@amerged/ohmyhost-cli 0.1.36 → 0.1.37

package/dist/index.js

@@ -99,7 +99,7 @@ import {
   selectWorkspace,
   verifiedUserId,
   workspaceOf
-} from "./chunk-LU7ONYZG.js";
+} from "./chunk-IHXNADOQ.js";
 import {
   CredentialStoreIntegrityError,
   CredentialStoreUnavailableError,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@amerged/ohmyhost-cli",
-  "version": "0.1.36",
+  "version": "0.1.37",
   "type": "module",
   "engines": {
     "node": ">=22"

package/src/apps/product-cli/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ohmyhost/product-cli",
-  "version": "0.1.36",
+  "version": "0.1.37",
   "private": true,
   "ohmyhost": {
     "deployment": "production",

package/src/apps/product-cli/src/cli.ts

@@ -470,6 +470,37 @@ const HELP_USAGE = Object.freeze({
     "printf '%s' \"$SECRET_VALUE\" | ohmyhost secret set NAME --project ULID --environment ENVIRONMENT_ULID --idempotency-key KEY [--profile-user USER_ID --profile-organization ULID | --token-user USER_ID --token-organization ULID] --stdin [--wait] --json (with --profile-user and --profile-organization the saved login that runs it must belong to that user and organization; with --token-user and --token-organization it runs only with an OHMYHOST_TOKEN of that user and organization, never with a saved login)",
   "secret delete":
     "ohmyhost secret delete NAME --project ULID --environment ENVIRONMENT_ULID --idempotency-key KEY [--wait] --json",
+  "mail workspace list": "ohmyhost mail workspace list --organization ULID --json",
+  "mail workspace create":
+    "ohmyhost mail workspace create --organization ULID --domain DOMAIN --sending true --idempotency-key KEY --json",
+  "mail workspace status":
+    "ohmyhost mail workspace status --organization ULID --mail-domain ULID --json",
+  "mail workspace retire":
+    "ohmyhost mail workspace retire --organization ULID --mail-domain ULID --expected-revision N --idempotency-key KEY --yes --json",
+  "mail workspace dns-authorize":
+    "ohmyhost mail workspace dns-authorize --organization ULID --mail-domain ULID --expected-revision N --zone DOMAIN --idempotency-key KEY --json",
+  "mail workspace dns-revoke":
+    "ohmyhost mail workspace dns-revoke --organization ULID --mail-domain ULID --expected-revision N --idempotency-key KEY --yes --json",
+  "mail workspace dns-status":
+    "ohmyhost mail workspace dns-status --organization ULID --mail-domain ULID --json",
+  "mail binding get": "ohmyhost mail binding get --project ULID --environment PROD_ULID --json",
+  "mail binding set":
+    "ohmyhost mail binding set --project ULID --environment PROD_ULID --mail-domain ULID --sending true --sender-addresses contact@mail.example.com,contracts@mail.example.com --default-from contracts@mail.example.com [--reply-to owner@example.com] --expected-revision N --idempotency-key KEY --json",
+  "mail binding detach":
+    "ohmyhost mail binding detach --project ULID --environment PROD_ULID --expected-revision N --idempotency-key KEY --yes --json",
+  "mail identity get": "ohmyhost mail identity get --project ULID --json",
+  "mail identity declare":
+    "ohmyhost mail identity declare --project ULID --hostname sign.example.com --idempotency-key KEY --json",
+  "mail identity verify":
+    "ohmyhost mail identity verify --project ULID --expected-revision N --idempotency-key KEY --json",
+  "mail identity revoke":
+    "ohmyhost mail identity revoke --project ULID --expected-revision N --idempotency-key KEY --yes --json",
+  "mail identity authorize":
+    "ohmyhost mail identity authorize --project ULID --expected-revision N --zone example.com --idempotency-key KEY --json",
+  "mail identity authorization-revoke":
+    "ohmyhost mail identity authorization-revoke --project ULID --expected-revision N --idempotency-key KEY --yes --json",
+  "mail identity authorization-status":
+    "ohmyhost mail identity authorization-status --project ULID --json",
   "mail setup":
     "ohmyhost mail setup --project ULID --environment ULID --domain DOMAIN --sending true --receiving false --idempotency-key KEY --json",
   "mail status": "ohmyhost mail status --project ULID --environment ULID --json",
@@ -1114,6 +1145,11 @@ export class ProductCli {
       if (command.kind === "secret-list") return await this.listEnvironmentSecrets(command, signal);
       if (command.kind === "function-runs") return await this.listFunctionRuns(command, signal);
       if (command.kind === "secret-set") return await this.putEnvironmentSecret(command, signal);
+      if (command.kind === "shared-mail") {
+        const api = await this.authenticatedApi(command.credentialStore, signal);
+        if (!api.sharedMail) throw new Error("Shared mail unavailable");
+        return success(command.label, { mail: await api.sharedMail(command.request) });
+      }
       if (command.kind === "managed-mail") {
         const api = await this.authenticatedApi(command.credentialStore, signal);
         if (!api.managedMail) throw new Error("Mail unavailable");
@@ -3120,7 +3156,7 @@ const parsedCommandName = (command: ProductCliCommand): CommandLabel => {
   if (command.kind === "function-runs") return "function runs";
   if (command.kind === "secret-set") return "secret set";
   if (command.kind === "secret-delete") return "secret delete";
-  if (command.kind === "managed-mail") return command.label;
+  if (command.kind === "shared-mail" || command.kind === "managed-mail") return command.label;
   if (command.kind === "profile-list") return "profile list";
   return command.kind;
 };

package/src/apps/product-cli/src/command.ts

@@ -3,7 +3,7 @@ import {
   isProjectDataChangeKind,
   type ProjectDataChangeKind,
 } from "@ohmyhost/contracts/project-data-changes";
-import type { ManagedMailCommand } from "@ohmyhost/sdk-ts";
+import type { ManagedMailCommand, SharedMailCommand } from "@ohmyhost/sdk-ts";
 import { USER_API_KEY_ID } from "@ohmyhost/contracts/user-api-keys";
 import { WORKOS_USER_API_KEY_PATTERN } from "@ohmyhost/workos-auth-contracts/user-api-keys";
 import { isProfileName, isProfileUserId } from "./profile-store.js";
@@ -536,6 +536,12 @@ export type ProductCliCommand =
       readonly wait: boolean;
       readonly credentialStore: "native";
     }
+  | {
+      readonly kind: "shared-mail";
+      readonly request: SharedMailCommand;
+      readonly label: SharedMailCommandLabel;
+      readonly credentialStore: "native";
+    }
   | {
       readonly kind: "managed-mail";
       readonly request: ManagedMailCommand;
@@ -902,7 +908,27 @@ export type RecognizedCommandLabel =
   | "mail messages retry"
   | "mail domain set"
   | "mail domain status"
-  | "mail domain delete";
+  | "mail domain delete"
+  | SharedMailCommandLabel;
+
+export type SharedMailCommandLabel =
+  | "mail workspace list"
+  | "mail workspace create"
+  | "mail workspace status"
+  | "mail workspace retire"
+  | "mail workspace dns-authorize"
+  | "mail workspace dns-status"
+  | "mail workspace dns-revoke"
+  | "mail binding get"
+  | "mail binding set"
+  | "mail binding detach"
+  | "mail identity get"
+  | "mail identity declare"
+  | "mail identity verify"
+  | "mail identity revoke"
+  | "mail identity authorize"
+  | "mail identity authorization-status"
+  | "mail identity authorization-revoke";
 
 export const recognizedCommandLabel = (argv: readonly string[]): RecognizedCommandLabel => {
   const values = [...argv];
@@ -1052,6 +1078,11 @@ export const recognizedCommandLabel = (argv: readonly string[]): RecognizedComma
     }
     if (value === "function" && values[0] === "runs") return "function runs";
     if (value === "mail") {
+      if (["workspace", "binding", "identity"].includes(values[0] ?? "")) {
+        const candidate = `mail ${values[0]} ${values[1]}`;
+        if (SHARED_MAIL_LABELS.includes(candidate as SharedMailCommandLabel))
+          return candidate as SharedMailCommandLabel;
+      }
       if (values[0] === "setup") return "mail setup";
       if (values[0] === "status") return "mail status";
       if (values[0] === "webhook") {
@@ -2328,6 +2359,10 @@ export const parseProductCliCommand = (argv: readonly string[]): ProductCliComma
     }
     throw new InvalidCommandError();
   }
+  if (first === "mail" && ["workspace", "binding", "identity"].includes(values[0] ?? "")) {
+    if (wait || follow || stdin) throw new InvalidCommandError();
+    return parseSharedMailCommand(values, yes);
+  }
   if (first === "mail") {
     const area = values.shift();
     const sub =
@@ -2538,3 +2573,194 @@ const validPaidHostname = (value: string): boolean =>
   !value.endsWith(".omh.st") &&
   value !== "ohmyho.st" &&
   !value.endsWith(".ohmyho.st");
+
+const SHARED_MAIL_LABELS: readonly SharedMailCommandLabel[] = [
+  "mail workspace list",
+  "mail workspace create",
+  "mail workspace status",
+  "mail workspace retire",
+  "mail workspace dns-authorize",
+  "mail workspace dns-status",
+  "mail workspace dns-revoke",
+  "mail binding get",
+  "mail binding set",
+  "mail binding detach",
+  "mail identity get",
+  "mail identity declare",
+  "mail identity verify",
+  "mail identity revoke",
+  "mail identity authorize",
+  "mail identity authorization-status",
+  "mail identity authorization-revoke",
+];
+
+/** New workspace sender operations stay separate from the exact legacy project mail contract. */
+function parseSharedMailCommand(values: string[], yes: boolean): ProductCliCommand {
+  const area = values.shift(),
+    operation = values.shift();
+  const label = `mail ${area} ${operation}` as SharedMailCommandLabel;
+  if (!SHARED_MAIL_LABELS.includes(label)) throw new InvalidCommandError();
+  const destructive =
+    operation === "retire" ||
+    operation === "detach" ||
+    operation === "revoke" ||
+    operation === "dns-revoke" ||
+    operation === "authorization-revoke";
+  if (yes !== destructive) throw new InvalidCommandError();
+  const allowed = area === "workspace" ? ["--organization"] : ["--project"];
+  const writing = [
+    "create",
+    "retire",
+    "dns-authorize",
+    "dns-revoke",
+    "set",
+    "detach",
+    "declare",
+    "verify",
+    "revoke",
+    "authorize",
+    "authorization-revoke",
+  ].includes(operation ?? "");
+  if (area === "workspace" && operation !== "list" && operation !== "create")
+    allowed.push("--mail-domain");
+  if (area === "binding") allowed.push("--environment");
+  if (operation === "create") allowed.push("--domain", "--sending");
+  if (area === "binding" && operation === "set")
+    allowed.push(
+      "--mail-domain",
+      "--sending",
+      "--sender-addresses",
+      "--default-from",
+      "--reply-to",
+    );
+  if (operation === "declare") allowed.push("--hostname");
+  if (operation === "authorize" || operation === "dns-authorize") allowed.push("--zone");
+  if (writing) allowed.push("--idempotency-key");
+  if (writing && operation !== "create" && operation !== "declare")
+    allowed.push("--expected-revision");
+  const options = parseOptionalOptions(values, allowed);
+  const required = (key: keyof typeof options) => {
+    const value = options[key];
+    if (!value) throw new InvalidCommandError();
+    return value;
+  };
+  const revision = () => {
+    const value = required("--expected-revision");
+    if (!/^(?:0|[1-9][0-9]*)$/u.test(value) || !Number.isSafeInteger(Number(value)))
+      throw new InvalidCommandError();
+    return Number(value);
+  };
+  const sending = () => {
+    const value = required("--sending");
+    if (value !== "true" && value !== "false") throw new InvalidCommandError();
+    return value === "true";
+  };
+  const idempotencyKey = () => required("--idempotency-key");
+  let request: SharedMailCommand;
+  if (area === "workspace") {
+    const scope = { organizationId: required("--organization") };
+    if (operation === "list") request = { ...scope, action: "domains_list" };
+    else if (operation === "create") {
+      const enabled = sending();
+      if (!enabled) throw new InvalidCommandError();
+      request = {
+        ...scope,
+        action: "domain_create",
+        domain: required("--domain"),
+        sending: enabled,
+        idempotencyKey: idempotencyKey(),
+      };
+    } else {
+      const target = { ...scope, mailDomainId: required("--mail-domain") };
+      if (operation === "status") request = { ...target, action: "domain_get" };
+      else if (operation === "dns-status") request = { ...target, action: "domain_dns_status" };
+      else if (operation === "dns-revoke")
+        request = {
+          ...target,
+          action: "domain_dns_revoke",
+          expectedRevision: revision(),
+          idempotencyKey: idempotencyKey(),
+        };
+      else if (operation === "retire")
+        request = {
+          ...target,
+          action: "domain_retire",
+          expectedRevision: revision(),
+          idempotencyKey: idempotencyKey(),
+        };
+      else
+        request = {
+          ...target,
+          action: "domain_dns_authorize",
+          expectedRevision: revision(),
+          zone: required("--zone"),
+          idempotencyKey: idempotencyKey(),
+        };
+    }
+  } else if (area === "binding") {
+    const scope = { projectId: required("--project"), environmentId: required("--environment") };
+    if (operation === "get") request = { ...scope, action: "binding_get" };
+    else if (operation === "detach")
+      request = {
+        ...scope,
+        action: "binding_detach",
+        expectedRevision: revision(),
+        idempotencyKey: idempotencyKey(),
+      };
+    else {
+      const senderAddresses = required("--sender-addresses").split(",");
+      if (
+        senderAddresses.length > 32 ||
+        senderAddresses.some((address) => !address || address.trim() !== address) ||
+        new Set(senderAddresses).size !== senderAddresses.length
+      )
+        throw new InvalidCommandError();
+      request = {
+        ...scope,
+        action: "binding_set",
+        mailDomainId: required("--mail-domain"),
+        sending: sending(),
+        senderAddresses,
+        defaultFrom: required("--default-from"),
+        defaultReplyTo: options["--reply-to"] ?? null,
+        expectedRevision: revision(),
+        idempotencyKey: idempotencyKey(),
+      };
+    }
+  } else {
+    const scope = { projectId: required("--project") };
+    if (operation === "get") request = { ...scope, action: "identity_get" };
+    else if (operation === "authorization-status")
+      request = { ...scope, action: "identity_authorization_status" };
+    else if (operation === "authorization-revoke")
+      request = {
+        ...scope,
+        action: "identity_authorization_revoke",
+        expectedRevision: revision(),
+        idempotencyKey: idempotencyKey(),
+      };
+    else if (operation === "declare")
+      request = {
+        ...scope,
+        action: "identity_declare",
+        hostname: required("--hostname"),
+        idempotencyKey: idempotencyKey(),
+      };
+    else if (operation === "authorize")
+      request = {
+        ...scope,
+        action: "identity_authorize",
+        zone: required("--zone"),
+        expectedRevision: revision(),
+        idempotencyKey: idempotencyKey(),
+      };
+    else
+      request = {
+        ...scope,
+        action: operation === "verify" ? "identity_verify" : "identity_revoke",
+        expectedRevision: revision(),
+        idempotencyKey: idempotencyKey(),
+      };
+  }
+  return { kind: "shared-mail", request, label, credentialStore: "native" };
+}

package/src/apps/product-cli/src/composition.ts

@@ -528,6 +528,8 @@ const readTokenIdentity = async (input: {
 /** The organization a command names explicitly; `organization use` names its target instead. */
 const commandOrganizationId = (command: ProductCliCommand): string | undefined => {
   if (command.kind === "organization-use" || command.kind === "login") return undefined;
+  if (command.kind === "shared-mail" && "organizationId" in command.request)
+    return command.request.organizationId;
   if (command.kind === "feedback-submit") return command.report.organization_id;
   return "organizationId" in command && typeof command.organizationId === "string"
     ? command.organizationId
@@ -535,6 +537,8 @@ const commandOrganizationId = (command: ProductCliCommand): string | undefined =
 };
 
 const commandProjectId = (command: ProductCliCommand): string | undefined => {
+  if (command.kind === "shared-mail")
+    return "projectId" in command.request ? command.request.projectId : undefined;
   if (command.kind === "managed-mail") return command.request.projectId;
   return "projectId" in command && typeof command.projectId === "string"
     ? command.projectId

package/src/apps/product-cli/src/product-api.ts

@@ -1,4 +1,9 @@
-import { executeManagedMail, type ManagedMailCommand } from "@ohmyhost/sdk-ts";
+import {
+  executeManagedMail,
+  executeSharedMail,
+  type ManagedMailCommand,
+  type SharedMailCommand,
+} from "@ohmyhost/sdk-ts";
 import type {
   ProjectDataChangeKind,
   ProjectDataChangePlan,
@@ -434,6 +439,7 @@ export interface ProductApi {
     readonly name: string;
     readonly idempotencyKey: string;
   }): Promise<DeleteEnvironmentSecretResult>;
+  sharedMail?(input: SharedMailCommand): Promise<unknown>;
   managedMail?(input: ManagedMailCommand): Promise<unknown>;
 }
 
@@ -1237,6 +1243,10 @@ export class GeneratedSdkProductApi implements ProductApi {
     );
   }
 
+  public sharedMail(input: SharedMailCommand) {
+    return executeSharedMail(this.#client, input);
+  }
+
   public managedMail(input: ManagedMailCommand) {
     return executeManagedMail(this.#client, input);
   }

package/src/packages/contracts/package.json

@@ -5,6 +5,11 @@
   "type": "module",
   "sideEffects": false,
   "exports": {
+    "./shared-mail": {
+      "source": "./src/shared-mail.ts",
+      "types": "./dist/shared-mail.d.ts",
+      "import": "./dist/shared-mail.js"
+    },
     "./mcp-source-codec": {
       "source": "./src/mcp-source-codec.ts",
       "types": "./dist/mcp-source-codec.d.ts",

package/src/packages/contracts/src/problem-policy.ts

@@ -313,14 +313,14 @@ export const PROBLEM_POLICY = {
     status: 409,
     retryable: false,
     action:
-      "Use the sender domain already configured for this project, or retire it with 'ohmyhost mail domain delete' (repeat while the removal is pending) and then set up the new domain; a domain registered to another project cannot be set up.",
+      "Read the workspace sender resource and project binding. Reuse requires explicit domain-use authority, target-project editing and a current verified application identity with the same registrable main domain. Read the current revision before changing settings. Detach a shared project binding explicitly; legacy domain deletion cannot retire a resource used by another project.",
     title: "Mail domain conflict",
   },
   mail_domain_required: {
     status: 409,
     retryable: false,
     action:
-      "This app declares mail.enabled. Configure the project's own sender domain with 'ohmyhost mail setup' using its Prod environment ID, or set mail.enabled to false if the app sends no mail, then plan again.",
+      "This app declares mail.enabled. Configure a sender with 'ohmyhost mail setup' or explicitly attach an authorized workspace sender using the project's Prod environment ID. Reuse first requires proof of the intended application hostname with the same registrable main domain; declare and verify that identity before mail-gated deployment. Then plan again.",
     title: "Mail domain required",
   },
   storage_jurisdiction_conflict: {

package/src/packages/contracts/src/shared-mail.ts

@@ -0,0 +1,236 @@
+export interface SharedMailResponseContext {
+  readonly action: string;
+  readonly organizationId?: string;
+  readonly projectId?: string;
+  readonly environmentId?: string;
+  readonly mailDomainId?: string;
+}
+const ULID = /^[0-7][0-9A-HJKMNP-TV-Z]{25}$/u;
+const HOST = /^(?=.{1,253}$)(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\.)+[a-z]{2,63}$/u;
+
+/** Strict validation keeps provider data and out-of-scope resources out of client guidance. */
+export function assertSharedMailResponse(value: unknown, input: SharedMailResponseContext): void {
+  const v = object(value);
+  if (input.action === "domains_list") {
+    exact(v, ["items"]);
+    if (!Array.isArray(v["items"]) || v["items"].length > 100) invalid();
+    for (const item of v["items"])
+      assertSharedMailResponse(item, {
+        ...input,
+        action: "domain_get",
+        mailDomainId: String(object(item)["domain_id"]),
+      });
+    return;
+  }
+  if (["domain_get", "domain_create", "domain_retire"].includes(input.action)) {
+    exact(v, [
+      "domain_id",
+      "organization_id",
+      "domain",
+      "registrable_domain",
+      "revision",
+      "status",
+      "sending",
+      "receiving",
+      "configured_at",
+      "observed_at",
+      "dns_records",
+      "bindings_count",
+    ]);
+    id(v["domain_id"]);
+    id(v["organization_id"]);
+    if (
+      !("organizationId" in input) ||
+      v["organization_id"] !== input.organizationId ||
+      ("mailDomainId" in input && v["domain_id"] !== input.mailDomainId)
+    )
+      invalid();
+    host(v["domain"]);
+    host(v["registrable_domain"]);
+    positive(v["revision"]);
+    member(v["status"], ["active", "retiring", "retired"]);
+    for (const k of ["sending", "receiving"])
+      member(v[k], ["disabled", "pending", "ready", "failed"]);
+    time(v["configured_at"]);
+    if (v["observed_at"] !== null) time(v["observed_at"]);
+    if (!Number.isSafeInteger(v["bindings_count"]) || Number(v["bindings_count"]) < 0) invalid();
+    if (!Array.isArray(v["dns_records"])) invalid();
+    for (const entry of v["dns_records"]) {
+      const r = object(entry);
+      exact(r, ["type", "name", "value", "purpose", "status"], ["priority"]);
+      member(r["type"], ["TXT", "MX", "CNAME"]);
+      for (const k of ["name", "value", "purpose", "status"])
+        if (typeof r[k] !== "string" || /[\r\n\0]/u.test(r[k])) invalid();
+      if (
+        r["priority"] !== undefined &&
+        (!Number.isSafeInteger(r["priority"]) ||
+          Number(r["priority"]) < 0 ||
+          Number(r["priority"]) > 65535)
+      )
+        invalid();
+      if (r["type"] === "MX" && r["priority"] === undefined) invalid();
+    }
+    return;
+  }
+  if (["binding_get", "binding_set", "binding_detach"].includes(input.action)) {
+    exact(v, [
+      "mail_domain_id",
+      "organization_id",
+      "project_id",
+      "environment_id",
+      "revision",
+      "sending",
+      "sender_addresses",
+      "default_from",
+      "default_reply_to",
+      "legacy",
+      "status",
+      "application_domain_identity",
+    ]);
+    for (const k of ["mail_domain_id", "organization_id", "project_id", "environment_id"]) id(v[k]);
+    if (
+      !("projectId" in input) ||
+      !("environmentId" in input) ||
+      v["project_id"] !== input.projectId ||
+      v["environment_id"] !== input.environmentId ||
+      ("mailDomainId" in input && v["mail_domain_id"] !== input.mailDomainId)
+    )
+      invalid();
+    positive(v["revision"]);
+    for (const k of ["sending", "legacy"]) if (typeof v[k] !== "boolean") invalid();
+    member(v["status"], ["active", "detached", "suspended"]);
+    if (
+      !Array.isArray(v["sender_addresses"]) ||
+      v["sender_addresses"].length > 32 ||
+      new Set(v["sender_addresses"]).size !== v["sender_addresses"].length
+    )
+      invalid();
+    for (const a of v["sender_addresses"]) mailbox(a);
+    for (const k of ["default_from", "default_reply_to"]) if (v[k] !== null) mailbox(v[k]);
+    if (
+      !v["legacy"] &&
+      (!v["sender_addresses"].includes(v["default_from"]) || v["sender_addresses"].length === 0)
+    )
+      invalid();
+    if (v["application_domain_identity"] !== null) {
+      const identity = object(v["application_domain_identity"]);
+      exact(identity, ["hostname", "registrable_domain", "revision", "status"]);
+      host(identity["hostname"]);
+      host(identity["registrable_domain"]);
+      positive(identity["revision"]);
+      member(identity["status"], ["pending", "verified", "expired", "revoked"]);
+    }
+    return;
+  }
+  if (
+    ["identity_get", "identity_declare", "identity_verify", "identity_revoke"].includes(
+      input.action,
+    )
+  ) {
+    exact(v, [
+      "organization_id",
+      "project_id",
+      "hostname",
+      "registrable_domain",
+      "status",
+      "revision",
+      "challenge",
+      "verified_at",
+      "expires_at",
+    ]);
+    id(v["organization_id"]);
+    id(v["project_id"]);
+    if (!("projectId" in input) || v["project_id"] !== input.projectId) invalid();
+    host(v["hostname"]);
+    host(v["registrable_domain"]);
+    positive(v["revision"]);
+    member(v["status"], ["pending", "verified", "expired", "revoked"]);
+    const challenge = object(v["challenge"]);
+    exact(challenge, ["type", "name", "value"]);
+    if (
+      challenge["type"] !== "TXT" ||
+      typeof challenge["name"] !== "string" ||
+      challenge["name"] !== `_omh-project.${v["hostname"]}` ||
+      typeof challenge["value"] !== "string" ||
+      challenge["value"].length < 16 ||
+      challenge["value"].length > 255 ||
+      /[\r\n\0]/u.test(challenge["value"])
+    )
+      invalid();
+    if (v["verified_at"] !== null) time(v["verified_at"]);
+    time(v["expires_at"]);
+    return;
+  }
+  if (input.action === "domain_dns_authorize" || input.action === "identity_authorize") {
+    exact(v, ["authorization_id", "authorization_url", "expires_at"]);
+    id(v["authorization_id"]);
+    time(v["expires_at"]);
+    if (
+      typeof v["authorization_url"] !== "string" ||
+      !/^https:\/\/dash\.cloudflare\.com\/oauth2\/auth\?/u.test(v["authorization_url"])
+    )
+      invalid();
+    return;
+  }
+  exact(v, ["status", "zone", "scopes", "expires_at"]);
+  member(v["status"], ["not_authorized", "pending", "authorized", "expired", "revoked"]);
+  if (
+    !Array.isArray(v["scopes"]) ||
+    v["scopes"].length > 2 ||
+    new Set(v["scopes"]).size !== v["scopes"].length ||
+    v["scopes"].some((s) => s !== "dns.write" && s !== "zone.read")
+  )
+    invalid();
+  if (v["zone"] !== null) host(v["zone"]);
+  if (v["expires_at"] !== null) time(v["expires_at"]);
+  if (
+    v["status"] === "not_authorized" &&
+    (v["zone"] !== null || v["expires_at"] !== null || v["scopes"].length)
+  )
+    invalid();
+}
+function object(v: unknown): Record<string, unknown> {
+  if (v === null || typeof v !== "object" || Array.isArray(v)) invalid();
+  return v as Record<string, unknown>;
+}
+function exact(
+  v: Record<string, unknown>,
+  required: readonly string[],
+  optional: readonly string[] = [],
+) {
+  if (
+    required.some((k) => !(k in v)) ||
+    Object.keys(v).some((k) => !required.includes(k) && !optional.includes(k))
+  )
+    invalid();
+}
+function member(v: unknown, values: readonly string[]) {
+  if (typeof v !== "string" || !values.includes(v)) invalid();
+}
+function id(v: unknown) {
+  if (typeof v !== "string" || !ULID.test(v)) invalid();
+}
+function host(v: unknown) {
+  if (typeof v !== "string" || !HOST.test(v)) invalid();
+}
+function positive(v: unknown) {
+  if (!Number.isSafeInteger(v) || Number(v) < 1) invalid();
+}
+function time(v: unknown) {
+  if (typeof v !== "string" || !Number.isFinite(Date.parse(v)) || new Date(v).toISOString() !== v)
+    invalid();
+}
+function mailbox(v: unknown) {
+  if (
+    typeof v !== "string" ||
+    v.length > 254 ||
+    !/^[A-Za-z0-9.!#$%&'*+\-/=?^_`{|}~]+@[a-z0-9.-]+\.[a-z]{2,63}$/u.test(v) ||
+    v.startsWith(".") ||
+    v.includes("..") ||
+    v.includes(".@")
+  )
+    invalid();
+}
+function invalid(): never {
+  throw new TypeError("Shared mail response contract invalid");
+}