@amerged/ohmyhost-cli 0.1.11 → 0.1.14

package/dist/{chunk-WT2RRQUB.js → chunk-U32PJQHH.js}

@@ -2209,10 +2209,10 @@ var require_resolve = __commonJS({
       }
       return count;
     }
-    function getFullPath(resolver, id2 = "", normalize) {
+    function getFullPath(resolver, id3 = "", normalize) {
       if (normalize !== false)
-        id2 = normalizeId(id2);
-      const p = resolver.parse(id2);
+        id3 = normalizeId(id3);
+      const p = resolver.parse(id3);
       return _getFullPath(resolver, p);
     }
     exports.getFullPath = getFullPath;
@@ -2222,13 +2222,13 @@ var require_resolve = __commonJS({
     }
     exports._getFullPath = _getFullPath;
     var TRAILING_SLASH_HASH = /#\/?$/;
-    function normalizeId(id2) {
-      return id2 ? id2.replace(TRAILING_SLASH_HASH, "") : "";
+    function normalizeId(id3) {
+      return id3 ? id3.replace(TRAILING_SLASH_HASH, "") : "";
     }
     exports.normalizeId = normalizeId;
-    function resolveUrl(resolver, baseId, id2) {
-      id2 = normalizeId(id2);
-      return resolver.resolve(baseId, id2);
+    function resolveUrl(resolver, baseId, id3) {
+      id3 = normalizeId(id3);
+      return resolver.resolve(baseId, id3);
     }
     exports.resolveUrl = resolveUrl;
     var ANCHOR = /^[a-z_][-a-z0-9._]*$/i;
@@ -2998,8 +2998,8 @@ var require_compile = __commonJS({
       if (Object.keys(root.schema).length > 0 && refPath === baseId) {
         return getJsonPointer.call(this, p, root);
       }
-      const id2 = (0, resolve_1.normalizeId)(refPath);
-      const schOrRef = this.refs[id2] || this.schemas[id2];
+      const id3 = (0, resolve_1.normalizeId)(refPath);
+      const schOrRef = this.refs[id3] || this.schemas[id3];
       if (typeof schOrRef == "string") {
         const sch = resolveSchema.call(this, root, schOrRef);
         if (typeof (sch === null || sch === void 0 ? void 0 : sch.schema) !== "object")
@@ -3010,7 +3010,7 @@ var require_compile = __commonJS({
         return;
       if (!schOrRef.validate)
         compileSchema.call(this, schOrRef);
-      if (id2 === (0, resolve_1.normalizeId)(ref)) {
+      if (id3 === (0, resolve_1.normalizeId)(ref)) {
         const { schema } = schOrRef;
         const { schemaId } = this.opts;
         const schId = schema[schemaId];
@@ -3710,7 +3710,7 @@ var require_schemes = __commonJS({
         serialize: httpSerialize
       }
     );
-    var https = (
+    var https2 = (
       /** @type {SchemeHandler} */
       {
         scheme: "https",
@@ -3759,7 +3759,7 @@ var require_schemes = __commonJS({
       /** @type {Record<SchemeName, SchemeHandler>} */
       {
         http,
-        https,
+        https: https2,
         ws,
         wss,
         urn,
@@ -4425,15 +4425,15 @@ var require_core = __commonJS({
             this.addSchema(sch, void 0, _meta, _validateSchema);
           return this;
         }
-        let id2;
+        let id3;
         if (typeof schema === "object") {
           const { schemaId } = this.opts;
-          id2 = schema[schemaId];
-          if (id2 !== void 0 && typeof id2 != "string") {
+          id3 = schema[schemaId];
+          if (id3 !== void 0 && typeof id3 != "string") {
             throw new Error(`schema ${schemaId} must be string`);
           }
         }
-        key = (0, resolve_1.normalizeId)(key || id2);
+        key = (0, resolve_1.normalizeId)(key || id3);
         this._checkUnique(key);
         this.schemas[key] = this._addSchema(schema, _meta, key, _validateSchema, true);
         return this;
@@ -4512,11 +4512,11 @@ var require_core = __commonJS({
           case "object": {
             const cacheKey = schemaKeyRef;
             this._cache.delete(cacheKey);
-            let id2 = schemaKeyRef[this.opts.schemaId];
-            if (id2) {
-              id2 = (0, resolve_1.normalizeId)(id2);
-              delete this.schemas[id2];
-              delete this.refs[id2];
+            let id3 = schemaKeyRef[this.opts.schemaId];
+            if (id3) {
+              id3 = (0, resolve_1.normalizeId)(id3);
+              delete this.schemas[id3];
+              delete this.refs[id3];
             }
             return this;
           }
@@ -4623,10 +4623,10 @@ var require_core = __commonJS({
         }
       }
       _addSchema(schema, meta, baseId, validateSchema = this.opts.validateSchema, addSchema = this.opts.addUsedSchema) {
-        let id2;
+        let id3;
         const { schemaId } = this.opts;
         if (typeof schema == "object") {
-          id2 = schema[schemaId];
+          id3 = schema[schemaId];
         } else {
           if (this.opts.jtd)
             throw new Error("schema must be object");
@@ -4636,7 +4636,7 @@ var require_core = __commonJS({
         let sch = this._cache.get(schema);
         if (sch !== void 0)
           return sch;
-        baseId = (0, resolve_1.normalizeId)(id2 || baseId);
+        baseId = (0, resolve_1.normalizeId)(id3 || baseId);
         const localRefs = resolve_1.getSchemaRefs.call(this, schema, baseId);
         sch = new compile_1.SchemaEnv({ schema, schemaId, meta, baseId, localRefs });
         this._cache.set(sch.schema, sch);
@@ -4649,9 +4649,9 @@ var require_core = __commonJS({
           this.validateSchema(schema, true);
         return sch;
       }
-      _checkUnique(id2) {
-        if (this.schemas[id2] || this.refs[id2]) {
-          throw new Error(`schema with key or id "${id2}" already exists`);
+      _checkUnique(id3) {
+        if (this.schemas[id3] || this.refs[id3]) {
+          throw new Error(`schema with key or id "${id3}" already exists`);
         }
       }
       _compileSchemaEnv(sch) {
@@ -5016,8 +5016,8 @@ var require_multipleOf = __commonJS({
         const { gen, data, schemaCode, it } = cxt;
         const prec = it.opts.multipleOfPrecision;
         const res = gen.let("res");
-        const invalid3 = prec ? (0, codegen_1._)`Math.abs(Math.round(${res}) - ${res}) > 1e-${prec}` : (0, codegen_1._)`${res} !== parseInt(${res})`;
-        cxt.fail$data((0, codegen_1._)`(${schemaCode} === 0 || (${res} = ${data}/${schemaCode}, ${invalid3}))`);
+        const invalid4 = prec ? (0, codegen_1._)`Math.abs(Math.round(${res}) - ${res}) > 1e-${prec}` : (0, codegen_1._)`${res} !== parseInt(${res})`;
+        cxt.fail$data((0, codegen_1._)`(${schemaCode} === 0 || (${res} = ${data}/${schemaCode}, ${invalid4}))`);
       }
     };
     exports.default = def;
@@ -15002,6 +15002,8 @@ var recognizedCommandLabel = (argv) => {
       return "project status";
     if (value === "project" && values[0] === "handle" && values[1] === "check")
       return "project handle check";
+    if (value === "project" && values[0] === "handle" && values[1] === "set")
+      return "project handle set";
     if (value === "project" && values[0] === "dev-access" && values[1] === "create")
       return "project dev-access create";
     if (value === "database" && values[0] === "compute" && values[1] === "set")
@@ -15066,6 +15068,28 @@ var recognizedCommandLabel = (argv) => {
     }
     if (value === "function" && values[0] === "runs")
       return "function runs";
+    if (value === "mail") {
+      if (values[0] === "setup")
+        return "mail setup";
+      if (values[0] === "status")
+        return "mail status";
+      if (values[0] === "webhook") {
+        if (values[1] === "set")
+          return "mail webhook set";
+        if (values[1] === "verify")
+          return "mail webhook verify";
+        if (values[1] === "disable")
+          return "mail webhook disable";
+      }
+      if (values[0] === "messages") {
+        if (values[1] === "list")
+          return "mail messages list";
+        if (values[1] === "get")
+          return "mail messages get";
+        if (values[1] === "retry")
+          return "mail messages retry";
+      }
+    }
     if (value === "mail" && values[0] === "domain") {
       if (values[1] === "set")
         return "mail domain set";
@@ -15444,6 +15468,25 @@ var parseProductCliCommand = (argv) => {
   }
   if (first === "project") {
     const subcommand = values.shift();
+    if (subcommand === "handle" && values[0] === "set") {
+      values.shift();
+      if (yes || wait || follow || stdin)
+        throw new InvalidCommandError();
+      const options2 = parseOptions(values, [
+        "--project",
+        "--handle",
+        "--if-match",
+        "--idempotency-key"
+      ]);
+      return {
+        kind: "project-handle-set",
+        projectId: options2["--project"],
+        handle: options2["--handle"],
+        ifMatch: options2["--if-match"],
+        idempotencyKey: options2["--idempotency-key"],
+        credentialStore
+      };
+    }
     if (subcommand === "handle" && values.shift() === "check") {
       if (yes || wait || follow || stdin)
         throw new InvalidCommandError();
@@ -16083,32 +16126,82 @@ var parseProductCliCommand = (argv) => {
     }
     throw new InvalidCommandError();
   }
-  if (first === "mail" && values[0] === "domain" && values[1] === "set") {
+  if (first === "mail") {
     if (yes || wait || follow || stdin)
       throw new InvalidCommandError();
-    values.splice(0, 2);
-    const options = parseOptions(values, ["--project", "--domain", "--idempotency-key"]);
-    if (!/^(?=.{1,253}$)(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\.)+[a-z]{2,63}$/u.test(options["--domain"])) {
-      throw new InvalidCommandError();
-    }
-    return {
-      kind: "mail-domain-set",
-      projectId: options["--project"],
-      domain: options["--domain"],
-      idempotencyKey: options["--idempotency-key"],
-      credentialStore
+    const area = values.shift();
+    const sub = area === "webhook" || area === "messages" || area === "domain" ? values.shift() : void 0;
+    const options = parseOptionalOptions(values, [
+      "--project",
+      "--environment",
+      "--domain",
+      "--sending",
+      "--receiving",
+      "--url",
+      "--idempotency-key",
+      "--message",
+      "--after"
+    ]);
+    const required = (key) => {
+      const value = options[key];
+      if (!value)
+        throw new InvalidCommandError();
+      return value;
     };
-  }
-  if (first === "mail" && values[0] === "domain" && values[1] === "status") {
-    if (yes || wait || follow || stdin)
+    const scope = { projectId: required("--project"), environmentId: required("--environment") };
+    let request, label;
+    if (area === "setup" || area === "domain" && sub === "set") {
+      const sending = required("--sending"), receiving = required("--receiving");
+      if (!["true", "false"].includes(sending) || !["true", "false"].includes(receiving))
+        throw new InvalidCommandError();
+      request = {
+        ...scope,
+        action: "configure",
+        domain: required("--domain"),
+        sending: sending === "true",
+        receiving: receiving === "true",
+        idempotencyKey: required("--idempotency-key")
+      };
+      label = area === "domain" ? "mail domain set" : "mail setup";
+    } else if (area === "status" || area === "domain" && sub === "status") {
+      request = { ...scope, action: "status" };
+      label = area === "domain" ? "mail domain status" : "mail status";
+    } else if (area === "webhook" && sub === "set") {
+      request = {
+        ...scope,
+        action: "webhook_set",
+        url: required("--url"),
+        idempotencyKey: required("--idempotency-key")
+      };
+      label = "mail webhook set";
+    } else if (area === "webhook" && (sub === "verify" || sub === "disable")) {
+      request = {
+        ...scope,
+        action: sub === "verify" ? "webhook_verify" : "webhook_disable",
+        idempotencyKey: required("--idempotency-key")
+      };
+      label = sub === "verify" ? "mail webhook verify" : "mail webhook disable";
+    } else if (area === "messages" && sub === "list") {
+      request = {
+        ...scope,
+        action: "messages_list",
+        ...options["--after"] ? { after: options["--after"] } : {}
+      };
+      label = "mail messages list";
+    } else if (area === "messages" && sub === "get") {
+      request = { ...scope, action: "message_get", messageId: required("--message") };
+      label = "mail messages get";
+    } else if (area === "messages" && sub === "retry") {
+      request = {
+        ...scope,
+        action: "message_retry",
+        messageId: required("--message"),
+        idempotencyKey: required("--idempotency-key")
+      };
+      label = "mail messages retry";
+    } else
       throw new InvalidCommandError();
-    values.splice(0, 2);
-    const options = parseOptions(values, ["--project"]);
-    return {
-      kind: "mail-domain-status",
-      projectId: options["--project"],
-      credentialStore
-    };
+    return { kind: "managed-mail", request, label, credentialStore };
   }
   throw new InvalidCommandError();
 };
@@ -16299,12 +16392,12 @@ function classifyFrameworkVersion(framework, version2) {
   return VERIFIED_VERSIONS[framework].has(version2) ? versionAdmission("verified", "verified_fixture") : versionAdmission("experimental", "inside_admitted_window");
 }
 function parseVersionSpec(version2) {
-  const exact3 = EXACT_VERSION.exec(version2);
-  const match = exact3 ?? (/^[~^](.*)$/u.exec(version2)?.[1] ? EXACT_VERSION.exec(version2.slice(1)) : null);
+  const exact4 = EXACT_VERSION.exec(version2);
+  const match = exact4 ?? (/^[~^](.*)$/u.exec(version2)?.[1] ? EXACT_VERSION.exec(version2.slice(1)) : null);
   if (match === null)
     return null;
   const tuple = [Number(match[1]), Number(match[2]), Number(match[3])];
-  return tuple.every(Number.isSafeInteger) ? Object.freeze({ exact: exact3 !== null, version: tuple }) : null;
+  return tuple.every(Number.isSafeInteger) ? Object.freeze({ exact: exact4 !== null, version: tuple }) : null;
 }
 function insideAdmittedWindow(framework, version2) {
   switch (framework) {
@@ -16328,8 +16421,8 @@ function versionAdmission(classification, reason) {
 }
 var FRAMEWORK_CONVERSION_DETAILS = Object.freeze({
   database_binding_private: Object.freeze({
-    render: (path) => `"${path}" reads a managed database connection string. Hyperdrive, DATABASE_URL and postgres:// URLs never reach a customer Worker; call the database with createPrivateDatabaseClient from "@ohmyhost/customer-runtime/database". Commit the change, then plan again.`,
-    pattern: /^"([^"]+)" reads a managed database connection string\. Hyperdrive, DATABASE_URL and postgres:\/\/ URLs never reach a customer Worker; call the database with createPrivateDatabaseClient from "@ohmyhost\/customer-runtime\/database"\. Commit the change, then plan again\.$/u
+    render: (path) => `"${path}" reads a managed database connection string. HYPERDRIVE is retired; DATABASE_URL and postgres:// URLs never reach a customer Worker. Call the database with createPrivateDatabaseClient from "@ohmyhost/customer-runtime/database". Commit the change, then plan again.`,
+    pattern: /^"([^"]+)" reads a managed database connection string\. HYPERDRIVE is retired; DATABASE_URL and postgres:\/\/ URLs never reach a customer Worker\. Call the database with createPrivateDatabaseClient from "@ohmyhost\/customer-runtime\/database"\. Commit the change, then plan again\.$/u
   }),
   database_driver_unsupported: Object.freeze({
     render: (path) => `"${path}" imports a PostgreSQL socket driver. Outbound connect() is disabled for customer Workers, so it can never open a connection; call the database with createPrivateDatabaseClient from "@ohmyhost/customer-runtime/database". Commit the change, then plan again.`,
@@ -16751,6 +16844,26 @@ var PROBLEM_POLICY = {
     retryable: true,
     action: "Retry project creation with the same idempotency key."
   },
+  project_handle_taken: {
+    status: 409,
+    retryable: false,
+    action: "Run 'ohmyhost project handle check' for a free address, then rename to one of the alternatives it returns."
+  },
+  project_handle_invalid: {
+    status: 409,
+    retryable: false,
+    action: "Choose one to five lowercase words of letters and digits, three to fifty-nine characters, avoiding reserved words."
+  },
+  project_handle_unchanged: {
+    status: 409,
+    retryable: false,
+    action: "The project already answers on this address; no rename is needed."
+  },
+  project_rename_blocked: {
+    status: 409,
+    retryable: true,
+    action: "Wait for the running operation to finish, read the project again, then rename with the new ETag."
+  },
   project_identity_unavailable: {
     status: 503,
     retryable: true,
@@ -16816,6 +16929,11 @@ var PROBLEM_POLICY = {
     retryable: false,
     action: "Run 'ohmyhost init', apply the matching ohmyhost framework skill, then plan the new commit."
   },
+  repository_configuration_missing: {
+    status: 409,
+    retryable: false,
+    action: "Place ohmyhost.yaml at the Git repository root and set applicationRoot to the application directory (for example website). Commit and push the change, then plan the new commit."
+  },
   migration_filename_noncanonical: {
     status: 409,
     retryable: false,
@@ -16909,7 +17027,7 @@ var parsePaidDomain = (value) => {
   ]);
   const status = input["status"];
   const hostname = input["hostname"];
-  const records = input["validation_records"];
+  const records2 = input["validation_records"];
   if (![
     "not_configured",
     "pending",
@@ -16922,7 +17040,7 @@ var parsePaidDomain = (value) => {
     "paid_plan_required",
     "insufficient_organization_credits",
     "project_budget_exceeded"
-  ].includes(input["suspension_reason"]) || status === "suspended" !== (input["suspension_reason"] !== null) || status === "suspended" && input["url"] !== null || input["environment"] !== "prod" || !isSaasCnameTarget(input["cname_target"]) || hostname !== null && !isPaidHostname(hostname) || input["custom_hostname_status"] !== null && typeof input["custom_hostname_status"] !== "string" || input["ssl_status"] !== null && typeof input["ssl_status"] !== "string" || !Array.isArray(records) || records.length > 16 || !records.every(isPaidValidationRecord) || input["url"] !== null && input["url"] !== `https://${String(hostname)}`) {
+  ].includes(input["suspension_reason"]) || status === "suspended" !== (input["suspension_reason"] !== null) || status === "suspended" && input["url"] !== null || input["environment"] !== "prod" || !isSaasCnameTarget(input["cname_target"]) || hostname !== null && !isPaidHostname(hostname) || input["custom_hostname_status"] !== null && typeof input["custom_hostname_status"] !== "string" || input["ssl_status"] !== null && typeof input["ssl_status"] !== "string" || !Array.isArray(records2) || records2.length > 16 || !records2.every(isPaidValidationRecord) || input["url"] !== null && input["url"] !== `https://${String(hostname)}`) {
     throw new ResponseContractError();
   }
   return input;
@@ -17074,7 +17192,7 @@ var parseDevAccessTicket = (value) => {
   ]);
   const origin = input["origin"];
   const redeemUrl = input["redeem_url"];
-  if (!isUlid(input["ticket_id"]) || !isUlid(input["project_id"]) || !isUlid(input["environment_id"]) || typeof origin !== "string" || !/^https:\/\/dev-[a-z]+-[a-z]+-[a-z]+\.(?:dev\.)?check\.omh\.st$/u.test(origin) || typeof redeemUrl !== "string" || !/^https:\/\/dev-[a-z]+-[a-z]+-[a-z]+\.(?:dev\.)?check\.omh\.st\/\.ohmyhost\/dev-access\/redeem\?stage=dev&ticket=[A-Za-z0-9_-]{43}$/u.test(redeemUrl) || new URL(redeemUrl).origin !== origin || !isIsoInstant(input["expires_at"])) {
+  if (!isUlid(input["ticket_id"]) || !isUlid(input["project_id"]) || !isUlid(input["environment_id"]) || typeof origin !== "string" || !/^https:\/\/dev-[a-z0-9]+(?:-[a-z0-9]+){0,4}\.(?:dev\.)?check\.omh\.st$/u.test(origin) || typeof redeemUrl !== "string" || !/^https:\/\/dev-[a-z0-9]+(?:-[a-z0-9]+){0,4}\.(?:dev\.)?check\.omh\.st\/\.ohmyhost\/dev-access\/redeem\?stage=dev&ticket=[A-Za-z0-9_-]{43}$/u.test(redeemUrl) || new URL(redeemUrl).origin !== origin || !isIsoInstant(input["expires_at"])) {
     throw new ResponseContractError();
   }
   return input;
@@ -17197,7 +17315,7 @@ var parseProject = (value) => {
     "region",
     "created_at"
   ]);
-  if (!isUlid(input["id"]) || !isUlid(input["organization_id"]) || !boundedString(input["name"], 1, 128) || input["name"] !== input["name"].trim() || !boundedString(input["handle"], 5, 59) || !/^[a-z]+-[a-z]+-[a-z]+$/u.test(input["handle"]) || input["data_mode"] !== "shared" && input["data_mode"] !== "isolated" || input["region"] !== "us" && input["region"] !== "eu" || !isIsoInstant(input["created_at"])) {
+  if (!isUlid(input["id"]) || !isUlid(input["organization_id"]) || !boundedString(input["name"], 1, 128) || input["name"] !== input["name"].trim() || !boundedString(input["handle"], 3, 59) || !/^[a-z0-9]+(?:-[a-z0-9]+){0,4}$/u.test(input["handle"]) || input["data_mode"] !== "shared" && input["data_mode"] !== "isolated" || input["region"] !== "us" && input["region"] !== "eu" || !isIsoInstant(input["created_at"])) {
     throw new ResponseContractError();
   }
   return input;
@@ -17215,6 +17333,7 @@ var parseProjectPage = (value) => {
 var parseProjectStatus = (value) => {
   const input = exactRecord2(value, [
     "project_id",
+    "etag",
     "handle",
     "region",
     "lifecycle",
@@ -17228,7 +17347,7 @@ var parseProjectStatus = (value) => {
     "cleanup_state"
   ]);
   const handle = input["handle"];
-  if (!isUlid(input["project_id"]) || !boundedString(handle, 5, 59) || !/^[a-z]+-[a-z]+-[a-z]+$/u.test(handle) || input["region"] !== "us" && input["region"] !== "eu" || input["lifecycle"] !== "active" && input["lifecycle"] !== "deleting" && input["lifecycle"] !== "deleted" || input["dev_url"] !== null && ![`https://dev-${handle}.dev.check.omh.st`, `https://dev-${handle}.check.omh.st`].includes(String(input["dev_url"])) || input["prod_url"] !== null && ![`https://${handle}.dev.check.omh.st`, `https://${handle}.check.omh.st`].includes(String(input["prod_url"])) || input["cleanup_state"] !== "not_started" && input["cleanup_state"] !== "pending" && input["cleanup_state"] !== "completed" && input["cleanup_state"] !== "reconciliation_required") {
+  if (!isUlid(input["project_id"]) || typeof input["etag"] !== "string" || !/^"sha256-[a-f0-9]{64}"$/u.test(input["etag"]) || !boundedString(handle, 3, 59) || !/^[a-z0-9]+(?:-[a-z0-9]+){0,4}$/u.test(handle) || input["region"] !== "us" && input["region"] !== "eu" || input["lifecycle"] !== "active" && input["lifecycle"] !== "deleting" && input["lifecycle"] !== "deleted" || input["dev_url"] !== null && ![`https://dev-${handle}.dev.check.omh.st`, `https://dev-${handle}.check.omh.st`].includes(String(input["dev_url"])) || input["prod_url"] !== null && ![`https://${handle}.dev.check.omh.st`, `https://${handle}.check.omh.st`].includes(String(input["prod_url"])) || input["cleanup_state"] !== "not_started" && input["cleanup_state"] !== "pending" && input["cleanup_state"] !== "completed" && input["cleanup_state"] !== "reconciliation_required") {
     throw new ResponseContractError();
   }
   if (input["source"] !== null)
@@ -17248,10 +17367,10 @@ var parseProjectStatus = (value) => {
     const ids = /* @__PURE__ */ new Set(), names = /* @__PURE__ */ new Set();
     for (const raw of environments) {
       const environment = exactRecord2(raw, ["id", "name"]);
-      const id2 = environment["id"], name = environment["name"];
-      if (!isUlid(id2) || name !== "dev" && name !== "prod" || ids.has(id2) || names.has(name))
+      const id3 = environment["id"], name = environment["name"];
+      if (!isUlid(id3) || name !== "dev" && name !== "prod" || ids.has(id3) || names.has(name))
         throw new ResponseContractError();
-      ids.add(id2);
+      ids.add(id3);
       names.add(name);
     }
   }
@@ -17395,45 +17514,6 @@ var parseEnvironmentSecretDeletion = (value) => {
 function validDelivery(input) {
   return Number.isSafeInteger(input["desired_generation"]) && Number(input["desired_generation"]) >= 0 && Number.isSafeInteger(input["applied_generation"]) && Number(input["applied_generation"]) >= 0 && Number(input["applied_generation"]) <= Number(input["desired_generation"]) && ["not_deployed", "pending", "ready", "failed"].includes(String(input["delivery_state"])) && (input["runtime_provider"] === null || input["runtime_provider"] === "wfp") && Number.isSafeInteger(input["applied_secret_count"]) && Number(input["applied_secret_count"]) >= 0 && Number(input["applied_secret_count"]) <= 100 && (input["last_error"] === null || typeof input["last_error"] === "string" && /^[A-Z][A-Z0-9_]{0,63}$/u.test(input["last_error"]));
 }
-var parseProjectMailDomain = (value) => {
-  const input = exactRecord2(value, [
-    "domain",
-    "status",
-    "configured_at",
-    "name_servers",
-    "change_id",
-    "observed_at",
-    "verification_issue",
-    "next_check_after_seconds"
-  ]);
-  if (typeof input["domain"] !== "string" || !/^(?=.{1,253}$)(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\.)+[a-z]{2,63}$/u.test(input["domain"]) || !isIsoInstant(input["configured_at"])) {
-    throw new ResponseContractError();
-  }
-  if (input["status"] === "configured") {
-    if (input["name_servers"] !== void 0 || input["change_id"] !== void 0 || input["observed_at"] !== void 0 || input["verification_issue"] !== void 0 || input["next_check_after_seconds"] !== void 0) {
-      throw new ResponseContractError();
-    }
-    return input;
-  }
-  if (!["delegation_required", "ready", "verification_pending", "verification_failed"].includes(String(input["status"])) || !Array.isArray(input["name_servers"]) || input["name_servers"].length !== 4 || new Set(input["name_servers"]).size !== 4 || input["name_servers"].some((nameServer) => typeof nameServer !== "string" || !/^ns-[0-9]{1,4}\.awsdns-[0-9]{1,2}\.(?:com|net|org|co\.uk)$/u.test(nameServer)) || typeof input["change_id"] !== "string" || !/^C[A-Z0-9]{8,31}$/u.test(input["change_id"])) {
-    throw new ResponseContractError();
-  }
-  if (input["observed_at"] !== void 0) {
-    if (![
-      null,
-      "identity_missing",
-      "identity_verification_failed",
-      "dkim_verification_failed",
-      "dkim_records_changed",
-      "tenant_association_missing"
-    ].includes(input["verification_issue"]))
-      throw new ResponseContractError();
-    if (!isIsoInstant(input["observed_at"]) || input["next_check_after_seconds"] !== (input["status"] === "ready" ? null : 3600))
-      throw new ResponseContractError();
-  } else if (input["next_check_after_seconds"] !== void 0 || input["verification_issue"] !== void 0 || ["verification_pending", "verification_failed"].includes(String(input["status"])))
-    throw new ResponseContractError();
-  return input;
-};
 var parseDeploymentPlan = (value) => {
   const input = exactRecord2(value, [
     "id",
@@ -17538,13 +17618,14 @@ var parseSafeProblem = (value) => {
   if (typeof code !== "string" || !(code in PROBLEM_POLICY))
     throw new ResponseContractError();
   const policy = PROBLEM_POLICY[code];
-  if (input["status"] !== policy.status || !boundedString(input["type"], 1, 512) || !isHttpsUrl(input["type"]) || !boundedString(input["title"], 1, 160) || !boundedString(input["request_id"], 1, 128) || typeof input["retryable"] !== "boolean" || !boundedString(input["suggested_action"], 1, 500) || input["detail"] !== void 0 && !boundedString(input["detail"], 1, 2e3) || input["instance"] !== void 0 && !boundedString(input["instance"], 1, 512)) {
+  if (input["status"] !== policy.status || !boundedString(input["type"], 1, 512) || !isHttpsUrl(input["type"]) || !boundedString(input["title"], 1, 160) || !boundedString(input["request_id"], 1, 128) || /[\p{Cc}\p{Cf}\p{Zl}\p{Zp}]/u.test(input["request_id"]) || typeof input["retryable"] !== "boolean" || !boundedString(input["suggested_action"], 1, 500) || input["detail"] !== void 0 && !boundedString(input["detail"], 1, 2e3) || input["instance"] !== void 0 && !boundedString(input["instance"], 1, 512)) {
     throw new ResponseContractError();
   }
   const retryAfter = input["retry_after_seconds"];
   if (retryAfter !== void 0 && (code !== "rate_limited" || typeof retryAfter !== "number" || !Number.isSafeInteger(retryAfter) || retryAfter < 1 || retryAfter > 86400))
     throw new ResponseContractError();
   return {
+    requestId: input["request_id"],
     code,
     retryable: policy.retryable,
     suggestedAction: (code === "framework_conversion_required" ? parseFrameworkConversionDetail(input["detail"]) ?? policy.action : policy.action) + (retryAfter === void 0 ? "" : ` Retry after ${String(retryAfter)} seconds.`),
@@ -17563,15 +17644,15 @@ var parseOperation = (value) => {
     "reconciliation",
     "progress"
   ]);
-  const id2 = input["id"];
+  const id3 = input["id"];
   const state = input["state"];
   const createdAt = input["created_at"];
   const updatedAt = input["updated_at"];
   const result = input["result"];
   const blockingOperationId = input["blocking_operation_id"];
-  if (blockingOperationId !== void 0 && (state !== "queued" || !isUlid(blockingOperationId) || blockingOperationId === id2))
+  if (blockingOperationId !== void 0 && (state !== "queued" || !isUlid(blockingOperationId) || blockingOperationId === id3))
     throw new ResponseContractError();
-  if (!isUlid(id2) || !isOperationState(state) || !isIsoInstant(createdAt) || !isIsoInstant(updatedAt) || result !== void 0 && !isRecord(result)) {
+  if (!isUlid(id3) || !isOperationState(state) || !isIsoInstant(createdAt) || !isIsoInstant(updatedAt) || result !== void 0 && !isRecord(result)) {
     throw new ResponseContractError();
   }
   let progress;
@@ -17611,7 +17692,7 @@ var parseOperation = (value) => {
       throw new ResponseContractError();
   }
   return {
-    id: id2,
+    id: id3,
     state,
     created_at: createdAt,
     updated_at: updatedAt,
@@ -17818,7 +17899,7 @@ function exact2(v, keys) {
 // apps/product-cli/package.json
 var package_default = {
   name: "@ohmyhost/product-cli",
-  version: "0.1.11",
+  version: "0.1.14",
   private: true,
   ohmyhost: {
     deployment: "production",
@@ -18182,6 +18263,7 @@ var HELP_USAGE = Object.freeze({
   "project status": "ohmyhost project status --project ULID --json",
   "project dev-access create": "ohmyhost project dev-access create --project ULID --json",
   "project handle check": "ohmyhost project handle check --handle HANDLE --json (is this address free? answers with a reason and free alternatives; the address becomes HANDLE.check.omh.st)",
+  "project handle set": "ohmyhost project handle set --project ULID --handle HANDLE --if-match ETAG --idempotency-key KEY --json (moves the project to a free address; the old one stops working and anyone may claim it)",
   "database compute set": "ohmyhost database compute set --project ULID --environment dev|prod --profile standard|performance --idempotency-key KEY --yes [--wait] --json\n  standard: Free 0.25 CU/1 GB/60s idle, Paid 0.5 CU/2 GB/60s idle. performance: Paid 1 CU/4 GB/300s idle, 2.5x database compute credits per equal active minute; longer idle time also consumes credits.",
   "database compute get": "ohmyhost database compute get --project ULID [--environment dev|prod] --json",
   "database write": "ohmyhost database write --project ULID --environment dev|prod --statement-file PATH --idempotency-key KEY [--parameters-json JSON] --yes --json",
@@ -18214,8 +18296,16 @@ var HELP_USAGE = Object.freeze({
   "function runs": "ohmyhost function runs --project ULID --environment ENVIRONMENT_ULID [--limit 1-100] --json",
   "secret set": `printf '%s' "$SECRET_VALUE" | ohmyhost secret set NAME --project ULID --environment ENVIRONMENT_ULID --idempotency-key KEY --stdin [--wait] --json`,
   "secret delete": "ohmyhost secret delete NAME --project ULID --environment ENVIRONMENT_ULID --idempotency-key KEY [--wait] --json",
-  "mail domain set": "ohmyhost mail domain set --project ULID --domain DOMAIN --idempotency-key KEY --json",
-  "mail domain status": "ohmyhost mail domain status --project ULID --json"
+  "mail setup": "ohmyhost mail setup --project ULID --environment ULID --domain DOMAIN --sending true --receiving false --idempotency-key KEY --json",
+  "mail status": "ohmyhost mail status --project ULID --environment ULID --json",
+  "mail webhook set": "ohmyhost mail webhook set --project ULID --environment ULID --url HTTPS_URL --idempotency-key KEY --json",
+  "mail webhook verify": "ohmyhost mail webhook verify --project ULID --environment ULID --idempotency-key KEY --json",
+  "mail webhook disable": "ohmyhost mail webhook disable --project ULID --environment ULID --idempotency-key KEY --json",
+  "mail messages list": "ohmyhost mail messages list --project ULID --environment ULID [--after ULID] --json",
+  "mail messages get": "ohmyhost mail messages get --project ULID --environment ULID --message ULID --json",
+  "mail messages retry": "ohmyhost mail messages retry --project ULID --environment ULID --message ULID --idempotency-key KEY --json",
+  "mail domain set": "ohmyhost mail domain set --project ULID --environment ULID --domain DOMAIN --sending true --receiving false --idempotency-key KEY --json",
+  "mail domain status": "ohmyhost mail domain status --project ULID --environment ULID --json"
 });
 var HELP_COMMANDS = Object.freeze(Object.entries(HELP_USAGE).map(([command, usage]) => Object.freeze({ command, usage })));
 var cliMetadataResult = (kind, topic) => kind === "help" ? success("help", {
@@ -18458,6 +18548,8 @@ var ProductCli = class {
         return await this.listProjects(command, signal);
       if (command.kind === "project-handle-check")
         return await this.checkProjectHandle(command, signal);
+      if (command.kind === "project-handle-set")
+        return await this.changeProjectHandle(command, signal);
       if (command.kind === "database-compute-set") {
         const api = await this.authenticatedApi(command.credentialStore, signal);
         let operation = parseOperation(await api.changeDatabaseCompute(command));
@@ -18591,10 +18683,12 @@ var ProductCli = class {
         return await this.listFunctionRuns(command, signal);
       if (command.kind === "secret-set")
         return await this.putEnvironmentSecret(command, signal);
-      if (command.kind === "mail-domain-set")
-        return await this.configureMailDomain(command, signal);
-      if (command.kind === "mail-domain-status")
-        return await this.getMailDomain(command, signal);
+      if (command.kind === "managed-mail") {
+        const api = await this.authenticatedApi(command.credentialStore, signal);
+        if (!api.managedMail)
+          throw new Error("Mail unavailable");
+        return success(command.label, { mail: await api.managedMail(command.request) });
+      }
       return await this.deleteEnvironmentSecret(command, signal);
     } catch (error) {
       if (error instanceof UserTokenFileError)
@@ -18797,6 +18891,16 @@ var ProductCli = class {
     }));
     return success("project list", { status: "succeeded", projects });
   }
+  async changeProjectHandle(command, signal) {
+    const api = await this.authenticatedApi(command.credentialStore, signal);
+    const operation = parseOperation(await api.changeProjectHandle({
+      projectId: command.projectId,
+      handle: command.handle,
+      ifMatch: command.ifMatch,
+      idempotencyKey: command.idempotencyKey
+    }));
+    return success("project handle set", { status: "accepted", operation });
+  }
   async checkProjectHandle(command, signal) {
     const api = await this.authenticatedApi(command.credentialStore, signal);
     const handle = await api.checkProjectHandle({ handle: command.handle });
@@ -18918,26 +19022,26 @@ var ProductCli = class {
   }
   async applyPaidDomain(command, signal) {
     const api = await this.authenticatedApi(command.credentialStore, signal);
-    const domain = parsePaidDomain(await api.applyPaidDomain({
+    const domain2 = parsePaidDomain(await api.applyPaidDomain({
       projectId: command.projectId,
       hostname: command.hostname,
       idempotencyKey: command.idempotencyKey
     }));
-    return success("domain paid apply", { status: domain.status, domain });
+    return success("domain paid apply", { status: domain2.status, domain: domain2 });
   }
   async getPaidDomain(command, signal) {
     const api = await this.authenticatedApi(command.credentialStore, signal);
-    const domain = parsePaidDomain(await api.getPaidDomain(command.projectId));
-    return success("domain paid status", { status: domain.status, domain });
+    const domain2 = parsePaidDomain(await api.getPaidDomain(command.projectId));
+    return success("domain paid status", { status: domain2.status, domain: domain2 });
   }
   async deletePaidDomain(command, signal) {
     const api = await this.authenticatedApi(command.credentialStore, signal);
-    const domain = parsePaidDomain(await api.deletePaidDomain({
+    const domain2 = parsePaidDomain(await api.deletePaidDomain({
       projectId: command.projectId,
       hostname: command.hostname,
       idempotencyKey: command.idempotencyKey
     }));
-    return success("domain paid delete", { status: domain.status, domain });
+    return success("domain paid delete", { status: domain2.status, domain: domain2 });
   }
   async linkSource(command, signal) {
     const api = await this.authenticatedApi(command.credentialStore, signal);
@@ -19157,20 +19261,6 @@ var ProductCli = class {
     }
     throw new ProductCliFailure(8, "secret_delivery_wait_timeout", true, "Run 'ohmyhost secret list --json' to inspect delivery metadata.");
   }
-  async configureMailDomain(command, signal) {
-    const api = await this.authenticatedApi(command.credentialStore, signal);
-    const mailDomain = parseProjectMailDomain(await api.configureMailDomain({
-      projectId: command.projectId,
-      domain: command.domain,
-      idempotencyKey: command.idempotencyKey
-    }));
-    return success("mail domain set", { status: mailDomain.status, mail_domain: mailDomain });
-  }
-  async getMailDomain(command, signal) {
-    const api = await this.authenticatedApi(command.credentialStore, signal);
-    const mailDomain = parseProjectMailDomain(await api.getMailDomain(command.projectId));
-    return success("mail domain status", { status: mailDomain.status, mail_domain: mailDomain });
-  }
   async waitForOperation(api, initial, signal) {
     let operation = initial;
     for (let attempt = 0; attempt < 120 && (operation.state === "queued" || operation.state === "running") && operation.reconciliation?.state !== "required"; attempt += 1) {
@@ -19306,7 +19396,7 @@ var classifyFailure = (command, error, signal) => {
   if (looksLikeProblem(error)) {
     try {
       const problem = parseSafeProblem(error);
-      return failure(command, 7, problem.code, problem.retryable, problem.suggestedAction, void 0, problem.retryAfterSeconds);
+      return failure(command, 7, problem.code, problem.retryable, problem.suggestedAction, void 0, problem.retryAfterSeconds, problem.requestId);
     } catch {
       return failure(command, 7, "response_contract_invalid", false, "Retry only after the client or server contract is repaired.");
     }
@@ -19326,7 +19416,7 @@ var success = (command, body) => ({
 `,
   stderr: ""
 });
-var failure = (command, exitCode, code, retryable, suggestedAction, operation, retryAfterSeconds) => {
+var failure = (command, exitCode, code, retryable, suggestedAction, operation, retryAfterSeconds, requestId) => {
   const document = {
     version: 1,
     command,
@@ -19337,6 +19427,7 @@ var failure = (command, exitCode, code, retryable, suggestedAction, operation, r
       retryable,
       suggested_action: suggestedAction,
       ...retryAfterSeconds === void 0 ? {} : { retry_after_seconds: retryAfterSeconds },
+      ...requestId === void 0 ? {} : { request_id: requestId },
       ...operation?.error === void 0 ? {} : { message: operation.error.message }
     }
   };
@@ -19408,6 +19499,8 @@ var parsedCommandName = (command) => {
     return "project dev-access create";
   if (command.kind === "project-handle-check")
     return "project handle check";
+  if (command.kind === "project-handle-set")
+    return "project handle set";
   if (command.kind === "database-write")
     return "database write";
   if (command.kind === "database-query")
@@ -19456,10 +19549,8 @@ var parsedCommandName = (command) => {
     return "secret set";
   if (command.kind === "secret-delete")
     return "secret delete";
-  if (command.kind === "mail-domain-set")
-    return "mail domain set";
-  if (command.kind === "mail-domain-status")
-    return "mail domain status";
+  if (command.kind === "managed-mail")
+    return command.label;
   return command.kind;
 };
 var boundedSignal = (parent, timeoutMs) => AbortSignal.any([parent, AbortSignal.timeout(timeoutMs)]);
@@ -19562,17 +19653,6 @@ var diagnosticDescriptor = (error, signal) => {
   return { category: "internal", subsystem: "runtime", errorKind: "unexpected" };
 };
 
-// packages/contracts/dist/feedback.js
-var identifier = /^[0-7][0-9A-HJKMNP-TV-Z]{25}$/u;
-function parseFeedbackReceipt(value) {
-  if (typeof value !== "object" || value === null || Array.isArray(value))
-    throw new TypeError("Feedback was not acknowledged");
-  const v = value;
-  if (Object.keys(v).sort().join(",") !== "id,organization_id,submitted_at" || typeof v["id"] !== "string" || !identifier.test(v["id"]) || typeof v["organization_id"] !== "string" || !identifier.test(v["organization_id"]) || typeof v["submitted_at"] !== "string" || !/^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}\.\d{3}Z$/u.test(v["submitted_at"]) || !Number.isFinite(Date.parse(v["submitted_at"])) || new Date(v["submitted_at"]).toISOString() !== v["submitted_at"])
-    throw new TypeError("Feedback was not acknowledged");
-  return v;
-}
-
 // packages/sdk-ts/dist/generated/core/bodySerializer.gen.js
 var jsonBodySerializer = {
   bodySerializer: (body) => JSON.stringify(body, (_key, value) => typeof value === "bigint" ? value.toString() : value)
@@ -20155,27 +20235,27 @@ var Interceptors = class {
   clear() {
     this.fns = [];
   }
-  eject(id2) {
-    const index = this.getInterceptorIndex(id2);
+  eject(id3) {
+    const index = this.getInterceptorIndex(id3);
     if (this.fns[index]) {
       this.fns[index] = null;
     }
   }
-  exists(id2) {
-    const index = this.getInterceptorIndex(id2);
+  exists(id3) {
+    const index = this.getInterceptorIndex(id3);
     return Boolean(this.fns[index]);
   }
-  getInterceptorIndex(id2) {
-    if (typeof id2 === "number") {
-      return this.fns[id2] ? id2 : -1;
+  getInterceptorIndex(id3) {
+    if (typeof id3 === "number") {
+      return this.fns[id3] ? id3 : -1;
     }
-    return this.fns.indexOf(id2);
+    return this.fns.indexOf(id3);
   }
-  update(id2, fn) {
-    const index = this.getInterceptorIndex(id2);
+  update(id3, fn) {
+    const index = this.getInterceptorIndex(id3);
     if (this.fns[index]) {
       this.fns[index] = fn;
-      return id2;
+      return id3;
     }
     return false;
   }
@@ -21106,6 +21186,31 @@ var getCloudflareDnsAuthorizationStatus = (parameters, options) => {
     ...params
   });
 };
+var changeProjectHandle = (parameters, options) => {
+  const params = buildClientParams([parameters], [
+    {
+      args: [
+        { in: "headers", key: "X-Request-Id" },
+        { in: "headers", key: "Idempotency-Key" },
+        { in: "headers", key: "If-Match" },
+        { in: "path", key: "project_id" },
+        { in: "body", key: "handle" }
+      ]
+    }
+  ]);
+  return (options?.client ?? client).put({
+    responseStyle: "data",
+    security: [{ scheme: "bearer", type: "http" }],
+    url: "/v1/projects/{project_id}/handle",
+    ...options,
+    ...params,
+    headers: {
+      "Content-Type": "application/json",
+      ...options?.headers,
+      ...params.headers
+    }
+  });
+};
 var configureProjectDomains = (parameters, options) => {
   const params = buildClientParams([parameters], [
     {
@@ -21212,47 +21317,6 @@ var applyPaidProjectDomain = (parameters, options) => {
     }
   });
 };
-var getProjectMailDomain = (parameters, options) => {
-  const params = buildClientParams([parameters], [
-    {
-      args: [
-        { in: "headers", key: "X-Request-Id" },
-        { in: "path", key: "project_id" }
-      ]
-    }
-  ]);
-  return (options?.client ?? client).get({
-    responseStyle: "data",
-    security: [{ scheme: "bearer", type: "http" }],
-    url: "/v1/projects/{project_id}/mail-domain",
-    ...options,
-    ...params
-  });
-};
-var configureProjectMailDomain = (parameters, options) => {
-  const params = buildClientParams([parameters], [
-    {
-      args: [
-        { in: "headers", key: "X-Request-Id" },
-        { in: "headers", key: "Idempotency-Key" },
-        { in: "path", key: "project_id" },
-        { key: "configureProjectMailDomainRequest", map: "body" }
-      ]
-    }
-  ]);
-  return (options?.client ?? client).put({
-    responseStyle: "data",
-    security: [{ scheme: "bearer", type: "http" }],
-    url: "/v1/projects/{project_id}/mail-domain",
-    ...options,
-    ...params,
-    headers: {
-      "Content-Type": "application/json",
-      ...options?.headers,
-      ...params.headers
-    }
-  });
-};
 var planDeployment = (parameters, options) => {
   const params = buildClientParams([parameters], [
     {
@@ -21719,6 +21783,384 @@ var streamOperationEvents = (parameters, options) => {
     ...params
   });
 };
+var getManagedMailDomain = (parameters, options) => {
+  const params = buildClientParams([parameters], [
+    {
+      args: [
+        { in: "headers", key: "X-Request-Id" },
+        { in: "path", key: "project_id" },
+        { in: "path", key: "environment_id" }
+      ]
+    }
+  ]);
+  return (options?.client ?? client).get({
+    responseStyle: "data",
+    security: [{ scheme: "bearer", type: "http" }],
+    url: "/v1/projects/{project_id}/environments/{environment_id}/mail-domain",
+    ...options,
+    ...params
+  });
+};
+var configureManagedMailDomain = (parameters, options) => {
+  const params = buildClientParams([parameters], [
+    {
+      args: [
+        { in: "headers", key: "X-Request-Id" },
+        { in: "headers", key: "Idempotency-Key" },
+        { in: "path", key: "project_id" },
+        { in: "path", key: "environment_id" },
+        { key: "managedMailDomainRequest", map: "body" }
+      ]
+    }
+  ]);
+  return (options?.client ?? client).put({
+    responseStyle: "data",
+    security: [{ scheme: "bearer", type: "http" }],
+    url: "/v1/projects/{project_id}/environments/{environment_id}/mail-domain",
+    ...options,
+    ...params,
+    headers: {
+      "Content-Type": "application/json",
+      ...options?.headers,
+      ...params.headers
+    }
+  });
+};
+var disableManagedMailReceiving = (parameters, options) => {
+  const params = buildClientParams([parameters], [
+    {
+      args: [
+        { in: "headers", key: "X-Request-Id" },
+        { in: "headers", key: "Idempotency-Key" },
+        { in: "path", key: "project_id" },
+        { in: "path", key: "environment_id" }
+      ]
+    }
+  ]);
+  return (options?.client ?? client).delete({
+    responseStyle: "data",
+    security: [{ scheme: "bearer", type: "http" }],
+    url: "/v1/projects/{project_id}/environments/{environment_id}/mail-webhook",
+    ...options,
+    ...params
+  });
+};
+var prepareManagedMailWebhook = (parameters, options) => {
+  const params = buildClientParams([parameters], [
+    {
+      args: [
+        { in: "headers", key: "X-Request-Id" },
+        { in: "headers", key: "Idempotency-Key" },
+        { in: "path", key: "project_id" },
+        { in: "path", key: "environment_id" },
+        { key: "managedMailWebhookRequest", map: "body" }
+      ]
+    }
+  ]);
+  return (options?.client ?? client).put({
+    responseStyle: "data",
+    security: [{ scheme: "bearer", type: "http" }],
+    url: "/v1/projects/{project_id}/environments/{environment_id}/mail-webhook",
+    ...options,
+    ...params,
+    headers: {
+      "Content-Type": "application/json",
+      ...options?.headers,
+      ...params.headers
+    }
+  });
+};
+var verifyManagedMailWebhook = (parameters, options) => {
+  const params = buildClientParams([parameters], [
+    {
+      args: [
+        { in: "headers", key: "X-Request-Id" },
+        { in: "headers", key: "Idempotency-Key" },
+        { in: "path", key: "project_id" },
+        { in: "path", key: "environment_id" }
+      ]
+    }
+  ]);
+  return (options?.client ?? client).post({
+    responseStyle: "data",
+    security: [{ scheme: "bearer", type: "http" }],
+    url: "/v1/projects/{project_id}/environments/{environment_id}/mail-webhook/verify",
+    ...options,
+    ...params
+  });
+};
+var listManagedMailMessages = (parameters, options) => {
+  const params = buildClientParams([parameters], [
+    {
+      args: [
+        { in: "headers", key: "X-Request-Id" },
+        { in: "path", key: "project_id" },
+        { in: "path", key: "environment_id" },
+        { in: "query", key: "after" }
+      ]
+    }
+  ]);
+  return (options?.client ?? client).get({
+    responseStyle: "data",
+    security: [{ scheme: "bearer", type: "http" }],
+    url: "/v1/projects/{project_id}/environments/{environment_id}/mail/messages",
+    ...options,
+    ...params
+  });
+};
+var getManagedMailMessage = (parameters, options) => {
+  const params = buildClientParams([parameters], [
+    {
+      args: [
+        { in: "headers", key: "X-Request-Id" },
+        { in: "path", key: "project_id" },
+        { in: "path", key: "environment_id" },
+        { in: "path", key: "message_id" }
+      ]
+    }
+  ]);
+  return (options?.client ?? client).get({
+    responseStyle: "data",
+    security: [{ scheme: "bearer", type: "http" }],
+    url: "/v1/projects/{project_id}/environments/{environment_id}/mail/messages/{message_id}",
+    ...options,
+    ...params
+  });
+};
+var retryManagedMailMessage = (parameters, options) => {
+  const params = buildClientParams([parameters], [
+    {
+      args: [
+        { in: "headers", key: "X-Request-Id" },
+        { in: "headers", key: "Idempotency-Key" },
+        { in: "path", key: "project_id" },
+        { in: "path", key: "environment_id" },
+        { in: "path", key: "message_id" }
+      ]
+    }
+  ]);
+  return (options?.client ?? client).post({
+    responseStyle: "data",
+    security: [{ scheme: "bearer", type: "http" }],
+    url: "/v1/projects/{project_id}/environments/{environment_id}/mail/messages/{message_id}/retry",
+    ...options,
+    ...params
+  });
+};
+
+// packages/sdk-ts/dist/managed-mail-response.js
+var ULID = /^[0-7][0-9A-HJKMNP-TV-Z]{25}$/u;
+function assertManagedMailResponse(value, input) {
+  const r = object2(value);
+  if (input.action === "configure" || input.action === "status" || input.action === "webhook_verify") {
+    exact3(r, [
+      "domain_id",
+      "domain",
+      "environment_id",
+      "sending",
+      "receiving",
+      "status",
+      "configured_at",
+      "observed_at",
+      "dns_records",
+      "webhook",
+      "next_check_after_seconds"
+    ], ["dns"]);
+    id2(r["domain_id"]);
+    domain(r["domain"]);
+    if (r["environment_id"] !== input.environmentId)
+      invalid3();
+    for (const key of ["sending", "receiving"])
+      if (!["disabled", "pending", "ready", "failed"].includes(String(r[key])))
+        invalid3();
+    if (!["ready", "verification_pending"].includes(String(r["status"])))
+      invalid3();
+    time(r["configured_at"]);
+    if (r["observed_at"] !== null)
+      time(r["observed_at"]);
+    records(r["dns_records"]);
+    if (r["next_check_after_seconds"] !== null && r["next_check_after_seconds"] !== 60)
+      invalid3();
+    if (r["webhook"] !== null) {
+      const hook = object2(r["webhook"]);
+      exact3(hook, ["url", "verified"]);
+      https(hook["url"]);
+      if (typeof hook["verified"] !== "boolean")
+        invalid3();
+    }
+    if (r["dns"] !== void 0) {
+      const dns = object2(r["dns"]);
+      exact3(dns, ["status", "records"]);
+      if (!["configured", "action_required", "conflict"].includes(String(dns["status"])))
+        invalid3();
+      records(dns["records"]);
+    }
+    return;
+  }
+  if (input.action === "webhook_set") {
+    exact3(r, ["url", "signing_secret", "status"]);
+    if (r["url"] !== input.url || r["status"] !== "verification_required" || typeof r["signing_secret"] !== "string" || !/^whsec_[A-Za-z0-9+/]{43}=$/u.test(r["signing_secret"]))
+      invalid3();
+    return;
+  }
+  if (input.action === "webhook_disable") {
+    exact3(r, ["status"]);
+    if (r["status"] !== "disabled")
+      invalid3();
+    return;
+  }
+  if (input.action === "messages_list") {
+    exact3(r, ["items"]);
+    if (!Array.isArray(r["items"]) || r["items"].length > 50)
+      invalid3();
+    for (const value2 of r["items"]) {
+      const item = object2(value2);
+      exact3(item, ["message_id", "received_at", "state", "attempts"]);
+      id2(item["message_id"]);
+      time(item["received_at"]);
+      if (!["pending", "delivering", "delivered", "delivery_failed", "expired"].includes(String(item["state"])) || !Number.isInteger(item["attempts"]) || Number(item["attempts"]) < 0 || Number(item["attempts"]) > 4)
+        invalid3();
+    }
+    return;
+  }
+  if (input.action === "message_retry") {
+    exact3(r, ["attempted"], ["delivered"]);
+    if (typeof r["attempted"] !== "boolean" || r["delivered"] !== void 0 && typeof r["delivered"] !== "boolean")
+      invalid3();
+    return;
+  }
+  if (input.action !== "message_get")
+    invalid3();
+  if (r["status"] === "expired") {
+    exact3(r, ["status"]);
+    return;
+  }
+  exact3(r, [
+    "id",
+    "domain",
+    "received_at",
+    "expires_at",
+    "from",
+    "to",
+    "subject",
+    "text",
+    "html",
+    "message_id",
+    "attachments"
+  ]);
+  if (r["id"] !== input.messageId)
+    invalid3();
+  domain(r["domain"]);
+  time(r["received_at"]);
+  time(r["expires_at"]);
+  if (Date.parse(String(r["expires_at"])) - Date.parse(String(r["received_at"])) !== 72 * 36e5)
+    invalid3();
+  for (const key of ["from", "subject", "message_id"])
+    if (typeof r[key] !== "string")
+      invalid3();
+  for (const key of ["text", "html"])
+    if (r[key] !== null && typeof r[key] !== "string")
+      invalid3();
+  if (!Array.isArray(r["to"]) || r["to"].some((v) => typeof v !== "string" || v.slice(v.lastIndexOf("@") + 1).toLowerCase() !== r["domain"]))
+    invalid3();
+  if (!Array.isArray(r["attachments"]))
+    invalid3();
+  for (const value2 of r["attachments"]) {
+    const a = object2(value2);
+    exact3(a, ["id", "filename", "content_type", "download_path"]);
+    if (typeof a["id"] !== "string" || !/^[A-Za-z0-9_-]{1,128}$/u.test(a["id"]) || a["filename"] !== null && typeof a["filename"] !== "string" || typeof a["content_type"] !== "string" || a["download_path"] !== `/v1/projects/${input.projectId}/environments/${input.environmentId}/mail/messages/${input.messageId}/attachments/${a["id"]}`)
+      invalid3();
+  }
+}
+function object2(v) {
+  if (typeof v !== "object" || v === null || Array.isArray(v))
+    invalid3();
+  return v;
+}
+function exact3(v, required, optional = []) {
+  if (required.some((k) => !(k in v)) || Object.keys(v).some((k) => !required.includes(k) && !optional.includes(k)))
+    invalid3();
+}
+function id2(v) {
+  if (typeof v !== "string" || !ULID.test(v))
+    invalid3();
+}
+function domain(v) {
+  if (typeof v !== "string" || !/^(?=.{1,253}$)(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\.)+[a-z]{2,63}$/u.test(v))
+    invalid3();
+}
+function time(v) {
+  if (typeof v !== "string" || !Number.isFinite(Date.parse(v)) || new Date(v).toISOString() !== v)
+    invalid3();
+}
+function https(v) {
+  if (typeof v !== "string" || !v.startsWith("https://"))
+    invalid3();
+}
+function records(v) {
+  if (!Array.isArray(v))
+    invalid3();
+  for (const value of v) {
+    const r = object2(value);
+    exact3(r, ["type", "name", "value", "purpose", "status"], ["priority"]);
+    if (!["TXT", "CNAME", "MX"].includes(String(r["type"])) || ["name", "value", "purpose", "status"].some((k) => typeof r[k] !== "string") || r["type"] === "MX" && (!Number.isInteger(r["priority"]) || Number(r["priority"]) < 0 || Number(r["priority"]) > 65535))
+      invalid3();
+  }
+}
+function invalid3() {
+  throw new TypeError("Mail response contract invalid");
+}
+
+// packages/sdk-ts/dist/managed-mail.js
+function requestManagedMail(client2, input) {
+  const scope = { project_id: input.projectId, environment_id: input.environmentId };
+  switch (input.action) {
+    case "configure":
+      return configureManagedMailDomain({
+        ...scope,
+        "Idempotency-Key": input.idempotencyKey,
+        managedMailDomainRequest: {
+          domain: input.domain,
+          sending: input.sending,
+          receiving: input.receiving
+        }
+      }, { client: client2 });
+    case "status":
+      return getManagedMailDomain(scope, { client: client2 });
+    case "webhook_set":
+      return prepareManagedMailWebhook({
+        ...scope,
+        "Idempotency-Key": input.idempotencyKey,
+        managedMailWebhookRequest: { url: input.url }
+      }, { client: client2 });
+    case "webhook_verify":
+      return verifyManagedMailWebhook({ ...scope, "Idempotency-Key": input.idempotencyKey }, { client: client2 });
+    case "webhook_disable":
+      return disableManagedMailReceiving({ ...scope, "Idempotency-Key": input.idempotencyKey }, { client: client2 });
+    case "messages_list":
+      return listManagedMailMessages({ ...scope, ...input.after ? { after: input.after } : {} }, { client: client2 });
+    case "message_get":
+      return getManagedMailMessage({ ...scope, message_id: input.messageId }, { client: client2 });
+    case "message_retry":
+      return retryManagedMailMessage({ ...scope, message_id: input.messageId, "Idempotency-Key": input.idempotencyKey }, { client: client2 });
+  }
+}
+async function executeManagedMail(client2, input) {
+  const result = await requestManagedMail(client2, input);
+  assertManagedMailResponse(result, input);
+  return result;
+}
+
+// packages/contracts/dist/feedback.js
+var identifier = /^[0-7][0-9A-HJKMNP-TV-Z]{25}$/u;
+function parseFeedbackReceipt(value) {
+  if (typeof value !== "object" || value === null || Array.isArray(value))
+    throw new TypeError("Feedback was not acknowledged");
+  const v = value;
+  if (Object.keys(v).sort().join(",") !== "id,organization_id,submitted_at" || typeof v["id"] !== "string" || !identifier.test(v["id"]) || typeof v["organization_id"] !== "string" || !identifier.test(v["organization_id"]) || typeof v["submitted_at"] !== "string" || !/^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}\.\d{3}Z$/u.test(v["submitted_at"]) || !Number.isFinite(Date.parse(v["submitted_at"])) || new Date(v["submitted_at"]).toISOString() !== v["submitted_at"])
+    throw new TypeError("Feedback was not acknowledged");
+  return v;
+}
 
 // apps/product-cli/dist/product-api.js
 var GeneratedSdkProductApi = class {
@@ -21852,6 +22294,14 @@ var GeneratedSdkProductApi = class {
   async listProjects(input) {
     return listProjects(input, { client: this.#client });
   }
+  async changeProjectHandle(input) {
+    return changeProjectHandle({
+      project_id: input.projectId,
+      "Idempotency-Key": input.idempotencyKey,
+      "If-Match": input.ifMatch,
+      handle: input.handle
+    }, { client: this.#client });
+  }
   async checkProjectHandle(input) {
     return getProjectHandleAvailability({ handle: input.handle }, { client: this.#client });
   }
@@ -22080,15 +22530,8 @@ var GeneratedSdkProductApi = class {
       secret_name: input.name
     }, { client: this.#client });
   }
-  async configureMailDomain(input) {
-    return configureProjectMailDomain({
-      "Idempotency-Key": input.idempotencyKey,
-      project_id: input.projectId,
-      configureProjectMailDomainRequest: { domain: input.domain }
-    }, { client: this.#client });
-  }
-  async getMailDomain(projectId) {
-    return getProjectMailDomain({ project_id: projectId }, { client: this.#client });
+  managedMail(input) {
+    return executeManagedMail(this.#client, input);
   }
 };
 
@@ -22116,7 +22559,7 @@ var OwnerOnlyProjectLinkStore = class {
 // apps/product-cli/dist/repository-init.js
 import { createHash } from "node:crypto";
 import { lstat as lstat2, open as open3, readFile, readdir, stat } from "node:fs/promises";
-import { posix, resolve as resolve2 } from "node:path";
+import { dirname as dirname2, posix, resolve as resolve2 } from "node:path";
 
 // packages/contracts/dist/application-root.js
 var APPLICATION_ROOT_PATTERN = /^(?:\.|[A-Za-z0-9][A-Za-z0-9._-]*(?:\/[A-Za-z0-9][A-Za-z0-9._-]*)*)$/u;
@@ -23132,7 +23575,7 @@ async function databaseContractBlockers(config, applicationDirectory, files) {
     if (DATABASE_PRIVATE_BINDING_PATTERN.test(source)) {
       blockers.push({
         code: "database_binding_private",
-        message: `${path} reaches for a managed database connection string. Hyperdrive, DATABASE_URL and postgres:// URLs are platform-private and never reach a customer Worker. Call the database with createPrivateDatabaseClient from "@ohmyhost/customer-runtime/database".`
+        message: `${path} reaches for a managed database connection string. HYPERDRIVE is retired; DATABASE_URL and postgres:// URLs never reach a customer Worker. Call the database with createPrivateDatabaseClient from "@ohmyhost/customer-runtime/database".`
       });
     }
     if (DATABASE_SOCKET_DRIVER_PATTERN.test(source)) {
@@ -23155,8 +23598,8 @@ function migrationFilenameBlockers(files, configuredPath, provider) {
     return [];
   const root = configuredPath ?? "postgres/migrations";
   const prefix = `${root}/`;
-  const invalid3 = files.filter((path) => path.startsWith(prefix)).map((path) => path.slice(prefix.length)).some((path) => !/^(?:[A-Za-z0-9][A-Za-z0-9._-]*\/)*\d{14}_[a-z0-9][a-z0-9_-]*\.sql$/u.test(path));
-  return invalid3 ? [
+  const invalid4 = files.filter((path) => path.startsWith(prefix)).map((path) => path.slice(prefix.length)).some((path) => !/^(?:[A-Za-z0-9][A-Za-z0-9._-]*\/)*\d{14}_[a-z0-9][a-z0-9_-]*\.sql$/u.test(path));
+  return invalid4 ? [
     {
       code: "migration_filename_noncanonical",
       message: "Rename every PostgreSQL migration to YYYYMMDDHHMMSS_name.sql before initialization."
@@ -23363,6 +23806,24 @@ async function assertRepositoryRoot(root) {
   if (!information.isDirectory()) {
     throw new RepositoryInitError("repository_not_directory", "Repository path is not a directory");
   }
+  for (let ancestor = root; ; ancestor = dirname2(ancestor)) {
+    let marker;
+    try {
+      marker = await lstat2(resolve2(ancestor, ".git"));
+    } catch (error) {
+      if (error.code !== "ENOENT") {
+        throw new RepositoryInitError("repository_unreadable", "Could not determine the Git repository root");
+      }
+    }
+    if (marker !== void 0) {
+      if (ancestor !== root) {
+        throw new RepositoryInitError("repository_root_required", "Run ohmyhost init from the Git repository root and select the application directory with --root; ohmyhost.yaml must be at the repository root.");
+      }
+      return;
+    }
+    if (dirname2(ancestor) === ancestor)
+      return;
+  }
 }
 async function collectRepositoryFiles(root) {
   const files = [];
@@ -24340,7 +24801,7 @@ var runOfflineInit = async (command, io, diagnostics) => {
     });
     const code = error instanceof RepositoryInitBlockedError ? "repository_init_blocked" : error instanceof RepositoryInitConflictError ? "repository_configuration_exists" : known ? error.code : "internal_error";
     const exitCode = error instanceof RepositoryInitBlockedError ? 9 : known ? 2 : 1;
-    const result = errorDocument("init", exitCode, code, false, error instanceof RepositoryInitConflictError ? "Keep the existing ohmyhost.yaml or remove it explicitly before retrying." : error instanceof RepositoryInitError && error.code === "project_name_invalid" ? "Pass a lowercase deployment slug with '--project', then rerun init." : "Run 'ohmyhost init --dry-run --json' and resolve every reported blocker.");
+    const result = errorDocument("init", exitCode, code, false, error instanceof RepositoryInitConflictError ? "Keep the existing ohmyhost.yaml or remove it explicitly before retrying." : error instanceof RepositoryInitError && error.code === "repository_root_required" ? "Run ohmyhost init from the Git repository root with --root set to the application directory (for example --root website); commit the root ohmyhost.yaml before planning." : error instanceof RepositoryInitError && error.code === "project_name_invalid" ? "Pass a lowercase deployment slug with '--project', then rerun init." : "Run 'ohmyhost init --dry-run --json' and resolve every reported blocker.");
     io.writeStdout(result.stdout);
     return result.exitCode;
   }