@amerged/ohmyhost-cli 0.1.35 → 0.1.37

package/dist/index.js

@@ -99,7 +99,7 @@ import {
   selectWorkspace,
   verifiedUserId,
   workspaceOf
-} from "./chunk-ZQSLRNH6.js";
+} from "./chunk-IHXNADOQ.js";
 import {
   CredentialStoreIntegrityError,
   CredentialStoreUnavailableError,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@amerged/ohmyhost-cli",
-  "version": "0.1.35",
+  "version": "0.1.37",
   "type": "module",
   "engines": {
     "node": ">=22"

package/src/apps/product-cli/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ohmyhost/product-cli",
-  "version": "0.1.35",
+  "version": "0.1.37",
   "private": true,
   "ohmyhost": {
     "deployment": "production",

package/src/apps/product-cli/src/cli.ts

@@ -470,6 +470,37 @@ const HELP_USAGE = Object.freeze({
     "printf '%s' \"$SECRET_VALUE\" | ohmyhost secret set NAME --project ULID --environment ENVIRONMENT_ULID --idempotency-key KEY [--profile-user USER_ID --profile-organization ULID | --token-user USER_ID --token-organization ULID] --stdin [--wait] --json (with --profile-user and --profile-organization the saved login that runs it must belong to that user and organization; with --token-user and --token-organization it runs only with an OHMYHOST_TOKEN of that user and organization, never with a saved login)",
   "secret delete":
     "ohmyhost secret delete NAME --project ULID --environment ENVIRONMENT_ULID --idempotency-key KEY [--wait] --json",
+  "mail workspace list": "ohmyhost mail workspace list --organization ULID --json",
+  "mail workspace create":
+    "ohmyhost mail workspace create --organization ULID --domain DOMAIN --sending true --idempotency-key KEY --json",
+  "mail workspace status":
+    "ohmyhost mail workspace status --organization ULID --mail-domain ULID --json",
+  "mail workspace retire":
+    "ohmyhost mail workspace retire --organization ULID --mail-domain ULID --expected-revision N --idempotency-key KEY --yes --json",
+  "mail workspace dns-authorize":
+    "ohmyhost mail workspace dns-authorize --organization ULID --mail-domain ULID --expected-revision N --zone DOMAIN --idempotency-key KEY --json",
+  "mail workspace dns-revoke":
+    "ohmyhost mail workspace dns-revoke --organization ULID --mail-domain ULID --expected-revision N --idempotency-key KEY --yes --json",
+  "mail workspace dns-status":
+    "ohmyhost mail workspace dns-status --organization ULID --mail-domain ULID --json",
+  "mail binding get": "ohmyhost mail binding get --project ULID --environment PROD_ULID --json",
+  "mail binding set":
+    "ohmyhost mail binding set --project ULID --environment PROD_ULID --mail-domain ULID --sending true --sender-addresses contact@mail.example.com,contracts@mail.example.com --default-from contracts@mail.example.com [--reply-to owner@example.com] --expected-revision N --idempotency-key KEY --json",
+  "mail binding detach":
+    "ohmyhost mail binding detach --project ULID --environment PROD_ULID --expected-revision N --idempotency-key KEY --yes --json",
+  "mail identity get": "ohmyhost mail identity get --project ULID --json",
+  "mail identity declare":
+    "ohmyhost mail identity declare --project ULID --hostname sign.example.com --idempotency-key KEY --json",
+  "mail identity verify":
+    "ohmyhost mail identity verify --project ULID --expected-revision N --idempotency-key KEY --json",
+  "mail identity revoke":
+    "ohmyhost mail identity revoke --project ULID --expected-revision N --idempotency-key KEY --yes --json",
+  "mail identity authorize":
+    "ohmyhost mail identity authorize --project ULID --expected-revision N --zone example.com --idempotency-key KEY --json",
+  "mail identity authorization-revoke":
+    "ohmyhost mail identity authorization-revoke --project ULID --expected-revision N --idempotency-key KEY --yes --json",
+  "mail identity authorization-status":
+    "ohmyhost mail identity authorization-status --project ULID --json",
   "mail setup":
     "ohmyhost mail setup --project ULID --environment ULID --domain DOMAIN --sending true --receiving false --idempotency-key KEY --json",
   "mail status": "ohmyhost mail status --project ULID --environment ULID --json",
@@ -1114,6 +1145,11 @@ export class ProductCli {
       if (command.kind === "secret-list") return await this.listEnvironmentSecrets(command, signal);
       if (command.kind === "function-runs") return await this.listFunctionRuns(command, signal);
       if (command.kind === "secret-set") return await this.putEnvironmentSecret(command, signal);
+      if (command.kind === "shared-mail") {
+        const api = await this.authenticatedApi(command.credentialStore, signal);
+        if (!api.sharedMail) throw new Error("Shared mail unavailable");
+        return success(command.label, { mail: await api.sharedMail(command.request) });
+      }
       if (command.kind === "managed-mail") {
         const api = await this.authenticatedApi(command.credentialStore, signal);
         if (!api.managedMail) throw new Error("Mail unavailable");
@@ -3120,7 +3156,7 @@ const parsedCommandName = (command: ProductCliCommand): CommandLabel => {
   if (command.kind === "function-runs") return "function runs";
   if (command.kind === "secret-set") return "secret set";
   if (command.kind === "secret-delete") return "secret delete";
-  if (command.kind === "managed-mail") return command.label;
+  if (command.kind === "shared-mail" || command.kind === "managed-mail") return command.label;
   if (command.kind === "profile-list") return "profile list";
   return command.kind;
 };

package/src/apps/product-cli/src/command.ts

@@ -3,7 +3,7 @@ import {
   isProjectDataChangeKind,
   type ProjectDataChangeKind,
 } from "@ohmyhost/contracts/project-data-changes";
-import type { ManagedMailCommand } from "@ohmyhost/sdk-ts";
+import type { ManagedMailCommand, SharedMailCommand } from "@ohmyhost/sdk-ts";
 import { USER_API_KEY_ID } from "@ohmyhost/contracts/user-api-keys";
 import { WORKOS_USER_API_KEY_PATTERN } from "@ohmyhost/workos-auth-contracts/user-api-keys";
 import { isProfileName, isProfileUserId } from "./profile-store.js";
@@ -536,6 +536,12 @@ export type ProductCliCommand =
       readonly wait: boolean;
       readonly credentialStore: "native";
     }
+  | {
+      readonly kind: "shared-mail";
+      readonly request: SharedMailCommand;
+      readonly label: SharedMailCommandLabel;
+      readonly credentialStore: "native";
+    }
   | {
       readonly kind: "managed-mail";
       readonly request: ManagedMailCommand;
@@ -902,7 +908,27 @@ export type RecognizedCommandLabel =
   | "mail messages retry"
   | "mail domain set"
   | "mail domain status"
-  | "mail domain delete";
+  | "mail domain delete"
+  | SharedMailCommandLabel;
+
+export type SharedMailCommandLabel =
+  | "mail workspace list"
+  | "mail workspace create"
+  | "mail workspace status"
+  | "mail workspace retire"
+  | "mail workspace dns-authorize"
+  | "mail workspace dns-status"
+  | "mail workspace dns-revoke"
+  | "mail binding get"
+  | "mail binding set"
+  | "mail binding detach"
+  | "mail identity get"
+  | "mail identity declare"
+  | "mail identity verify"
+  | "mail identity revoke"
+  | "mail identity authorize"
+  | "mail identity authorization-status"
+  | "mail identity authorization-revoke";
 
 export const recognizedCommandLabel = (argv: readonly string[]): RecognizedCommandLabel => {
   const values = [...argv];
@@ -1052,6 +1078,11 @@ export const recognizedCommandLabel = (argv: readonly string[]): RecognizedComma
     }
     if (value === "function" && values[0] === "runs") return "function runs";
     if (value === "mail") {
+      if (["workspace", "binding", "identity"].includes(values[0] ?? "")) {
+        const candidate = `mail ${values[0]} ${values[1]}`;
+        if (SHARED_MAIL_LABELS.includes(candidate as SharedMailCommandLabel))
+          return candidate as SharedMailCommandLabel;
+      }
       if (values[0] === "setup") return "mail setup";
       if (values[0] === "status") return "mail status";
       if (values[0] === "webhook") {
@@ -2328,6 +2359,10 @@ export const parseProductCliCommand = (argv: readonly string[]): ProductCliComma
     }
     throw new InvalidCommandError();
   }
+  if (first === "mail" && ["workspace", "binding", "identity"].includes(values[0] ?? "")) {
+    if (wait || follow || stdin) throw new InvalidCommandError();
+    return parseSharedMailCommand(values, yes);
+  }
   if (first === "mail") {
     const area = values.shift();
     const sub =
@@ -2538,3 +2573,194 @@ const validPaidHostname = (value: string): boolean =>
   !value.endsWith(".omh.st") &&
   value !== "ohmyho.st" &&
   !value.endsWith(".ohmyho.st");
+
+const SHARED_MAIL_LABELS: readonly SharedMailCommandLabel[] = [
+  "mail workspace list",
+  "mail workspace create",
+  "mail workspace status",
+  "mail workspace retire",
+  "mail workspace dns-authorize",
+  "mail workspace dns-status",
+  "mail workspace dns-revoke",
+  "mail binding get",
+  "mail binding set",
+  "mail binding detach",
+  "mail identity get",
+  "mail identity declare",
+  "mail identity verify",
+  "mail identity revoke",
+  "mail identity authorize",
+  "mail identity authorization-status",
+  "mail identity authorization-revoke",
+];
+
+/** New workspace sender operations stay separate from the exact legacy project mail contract. */
+function parseSharedMailCommand(values: string[], yes: boolean): ProductCliCommand {
+  const area = values.shift(),
+    operation = values.shift();
+  const label = `mail ${area} ${operation}` as SharedMailCommandLabel;
+  if (!SHARED_MAIL_LABELS.includes(label)) throw new InvalidCommandError();
+  const destructive =
+    operation === "retire" ||
+    operation === "detach" ||
+    operation === "revoke" ||
+    operation === "dns-revoke" ||
+    operation === "authorization-revoke";
+  if (yes !== destructive) throw new InvalidCommandError();
+  const allowed = area === "workspace" ? ["--organization"] : ["--project"];
+  const writing = [
+    "create",
+    "retire",
+    "dns-authorize",
+    "dns-revoke",
+    "set",
+    "detach",
+    "declare",
+    "verify",
+    "revoke",
+    "authorize",
+    "authorization-revoke",
+  ].includes(operation ?? "");
+  if (area === "workspace" && operation !== "list" && operation !== "create")
+    allowed.push("--mail-domain");
+  if (area === "binding") allowed.push("--environment");
+  if (operation === "create") allowed.push("--domain", "--sending");
+  if (area === "binding" && operation === "set")
+    allowed.push(
+      "--mail-domain",
+      "--sending",
+      "--sender-addresses",
+      "--default-from",
+      "--reply-to",
+    );
+  if (operation === "declare") allowed.push("--hostname");
+  if (operation === "authorize" || operation === "dns-authorize") allowed.push("--zone");
+  if (writing) allowed.push("--idempotency-key");
+  if (writing && operation !== "create" && operation !== "declare")
+    allowed.push("--expected-revision");
+  const options = parseOptionalOptions(values, allowed);
+  const required = (key: keyof typeof options) => {
+    const value = options[key];
+    if (!value) throw new InvalidCommandError();
+    return value;
+  };
+  const revision = () => {
+    const value = required("--expected-revision");
+    if (!/^(?:0|[1-9][0-9]*)$/u.test(value) || !Number.isSafeInteger(Number(value)))
+      throw new InvalidCommandError();
+    return Number(value);
+  };
+  const sending = () => {
+    const value = required("--sending");
+    if (value !== "true" && value !== "false") throw new InvalidCommandError();
+    return value === "true";
+  };
+  const idempotencyKey = () => required("--idempotency-key");
+  let request: SharedMailCommand;
+  if (area === "workspace") {
+    const scope = { organizationId: required("--organization") };
+    if (operation === "list") request = { ...scope, action: "domains_list" };
+    else if (operation === "create") {
+      const enabled = sending();
+      if (!enabled) throw new InvalidCommandError();
+      request = {
+        ...scope,
+        action: "domain_create",
+        domain: required("--domain"),
+        sending: enabled,
+        idempotencyKey: idempotencyKey(),
+      };
+    } else {
+      const target = { ...scope, mailDomainId: required("--mail-domain") };
+      if (operation === "status") request = { ...target, action: "domain_get" };
+      else if (operation === "dns-status") request = { ...target, action: "domain_dns_status" };
+      else if (operation === "dns-revoke")
+        request = {
+          ...target,
+          action: "domain_dns_revoke",
+          expectedRevision: revision(),
+          idempotencyKey: idempotencyKey(),
+        };
+      else if (operation === "retire")
+        request = {
+          ...target,
+          action: "domain_retire",
+          expectedRevision: revision(),
+          idempotencyKey: idempotencyKey(),
+        };
+      else
+        request = {
+          ...target,
+          action: "domain_dns_authorize",
+          expectedRevision: revision(),
+          zone: required("--zone"),
+          idempotencyKey: idempotencyKey(),
+        };
+    }
+  } else if (area === "binding") {
+    const scope = { projectId: required("--project"), environmentId: required("--environment") };
+    if (operation === "get") request = { ...scope, action: "binding_get" };
+    else if (operation === "detach")
+      request = {
+        ...scope,
+        action: "binding_detach",
+        expectedRevision: revision(),
+        idempotencyKey: idempotencyKey(),
+      };
+    else {
+      const senderAddresses = required("--sender-addresses").split(",");
+      if (
+        senderAddresses.length > 32 ||
+        senderAddresses.some((address) => !address || address.trim() !== address) ||
+        new Set(senderAddresses).size !== senderAddresses.length
+      )
+        throw new InvalidCommandError();
+      request = {
+        ...scope,
+        action: "binding_set",
+        mailDomainId: required("--mail-domain"),
+        sending: sending(),
+        senderAddresses,
+        defaultFrom: required("--default-from"),
+        defaultReplyTo: options["--reply-to"] ?? null,
+        expectedRevision: revision(),
+        idempotencyKey: idempotencyKey(),
+      };
+    }
+  } else {
+    const scope = { projectId: required("--project") };
+    if (operation === "get") request = { ...scope, action: "identity_get" };
+    else if (operation === "authorization-status")
+      request = { ...scope, action: "identity_authorization_status" };
+    else if (operation === "authorization-revoke")
+      request = {
+        ...scope,
+        action: "identity_authorization_revoke",
+        expectedRevision: revision(),
+        idempotencyKey: idempotencyKey(),
+      };
+    else if (operation === "declare")
+      request = {
+        ...scope,
+        action: "identity_declare",
+        hostname: required("--hostname"),
+        idempotencyKey: idempotencyKey(),
+      };
+    else if (operation === "authorize")
+      request = {
+        ...scope,
+        action: "identity_authorize",
+        zone: required("--zone"),
+        expectedRevision: revision(),
+        idempotencyKey: idempotencyKey(),
+      };
+    else
+      request = {
+        ...scope,
+        action: operation === "verify" ? "identity_verify" : "identity_revoke",
+        expectedRevision: revision(),
+        idempotencyKey: idempotencyKey(),
+      };
+  }
+  return { kind: "shared-mail", request, label, credentialStore: "native" };
+}

package/src/apps/product-cli/src/composition.ts

@@ -528,6 +528,8 @@ const readTokenIdentity = async (input: {
 /** The organization a command names explicitly; `organization use` names its target instead. */
 const commandOrganizationId = (command: ProductCliCommand): string | undefined => {
   if (command.kind === "organization-use" || command.kind === "login") return undefined;
+  if (command.kind === "shared-mail" && "organizationId" in command.request)
+    return command.request.organizationId;
   if (command.kind === "feedback-submit") return command.report.organization_id;
   return "organizationId" in command && typeof command.organizationId === "string"
     ? command.organizationId
@@ -535,6 +537,8 @@ const commandOrganizationId = (command: ProductCliCommand): string | undefined =
 };
 
 const commandProjectId = (command: ProductCliCommand): string | undefined => {
+  if (command.kind === "shared-mail")
+    return "projectId" in command.request ? command.request.projectId : undefined;
   if (command.kind === "managed-mail") return command.request.projectId;
   return "projectId" in command && typeof command.projectId === "string"
     ? command.projectId

package/src/apps/product-cli/src/product-api.ts

@@ -1,4 +1,9 @@
-import { executeManagedMail, type ManagedMailCommand } from "@ohmyhost/sdk-ts";
+import {
+  executeManagedMail,
+  executeSharedMail,
+  type ManagedMailCommand,
+  type SharedMailCommand,
+} from "@ohmyhost/sdk-ts";
 import type {
   ProjectDataChangeKind,
   ProjectDataChangePlan,
@@ -434,6 +439,7 @@ export interface ProductApi {
     readonly name: string;
     readonly idempotencyKey: string;
   }): Promise<DeleteEnvironmentSecretResult>;
+  sharedMail?(input: SharedMailCommand): Promise<unknown>;
   managedMail?(input: ManagedMailCommand): Promise<unknown>;
 }
 
@@ -1237,6 +1243,10 @@ export class GeneratedSdkProductApi implements ProductApi {
     );
   }
 
+  public sharedMail(input: SharedMailCommand) {
+    return executeSharedMail(this.#client, input);
+  }
+
   public managedMail(input: ManagedMailCommand) {
     return executeManagedMail(this.#client, input);
   }

package/src/packages/contracts/package.json

@@ -5,6 +5,11 @@
   "type": "module",
   "sideEffects": false,
   "exports": {
+    "./shared-mail": {
+      "source": "./src/shared-mail.ts",
+      "types": "./dist/shared-mail.d.ts",
+      "import": "./dist/shared-mail.js"
+    },
     "./mcp-source-codec": {
       "source": "./src/mcp-source-codec.ts",
       "types": "./dist/mcp-source-codec.d.ts",

package/src/packages/contracts/src/operation-failure.ts

@@ -90,6 +90,10 @@ const failures = {
     "The organization does not have sufficient available credits for this operation.",
     "Ask the organization owner to top up credits, then create a new deployment plan. Preserve existing data; do not buy a second subscription or repeatedly reconcile this terminal operation.",
   ],
+  project_budget_exceeded: [
+    "The project's Stop budget prevents this deployment.",
+    "This project's Stop budget for the current UTC month was reached; no build started. Read 'ohmyhost budget get --project ULID --json'. Ask the organization Owner to change the limit or mode only if they want to allow more spending; otherwise wait for the next UTC month. Then plan and deploy again or send a new push. Replaying this terminal operation cannot start a build.",
+  ],
   paid_plan_required: [
     "Transactional mail requires an active Paid plan for this organization.",
     "Ask the organization Owner to activate Paid through billing checkout; top-ups and signup credits do not activate it. Then plan the same deployment or promotion again. If the app should send no mail, instead set mail.enabled to false in ohmyhost.yaml, save or push the corrected version and plan its commit. Replaying this operation cannot enable mail. Do not reset the database.",

package/src/packages/contracts/src/problem-policy.ts

@@ -313,14 +313,14 @@ export const PROBLEM_POLICY = {
     status: 409,
     retryable: false,
     action:
-      "Use the sender domain already configured for this project, or retire it with 'ohmyhost mail domain delete' (repeat while the removal is pending) and then set up the new domain; a domain registered to another project cannot be set up.",
+      "Read the workspace sender resource and project binding. Reuse requires explicit domain-use authority, target-project editing and a current verified application identity with the same registrable main domain. Read the current revision before changing settings. Detach a shared project binding explicitly; legacy domain deletion cannot retire a resource used by another project.",
     title: "Mail domain conflict",
   },
   mail_domain_required: {
     status: 409,
     retryable: false,
     action:
-      "This app declares mail.enabled. Configure the project's own sender domain with 'ohmyhost mail setup' using its Prod environment ID, or set mail.enabled to false if the app sends no mail, then plan again.",
+      "This app declares mail.enabled. Configure a sender with 'ohmyhost mail setup' or explicitly attach an authorized workspace sender using the project's Prod environment ID. Reuse first requires proof of the intended application hostname with the same registrable main domain; declare and verify that identity before mail-gated deployment. Then plan again.",
     title: "Mail domain required",
   },
   storage_jurisdiction_conflict: {