@amerged/ohmyhost-cli 0.1.11 → 0.1.13

package/README.md

@@ -1,6 +1,6 @@
 # @amerged/ohmyhost-cli
 
-ohmyho.st cli client, version 0.1.11.
+ohmyho.st cli client, version 0.1.13.
 
 ```sh
 npm install --global @amerged/ohmyhost-cli

package/dist/bin.js

@@ -2,7 +2,7 @@
 import { createRequire as __ohmyhostCreateRequire } from "node:module"; const require = __ohmyhostCreateRequire(import.meta.url);
 import {
   runProductionCli
-} from "./chunk-WT2RRQUB.js";
+} from "./chunk-ZWAAQEOZ.js";
 import "./chunk-4HFQ54FP.js";
 
 // apps/product-cli/dist/bin.js

package/dist/{chunk-WT2RRQUB.js → chunk-ZWAAQEOZ.js}

@@ -15002,6 +15002,8 @@ var recognizedCommandLabel = (argv) => {
       return "project status";
     if (value === "project" && values[0] === "handle" && values[1] === "check")
       return "project handle check";
+    if (value === "project" && values[0] === "handle" && values[1] === "set")
+      return "project handle set";
     if (value === "project" && values[0] === "dev-access" && values[1] === "create")
       return "project dev-access create";
     if (value === "database" && values[0] === "compute" && values[1] === "set")
@@ -15444,6 +15446,25 @@ var parseProductCliCommand = (argv) => {
   }
   if (first === "project") {
     const subcommand = values.shift();
+    if (subcommand === "handle" && values[0] === "set") {
+      values.shift();
+      if (yes || wait || follow || stdin)
+        throw new InvalidCommandError();
+      const options2 = parseOptions(values, [
+        "--project",
+        "--handle",
+        "--if-match",
+        "--idempotency-key"
+      ]);
+      return {
+        kind: "project-handle-set",
+        projectId: options2["--project"],
+        handle: options2["--handle"],
+        ifMatch: options2["--if-match"],
+        idempotencyKey: options2["--idempotency-key"],
+        credentialStore
+      };
+    }
     if (subcommand === "handle" && values.shift() === "check") {
       if (yes || wait || follow || stdin)
         throw new InvalidCommandError();
@@ -16751,6 +16772,26 @@ var PROBLEM_POLICY = {
     retryable: true,
     action: "Retry project creation with the same idempotency key."
   },
+  project_handle_taken: {
+    status: 409,
+    retryable: false,
+    action: "Run 'ohmyhost project handle check' for a free address, then rename to one of the alternatives it returns."
+  },
+  project_handle_invalid: {
+    status: 409,
+    retryable: false,
+    action: "Choose one to five lowercase words of letters and digits, three to fifty-nine characters, avoiding reserved words."
+  },
+  project_handle_unchanged: {
+    status: 409,
+    retryable: false,
+    action: "The project already answers on this address; no rename is needed."
+  },
+  project_rename_blocked: {
+    status: 409,
+    retryable: true,
+    action: "Wait for the running operation to finish, read the project again, then rename with the new ETag."
+  },
   project_identity_unavailable: {
     status: 503,
     retryable: true,
@@ -16816,6 +16857,11 @@ var PROBLEM_POLICY = {
     retryable: false,
     action: "Run 'ohmyhost init', apply the matching ohmyhost framework skill, then plan the new commit."
   },
+  repository_configuration_missing: {
+    status: 409,
+    retryable: false,
+    action: "Place ohmyhost.yaml at the Git repository root and set applicationRoot to the application directory (for example website). Commit and push the change, then plan the new commit."
+  },
   migration_filename_noncanonical: {
     status: 409,
     retryable: false,
@@ -17074,7 +17120,7 @@ var parseDevAccessTicket = (value) => {
   ]);
   const origin = input["origin"];
   const redeemUrl = input["redeem_url"];
-  if (!isUlid(input["ticket_id"]) || !isUlid(input["project_id"]) || !isUlid(input["environment_id"]) || typeof origin !== "string" || !/^https:\/\/dev-[a-z]+-[a-z]+-[a-z]+\.(?:dev\.)?check\.omh\.st$/u.test(origin) || typeof redeemUrl !== "string" || !/^https:\/\/dev-[a-z]+-[a-z]+-[a-z]+\.(?:dev\.)?check\.omh\.st\/\.ohmyhost\/dev-access\/redeem\?stage=dev&ticket=[A-Za-z0-9_-]{43}$/u.test(redeemUrl) || new URL(redeemUrl).origin !== origin || !isIsoInstant(input["expires_at"])) {
+  if (!isUlid(input["ticket_id"]) || !isUlid(input["project_id"]) || !isUlid(input["environment_id"]) || typeof origin !== "string" || !/^https:\/\/dev-[a-z0-9]+(?:-[a-z0-9]+){0,4}\.(?:dev\.)?check\.omh\.st$/u.test(origin) || typeof redeemUrl !== "string" || !/^https:\/\/dev-[a-z0-9]+(?:-[a-z0-9]+){0,4}\.(?:dev\.)?check\.omh\.st\/\.ohmyhost\/dev-access\/redeem\?stage=dev&ticket=[A-Za-z0-9_-]{43}$/u.test(redeemUrl) || new URL(redeemUrl).origin !== origin || !isIsoInstant(input["expires_at"])) {
     throw new ResponseContractError();
   }
   return input;
@@ -17197,7 +17243,7 @@ var parseProject = (value) => {
     "region",
     "created_at"
   ]);
-  if (!isUlid(input["id"]) || !isUlid(input["organization_id"]) || !boundedString(input["name"], 1, 128) || input["name"] !== input["name"].trim() || !boundedString(input["handle"], 5, 59) || !/^[a-z]+-[a-z]+-[a-z]+$/u.test(input["handle"]) || input["data_mode"] !== "shared" && input["data_mode"] !== "isolated" || input["region"] !== "us" && input["region"] !== "eu" || !isIsoInstant(input["created_at"])) {
+  if (!isUlid(input["id"]) || !isUlid(input["organization_id"]) || !boundedString(input["name"], 1, 128) || input["name"] !== input["name"].trim() || !boundedString(input["handle"], 3, 59) || !/^[a-z0-9]+(?:-[a-z0-9]+){0,4}$/u.test(input["handle"]) || input["data_mode"] !== "shared" && input["data_mode"] !== "isolated" || input["region"] !== "us" && input["region"] !== "eu" || !isIsoInstant(input["created_at"])) {
     throw new ResponseContractError();
   }
   return input;
@@ -17215,6 +17261,7 @@ var parseProjectPage = (value) => {
 var parseProjectStatus = (value) => {
   const input = exactRecord2(value, [
     "project_id",
+    "etag",
     "handle",
     "region",
     "lifecycle",
@@ -17228,7 +17275,7 @@ var parseProjectStatus = (value) => {
     "cleanup_state"
   ]);
   const handle = input["handle"];
-  if (!isUlid(input["project_id"]) || !boundedString(handle, 5, 59) || !/^[a-z]+-[a-z]+-[a-z]+$/u.test(handle) || input["region"] !== "us" && input["region"] !== "eu" || input["lifecycle"] !== "active" && input["lifecycle"] !== "deleting" && input["lifecycle"] !== "deleted" || input["dev_url"] !== null && ![`https://dev-${handle}.dev.check.omh.st`, `https://dev-${handle}.check.omh.st`].includes(String(input["dev_url"])) || input["prod_url"] !== null && ![`https://${handle}.dev.check.omh.st`, `https://${handle}.check.omh.st`].includes(String(input["prod_url"])) || input["cleanup_state"] !== "not_started" && input["cleanup_state"] !== "pending" && input["cleanup_state"] !== "completed" && input["cleanup_state"] !== "reconciliation_required") {
+  if (!isUlid(input["project_id"]) || typeof input["etag"] !== "string" || !/^"sha256-[a-f0-9]{64}"$/u.test(input["etag"]) || !boundedString(handle, 3, 59) || !/^[a-z0-9]+(?:-[a-z0-9]+){0,4}$/u.test(handle) || input["region"] !== "us" && input["region"] !== "eu" || input["lifecycle"] !== "active" && input["lifecycle"] !== "deleting" && input["lifecycle"] !== "deleted" || input["dev_url"] !== null && ![`https://dev-${handle}.dev.check.omh.st`, `https://dev-${handle}.check.omh.st`].includes(String(input["dev_url"])) || input["prod_url"] !== null && ![`https://${handle}.dev.check.omh.st`, `https://${handle}.check.omh.st`].includes(String(input["prod_url"])) || input["cleanup_state"] !== "not_started" && input["cleanup_state"] !== "pending" && input["cleanup_state"] !== "completed" && input["cleanup_state"] !== "reconciliation_required") {
     throw new ResponseContractError();
   }
   if (input["source"] !== null)
@@ -17538,13 +17585,14 @@ var parseSafeProblem = (value) => {
   if (typeof code !== "string" || !(code in PROBLEM_POLICY))
     throw new ResponseContractError();
   const policy = PROBLEM_POLICY[code];
-  if (input["status"] !== policy.status || !boundedString(input["type"], 1, 512) || !isHttpsUrl(input["type"]) || !boundedString(input["title"], 1, 160) || !boundedString(input["request_id"], 1, 128) || typeof input["retryable"] !== "boolean" || !boundedString(input["suggested_action"], 1, 500) || input["detail"] !== void 0 && !boundedString(input["detail"], 1, 2e3) || input["instance"] !== void 0 && !boundedString(input["instance"], 1, 512)) {
+  if (input["status"] !== policy.status || !boundedString(input["type"], 1, 512) || !isHttpsUrl(input["type"]) || !boundedString(input["title"], 1, 160) || !boundedString(input["request_id"], 1, 128) || /[\p{Cc}\p{Cf}\p{Zl}\p{Zp}]/u.test(input["request_id"]) || typeof input["retryable"] !== "boolean" || !boundedString(input["suggested_action"], 1, 500) || input["detail"] !== void 0 && !boundedString(input["detail"], 1, 2e3) || input["instance"] !== void 0 && !boundedString(input["instance"], 1, 512)) {
     throw new ResponseContractError();
   }
   const retryAfter = input["retry_after_seconds"];
   if (retryAfter !== void 0 && (code !== "rate_limited" || typeof retryAfter !== "number" || !Number.isSafeInteger(retryAfter) || retryAfter < 1 || retryAfter > 86400))
     throw new ResponseContractError();
   return {
+    requestId: input["request_id"],
     code,
     retryable: policy.retryable,
     suggestedAction: (code === "framework_conversion_required" ? parseFrameworkConversionDetail(input["detail"]) ?? policy.action : policy.action) + (retryAfter === void 0 ? "" : ` Retry after ${String(retryAfter)} seconds.`),
@@ -17818,7 +17866,7 @@ function exact2(v, keys) {
 // apps/product-cli/package.json
 var package_default = {
   name: "@ohmyhost/product-cli",
-  version: "0.1.11",
+  version: "0.1.13",
   private: true,
   ohmyhost: {
     deployment: "production",
@@ -18182,6 +18230,7 @@ var HELP_USAGE = Object.freeze({
   "project status": "ohmyhost project status --project ULID --json",
   "project dev-access create": "ohmyhost project dev-access create --project ULID --json",
   "project handle check": "ohmyhost project handle check --handle HANDLE --json (is this address free? answers with a reason and free alternatives; the address becomes HANDLE.check.omh.st)",
+  "project handle set": "ohmyhost project handle set --project ULID --handle HANDLE --if-match ETAG --idempotency-key KEY --json (moves the project to a free address; the old one stops working and anyone may claim it)",
   "database compute set": "ohmyhost database compute set --project ULID --environment dev|prod --profile standard|performance --idempotency-key KEY --yes [--wait] --json\n  standard: Free 0.25 CU/1 GB/60s idle, Paid 0.5 CU/2 GB/60s idle. performance: Paid 1 CU/4 GB/300s idle, 2.5x database compute credits per equal active minute; longer idle time also consumes credits.",
   "database compute get": "ohmyhost database compute get --project ULID [--environment dev|prod] --json",
   "database write": "ohmyhost database write --project ULID --environment dev|prod --statement-file PATH --idempotency-key KEY [--parameters-json JSON] --yes --json",
@@ -18458,6 +18507,8 @@ var ProductCli = class {
         return await this.listProjects(command, signal);
       if (command.kind === "project-handle-check")
         return await this.checkProjectHandle(command, signal);
+      if (command.kind === "project-handle-set")
+        return await this.changeProjectHandle(command, signal);
       if (command.kind === "database-compute-set") {
         const api = await this.authenticatedApi(command.credentialStore, signal);
         let operation = parseOperation(await api.changeDatabaseCompute(command));
@@ -18797,6 +18848,16 @@ var ProductCli = class {
     }));
     return success("project list", { status: "succeeded", projects });
   }
+  async changeProjectHandle(command, signal) {
+    const api = await this.authenticatedApi(command.credentialStore, signal);
+    const operation = parseOperation(await api.changeProjectHandle({
+      projectId: command.projectId,
+      handle: command.handle,
+      ifMatch: command.ifMatch,
+      idempotencyKey: command.idempotencyKey
+    }));
+    return success("project handle set", { status: "accepted", operation });
+  }
   async checkProjectHandle(command, signal) {
     const api = await this.authenticatedApi(command.credentialStore, signal);
     const handle = await api.checkProjectHandle({ handle: command.handle });
@@ -19306,7 +19367,7 @@ var classifyFailure = (command, error, signal) => {
   if (looksLikeProblem(error)) {
     try {
       const problem = parseSafeProblem(error);
-      return failure(command, 7, problem.code, problem.retryable, problem.suggestedAction, void 0, problem.retryAfterSeconds);
+      return failure(command, 7, problem.code, problem.retryable, problem.suggestedAction, void 0, problem.retryAfterSeconds, problem.requestId);
     } catch {
       return failure(command, 7, "response_contract_invalid", false, "Retry only after the client or server contract is repaired.");
     }
@@ -19326,7 +19387,7 @@ var success = (command, body) => ({
 `,
   stderr: ""
 });
-var failure = (command, exitCode, code, retryable, suggestedAction, operation, retryAfterSeconds) => {
+var failure = (command, exitCode, code, retryable, suggestedAction, operation, retryAfterSeconds, requestId) => {
   const document = {
     version: 1,
     command,
@@ -19337,6 +19398,7 @@ var failure = (command, exitCode, code, retryable, suggestedAction, operation, r
       retryable,
       suggested_action: suggestedAction,
       ...retryAfterSeconds === void 0 ? {} : { retry_after_seconds: retryAfterSeconds },
+      ...requestId === void 0 ? {} : { request_id: requestId },
       ...operation?.error === void 0 ? {} : { message: operation.error.message }
     }
   };
@@ -19408,6 +19470,8 @@ var parsedCommandName = (command) => {
     return "project dev-access create";
   if (command.kind === "project-handle-check")
     return "project handle check";
+  if (command.kind === "project-handle-set")
+    return "project handle set";
   if (command.kind === "database-write")
     return "database write";
   if (command.kind === "database-query")
@@ -21106,6 +21170,31 @@ var getCloudflareDnsAuthorizationStatus = (parameters, options) => {
     ...params
   });
 };
+var changeProjectHandle = (parameters, options) => {
+  const params = buildClientParams([parameters], [
+    {
+      args: [
+        { in: "headers", key: "X-Request-Id" },
+        { in: "headers", key: "Idempotency-Key" },
+        { in: "headers", key: "If-Match" },
+        { in: "path", key: "project_id" },
+        { in: "body", key: "handle" }
+      ]
+    }
+  ]);
+  return (options?.client ?? client).put({
+    responseStyle: "data",
+    security: [{ scheme: "bearer", type: "http" }],
+    url: "/v1/projects/{project_id}/handle",
+    ...options,
+    ...params,
+    headers: {
+      "Content-Type": "application/json",
+      ...options?.headers,
+      ...params.headers
+    }
+  });
+};
 var configureProjectDomains = (parameters, options) => {
   const params = buildClientParams([parameters], [
     {
@@ -21852,6 +21941,14 @@ var GeneratedSdkProductApi = class {
   async listProjects(input) {
     return listProjects(input, { client: this.#client });
   }
+  async changeProjectHandle(input) {
+    return changeProjectHandle({
+      project_id: input.projectId,
+      "Idempotency-Key": input.idempotencyKey,
+      "If-Match": input.ifMatch,
+      handle: input.handle
+    }, { client: this.#client });
+  }
   async checkProjectHandle(input) {
     return getProjectHandleAvailability({ handle: input.handle }, { client: this.#client });
   }
@@ -22116,7 +22213,7 @@ var OwnerOnlyProjectLinkStore = class {
 // apps/product-cli/dist/repository-init.js
 import { createHash } from "node:crypto";
 import { lstat as lstat2, open as open3, readFile, readdir, stat } from "node:fs/promises";
-import { posix, resolve as resolve2 } from "node:path";
+import { dirname as dirname2, posix, resolve as resolve2 } from "node:path";
 
 // packages/contracts/dist/application-root.js
 var APPLICATION_ROOT_PATTERN = /^(?:\.|[A-Za-z0-9][A-Za-z0-9._-]*(?:\/[A-Za-z0-9][A-Za-z0-9._-]*)*)$/u;
@@ -23363,6 +23460,24 @@ async function assertRepositoryRoot(root) {
   if (!information.isDirectory()) {
     throw new RepositoryInitError("repository_not_directory", "Repository path is not a directory");
   }
+  for (let ancestor = root; ; ancestor = dirname2(ancestor)) {
+    let marker;
+    try {
+      marker = await lstat2(resolve2(ancestor, ".git"));
+    } catch (error) {
+      if (error.code !== "ENOENT") {
+        throw new RepositoryInitError("repository_unreadable", "Could not determine the Git repository root");
+      }
+    }
+    if (marker !== void 0) {
+      if (ancestor !== root) {
+        throw new RepositoryInitError("repository_root_required", "Run ohmyhost init from the Git repository root and select the application directory with --root; ohmyhost.yaml must be at the repository root.");
+      }
+      return;
+    }
+    if (dirname2(ancestor) === ancestor)
+      return;
+  }
 }
 async function collectRepositoryFiles(root) {
   const files = [];
@@ -24340,7 +24455,7 @@ var runOfflineInit = async (command, io, diagnostics) => {
     });
     const code = error instanceof RepositoryInitBlockedError ? "repository_init_blocked" : error instanceof RepositoryInitConflictError ? "repository_configuration_exists" : known ? error.code : "internal_error";
     const exitCode = error instanceof RepositoryInitBlockedError ? 9 : known ? 2 : 1;
-    const result = errorDocument("init", exitCode, code, false, error instanceof RepositoryInitConflictError ? "Keep the existing ohmyhost.yaml or remove it explicitly before retrying." : error instanceof RepositoryInitError && error.code === "project_name_invalid" ? "Pass a lowercase deployment slug with '--project', then rerun init." : "Run 'ohmyhost init --dry-run --json' and resolve every reported blocker.");
+    const result = errorDocument("init", exitCode, code, false, error instanceof RepositoryInitConflictError ? "Keep the existing ohmyhost.yaml or remove it explicitly before retrying." : error instanceof RepositoryInitError && error.code === "repository_root_required" ? "Run ohmyhost init from the Git repository root with --root set to the application directory (for example --root website); commit the root ohmyhost.yaml before planning." : error instanceof RepositoryInitError && error.code === "project_name_invalid" ? "Pass a lowercase deployment slug with '--project', then rerun init." : "Run 'ohmyhost init --dry-run --json' and resolve every reported blocker.");
     io.writeStdout(result.stdout);
     return result.exitCode;
   }

package/dist/index.js

@@ -47,7 +47,7 @@ import {
   selectWorkspace,
   selectedWorkspaceId,
   workspaceOf
-} from "./chunk-WT2RRQUB.js";
+} from "./chunk-ZWAAQEOZ.js";
 import {
   CredentialStoreIntegrityError,
   CredentialStoreUnavailableError,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@amerged/ohmyhost-cli",
-  "version": "0.1.11",
+  "version": "0.1.13",
   "type": "module",
   "engines": {
     "node": ">=22"

package/src/apps/product-cli/cli.ts

@@ -254,6 +254,7 @@ interface CliErrorDocument {
     readonly suggested_action: string;
     readonly message?: string;
     readonly retry_after_seconds?: number;
+    readonly request_id?: string;
   };
 }
 
@@ -312,6 +313,8 @@ const HELP_USAGE = Object.freeze({
   "project dev-access create": "ohmyhost project dev-access create --project ULID --json",
   "project handle check":
     "ohmyhost project handle check --handle HANDLE --json (is this address free? answers with a reason and free alternatives; the address becomes HANDLE.check.omh.st)",
+  "project handle set":
+    "ohmyhost project handle set --project ULID --handle HANDLE --if-match ETAG --idempotency-key KEY --json (moves the project to a free address; the old one stops working and anyone may claim it)",
   "database compute set":
     "ohmyhost database compute set --project ULID --environment dev|prod --profile standard|performance --idempotency-key KEY --yes [--wait] --json\n" +
     "  standard: Free 0.25 CU/1 GB/60s idle, Paid 0.5 CU/2 GB/60s idle. performance: Paid 1 CU/4 GB/300s idle, 2.5x database compute credits per equal active minute; longer idle time also consumes credits.",
@@ -691,6 +694,8 @@ export class ProductCli {
       if (command.kind === "project-list") return await this.listProjects(command, signal);
       if (command.kind === "project-handle-check")
         return await this.checkProjectHandle(command, signal);
+      if (command.kind === "project-handle-set")
+        return await this.changeProjectHandle(command, signal);
       if (command.kind === "database-compute-set") {
         const api = await this.authenticatedApi(command.credentialStore, signal);
         let operation = parseOperation(await api.changeDatabaseCompute(command));
@@ -1169,6 +1174,22 @@ export class ProductCli {
     return success("project list", { status: "succeeded", projects });
   }
 
+  private async changeProjectHandle(
+    command: Extract<ProductCliCommand, { kind: "project-handle-set" }>,
+    signal: AbortSignal,
+  ): Promise<CliResult> {
+    const api = await this.authenticatedApi(command.credentialStore, signal);
+    const operation = parseOperation(
+      await api.changeProjectHandle({
+        projectId: command.projectId,
+        handle: command.handle,
+        ifMatch: command.ifMatch,
+        idempotencyKey: command.idempotencyKey,
+      }),
+    );
+    return success("project handle set", { status: "accepted", operation });
+  }
+
   private async checkProjectHandle(
     command: Extract<ProductCliCommand, { kind: "project-handle-check" }>,
     signal: AbortSignal,
@@ -2030,6 +2051,7 @@ const classifyFailure = (command: CommandLabel, error: unknown, signal: AbortSig
         problem.suggestedAction,
         undefined,
         problem.retryAfterSeconds,
+        problem.requestId,
       );
     } catch {
       return failure(
@@ -2079,6 +2101,7 @@ const failure = (
   suggestedAction: string,
   operation?: ReturnType<typeof parseOperation>,
   retryAfterSeconds?: number,
+  requestId?: string,
 ): CliResult => {
   const document: CliErrorDocument = {
     version: 1,
@@ -2090,6 +2113,7 @@ const failure = (
       retryable,
       suggested_action: suggestedAction,
       ...(retryAfterSeconds === undefined ? {} : { retry_after_seconds: retryAfterSeconds }),
+      ...(requestId === undefined ? {} : { request_id: requestId }),
       ...(operation?.error === undefined ? {} : { message: operation.error.message }),
     },
   };
@@ -2129,6 +2153,7 @@ const parsedCommandName = (command: ProductCliCommand): CommandLabel => {
   if (command.kind === "project-status") return "project status";
   if (command.kind === "project-dev-access-create") return "project dev-access create";
   if (command.kind === "project-handle-check") return "project handle check";
+  if (command.kind === "project-handle-set") return "project handle set";
   if (command.kind === "database-write") return "database write";
   if (command.kind === "database-query") return "database query";
   if (command.kind === "database-access-create") return "database access create";

package/src/apps/product-cli/command.ts

@@ -132,6 +132,15 @@ export type ProductCliCommand =
       readonly idempotencyKey: string;
       readonly credentialStore: "native";
     }
+  | {
+      /** Moves a project to a chosen address once its gateways serve it. */
+      readonly kind: "project-handle-set";
+      readonly projectId: string;
+      readonly handle: string;
+      readonly ifMatch: string;
+      readonly idempotencyKey: string;
+      readonly credentialStore: "native";
+    }
   | {
       /** Asks whether a project address is free; the candidate is sent exactly as the agent typed it. */
       readonly kind: "project-handle-check";
@@ -494,6 +503,7 @@ export type RecognizedCommandLabel =
   | "project status"
   | "project dev-access create"
   | "project handle check"
+  | "project handle set"
   | "database write"
   | "database query"
   | "database access create"
@@ -585,6 +595,8 @@ export const recognizedCommandLabel = (argv: readonly string[]): RecognizedComma
     if (value === "project" && values[0] === "status") return "project status";
     if (value === "project" && values[0] === "handle" && values[1] === "check")
       return "project handle check";
+    if (value === "project" && values[0] === "handle" && values[1] === "set")
+      return "project handle set";
     if (value === "project" && values[0] === "dev-access" && values[1] === "create")
       return "project dev-access create";
     if (value === "database" && values[0] === "compute" && values[1] === "set")
@@ -1054,6 +1066,24 @@ export const parseProductCliCommand = (argv: readonly string[]): ProductCliComma
   }
   if (first === "project") {
     const subcommand = values.shift();
+    if (subcommand === "handle" && values[0] === "set") {
+      values.shift();
+      if (yes || wait || follow || stdin) throw new InvalidCommandError();
+      const options = parseOptions(values, [
+        "--project",
+        "--handle",
+        "--if-match",
+        "--idempotency-key",
+      ]);
+      return {
+        kind: "project-handle-set",
+        projectId: options["--project"],
+        handle: options["--handle"],
+        ifMatch: options["--if-match"],
+        idempotencyKey: options["--idempotency-key"],
+        credentialStore,
+      };
+    }
     if (subcommand === "handle" && values.shift() === "check") {
       if (yes || wait || follow || stdin) throw new InvalidCommandError();
       const options = parseOptions(values, ["--handle"]);

package/src/apps/product-cli/composition.ts

@@ -429,9 +429,11 @@ const runOfflineInit = async (
       false,
       error instanceof RepositoryInitConflictError
         ? "Keep the existing ohmyhost.yaml or remove it explicitly before retrying."
-        : error instanceof RepositoryInitError && error.code === "project_name_invalid"
-          ? "Pass a lowercase deployment slug with '--project', then rerun init."
-          : "Run 'ohmyhost init --dry-run --json' and resolve every reported blocker.",
+        : error instanceof RepositoryInitError && error.code === "repository_root_required"
+          ? "Run ohmyhost init from the Git repository root with --root set to the application directory (for example --root website); commit the root ohmyhost.yaml before planning."
+          : error instanceof RepositoryInitError && error.code === "project_name_invalid"
+            ? "Pass a lowercase deployment slug with '--project', then rerun init."
+            : "Run 'ohmyhost init --dry-run --json' and resolve every reported blocker.",
     );
     io.writeStdout(result.stdout);
     return result.exitCode;

package/src/apps/product-cli/product-api.ts

@@ -83,6 +83,7 @@ import {
   listEnvironmentSecrets,
   listFunctionRuns,
   listProjects,
+  changeProjectHandle,
   getProjectHandleAvailability,
   planDeployment,
   planPaidProjectDomain,
@@ -211,6 +212,12 @@ export interface ProductApi {
   getAccountProfile(): Promise<readonly PublicWorkspace[]>;
   listProjects(input: { readonly cursor?: string; readonly limit: number }): Promise<ProjectPage>;
   checkProjectHandle(input: { readonly handle: string }): Promise<ProjectHandleAvailability>;
+  changeProjectHandle(input: {
+    readonly projectId: string;
+    readonly handle: string;
+    readonly ifMatch: string;
+    readonly idempotencyKey: string;
+  }): Promise<Operation>;
   getProjectStatus(projectId: string): Promise<ProjectStatus>;
   writeProjectDatabase(
     input: ProjectDatabaseWriteRequest & { projectId: string; idempotencyKey: string },
@@ -585,6 +592,23 @@ export class GeneratedSdkProductApi implements ProductApi {
     return listProjects(input, { client: this.#client });
   }
 
+  public async changeProjectHandle(input: {
+    readonly projectId: string;
+    readonly handle: string;
+    readonly ifMatch: string;
+    readonly idempotencyKey: string;
+  }): Promise<Operation> {
+    return changeProjectHandle(
+      {
+        project_id: input.projectId,
+        "Idempotency-Key": input.idempotencyKey,
+        "If-Match": input.ifMatch,
+        handle: input.handle,
+      },
+      { client: this.#client },
+    );
+  }
+
   public async checkProjectHandle(input: {
     readonly handle: string;
   }): Promise<ProjectHandleAvailability> {

package/src/apps/product-cli/repository-init.ts

@@ -1,6 +1,6 @@
 import { createHash } from "node:crypto";
 import { lstat, open, readFile, readdir, stat } from "node:fs/promises";
-import { posix, resolve } from "node:path";
+import { dirname, posix, resolve } from "node:path";
 
 import {
   normalizeApplicationRoot,
@@ -876,6 +876,30 @@ async function assertRepositoryRoot(root: string): Promise<void> {
   if (!information.isDirectory()) {
     throw new RepositoryInitError("repository_not_directory", "Repository path is not a directory");
   }
+  // A Git worktree uses a .git file; never read or follow that file's target.
+  for (let ancestor = root; ; ancestor = dirname(ancestor)) {
+    let marker;
+    try {
+      marker = await lstat(resolve(ancestor, ".git"));
+    } catch (error) {
+      if ((error as NodeJS.ErrnoException).code !== "ENOENT") {
+        throw new RepositoryInitError(
+          "repository_unreadable",
+          "Could not determine the Git repository root",
+        );
+      }
+    }
+    if (marker !== undefined) {
+      if (ancestor !== root) {
+        throw new RepositoryInitError(
+          "repository_root_required",
+          "Run ohmyhost init from the Git repository root and select the application directory with --root; ohmyhost.yaml must be at the repository root.",
+        );
+      }
+      return;
+    }
+    if (dirname(ancestor) === ancestor) return;
+  }
 }
 
 async function collectRepositoryFiles(root: string): Promise<string[]> {

package/src/apps/product-cli/runtime-contract.ts

@@ -129,6 +129,29 @@ const PROBLEM_POLICY = {
     retryable: true,
     action: "Retry project creation with the same idempotency key.",
   },
+  project_handle_taken: {
+    status: 409,
+    retryable: false,
+    action:
+      "Run 'ohmyhost project handle check' for a free address, then rename to one of the alternatives it returns.",
+  },
+  project_handle_invalid: {
+    status: 409,
+    retryable: false,
+    action:
+      "Choose one to five lowercase words of letters and digits, three to fifty-nine characters, avoiding reserved words.",
+  },
+  project_handle_unchanged: {
+    status: 409,
+    retryable: false,
+    action: "The project already answers on this address; no rename is needed.",
+  },
+  project_rename_blocked: {
+    status: 409,
+    retryable: true,
+    action:
+      "Wait for the running operation to finish, read the project again, then rename with the new ETag.",
+  },
   project_identity_unavailable: {
     status: 503,
     retryable: true,
@@ -196,6 +219,12 @@ const PROBLEM_POLICY = {
     action:
       "Run 'ohmyhost init', apply the matching ohmyhost framework skill, then plan the new commit.",
   },
+  repository_configuration_missing: {
+    status: 409,
+    retryable: false,
+    action:
+      "Place ohmyhost.yaml at the Git repository root and set applicationRoot to the application directory (for example website). Commit and push the change, then plan the new commit.",
+  },
   migration_filename_noncanonical: {
     status: 409,
     retryable: false,
@@ -278,6 +307,7 @@ export class ResponseContractError extends Error {
 }
 
 export interface SafeProblem {
+  readonly requestId: string;
   readonly retryAfterSeconds?: number;
   readonly code: ProblemCode;
   readonly retryable: boolean;
@@ -676,9 +706,9 @@ export const parseDevAccessTicket = (value: unknown): PublicDevAccessTicket => {
     !isUlid(input["project_id"]) ||
     !isUlid(input["environment_id"]) ||
     typeof origin !== "string" ||
-    !/^https:\/\/dev-[a-z]+-[a-z]+-[a-z]+\.(?:dev\.)?check\.omh\.st$/u.test(origin) ||
+    !/^https:\/\/dev-[a-z0-9]+(?:-[a-z0-9]+){0,4}\.(?:dev\.)?check\.omh\.st$/u.test(origin) ||
     typeof redeemUrl !== "string" ||
-    !/^https:\/\/dev-[a-z]+-[a-z]+-[a-z]+\.(?:dev\.)?check\.omh\.st\/\.ohmyhost\/dev-access\/redeem\?stage=dev&ticket=[A-Za-z0-9_-]{43}$/u.test(
+    !/^https:\/\/dev-[a-z0-9]+(?:-[a-z0-9]+){0,4}\.(?:dev\.)?check\.omh\.st\/\.ohmyhost\/dev-access\/redeem\?stage=dev&ticket=[A-Za-z0-9_-]{43}$/u.test(
       redeemUrl,
     ) ||
     new URL(redeemUrl).origin !== origin ||
@@ -880,8 +910,8 @@ const parseProject = (value: unknown): PublicProject => {
     !isUlid(input["organization_id"]) ||
     !boundedString(input["name"], 1, 128) ||
     input["name"] !== input["name"].trim() ||
-    !boundedString(input["handle"], 5, 59) ||
-    !/^[a-z]+-[a-z]+-[a-z]+$/u.test(input["handle"]) ||
+    !boundedString(input["handle"], 3, 59) ||
+    !/^[a-z0-9]+(?:-[a-z0-9]+){0,4}$/u.test(input["handle"]) ||
     (input["data_mode"] !== "shared" && input["data_mode"] !== "isolated") ||
     (input["region"] !== "us" && input["region"] !== "eu") ||
     !isIsoInstant(input["created_at"])
@@ -910,6 +940,7 @@ export const parseProjectPage = (
 export const parseProjectStatus = (value: unknown): Readonly<Record<string, unknown>> => {
   const input = exactRecord(value, [
     "project_id",
+    "etag",
     "handle",
     "region",
     "lifecycle",
@@ -925,8 +956,10 @@ export const parseProjectStatus = (value: unknown): Readonly<Record<string, unkn
   const handle = input["handle"];
   if (
     !isUlid(input["project_id"]) ||
-    !boundedString(handle, 5, 59) ||
-    !/^[a-z]+-[a-z]+-[a-z]+$/u.test(handle) ||
+    typeof input["etag"] !== "string" ||
+    !/^"sha256-[a-f0-9]{64}"$/u.test(input["etag"]) ||
+    !boundedString(handle, 3, 59) ||
+    !/^[a-z0-9]+(?:-[a-z0-9]+){0,4}$/u.test(handle) ||
     (input["region"] !== "us" && input["region"] !== "eu") ||
     (input["lifecycle"] !== "active" &&
       input["lifecycle"] !== "deleting" &&
@@ -1540,6 +1573,7 @@ export const parseSafeProblem = (value: unknown): SafeProblem => {
     !isHttpsUrl(input["type"]) ||
     !boundedString(input["title"], 1, 160) ||
     !boundedString(input["request_id"], 1, 128) ||
+    /[\p{Cc}\p{Cf}\p{Zl}\p{Zp}]/u.test(input["request_id"]) ||
     typeof input["retryable"] !== "boolean" ||
     !boundedString(input["suggested_action"], 1, 500) ||
     (input["detail"] !== undefined && !boundedString(input["detail"], 1, 2_000)) ||
@@ -1558,6 +1592,7 @@ export const parseSafeProblem = (value: unknown): SafeProblem => {
   )
     throw new ResponseContractError();
   return {
+    requestId: input["request_id"],
     code: code as ProblemCode,
     retryable: policy.retryable,
     suggestedAction:

package/src/packages/sdk-ts/generated/index.ts

@@ -3,6 +3,7 @@
 export {
   applyPaidProjectDomain,
   changeDatabaseCompute,
+  changeProjectHandle,
   completeCloudflareDnsAuthorization,
   completeGithubSourceAuthorization,
   configureBillingRecharge,
@@ -101,6 +102,11 @@ export type {
   ChangeDatabaseComputeErrors,
   ChangeDatabaseComputeResponse,
   ChangeDatabaseComputeResponses,
+  ChangeProjectHandleData,
+  ChangeProjectHandleError,
+  ChangeProjectHandleErrors,
+  ChangeProjectHandleResponse,
+  ChangeProjectHandleResponses,
   ClientOptions,
   CloudflareDnsAuthorization,
   CloudflareDnsAuthorizationStatus,

package/src/packages/sdk-ts/generated/sdk.gen.ts

@@ -15,6 +15,8 @@ import type {
   ApplyPaidProjectDomainResponses,
   ChangeDatabaseComputeErrors,
   ChangeDatabaseComputeResponses,
+  ChangeProjectHandleErrors,
+  ChangeProjectHandleResponses,
   CompleteCloudflareDnsAuthorizationErrors,
   CompleteCloudflareDnsAuthorizationResponses,
   CompleteGithubSourceAuthorizationErrors,
@@ -2070,6 +2072,54 @@ export const getCloudflareDnsAuthorizationStatus = <ThrowOnError extends boolean
   });
 };
 
+/**
+ * Move a project to a chosen address
+ *
+ * Starts a durable operation that re-publishes the project's Dev and Prod gateways at the chosen address and stores it only once both serve it. The previous address stops answering and returns to the pool for any project to claim. Ask GET /v1/project-handles/{handle} first; a taken, unusable or unchanged address is refused before any gateway moves, and a project with an operation in flight is refused until it finishes.
+ */
+export const changeProjectHandle = <ThrowOnError extends boolean = true>(
+  parameters: {
+    "X-Request-Id"?: string;
+    "Idempotency-Key": string;
+    "If-Match": string;
+    project_id: Ulid;
+    handle: string;
+  },
+  options?: Options<never, ThrowOnError>,
+): RequestResult<ChangeProjectHandleResponses, ChangeProjectHandleErrors, ThrowOnError, "data"> => {
+  const params = buildClientParams(
+    [parameters],
+    [
+      {
+        args: [
+          { in: "headers", key: "X-Request-Id" },
+          { in: "headers", key: "Idempotency-Key" },
+          { in: "headers", key: "If-Match" },
+          { in: "path", key: "project_id" },
+          { in: "body", key: "handle" },
+        ],
+      },
+    ],
+  );
+  return (options?.client ?? client).put<
+    ChangeProjectHandleResponses,
+    ChangeProjectHandleErrors,
+    ThrowOnError,
+    "data"
+  >({
+    responseStyle: "data",
+    security: [{ scheme: "bearer", type: "http" }],
+    url: "/v1/projects/{project_id}/handle",
+    ...options,
+    ...params,
+    headers: {
+      "Content-Type": "application/json",
+      ...options?.headers,
+      ...params.headers,
+    },
+  });
+};
+
 /**
  * Apply the server-derived project domains
  *

package/src/packages/sdk-ts/generated/types.gen.ts

@@ -865,6 +865,10 @@ export type ProjectHandleAvailability = {
 };
 
 export type ProjectStatus = {
+  /**
+   * Optimistic-concurrency token for changing this project address; use it as If-Match on the handle endpoint.
+   */
+  etag: string;
   project_id: Ulid;
   handle: string;
   region: HostingRegion;
@@ -912,9 +916,14 @@ export type ProblemDetails = {
     | "mail_domain_required"
     | "storage_jurisdiction_conflict"
     | "framework_conversion_required"
+    | "repository_configuration_missing"
     | "migration_filename_noncanonical"
     | "environment_secret_mutation_blocked"
     | "workers_runtime_incompatible"
+    | "project_handle_invalid"
+    | "project_handle_taken"
+    | "project_handle_unchanged"
+    | "project_rename_blocked"
     | "payload_too_large"
     | "rate_limited"
     | "insufficient_organization_credits"
@@ -3812,6 +3821,80 @@ export type GetCloudflareDnsAuthorizationStatusResponses = {
 export type GetCloudflareDnsAuthorizationStatusResponse =
   GetCloudflareDnsAuthorizationStatusResponses[keyof GetCloudflareDnsAuthorizationStatusResponses];
 
+export type ChangeProjectHandleData = {
+  body: {
+    /**
+     * One to five lowercase words of letters and digits.
+     */
+    handle: string;
+  };
+  headers: {
+    /**
+     * Optional caller-provided correlation identifier.
+     */
+    "X-Request-Id"?: string;
+    /**
+     * Identifies one mutation and its canonical request payload.
+     */
+    "Idempotency-Key": string;
+    /**
+     * Exact ETag returned for the current project or deployment state.
+     */
+    "If-Match": string;
+  };
+  path: {
+    /**
+     * Project identifier.
+     */
+    project_id: Ulid;
+  };
+  query?: never;
+  url: "/v1/projects/{project_id}/handle";
+};
+
+export type ChangeProjectHandleErrors = {
+  /**
+   * The request failed.
+   */
+  400: ProblemDetails;
+  /**
+   * The request failed.
+   */
+  401: ProblemDetails;
+  /**
+   * The request failed.
+   */
+  403: ProblemDetails;
+  /**
+   * The resource does not exist or is not visible to the authenticated principal.
+   */
+  404: ProblemDetails;
+  /**
+   * The idempotency key was already used with a different canonical request.
+   */
+  409: IdempotencyConflictProblem;
+  /**
+   * The request failed.
+   */
+  429: ProblemDetails;
+  /**
+   * The request failed.
+   */
+  503: ProblemDetails;
+};
+
+export type ChangeProjectHandleError = ChangeProjectHandleErrors[keyof ChangeProjectHandleErrors];
+
+export type ChangeProjectHandleResponses = {
+  /**
+   * The mutation was accepted for asynchronous processing.
+   */
+  202: Operation;
+};
+
+export type ChangeProjectHandleResponse =
+  ChangeProjectHandleResponses[keyof ChangeProjectHandleResponses];
+
 export type ConfigureProjectDomainsData = {
   body?: never;
   headers: {