@amerged/ohmyhost-cli 0.1.15 → 0.1.17

package/src/apps/product-cli/product-api.ts

@@ -57,6 +57,10 @@ import {
   configureProjectSourceAutoDeploy,
   createCloudflareDnsAuthorization,
   createProjectDevAccessTicket,
+  ensureProjectDevShareLink,
+  rotateProjectDevShareLink,
+  revokeProjectDevShareLink,
+  setProjectDevAccessMode,
   createDeployment,
   createProject,
   submitFeedback,
@@ -131,6 +135,7 @@ export interface ProjectCreateInput {
   readonly organizationId: string;
   readonly name: string;
   readonly dataMode?: "shared" | "isolated";
+  readonly devAccessMode?: "protected" | "public";
   readonly region?: "us" | "eu";
   readonly idempotencyKey: string;
 }
@@ -257,6 +262,20 @@ export interface ProductApi {
     readonly idempotencyKey: string;
   }): Promise<PaidDomain>;
   createDevAccessTicket(projectId: string): Promise<DevAccessTicket>;
+  ensureDevShareLink(projectId: string): Promise<import("@ohmyhost/sdk-ts").DevAccessState>;
+  rotateDevShareLink(
+    projectId: string,
+    idempotencyKey: string,
+  ): Promise<import("@ohmyhost/sdk-ts").DevAccessState>;
+  revokeDevShareLink(
+    projectId: string,
+    idempotencyKey: string,
+  ): Promise<import("@ohmyhost/sdk-ts").DevAccessState>;
+  setDevAccessMode(
+    projectId: string,
+    mode: "protected" | "public",
+    idempotencyKey: string,
+  ): Promise<import("@ohmyhost/sdk-ts").DevAccessState>;
   submitFeedback(input: {
     report: import("@ohmyhost/sdk-ts").FeedbackSubmission;
     idempotencyKey: string;
@@ -298,6 +317,7 @@ export interface ProductApi {
   planDeployment(input: {
     readonly projectId: string;
     readonly commitSha: string;
+    readonly environment: "dev" | "prod";
   }): Promise<DeploymentPlan>;
   createDeployment(input: {
     readonly projectId: string;
@@ -736,6 +756,35 @@ export class GeneratedSdkProductApi implements ProductApi {
     );
   }
 
+  public async ensureDevShareLink(projectId: string) {
+    return ensureProjectDevShareLink({ project_id: projectId }, { client: this.#client });
+  }
+  public async rotateDevShareLink(projectId: string, idempotencyKey: string) {
+    return rotateProjectDevShareLink(
+      { project_id: projectId, "Idempotency-Key": idempotencyKey },
+      { client: this.#client },
+    );
+  }
+  public async revokeDevShareLink(projectId: string, idempotencyKey: string) {
+    return revokeProjectDevShareLink(
+      { project_id: projectId, "Idempotency-Key": idempotencyKey },
+      { client: this.#client },
+    );
+  }
+  public async setDevAccessMode(
+    projectId: string,
+    mode: "protected" | "public",
+    idempotencyKey: string,
+  ) {
+    return setProjectDevAccessMode(
+      {
+        project_id: projectId,
+        "Idempotency-Key": idempotencyKey,
+        setDevAccessModeRequest: { mode },
+      },
+      { client: this.#client },
+    );
+  }
   public async createDevAccessTicket(projectId: string): Promise<DevAccessTicket> {
     return createProjectDevAccessTicket({ project_id: projectId }, { client: this.#client });
   }
@@ -760,6 +809,7 @@ export class GeneratedSdkProductApi implements ProductApi {
           organization_id: input.organizationId,
           name: input.name,
           ...(input.dataMode === undefined ? {} : { data_mode: input.dataMode }),
+          ...(input.devAccessMode === undefined ? {} : { dev_access_mode: input.devAccessMode }),
           ...(input.region === undefined ? {} : { region: input.region }),
         },
       },
@@ -880,9 +930,13 @@ export class GeneratedSdkProductApi implements ProductApi {
   public async planDeployment(input: {
     readonly projectId: string;
     readonly commitSha: string;
+    readonly environment: "dev" | "prod";
   }): Promise<DeploymentPlan> {
     return planDeployment(
-      { project_id: input.projectId, planDeploymentRequest: { commit_sha: input.commitSha } },
+      {
+        project_id: input.projectId,
+        planDeploymentRequest: { commit_sha: input.commitSha, environment: input.environment },
+      },
       { client: this.#client },
     );
   }

package/src/apps/product-cli/project-link-store.ts

@@ -1,4 +1,4 @@
-import { chmod, mkdir, rename, writeFile } from "node:fs/promises";
+import { appendFile, chmod, mkdir, readFile, rename, stat, writeFile } from "node:fs/promises";
 import { join } from "node:path";
 
 export interface ProjectLinkMetadata {
@@ -14,8 +14,32 @@ export interface ProjectLinkStore {
   save(metadata: ProjectLinkMetadata): Promise<void>;
 }
 
+/** The project this directory was linked to for this API, or null when there is no usable link. */
+export async function readLinkedProjectId(
+  directory: string,
+  apiOrigin: string,
+): Promise<string | null> {
+  try {
+    const link = JSON.parse(await readFile(join(directory, "link.json"), "utf8")) as unknown;
+    if (typeof link !== "object" || link === null) return null;
+    const { version, api_origin, project_id } = link as Record<string, unknown>;
+    return version === 1 &&
+      api_origin === apiOrigin &&
+      typeof project_id === "string" &&
+      /^[0-9A-HJKMNP-TV-Z]{26}$/u.test(project_id)
+      ? project_id
+      : null;
+  } catch {
+    return null;
+  }
+}
+
 export class OwnerOnlyProjectLinkStore implements ProjectLinkStore {
-  public constructor(private readonly directory: string) {}
+  /** repositoryRoot: when it is a Git working tree, the link directory is kept out of Git. */
+  public constructor(
+    private readonly directory: string,
+    private readonly repositoryRoot?: string,
+  ) {}
 
   public async save(metadata: ProjectLinkMetadata): Promise<void> {
     await mkdir(this.directory, { mode: 0o700, recursive: true });
@@ -26,5 +50,24 @@ export class OwnerOnlyProjectLinkStore implements ProjectLinkStore {
     await chmod(temporary, 0o600);
     await rename(temporary, target);
     await chmod(target, 0o600);
+    if (this.repositoryRoot !== undefined) await ignoreLinkDirectory(this.repositoryRoot);
+  }
+}
+
+async function ignoreLinkDirectory(root: string): Promise<void> {
+  try {
+    await stat(join(root, ".git"));
+  } catch {
+    return;
+  }
+  const file = join(root, ".gitignore");
+  let current = "";
+  try {
+    current = await readFile(file, "utf8");
+  } catch {
+    current = "";
   }
+  const lines = current.split(/\r?\n/u).map((line) => line.trim());
+  if (lines.some((line) => /^\/?\.ohmyhost\/?$/u.test(line))) return;
+  await appendFile(file, `${current === "" || current.endsWith("\n") ? "" : "\n"}/.ohmyhost/\n`);
 }

package/src/apps/product-cli/repository-init.ts

@@ -339,7 +339,8 @@ export async function initializeRepository(
     }),
   });
   const targetBetterAuth = existingConfiguration?.auth?.provider === "better-auth";
-  const targetMail = targetBetterAuth || existingConfiguration?.mail?.enabled === true;
+  // Mail stays an explicit choice: Better Auth or a detected mail package never enables it.
+  const targetMail = existingConfiguration?.mail?.enabled === true;
   const targetStorage = r2 || supabaseStorage;
   const configuredCompanionRequired =
     existingConfiguration !== null &&

package/src/apps/product-cli/runtime-contract.ts

@@ -21,12 +21,13 @@ import {
 } from "@ohmyhost/contracts/operation-failure";
 export type { PublicOperationFailure } from "@ohmyhost/contracts/operation-failure";
 
-const PROBLEM_POLICY = {
+/** Exported for the documentation build, which publishes one page per code. */
+export const PROBLEM_POLICY = {
   cloudflare_zone_not_bound: {
     status: 409,
     retryable: false,
     action:
-      "Configure the project domain first with 'ohmyhost domain paid plan' then 'ohmyhost domain paid apply', or configure its sender domain with 'ohmyhost mail domain set'. Then request Cloudflare authorization for that domain's zone.",
+      "Configure the project domain first with 'ohmyhost domain paid plan' then 'ohmyhost domain paid apply', or configure its sender domain with 'ohmyhost mail setup'. Then request Cloudflare authorization for that domain's zone.",
   },
   github_connection_required: {
     status: 409,
@@ -197,6 +198,12 @@ const PROBLEM_POLICY = {
     retryable: false,
     action: "Select the current succeeded dev deployment and target prod.",
   },
+  mail_capacity_unavailable: {
+    status: 503,
+    retryable: true,
+    action:
+      "Report this request ID through feedback. The stored mail setup continues automatically once ohmyho.st has capacity; follow mail status and keep the original idempotency key.",
+  },
   mail_domain_conflict: {
     status: 409,
     retryable: false,
@@ -205,7 +212,8 @@ const PROBLEM_POLICY = {
   mail_domain_required: {
     status: 409,
     retryable: false,
-    action: "Run 'ohmyhost mail domain set' for this project, then plan again.",
+    action:
+      "This app declares mail.enabled. Configure the project's own sender domain with 'ohmyhost mail setup' using its Prod environment ID, or set mail.enabled to false if the app sends no mail, then plan again.",
   },
   storage_jurisdiction_conflict: {
     status: 409,
@@ -213,6 +221,18 @@ const PROBLEM_POLICY = {
     action:
       "Set storage.jurisdiction in ohmyhost.yaml to the project's hosting region shown by project status, then plan again.",
   },
+  shared_data_requires_promotion: {
+    status: 409,
+    retryable: false,
+    action:
+      "Plan and deploy this commit to Dev, then run 'ohmyhost deployment promote plan' to reach Prod.",
+  },
+  production_deployment_required: {
+    status: 409,
+    retryable: false,
+    action:
+      "Deploy to Prod first: run 'ohmyhost plan --environment prod' and deploy that plan, or promote the current Dev deployment with 'ohmyhost deployment promote plan'. Then plan the domain again.",
+  },
   framework_conversion_required: {
     status: 409,
     retryable: false,
@@ -308,6 +328,8 @@ export class ResponseContractError extends Error {
 
 export interface SafeProblem {
   readonly requestId: string;
+  /** The error's documentation page, when the server names one on docs.ohmyho.st. */
+  readonly docsUrl?: string;
   readonly retryAfterSeconds?: number;
   readonly code: ProblemCode;
   readonly retryable: boolean;
@@ -690,6 +712,28 @@ export const parseCloudflareDnsAuthorizationStatus = (
   return input as unknown as PublicCloudflareDnsAuthorizationStatus;
 };
 
+export interface PublicDevAccessState {
+  readonly project_id: string;
+  readonly mode: "protected" | "public";
+  readonly share_url: string | null;
+}
+
+export const parseDevAccessState = (value: unknown): PublicDevAccessState => {
+  const input = exactRecord(value, ["project_id", "mode", "share_url"]);
+  if (
+    !isUlid(input["project_id"]) ||
+    (input["mode"] !== "protected" && input["mode"] !== "public") ||
+    (input["mode"] === "public" && input["share_url"] !== null) ||
+    (input["share_url"] !== null &&
+      (typeof input["share_url"] !== "string" ||
+        !/^https:\/\/dev-[a-z0-9]+(?:-[a-z0-9]+){0,4}\.(?:dev\.)?check\.omh\.st\/\.ohmyhost\/dev-access\/redeem\?stage=dev&ticket=[A-Za-z0-9_-]{43}$/u.test(
+          input["share_url"],
+        )))
+  )
+    throw new ResponseContractError();
+  return input as unknown as PublicDevAccessState;
+};
+
 export const parseDevAccessTicket = (value: unknown): PublicDevAccessTicket => {
   const input = exactRecord(value, [
     "ticket_id",
@@ -943,6 +987,7 @@ export const parseProjectStatus = (value: unknown): Readonly<Record<string, unkn
     "etag",
     "handle",
     "region",
+    "dev_access_mode",
     "lifecycle",
     "source",
     "default_environment",
@@ -961,6 +1006,7 @@ export const parseProjectStatus = (value: unknown): Readonly<Record<string, unkn
     !boundedString(handle, 3, 59) ||
     !/^[a-z0-9]+(?:-[a-z0-9]+){0,4}$/u.test(handle) ||
     (input["region"] !== "us" && input["region"] !== "eu") ||
+    (input["dev_access_mode"] !== "protected" && input["dev_access_mode"] !== "public") ||
     (input["lifecycle"] !== "active" &&
       input["lifecycle"] !== "deleting" &&
       input["lifecycle"] !== "deleted") ||
@@ -1308,6 +1354,7 @@ export const parseDeploymentPlan = (value: unknown): Readonly<Record<string, unk
   const input = exactRecord(value, [
     "id",
     "project_id",
+    "environment",
     "commit_sha",
     "source_digest",
     "build_plan_digest",
@@ -1329,6 +1376,7 @@ export const parseDeploymentPlan = (value: unknown): Readonly<Record<string, unk
     "currency",
     "rate_card_version",
     "credit_micros",
+    "credits",
     "provider_cost_micros",
     "scope",
     "reserved_seconds",
@@ -1336,6 +1384,7 @@ export const parseDeploymentPlan = (value: unknown): Readonly<Record<string, unk
   if (
     !isUlid(input["id"]) ||
     !isUlid(input["project_id"]) ||
+    (input["environment"] !== "dev" && input["environment"] !== "prod") ||
     !isCommitSha(input["commit_sha"]) ||
     !isDigest(input["source_digest"]) ||
     !isDigest(input["build_plan_digest"]) ||
@@ -1355,6 +1404,8 @@ export const parseDeploymentPlan = (value: unknown): Readonly<Record<string, unk
     !boundedString(cost["currency"], 1, 16) ||
     !boundedString(cost["rate_card_version"], 1, 128) ||
     !decimal(cost["credit_micros"]) ||
+    typeof cost["credits"] !== "string" ||
+    !/^[0-9]+(?:\.[0-9]{1,6})?$/u.test(cost["credits"]) ||
     !decimal(cost["provider_cost_micros"]) ||
     cost["scope"] !== "build_compute" ||
     !decimal(cost["reserved_seconds"]) ||
@@ -1497,8 +1548,10 @@ export const parseSafeProblem = (value: unknown): SafeProblem => {
       retryAfter > 86400)
   )
     throw new ResponseContractError();
+  const docsUrl = String(input["type"]);
   return {
     requestId: input["request_id"],
+    ...(docsUrl.startsWith("https://docs.ohmyho.st/errors/") ? { docsUrl } : {}),
     code: code as ProblemCode,
     retryable: policy.retryable,
     suggestedAction:

package/src/packages/sdk-ts/generated/index.ts

@@ -22,9 +22,11 @@ export {
   createProjectExport,
   createUserApiKey,
   deleteEnvironmentSecret,
+  deleteManagedMailDomain,
   deletePaidProjectDomain,
   deleteProject,
   disableManagedMailReceiving,
+  ensureProjectDevShareLink,
   getAccountProfile,
   getBillingCheckout,
   getBillingRecharge,
@@ -77,9 +79,12 @@ export {
   retryManagedMailMessage,
   revokeCurrentSession,
   revokeProjectDatabaseAccess,
+  revokeProjectDevShareLink,
   revokeUserApiKey,
   rollbackDeployment,
+  rotateProjectDevShareLink,
   setProjectCreditBudget,
+  setProjectDevAccessMode,
   setProjectNotes,
   streamDeploymentLogs,
   streamOperationEvents,
@@ -220,6 +225,11 @@ export type {
   DeleteEnvironmentSecretResponse,
   DeleteEnvironmentSecretResponses,
   DeleteEnvironmentSecretResult,
+  DeleteManagedMailDomainData,
+  DeleteManagedMailDomainError,
+  DeleteManagedMailDomainErrors,
+  DeleteManagedMailDomainResponse,
+  DeleteManagedMailDomainResponses,
   DeletePaidProjectDomainData,
   DeletePaidProjectDomainError,
   DeletePaidProjectDomainErrors,
@@ -239,12 +249,18 @@ export type {
   DeploymentPage,
   DeploymentPlan,
   DeploymentPlanWritable,
+  DevAccessState,
   DevAccessTicket,
   DisableManagedMailReceivingData,
   DisableManagedMailReceivingError,
   DisableManagedMailReceivingErrors,
   DisableManagedMailReceivingResponse,
   DisableManagedMailReceivingResponses,
+  EnsureProjectDevShareLinkData,
+  EnsureProjectDevShareLinkError,
+  EnsureProjectDevShareLinkErrors,
+  EnsureProjectDevShareLinkResponse,
+  EnsureProjectDevShareLinkResponses,
   EnvironmentId,
   EnvironmentSecret,
   EnvironmentSecretPage,
@@ -450,6 +466,7 @@ export type {
   ManagedMailDisabled,
   ManagedMailDnsRecord,
   ManagedMailDomain,
+  ManagedMailDomainDeleted,
   ManagedMailDomainRequest,
   ManagedMailExpired,
   ManagedMailMessagePage,
@@ -575,6 +592,11 @@ export type {
   RevokeProjectDatabaseAccessErrors,
   RevokeProjectDatabaseAccessResponse,
   RevokeProjectDatabaseAccessResponses,
+  RevokeProjectDevShareLinkData,
+  RevokeProjectDevShareLinkError,
+  RevokeProjectDevShareLinkErrors,
+  RevokeProjectDevShareLinkResponse,
+  RevokeProjectDevShareLinkResponses,
   RevokeUserApiKeyData,
   RevokeUserApiKeyError,
   RevokeUserApiKeyErrors,
@@ -585,13 +607,24 @@ export type {
   RollbackDeploymentErrors,
   RollbackDeploymentResponse,
   RollbackDeploymentResponses,
+  RotateProjectDevShareLinkData,
+  RotateProjectDevShareLinkError,
+  RotateProjectDevShareLinkErrors,
+  RotateProjectDevShareLinkResponse,
+  RotateProjectDevShareLinkResponses,
   SecretName,
+  SetDevAccessModeRequest,
   SetProjectCreditBudgetData,
   SetProjectCreditBudgetError,
   SetProjectCreditBudgetErrors,
   SetProjectCreditBudgetRequest,
   SetProjectCreditBudgetResponse,
   SetProjectCreditBudgetResponses,
+  SetProjectDevAccessModeData,
+  SetProjectDevAccessModeError,
+  SetProjectDevAccessModeErrors,
+  SetProjectDevAccessModeResponse,
+  SetProjectDevAccessModeResponses,
   SetProjectNotesData,
   SetProjectNotesError,
   SetProjectNotesErrors,