT]; auth user create|get|delete|invite|suspend|reactivate|revoke-sessions --project ULID --environment ULID [--email EMAIL | --user UUID] [--idempotency-key KEY]. Provider secrets are read only from stdin; use --json.",
   "secret delete":
     "ohmyhost secret delete NAME --project ULID --environment ENVIRONMENT_ULID --idempotency-key KEY [--wait] --json",
   "mail workspace list": "ohmyhost mail workspace list --organization ULID --json",
@@ -1276,6 +1277,26 @@ export class ProductCli {
       if (command.kind === "secret-list") return await this.listEnvironmentSecrets(command, signal);
       if (command.kind === "function-runs") return await this.listFunctionRuns(command, signal);
       if (command.kind === "secret-set") return await this.putEnvironmentSecret(command, signal);
+      if (command.kind === "native-auth") {
+        const api = await this.authenticatedApi(command.credentialStore, signal);
+        if (!api.nativeAuth) throw new Error("Native Auth unavailable");
+        if (command.stdin && command.request.action === "provider_set") {
+          const secret = await this.dependencies.readSecretValue(signal);
+          const bytes = new TextEncoder().encode(secret);
+          if (bytes.length === 0 || bytes.length > 5120) {
+            bytes.fill(0);
+            throw new SecretInputError();
+          }
+          try {
+            return success("auth", {
+              auth: await api.nativeAuth({ ...command.request, clientSecret: secret }),
+            });
+          } finally {
+            bytes.fill(0);
+          }
+        }
+        return success("auth", { auth: await api.nativeAuth(command.request) });
+      }
       if (command.kind === "shared-mail") {
         const api = await this.authenticatedApi(command.credentialStore, signal);
         if (!api.sharedMail) throw new Error("Shared mail unavailable");
@@ -3693,6 +3714,7 @@ const parsedCommandName = (command: ProductCliCommand): CommandLabel => {
   if (command.kind === "function-runs") return "function runs";
   if (command.kind === "secret-set") return "secret set";
   if (command.kind === "secret-delete") return "secret delete";
+  if (command.kind === "native-auth") return "auth";
   if (command.kind === "shared-mail" || command.kind === "managed-mail") return command.label;
   if (command.kind === "profile-list") return "profile list";
   return command.kind;

package/src/apps/product-cli/src/command.ts

@@ -26,6 +26,8 @@ import {
   type ProjectDataChangeKind,
 } from "@ohmyhost/contracts/project-data-changes";
 import type { ManagedMailCommand, SharedMailCommand } from "@ohmyhost/sdk-ts";
+import type { NativeAuthCommand } from "./native-auth.js";
+import { isNativeAuthRedirectPath } from "@ohmyhost/contracts/native-auth";
 import { USER_API_KEY_ID } from "@ohmyhost/contracts/user-api-keys";
 import { WORKOS_USER_API_KEY_PATTERN } from "@ohmyhost/workos-auth-contracts/user-api-keys";
 import { isProfileName, isProfileUserId } from "./profile-store.js";
@@ -86,6 +88,14 @@ export type SourceCliCommand =
     };
 export type ProductCliCommand =
   | SourceCliCommand
+  | {
+      readonly kind: "native-auth";
+      readonly request: NativeAuthCommand;
+      readonly stdin: boolean;
+      readonly credentialStore: "native";
+      readonly environmentToken?: HandedAccount;
+      readonly profileAccount?: HandedAccount;
+    }
   | {
       readonly kind: "project-data-plan";
       readonly projectId: string;
@@ -978,6 +988,7 @@ function parseSourceCommand(values: string[], wait: boolean): SourceCliCommand {
 }
 
 export type RecognizedCommandLabel =
+  | "auth"
   | "source inspect"
   | "source status"
   | "source files"
@@ -1291,6 +1302,7 @@ export const recognizedCommandLabel = (argv: readonly string[]): RecognizedComma
       if (values[0] === "set") return "secret set";
       if (values[0] === "delete") return "secret delete";
     }
+    if (value === "auth") return "auth";
     if (value === "function" && values[0] === "runs") return "function runs";
     if (value === "mail") {
       if (["workspace", "binding", "identity"].includes(values[0] ?? "")) {
@@ -1350,6 +1362,229 @@ export const parseProductCliCommand = (argv: readonly string[]): ProductCliComma
   const follow = removeFlag(values, "--follow");
   const stdin = removeFlag(values, "--stdin");
   const first = values.shift();
+  if (first === "auth") {
+    if (dryRun || revoke || yes || wait || follow) throw new InvalidCommandError();
+    const area = values.shift();
+    const action = values.shift();
+    const actionKey = `${area}_${action}`;
+    const options = parseOptionalOptions(values, [
+      "--project",
+      "--environment",
+      "--idempotency-key",
+      "--revision",
+      "--enabled",
+      "--signup-policy",
+      "--application-name",
+      "--canonical-origin",
+      "--allowed-redirect-paths",
+      "--reset-password-path",
+      "--invitation-path",
+      "--provider",
+      "--client-id",
+      "--user",
+      "--email",
+      "--limit",
+      "--cursor",
+      "--search",
+      "--token-user",
+      "--token-organization",
+      "--profile-user",
+      "--profile-organization",
+    ]);
+    const actionOptions: Readonly<Record<string, readonly string[]>> = {
+      config_get: [],
+      config_set: [
+        "--idempotency-key",
+        "--revision",
+        "--enabled",
+        "--signup-policy",
+        "--application-name",
+        "--canonical-origin",
+        "--allowed-redirect-paths",
+        "--reset-password-path",
+        "--invitation-path",
+      ],
+      provider_get: ["--provider"],
+      provider_set: [
+        "--provider",
+        "--idempotency-key",
+        "--revision",
+        "--enabled",
+        "--client-id",
+        "--token-user",
+        "--token-organization",
+        "--profile-user",
+        "--profile-organization",
+      ],
+      users_list: ["--limit", "--cursor", "--search"],
+      user_create: ["--idempotency-key", "--email"],
+      user_get: ["--user"],
+      user_delete: ["--user", "--idempotency-key"],
+      user_invite: ["--user", "--idempotency-key"],
+      user_suspend: ["--user", "--idempotency-key"],
+      user_reactivate: ["--user", "--idempotency-key"],
+      "user_revoke-sessions": ["--user", "--idempotency-key"],
+    };
+    const admittedOptions = actionOptions[actionKey];
+    if (
+      !admittedOptions ||
+      Object.keys(options).some(
+        (key) => key !== "--project" && key !== "--environment" && !admittedOptions.includes(key),
+      )
+    )
+      throw new InvalidCommandError();
+    const projectId = options["--project"],
+      environmentId = options["--environment"];
+    if (!projectId || !environmentId) throw new InvalidCommandError();
+    const scope = { projectId, environmentId };
+    const idempotencyKey = options["--idempotency-key"];
+    const revision = Number(options["--revision"]);
+    const enabled =
+      options["--enabled"] === "true" ? true : options["--enabled"] === "false" ? false : null;
+    const provider = options["--provider"];
+    const userId = options["--user"];
+    let request: NativeAuthCommand;
+    if (actionKey === "config_get") request = { ...scope, action: "config_get" };
+    else if (
+      actionKey === "config_set" &&
+      idempotencyKey &&
+      Number.isSafeInteger(revision) &&
+      revision >= 0 &&
+      enabled !== null &&
+      (options["--signup-policy"] === "open" || options["--signup-policy"] === "invite-only") &&
+      options["--application-name"]
+    ) {
+      const rawPaths = options["--allowed-redirect-paths"];
+      let paths: unknown;
+      if (rawPaths !== undefined) {
+        try {
+          paths = JSON.parse(rawPaths);
+        } catch {
+          throw new InvalidCommandError();
+        }
+        if (
+          !Array.isArray(paths) ||
+          paths.length < 1 ||
+          paths.length > 16 ||
+          !paths.every(isNativeAuthRedirectPath) ||
+          new Set(paths).size !== paths.length
+        )
+          throw new InvalidCommandError();
+      }
+      for (const path of [options["--reset-password-path"], options["--invitation-path"]]) {
+        if (
+          path !== undefined &&
+          (!isNativeAuthRedirectPath(path) || (Array.isArray(paths) && !paths.includes(path)))
+        )
+          throw new InvalidCommandError();
+      }
+      const origin = options["--canonical-origin"];
+      if (origin !== undefined && origin !== "primary") {
+        try {
+          const url = new URL(origin);
+          if (url.protocol !== "https:" || url.origin !== origin || url.username || url.password)
+            throw new InvalidCommandError();
+        } catch {
+          throw new InvalidCommandError();
+        }
+      }
+      request = {
+        ...scope,
+        action: "config_set",
+        idempotencyKey,
+        configurationRevision: revision,
+        enabled,
+        signupPolicy: options["--signup-policy"],
+        applicationName: options["--application-name"],
+        ...(options["--canonical-origin"] === undefined
+          ? {}
+          : {
+              canonicalOrigin:
+                options["--canonical-origin"] === "primary" ? null : options["--canonical-origin"],
+            }),
+        ...(paths === undefined ? {} : { allowedRedirectPaths: paths as string[] }),
+        ...(options["--reset-password-path"] === undefined
+          ? {}
+          : { resetPasswordPath: options["--reset-password-path"] }),
+        ...(options["--invitation-path"] === undefined
+          ? {}
+          : { invitationPath: options["--invitation-path"] }),
+      };
+    } else if (actionKey === "provider_get" && (provider === "google" || provider === "github"))
+      request = { ...scope, action: "provider_get", provider };
+    else if (
+      actionKey === "provider_set" &&
+      idempotencyKey &&
+      Number.isSafeInteger(revision) &&
+      revision >= 0 &&
+      enabled !== null &&
+      (provider === "google" || provider === "github")
+    )
+      request = {
+        ...scope,
+        action: "provider_set",
+        provider,
+        idempotencyKey,
+        configurationRevision: revision,
+        enabled,
+        ...(options["--client-id"] ? { clientId: options["--client-id"] } : {}),
+      };
+    else if (actionKey === "users_list") {
+      const limit = options["--limit"] === undefined ? undefined : Number(options["--limit"]);
+      if (limit !== undefined && (!Number.isInteger(limit) || limit < 1 || limit > 100))
+        throw new InvalidCommandError();
+      request = {
+        ...scope,
+        action: "users_list",
+        ...(limit === undefined ? {} : { limit }),
+        ...(options["--cursor"] ? { cursor: options["--cursor"] } : {}),
+        ...(options["--search"] ? { search: options["--search"] } : {}),
+      };
+    } else if (actionKey === "user_create" && idempotencyKey && options["--email"])
+      request = { ...scope, action: "user_create", idempotencyKey, email: options["--email"] };
+    else if (actionKey === "user_get" && userId) request = { ...scope, action: "user_get", userId };
+    else if (
+      idempotencyKey &&
+      userId &&
+      [
+        "user_delete",
+        "user_invite",
+        "user_suspend",
+        "user_reactivate",
+        "user_revoke-sessions",
+      ].includes(actionKey)
+    )
+      request = {
+        ...scope,
+        action: (actionKey === "user_revoke-sessions" ? "user_revoke_sessions" : actionKey) as
+          | "user_delete"
+          | "user_invite"
+          | "user_suspend"
+          | "user_reactivate"
+          | "user_revoke_sessions",
+        userId,
+        idempotencyKey,
+      };
+    else throw new InvalidCommandError();
+    if (stdin && request.action !== "provider_set") throw new InvalidCommandError();
+    const environmentToken = handedAccount(
+      options["--token-user"],
+      options["--token-organization"],
+    );
+    const profileAccount = handedAccount(
+      options["--profile-user"],
+      options["--profile-organization"],
+    );
+    if (environmentToken && profileAccount) throw new InvalidCommandError();
+    return {
+      kind: "native-auth",
+      request,
+      stdin,
+      credentialStore,
+      ...(environmentToken ? { environmentToken } : {}),
+      ...(profileAccount ? { profileAccount } : {}),
+    };
+  }
   if (first === "source" && values[0] !== "auto-deploy") {
     if (dryRun || revoke || yes || follow || stdin) throw new InvalidCommandError();
     return parseSourceCommand(values, wait);