@amerged/ohmyhost-cli 0.1.23 → 0.1.25

package/dist/{chunk-74DROG4F.js → chunk-YOEEWHSQ.js}

@@ -5019,8 +5019,8 @@ var require_multipleOf = __commonJS({
         const { gen, data, schemaCode, it } = cxt;
         const prec = it.opts.multipleOfPrecision;
         const res = gen.let("res");
-        const invalid4 = prec ? (0, codegen_1._)`Math.abs(Math.round(${res}) - ${res}) > 1e-${prec}` : (0, codegen_1._)`${res} !== parseInt(${res})`;
-        cxt.fail$data((0, codegen_1._)`(${schemaCode} === 0 || (${res} = ${data}/${schemaCode}, ${invalid4}))`);
+        const invalid5 = prec ? (0, codegen_1._)`Math.abs(Math.round(${res}) - ${res}) > 1e-${prec}` : (0, codegen_1._)`${res} !== parseInt(${res})`;
+        cxt.fail$data((0, codegen_1._)`(${schemaCode} === 0 || (${res} = ${data}/${schemaCode}, ${invalid5}))`);
       }
     };
     exports.default = def;
@@ -14769,17 +14769,25 @@ var UserTokenFileError = class extends Error {
   code;
   keyId;
   constructor(code, keyId) {
-    super({
-      token_file_not_ignored: "Add the selected env file to .gitignore or choose a location outside the repository. No token was created or written.",
-      token_file_unsafe: "Choose a private .env file owned by you. Symlinks, shared files and files larger than 64 KiB are not accepted.",
-      token_file_has_token: "The selected file already contains OHMYHOST_TOKEN. Use that token or choose a new file; existing credentials were preserved.",
-      token_file_changed: "The environment file changed during creation. It was not overwritten. List tokens to inspect the issued key before creating another.",
-      token_value_unavailable: "This token was already issued and its full value cannot be retrieved. Use the previously saved file, or explicitly revoke the listed key before creating a replacement."
-    }[code] + (keyId ? ` Token ID: ${keyId}.` : ""));
+    super(tokenFileAction(code, keyId));
     this.code = code;
     this.keyId = keyId;
   }
 };
+var tokenFileAction = (code, keyId) => {
+  switch (code) {
+    case "token_file_not_ignored":
+      return "Add the selected env file to .gitignore or choose a location outside the repository. No token was created or written.";
+    case "token_file_unsafe":
+      return "Choose an env file whose name starts or ends with .env, for example .env.local: a regular file you own, not a symlink or hard link, at most 64 KiB.";
+    case "token_file_has_token":
+      return "The selected file already contains OHMYHOST_TOKEN. Use that token or choose a new file; existing credentials were preserved.";
+    case "token_file_changed":
+      return keyId === void 0 ? "The env file changed while it was being read; no key was issued. Run the same command again." : `The env file changed while the token was being saved, so its value may not be in the file; key ${keyId} was issued. Revoke it with 'ohmyhost token revoke --organization ULID --key ${keyId} --yes --json' (MCP token_revoke), then create a new one with a new idempotency key.`;
+    case "token_value_unavailable":
+      return `A key was already issued for this idempotency key, and its value is shown only once. Use the file it was saved to, or revoke key ${String(keyId)} (ohmyhost token revoke, MCP token_revoke) and create a replacement with a new idempotency key.`;
+  }
+};
 async function prepareUserTokenFile(output) {
   const path = resolve(output);
   if (!basename(path).startsWith(".env") && !basename(path).endsWith(".env"))
@@ -14812,18 +14820,22 @@ OHMYHOST_TOKEN=${preview}
         const result = parseUserApiKeyCreation(value);
         if (result.value === null)
           throw new UserTokenFileError("token_value_unavailable", result.key.id);
-        const current = await lstat(path);
-        if (!current.isFile() || current.isSymbolicLink() || current.nlink !== 1 || current.ino !== identity.ino || current.dev !== identity.dev || await tokenFileText(handle) !== initial)
-          throw new UserTokenFileError("token_file_changed");
-        await handle.appendFile(`
+        try {
+          const current = await lstat(path);
+          if (!current.isFile() || current.isSymbolicLink() || current.nlink !== 1 || current.ino !== identity.ino || current.dev !== identity.dev || await tokenFileText(handle) !== initial)
+            throw new UserTokenFileError("token_file_changed");
+          await handle.appendFile(`
 OHMYHOST_TOKEN=${result.value}
 `, "utf8");
-        await handle.sync();
-        if (parseEnv(await tokenFileText(handle))["OHMYHOST_TOKEN"] !== result.value)
-          throw new UserTokenFileError("token_file_changed");
-        const saved = await lstat(path);
-        if (!saved.isFile() || saved.isSymbolicLink() || saved.ino !== identity.ino || saved.dev !== identity.dev)
+          await handle.sync();
+          if (parseEnv(await tokenFileText(handle))["OHMYHOST_TOKEN"] !== result.value)
+            throw new UserTokenFileError("token_file_changed");
+          const saved = await lstat(path);
+          if (!saved.isFile() || saved.isSymbolicLink() || saved.ino !== identity.ino || saved.dev !== identity.dev)
+            throw new UserTokenFileError("token_file_changed");
+        } catch {
           throw new UserTokenFileError("token_file_changed", result.key.id);
+        }
         return { request_id: result.request_id, key: result.key, token_file: path };
       },
       close: () => handle.close()
@@ -15271,6 +15283,63 @@ var describeRequest = (request) => {
 };
 var describeProfile = (profile) => `profile ${profile.name} (user ${profile.userId}, ${profile.organizationId === null ? "no organization" : `organization ${profile.organizationName === null ? "" : `${profile.organizationName} `}${profile.organizationId}`})`;
 
+// packages/contracts/dist/secret-names.js
+var USER_SECRET_NAME_PATTERN = /^[A-Z][A-Z0-9_]{0,127}$/u;
+var FIXED_PLATFORM_NAMES = /* @__PURE__ */ new Set([
+  "BETTER_AUTH_SECRET",
+  "BETTER_AUTH_URL",
+  "DATABASE_URL",
+  "HYPERDRIVE",
+  "ASSETS",
+  "FILES",
+  "IMAGES",
+  "STORAGE"
+]);
+var INSTALLED_PLATFORM_KEYS = /* @__PURE__ */ new Set([
+  "OHMYHOST_STORAGE_KEY",
+  "OHMYHOST_MAIL_KEY",
+  "BETTER_AUTH_SECRET"
+]);
+function isUserSecretName(value, action = "set") {
+  if (typeof value !== "string" || !USER_SECRET_NAME_PATTERN.test(value))
+    return false;
+  return action === "delete" ? !INSTALLED_PLATFORM_KEYS.has(value) : !value.startsWith("OHMYHOST_") && !FIXED_PLATFORM_NAMES.has(value);
+}
+
+// packages/contracts/dist/project-data-changes.js
+var PROJECT_DATA_CHANGE_KINDS = [
+  "isolate_prod_keeps_data",
+  "isolate_dev_keeps_data",
+  "share_prod_keeps_data",
+  "reset_dev"
+];
+function parseProjectDataChangePlan(value) {
+  if (value === null || typeof value !== "object" || Array.isArray(value))
+    invalid();
+  const input = value;
+  if (Object.keys(input).sort().join(",") !== "action,change,confirmation_token,created_at,data_mode_after,data_mode_before,destructive_effects,effects,expires_at,project_id,redeploy_environments,resource_etag,risks" || input["action"] !== "data_change" || typeof input["project_id"] !== "string" || !/^[0-7][0-9A-HJKMNP-TV-Z]{25}$/u.test(input["project_id"]) || !isProjectDataChangeKind(input["change"]) || !["shared", "isolated"].includes(String(input["data_mode_before"])) || input["data_mode_after"] !== (input["change"] === "share_prod_keeps_data" ? "shared" : "isolated") || input["data_mode_before"] !== (input["change"].startsWith("isolate_") ? "shared" : "isolated") || !Array.isArray(input["redeploy_environments"]) || input["redeploy_environments"].length !== 1 || input["redeploy_environments"][0] !== (input["change"] === "isolate_dev_keeps_data" ? "prod" : "dev") || !planStrings(input["effects"]) || !planStrings(input["destructive_effects"]) || !planStrings(input["risks"]) || typeof input["resource_etag"] !== "string" || !/^"sha256-[a-f0-9]{64}"$/u.test(input["resource_etag"]) || typeof input["confirmation_token"] !== "string" || !/^[A-Za-z0-9_-]{43}$/u.test(input["confirmation_token"]) || !instant(input["created_at"]) || !instant(input["expires_at"]) || Date.parse(input["expires_at"]) - Date.parse(input["created_at"]) !== 6e5)
+    invalid();
+  return Object.freeze({
+    ...input,
+    effects: Object.freeze([...input["effects"]]),
+    destructive_effects: Object.freeze([...input["destructive_effects"]]),
+    risks: Object.freeze([...input["risks"]]),
+    redeploy_environments: Object.freeze([...input["redeploy_environments"]])
+  });
+}
+function isProjectDataChangeKind(value) {
+  return typeof value === "string" && PROJECT_DATA_CHANGE_KINDS.some((kind) => kind === value);
+}
+function planStrings(value) {
+  return Array.isArray(value) && value.length <= 32 && value.every((text) => typeof text === "string" && text.length > 0 && text.length <= 2e3 && !/[\p{Cc}\p{Cf}]/u.test(text));
+}
+function instant(value) {
+  return typeof value === "string" && Number.isFinite(Date.parse(value)) && new Date(value).toISOString() === value;
+}
+function invalid() {
+  throw new TypeError("Project data change plan is invalid");
+}
+
 // packages/workos-auth-contracts/dist/parsing.js
 var WorkosContractError = class extends Error {
   code;
@@ -15390,6 +15459,10 @@ var recognizedCommandLabel = (argv) => {
       return "feedback status";
     if (value === "project" && values[0] === "create")
       return "project create";
+    if (value === "project" && values[0] === "data" && values[1] === "plan")
+      return "project data plan";
+    if (value === "project" && values[0] === "data" && values[1] === "change")
+      return "project data change";
     if (value === "organization" && values[0] === "create")
       return "organization create";
     if (value === "organization" && values[0] === "list")
@@ -15906,6 +15979,27 @@ var parseProductCliCommand = (argv) => {
   }
   if (first === "project") {
     const subcommand = values.shift();
+    if (subcommand === "data") {
+      const action = values.shift();
+      if (follow || stdin || action !== "plan" && action !== "change")
+        throw new InvalidCommandError();
+      if (action === "plan" && (yes || wait) || action === "change" && !yes)
+        throw new InvalidCommandError();
+      const options2 = parseOptions(values, action === "plan" ? ["--project", "--change"] : ["--project", "--change", "--if-match", "--confirmation-token", "--idempotency-key"]);
+      const change = options2["--change"];
+      if (!isProjectDataChangeKind(change))
+        throw new InvalidCommandError();
+      const common = { projectId: options2["--project"], change, credentialStore };
+      return action === "plan" ? { kind: "project-data-plan", ...common } : {
+        kind: "project-data-change",
+        ...common,
+        ifMatch: options2["--if-match"],
+        confirmationToken: options2["--confirmation-token"],
+        idempotencyKey: options2["--idempotency-key"],
+        yes: true,
+        wait
+      };
+    }
     if (subcommand === "handle" && values[0] === "set") {
       values.shift();
       if (yes || wait || follow || stdin)
@@ -16565,7 +16659,7 @@ var parseProductCliCommand = (argv) => {
       throw new InvalidCommandError();
     values.shift();
     const name = values.shift();
-    if (!isUserSecretName(name))
+    if (!isUserSecretName(name, "delete"))
       throw new InvalidCommandError();
     const options = parseOptions(values, ["--project", "--environment", "--idempotency-key"]);
     return {
@@ -16763,6 +16857,8 @@ var parseOptions = (values, allowed) => {
     if (option === void 0 || !allowed.includes(option) || !isValue(value)) {
       throw new InvalidCommandError();
     }
+    if (option === "--idempotency-key" && value.length > 128)
+      throw new InvalidCommandError();
     if (option in result)
       throw new InvalidCommandError();
     result[option] = value;
@@ -16786,6 +16882,8 @@ var parseOptionalOptions = (values, allowed) => {
     if (option === void 0 || !allowed.includes(option) || !isValue(value)) {
       throw new InvalidCommandError();
     }
+    if (option === "--idempotency-key" && value.length > 128)
+      throw new InvalidCommandError();
     if (option in result)
       throw new InvalidCommandError();
     result[option] = value;
@@ -16818,7 +16916,6 @@ var validGithubBranchName = (value) => !(value.length < 1 || value.length > 1024
   return code <= 32 || code === 127 || "\\~^:?*[]".includes(character);
 }) || value.split("/").some((component) => component.startsWith(".") || component.endsWith(".lock")));
 var validPaidHostname = (value) => /^(?=.{1,253}$)(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\.)+[a-z]{2,63}$/u.test(value) && !value.endsWith(".poc.aixyte.com") && value !== "omh.st" && !value.endsWith(".omh.st") && value !== "ohmyho.st" && !value.endsWith(".ohmyho.st");
-var isUserSecretName = (value) => isValue(value) && /^[A-Z][A-Z0-9_]{0,127}$/u.test(value) && value !== "DATABASE_URL" && value !== "HYPERDRIVE" && value !== "BETTER_AUTH_SECRET" && value !== "BETTER_AUTH_URL" && value !== "OHMYHOST_MAIL_KEY" && value !== "OHMYHOST_MAIL_GATEWAY_URL";
 
 // packages/contracts/dist/feedback.js
 var FEEDBACK_HISTORY_PAGE_SIZE = 25;
@@ -16892,6 +16989,41 @@ function hasControlCharacter(value, multiline) {
   });
 }
 
+// packages/contracts/dist/framework-build-script.mjs
+var PINNED_BUN_VERSION = "1.2.22";
+var TYPESCRIPT_BUILD_STAGE = /^tsc(?:[ \t]+(?:--noEmit|-b|--build))?$/u;
+function isAdmittedFrameworkBuildScript(framework, script) {
+  if (typeof script !== "string")
+    return false;
+  if (framework === "nextjs")
+    return script === "next build" || script === "next build --webpack";
+  if (framework !== "vite" && framework !== "tanstack-start")
+    return false;
+  const stages = script.trim().split(/[ \t]*&&[ \t]*/u);
+  if (stages.length === 1)
+    return stages[0] === "vite build";
+  if (stages.length !== 2)
+    return false;
+  return stages[0] === "vite build" && TYPESCRIPT_BUILD_STAGE.test(stages[1] ?? "") || TYPESCRIPT_BUILD_STAGE.test(stages[0] ?? "") && stages[1] === "vite build";
+}
+
+// packages/contracts/dist/customer-auth-admission.js
+function managedCustomerAuthDatabaseMessage(path) {
+  return `"${path}" selects the managed Better Auth bridge, which requires the managed PostgreSQL database. Set database.enabled: true with an admitted migrations path, or set auth.provider: none and keep the application-owned authentication configuration. Commit and push the change, then plan the new commit.`;
+}
+function managedCustomerAuthAdmissionIssue(capabilities) {
+  if (capabilities?.auth?.provider !== "better-auth") {
+    return null;
+  }
+  if (capabilities.database?.enabled !== true) {
+    return Object.freeze({
+      code: "managed_auth_database_required",
+      message: managedCustomerAuthDatabaseMessage("ohmyhost.yaml")
+    });
+  }
+  return null;
+}
+
 // packages/contracts/dist/framework-admission.js
 var FrameworkAdmissionError = class extends Error {
   reason;
@@ -16946,6 +17078,9 @@ function resolvePackageManager(input) {
   if (!contract.lockfiles.includes(lockfile)) {
     throw new FrameworkAdmissionError("package_manager_lockfile_mismatch");
   }
+  if (manager === "bun" && version2 !== PINNED_BUN_VERSION) {
+    throw new FrameworkAdmissionError("package_manager_version_unsupported");
+  }
   return Object.freeze({
     manager,
     version: version2,
@@ -17006,26 +17141,47 @@ function compareVersions(left, right) {
 function versionAdmission(classification, reason) {
   return Object.freeze({ classification, reason });
 }
+var PUSH_AND_PLAN = "Commit and push the change, then plan the new commit.";
 var FRAMEWORK_CONVERSION_DETAILS = Object.freeze({
+  managed_auth_database_required: Object.freeze({
+    render: managedCustomerAuthDatabaseMessage,
+    pattern: /^"([^"]+)" selects the managed Better Auth bridge, which requires the managed PostgreSQL database\. Set database\.enabled: true with an admitted migrations path, or set auth\.provider: none and keep the application-owned authentication configuration\. Commit and push the change, then plan the new commit\.$/u
+  }),
   database_binding_private: Object.freeze({
-    render: (path) => `"${path}" reads a managed database connection string. HYPERDRIVE is retired; DATABASE_URL and postgres:// URLs never reach a customer Worker. Call the database with createPrivateDatabaseClient from "@ohmyhost/customer-runtime/database". Commit the change, then plan again.`,
-    pattern: /^"([^"]+)" reads a managed database connection string\. HYPERDRIVE is retired; DATABASE_URL and postgres:\/\/ URLs never reach a customer Worker\. Call the database with createPrivateDatabaseClient from "@ohmyhost\/customer-runtime\/database"\. Commit the change, then plan again\.$/u
+    render: (path) => `"${path}" reads a database connection string (DATABASE_URL, HYPERDRIVE, connectionString or a postgres:// URL); none reaches a customer Worker. Call the database with createPrivateDatabaseClient from "@ohmyhost/customer-runtime/database". ${PUSH_AND_PLAN}`,
+    pattern: /^"([^"]+)" reads a database connection string \(DATABASE_URL, HYPERDRIVE, connectionString or a postgres:\/\/ URL\); none reaches a customer Worker\. Call the database with createPrivateDatabaseClient from "@ohmyhost\/customer-runtime\/database"\. Commit and push the change, then plan the new commit\.$/u
   }),
   database_driver_unsupported: Object.freeze({
-    render: (path) => `"${path}" imports a PostgreSQL socket driver. Outbound connect() is disabled for customer Workers, so it can never open a connection; call the database with createPrivateDatabaseClient from "@ohmyhost/customer-runtime/database". Commit the change, then plan again.`,
-    pattern: /^"([^"]+)" imports a PostgreSQL socket driver\. Outbound connect\(\) is disabled for customer Workers, so it can never open a connection; call the database with createPrivateDatabaseClient from "@ohmyhost\/customer-runtime\/database"\. Commit the change, then plan again\.$/u
+    render: (path) => `"${path}" imports a database socket driver (pg, postgres, pg-native or mysql2); customer Workers cannot open sockets. Call the database with createPrivateDatabaseClient from "@ohmyhost/customer-runtime/database". ${PUSH_AND_PLAN}`,
+    pattern: /^"([^"]+)" imports a database socket driver \(pg, postgres, pg-native or mysql2\); customer Workers cannot open sockets\. Call the database with createPrivateDatabaseClient from "@ohmyhost\/customer-runtime\/database"\. Commit and push the change, then plan the new commit\.$/u
   }),
   source_syntax_invalid: Object.freeze({
-    render: (path) => `Invalid JavaScript or TypeScript in "${path}". Fix the file, commit the change, then plan again.`,
-    pattern: /^Invalid JavaScript or TypeScript in "([^"]+)"\. Fix the file, commit the change, then plan again\.$/u
+    render: (path) => `Invalid JavaScript or TypeScript in "${path}". Fix the file, commit and push the change, then plan the new commit.`,
+    pattern: /^Invalid JavaScript or TypeScript in "([^"]+)"\. Fix the file, commit and push the change, then plan the new commit\.$/u
   }),
   worker_module_default_export_required: Object.freeze({
-    render: (path) => `Worker module "${path}" has no default export. Export default { fetch, scheduled } with the handlers ohmyho.st invokes; named exports are never called. Commit the change, then plan again.`,
-    pattern: /^Worker module "([^"]+)" has no default export\. Export default \{ fetch, scheduled \} with the handlers ohmyho\.st invokes; named exports are never called\. Commit the change, then plan again\.$/u
+    render: (path) => `Worker module "${path}" has no default export. Export default { fetch, scheduled } with the handlers ohmyho.st invokes; named exports are never called. ${PUSH_AND_PLAN}`,
+    pattern: /^Worker module "([^"]+)" has no default export\. Export default \{ fetch, scheduled \} with the handlers ohmyho\.st invokes; named exports are never called\. Commit and push the change, then plan the new commit\.$/u
   }),
   scheduled_handler_required: Object.freeze({
-    render: (path) => `functions.crons is declared but "${path}" exports no scheduled handler. Add scheduled(controller, env, ctx) to its default export, commit the change, then plan again.`,
-    pattern: /^functions\.crons is declared but "([^"]+)" exports no scheduled handler\. Add scheduled\(controller, env, ctx\) to its default export, commit the change, then plan again\.$/u
+    render: (path) => `functions.crons is declared but "${path}" exports no scheduled handler. Add scheduled(controller, env, ctx) to its default export, commit and push the change, then plan the new commit.`,
+    pattern: /^functions\.crons is declared but "([^"]+)" exports no scheduled handler\. Add scheduled\(controller, env, ctx\) to its default export, commit and push the change, then plan the new commit\.$/u
+  }),
+  framework_base_path_unsupported: Object.freeze({
+    render: (path) => `"${path}" sets a Vite base. ohmyho.st serves the app at the root origin: remove base or set base: "/". ${PUSH_AND_PLAN}`,
+    pattern: /^"([^"]+)" sets a Vite base\. ohmyho\.st serves the app at the root origin: remove base or set base: "\/"\. Commit and push the change, then plan the new commit\.$/u
+  }),
+  tanstack_prerender_required: Object.freeze({
+    render: (path) => `"${path}" does not call tanstackStart({ prerender: { enabled: true } }), which the static TanStack Start runtime needs; enable prerender, or set runtime.mode: edge with the Cloudflare Vite plugin. ${PUSH_AND_PLAN}`,
+    pattern: /^"([^"]+)" does not call tanstackStart\(\{ prerender: \{ enabled: true \} \}\), which the static TanStack Start runtime needs; enable prerender, or set runtime\.mode: edge with the Cloudflare Vite plugin\. Commit and push the change, then plan the new commit\.$/u
+  }),
+  tanstack_vite_plugins_required: Object.freeze({
+    render: (path) => `"${path}" does not follow the TanStack Start plugin contract: import tanstackStart from "@tanstack/react-start/plugin/vite"; on runtime edge also import cloudflare from "@cloudflare/vite-plugin" and call cloudflare({ viteEnvironment: { name: "ssr" } }) before tanstackStart(); on runtime static do not import the Cloudflare plugin. ${PUSH_AND_PLAN}`,
+    pattern: /^"([^"]+)" does not follow the TanStack Start plugin contract: import tanstackStart from "@tanstack\/react-start\/plugin\/vite"; on runtime edge also import cloudflare from "@cloudflare\/vite-plugin" and call cloudflare\(\{ viteEnvironment: \{ name: "ssr" \} \}\) before tanstackStart\(\); on runtime static do not import the Cloudflare plugin\. Commit and push the change, then plan the new commit\.$/u
+  }),
+  next_cache_components_unsupported: Object.freeze({
+    render: (path) => `"${path}" sets cacheComponents: true, which ohmyho.st does not support; remove it or set it to false. ${PUSH_AND_PLAN}`,
+    pattern: /^"([^"]+)" sets cacheComponents: true, which ohmyho\.st does not support; remove it or set it to false\. Commit and push the change, then plan the new commit\.$/u
   })
 });
 function isFrameworkConversionDiagnosticCode(value) {
@@ -17037,7 +17193,7 @@ function parseFrameworkConversionDiagnostic(value) {
   const record5 = value;
   const path = record5["path"];
   const code = record5["code"];
-  if (Object.keys(record5).length !== 2 || !isFrameworkConversionDiagnosticCode(code) || typeof path !== "string" || path.length > 240 || !/^[A-Za-z0-9_@()[\]./-]+\.(?:[cm]?[jt]sx?)$/u.test(path) || path.split("/").some((segment) => segment === "" || segment === "." || segment === ".."))
+  if (Object.keys(record5).length !== 2 || !isFrameworkConversionDiagnosticCode(code) || typeof path !== "string" || path.length > 240 || (code === "managed_auth_database_required" ? path !== "ohmyhost.yaml" : !/^[A-Za-z0-9_@()[\]./-]+\.(?:[cm]?[jt]sx?)$/u.test(path)) || path.split("/").some((segment) => segment === "" || segment === "." || segment === ".."))
     return null;
   return Object.freeze({ code, path });
 }
@@ -17059,36 +17215,36 @@ function parseFrameworkConversionDetail(value) {
 // packages/contracts/dist/operation-deployment-result.js
 function exactRecord(value, keys) {
   if (typeof value !== "object" || value === null || Array.isArray(value))
-    invalid();
+    invalid2();
   const actual = Object.keys(value).sort();
   const expected = [...keys].sort();
   if (actual.length !== expected.length || actual.some((key, index) => key !== expected[index])) {
-    invalid();
+    invalid2();
   }
   return value;
 }
 function ulid2(value) {
   if (typeof value !== "string" || !/^[0-9A-HJKMNP-TV-Z]{26}$/u.test(value))
-    invalid();
+    invalid2();
   return value;
 }
-function invalid() {
+function invalid2() {
   throw new TypeError("Operation deployment result is invalid");
 }
 var deploymentProgressActions = {
   queued: "The deployment is queued. Poll this same operation; do not submit another deployment.",
   building: "The build has not yet completed. Poll this same operation and read deployment logs if it fails.",
   publishing: "The build has completed. Runtime preparation or publication is still running; poll this same operation.",
-  waiting_for_mail: "Read 'ohmyhost mail domain status --project PROJECT --json' now and follow its verification issue and DNS records. Keep this operation; do not rebuild or repeat correct DNS changes.",
-  mail_status_unavailable: "Mail readiness could not be observed. Read 'ohmyhost mail domain status --project PROJECT --json' and report a persistent error; keep this operation."
+  waiting_for_mail: "Read 'ohmyhost mail status --project PROJECT --environment PROD_ENVIRONMENT_ULID --json' (MCP mail_status) now, with the Prod environment ID from 'ohmyhost project status', and follow its verification issue and DNS records. Keep this operation; do not rebuild or repeat correct DNS changes.",
+  mail_status_unavailable: "Mail readiness could not be observed. Read 'ohmyhost mail status --project PROJECT --environment PROD_ENVIRONMENT_ULID --json' (MCP mail_status) with the Prod environment ID from 'ohmyhost project status', and report a persistent error; keep this operation."
 };
 function createOperationDeploymentProgress(input) {
   const project = ulid2(input.project_id);
   ulid2(input.deployment_id);
   if (!Object.hasOwn(deploymentProgressActions, input.phase) || !Number.isFinite(Date.parse(input.observed_at)) || new Date(input.observed_at).toISOString() !== input.observed_at)
-    invalid();
+    invalid2();
   if (input.build_completed_at !== void 0 && (!Number.isFinite(Date.parse(input.build_completed_at)) || new Date(input.build_completed_at).toISOString() !== input.build_completed_at))
-    invalid();
+    invalid2();
   return Object.freeze({
     ...input.build_completed_at === void 0 ? {} : { build_completed_at: input.build_completed_at },
     phase: input.phase,
@@ -17119,7 +17275,7 @@ function parseOperationDeploymentProgress(value) {
     observed_at: row["observed_at"]
   });
   if (row["next_poll_after_seconds"] !== 60 || row["suggested_action"] !== parsed.suggested_action)
-    invalid();
+    invalid2();
   return parsed;
 }
 
@@ -17223,12 +17379,12 @@ function assertOrganizationAccount(value) {
 // packages/contracts/dist/operation-failure.js
 var failures = {
   operation_abandoned: [
-    "The operation stopped renewing its execution lease and was ended.",
-    "Inspect project status and, when this operation names a deployment_id, its diagnostics with 'ohmyhost deployment logs --project PROJECT_ULID --deployment DEPLOYMENT_ULID --follow --json' or MCP deployment_logs before creating a fresh plan. Keep this operation ID; the expired execution cannot resume."
+    "ohmyho.st stopped this operation before it finished and ended it.",
+    "Repeating this operation cannot resume it. Read project status for what is live; if this operation names a deployment_id, read 'ohmyhost deployment logs --project PROJECT_ULID --deployment DEPLOYMENT_ULID --follow --json' or MCP deployment_logs. Then submit the request once more with a new idempotency key: a deployment, promotion, rollback or deletion from a fresh plan, a rename with the ETag from project status. If it ends the same way, report both operation IDs through feedback."
   ],
   database_write_rejected: [
     "The database rejected this write; it was not committed.",
-    "Inspect the schema and parameter types with database query, then correct the statement and use a new key. Do not reset the database."
+    "The statement failed on PostgreSQL, ran or waited for a lock longer than 5 seconds, affected more than 1,000 rows, or was not one INSERT, UPDATE or DELETE. Check table, column and parameter types with database query, split a large change into batches of at most 1,000 rows, then submit with a new key. Nothing was committed; do not reset the database."
   ],
   database_write_unavailable: [
     "The database write could not start.",
@@ -17280,7 +17436,7 @@ var failures = {
   ],
   operation_failed: [
     "The operation failed.",
-    "Inspect the operation events and deployment diagnostics. Include the operation ID when reporting the issue."
+    "Read project status and, if this operation names a deployment_id, its diagnostics with 'ohmyhost deployment logs --project PROJECT_ULID --deployment DEPLOYMENT_ULID --follow --json'. Without one (a source link or project creation), check project status or project list, then repeat that command once with a new idempotency key. If it fails again, report the operation ID through feedback."
   ],
   build_not_started: [
     "The deployment ended without starting a build.",
@@ -17288,7 +17444,7 @@ var failures = {
   ],
   build_failed: [
     "The build did not produce a verified deployable artifact.",
-    "Read the BUILD_FAILED diagnostic of this operation's deployment_id with 'ohmyhost deployment logs --project PROJECT_ULID --deployment DEPLOYMENT_ULID --follow --json' or MCP deployment_logs; its excerpt is the tail of the install and build output. Correct that failure and verify the commands for the admitted commit before planning a new deployment."
+    "Read the BUILD_FAILED item of this operation's deployment_id with 'ohmyhost deployment logs --project PROJECT_ULID --deployment DEPLOYMENT_ULID --follow --json' or MCP deployment_logs. Its excerpt is the tail of your install and build output: fix that error, push and plan the new commit. Without an excerpt the build printed nothing, passed the 8-minute limit or failed inside ohmyho.st: plan the same commit once more, and report the operation ID through feedback if it fails again."
   ],
   insufficient_organization_credits: [
     "The organization does not have sufficient available credits for this operation.",
@@ -17296,27 +17452,39 @@ var failures = {
   ],
   paid_plan_required: [
     "Transactional mail requires an active Paid plan for this organization.",
-    "Activate or renew Paid for the organization, then create a new deployment plan. Replaying this terminal operation cannot enable mail. Do not change application code or reset its database."
+    "Ask the organization Owner to activate Paid through billing checkout; top-ups and signup credits do not activate it. Then plan the same deployment or promotion again. If the app should send no mail, instead set mail.enabled to false in ohmyhost.yaml, commit and push, and plan the new commit. Replaying this operation cannot enable mail. Do not reset the database."
   ],
   database_migration_failed: [
-    "The database migrations could not be applied.",
-    "Inspect the migration diagnostics and verify the canonical SQL migrations on PostgreSQL. Preserve production data; do not reset the database to retry a deployment."
+    "The database migrations were not applied; none of this deployment's new migration files took effect.",
+    "Read the DATABASE_MIGRATION_FAILED item in 'ohmyhost deployment logs --project PROJECT_ULID --deployment DEPLOYMENT_ULID --follow --json' and fix what it names; run 'ohmyhost init --dry-run --json' for migration_sql_not_admitted. Keep applied files unchanged, give new files later timestamps, and add to existing tables only nullable columns without default and non-unique indexes. Push and plan the new commit; never reset the database."
   ],
   runtime_candidate_failed: [
     "The deployed candidate failed its runtime checks.",
-    "Read the HEALTH_CHECK_FAILED diagnostic of this operation's deployment_id with 'ohmyhost deployment logs --project PROJECT_ULID --deployment DEPLOYMENT_ULID --follow --json' or MCP deployment_logs. Its route must answer 2xx to a cookieless GET without a redirect; status_code and, for owners, excerpt show what it answered. Fix that, often a missing secret or a redirect, then plan a new deployment."
+    "Read the HEALTH_CHECK_FAILED item with 'ohmyhost deployment logs --project PROJECT_ULID --deployment DEPLOYMENT_ULID --follow --json' or MCP deployment_logs. ohmyhost.yaml runtime.healthcheck (default /) must answer 2xx to a cookieless GET without redirect; status_code and, for owners, excerpt show the answer. After a promotion or rollback, fix that environment, often a missing secret, and plan it again; else fix the app, push and plan the new commit. No such item: plan once more, then report."
   ],
   runtime_candidate_rejected: [
-    "The runtime rejected the built Worker script.",
-    "Check that src/ohmyhost/worker.ts exports its handlers as the default export and imports no framework-only modules, then plan the new commit. Replaying this terminal operation cannot stage the same script."
+    "The runtime refused to load the built Worker.",
+    "The built Worker could not be loaded: top-level code throws or calls fetch, timers or random values outside a handler, an import cannot be resolved, a Worker module such as src/ohmyhost/companion.ts has no default export, or the bundle is too large. Fix that, push and plan the new commit; replaying this operation cannot pass. If none of this applies, report the operation ID through feedback."
   ],
   storage_jurisdiction_conflict: [
     "storage.jurisdiction must equal the project's hosting region.",
-    "Set storage.jurisdiction in ohmyhost.yaml to the project's hosting region shown by project status and plan again. A project cannot move its files between regions; do not delete or recreate the project to change it."
+    "Set storage.jurisdiction in ohmyhost.yaml to the project's region (us or eu) shown by 'ohmyhost project status', commit and push, then plan the new commit (for a promotion, deploy it to Dev and promote again); the unchanged commit fails again. A project cannot move its files between regions; do not delete or recreate the project to change it."
   ],
   provider_state_absent: [
     "Reconciliation confirmed that the required deployment resources are absent.",
     "Create a fresh deployment plan. The original operation is terminal; do not repeatedly reconcile it."
+  ],
+  auto_deploy_plan_rejected: [
+    "The GitHub push could not be planned for deployment.",
+    "Read project status and the operation's error or deployment diagnostics. Correct the source or configuration named there, push the new commit and plan it before deploying. Replaying this failed operation cannot start a build."
+  ],
+  promotion_source_stale: [
+    "The Dev deployment changed before promotion could start.",
+    "Read the current Dev deployment with 'ohmyhost project status --project ULID --json', then run 'ohmyhost deployment promote plan' for that succeeded deployment and confirm the new plan. Replaying this terminal promotion cannot select another source."
+  ],
+  promotion_target_stale: [
+    "The Prod deployment changed before promotion could start.",
+    "Read current Prod status, run 'ohmyhost deployment promote plan' again and confirm it with the new resource_etag and confirmation_token. Replaying this terminal operation cannot replace its stale target."
   ]
 };
 function publicOperationReconciliation(observation) {
@@ -17336,280 +17504,436 @@ function publicOperationFailure(internalCode) {
   return Object.freeze({ code, message, retryable: false, suggested_action });
 }
 
-// apps/product-cli/dist/runtime-contract.js
+// packages/contracts/dist/problem-policy.js
 var PROBLEM_POLICY = {
   cloudflare_zone_not_bound: {
     status: 409,
     retryable: false,
-    action: "Configure the project domain first with 'ohmyhost domain paid plan' then 'ohmyhost domain paid apply', or configure its sender domain with 'ohmyhost mail setup'. Then request Cloudflare authorization for that domain's zone."
+    action: "Configure the project domain first with 'ohmyhost domain paid plan' then 'ohmyhost domain paid apply', or configure its sender domain with 'ohmyhost mail setup'. Then request Cloudflare authorization for that domain's zone.",
+    title: "Cloudflare zone is not bound to this project"
   },
   github_connection_required: {
     status: 409,
     retryable: false,
-    action: "This workspace has no GitHub connection yet. Run 'ohmyhost github connect --organization ULID --idempotency-key KEY --json' for it, complete its browser link, then repeat the original source link. If the project belongs to another account, use that account's login instead; error.acting_as names the login this ran as."
+    action: "This workspace has no GitHub connection yet. Run 'ohmyhost github connect --organization ULID --idempotency-key KEY --json' for it, complete its browser link, then repeat the original source link. If the project belongs to another account, use that account's login instead; error.acting_as in the CLI and MCP names the login this ran as.",
+    title: "GitHub connection required"
   },
   github_connection_revoked: {
     status: 409,
     retryable: false,
-    action: "Run 'ohmyhost github connect --organization ULID --idempotency-key KEY --json' to restore this workspace's GitHub connection, then repeat the original source link."
+    action: "The workspace's GitHub App installation was removed or can no longer be used. Run 'ohmyhost github connect --organization ULID --idempotency-key NEW_KEY --json' with a new key (an earlier key only replays the old connection), send the customer its authorization_url, repeat that command with the same new key until status is connected, then repeat the original source link.",
+    title: "GitHub connection revoked",
+    restAction: "The workspace's GitHub App installation was removed or can no longer be used. Run 'ohmyhost github connect --organization ULID --idempotency-key NEW_KEY --json' with a new key (an earlier key only replays the old connection), send the customer its authorization_url, repeat that command with the same new key until status is connected, then repeat the original source link."
   },
   repository_not_installed: {
     status: 403,
     retryable: false,
-    action: "Read 'ohmyhost github status --organization ULID --json', open connection.settings_url and add this repository to the installation. Then repeat the original source link and key."
+    action: "Read 'ohmyhost github status --organization ULID --json', open connection.settings_url and add this repository to the installation. Then repeat the original source link and key.",
+    title: "Repository access required"
   },
   database_write_pending: {
     status: 409,
     retryable: false,
-    action: "Poll the original database-write operation before transfer or deletion."
+    action: "A database write of this project is still running, so the project cannot be deleted yet. Read latest_operation from 'ohmyhost project status --project ULID --json' until it is no longer running; writes are short. Then repeat the deletion, planning it again if its confirmation expired.",
+    title: "Database write in progress",
+    restAction: "A database write of this project is still running, so the project cannot be deleted yet. Read latest_operation from 'ohmyhost project status --project ULID --json' until it is no longer running; writes are short. Then repeat the deletion, planning it again if its confirmation expired."
   },
   cloudflare_authorization_closed: {
     status: 409,
     retryable: false,
-    action: "Read Cloudflare DNS status. Reuse a valid grant for the requested zone; otherwise request fresh authorization with a new idempotency key. Do not replay the callback."
+    action: "Read Cloudflare DNS status. Reuse a valid grant for the requested zone; otherwise request fresh authorization with a new idempotency key. Do not replay the callback.",
+    title: "Cloudflare authorization closed"
   },
   billing_recharge_conflict: {
     status: 409,
     retryable: false,
-    action: "Read billing recharge get and the current revision. Preserve the original key after uncertainty; do not start a checkout or automatically re-enable charges."
+    action: "The auto-recharge settings changed since you read them, or this key was used with other settings. Run 'ohmyhost billing recharge get --organization ULID --json'. If it already shows the requested change, stop. Otherwise, only if the Owner still wants it, send the change again with the returned revision and a new idempotency key. Never re-enable charges without the Owner's approval.",
+    title: "Auto-recharge settings conflict",
+    restAction: "The auto-recharge settings changed since you read them, or this key was used with other settings. Run 'ohmyhost billing recharge get --organization ULID --json'. If it already shows the requested change, stop. Otherwise, only if the Owner still wants it, send the change again with the returned revision and a new idempotency key. Never re-enable charges without the Owner's approval."
   },
   billing_purchase_conflict: {
     status: 409,
     retryable: false,
-    action: "Read the original checkout and use billing portal to manage the existing subscription. Do not create another purchase after uncertainty."
+    action: "This workspace already has Paid or an open Paid checkout, this key belongs to a checkout with a different offer or pack count, or, for 'billing portal', the workspace has never started a checkout. Read the original checkout with 'ohmyhost billing status --organization ULID --checkout CHECKOUT_ULID --json'; manage an existing Paid subscription with 'ohmyhost billing portal'. Never start a second purchase after an uncertain one.",
+    title: "Billing purchase conflict",
+    restAction: "This workspace already has Paid or an open Paid checkout, this key belongs to a checkout with a different offer or pack count, or, for 'billing portal', the workspace has never started a checkout. Read the original checkout with 'ohmyhost billing status --organization ULID --checkout CHECKOUT_ULID --json'; manage an existing Paid subscription with 'ohmyhost billing portal'. Never start a second purchase after an uncertain one."
   },
   compute_performance_paid_required: {
     status: 403,
     retryable: false,
-    action: "Check Paid service and usable credits or grace, or choose standard compute."
+    action: "Performance compute needs active Paid and usable credits or grace; repeating unchanged does not help. Read 'ohmyhost credits account --organization ULID --json'. On Free, the Owner may start Paid with 'ohmyhost billing checkout --offer paid'; without usable credits, they may add credits. Until then, keep standard compute.",
+    title: "Performance requires Paid access",
+    restAction: "Performance compute needs active Paid and usable credits or grace; repeating unchanged does not help. Read 'ohmyhost credits account --organization ULID --json'. On Free, the Owner may start Paid with 'ohmyhost billing checkout --offer paid'; without usable credits, they may add credits. Until then, keep standard compute."
   },
   compute_performance_unavailable: {
     status: 503,
     retryable: false,
-    action: "Choose standard compute or report inactive performance pricing through feedback. Do not repeatedly resubmit."
+    action: "Choose standard compute or report inactive performance pricing through feedback. Do not repeatedly resubmit.",
+    title: "Performance pricing unavailable"
   },
   compute_change_pending: {
     status: 409,
     retryable: false,
-    action: "Poll the existing operation after 60 seconds. Do not submit another size change, deletion or transfer while it runs."
+    action: "A database size change of this project is still running. Every 60 seconds read latest_operation from 'ohmyhost project status --project ULID --json', or 'ohmyhost operation get OPERATION_ID --json' for the change you started, until it ends, then repeat this request. Do not submit another size change or a deletion meanwhile.",
+    title: "Database size change running",
+    restAction: "A database size change of this project is still running. Every 60 seconds read latest_operation from 'ohmyhost project status --project ULID --json', or 'ohmyhost operation get OPERATION_ID --json' for the change you started, until it ends, then repeat this request. Do not submit another size change or a deletion meanwhile."
   },
   compute_change_conflict: {
     status: 409,
     retryable: false,
-    action: "Read the original operation and current database compute. Preserve data and report unresolved conflicts through feedback with the operation ID."
+    action: "Read the original operation and current database compute. Preserve data and report unresolved conflicts through feedback with the operation ID.",
+    title: "Database size change conflict"
   },
   database_access_limit: {
     status: 409,
     retryable: false,
-    action: "List the project's database credentials and revoke one you no longer need, then request access again."
+    action: "List the project's database credentials and revoke one you no longer need, then request access again.",
+    title: "Database access limit reached"
   },
   project_notes_conflict: {
     status: 409,
     retryable: false,
-    action: "Read project context, merge the current notes and retry with its version and a new idempotency key."
+    action: "Read project context, merge the current notes and retry with its version and a new idempotency key.",
+    title: "Project notes changed"
+  },
+  invalid_request: {
+    status: 400,
+    retryable: false,
+    action: "The server rejected this request; repeating it unchanged fails again. Check every argument against the command usage or the tool schema. For 'mail webhook verify' and mail receiving, the app's webhook route must answer the signed test with 2xx using the installed signing secret; receiving needs a verified webhook. For 'database query', send one read-only SELECT or WITH statement that runs on the current schema.",
+    title: "Invalid request",
+    restAction: "Read detail for the rejected field or condition, correct it and send the corrected request; repeating it unchanged fails again."
   },
-  invalid_request: { status: 400, retryable: false, action: "Check the request and retry." },
   unauthenticated: {
     status: 401,
     retryable: false,
-    action: "Check OHMYHOST_TOKEN and the selected environment. Replace invalid tokens, or unset OHMYHOST_TOKEN and run 'ohmyhost login'."
+    action: "The login or token was not accepted; repeating unchanged does not help. If OHMYHOST_TOKEN is set, it was revoked, mistyped or belongs to a different platform than OHMYHOST_ENVIRONMENT selects (a platform setting, not the project's dev or prod): ask the customer for a current token from the portal's API Tokens page, or unset it and run 'ohmyhost login --json'. Otherwise run 'ohmyhost login --json', then repeat the request.",
+    title: "Authentication required",
+    restAction: "The login or token was not accepted; repeating unchanged does not help. If OHMYHOST_TOKEN is set, it was revoked, mistyped or belongs to a different platform than OHMYHOST_ENVIRONMENT selects (a platform setting, not the project's dev or prod): ask the customer for a current token from the portal's API Tokens page, or unset it and run 'ohmyhost login --json'. Otherwise run 'ohmyhost login --json', then repeat the request."
+  },
+  forbidden: {
+    status: 403,
+    retryable: false,
+    action: "This login may not do this; repeating unchanged does not help. error.acting_as names the login used: use a workspace this login belongs to ('ohmyhost whoami --json'), or the login of the account that owns it. For 'organization create', pass --source exactly as the Signup source on the portal Profile page, or omit it when that page shows Direct.",
+    title: "Forbidden",
+    restAction: "This identity may not do this; repeating unchanged does not help. Use a workspace this identity belongs to. A new workspace must preserve the signup source already recorded for this user; a scoped API token may create another workspace through the ordinary authorized flow."
   },
-  forbidden: { status: 403, retryable: false, action: "Check organization access." },
   organization_required: {
     status: 409,
     retryable: false,
-    action: "Run 'ohmyhost organization list --json' and select one with 'ohmyhost organization use --organization ULID --json', or create the first workspace."
+    action: "Run 'ohmyhost organization list --json' and select one with 'ohmyhost organization use --organization ULID --json', or create the first workspace.",
+    title: "Workspace selection required"
   },
   resource_not_found: {
     status: 404,
     retryable: false,
-    action: "Check the resource identifier and the account: a project is visible only to its own organization, and error.acting_as names the login this ran as. Use the login of the account that owns it."
+    action: "Check the resource identifier and the account: a project is visible only to its own organization, and error.acting_as in the CLI and MCP names the login this ran as. Use the login of the account that owns it.",
+    title: "Resource not found"
   },
   idempotency_key_reused: {
     status: 409,
     retryable: false,
-    action: "Use a new idempotency key for a different request."
+    action: "This key was already used for a request with different arguments or from another login. To repeat that original request, send exactly its original arguments with this key from the same login; for a new request, use a new key. Never pair a new key with a request whose first attempt had an uncertain outcome: read its result first.",
+    title: "Idempotency key reused",
+    restAction: "This key was already used for a request with different arguments or from another login. To repeat that original request, send exactly its original arguments with this key from the same login; for a new request, use a new key. Never pair a new key with a request whose first attempt had an uncertain outcome: read its result first."
   },
   project_handle_unavailable: {
     status: 503,
     retryable: true,
-    action: "Retry project creation with the same idempotency key."
+    action: "Retry project creation with the same idempotency key.",
+    title: "Project handle unavailable"
   },
   project_handle_taken: {
     status: 409,
     retryable: false,
-    action: "Run 'ohmyhost project handle check' for a free address, then rename to one of the alternatives it returns."
+    action: "Another project uses this address. Run 'ohmyhost project handle check --handle NAME --json' and offer the customer its alternatives; rename only to the one they choose.",
+    title: "Project address is taken",
+    restAction: "Another project uses this address. Run 'ohmyhost project handle check --handle NAME --json' and offer the customer its alternatives; rename only to the one they choose."
   },
   project_handle_invalid: {
     status: 409,
     retryable: false,
-    action: "Choose one to five lowercase words of letters and digits, three to fifty-nine characters, avoiding reserved words."
+    action: "Choose one to five lowercase words of letters and digits, three to fifty-nine characters, avoiding reserved words.",
+    title: "Project address is invalid"
   },
   project_handle_unchanged: {
     status: 409,
     retryable: false,
-    action: "The project already answers on this address; no rename is needed."
+    action: "The project already answers on this address; no rename is needed.",
+    title: "Project address is unchanged"
   },
   project_rename_blocked: {
     status: 409,
     retryable: true,
-    action: "Wait for the running operation to finish, read the project again, then rename with the new ETag."
+    action: "Wait for the running operation to finish, read the project again, then rename with the new ETag.",
+    title: "Project address change blocked"
   },
   project_identity_unavailable: {
     status: 503,
     retryable: true,
-    action: "Retry project creation with the same idempotency key."
+    action: "Retry project creation with the same idempotency key.",
+    title: "Project identity unavailable"
   },
   deployment_plan_expired: {
     status: 409,
     retryable: false,
-    action: "Run 'ohmyhost plan' again, then deploy the new plan."
+    action: "Run 'ohmyhost plan' again, then deploy the new plan.",
+    title: "Deployment plan expired"
   },
   deployment_plan_incompatible: {
     status: 409,
     retryable: false,
-    action: "Run 'ohmyhost plan' again with the current source revision."
+    action: "Run 'ohmyhost plan' again with the current source revision.",
+    title: "Deployment plan incompatible"
   },
   confirmation_expired: {
     status: 409,
     retryable: false,
-    action: "Plan the destructive action again before confirming it."
+    action: "Plan the destructive action again before confirming it.",
+    title: "Confirmation expired"
   },
   confirmation_invalid: {
     status: 409,
     retryable: false,
-    action: "Use the confirmation token from a fresh matching plan."
+    action: "The confirmation token does not match this action or the project's current state. A deletion is also refused while a SQL export of the project is being captured, for up to about ten minutes ('ohmyhost export get'). Then create a new plan and confirm with its confirmation_token and resource_etag before the token expires.",
+    title: "Confirmation invalid",
+    restAction: "The confirmation token does not match this action or the project's current state. A deletion is also refused while a SQL export of the project is being captured, for up to about ten minutes ('ohmyhost export get'). Then create a new plan and confirm with its confirmation_token and resource_etag before the token expires."
   },
   etag_mismatch: {
     status: 409,
     retryable: false,
-    action: "Refresh the resource, plan the action again, and retry."
+    action: "The project changed after you read its ETag. For a rename, read etag from 'ohmyhost project status --project ULID --json' and repeat 'ohmyhost project handle set' with it. For a rollback, promotion or deletion, create a new plan and confirm with its resource_etag and confirmation_token.",
+    title: "Resource changed",
+    restAction: "The project changed after you read its ETag. For a rename, read etag from 'ohmyhost project status --project ULID --json' and repeat 'ohmyhost project handle set' with it. For a rollback, promotion or deletion, create a new plan and confirm with its resource_etag and confirmation_token."
   },
   promotion_source_stale: {
     status: 409,
     retryable: false,
-    action: "Read the current dev deployment, then plan promotion again."
+    action: "Read the current dev deployment, then plan promotion again.",
+    title: "Promotion source changed"
   },
   promotion_target_stale: {
     status: 409,
     retryable: false,
-    action: "Read the current prod status, then plan promotion again."
+    action: "Read the current prod status, then plan promotion again.",
+    title: "Promotion target changed"
   },
   promotion_invalid_target: {
     status: 409,
     retryable: false,
-    action: "Select the current succeeded dev deployment and target prod."
+    action: "Select the current succeeded dev deployment and target prod.",
+    title: "Promotion target invalid"
   },
   mail_capacity_unavailable: {
     status: 503,
     retryable: true,
-    action: "Report this request ID through feedback. The stored mail setup continues automatically once ohmyho.st has capacity; follow mail status and keep the original idempotency key."
+    action: "Report this request ID through feedback. The stored mail setup continues automatically once ohmyho.st has capacity; follow mail status and keep the original idempotency key.",
+    title: "Mail capacity unavailable"
   },
   mail_domain_conflict: {
     status: 409,
     retryable: false,
-    action: "Read and use the sender domain already configured for this project."
+    action: "Use the sender domain already configured for this project, or retire it with 'ohmyhost mail domain delete' (repeat while the removal is pending) and then set up the new domain; a domain registered to another project cannot be set up.",
+    title: "Mail domain conflict"
   },
   mail_domain_required: {
     status: 409,
     retryable: false,
-    action: "This app declares mail.enabled. Configure the project's own sender domain with 'ohmyhost mail setup' using its Prod environment ID, or set mail.enabled to false if the app sends no mail, then plan again."
+    action: "This app declares mail.enabled. Configure the project's own sender domain with 'ohmyhost mail setup' using its Prod environment ID, or set mail.enabled to false if the app sends no mail, then plan again.",
+    title: "Mail domain required"
   },
   storage_jurisdiction_conflict: {
     status: 409,
     retryable: false,
-    action: "Set storage.jurisdiction in ohmyhost.yaml to the project's hosting region shown by project status, then plan again."
+    action: "Set storage.jurisdiction in ohmyhost.yaml to the project's region (us or eu) shown by 'ohmyhost project status', commit and push, then plan the new commit (for a promotion, deploy it to Dev and promote again); the unchanged commit fails again. A project cannot move its files between regions; do not delete or recreate the project to change it.",
+    title: "Storage jurisdiction conflict",
+    restAction: "Set storage.jurisdiction in ohmyhost.yaml to the project's region (us or eu) shown by 'ohmyhost project status', commit and push, then plan the new commit (for a promotion, deploy it to Dev and promote again); the unchanged commit fails again. A project cannot move its files between regions; do not delete or recreate the project to change it."
   },
   shared_data_requires_promotion: {
     status: 409,
     retryable: false,
-    action: "Plan and deploy this commit to Dev, then run 'ohmyhost deployment promote plan' to reach Prod."
+    action: "Plan and deploy this commit to Dev, then run 'ohmyhost deployment promote plan' to reach Prod.",
+    title: "Shared data requires promotion"
   },
   production_deployment_required: {
     status: 409,
     retryable: false,
-    action: "Deploy to Prod first: run 'ohmyhost plan --environment prod' and deploy that plan, or promote the current Dev deployment with 'ohmyhost deployment promote plan'. Then plan the domain again."
+    action: "Deploy to Prod first: run 'ohmyhost plan --environment prod' and deploy that plan, or promote the current Dev deployment with 'ohmyhost deployment promote plan'. Then plan the domain again.",
+    title: "Production deployment required"
   },
   framework_conversion_required: {
     status: 409,
     retryable: false,
-    action: "Run 'ohmyhost init', apply the matching ohmyhost framework skill, then plan the new commit."
+    action: "Read detail for the file, reason and required change. Run ohmyhost init --dry-run --json at that commit, apply its blockers and the matching ohmyho.st framework Skill, then commit and push. Plan the new commit; repeating the unchanged source cannot fix an admission error.",
+    title: "Framework conversion required",
+    restAction: "Read detail for the file, reason and required change. Run ohmyhost init --dry-run --json at that commit, apply its blockers and the matching ohmyho.st framework Skill, then commit and push. Plan the new commit; repeating the unchanged source cannot fix an admission error."
   },
   repository_configuration_missing: {
     status: 409,
     retryable: false,
-    action: "Place ohmyhost.yaml at the Git repository root and set applicationRoot to the application directory (for example website). Commit and push the change, then plan the new commit."
+    action: "The planned commit has no ohmyhost.yaml at the Git repository root. If the repository has none, run 'ohmyhost init --json' at the root (--root DIR when the app lives in a subdirectory, --region eu for an EU project). Otherwise move the existing file to the root and set applicationRoot to the app directory, for example website. Commit and push, then plan the new commit.",
+    title: "Repository configuration missing",
+    restAction: "The planned commit has no ohmyhost.yaml at the Git repository root. If the repository has none, run 'ohmyhost init --json' at the root (--root DIR when the app lives in a subdirectory, --region eu for an EU project). Otherwise move the existing file to the root and set applicationRoot to the app directory, for example website. Commit and push, then plan the new commit."
   },
   migration_filename_noncanonical: {
     status: 409,
     retryable: false,
-    action: "Rename every migration to YYYYMMDDHHMMSS_name.sql, commit the change, then plan again."
+    action: "Every file in the migrations directory (database.migrations in ohmyhost.yaml) must be named YYYYMMDDHHMMSS_name.sql: 14 digits, an underscore, then lowercase letters, digits, _ or -. Rename each file that does not match and move any other file, such as README.md or .gitkeep, out of that directory. Commit and push, then plan the new commit. Never rename a migration a deployment already applied.",
+    title: "Migration filename noncanonical",
+    restAction: "Every file in the migrations directory (database.migrations in ohmyhost.yaml) must be named YYYYMMDDHHMMSS_name.sql: 14 digits, an underscore, then lowercase letters, digits, _ or -. Rename each file that does not match and move any other file, such as README.md or .gitkeep, out of that directory. Commit and push, then plan the new commit. Never rename a migration a deployment already applied."
   },
   environment_secret_mutation_blocked: {
     status: 409,
     retryable: true,
-    action: "Wait for the active deployment or rollback to finish, then retry unchanged."
+    action: "Wait for the active deployment or rollback to finish, then retry unchanged.",
+    title: "Environment secret mutation blocked"
   },
   workers_runtime_incompatible: {
     status: 409,
     retryable: false,
-    action: "Remove or replace the reported module, commit the change, then create a new plan."
+    action: "A Next.js file under app/, pages/, middleware or proxy imports a native addon (.node) or a Node.js module that does not run on Workers: child_process, cluster, dgram, domain, http2, inspector, readline, repl, sqlite, trace_events, tty, v8, vm, wasi, worker_threads or _stream_wrap, with or without node:. Remove or replace that import, commit and push, then plan the new commit.",
+    title: "Workers runtime incompatible",
+    restAction: "A Next.js file under app/, pages/, middleware or proxy imports a native addon (.node) or a Node.js module that does not run on Workers: child_process, cluster, dgram, domain, http2, inspector, readline, repl, sqlite, trace_events, tty, v8, vm, wasi, worker_threads or _stream_wrap, with or without node:. Remove or replace that import, commit and push, then plan the new commit."
+  },
+  payload_too_large: {
+    status: 413,
+    retryable: false,
+    action: "Reduce the request size.",
+    title: "Payload too large"
   },
-  payload_too_large: { status: 413, retryable: false, action: "Reduce the request size." },
   project_export_not_ready: {
     status: 409,
     retryable: false,
-    action: "Finish database provisioning, then request the export again. No backup was accepted."
+    action: "No database of this project is ready, so no export was accepted. A database is created when a commit whose ohmyhost.yaml sets database.enabled: true is deployed; request the export again after that deployment succeeds ('ohmyhost operation get OPERATION_ID --json'). A project without a database has no SQL export.",
+    title: "Project database not ready for export",
+    restAction: "No database of this project is ready, so no export was accepted. A database is created when a commit whose ohmyhost.yaml sets database.enabled: true is deployed; request the export again after that deployment succeeds ('ohmyhost operation get OPERATION_ID --json'). A project without a database has no SQL export."
   },
   powered_by_flag_required: {
     status: 409,
     retryable: false,
-    action: "Keep the flag on, remove the custom domain with 'ohmyhost domain paid delete', or buy Paid, then switch the flag off."
+    action: "Keep the flag on, remove the custom domain with 'ohmyhost domain paid delete', or buy Paid, then switch the flag off.",
+    title: "Powered-by flag required"
+  },
+  rate_limited: {
+    status: 429,
+    retryable: true,
+    action: "Too many requests. Wait retry_after_seconds, or 60 seconds when none is shown, then repeat the same request with the same idempotency key. SQL exports allow one request per project per rolling 24 hours: poll the export already requested with 'ohmyhost export get EXPORT_ID --project ULID --json' instead of creating another.",
+    title: "Rate limited",
+    restAction: "Wait the Retry-After interval (also retry_after_seconds), then repeat the same request with the same idempotency key."
   },
-  rate_limited: { status: 429, retryable: true, action: "Retry after the server delay." },
   insufficient_organization_credits: {
     status: 402,
     retryable: false,
-    action: "Add organization credits or wait for reservations to settle, then retry the same request."
+    action: "Add organization credits or wait for reservations to settle, then retry the same request.",
+    title: "Insufficient organization credits"
   },
   project_budget_exceeded: {
     status: 402,
     retryable: false,
-    action: "Raise the project's stop budget or select continue, then retry the same request."
+    action: "This project's Stop budget for the current UTC month is reached; nothing was started. Show the customer 'ohmyhost budget get --project ULID --json'. Only on their request raise the limit or switch the mode to continue with 'ohmyhost budget set', then retry the same request; otherwise wait for the next UTC month.",
+    title: "Project budget exceeded",
+    restAction: "This project's Stop budget for the current UTC month is reached; nothing was started. Show the customer 'ohmyhost budget get --project ULID --json'. Only on their request raise the limit or switch the mode to continue with 'ohmyhost budget set', then retry the same request; otherwise wait for the next UTC month."
   },
   paid_plan_required: {
     status: 402,
     retryable: false,
-    action: "Ask the organization Owner to activate Paid through billing checkout, then retry. Top-ups and signup credits do not activate Paid. For a website domain alone, a Free workspace may instead show the powered-by flag on the project."
+    action: "Ask the organization Owner to activate Paid through billing checkout, then retry. Top-ups and signup credits do not activate Paid. For a website domain alone, a Free workspace may instead show the powered-by flag on the project.",
+    title: "Paid plan required"
   },
   interactive_login_required: {
     status: 403,
     retryable: false,
-    action: "Unset OHMYHOST_TOKEN and run ohmyhost login before managing tokens. Existing token files remain unchanged."
+    action: "Unset OHMYHOST_TOKEN and run ohmyhost login before managing tokens. Existing token files remain unchanged.",
+    title: "Interactive login required"
   },
   api_key_creation_uncertain: {
     status: 503,
     retryable: true,
-    action: "Repeat the original token name and Idempotency-Key to observe its result; do not blindly create another key."
+    action: "Repeat the original token name and Idempotency-Key to observe its result; do not blindly create another key.",
+    title: "Token creation unconfirmed"
   },
   api_key_permissions_unavailable: {
     status: 503,
     retryable: false,
-    action: "Report the platform user-key permission configuration through feedback. Repeated login or creation will not fix it."
+    action: "Report the platform user-key permission configuration through feedback. Repeated login or creation will not fix it.",
+    title: "Token permissions unavailable"
   },
   reconciliation_exhausted: {
     status: 409,
     retryable: false,
-    action: "Stop retries and submit feedback with this operation ID. A platform recovery review is required."
+    action: "Stop retries and submit feedback with this operation ID. A platform recovery review is required.",
+    title: "Recovery attempts exhausted"
+  },
+  service_unavailable: {
+    status: 503,
+    retryable: true,
+    action: "The service could not complete or confirm this request; it may already have taken effect. Wait, then repeat exactly the same request with the same idempotency key, waiting longer each time; never switch to a new key. If 'ohmyhost plan' keeps failing, check that the commit is pushed to the linked repository and that 'ohmyhost init --dry-run --json' at that commit reports no blockers. If it still fails, report the request_id through feedback.",
+    title: "Service unavailable",
+    restAction: "The service could not complete or confirm this request; it may already have taken effect. Wait, then repeat exactly the same request with the same idempotency key, waiting longer each time; never switch to a new key. If 'ohmyhost plan' keeps failing, check that the commit is pushed to the linked repository and that 'ohmyhost init --dry-run --json' at that commit reports no blockers. If it still fails, report the request_id through feedback."
   },
-  service_unavailable: { status: 503, retryable: true, action: "Retry later." }
+  source_commit_not_found: {
+    status: 409,
+    retryable: false,
+    action: "The requested commit is not in the linked repository. Push that exact commit to the repository named by project status, or select a commit already there, then run 'ohmyhost plan' with its full SHA. Repeating the unchanged unavailable commit cannot work.",
+    restAction: "The requested commit is not in the linked repository. Push that exact commit to the repository named by project status, or select a commit already there, then run 'ohmyhost plan' with its full SHA. Repeating the unchanged unavailable commit cannot work.",
+    title: "Source commit not found"
+  },
+  domain_hostname_taken: {
+    status: 409,
+    retryable: false,
+    action: "A live project connection already holds this hostname. Remove it from the project you manage with 'ohmyhost domain paid delete --project ULID --hostname HOST --yes --json', then apply it to the new project. Repeating while that connection remains cannot work; report the request_id if you cannot manage its owning project.",
+    restAction: "A live project connection already holds this hostname. Remove it from the project you manage with 'ohmyhost domain paid delete --project ULID --hostname HOST --yes --json', then apply it to the new project. Repeating while that connection remains cannot work; report the request_id if you cannot manage its owning project.",
+    title: "Domain hostname is already connected"
+  },
+  data_change_blocked: {
+    status: 409,
+    retryable: true,
+    action: "An operation of this project is still running. Wait until 'ohmyhost operation get OPERATION_ULID --json' shows it finished, plan the data change again and confirm it with the new ETag and token.",
+    restAction: "An operation of this project is still running. Wait until 'ohmyhost operation get OPERATION_ULID --json' shows it finished, plan the data change again and confirm it with the new ETag and token.",
+    title: "Data change blocked"
+  },
+  data_change_in_progress: {
+    status: 409,
+    retryable: true,
+    action: "A data change of this project is running. Wait until its operation has finished ('ohmyhost project status --project ULID --json'), then repeat the request unchanged.",
+    restAction: "A data change of this project is running. Wait until its operation has finished ('ohmyhost project status --project ULID --json'), then repeat the request unchanged.",
+    title: "Data change in progress"
+  },
+  data_change_not_applicable: {
+    status: 409,
+    retryable: false,
+    action: "Read 'ohmyhost project status --project ULID --json'. Isolation applies to shared projects; returning to shared needs a deployed Prod database, and reset_dev applies to isolated projects. If detail names an old database or storage binding, deploy the affected environment again before planning the change. Repeating unchanged does not help.",
+    restAction: "Read 'ohmyhost project status --project ULID --json'. Isolation applies to shared projects; returning to shared needs a deployed Prod database, and reset_dev applies to isolated projects. If detail names an old database or storage binding, deploy the affected environment again before planning the change. Repeating unchanged does not help.",
+    title: "Data change is not applicable"
+  },
+  rollback_target_data_changed: {
+    status: 409,
+    retryable: false,
+    action: "This deployment used a data area its environment no longer has. Deploy that commit again with a fresh plan instead of rolling back to its old bindings; repeating this rollback cannot work.",
+    restAction: "This deployment used a data area its environment no longer has. Deploy that commit again with a fresh plan instead of rolling back to its old bindings; repeating this rollback cannot work.",
+    title: "Rollback data area changed"
+  },
+  project_domain_delete_required: {
+    status: 409,
+    retryable: false,
+    title: "Remove the project domain first",
+    action: "This project still has a live or pending custom-domain connection. Read 'ohmyhost domain paid status --project ULID --json', remove that connection with 'ohmyhost domain paid delete --project ULID --hostname HOST --yes --json', then create a fresh project deletion plan. Repeating while it remains connected cannot work."
+  }
 };
+
+// apps/product-cli/dist/runtime-contract.js
 var ResponseContractError = class extends Error {
   constructor() {
     super("The server response does not match the public contract.");
     this.name = "ResponseContractError";
   }
 };
+function parseProjectDataChangePlan2(value) {
+  try {
+    return parseProjectDataChangePlan(value);
+  } catch {
+    throw new ResponseContractError();
+  }
+}
 var parsePaidDomainPlan = (value) => {
   const input = exactRecord2(value, [
     "cname_target",
@@ -18259,6 +18583,7 @@ var parseSafeProblem = (value) => {
   const docsUrl = String(input["type"]);
   return {
     requestId: input["request_id"],
+    ...input["detail"] === void 0 ? {} : { message: String(input["detail"]) },
     ...docsUrl.startsWith("https://docs.ohmyho.st/errors/") ? { docsUrl } : {},
     code,
     retryable: policy.retryable,
@@ -18439,8 +18764,10 @@ var selectWorkspace = async (session, organization, signal, identity) => {
     throw new InteractiveSessionRequiredError();
   const refreshed = await session.refresher.refresh(stored.refreshToken, signal, organization.workos_id);
   assertVerifiedLogin(await identity(refreshed.accessToken), session.profile.userId, organization.id);
+  const existing = (await session.profiles.list()).find((saved) => saved.userId === session.profile.userId && saved.organizationId === organization.id);
   const bound = {
     ...session.profile,
+    name: existing?.name ?? session.profile.name,
     organizationId: organization.id,
     organizationName: organization.name
   };
@@ -18537,7 +18864,7 @@ function assertProjectDatabaseAccessPage(value) {
 }
 function assertAccessFields(value) {
   const revoked = value["revoked_at"], reason = value["revocation_reason"];
-  if (typeof value["access_id"] !== "string" || !/^[0-7][0-9A-HJKMNP-TV-Z]{25}$/u.test(value["access_id"]) || !["dev", "prod"].includes(String(value["environment"])) || !["read", "write"].includes(String(value["mode"])) || typeof value["role_name"] !== "string" || !ACCESS_ROLE_PATTERN.test(value["role_name"]) || typeof value["host"] !== "string" || !/^[a-z0-9]([a-z0-9.-]{0,251}[a-z0-9])?$/u.test(value["host"]) || value["database"] !== "neondb" || value["label"] !== null && accessLabel(value["label"]) !== value["label"] || !["active", "expired", "revoked"].includes(String(value["state"])) || !timestamp(value["issued_at"]) || !timestamp(value["expires_at"]) || Date.parse(String(value["expires_at"])) <= Date.parse(String(value["issued_at"])) || revoked !== null && !timestamp(revoked) || revoked === null !== (reason === null) || reason !== null && !["principal", "expired", "budget", "creation_failed"].includes(String(reason)) || value["state"] === "revoked" !== (revoked !== null))
+  if (typeof value["access_id"] !== "string" || !/^[0-7][0-9A-HJKMNP-TV-Z]{25}$/u.test(value["access_id"]) || !["dev", "prod"].includes(String(value["environment"])) || !["read", "write"].includes(String(value["mode"])) || typeof value["role_name"] !== "string" || !ACCESS_ROLE_PATTERN.test(value["role_name"]) || typeof value["host"] !== "string" || !/^[a-z0-9]([a-z0-9.-]{0,251}[a-z0-9])?$/u.test(value["host"]) || value["database"] !== "neondb" || value["label"] !== null && accessLabel(value["label"]) !== value["label"] || !["active", "expired", "revoked"].includes(String(value["state"])) || !timestamp(value["issued_at"]) || !timestamp(value["expires_at"]) || Date.parse(String(value["expires_at"])) <= Date.parse(String(value["issued_at"])) || revoked !== null && !timestamp(revoked) || revoked === null !== (reason === null) || reason !== null && !["principal", "expired", "budget", "creation_failed", "data_change"].includes(String(reason)) || value["state"] === "revoked" !== (revoked !== null))
     throw new TypeError("Invalid database access");
 }
 function accessLabel(value) {
@@ -18609,7 +18936,7 @@ function exact2(v, keys) {
 // apps/product-cli/package.json
 var package_default = {
   name: "@ohmyhost/product-cli",
-  version: "0.1.23",
+  version: "0.1.25",
   private: true,
   ohmyhost: {
     deployment: "production",
@@ -18672,43 +18999,43 @@ function assertProjectContext(v) {
 // packages/contracts/dist/project-exports.js
 function assertProjectExport(value) {
   if (!record4(value) || Object.keys(value).sort().join(",") !== "archive,error,id,next_poll_after_seconds,next_request_at,project_id,requested_at,state" || typeof value["id"] !== "string" || !id.test(value["id"]) || typeof value["project_id"] !== "string" || !id.test(value["project_id"]) || !["queued", "running", "succeeded", "failed", "cancelled"].includes(String(value["state"])) || !timestamp3(value["requested_at"]) || !timestamp3(value["next_request_at"]))
-    invalid2();
+    invalid3();
   const active = value["state"] === "queued" || value["state"] === "running";
   if (value["next_poll_after_seconds"] !== (active ? 5 : null))
-    invalid2();
+    invalid3();
   if (value["state"] === "failed") {
     const error = value["error"];
     if (!record4(error) || Object.keys(error).sort().join(",") !== "code,message,retryable,suggested_action" || typeof error["code"] !== "string")
-      invalid2();
+      invalid3();
     const expected = publicOperationFailure(error["code"]);
     for (const key of Object.keys(expected))
       if (error[key] !== expected[key])
-        invalid2();
+        invalid3();
   } else if (value["error"] !== null)
-    invalid2();
+    invalid3();
   const archive = value["archive"];
   if (archive === null) {
     if (value["state"] === "succeeded")
-      invalid2();
+      invalid3();
     return;
   }
   if (value["state"] !== "succeeded" || !record4(archive) || Object.keys(archive).sort().join(",") !== "bytes,captured_at,download_expires_at,download_url,expires_at,sha256,sql_files" || !Number.isSafeInteger(archive["bytes"]) || Number(archive["bytes"]) < 1 || Number(archive["bytes"]) > 536870912 || typeof archive["sha256"] !== "string" || !/^sha256:[a-f0-9]{64}$/u.test(archive["sha256"]) || !['["dev.sql"]', '["prod.sql"]', '["dev.sql","prod.sql"]', '["shared.sql"]'].includes(JSON.stringify(archive["sql_files"])) || !timestamp3(archive["captured_at"]) || !timestamp3(archive["expires_at"]))
-    invalid2();
+    invalid3();
   if (archive["download_url"] === null) {
     if (archive["download_expires_at"] !== null)
-      invalid2();
+      invalid3();
     return;
   }
   if (typeof archive["download_url"] !== "string" || !timestamp3(archive["download_expires_at"]) || Date.parse(archive["download_expires_at"]) > Date.parse(archive["expires_at"]))
-    invalid2();
+    invalid3();
   let url;
   try {
     url = new URL(archive["download_url"]);
   } catch {
-    invalid2();
+    invalid3();
   }
   if (url.protocol !== "https:" || url.username || url.password || url.hash)
-    invalid2();
+    invalid3();
 }
 var id = /^[0-7][0-9A-HJKMNP-TV-Z]{25}$/u;
 function record4(value) {
@@ -18717,7 +19044,7 @@ function record4(value) {
 function timestamp3(value) {
   return typeof value === "string" && Number.isFinite(Date.parse(value)) && new Date(value).toISOString() === value;
 }
-function invalid2() {
+function invalid3() {
   throw new TypeError("Project export response is invalid");
 }
 
@@ -18908,7 +19235,7 @@ var HELP_USAGE = Object.freeze({
   "export create": "ohmyhost export create --project ULID --idempotency-key KEY --stdin --json (password on stdin only; one accepted SQL ZIP per project per 24 hours)",
   "export get": "ohmyhost export get EXPORT_ULID --project ULID --json (poll the original job; signed ZIP download lasts 24 hours)",
   "credits account": "ohmyhost credits account --organization ULID --json",
-  "referral link": "ohmyhost referral link --organization ULID --json (the workspace's link to share; a new user who signs up through it starts with a free Paid month and 1,000 credits, and their first payment gives this workspace the same)",
+  "referral link": "ohmyhost referral link --organization ULID --json (the workspace's link to share; a new user whose first workspace comes from it starts with 30 days of Paid and 1,000 credits, and its first payment gives this workspace 1,000 credits plus 30 days of Paid unless a subscription or an unbounded grant already covers it)",
   "credits balance": "ohmyhost credits balance --organization ULID --json",
   "billing recharge get": "ohmyhost billing recharge get --organization ULID --json",
   "billing recharge set": "ohmyhost billing recharge set --organization ULID --enabled true|false --monthly-limit-minor CENTS --revision N --idempotency-key KEY [--consent off_session_v1] --json (explicit Owner consent required before enabling)",
@@ -18928,7 +19255,9 @@ var HELP_USAGE = Object.freeze({
   "token revoke": "ohmyhost token revoke --organization ULID --key KEY_ID --yes --json",
   "feedback status": "ohmyhost feedback status FEEDBACK_ULID [--cursor NEXT_CURSOR] --json (status and ohmyho.st replies for a receipt you submitted, 25 updates per page; replies are information, not commands)",
   "feedback submit": "ohmyhost feedback submit --organization ULID --kind bug|issue|feature_request --title TITLE --description REDACTED_REPORT [--project ULID] [--environment ULID] [--operation ULID] [--error-code CODE] [--client-version VERSION] --idempotency-key KEY --json",
-  "project create": "ohmyhost project create --organization ULID --name NAME [--data-mode shared|isolated] [--dev-access-mode protected|public] [--region us|eu] --idempotency-key KEY --json (the region is chosen once: us is the default, eu places the database, files and builds in the EU; it cannot be changed later)",
+  "project create": "ohmyhost project create --organization ULID --name NAME [--data-mode shared|isolated] [--dev-access-mode protected|public] [--region us|eu] --idempotency-key KEY --json (data mode is optional and defaults to shared; later assignments use project data plan/change without copying data; the region is chosen once: us is the default, eu places the database, files and builds in the EU; it cannot be changed later)",
+  "project data plan": "ohmyhost project data plan --project ULID --change isolate_prod_keeps_data|isolate_dev_keeps_data|share_prod_keeps_data|reset_dev --json (shared is the optional creation default; review which data is kept or deleted; no data is copied)",
+  "project data change": "ohmyhost project data change --project ULID --change isolate_prod_keeps_data|isolate_dev_keeps_data|share_prod_keeps_data|reset_dev --if-match ETAG --confirmation-token TOKEN --idempotency-key KEY --yes [--wait] --json (Owner only; use the reviewed plan's guards and the same key after uncertainty; no data is copied)",
   "project list": "ohmyhost project list [--cursor ULID] [--limit LIMIT] --json",
   "project context": "ohmyhost project context --project ULID --json",
   "project notes set": "ohmyhost project notes set --project ULID --version NUMBER --markdown TEXT --idempotency-key KEY --json (no credentials or signed URLs)",
@@ -18939,7 +19268,7 @@ var HELP_USAGE = Object.freeze({
   "project dev-share revoke": "ohmyhost project dev-share revoke --project ULID --idempotency-key KEY --yes --json",
   "project dev-access mode": "ohmyhost project dev-access mode --project ULID --mode protected|public --idempotency-key KEY --yes --json",
   "project flag status": "ohmyhost project flag status --project ULID --json",
-  "project flag set": "ohmyhost project flag set --project ULID --enabled true|false --idempotency-key KEY --json (shows the small Powered by ohmyho.st flag on the production site; while it shows, a Free workspace may connect its own domain without the domain fee and each Paid period adds 250 credits)",
+  "project flag set": "ohmyhost project flag set --project ULID --enabled true|false --idempotency-key KEY --json (shows the small Powered by ohmyho.st flag on the production site; while it shows, this project's custom domain uses no domain credits and also works on Free, and each Paid period bought through Stripe adds 250 credits to the workspace, however many projects show the flag)",
   "project handle check": "ohmyhost project handle check --handle HANDLE --json (is this address free? answers with a reason and free alternatives; the address becomes HANDLE.check.omh.st)",
   "project handle set": "ohmyhost project handle set --project ULID --handle HANDLE --if-match ETAG --idempotency-key KEY --json (moves the project to a free address; the old one stops working and anyone may claim it)",
   "database compute set": "ohmyhost database compute set --project ULID --environment dev|prod --profile standard|performance --idempotency-key KEY --yes [--wait] --json\n  standard: Free 0.25 CU/1 GB/60s idle, Paid 0.5 CU/2 GB/60s idle. performance: Paid 1 CU/4 GB/300s idle, 2.5x database compute credits per equal active minute; longer idle time also consumes credits.",
@@ -18994,6 +19323,30 @@ var cliMetadataResult = (kind, topic) => kind === "help" ? success("help", {
   environment: "OHMYHOST_ENVIRONMENT=development|production (default: production); OHMYHOST_PROFILE=NAME binds this process to one saved login",
   commands: HELP_COMMANDS.filter((entry) => !topic || entry.command === topic)
 }) : success("version", { status: "succeeded", cli_version: CLI_VERSION });
+var invalidCommandAction = (argv, commandPrefix) => {
+  const label = recognizedCommandLabel(argv);
+  if (label === "secret set" || label === "secret delete") {
+    const action = label === "secret set" ? "set" : "delete";
+    const at = argv.findIndex((value, index) => value === "secret" && argv[index + 1] === action);
+    const name = at < 0 ? void 0 : argv[at + 2];
+    if (name !== void 0 && !isUserSecretName(name, action))
+      return action === "set" ? "Choose a customer secret name of at most 128 uppercase letters, digits and underscores, starting with a letter. OHMYHOST_* and DATABASE_URL, HYPERDRIVE, BETTER_AUTH_SECRET, BETTER_AUTH_URL, ASSETS, FILES, IMAGES and STORAGE are reserved for the platform. Rename the application's own variable and its source references; platform bindings are installed automatically. Nothing was sent; changing only the idempotency key will not help." : "Choose an existing customer secret name of at most 128 uppercase letters, digits and underscores, starting with a letter. The installed platform keys OHMYHOST_STORAGE_KEY, OHMYHOST_MAIL_KEY and BETTER_AUTH_SECRET cannot be deleted. Older reserved-name collisions can be removed with secret delete; deployed platform keys stay managed by ohmyho.st. Nothing was sent; changing only the idempotency key will not help.";
+  }
+  const usage = Object.hasOwn(HELP_USAGE, label) ? HELP_USAGE[label].split("\n")[0] : void 0;
+  if (usage === void 0)
+    return "Unknown command; nothing was sent. 'ohmyhost --help --json' lists every command with its flags. If a documented command is missing, this CLI is older than https://ohmyho.st/client-release.json: install the published version.";
+  const linkable = /(?:^|\s)--project ULID/u.test(usage) && !argv.includes("--project");
+  return `The arguments of '${label}' are invalid or incomplete; nothing was sent. Usage: ${usage}.${linkable ? ` --project may be omitted only inside a directory linked with '${commandPrefix} link' for this OHMYHOST_ENVIRONMENT; otherwise pass --project ULID.` : ""}`;
+};
+var INTERNAL_ERROR_ACTION = "The ohmyhost client stopped on an unexpected error; the stderr line starting with [ohmyhost: identifies it. Compare 'ohmyhost --version' with https://ohmyho.st/client-release.json and install the published client if it is older, then run the same command again with the same --idempotency-key. If the current client fails the same way, report it with feedback submit (kind bug, error code internal_error) and quote that stderr line.";
+var CREDENTIAL_STORE_UNAVAILABLE_ACTION = "This computer's credential store (for example macOS Keychain or Windows Credential Manager) or the saved-login list in ~/.ohmyhost/profiles could not be read or written; nothing was changed. If the agent runs in a sandbox, run the command with access to them before asking the customer to sign in again. If the store is locked, ask the customer to unlock it, then run the command again. On a server, container or CI runner without a credential store, do not run login: load OHMYHOST_TOKEN from a private env file with a token from the portal's API Tokens page.";
+var RESPONSE_CONTRACT_INVALID_ACTION = "The ohmyho.st API answered in a form this client version does not accept, usually because the client is older than the service. Compare 'ohmyhost --version' with https://ohmyho.st/client-release.json; if it is older, install the published CLI and MCP and reload MCP. Then run the same command again with the same --idempotency-key: the change may already have been applied. If the current version answers this too, report it with feedback submit (kind bug, error code response_contract_invalid).";
+var REQUEST_TIMEOUT_ACTION = "The ohmyho.st API did not answer within 30 seconds. Run the same command again with the same --idempotency-key; the change may already be under way, and a new key could apply it twice.";
+var LOGOUT_UNCONFIRMED_ACTION = "The saved login was removed from this computer, but ohmyho.st did not confirm that its session ended. Running logout again cannot retry this, because the login is gone; do not sign in again just to revoke it. Tell the customer the session end was not confirmed.";
+var STATEMENT_FILE_INVALID_ACTION = "Put one INSERT, UPDATE or DELETE statement that starts with that keyword (no leading comment or WITH), UTF-8, at most 64 KiB, in the file named by --statement-file, then rerun with the same --idempotency-key.";
+var signInCommand = (commandPrefix, profile) => profile === void 0 ? `${commandPrefix} login --json` : `${commandPrefix} login${profile.organizationId === null ? "" : ` --organization ${profile.organizationId}`} --user ${profile.userId} --profile-name ${profile.name} --json`;
+var endedLoginAction = (commandPrefix, profile) => `The sign-in of ${profile === void 0 ? "this computer's saved login" : `saved login ${profile.name} (user ${profile.userId}${profile.organizationId === null ? "" : `, organization ${profile.organizationId}`})`} ended and it was removed. Run '${signInCommand(commandPrefix, profile)}' to sign it in again.`;
+var refreshFailedAction = (commandPrefix, profile) => `Renewing the saved login${profile === void 0 ? "" : ` ${profile.name}`} at the sign-in service failed. Run the same command again in a minute, with the same --idempotency-key if it has one. If it fails again, run '${signInCommand(commandPrefix, profile)}' and send the customer the link and code.`;
 var ProductCliFailure = class extends Error {
   exitCode;
   code;
@@ -19024,14 +19377,14 @@ var ProductCli = class {
       command = parseProductCliCommand(argv);
     } catch (error) {
       if (error instanceof InvalidCommandError) {
-        return failure(recognizedCommandLabel(argv), 2, "invalid_command", false, "Check 'ohmyhost --help'.");
+        return failure(recognizedCommandLabel(argv), 2, "invalid_command", false, invalidCommandAction(argv, this.dependencies.commandPrefix));
       }
       this.recordDiagnostic({
         category: "internal",
         subsystem: "parser",
         errorKind: "unexpected"
       });
-      return failure("unknown", 1, "internal_error", false, "Retry the command.");
+      return failure(recognizedCommandLabel(argv), 1, "internal_error", false, INTERNAL_ERROR_ACTION);
     }
     return this.runCommand(command, signal);
   }
@@ -19251,6 +19604,10 @@ var ProductCli = class {
       }
       if (command.kind === "project-create")
         return await this.createProject(command, signal);
+      if (command.kind === "project-data-plan")
+        return await this.planProjectData(command, signal);
+      if (command.kind === "project-data-change")
+        return await this.changeProjectData(command, signal);
       if (command.kind === "project-list")
         return await this.listProjects(command, signal);
       if (command.kind === "project-handle-check")
@@ -19299,25 +19656,15 @@ var ProductCli = class {
         return success(command.kind === "project-dev-share-link" ? "project dev-share link" : command.kind === "project-dev-share-rotate" ? "project dev-share rotate" : command.kind === "project-dev-share-revoke" ? "project dev-share revoke" : "project dev-access mode", { status: "succeeded", state });
       }
       if (command.kind === "database-write") {
-        const file = await open3(command.statementFile, "r"), buffer = Buffer.alloc(65537);
-        let statement;
+        const statement = await readStatementFile(command.statementFile);
         try {
-          const stat3 = await file.stat();
-          if (!stat3.isFile() || stat3.size > 65536)
-            throw new InvalidCommandError();
-          let length = 0;
-          while (length < buffer.length) {
-            const read = await file.read(buffer, length, buffer.length - length, null);
-            if (read.bytesRead === 0)
-              break;
-            length += read.bytesRead;
-          }
-          if (length > 65536)
-            throw new InvalidCommandError();
-          statement = new TextDecoder("utf-8", { fatal: true }).decode(buffer.subarray(0, length));
-        } finally {
-          buffer.fill(0);
-          await file.close();
+          parseProjectDatabaseWrite({
+            environment: command.environment,
+            statement,
+            parameters: []
+          });
+        } catch {
+          throw new ProductCliFailure(2, "statement_file_invalid", false, STATEMENT_FILE_INVALID_ACTION);
         }
         const body = parseProjectDatabaseWrite({
           environment: command.environment,
@@ -19544,8 +19891,13 @@ var ProductCli = class {
         expiresAt
       };
       const account = await this.dependencies.accountProfile(async () => signedIn.accessToken);
+      const loginFlags = {
+        organizationId,
+        userId: expectedUserId,
+        profileName: this.dependencies.profileName
+      };
       if (!isProfileUserId(account.userId))
-        throw this.unverifiedLogin();
+        throw this.unverifiedLogin(loginFlags);
       if (expectedUserId !== void 0 && account.userId !== expectedUserId)
         throw new ProductCliFailure(4, "login_account_mismatch", false, `The browser signed in as user ${account.userId}, not ${expectedUserId}. Nothing was saved and every saved login is unchanged. Sign out of ohmyho.st in that browser or use the browser profile of ${expectedUserId}, then run '${this.dependencies.commandPrefix} login${organizationId === void 0 ? "" : ` --organization ${organizationId}`} --user ${expectedUserId} --json' again.`);
       const selection = chooseWorkspace(account.organizations, organizationId);
@@ -19556,12 +19908,12 @@ var ProductCli = class {
       const scopedId = selection.outcome === "selected" ? selection.organization.id : parseCurrentIdentity(identity).organization_ids[0] ?? null;
       const organization = scopedId === null ? null : account.organizations.find((candidate) => candidate.id === scopedId);
       if (organization === void 0)
-        throw this.unverifiedLogin();
+        throw this.unverifiedLogin(loginFlags);
       try {
         assertVerifiedLogin(identity, account.userId, scopedId);
       } catch (error) {
         if (error instanceof AccountVerificationError)
-          throw this.unverifiedLogin();
+          throw this.unverifiedLogin(loginFlags);
         throw error;
       }
       const login = {
@@ -19605,8 +19957,8 @@ var ProductCli = class {
     }
   }
   /** The provider answered with another account than the one this login requested. */
-  unverifiedLogin() {
-    return new ProductCliFailure(4, "login_verification_failed", true, `The signed-in account could not be verified; nothing was saved. Run '${this.dependencies.commandPrefix} login --json' again.`);
+  unverifiedLogin(flags) {
+    return new ProductCliFailure(4, "login_verification_failed", true, `The signed-in account could not be verified; nothing was saved. Run '${this.dependencies.commandPrefix} login${flags.organizationId === void 0 ? "" : ` --organization ${flags.organizationId}`}${flags.userId === void 0 ? "" : ` --user ${flags.userId}`}${flags.profileName === void 0 ? "" : ` --profile-name ${flags.profileName}`} --json' again with the same flags and send the customer the new link and code.`);
   }
   /**
    * Bind the login of this run, which has no organization yet, to one of its user's organizations.
@@ -19627,7 +19979,11 @@ var ProductCli = class {
       }, organization, bounded2, (accessToken) => this.dependencies.productApi(async () => accessToken).getCurrentIdentity()), signal, this.dependencies.lifecycleTimeoutMs);
     } catch (error) {
       if (error instanceof AccountVerificationError)
-        throw this.unverifiedLogin();
+        throw this.unverifiedLogin({
+          organizationId: organization.id,
+          userId: profile.userId,
+          profileName: profile.name
+        });
       if (!(error instanceof ProfileOrganizationFixedError))
         throw error;
       throw new ProductCliFailure(2, "profile_organization_fixed", false, `Profile ${profile.name} stays signed in to organization ${String(profile.organizationId)}. Run '${this.dependencies.commandPrefix} login --organization ${organization.id} --user ${profile.userId} --json' to add a separate login for ${organization.id} as the same user; a saved login never switches organizations.`);
@@ -19663,10 +20019,10 @@ var ProductCli = class {
         throw new ProductCliFailure(9, "blocked_prerequisite", false, "Remote token revocation is not available in this release.");
       }
       if (isTimeout(revocationError)) {
-        throw new ProductCliFailure(8, "request_timeout", true, "Remote revocation timed out; local credentials were removed.");
+        throw new ProductCliFailure(8, "request_timeout", false, LOGOUT_UNCONFIRMED_ACTION);
       }
       if (revocationError instanceof LifecycleTransportError) {
-        throw new ProductCliFailure(6, "token_revocation_failed", true, "Remote revocation failed; the local credential was removed.");
+        throw new ProductCliFailure(6, "token_revocation_failed", false, LOGOUT_UNCONFIRMED_ACTION);
       }
       throw revocationError;
     }
@@ -19707,6 +20063,29 @@ var ProductCli = class {
     }));
     return success("operation reconcile", { status: "accepted", reconciliation });
   }
+  async planProjectData(command, signal) {
+    const api = await this.authenticatedApi(command.credentialStore, signal);
+    return success("project data plan", {
+      status: "planned",
+      plan: parseProjectDataChangePlan2(await api.planProjectDataChange({ projectId: command.projectId, change: command.change }))
+    });
+  }
+  async changeProjectData(command, signal) {
+    const api = await this.authenticatedApi(command.credentialStore, signal);
+    let operation = parseOperation(await api.createProjectDataChange({
+      projectId: command.projectId,
+      change: command.change,
+      ifMatch: command.ifMatch,
+      confirmationToken: command.confirmationToken,
+      idempotencyKey: command.idempotencyKey
+    }));
+    if (command.wait)
+      operation = await this.waitForOperation(api, operation, signal);
+    return success("project data change", {
+      status: command.wait ? "completed" : "accepted",
+      operation
+    });
+  }
   async createProject(command, signal) {
     const api = await this.authenticatedApi(command.credentialStore, signal);
     const operation = parseOperation(await api.createProject({
@@ -19960,11 +20339,20 @@ var ProductCli = class {
       commitSha: command.commitSha,
       environment: command.environment
     }));
-    let operation = parseOperation(await api.createDeployment({
-      projectId: command.projectId,
-      planId: plan === null ? String(command.planId) : String(plan["id"]),
-      idempotencyKey: command.idempotencyKey
-    }));
+    let accepted;
+    try {
+      accepted = await api.createDeployment({
+        projectId: command.projectId,
+        planId: plan === null ? String(command.planId) : String(plan["id"]),
+        idempotencyKey: command.idempotencyKey
+      });
+    } catch (error) {
+      const reused = plan === null ? void 0 : reusedKeyProblem(error);
+      if (reused === void 0)
+        throw error;
+      return failure("deploy", 7, reused.code, false, `This key already started a deployment from an earlier run of this command; a new key would build the same commit again. Run 'ohmyhost project status --project ${command.projectId} --json' and follow latest_operation with 'ohmyhost operation get OPERATION_ULID --json'.`, void 0, void 0, reused.requestId, reused.docsUrl, void 0, reused.message);
+    }
+    let operation = parseOperation(accepted);
     if (command.wait)
       operation = await this.waitForOperation(api, operation, signal);
     const notes = operation.state === "succeeded" ? [
@@ -19979,27 +20367,40 @@ var ProductCli = class {
   }
   async logs(command, signal) {
     const api = await this.authenticatedApi(command.credentialStore, signal);
+    let operation = parseOperation(await api.getOperation(command.operationId));
     let eventCount = 0;
-    for await (const event of await api.streamOperationEvents(command.operationId, signal)) {
-      const parsed = parseOperationEvent(event);
-      this.dependencies.operationEventSink?.write(`${JSON.stringify(parsed)}
+    let lastEventId;
+    for (let connection = 0; connection < OPERATION_STREAM_CONNECTIONS; connection += 1) {
+      if (connection > 0)
+        await this.dependencies.waitUntil(new Date(this.dependencies.now().getTime() + 1e3), signal);
+      const events = lastEventId === void 0 ? await api.streamOperationEvents(command.operationId, signal) : await api.streamOperationEvents(command.operationId, signal, lastEventId);
+      for await (const event of events) {
+        const parsed = parseOperationEvent(event);
+        this.dependencies.operationEventSink?.write(`${JSON.stringify(parsed)}
 `);
-      eventCount += 1;
-      if (parsed["type"] === "OperationSucceeded" || parsed["type"] === "OperationFailed" || parsed["type"] === "OperationCancelled") {
-        break;
+        eventCount += 1;
+        lastEventId = String(parsed["event_id"]);
+        if (parsed["type"] === "OperationSucceeded" || parsed["type"] === "OperationFailed" || parsed["type"] === "OperationCancelled")
+          return success("logs", { status: "completed", event_count: eventCount });
       }
+      throwIfAborted(signal);
+      operation = parseOperation(await api.getOperation(command.operationId));
+      if (operation.state !== "queued" && operation.state !== "running")
+        return success("logs", { status: "completed", event_count: eventCount, operation });
     }
-    return success("logs", { status: "completed", event_count: eventCount });
+    throw new ProductCliFailure(8, "operation_stream_ended", true, `The event stream ended before operation ${command.operationId} finished, and it is still running; nothing was cancelled. Poll 'ohmyhost operation get ${command.operationId} --json' about every 60 seconds until it is succeeded, failed or cancelled.`, operation);
   }
   async deploymentLogs(command, signal) {
     const api = await this.authenticatedApi(command.credentialStore, signal);
-    let count = 0;
-    for await (const event of await api.streamDeploymentLogs({ projectId: command.projectId, deploymentId: command.deploymentId }, signal)) {
-      this.dependencies.operationEventSink?.write(`${JSON.stringify(event)}
+    const page = await api.getDeploymentLogs({
+      projectId: command.projectId,
+      deploymentId: command.deploymentId,
+      limit: 100
+    });
+    for (const item of page.items)
+      this.dependencies.operationEventSink?.write(`${JSON.stringify(item)}
 `);
-      count += 1;
-    }
-    return success("deployment logs", { status: "completed", event_count: count });
+    return success("deployment logs", { status: "completed", event_count: page.items.length });
   }
   async planRollback(command, signal) {
     const api = await this.authenticatedApi(command.credentialStore, signal);
@@ -20077,7 +20478,7 @@ var ProductCli = class {
       }));
       const completed = command.wait ? await this.waitForSecretDelivery(api, command.projectId, command.environmentId, secret, signal) : secret;
       return success("secret set", {
-        status: command.wait ? "ready" : "stored",
+        status: command.wait && completed.delivery_state === "ready" ? "ready" : "stored",
         secret: completed
       });
     } finally {
@@ -20094,7 +20495,7 @@ var ProductCli = class {
     }));
     const delivery = command.wait ? await this.waitForSecretDelivery(api, command.projectId, command.environmentId, { desired_generation: deleted.desired_generation }, signal) : deleted;
     return success("secret delete", {
-      status: command.wait ? "ready" : deleted.status,
+      status: command.wait && delivery.delivery_state === "ready" ? "ready" : deleted.status,
       secret: { name: deleted.name, ...secretDeliveryProjection(delivery) }
     });
   }
@@ -20103,9 +20504,9 @@ var ProductCli = class {
     for (let attempt = 0; attempt < 120; attempt += 1) {
       const page = parseEnvironmentSecretPage(await api.listEnvironmentSecrets({ projectId, environmentId }));
       if (page.last_error !== null || page.delivery_state === "failed") {
-        throw new ProductCliFailure(10, "secret_delivery_failed", true, "Inspect secret metadata and deployment logs, then retry reconciliation.");
+        throw new ProductCliFailure(10, "secret_delivery_failed", true, `The secret is saved, but delivering it to the running app failed (last_error in 'ohmyhost secret list --project ${projectId} --environment ${environmentId} --json'). Do not set the value again: ohmyho.st retries delivery automatically, and the next deployment of this environment also delivers it. Read secret list again in a few minutes; if delivery_state stays failed, report last_error with feedback submit (kind bug, error code secret_delivery_failed).`);
       }
-      if (page.delivery_state === "ready" && page.desired_generation >= desiredGeneration && page.applied_generation >= desiredGeneration) {
+      if (page.delivery_state === "not_deployed" || page.delivery_state === "ready" && page.desired_generation >= desiredGeneration && page.applied_generation >= desiredGeneration) {
         if (!("name" in stored))
           return page;
         return page.items.find((secret) => secret.name === stored.name) ?? {
@@ -20117,7 +20518,7 @@ var ProductCli = class {
       }
       await this.dependencies.waitUntil(new Date(this.dependencies.now().getTime() + 1e3), signal);
     }
-    throw new ProductCliFailure(8, "secret_delivery_wait_timeout", true, "Run 'ohmyhost secret list --json' to inspect delivery metadata.");
+    throw new ProductCliFailure(8, "secret_delivery_wait_timeout", true, `The secret is saved, but it had not reached the running app after about 2 minutes. Read 'ohmyhost secret list --project ${projectId} --environment ${environmentId} --json': pending means delivery is still under way, and not_deployed means it arrives with the first deployment. Do not set the value again.`);
   }
   async waitForOperation(api, initial, signal) {
     let operation = initial;
@@ -20128,7 +20529,7 @@ var ProductCli = class {
     if (operation.reconciliation?.state === "required")
       throw new ProductCliFailure(10, "operation_reconciliation_required", false, `${operation.reconciliation.suggested_action} Inspect 'ohmyhost operation get ${operation.id} --json' and use 'ohmyhost operation reconcile' after confirmation.`, operation);
     if (operation.state === "queued" || operation.state === "running")
-      throw new ProductCliFailure(8, "operation_wait_timeout", true, `Run 'ohmyhost operation get ${operation.id} --json' to inspect the existing operation before resubmitting a mutation.`, operation);
+      throw new ProductCliFailure(8, "operation_wait_timeout", true, `The operation is still running; this command stopped waiting after about 2 minutes and cancelled nothing. Poll 'ohmyhost operation get ${operation.id} --json' about every 60 seconds until it is succeeded, failed or cancelled. Do not submit the same change again; a new key starts a second operation.`, operation);
     if (operation.state === "failed" && operation.error !== void 0)
       throw new ProductCliFailure(10, operation.error.code, operation.error.retryable, operation.error.suggested_action, operation);
     if (operation.state === "cancelled")
@@ -20153,8 +20554,9 @@ var ProductCli = class {
     } catch (error) {
       if (!(error instanceof TokenRefreshRejectedError))
         throw error;
+      const ended = this.#profile;
       await this.forgetLogin(store);
-      throw new ProductCliFailure(5, "authentication_required", false, this.loginAction());
+      throw new ProductCliFailure(5, "authentication_required", false, endedLoginAction(this.dependencies.commandPrefix, ended));
     }
     if (refresh.refreshed)
       await store.replace(refresh.credential);
@@ -20187,10 +20589,10 @@ var ProductCli = class {
         throw new ProductCliFailure(9, "blocked_prerequisite", false, "Token refresh is not available in this release; run 'ohmyhost login'.");
       }
       if (isTimeout(error)) {
-        throw new ProductCliFailure(8, "request_timeout", true, "Retry the command.");
+        throw new ProductCliFailure(8, "request_timeout", true, REQUEST_TIMEOUT_ACTION);
       }
       if (error instanceof LifecycleTransportError) {
-        throw new ProductCliFailure(5, "token_refresh_failed", true, "Run 'ohmyhost login' if retrying does not succeed.");
+        throw new ProductCliFailure(5, "token_refresh_failed", true, refreshFailedAction(this.dependencies.commandPrefix, this.#profile));
       }
       throw error;
     }
@@ -20231,31 +20633,31 @@ var ACCOUNT_SENSITIVE_PROBLEMS = /* @__PURE__ */ new Set([
 var classifyCliFailure = (command, error, signal) => classifyFailure(command, error, signal);
 var classifyFailure = (command, error, signal, actingAs) => {
   if (signal.aborted || isCancellation(error)) {
-    return failure(command, 130, "command_cancelled", true, "Run the command again.");
+    return failure(command, 130, "command_cancelled", true, "The command was stopped by an interrupt or termination signal, for example the shell's command timeout, before it finished. Run it again with the same --idempotency-key; a change may already be under way. Give login and commands with --wait or --follow several minutes, or run them in the background.");
   }
   if (isTimeout(error)) {
-    return failure(command, 8, "request_timeout", true, "Retry the command.");
+    return failure(command, 8, "request_timeout", true, REQUEST_TIMEOUT_ACTION);
   }
   if (error instanceof ProductCliFailure) {
     return failure(command, error.exitCode, error.code, error.retryable, error.suggestedAction, error.operation);
   }
   if (error instanceof SecretInputError) {
-    return failure(command, 2, "secret_input_invalid", false, "Pipe a non-empty UTF-8 value of at most 5120 bytes through standard input.");
+    return failure(command, 2, "secret_input_invalid", false, command === "export create" ? "Pipe the ZIP password through standard input: non-blank UTF-8 of at most 1024 bytes. A final line break becomes part of the password." : "Pipe a non-empty UTF-8 value of at most 5120 bytes through standard input.");
   }
   if (error instanceof WorkosContractError) {
     if (error.code === "access_denied") {
-      return failure(command, 4, "device_authorization_denied", false, "Run login again.");
+      return failure(command, 4, "device_authorization_denied", false, "The customer declined the sign-in in the browser; nothing was saved. Ask the customer whether to sign in, then run the same login command again and send them the new link and code.");
     }
     if (error.code === "expired_token") {
-      return failure(command, 4, "device_authorization_expired", false, "Run login again.");
+      return failure(command, 4, "device_authorization_expired", false, "Nobody finished the sign-in within 30 minutes; nothing was saved. Run the same login command again and send the customer the new link and code at once.");
     }
-    return failure(command, 4, "device_authorization_failed", true, "Run login again.");
+    return failure(command, 4, "device_authorization_failed", true, "The sign-in service answered unexpectedly; nothing was saved. Run the same login command again; if it fails twice more, ask the customer to try again later.");
   }
   if (error instanceof CredentialStoreUnavailableError) {
-    return failure(command, 3, "credential_store_unavailable", true, "Unlock or repair the selected credential store and retry.");
+    return failure(command, 3, "credential_store_unavailable", false, CREDENTIAL_STORE_UNAVAILABLE_ACTION);
   }
   if (error instanceof ResponseContractError) {
-    return failure(command, 7, "response_contract_invalid", false, "Retry only after the client or server contract is repaired.");
+    return failure(command, 7, "response_contract_invalid", false, RESPONSE_CONTRACT_INVALID_ACTION);
   }
   if (error instanceof PublicResponseTooLargeError) {
     return failure(command, 7, "response_too_large", false, "Retry only after the remote response is repaired.");
@@ -20263,18 +20665,61 @@ var classifyFailure = (command, error, signal, actingAs) => {
   if (looksLikeProblem(error)) {
     try {
       const problem = parseSafeProblem(error);
-      return failure(command, 7, problem.code, problem.retryable, problem.suggestedAction, void 0, problem.retryAfterSeconds, problem.requestId, problem.docsUrl, ACCOUNT_SENSITIVE_PROBLEMS.has(problem.code) ? actingAs : void 0);
+      return failure(command, 7, problem.code, problem.retryable, problem.suggestedAction, void 0, problem.retryAfterSeconds, problem.requestId, problem.docsUrl, ACCOUNT_SENSITIVE_PROBLEMS.has(problem.code) ? actingAs : void 0, problem.message);
     } catch {
-      return failure(command, 7, "response_contract_invalid", false, "Retry only after the client or server contract is repaired.");
+      return failure(command, 7, "response_contract_invalid", false, RESPONSE_CONTRACT_INVALID_ACTION);
     }
   }
   if (looksLikeRemoteObject(error)) {
-    return failure(command, 7, "response_contract_invalid", false, "Retry only after the client or server contract is repaired.");
+    return failure(command, 7, "response_contract_invalid", false, RESPONSE_CONTRACT_INVALID_ACTION);
   }
   if (error instanceof NetworkTransportError) {
-    return failure(command, 8, "network_error", true, "Check connectivity and retry.");
+    return failure(command, 8, "network_error", true, "The request did not reach the ohmyho.st API, or its answer was cut off. If the agent runs in a sandbox without network access, run the command with network access. Otherwise run the same command again with the same --idempotency-key; the change may already have been applied, and a new key could apply it twice.");
+  }
+  return failure(command, 1, "internal_error", false, INTERNAL_ERROR_ACTION);
+};
+var reusedKeyProblem = (error) => {
+  if (!looksLikeProblem(error))
+    return void 0;
+  try {
+    const problem = parseSafeProblem(error);
+    return problem.code === "idempotency_key_reused" ? problem : void 0;
+  } catch {
+    return void 0;
+  }
+};
+var OPERATION_STREAM_CONNECTIONS = 4;
+var readStatementFile = async (path) => {
+  const invalid5 = () => new ProductCliFailure(2, "statement_file_invalid", false, STATEMENT_FILE_INVALID_ACTION);
+  let file;
+  try {
+    file = await open3(path, "r");
+  } catch {
+    throw invalid5();
+  }
+  const buffer = Buffer.alloc(65537);
+  try {
+    const stat3 = await file.stat();
+    if (!stat3.isFile() || stat3.size > 65536)
+      throw invalid5();
+    let length = 0;
+    while (length < buffer.length) {
+      const read = await file.read(buffer, length, buffer.length - length, null);
+      if (read.bytesRead === 0)
+        break;
+      length += read.bytesRead;
+    }
+    if (length > 65536)
+      throw invalid5();
+    return new TextDecoder("utf-8", { fatal: true }).decode(buffer.subarray(0, length));
+  } catch (error) {
+    if (error instanceof ProductCliFailure)
+      throw error;
+    throw invalid5();
+  } finally {
+    buffer.fill(0);
+    await file.close();
   }
-  return failure(command, 1, "internal_error", false, "Retry the command.");
 };
 var psqlUnavailable = () => failure("database psql", 9, "psql_unavailable", false, "Install the PostgreSQL client (psql) and make it available on PATH, or run 'ohmyhost database access create' and connect with your own SQL client.");
 var success = (command, body) => ({
@@ -20283,7 +20728,7 @@ var success = (command, body) => ({
 `,
   stderr: ""
 });
-var failure = (command, exitCode, code, retryable, suggestedAction, operation, retryAfterSeconds, requestId, docsUrl, actingAs) => {
+var failure = (command, exitCode, code, retryable, suggestedAction, operation, retryAfterSeconds, requestId, docsUrl, actingAs, message) => {
   const document = {
     version: 1,
     command,
@@ -20297,6 +20742,7 @@ var failure = (command, exitCode, code, retryable, suggestedAction, operation, r
       ...requestId === void 0 ? {} : { request_id: requestId },
       ...docsUrl === void 0 ? {} : { docs_url: docsUrl },
       ...operation?.error === void 0 ? {} : { message: operation.error.message },
+      ...message === void 0 ? {} : { message },
       ...actingAs === void 0 ? {} : { acting_as: actingAs }
     }
   };
@@ -20346,6 +20792,10 @@ var parsedCommandName = (command) => {
     return "feedback status";
   if (command.kind === "project-create")
     return "project create";
+  if (command.kind === "project-data-plan")
+    return "project data plan";
+  if (command.kind === "project-data-change")
+    return "project data change";
   if (command.kind === "organization-create")
     return "organization create";
   if (command.kind === "organization-list")
@@ -22459,24 +22909,6 @@ var getDeploymentLogs = (parameters, options) => {
     ...params
   });
 };
-var streamDeploymentLogs = (parameters, options) => {
-  const params = buildClientParams([parameters], [
-    {
-      args: [
-        { in: "headers", key: "X-Request-Id" },
-        { in: "path", key: "project_id" },
-        { in: "path", key: "deployment_id" }
-      ]
-    }
-  ]);
-  return (options?.client ?? client).sse.get({
-    responseStyle: "data",
-    security: [{ scheme: "bearer", type: "http" }],
-    url: "/v1/projects/{project_id}/deployments/{deployment_id}/logs/events",
-    ...options,
-    ...params
-  });
-};
 var getDatabaseCompute = (parameters, options) => {
   const params = buildClientParams([parameters], [
     {
@@ -23023,6 +23455,55 @@ var retryManagedMailMessage = (parameters, options) => {
     ...params
   });
 };
+var planProjectDataChange = (parameters, options) => {
+  const params = buildClientParams([parameters], [
+    {
+      args: [
+        { in: "headers", key: "X-Request-Id" },
+        { in: "path", key: "project_id" },
+        { key: "projectDataChangeRequest", map: "body" }
+      ]
+    }
+  ]);
+  return (options?.client ?? client).post({
+    responseStyle: "data",
+    security: [{ scheme: "bearer", type: "http" }],
+    url: "/v1/projects/{project_id}/data-changes:plan",
+    ...options,
+    ...params,
+    headers: {
+      "Content-Type": "application/json",
+      ...options?.headers,
+      ...params.headers
+    }
+  });
+};
+var createProjectDataChange = (parameters, options) => {
+  const params = buildClientParams([parameters], [
+    {
+      args: [
+        { in: "headers", key: "X-Request-Id" },
+        { in: "headers", key: "Idempotency-Key" },
+        { in: "headers", key: "If-Match" },
+        { in: "headers", key: "X-Confirmation-Token" },
+        { in: "path", key: "project_id" },
+        { key: "projectDataChangeRequest", map: "body" }
+      ]
+    }
+  ]);
+  return (options?.client ?? client).post({
+    responseStyle: "data",
+    security: [{ scheme: "bearer", type: "http" }],
+    url: "/v1/projects/{project_id}/data-changes",
+    ...options,
+    ...params,
+    headers: {
+      "Content-Type": "application/json",
+      ...options?.headers,
+      ...params.headers
+    }
+  });
+};
 
 // packages/sdk-ts/dist/managed-mail-response.js
 var ULID = /^[0-7][0-9A-HJKMNP-TV-Z]{25}$/u;
@@ -23045,30 +23526,30 @@ function assertManagedMailResponse(value, input) {
     id2(r["domain_id"]);
     domain(r["domain"]);
     if (r["environment_id"] !== input.environmentId)
-      invalid3();
+      invalid4();
     for (const key of ["sending", "receiving"])
       if (!["disabled", "pending", "ready", "failed"].includes(String(r[key])))
-        invalid3();
+        invalid4();
     if (!["ready", "verification_pending"].includes(String(r["status"])))
-      invalid3();
+      invalid4();
     time(r["configured_at"]);
     if (r["observed_at"] !== null)
       time(r["observed_at"]);
     records(r["dns_records"]);
     if (r["next_check_after_seconds"] !== null && r["next_check_after_seconds"] !== 60)
-      invalid3();
+      invalid4();
     if (r["webhook"] !== null) {
       const hook = object2(r["webhook"]);
       exact3(hook, ["url", "verified"]);
       https(hook["url"]);
       if (typeof hook["verified"] !== "boolean")
-        invalid3();
+        invalid4();
     }
     if (r["dns"] !== void 0) {
       const dns = object2(r["dns"]);
       exact3(dns, ["status", "records"]);
       if (!["configured", "action_required", "conflict"].includes(String(dns["status"])))
-        invalid3();
+        invalid4();
       records(dns["records"]);
     }
     return;
@@ -23076,19 +23557,19 @@ function assertManagedMailResponse(value, input) {
   if (input.action === "webhook_set") {
     exact3(r, ["url", "signing_secret", "status"]);
     if (r["url"] !== input.url || r["status"] !== "verification_required" || typeof r["signing_secret"] !== "string" || !/^whsec_[A-Za-z0-9+/]{43}=$/u.test(r["signing_secret"]))
-      invalid3();
+      invalid4();
     return;
   }
   if (input.action === "webhook_disable") {
     exact3(r, ["status"]);
     if (r["status"] !== "disabled")
-      invalid3();
+      invalid4();
     return;
   }
   if (input.action === "domain_delete") {
     exact3(r, ["status", "domain", "dns_records"]);
     if (r["status"] !== "deleted")
-      invalid3();
+      invalid4();
     domain(r["domain"]);
     records(r["dns_records"]);
     return;
@@ -23096,25 +23577,25 @@ function assertManagedMailResponse(value, input) {
   if (input.action === "messages_list") {
     exact3(r, ["items"]);
     if (!Array.isArray(r["items"]) || r["items"].length > 50)
-      invalid3();
+      invalid4();
     for (const value2 of r["items"]) {
       const item = object2(value2);
       exact3(item, ["message_id", "received_at", "state", "attempts"]);
       id2(item["message_id"]);
       time(item["received_at"]);
       if (!["pending", "delivering", "delivered", "delivery_failed", "expired"].includes(String(item["state"])) || !Number.isInteger(item["attempts"]) || Number(item["attempts"]) < 0 || Number(item["attempts"]) > 4)
-        invalid3();
+        invalid4();
     }
     return;
   }
   if (input.action === "message_retry") {
     exact3(r, ["attempted"], ["delivered"]);
     if (typeof r["attempted"] !== "boolean" || r["delivered"] !== void 0 && typeof r["delivered"] !== "boolean")
-      invalid3();
+      invalid4();
     return;
   }
   if (input.action !== "message_get")
-    invalid3();
+    invalid4();
   if (r["status"] === "expired") {
     exact3(r, ["status"]);
     return;
@@ -23133,65 +23614,65 @@ function assertManagedMailResponse(value, input) {
     "attachments"
   ]);
   if (r["id"] !== input.messageId)
-    invalid3();
+    invalid4();
   domain(r["domain"]);
   time(r["received_at"]);
   time(r["expires_at"]);
   if (Date.parse(String(r["expires_at"])) - Date.parse(String(r["received_at"])) !== 72 * 36e5)
-    invalid3();
+    invalid4();
   for (const key of ["from", "subject", "message_id"])
     if (typeof r[key] !== "string")
-      invalid3();
+      invalid4();
   for (const key of ["text", "html"])
     if (r[key] !== null && typeof r[key] !== "string")
-      invalid3();
+      invalid4();
   if (!Array.isArray(r["to"]) || r["to"].some((v) => typeof v !== "string" || v.slice(v.lastIndexOf("@") + 1).toLowerCase() !== r["domain"]))
-    invalid3();
+    invalid4();
   if (!Array.isArray(r["attachments"]))
-    invalid3();
+    invalid4();
   for (const value2 of r["attachments"]) {
     const a = object2(value2);
     exact3(a, ["id", "filename", "content_type", "download_path"]);
     if (typeof a["id"] !== "string" || !/^[A-Za-z0-9_-]{1,128}$/u.test(a["id"]) || a["filename"] !== null && typeof a["filename"] !== "string" || typeof a["content_type"] !== "string" || a["download_path"] !== `/v1/projects/${input.projectId}/environments/${input.environmentId}/mail/messages/${input.messageId}/attachments/${a["id"]}`)
-      invalid3();
+      invalid4();
   }
 }
 function object2(v) {
   if (typeof v !== "object" || v === null || Array.isArray(v))
-    invalid3();
+    invalid4();
   return v;
 }
 function exact3(v, required, optional = []) {
   if (required.some((k) => !(k in v)) || Object.keys(v).some((k) => !required.includes(k) && !optional.includes(k)))
-    invalid3();
+    invalid4();
 }
 function id2(v) {
   if (typeof v !== "string" || !ULID.test(v))
-    invalid3();
+    invalid4();
 }
 function domain(v) {
   if (typeof v !== "string" || !/^(?=.{1,253}$)(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\.)+[a-z]{2,63}$/u.test(v))
-    invalid3();
+    invalid4();
 }
 function time(v) {
   if (typeof v !== "string" || !Number.isFinite(Date.parse(v)) || new Date(v).toISOString() !== v)
-    invalid3();
+    invalid4();
 }
 function https(v) {
   if (typeof v !== "string" || !v.startsWith("https://"))
-    invalid3();
+    invalid4();
 }
 function records(v) {
   if (!Array.isArray(v))
-    invalid3();
+    invalid4();
   for (const value of v) {
     const r = object2(value);
     exact3(r, ["type", "name", "value", "purpose", "status"], ["priority"]);
     if (!["TXT", "CNAME", "MX"].includes(String(r["type"])) || ["name", "value", "purpose", "status"].some((k) => typeof r[k] !== "string") || r["type"] === "MX" && (!Number.isInteger(r["priority"]) || Number(r["priority"]) < 0 || Number(r["priority"]) > 65535))
-      invalid3();
+      invalid4();
   }
 }
-function invalid3() {
+function invalid4() {
   throw new TypeError("Mail response contract invalid");
 }
 
@@ -23489,6 +23970,18 @@ var GeneratedSdkProductApi = class {
   async getFeedback(feedbackId, cursor) {
     return parseFeedbackStatus(await getFeedback({ feedback_id: feedbackId, ...cursor === void 0 ? {} : { cursor } }, { client: this.#client }));
   }
+  async planProjectDataChange(input) {
+    return parseProjectDataChangePlan2(await planProjectDataChange({ project_id: input.projectId, projectDataChangeRequest: { change: input.change } }, { client: this.#client }));
+  }
+  async createProjectDataChange(input) {
+    return parseOperation(await createProjectDataChange({
+      project_id: input.projectId,
+      projectDataChangeRequest: { change: input.change },
+      "If-Match": input.ifMatch,
+      "X-Confirmation-Token": input.confirmationToken,
+      "Idempotency-Key": input.idempotencyKey
+    }, { client: this.#client }));
+  }
   async createProject(input) {
     return createProject({
       "Idempotency-Key": input.idempotencyKey,
@@ -23569,8 +24062,17 @@ var GeneratedSdkProductApi = class {
   async getDeployment(input) {
     return getDeployment({ project_id: input.projectId, deployment_id: input.deploymentId }, { client: this.#client });
   }
-  async streamOperationEvents(operationId, signal) {
-    return (await streamOperationEvents({ operation_id: operationId }, { client: this.#client, signal, headers: { Accept: "text/event-stream" } })).stream;
+  async streamOperationEvents(operationId, signal, lastEventId) {
+    return (await streamOperationEvents({ operation_id: operationId }, {
+      client: this.#client,
+      signal,
+      // The generated client would otherwise retry a refused stream, such as a 404, forever.
+      sseMaxRetryAttempts: 1,
+      headers: {
+        Accept: "text/event-stream",
+        ...lastEventId === void 0 ? {} : { "Last-Event-ID": lastEventId }
+      }
+    })).stream;
   }
   async getDeploymentLogs(input) {
     return getDeploymentLogs({
@@ -23580,9 +24082,6 @@ var GeneratedSdkProductApi = class {
       ...input.cursor === void 0 ? {} : { cursor: input.cursor }
     }, { client: this.#client });
   }
-  async streamDeploymentLogs(input, signal) {
-    return (await streamDeploymentLogs({ project_id: input.projectId, deployment_id: input.deploymentId }, { client: this.#client, signal, headers: { Accept: "text/event-stream" } })).stream;
-  }
   async planRollback(input) {
     return planDeploymentRollback({ project_id: input.projectId, target_deployment_id: input.deploymentId }, { client: this.#client });
   }
@@ -23951,6 +24450,9 @@ var ohmyhost_schema_default = {
           maxLength: 256,
           pattern: "^/"
         },
+        browser: {
+          $ref: "#/$defs/browser"
+        },
         egress: {
           type: "object",
           additionalProperties: false,
@@ -23958,7 +24460,7 @@ var ohmyhost_schema_default = {
           properties: {
             allow: {
               type: "array",
-              maxItems: 16,
+              maxItems: 13,
               uniqueItems: true,
               items: {
                 type: "string",
@@ -23971,6 +24473,56 @@ var ohmyhost_schema_default = {
         }
       }
     },
+    browserOrigins: {
+      type: "array",
+      maxItems: 16,
+      uniqueItems: true,
+      items: {
+        type: "string",
+        minLength: 1,
+        maxLength: 256,
+        pattern: "^https://"
+      }
+    },
+    browser: {
+      type: "object",
+      additionalProperties: false,
+      properties: {
+        connect: {
+          type: "array",
+          maxItems: 16,
+          uniqueItems: true,
+          items: {
+            type: "string",
+            minLength: 1,
+            maxLength: 256,
+            pattern: "^(?:https|wss)://"
+          }
+        },
+        scripts: { $ref: "#/$defs/browserOrigins" },
+        styles: { $ref: "#/$defs/browserOrigins" },
+        images: { $ref: "#/$defs/browserOrigins" },
+        fonts: { $ref: "#/$defs/browserOrigins" },
+        frames: { $ref: "#/$defs/browserOrigins" },
+        frameAncestors: { $ref: "#/$defs/browserOrigins" },
+        workers: {
+          type: "object",
+          additionalProperties: false,
+          properties: {
+            self: { type: "boolean" },
+            blob: { type: "boolean" }
+          }
+        },
+        cors: {
+          type: "object",
+          additionalProperties: false,
+          properties: {
+            origins: { $ref: "#/$defs/browserOrigins" },
+            credentials: { type: "boolean" }
+          }
+        }
+      }
+    },
     database: {
       type: "object",
       additionalProperties: false,
@@ -24228,6 +24780,74 @@ function validCronField(value, minimum, maximum) {
   return parsed >= minimum && parsed <= maximum;
 }
 
+// packages/contracts/dist/browser-capabilities.js
+var RESOURCE_GROUPS = [
+  "connect",
+  "scripts",
+  "styles",
+  "images",
+  "fonts",
+  "frames",
+  "frameAncestors"
+];
+var POLICY_KEYS = [...RESOURCE_GROUPS, "workers", "cors"];
+var MAX_ORIGINS = 16;
+function normalizeBrowserPolicy(value) {
+  const input = value === void 0 ? {} : policyRecord(value, POLICY_KEYS);
+  const workers = input["workers"] === void 0 ? {} : policyRecord(input["workers"], ["self", "blob"]);
+  const cors = input["cors"] === void 0 ? {} : policyRecord(input["cors"], ["origins", "credentials"]);
+  const resources = Object.fromEntries(RESOURCE_GROUPS.map((group) => [group, normalizeOrigins(input[group], group === "connect")]));
+  return Object.freeze({
+    ...resources,
+    workers: Object.freeze({
+      self: normalizeBoolean(workers["self"]),
+      blob: normalizeBoolean(workers["blob"])
+    }),
+    cors: Object.freeze({
+      origins: normalizeOrigins(cors["origins"], false),
+      credentials: normalizeBoolean(cors["credentials"])
+    })
+  });
+}
+function policyRecord(value, keys, complete = false) {
+  if (typeof value !== "object" || value === null || Array.isArray(value) || ![Object.prototype, null].includes(Object.getPrototypeOf(value)) || Object.keys(value).some((key) => !keys.includes(key)) || complete && Object.keys(value).length !== keys.length)
+    throw invalidPolicy();
+  return value;
+}
+function normalizeBoolean(value) {
+  if (value === void 0)
+    return false;
+  if (typeof value !== "boolean")
+    throw invalidPolicy();
+  return value;
+}
+function normalizeOrigins(value, allowWebSocket) {
+  if (value === void 0)
+    return Object.freeze([]);
+  if (!Array.isArray(value) || value.length > MAX_ORIGINS)
+    throw invalidPolicy();
+  const origins = [];
+  for (const origin of value) {
+    if (!browserOrigin(origin, allowWebSocket) || origins.includes(origin))
+      throw invalidPolicy();
+    origins.push(origin);
+  }
+  return Object.freeze(origins.sort());
+}
+function browserOrigin(value, allowWebSocket) {
+  if (typeof value !== "string" || value.length > 256)
+    return false;
+  try {
+    const url = new URL(value);
+    return (url.protocol === "https:" || allowWebSocket && url.protocol === "wss:") && url.origin === value && url.username === "" && url.password === "" && url.pathname === "/" && url.search === "" && url.hash === "" && url.hostname.includes(".") && !url.hostname.endsWith(".local") && !url.hostname.endsWith(".internal") && !/^\d+(?:\.\d+){3}$/u.test(url.hostname) && url.hostname.split(".").every((label) => /^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/u.test(label));
+  } catch {
+    return false;
+  }
+}
+function invalidPolicy() {
+  return new TypeError("Invalid browser capability policy");
+}
+
 // packages/contracts/dist/index.js
 var validateOhmyhostConfig = new import__.Ajv2020({
   allErrors: true,
@@ -24252,7 +24872,8 @@ function parseOhmyhostConfig(value) {
       healthcheck: normalizeHealthcheck(input.runtime.healthcheck),
       egress: Object.freeze({
         allow: normalizeEgressOrigins(input.runtime.egress?.allow)
-      })
+      }),
+      ...input.runtime.browser === void 0 ? {} : { browser: normalizeBrowserPolicy(input.runtime.browser) }
     }),
     ...input.database === void 0 ? {} : {
       database: Object.freeze({
@@ -24306,7 +24927,7 @@ function normalizeEgressOrigins(value) {
     } catch {
       throw new TypeError("ohmyhost.yaml runtime egress origin is invalid");
     }
-    if (parsed.protocol !== "https:" || parsed.username !== "" || parsed.password !== "" || parsed.origin !== origin || parsed.pathname !== "/" || parsed.search !== "" || parsed.hash !== "" || forbiddenEgressHostname(parsed.hostname)) {
+    if (parsed.protocol !== "https:" || parsed.port !== "" || parsed.username !== "" || parsed.password !== "" || parsed.origin !== origin || parsed.pathname !== "/" || parsed.search !== "" || parsed.hash !== "" || forbiddenEgressHostname(parsed.hostname)) {
       throw new TypeError("ohmyhost.yaml runtime egress origin is invalid");
     }
   }
@@ -24315,16 +24936,7 @@ function normalizeEgressOrigins(value) {
 }
 function forbiddenEgressHostname(hostname) {
   const normalized = hostname.toLowerCase();
-  if (normalized === "localhost" || normalized.endsWith(".localhost") || normalized.endsWith(".local") || normalized.endsWith(".internal") || normalized === "0.0.0.0" || normalized === "::1") {
-    return true;
-  }
-  const ipv4 = /^(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})$/u.exec(normalized);
-  if (ipv4 === null)
-    return normalized.startsWith("[") || normalized.endsWith("]");
-  const octets = ipv4.slice(1).map(Number);
-  if (octets.some((octet) => octet > 255))
-    return true;
-  return octets[0] === 10 || octets[0] === 127 || octets[0] === 169 && octets[1] === 254 || octets[0] === 172 && (octets[1] ?? 0) >= 16 && (octets[1] ?? 0) <= 31 || octets[0] === 192 && octets[1] === 168;
+  return normalized === "localhost" || normalized.endsWith(".localhost") || normalized.endsWith(".local") || normalized.endsWith(".internal") || /^\d{1,3}(?:\.\d{1,3}){3}$/u.test(normalized) || normalized.startsWith("[") || normalized.endsWith("]");
 }
 function parseOhmyhostConfigYaml(source) {
   if (typeof source !== "string") {
@@ -24625,6 +25237,7 @@ async function initializeRepository(input) {
   const configuredDatabase = existingConfiguration?.database?.enabled === true;
   const databaseProvider = supabaseMigrationCount > 0 ? "supabase" : postgresMigrationCount > 0 || configuredDatabase ? "postgresql" : "none";
   const migrationCount = databaseProvider === "supabase" ? supabaseMigrationCount : postgresMigrationCount;
+  const selectedDatabaseProvider = existingConfiguration === null ? databaseProvider : configuredDatabase ? "postgresql" : "none";
   const betterAuth = dependencies.has("better-auth") || existingConfiguration?.auth?.provider === "better-auth";
   const workos = [
     "@workos-inc/authkit-react",
@@ -24677,19 +25290,19 @@ async function initializeRepository(input) {
   });
   const configurationYaml = existingConfigurationYaml ?? generatedConfigurationYaml;
   const capabilities = Object.freeze({
-    database: databaseProvider !== "none",
+    database: selectedDatabaseProvider !== "none",
     auth: targetBetterAuth,
     mail: targetMail,
     storage: targetStorage
   });
   const companion = companionRequired ? viteCompanionScaffold(applicationFiles, capabilities) : null;
   const companionSourcePresent = companion !== null && applicationFiles.includes(companion.sourceEntryPoint);
-  const migrationSqlAdmissionBlockers = await migrationSqlBlockers(applicationDirectory, applicationFiles, existingConfiguration?.database?.migrations, databaseProvider);
+  const migrationSqlAdmissionBlockers = await migrationSqlBlockers(applicationDirectory, applicationFiles, existingConfiguration?.database?.migrations, selectedDatabaseProvider);
   const blockers = [
     ...repositoryAdmissionBlockers,
     ...await workerModuleBlockers(framework, applicationDirectory, applicationFiles),
     ...await cronBlockers(framework, existingConfiguration, applicationDirectory, applicationFiles),
-    ...migrationFilenameBlockers(applicationFiles, existingConfiguration?.database?.migrations, databaseProvider),
+    ...selectedDatabaseProvider === "none" ? [] : migrationFilenameBlockers(applicationFiles, existingConfiguration?.database?.migrations, selectedDatabaseProvider),
     ...migrationSqlAdmissionBlockers,
     ...await storageClientBlockers(existingConfiguration, applicationDirectory, applicationFiles),
     ...await databaseContractBlockers(existingConfiguration, applicationDirectory, applicationFiles)
@@ -24718,7 +25331,9 @@ async function initializeRepository(input) {
       sourceEntryPoint: WORKER_MODULE_PATH,
       present: applicationFiles.includes(WORKER_MODULE_PATH),
       ...runtimeContract(capabilities)
-    }) : null
+    }) : null,
+    // Next.js and TanStack Start have neither a companion nor a Worker module, and read it here.
+    runtime: Object.values(capabilities).some(Boolean) ? runtimeContract(capabilities) : null
   });
 }
 function detectRepositoryFramework(dependencies, files, existingConfiguration) {
@@ -24738,7 +25353,7 @@ async function cronBlockers(framework, config, applicationDirectory, files) {
     return [
       {
         code: "scheduled_functions_runtime_unsupported",
-        message: "Declared crons run on the edge runtime of a Vite API companion, Next.js or TanStack Start application, or on the functions runtime."
+        message: "functions.crons needs runtime.mode edge (Next.js, TanStack Start, or Vite with src/ohmyhost/companion.ts) or functions (src/ohmyhost/worker.ts) in ohmyhost.yaml. Change runtime.mode, or remove functions.crons."
       }
     ];
   }
@@ -24815,14 +25430,20 @@ function migrationFilenameBlockers(files, configuredPath, provider) {
     return [];
   const root = configuredPath ?? "postgres/migrations";
   const prefix = `${root}/`;
-  const invalid4 = files.filter((path) => path.startsWith(prefix)).map((path) => path.slice(prefix.length)).some((path) => !/^(?:[A-Za-z0-9][A-Za-z0-9._-]*\/)*\d{14}_[a-z0-9][a-z0-9_-]*\.sql$/u.test(path));
-  return invalid4 ? [
+  const invalid5 = files.filter((path) => path.startsWith(prefix)).map((path) => path.slice(prefix.length)).find((path) => !/^(?:[A-Za-z0-9][A-Za-z0-9._-]*\/)*\d{14}_[a-z0-9][a-z0-9_-]*\.sql$/u.test(path));
+  return invalid5 === void 0 ? [] : [
     {
       code: "migration_filename_noncanonical",
-      message: "Rename every PostgreSQL migration to YYYYMMDDHHMMSS_name.sql before initialization."
+      message: `Migration file '${invalid5}' in ${root} is not named YYYYMMDDHHMMSS_name.sql (14 digits, an underscore, then lowercase letters, digits, _ or -). Every file in that directory must match, README and .gitkeep included: rename or move it, keeping the run order.`
     }
-  ] : [];
+  ];
 }
+var MIGRATION_REJECTION = {
+  destructive: "It contains DROP, TRUNCATE, INSERT, UPDATE, DELETE, BEGIN/COMMIT/ROLLBACK, CREATE OR REPLACE, or ALTER TABLE other than ADD; move row changes to 'ohmyhost database write'.",
+  provider_specific: "It mentions supabase, CREATE POLICY, ROW LEVEL SECURITY, the auth. or storage. schema, or the anon, authenticated or service_role role; comments count.",
+  unsupported: "It has a statement other than CREATE TABLE, TYPE, DOMAIN, SEQUENCE, VIEW, MATERIALIZED VIEW, TRIGGER, INDEX or FUNCTION, ALTER TABLE ... ADD, COMMENT ON, CREATE SCHEMA IF NOT EXISTS auth|extensions|private or CREATE EXTENSION IF NOT EXISTS pgcrypto|btree_gist|unaccent; or a function not in LANGUAGE sql or plpgsql, SECURITY DEFINER without SET search_path, or the word ohmyhost, comments included.",
+  invalid: "It is empty, not UTF-8 with LF line endings, has a BOM or NUL byte or an unterminated quote or comment, or exceeds 256 KiB (at most 128 files and 2 MiB in total)."
+};
 async function migrationSqlBlockers(applicationDirectory, files, configuredPath, provider) {
   if (provider !== "postgresql")
     return [];
@@ -24845,7 +25466,7 @@ async function migrationSqlBlockers(applicationDirectory, files, configuredPath,
         throw error;
       blockers.push({
         code: "migration_sql_not_admitted",
-        message: `PostgreSQL migration '${migration.path}' is not admitted (${error.reason}).`
+        message: `PostgreSQL migration '${migration.path}' is not admitted (${error.reason}): ${MIGRATION_REJECTION[error.reason]} Migrations are expand-only. Fix the file before its first deployment; never edit a migration a deployment already applied.`
       });
     }
   }
@@ -24860,7 +25481,7 @@ async function migrationSqlBlockers(applicationDirectory, files, configuredPath,
     return [
       {
         code: "migration_sql_not_admitted",
-        message: `PostgreSQL migration set is not admitted (${error.reason}).`
+        message: `The migration set is not admitted (${error.reason}): ${MIGRATION_REJECTION[error.reason]}`
       }
     ];
   }
@@ -24871,17 +25492,17 @@ async function readExistingConfiguration(repositoryRoot, repositoryFiles, applic
   const configurationPath = resolve2(repositoryRoot, "ohmyhost.yaml");
   const information = await stat2(configurationPath);
   if (!information.isFile() || information.size > MAXIMUM_CONFIGURATION_BYTES) {
-    throw new RepositoryInitError("repository_configuration_invalid", "Existing ohmyhost.yaml must be one bounded regular file.");
+    throw new RepositoryInitError("repository_configuration_invalid", "ohmyhost.yaml must be one regular file of at most 64 KiB");
   }
   const configuration = await readFile3(configurationPath, "utf8");
   let parsed;
   try {
     parsed = parseOhmyhostConfigYaml(configuration);
-  } catch {
-    throw new RepositoryInitError("repository_configuration_invalid", "Existing ohmyhost.yaml is invalid.");
+  } catch (error) {
+    throw new RepositoryInitError("repository_configuration_invalid", error instanceof TypeError ? error.message : "ohmyhost.yaml is invalid");
   }
   if (parsed.applicationRoot !== applicationRoot) {
-    throw new RepositoryInitError("repository_configuration_root_mismatch", "Existing ohmyhost.yaml must select the detected application root.");
+    throw new RepositoryInitError("repository_configuration_root_mismatch", `ohmyhost.yaml sets applicationRoot to '${parsed.applicationRoot}', but init selected '${applicationRoot}'. Run 'ohmyhost init --root ${parsed.applicationRoot} --dry-run --json', or correct applicationRoot.`);
   }
   return configuration;
 }
@@ -25003,12 +25624,13 @@ function hasDirectSafeBuildCommand(packageJson, framework) {
   const scripts = packageJson["scripts"];
   if (!isRecord4(scripts) || typeof scripts["build"] !== "string")
     return false;
-  const command = scripts["build"];
-  if (command.includes("..") || /(?:^|\s)cd(?:\s|$)/u.test(command))
-    return false;
+  return (framework === "nextjs" || framework === "vite" || framework === "tanstack-start") && isAdmittedFrameworkBuildScript(framework, scripts["build"]);
+}
+function buildScriptMessage(framework, command) {
+  const quoted = command.slice(0, 200);
   if (framework === "nextjs")
-    return command === "next build" || command === "next build --webpack";
-  return command === "vite build" || command === "vite build && tsc --noEmit";
+    return `package.json scripts.build must be exactly "next build" or "next build --webpack", not "${quoted}". Move other steps into their own scripts, then commit and push.`;
+  return `package.json scripts.build must be "vite build", optionally joined with && to exactly one "tsc", "tsc -b", "tsc --build" or "tsc --noEmit" stage before or after it, not "${quoted}". Move other steps into their own scripts, then commit and push.`;
 }
 async function assertRepositoryRoot(root) {
   let information;
@@ -25157,11 +25779,16 @@ function frameworkConfigurations(files) {
     ambiguous: Object.freeze(ambiguous)
   });
 }
+var FRAMEWORK_PACKAGE = {
+  nextjs: "next",
+  "tanstack-start": "@tanstack/react-start",
+  vite: "vite"
+};
 function frameworkCompatibility(packageJson, framework) {
   const targets = framework === "tanstack-start" ? [
-    { framework: "tanstack-start", packageName: "@tanstack/react-start" },
-    { framework: "vite", packageName: "vite" }
-  ] : framework === "nextjs" ? [{ framework: "nextjs", packageName: "next" }] : framework === "vite" ? [{ framework: "vite", packageName: "vite" }] : [];
+    { framework: "tanstack-start", packageName: FRAMEWORK_PACKAGE["tanstack-start"] },
+    { framework: "vite", packageName: FRAMEWORK_PACKAGE.vite }
+  ] : framework === "nextjs" ? [{ framework: "nextjs", packageName: FRAMEWORK_PACKAGE.nextjs }] : framework === "vite" ? [{ framework: "vite", packageName: FRAMEWORK_PACKAGE.vite }] : [];
   const frameworks = targets.map(({ framework: targetFramework, packageName }) => {
     const version2 = dependencyVersion(packageJson, packageName) ?? "";
     return Object.freeze({
@@ -25199,7 +25826,7 @@ function repositoryBlockers(packageJson, framework, nextStandaloneOutput, tanSta
   if (tanStackRuntime === "ambiguous") {
     blockers.push({
       code: "framework_ambiguous",
-      message: "TanStack Start must explicitly enable static prerendering or the complete Cloudflare edge contract."
+      message: 'TanStack Start needs one vite.config.js, .mjs or .ts that selects a mode. Static: tanstackStart({ prerender: { enabled: true } }) from "@tanstack/react-start/plugin/vite" and no "@cloudflare/vite-plugin". Server: cloudflare({ viteEnvironment: { name: "ssr" } }) from "@cloudflare/vite-plugin" listed before tanstackStart() in plugins, with @cloudflare/vite-plugin, @tanstack/react-router, @tanstack/react-start, react, react-dom, @vitejs/plugin-react and vite in package.json.'
     });
   }
   const relevantAmbiguousConfigs = frameworkConfigs.ambiguous.filter((config) => framework === "nextjs" ? config === "next" || config === "open-next" : config === "vite");
@@ -25217,19 +25844,19 @@ function repositoryBlockers(packageJson, framework, nextStandaloneOutput, tanSta
   } else if (packageManagerAdmission instanceof FrameworkAdmissionError) {
     blockers.push({
       code: "package_manager_unpinned",
-      message: "Declare one exact npm, pnpm, Yarn, or Bun packageManager version and commit its matching lockfile."
+      message: packageManagerAdmission.reason === "package_manager_version_unsupported" ? `This build image runs Bun ${PINNED_BUN_VERSION}; pin packageManager to bun@${PINNED_BUN_VERSION} and commit its matching lockfile. Repeating the unchanged version cannot work.` : "Declare one exact npm, pnpm, Yarn, or Bun packageManager version and commit its matching lockfile."
     });
   } else if (existingConfiguration !== null && (existingConfiguration.build.install !== packageManagerAdmission.installCommand || "command" in existingConfiguration.build && existingConfiguration.build.command !== packageManagerAdmission.buildCommand)) {
     blockers.push({
       code: "build_command_unsupported",
-      message: "Use the admitted package manager's secure install and direct build commands."
+      message: `ohmyhost.yaml build.install must be exactly "${packageManagerAdmission.installCommand}"${"command" in existingConfiguration.build ? ` and build.command "${packageManagerAdmission.buildCommand}"` : ""} for the packageManager in package.json. Set them, then commit and push.`
     });
   }
   if (compatibility.classification === "unsupported" && compatibility.frameworks.length > 0) {
-    const unsupported = compatibility.frameworks.filter((entry) => entry.classification === "unsupported").map((entry) => `${entry.framework}@${entry.version || "missing"}`).join(", ");
+    const unsupported = compatibility.frameworks.filter((entry) => entry.classification === "unsupported").map((entry) => `${FRAMEWORK_PACKAGE[entry.framework]}@${entry.version || "missing"}`).join(", ");
     blockers.push({
       code: "framework_version_unsupported",
-      message: `Framework version is outside the admitted POC window: ${unsupported}.`
+      message: `${unsupported} is outside the versions ohmyho.st builds: next 15.5.x or 16.0.0\u201316.3.4, vite 5.4.0\u20138.2.2, @tanstack/react-start 1.168.26\u20131.168.49, as an exact version or a ^ or ~ range whose base version is inside. Pin a version in that range in package.json, update the lockfile, commit and push.`
     });
   }
   const scripts = packageJson["scripts"];
@@ -25240,10 +25867,13 @@ function repositoryBlockers(packageJson, framework, nextStandaloneOutput, tanSta
   } else if (!hasDirectSafeBuildCommand(packageJson, framework)) {
     blockers.push({
       code: "build_command_unsupported",
-      message: "Use a direct framework build command without traversal or directory changes."
+      message: buildScriptMessage(framework, scripts["build"])
     });
   }
   const betterAuthVersion = dependencyVersion(packageJson, "better-auth");
+  const managedAuthIssue = managedCustomerAuthAdmissionIssue(existingConfiguration);
+  if (managedAuthIssue !== null)
+    blockers.push(managedAuthIssue);
   if (existingConfiguration?.auth?.provider === "better-auth" && betterAuthVersion !== null && betterAuthVersion !== SUPPORTED_BETTER_AUTH_VERSION) {
     blockers.push({
       code: "better_auth_version_unsupported",
@@ -25264,7 +25894,7 @@ function repositoryBlockers(packageJson, framework, nextStandaloneOutput, tanSta
     if (!nextConfigured) {
       blockers.push({
         code: "next_adapter_unconfigured",
-        message: "Declare direct next build, exact Next/React versions, and one supported Next config; ohmyhost supplies the OpenNext build overlay."
+        message: 'Next.js needs scripts.build exactly "next build" or "next build --webpack", react and react-dom at exact versions such as "19.1.0" (no ^ or ~), next within 15.5.x or 16.0.0\u201316.3.4, and exactly one next.config.js, .mjs or .ts, with at most one open-next.config file. ohmyho.st adds the OpenNext build itself; do not make it the build script.'
       });
     }
   }
@@ -26021,7 +26651,7 @@ var runProductionCli = async (argv, environment, io, signal, overrides = {}) =>
     args = extracted.argv;
     profileName = extracted.profileName;
   } catch {
-    return written(invalidCommandFailure(recognizedCommandLabel(argv)));
+    return written(invalidCommandFailure(argv, environment));
   }
   const workingDirectory = overrides.workingDirectory ?? process.cwd();
   let command;
@@ -26053,8 +26683,8 @@ var runProductionCli = async (argv, environment, io, signal, overrides = {}) =>
     if (error instanceof LinkedProjectAmbiguousError)
       return written(errorDocument(recognizedCommandLabel(args), 2, "linked_project_selection_required", false, `This directory is linked to projects of several organizations (${error.organizationIds.join(", ")}). Pass --project ULID, or choose the login with --profile-name NAME; '${resolveProductCliEnvironment(environment).commandPrefix} profile list --json' shows the saved logins.`));
     if (error instanceof CredentialStoreUnavailableError)
-      return written(errorDocument(recognizedCommandLabel(args), 3, "credential_store_unavailable", true, "Unlock or repair the selected credential store and retry."));
-    const result = error instanceof InvalidCommandError ? invalidCommandFailure(recognizedCommandLabel(args)) : errorDocument("unknown", 1, "internal_error", false, "Retry the command.");
+      return written(errorDocument(recognizedCommandLabel(args), 3, "credential_store_unavailable", false, CREDENTIAL_STORE_UNAVAILABLE_ACTION));
+    const result = error instanceof InvalidCommandError ? invalidCommandFailure(args, environment) : errorDocument(recognizedCommandLabel(args), 1, "internal_error", false, INTERNAL_ERROR_ACTION);
     if (!(error instanceof InvalidCommandError)) {
       diagnostics.record({
         correlationId: randomUUID2(),
@@ -26067,7 +26697,7 @@ var runProductionCli = async (argv, environment, io, signal, overrides = {}) =>
   }
   if (command.kind === "init") {
     if (profileName !== void 0)
-      return written(invalidCommandFailure("init"));
+      return written(errorDocument("init", 2, "invalid_command", false, "ohmyhost init runs offline and uses no login: remove --profile-name and run it again."));
     return runOfflineInit(command, io, diagnostics);
   }
   if (command.kind === "help" || command.kind === "version") {
@@ -26101,6 +26731,8 @@ var runProductionCli = async (argv, environment, io, signal, overrides = {}) =>
   const registry = overrides.profiles ?? new NativeKeyringProfileRegistry(void 0, platform.credentialService);
   const linkDirectory = join3(workingDirectory, platform.linkDirectory);
   const projectId = commandProjectId(command);
+  if (projectId !== void 0 && linked === null)
+    links = await readProjectLinks(linkDirectory, platform.apiOrigin);
   const organizationId = handedAccount2?.organizationId ?? commandOrganizationId(command) ?? linked?.organizationId ?? (projectId === void 0 ? void 0 : linkedOrganization(links, projectId));
   const request = profileRequest({
     ...profileName === void 0 ? {} : { name: profileName },
@@ -26179,7 +26811,15 @@ var runProductionCli = async (argv, environment, io, signal, overrides = {}) =>
       }
     }
   } catch (error) {
-    return written(compositionFailure(recognizedCommandLabel(args), error, signal, platform.commandPrefix));
+    const result = compositionFailure(recognizedCommandLabel(args), error, signal, platform.commandPrefix, profile);
+    if (result.exitCode === 1)
+      diagnostics.record({
+        correlationId: randomUUID2(),
+        category: "internal",
+        subsystem: "authentication",
+        errorKind: "unexpected"
+      });
+    return written(result);
   }
   const selected = profile;
   const productApiOrigin = platform.apiOrigin;
@@ -26263,13 +26903,13 @@ var adoptLegacyLink = async (input) => {
   });
   await removeLegacyProjectLink(input.directory);
 };
-var compositionFailure = (command, error, signal, commandPrefix) => {
+var compositionFailure = (command, error, signal, commandPrefix, profile) => {
   if (error instanceof ProfileSelectionError)
     return errorDocument(command, error.exitCode, error.code, false, error.suggestedAction);
   if (error instanceof ProfileLimitError)
     return errorDocument(command, 2, "profile_limit_reached", false, profileLimitAction(commandPrefix));
   if (error instanceof ProductApiAuthenticationError)
-    return error.code === "authentication_required" ? errorDocument(command, 5, "authentication_required", false, `Run '${commandPrefix} login --json'.`) : errorDocument(command, 5, "token_refresh_failed", true, `Run '${commandPrefix} login --json' if retrying does not succeed.`);
+    return error.code === "authentication_required" ? errorDocument(command, 5, "authentication_required", false, endedLoginAction(commandPrefix, profile)) : errorDocument(command, 5, "token_refresh_failed", true, refreshFailedAction(commandPrefix, profile));
   return classifyCliFailure(command, error, signal);
 };
 var runOfflineInit = async (command, io, diagnostics) => {
@@ -26301,7 +26941,8 @@ var runOfflineInit = async (command, io, diagnostics) => {
       companion: result.companion,
       // The functions runtime reports its own bindings and packages; dropping it left a
       // storage-enabled functions app with no contract to read at all.
-      worker: result.worker
+      worker: result.worker,
+      runtime: result.runtime
     })}
 `);
     return blocked ? 9 : 0;
@@ -26315,11 +26956,38 @@ var runOfflineInit = async (command, io, diagnostics) => {
     });
     const code = error instanceof RepositoryInitBlockedError ? "repository_init_blocked" : error instanceof RepositoryInitConflictError ? "repository_configuration_exists" : known ? error.code : "internal_error";
     const exitCode = error instanceof RepositoryInitBlockedError ? 9 : known ? 2 : 1;
-    const result = errorDocument("init", exitCode, code, false, error instanceof RepositoryInitConflictError ? "Keep the existing ohmyhost.yaml or remove it explicitly before retrying." : error instanceof RepositoryInitError && error.code === "repository_root_required" ? "Run ohmyhost init from the Git repository root with --root set to the application directory (for example --root website); commit the root ohmyhost.yaml before planning." : error instanceof RepositoryInitError && error.code === "project_name_invalid" ? "Pass a lowercase deployment slug with '--project', then rerun init." : "Run 'ohmyhost init --dry-run --json' and resolve every reported blocker.");
+    const result = errorDocument("init", exitCode, code, false, known ? initFailureAction(error) : INTERNAL_ERROR_ACTION);
     io.writeStdout(result.stdout);
     return result.exitCode;
   }
 };
+var initFailureAction = (error) => {
+  if (error instanceof RepositoryInitBlockedError)
+    return "Run 'ohmyhost init --dry-run --json' and resolve every reported blocker.";
+  if (error instanceof RepositoryInitConflictError)
+    return "ohmyhost.yaml already exists and init never overwrites it; that file stays authoritative. Run 'ohmyhost init --dry-run --json' to check it and list blockers, then edit the file by hand. Do not delete it to rerun init.";
+  const message = /[.!?]$/u.test(error.message) ? error.message : `${error.message}.`;
+  switch (error.code) {
+    case "repository_root_required":
+      return "Run ohmyhost init from the Git repository root with --root set to the application directory (for example --root website); commit the root ohmyhost.yaml before planning.";
+    case "project_name_invalid":
+      return "Pass a lowercase deployment slug with '--project', then rerun init.";
+    case "application_root_ambiguous":
+      return `${message} Run 'ohmyhost init --root DIR --dry-run --json' from the Git repository root with the directory to deploy; ask the customer if it is unclear.`;
+    case "application_root_not_found":
+    case "application_root_unsupported":
+      return `${message} init needs a package.json that depends on next (without vite or @tanstack/react-start), on vite, or on @tanstack/react-start, or a functions app with src/ohmyhost/worker.ts. Pass --root DIR with the app's directory, or fix its package.json, then run init again.`;
+    case "application_root_invalid":
+    case "application_root_missing":
+      return `${message} Pass --root as a path relative to the repository root, for example apps/web.`;
+    case "repository_configuration_invalid":
+      return `${error.message.replace(/\.$/u, "")}. Fix that, then run 'ohmyhost init --dry-run --json' again; do not delete ohmyhost.yaml.`;
+    case "repository_configuration_root_mismatch":
+      return error.message;
+    default:
+      return `${message} Fix that and run 'ohmyhost init --json' again from the Git repository root.`;
+  }
+};
 var FetchWorkosPublicTransport = class {
   parentSignal;
   timeoutMs;
@@ -26565,8 +27233,8 @@ var decodeUtf8 = (decoder, chunk, stream) => {
     throw new ResponseContractError();
   }
 };
-var waitUntil = async (instant, signal) => {
-  const delay = Math.max(0, instant.getTime() - Date.now());
+var waitUntil = async (instant2, signal) => {
+  const delay = Math.max(0, instant2.getTime() - Date.now());
   await new Promise((resolve3, reject) => {
     const cleanup = () => signal.removeEventListener("abort", cancel);
     const complete = () => {
@@ -26610,7 +27278,7 @@ var runOfflineLogout = async (registry, request, commandPrefix, io, diagnostics)
       subsystem: "credential_store",
       errorKind: "unavailable"
     });
-    result = errorDocument("logout", 3, "credential_store_unavailable", true, "Unlock or repair the selected credential store and retry.");
+    result = errorDocument("logout", 3, "credential_store_unavailable", false, CREDENTIAL_STORE_UNAVAILABLE_ACTION);
   }
   io.writeStdout(result.stdout);
   return result.exitCode;
@@ -26645,7 +27313,14 @@ var readSecretValueFromStandardInput = async (input, signal) => {
     value.fill(0);
   }
 };
-var invalidCommandFailure = (command) => errorDocument(command, 2, "invalid_command", false, "Check 'ohmyhost --help'.");
+var invalidCommandFailure = (argv, environment) => {
+  let commandPrefix = "ohmyhost";
+  try {
+    commandPrefix = resolveProductCliEnvironment(environment).commandPrefix;
+  } catch {
+  }
+  return errorDocument(recognizedCommandLabel(argv), 2, "invalid_command", false, invalidCommandAction(argv, commandPrefix));
+};
 var resultDocument = (command, exitCode, status, body = {}) => ({
   exitCode,
   stdout: `${JSON.stringify({ version: 1, command, status, ...body })}
@@ -26691,6 +27366,7 @@ export {
   InvalidCommandError,
   recognizedCommandLabel,
   parseProductCliCommand,
+  parseProjectDataChangePlan2 as parseProjectDataChangePlan,
   parsePaidDomainPlan,
   parsePaidDomain,
   parseCloudflareDnsAuthorization,
@@ -26721,6 +27397,11 @@ export {
   PublicResponseTooLargeError,
   PsqlUnavailableError,
   cliMetadataResult,
+  invalidCommandAction,
+  INTERNAL_ERROR_ACTION,
+  CREDENTIAL_STORE_UNAVAILABLE_ACTION,
+  endedLoginAction,
+  refreshFailedAction,
   ProductCli,
   ACCOUNT_SENSITIVE_PROBLEMS,
   classifyCliFailure,