@amerged/ohmyhost-cli 0.1.13 → 0.1.15

package/dist/index.js

@@ -47,7 +47,7 @@ import {
   selectWorkspace,
   selectedWorkspaceId,
   workspaceOf
-} from "./chunk-ZWAAQEOZ.js";
+} from "./chunk-3BEMNNWB.js";
 import {
   CredentialStoreIntegrityError,
   CredentialStoreUnavailableError,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@amerged/ohmyhost-cli",
-  "version": "0.1.13",
+  "version": "0.1.15",
   "type": "module",
   "engines": {
     "node": ">=22"

package/src/apps/product-cli/cli.ts

@@ -75,7 +75,6 @@ import {
   type PublicEnvironmentSecret,
   parseOperation,
   parseOperationEvent,
-  parseProjectMailDomain,
   parseProjectPage,
   parseProjectStatus,
   parseProjectDatabaseQuery,
@@ -370,9 +369,24 @@ const HELP_USAGE = Object.freeze({
     "printf '%s' \"$SECRET_VALUE\" | ohmyhost secret set NAME --project ULID --environment ENVIRONMENT_ULID --idempotency-key KEY --stdin [--wait] --json",
   "secret delete":
     "ohmyhost secret delete NAME --project ULID --environment ENVIRONMENT_ULID --idempotency-key KEY [--wait] --json",
+  "mail setup":
+    "ohmyhost mail setup --project ULID --environment ULID --domain DOMAIN --sending true --receiving false --idempotency-key KEY --json",
+  "mail status": "ohmyhost mail status --project ULID --environment ULID --json",
+  "mail webhook set":
+    "ohmyhost mail webhook set --project ULID --environment ULID --url HTTPS_URL --idempotency-key KEY --json",
+  "mail webhook verify":
+    "ohmyhost mail webhook verify --project ULID --environment ULID --idempotency-key KEY --json",
+  "mail webhook disable":
+    "ohmyhost mail webhook disable --project ULID --environment ULID --idempotency-key KEY --json",
+  "mail messages list":
+    "ohmyhost mail messages list --project ULID --environment ULID [--after ULID] --json",
+  "mail messages get":
+    "ohmyhost mail messages get --project ULID --environment ULID --message ULID --json",
+  "mail messages retry":
+    "ohmyhost mail messages retry --project ULID --environment ULID --message ULID --idempotency-key KEY --json",
   "mail domain set":
-    "ohmyhost mail domain set --project ULID --domain DOMAIN --idempotency-key KEY --json",
-  "mail domain status": "ohmyhost mail domain status --project ULID --json",
+    "ohmyhost mail domain set --project ULID --environment ULID --domain DOMAIN --sending true --receiving false --idempotency-key KEY --json",
+  "mail domain status": "ohmyhost mail domain status --project ULID --environment ULID --json",
 } satisfies Readonly<Record<CustomerCommandLabel, string>>);
 
 const HELP_COMMANDS = Object.freeze(
@@ -807,9 +821,11 @@ export class ProductCli {
       if (command.kind === "secret-list") return await this.listEnvironmentSecrets(command, signal);
       if (command.kind === "function-runs") return await this.listFunctionRuns(command, signal);
       if (command.kind === "secret-set") return await this.putEnvironmentSecret(command, signal);
-      if (command.kind === "mail-domain-set")
-        return await this.configureMailDomain(command, signal);
-      if (command.kind === "mail-domain-status") return await this.getMailDomain(command, signal);
+      if (command.kind === "managed-mail") {
+        const api = await this.authenticatedApi(command.credentialStore, signal);
+        if (!api.managedMail) throw new Error("Mail unavailable");
+        return success(command.label, { mail: await api.managedMail(command.request) });
+      }
       return await this.deleteEnvironmentSecret(command, signal);
     } catch (error) {
       if (error instanceof UserTokenFileError)
@@ -1763,30 +1779,6 @@ export class ProductCli {
     );
   }
 
-  private async configureMailDomain(
-    command: Extract<ProductCliCommand, { kind: "mail-domain-set" }>,
-    signal: AbortSignal,
-  ): Promise<CliResult> {
-    const api = await this.authenticatedApi(command.credentialStore, signal);
-    const mailDomain = parseProjectMailDomain(
-      await api.configureMailDomain({
-        projectId: command.projectId,
-        domain: command.domain,
-        idempotencyKey: command.idempotencyKey,
-      }),
-    );
-    return success("mail domain set", { status: mailDomain.status, mail_domain: mailDomain });
-  }
-
-  private async getMailDomain(
-    command: Extract<ProductCliCommand, { kind: "mail-domain-status" }>,
-    signal: AbortSignal,
-  ): Promise<CliResult> {
-    const api = await this.authenticatedApi(command.credentialStore, signal);
-    const mailDomain = parseProjectMailDomain(await api.getMailDomain(command.projectId));
-    return success("mail domain status", { status: mailDomain.status, mail_domain: mailDomain });
-  }
-
   private async waitForOperation(
     api: ProductApi,
     initial: ReturnType<typeof parseOperation>,
@@ -2178,8 +2170,7 @@ const parsedCommandName = (command: ProductCliCommand): CommandLabel => {
   if (command.kind === "function-runs") return "function runs";
   if (command.kind === "secret-set") return "secret set";
   if (command.kind === "secret-delete") return "secret delete";
-  if (command.kind === "mail-domain-set") return "mail domain set";
-  if (command.kind === "mail-domain-status") return "mail domain status";
+  if (command.kind === "managed-mail") return command.label;
   return command.kind;
 };
 

package/src/apps/product-cli/command.ts

@@ -1,3 +1,4 @@
+import type { ManagedMailCommand } from "@ohmyhost/sdk-ts";
 import { USER_API_KEY_ID } from "@ohmyhost/contracts/user-api-keys";
 export type ProductCliCommand =
   | {
@@ -397,15 +398,19 @@ export type ProductCliCommand =
       readonly credentialStore: "native";
     }
   | {
-      readonly kind: "mail-domain-set";
-      readonly projectId: string;
-      readonly domain: string;
-      readonly idempotencyKey: string;
-      readonly credentialStore: "native";
-    }
-  | {
-      readonly kind: "mail-domain-status";
-      readonly projectId: string;
+      readonly kind: "managed-mail";
+      readonly request: ManagedMailCommand;
+      readonly label:
+        | "mail domain set"
+        | "mail domain status"
+        | "mail setup"
+        | "mail status"
+        | "mail webhook set"
+        | "mail webhook verify"
+        | "mail webhook disable"
+        | "mail messages list"
+        | "mail messages get"
+        | "mail messages retry";
       readonly credentialStore: "native";
     }
   | {
@@ -534,6 +539,14 @@ export type RecognizedCommandLabel =
   | "function runs"
   | "secret set"
   | "secret delete"
+  | "mail setup"
+  | "mail status"
+  | "mail webhook set"
+  | "mail webhook verify"
+  | "mail webhook disable"
+  | "mail messages list"
+  | "mail messages get"
+  | "mail messages retry"
   | "mail domain set"
   | "mail domain status";
 
@@ -639,6 +652,20 @@ export const recognizedCommandLabel = (argv: readonly string[]): RecognizedComma
       if (values[0] === "delete") return "secret delete";
     }
     if (value === "function" && values[0] === "runs") return "function runs";
+    if (value === "mail") {
+      if (values[0] === "setup") return "mail setup";
+      if (values[0] === "status") return "mail status";
+      if (values[0] === "webhook") {
+        if (values[1] === "set") return "mail webhook set";
+        if (values[1] === "verify") return "mail webhook verify";
+        if (values[1] === "disable") return "mail webhook disable";
+      }
+      if (values[0] === "messages") {
+        if (values[1] === "list") return "mail messages list";
+        if (values[1] === "get") return "mail messages get";
+        if (values[1] === "retry") return "mail messages retry";
+      }
+    }
     if (value === "mail" && values[0] === "domain") {
       if (values[1] === "set") return "mail domain set";
       if (values[1] === "status") return "mail domain status";
@@ -1724,34 +1751,82 @@ export const parseProductCliCommand = (argv: readonly string[]): ProductCliComma
     }
     throw new InvalidCommandError();
   }
-  if (first === "mail" && values[0] === "domain" && values[1] === "set") {
+  if (first === "mail") {
     if (yes || wait || follow || stdin) throw new InvalidCommandError();
-    values.splice(0, 2);
-    const options = parseOptions(values, ["--project", "--domain", "--idempotency-key"]);
-    if (
-      !/^(?=.{1,253}$)(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\.)+[a-z]{2,63}$/u.test(
-        options["--domain"],
-      )
-    ) {
-      throw new InvalidCommandError();
-    }
-    return {
-      kind: "mail-domain-set",
-      projectId: options["--project"],
-      domain: options["--domain"],
-      idempotencyKey: options["--idempotency-key"],
-      credentialStore,
-    };
-  }
-  if (first === "mail" && values[0] === "domain" && values[1] === "status") {
-    if (yes || wait || follow || stdin) throw new InvalidCommandError();
-    values.splice(0, 2);
-    const options = parseOptions(values, ["--project"]);
-    return {
-      kind: "mail-domain-status",
-      projectId: options["--project"],
-      credentialStore,
+    const area = values.shift();
+    const sub =
+      area === "webhook" || area === "messages" || area === "domain" ? values.shift() : undefined;
+    const options = parseOptionalOptions(values, [
+      "--project",
+      "--environment",
+      "--domain",
+      "--sending",
+      "--receiving",
+      "--url",
+      "--idempotency-key",
+      "--message",
+      "--after",
+    ]);
+    const required = (key: keyof typeof options) => {
+      const value = options[key];
+      if (!value) throw new InvalidCommandError();
+      return value;
     };
+    const scope = { projectId: required("--project"), environmentId: required("--environment") };
+    let request: ManagedMailCommand,
+      label: Extract<ProductCliCommand, { kind: "managed-mail" }>["label"];
+    if (area === "setup" || (area === "domain" && sub === "set")) {
+      const sending = required("--sending"),
+        receiving = required("--receiving");
+      if (!["true", "false"].includes(sending) || !["true", "false"].includes(receiving))
+        throw new InvalidCommandError();
+      request = {
+        ...scope,
+        action: "configure",
+        domain: required("--domain"),
+        sending: sending === "true",
+        receiving: receiving === "true",
+        idempotencyKey: required("--idempotency-key"),
+      };
+      label = area === "domain" ? "mail domain set" : "mail setup";
+    } else if (area === "status" || (area === "domain" && sub === "status")) {
+      request = { ...scope, action: "status" };
+      label = area === "domain" ? "mail domain status" : "mail status";
+    } else if (area === "webhook" && sub === "set") {
+      request = {
+        ...scope,
+        action: "webhook_set",
+        url: required("--url"),
+        idempotencyKey: required("--idempotency-key"),
+      };
+      label = "mail webhook set";
+    } else if (area === "webhook" && (sub === "verify" || sub === "disable")) {
+      request = {
+        ...scope,
+        action: sub === "verify" ? "webhook_verify" : "webhook_disable",
+        idempotencyKey: required("--idempotency-key"),
+      };
+      label = sub === "verify" ? "mail webhook verify" : "mail webhook disable";
+    } else if (area === "messages" && sub === "list") {
+      request = {
+        ...scope,
+        action: "messages_list",
+        ...(options["--after"] ? { after: options["--after"] } : {}),
+      };
+      label = "mail messages list";
+    } else if (area === "messages" && sub === "get") {
+      request = { ...scope, action: "message_get", messageId: required("--message") };
+      label = "mail messages get";
+    } else if (area === "messages" && sub === "retry") {
+      request = {
+        ...scope,
+        action: "message_retry",
+        messageId: required("--message"),
+        idempotencyKey: required("--idempotency-key"),
+      };
+      label = "mail messages retry";
+    } else throw new InvalidCommandError();
+    return { kind: "managed-mail", request, label, credentialStore };
   }
   throw new InvalidCommandError();
 };

package/src/apps/product-cli/product-api.ts

@@ -1,3 +1,4 @@
+import { executeManagedMail, type ManagedMailCommand } from "@ohmyhost/sdk-ts";
 import {
   assertProjectDatabaseAccess,
   assertProjectDatabaseAccessCredential,
@@ -53,7 +54,6 @@ import {
   type ProjectCreditBudget,
   applyPaidProjectDomain,
   configureProjectDomains,
-  configureProjectMailDomain,
   configureProjectSourceAutoDeploy,
   createCloudflareDnsAuthorization,
   createProjectDevAccessTicket,
@@ -74,7 +74,6 @@ import {
   getAccountProfile,
   getCurrentIdentity,
   getDeployment,
-  getProjectMailDomain,
   getProjectSourceAutoDeploy,
   getProjectStatus,
   getPaidProjectDomain,
@@ -113,7 +112,6 @@ import {
   type DeleteEnvironmentSecretResult,
   type OhMyHostClient,
   type ProviderReconciliationAttempt,
-  type ProjectMailDomain,
   type CurrentIdentity,
   type DevAccessTicket,
   type ProjectPage,
@@ -375,12 +373,7 @@ export interface ProductApi {
     readonly name: string;
     readonly idempotencyKey: string;
   }): Promise<DeleteEnvironmentSecretResult>;
-  configureMailDomain(input: {
-    readonly projectId: string;
-    readonly domain: string;
-    readonly idempotencyKey: string;
-  }): Promise<ProjectMailDomain>;
-  getMailDomain(projectId: string): Promise<ProjectMailDomain>;
+  managedMail?(input: ManagedMailCommand): Promise<unknown>;
 }
 
 export class GeneratedSdkProductApi implements ProductApi {
@@ -1094,22 +1087,7 @@ export class GeneratedSdkProductApi implements ProductApi {
     );
   }
 
-  public async configureMailDomain(input: {
-    readonly projectId: string;
-    readonly domain: string;
-    readonly idempotencyKey: string;
-  }): Promise<ProjectMailDomain> {
-    return configureProjectMailDomain(
-      {
-        "Idempotency-Key": input.idempotencyKey,
-        project_id: input.projectId,
-        configureProjectMailDomainRequest: { domain: input.domain },
-      },
-      { client: this.#client },
-    );
-  }
-
-  public async getMailDomain(projectId: string): Promise<ProjectMailDomain> {
-    return getProjectMailDomain({ project_id: projectId }, { client: this.#client });
+  public managedMail(input: ManagedMailCommand) {
+    return executeManagedMail(this.#client, input);
   }
 }

package/src/apps/product-cli/repository-init.ts

@@ -50,7 +50,7 @@ const MAXIMUM_SOURCE_BYTES = 2 * 1024 * 1024;
 const SOURCE_MODULE_PATTERN = /\.(?:[cm]?[jt]s|[jt]sx)$/u;
 const STORAGE_CLIENT_CALL_PATTERN = /\bcreatePrivateStorageClient\s*\(/u;
 // Both database mistakes of 2026-09-18 are visible in the source before anything is built: one read
-// a Hyperdrive connection string, the other opened a socket driver. Neither can work in a Worker, so
+// a retired database binding, the other opened a socket driver. Neither can work in a customer Worker, so
 // naming them here costs a customer minutes instead of a deployment that fails its health check.
 const DATABASE_PRIVATE_BINDING_PATTERN =
   /\bHYPERDRIVE\b|\bconnectionString\b|\bDATABASE_URL\b|postgres(?:ql)?:\/\//u;
@@ -549,7 +549,7 @@ async function databaseContractBlockers(
     if (DATABASE_PRIVATE_BINDING_PATTERN.test(source)) {
       blockers.push({
         code: "database_binding_private",
-        message: `${path} reaches for a managed database connection string. Hyperdrive, DATABASE_URL and postgres:// URLs are platform-private and never reach a customer Worker. Call the database with createPrivateDatabaseClient from "@ohmyhost/customer-runtime/database".`,
+        message: `${path} reaches for a managed database connection string. HYPERDRIVE is retired; DATABASE_URL and postgres:// URLs never reach a customer Worker. Call the database with createPrivateDatabaseClient from "@ohmyhost/customer-runtime/database".`,
       });
     }
     if (DATABASE_SOCKET_DRIVER_PATTERN.test(source)) {

package/src/apps/product-cli/runtime-contract.ts

@@ -1304,100 +1304,6 @@ function validDelivery(input: Readonly<Record<string, unknown>>): boolean {
   );
 }
 
-export type PublicProjectMailDomain =
-  | Readonly<{ domain: string; status: "configured"; configured_at: string }>
-  | Readonly<{
-      domain: string;
-      status: "delegation_required" | "ready" | "verification_pending" | "verification_failed";
-      observed_at?: string;
-      verification_issue?:
-        | "identity_missing"
-        | "identity_verification_failed"
-        | "dkim_verification_failed"
-        | "dkim_records_changed"
-        | "tenant_association_missing"
-        | null;
-      next_check_after_seconds?: 3600 | null;
-      configured_at: string;
-      name_servers: readonly [string, string, string, string];
-      change_id: string;
-    }>;
-
-export const parseProjectMailDomain = (value: unknown): PublicProjectMailDomain => {
-  const input = exactRecord(value, [
-    "domain",
-    "status",
-    "configured_at",
-    "name_servers",
-    "change_id",
-    "observed_at",
-    "verification_issue",
-    "next_check_after_seconds",
-  ]);
-  if (
-    typeof input["domain"] !== "string" ||
-    !/^(?=.{1,253}$)(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\.)+[a-z]{2,63}$/u.test(
-      input["domain"],
-    ) ||
-    !isIsoInstant(input["configured_at"])
-  ) {
-    throw new ResponseContractError();
-  }
-  if (input["status"] === "configured") {
-    if (
-      input["name_servers"] !== undefined ||
-      input["change_id"] !== undefined ||
-      input["observed_at"] !== undefined ||
-      input["verification_issue"] !== undefined ||
-      input["next_check_after_seconds"] !== undefined
-    ) {
-      throw new ResponseContractError();
-    }
-    return input as unknown as PublicProjectMailDomain;
-  }
-  if (
-    !["delegation_required", "ready", "verification_pending", "verification_failed"].includes(
-      String(input["status"]),
-    ) ||
-    !Array.isArray(input["name_servers"]) ||
-    input["name_servers"].length !== 4 ||
-    new Set(input["name_servers"]).size !== 4 ||
-    input["name_servers"].some(
-      (nameServer) =>
-        typeof nameServer !== "string" ||
-        !/^ns-[0-9]{1,4}\.awsdns-[0-9]{1,2}\.(?:com|net|org|co\.uk)$/u.test(nameServer),
-    ) ||
-    typeof input["change_id"] !== "string" ||
-    !/^C[A-Z0-9]{8,31}$/u.test(input["change_id"])
-  ) {
-    throw new ResponseContractError();
-  }
-  if (input["observed_at"] !== undefined) {
-    if (
-      ![
-        null,
-        "identity_missing",
-        "identity_verification_failed",
-        "dkim_verification_failed",
-        "dkim_records_changed",
-        "tenant_association_missing",
-      ].includes(input["verification_issue"] as string | null)
-    )
-      throw new ResponseContractError();
-    if (
-      !isIsoInstant(input["observed_at"]) ||
-      input["next_check_after_seconds"] !== (input["status"] === "ready" ? null : 3600)
-    )
-      throw new ResponseContractError();
-  } else if (
-    input["next_check_after_seconds"] !== undefined ||
-    input["verification_issue"] !== undefined ||
-    ["verification_pending", "verification_failed"].includes(String(input["status"]))
-  )
-    throw new ResponseContractError();
-  return input as unknown as PublicProjectMailDomain;
-};
-
 export const parseDeploymentPlan = (value: unknown): Readonly<Record<string, unknown>> => {
   const input = exactRecord(value, [
     "id",

package/src/packages/contracts/framework-admission.ts

@@ -208,9 +208,9 @@ const FRAMEWORK_CONVERSION_DETAILS: Readonly<
 > = Object.freeze({
   database_binding_private: Object.freeze({
     render: (path: string) =>
-      `"${path}" reads a managed database connection string. Hyperdrive, DATABASE_URL and postgres:// URLs never reach a customer Worker; call the database with createPrivateDatabaseClient from "@ohmyhost/customer-runtime/database". Commit the change, then plan again.`,
+      `"${path}" reads a managed database connection string. HYPERDRIVE is retired; DATABASE_URL and postgres:// URLs never reach a customer Worker. Call the database with createPrivateDatabaseClient from "@ohmyhost/customer-runtime/database". Commit the change, then plan again.`,
     pattern:
-      /^"([^"]+)" reads a managed database connection string\. Hyperdrive, DATABASE_URL and postgres:\/\/ URLs never reach a customer Worker; call the database with createPrivateDatabaseClient from "@ohmyhost\/customer-runtime\/database"\. Commit the change, then plan again\.$/u,
+      /^"([^"]+)" reads a managed database connection string\. HYPERDRIVE is retired; DATABASE_URL and postgres:\/\/ URLs never reach a customer Worker\. Call the database with createPrivateDatabaseClient from "@ohmyhost\/customer-runtime\/database"\. Commit the change, then plan again\.$/u,
   }),
   database_driver_unsupported: Object.freeze({
     render: (path: string) =>