@amerged/ohmyhost-cli 0.1.36 → 0.1.38

package/dist/{chunk-LU7ONYZG.js → chunk-EWKJGJQU.js}

@@ -35,8 +35,8 @@ var require_ignore = __commonJS({
       TMP_KEY_IGNORE = /* @__PURE__ */ Symbol.for("node-ignore");
     }
     var KEY_IGNORE = TMP_KEY_IGNORE;
-    var define2 = (object3, key, value) => {
-      Object.defineProperty(object3, key, { value });
+    var define2 = (object4, key, value) => {
+      Object.defineProperty(object4, key, { value });
       return value;
     };
     var RETURN_FALSE = () => false;
@@ -1937,13 +1937,13 @@ var require_for_each = __commonJS({
         }
       }
     };
-    var forEachObject = function forEachObject2(object3, iterator, receiver) {
-      for (var k in object3) {
-        if (hasOwnProperty.call(object3, k)) {
+    var forEachObject = function forEachObject2(object4, iterator, receiver) {
+      for (var k in object4) {
+        if (hasOwnProperty.call(object4, k)) {
           if (receiver == null) {
-            iterator(object3[k], k, object3);
+            iterator(object4[k], k, object4);
           } else {
-            iterator.call(receiver, object3[k], k, object3);
+            iterator.call(receiver, object4[k], k, object4);
           }
         }
       }
@@ -7219,7 +7219,7 @@ var require_ignore2 = __commonJS({
       TMP_KEY_IGNORE = /* @__PURE__ */ Symbol.for("node-ignore");
     }
     var KEY_IGNORE = TMP_KEY_IGNORE;
-    var define2 = (object3, key, value) => Object.defineProperty(object3, key, { value });
+    var define2 = (object4, key, value) => Object.defineProperty(object4, key, { value });
     var REGEX_REGEXP_RANGE = /([0-z])-([0-z])/g;
     var RETURN_FALSE = () => false;
     var sanitizeRange = (range) => range.replace(
@@ -9840,15 +9840,15 @@ If you're a developer and you believe this is a bug in isomorphic-git, please fi
        * @param {Uint8Array} params.object - The raw object data to wrap.
        * @returns {Uint8Array} The wrapped Git object as a single buffer.
        */
-      static wrap({ type, object: object3 }) {
-        const header = `${type} ${object3.length}\0`;
+      static wrap({ type, object: object4 }) {
+        const header = `${type} ${object4.length}\0`;
         const headerLen = header.length;
-        const totalLength = headerLen + object3.length;
+        const totalLength = headerLen + object4.length;
         const wrappedObject = new Uint8Array(totalLength);
         for (let i = 0; i < headerLen; i++) {
           wrappedObject[i] = header.charCodeAt(i);
         }
-        wrappedObject.set(object3, headerLen);
+        wrappedObject.set(object4, headerLen);
         return wrappedObject;
       }
       /**
@@ -10339,9 +10339,9 @@ If you're a developer and you believe this is a bug in isomorphic-git, please fi
           try {
             p.readDepth = 0;
             p.externalReadDepth = 0;
-            const { type, object: object3 } = await p.readSlice({ start: offset });
+            const { type, object: object4 } = await p.readSlice({ start: offset });
             objectsByDepth[p.readDepth] += 1;
-            const oid = await shasum(GitObject.wrap({ type, object: object3 }));
+            const oid = await shasum(GitObject.wrap({ type, object: object4 }));
             o.oid = oid;
             hashes.push(oid);
             offsets.set(oid, offset);
@@ -10441,7 +10441,7 @@ If you're a developer and you believe this is a bug in isomorphic-git, please fi
           length = otherVarIntDecode(reader, lastFour);
         }
         let base = null;
-        let object3 = null;
+        let object4 = null;
         if (type === "ofs_delta") {
           const offset = decodeVarInt(reader);
           const baseOffset = start - offset;
@@ -10452,19 +10452,19 @@ If you're a developer and you believe this is a bug in isomorphic-git, please fi
           ({ object: base, type } = await this.read({ oid }));
         }
         const buffer = raw.slice(reader.tell());
-        object3 = Buffer.from(await inflate(buffer));
-        if (object3.byteLength !== length) {
+        object4 = Buffer.from(await inflate(buffer));
+        if (object4.byteLength !== length) {
           throw new InternalError(
-            `Packfile told us object would have length ${length} but it had length ${object3.byteLength}`
+            `Packfile told us object would have length ${length} but it had length ${object4.byteLength}`
           );
         }
         if (base) {
-          object3 = Buffer.from(applyDelta(object3, base));
+          object4 = Buffer.from(applyDelta(object4, base));
         }
         if (this.readDepth > 3) {
-          this.offsetCache[start] = { type, object: object3 };
+          this.offsetCache[start] = { type, object: object4 };
         }
-        return { type, format: "content", object: object3 };
+        return { type, format: "content", object: object4 };
       }
     };
     var PackfileCache = /* @__PURE__ */ Symbol("PackfileCache");
@@ -10614,9 +10614,9 @@ If you're a developer and you believe this is a bug in isomorphic-git, please fi
           `SHA check failed! Expected ${oid}, computed ${sha}`
         );
       }
-      const { object: object3, type } = GitObject.unwrap(result.object);
+      const { object: object4, type } = GitObject.unwrap(result.object);
       result.type = type;
-      result.object = object3;
+      result.object = object4;
       result.format = "content";
       return result;
     }
@@ -11308,19 +11308,19 @@ ${obj.gpgsig ? obj.gpgsig : ""}`;
       if (oid === "4b825dc642cb6eb9a060e54bf8d69288fbee4904") {
         return { tree: GitTree.from([]), oid };
       }
-      const { type, object: object3 } = await _readObject({ fs: fs3, cache, gitdir, oid });
+      const { type, object: object4 } = await _readObject({ fs: fs3, cache, gitdir, oid });
       if (type === "tag") {
-        oid = GitAnnotatedTag.from(object3).parse().object;
+        oid = GitAnnotatedTag.from(object4).parse().object;
         return resolveTree({ fs: fs3, cache, gitdir, oid });
       }
       if (type === "commit") {
-        oid = GitCommit.from(object3).parse().tree;
+        oid = GitCommit.from(object4).parse().tree;
         return resolveTree({ fs: fs3, cache, gitdir, oid });
       }
       if (type !== "tree") {
         throw new ObjectTypeError(oid, type, "tree");
       }
-      return { tree: GitTree.from(object3), oid };
+      return { tree: GitTree.from(object4), oid };
     }
     var GitWalkerRepo = class {
       constructor({ fs: fs3, gitdir, ref, cache }) {
@@ -11383,11 +11383,11 @@ ${obj.gpgsig ? obj.gpgsig : ""}`;
         if (obj.type !== "tree") {
           return null;
         }
-        const { type, object: object3 } = await _readObject({ fs: fs3, cache, gitdir, oid });
+        const { type, object: object4 } = await _readObject({ fs: fs3, cache, gitdir, oid });
         if (type !== obj.type) {
           throw new ObjectTypeError(oid, type, obj.type);
         }
-        const tree = GitTree.from(object3);
+        const tree = GitTree.from(object4);
         for (const entry2 of tree) {
           map.set(join7(filepath, entry2.path), entry2);
         }
@@ -11417,11 +11417,11 @@ ${obj.gpgsig ? obj.gpgsig : ""}`;
           const { fs: fs3, cache, gitdir } = this;
           const obj = map.get(entry._fullpath);
           const oid = obj.oid;
-          const { type, object: object3 } = await _readObject({ fs: fs3, cache, gitdir, oid });
+          const { type, object: object4 } = await _readObject({ fs: fs3, cache, gitdir, oid });
           if (type !== "blob") {
             entry._content = void 0;
           } else {
-            entry._content = new Uint8Array(object3);
+            entry._content = new Uint8Array(object4);
           }
         }
         return entry._content;
@@ -12201,7 +12201,7 @@ ${obj.gpgsig ? obj.gpgsig : ""}`;
         return ignoredStatus;
       }
     };
-    async function writeObjectLoose({ fs: fs3, gitdir, object: object3, format, oid }) {
+    async function writeObjectLoose({ fs: fs3, gitdir, object: object4, format, oid }) {
       if (format !== "deflated") {
         throw new InternalError(
           "GitObjectStoreLoose expects objects to write to be in deflated format"
@@ -12209,7 +12209,7 @@ ${obj.gpgsig ? obj.gpgsig : ""}`;
       }
       const source = `objects/${oid.slice(0, 2)}/${oid.slice(2)}`;
       const filepath = `${gitdir}/${source}`;
-      if (!await fs3.exists(filepath)) await fs3.write(filepath, object3);
+      if (!await fs3.exists(filepath)) await fs3.write(filepath, object4);
     }
     var supportsCompressionStream = null;
     async function deflate(buffer) {
@@ -12238,20 +12238,20 @@ ${obj.gpgsig ? obj.gpgsig : ""}`;
       fs: fs3,
       gitdir,
       type,
-      object: object3,
+      object: object4,
       format = "content",
       oid = void 0,
       dryRun = false
     }) {
       if (format !== "deflated") {
         if (format !== "wrapped") {
-          object3 = GitObject.wrap({ type, object: object3 });
+          object4 = GitObject.wrap({ type, object: object4 });
         }
-        oid = await shasum(object3);
-        object3 = Buffer.from(await deflate(object3));
+        oid = await shasum(object4);
+        object4 = Buffer.from(await deflate(object4));
       }
       if (!dryRun) {
-        await writeObjectLoose({ fs: fs3, gitdir, object: object3, format: "deflated", oid });
+        await writeObjectLoose({ fs: fs3, gitdir, object: object4, format: "deflated", oid });
       }
       return oid;
     }
@@ -12360,9 +12360,9 @@ ${obj.gpgsig ? obj.gpgsig : ""}`;
             }
           }
         } else {
-          const object3 = stats.isSymbolicLink() ? await fs3.readlink(join7(dir, currentFilepath)).then(posixifyPathBuffer) : await fs3.read(join7(dir, currentFilepath), { autocrlf });
-          if (object3 === null) throw new NotFoundError(currentFilepath);
-          const oid = await _writeObject({ fs: fs3, gitdir, type: "blob", object: object3 });
+          const object4 = stats.isSymbolicLink() ? await fs3.readlink(join7(dir, currentFilepath)).then(posixifyPathBuffer) : await fs3.read(join7(dir, currentFilepath), { autocrlf });
+          if (object4 === null) throw new NotFoundError(currentFilepath);
+          const oid = await _writeObject({ fs: fs3, gitdir, type: "blob", object: object4 });
           index2.insert({ filepath: currentFilepath, stats, oid });
         }
       });
@@ -12442,15 +12442,15 @@ ${obj.gpgsig ? obj.gpgsig : ""}`;
       return normalizedCommitter;
     }
     async function resolveCommit({ fs: fs3, cache, gitdir, oid }) {
-      const { type, object: object3 } = await _readObject({ fs: fs3, cache, gitdir, oid });
+      const { type, object: object4 } = await _readObject({ fs: fs3, cache, gitdir, oid });
       if (type === "tag") {
-        oid = GitAnnotatedTag.from(object3).parse().object;
+        oid = GitAnnotatedTag.from(object4).parse().object;
         return resolveCommit({ fs: fs3, cache, gitdir, oid });
       }
       if (type !== "commit") {
         throw new ObjectTypeError(oid, type, "commit");
       }
-      return { commit: GitCommit.from(object3), oid };
+      return { commit: GitCommit.from(object4), oid };
     }
     async function _readCommit({ fs: fs3, cache, gitdir, oid }) {
       const { commit: commit3, oid: commitOid } = await resolveCommit({
@@ -12671,7 +12671,7 @@ ${obj.gpgsig ? obj.gpgsig : ""}`;
           if (pathArray.length === 0) {
             return entry;
           } else {
-            const { type, object: object3 } = await _readObject({
+            const { type, object: object4 } = await _readObject({
               fs: fs3,
               cache,
               gitdir,
@@ -12680,7 +12680,7 @@ ${obj.gpgsig ? obj.gpgsig : ""}`;
             if (type !== "tree") {
               throw new ObjectTypeError(oid, type, "tree", filepath);
             }
-            tree = GitTree.from(object3);
+            tree = GitTree.from(object4);
             return _resolveFilepath({
               fs: fs3,
               cache,
@@ -12713,12 +12713,12 @@ ${obj.gpgsig ? obj.gpgsig : ""}`;
       return result;
     }
     async function _writeTree({ fs: fs3, gitdir, tree }) {
-      const object3 = GitTree.from(tree).toObject();
+      const object4 = GitTree.from(tree).toObject();
       const oid = await _writeObject({
         fs: fs3,
         gitdir,
         type: "tree",
-        object: object3,
+        object: object4,
         format: "content"
       });
       return oid;
@@ -12899,7 +12899,7 @@ ${obj.gpgsig ? obj.gpgsig : ""}`;
       tagger,
       message = ref,
       gpgsig,
-      object: object3,
+      object: object4,
       signingKey,
       force = false
     }) {
@@ -12910,7 +12910,7 @@ ${obj.gpgsig ? obj.gpgsig : ""}`;
       const oid = await GitRefManager.resolve({
         fs: fs3,
         gitdir,
-        ref: object3 || "HEAD"
+        ref: object4 || "HEAD"
       });
       const { type } = await _readObject({ fs: fs3, cache, gitdir, oid });
       let tagObject = GitAnnotatedTag.from({
@@ -12941,7 +12941,7 @@ ${obj.gpgsig ? obj.gpgsig : ""}`;
       tagger: _tagger,
       message = ref,
       gpgsig,
-      object: object3,
+      object: object4,
       signingKey,
       force = false,
       cache = {}
@@ -12970,7 +12970,7 @@ ${obj.gpgsig ? obj.gpgsig : ""}`;
           tagger,
           message,
           gpgsig,
-          object: object3,
+          object: object4,
           signingKey,
           force
         });
@@ -12983,7 +12983,7 @@ ${obj.gpgsig ? obj.gpgsig : ""}`;
       fs: fs3,
       gitdir,
       ref,
-      object: object3,
+      object: object4,
       checkout: checkout2 = false,
       force = false
     }) {
@@ -12999,7 +12999,7 @@ ${obj.gpgsig ? obj.gpgsig : ""}`;
       }
       let oid;
       try {
-        oid = await GitRefManager.resolve({ fs: fs3, gitdir, ref: object3 || "HEAD" });
+        oid = await GitRefManager.resolve({ fs: fs3, gitdir, ref: object4 || "HEAD" });
       } catch (e) {
       }
       if (oid) {
@@ -13019,7 +13019,7 @@ ${obj.gpgsig ? obj.gpgsig : ""}`;
       dir,
       gitdir = join7(dir, ".git"),
       ref,
-      object: object3,
+      object: object4,
       checkout: checkout2 = false,
       force = false
     }) {
@@ -13033,7 +13033,7 @@ ${obj.gpgsig ? obj.gpgsig : ""}`;
           fs: fsp,
           gitdir: updatedGitdir,
           ref,
-          object: object3,
+          object: object4,
           checkout: checkout2,
           force
         });
@@ -13270,7 +13270,7 @@ ${obj.gpgsig ? obj.gpgsig : ""}`;
                   const filepath = `${dir}/${fullpath}`;
                   if (method !== "create-index" && method !== "mkdir-index") {
                     await assertNoSymlinkInLeadingPath(fs3, dir, fullpath);
-                    const { object: object3 } = await _readObject({
+                    const { object: object4 } = await _readObject({
                       fs: fs3,
                       cache,
                       gitdir,
@@ -13280,11 +13280,11 @@ ${obj.gpgsig ? obj.gpgsig : ""}`;
                       await fs3.rm(filepath);
                     }
                     if (mode === 33188) {
-                      await fs3.write(filepath, object3);
+                      await fs3.write(filepath, object4);
                     } else if (mode === 33261) {
-                      await fs3.write(filepath, object3, { mode: 511 });
+                      await fs3.write(filepath, object4, { mode: 511 });
                     } else if (mode === 40960) {
-                      await fs3.writelink(filepath, object3);
+                      await fs3.writelink(filepath, object4);
                     } else {
                       throw new InternalError(
                         `Invalid mode 0o${mode.toString(
@@ -13621,16 +13621,16 @@ ${obj.gpgsig ? obj.gpgsig : ""}`;
       const filepath = `${dir}/${fullpath}`;
       if (method !== "create-index" && method !== "mkdir-index") {
         await assertNoSymlinkInLeadingPath(fs3, dir, fullpath);
-        const { object: object3 } = await _readObject({ fs: fs3, cache, gitdir, oid });
+        const { object: object4 } = await _readObject({ fs: fs3, cache, gitdir, oid });
         if (chmod2) {
           await fs3.rm(filepath);
         }
         if (mode === 33188) {
-          await fs3.write(filepath, object3);
+          await fs3.write(filepath, object4);
         } else if (mode === 33261) {
-          await fs3.write(filepath, object3, { mode: 511 });
+          await fs3.write(filepath, object4, { mode: 511 });
         } else if (mode === 40960) {
-          await fs3.writelink(filepath, object3);
+          await fs3.writelink(filepath, object4);
         } else {
           throw new InternalError(
             `Invalid mode 0o${mode.toString(8)} detected in blob ${oid}`
@@ -13929,12 +13929,12 @@ ${obj.gpgsig ? obj.gpgsig : ""}`;
             return;
           if (entries.length > 0 || parent.path === "." && entries.length === 0) {
             const tree = new GitTree(entries);
-            const object3 = tree.toObject();
+            const object4 = tree.toObject();
             const oid = await _writeObject({
               fs: fs3,
               gitdir,
               type: "tree",
-              object: object3,
+              object: object4,
               dryRun
             });
             parent.oid = oid;
@@ -14043,9 +14043,9 @@ ${obj.gpgsig ? obj.gpgsig : ""}`;
       let retOid = objContent ? oid : void 0;
       if (!objContent) {
         await acquireLock(currentFilepath, async () => {
-          const object3 = stats.isSymbolicLink() ? await fs3.readlink(currentFilepath).then(posixifyPathBuffer) : await fs3.read(currentFilepath);
-          if (object3 === null) throw new NotFoundError(currentFilepath);
-          retOid = await _writeObject({ fs: fs3, gitdir, type: "blob", object: object3 });
+          const object4 = stats.isSymbolicLink() ? await fs3.readlink(currentFilepath).then(posixifyPathBuffer) : await fs3.read(currentFilepath);
+          if (object4 === null) throw new NotFoundError(currentFilepath);
+          retOid = await _writeObject({ fs: fs3, gitdir, type: "blob", object: object4 });
         });
       }
       return retOid;
@@ -14231,7 +14231,7 @@ ${obj.gpgsig ? obj.gpgsig : ""}`;
                 (removedDir) => currentFilepath.startsWith(removedDir)
               )) {
                 await assertNoSymlinkInLeadingPath(fs3, dir, op.filepath);
-                const { object: object3 } = await _readObject({
+                const { object: object4 } = await _readObject({
                   fs: fs3,
                   cache: {},
                   gitdir,
@@ -14240,7 +14240,7 @@ ${obj.gpgsig ? obj.gpgsig : ""}`;
                 if (await fs3.exists(currentFilepath)) {
                   await fs3.rm(currentFilepath);
                 }
-                await fs3.write(currentFilepath, object3);
+                await fs3.write(currentFilepath, object4);
               }
               break;
           }
@@ -15447,8 +15447,8 @@ ${obj.gpgsig ? obj.gpgsig : ""}`;
       for (const oid2 of response.shallows) {
         if (!oids.has(oid2)) {
           try {
-            const { object: object3 } = await _readObject({ fs: fs3, cache, gitdir, oid: oid2 });
-            const commit3 = new GitCommit(object3);
+            const { object: object4 } = await _readObject({ fs: fs3, cache, gitdir, oid: oid2 });
+            const commit3 = new GitCommit(object4);
             const hasParents = await Promise.all(
               commit3.headers().parent.map((oid3) => hasObject({ fs: fs3, cache, gitdir, oid: oid3 }))
             );
@@ -16018,11 +16018,11 @@ ${obj.gpgsig ? obj.gpgsig : ""}`;
       const shallows = await GitShallowManager.read({ fs: fs3, gitdir });
       const readParents = async (oid) => {
         if (parents.has(oid)) return parents.get(oid);
-        const { object: object3, type } = await _readObject({ fs: fs3, cache, gitdir, oid });
+        const { object: object4, type } = await _readObject({ fs: fs3, cache, gitdir, oid });
         if (type !== "commit") {
           throw new ObjectTypeError(oid, type, "commit");
         }
-        const commit3 = GitCommit.from(object3);
+        const commit3 = GitCommit.from(object4);
         const { parent } = commit3.parseHeaders();
         const result = shallows.has(oid) ? [] : parent;
         parents.set(oid, result);
@@ -16612,31 +16612,31 @@ ${obj.gpgsig ? obj.gpgsig : ""}`;
     }
     async function hashObject({
       type,
-      object: object3,
+      object: object4,
       format = "content",
       oid = void 0
     }) {
       if (format !== "deflated") {
         if (format !== "wrapped") {
-          object3 = GitObject.wrap({ type, object: object3 });
+          object4 = GitObject.wrap({ type, object: object4 });
         }
-        oid = await shasum(object3);
+        oid = await shasum(object4);
       }
-      return { oid, object: object3 };
+      return { oid, object: object4 };
     }
-    async function hashBlob({ object: object3 }) {
+    async function hashBlob({ object: object4 }) {
       try {
-        assertParameter("object", object3);
-        if (typeof object3 === "string") {
-          object3 = Buffer.from(object3, "utf8");
-        } else if (!(object3 instanceof Uint8Array)) {
-          object3 = new Uint8Array(object3);
+        assertParameter("object", object4);
+        if (typeof object4 === "string") {
+          object4 = Buffer.from(object4, "utf8");
+        } else if (!(object4 instanceof Uint8Array)) {
+          object4 = new Uint8Array(object4);
         }
         const type = "blob";
         const { oid, object: _object } = await hashObject({
           type,
           format: "content",
-          object: object3
+          object: object4
         });
         return { oid, type, object: _object, format: "wrapped" };
       } catch (err) {
@@ -16749,7 +16749,7 @@ ${obj.gpgsig ? obj.gpgsig : ""}`;
           throw new MaxDepthError(depth);
         }
         const oid2 = queue.shift();
-        const { type, object: object3 } = await _readObject({
+        const { type, object: object4 } = await _readObject({
           fs: fs3,
           cache,
           gitdir,
@@ -16758,7 +16758,7 @@ ${obj.gpgsig ? obj.gpgsig : ""}`;
         if (type !== "commit") {
           throw new ObjectTypeError(oid2, type, "commit");
         }
-        const commit3 = GitCommit.from(object3).parse();
+        const commit3 = GitCommit.from(object4).parse();
         for (const parent of commit3.parent) {
           if (parent === ancestor) return true;
         }
@@ -17149,12 +17149,12 @@ ${obj.gpgsig ? obj.gpgsig : ""}`;
             cache,
             gitdir,
             oid: entry.oid
-          }).then(function({ object: object3 }) {
+          }).then(function({ object: object4 }) {
             return _resolveFileId({
               fs: fs3,
               cache,
               gitdir,
-              tree: GitTree.from(object3),
+              tree: GitTree.from(object4),
               fileId,
               oid,
               filepaths,
@@ -17458,9 +17458,9 @@ ${obj.gpgsig ? obj.gpgsig : ""}`;
         outputStream.push(buff);
         hash.update(buff);
       }
-      async function writeObject2({ stype, object: object3 }) {
+      async function writeObject2({ stype, object: object4 }) {
         const type = types[stype];
-        let length = object3.length;
+        let length = object4.length;
         let multibyte = length > 15 ? 128 : 0;
         const lastFour = length & 15;
         length = length >>> 4;
@@ -17472,14 +17472,14 @@ ${obj.gpgsig ? obj.gpgsig : ""}`;
           write(padHex(2, byte), "hex");
           length = length >>> 7;
         }
-        write(Buffer.from(await deflate(object3)));
+        write(Buffer.from(await deflate(object4)));
       }
       write("PACK");
       write("00000002", "hex");
       write(padHex(8, oids.length), "hex");
       for (const oid of oids) {
-        const { type, object: object3 } = await _readObject({ fs: fs3, cache, gitdir, oid });
-        await writeObject2({ write, object: object3, stype: type });
+        const { type, object: object4 } = await _readObject({ fs: fs3, cache, gitdir, oid });
+        await writeObject2({ write, object: object4, stype: type });
       }
       const digest2 = hash.digest();
       outputStream.push(digest2);
@@ -17624,9 +17624,9 @@ ${obj.gpgsig ? obj.gpgsig : ""}`;
       const visited = /* @__PURE__ */ new Set();
       async function walk2(oid) {
         visited.add(oid);
-        const { type, object: object3 } = await _readObject({ fs: fs3, cache, gitdir, oid });
+        const { type, object: object4 } = await _readObject({ fs: fs3, cache, gitdir, oid });
         if (type === "tag") {
-          const tag2 = GitAnnotatedTag.from(object3);
+          const tag2 = GitAnnotatedTag.from(object4);
           const commit3 = tag2.headers().object;
           return walk2(commit3);
         }
@@ -17634,7 +17634,7 @@ ${obj.gpgsig ? obj.gpgsig : ""}`;
           throw new ObjectTypeError(oid, type, "commit");
         }
         if (!shallows.has(oid)) {
-          const commit3 = GitCommit.from(object3);
+          const commit3 = GitCommit.from(object4);
           const parents = commit3.headers().parent;
           for (oid of parents) {
             if (!finishingSet.has(oid) && !visited.has(oid)) {
@@ -17659,17 +17659,17 @@ ${obj.gpgsig ? obj.gpgsig : ""}`;
       async function walk2(oid) {
         if (visited.has(oid)) return;
         visited.add(oid);
-        const { type, object: object3 } = await _readObject({ fs: fs3, cache, gitdir, oid });
+        const { type, object: object4 } = await _readObject({ fs: fs3, cache, gitdir, oid });
         if (type === "tag") {
-          const tag2 = GitAnnotatedTag.from(object3);
+          const tag2 = GitAnnotatedTag.from(object4);
           const obj = tag2.headers().object;
           await walk2(obj);
         } else if (type === "commit") {
-          const commit3 = GitCommit.from(object3);
+          const commit3 = GitCommit.from(object4);
           const tree = commit3.headers().tree;
           await walk2(tree);
         } else if (type === "tree") {
-          const tree = GitTree.from(object3);
+          const tree = GitTree.from(object4);
           for (const entry of tree) {
             if (entry.type === "blob") {
               visited.add(entry.oid);
@@ -18000,15 +18000,15 @@ ${obj.gpgsig ? obj.gpgsig : ""}`;
       }
     }
     async function resolveBlob({ fs: fs3, cache, gitdir, oid }) {
-      const { type, object: object3 } = await _readObject({ fs: fs3, cache, gitdir, oid });
+      const { type, object: object4 } = await _readObject({ fs: fs3, cache, gitdir, oid });
       if (type === "tag") {
-        oid = GitAnnotatedTag.from(object3).parse().object;
+        oid = GitAnnotatedTag.from(object4).parse().object;
         return resolveBlob({ fs: fs3, cache, gitdir, oid });
       }
       if (type !== "blob") {
         throw new ObjectTypeError(oid, type, "blob");
       }
-      return { oid, blob: new Uint8Array(object3) };
+      return { oid, blob: new Uint8Array(object4) };
     }
     async function _readBlob({
       fs: fs3,
@@ -18193,7 +18193,7 @@ ${obj.gpgsig ? obj.gpgsig : ""}`;
       }
     }
     async function _readTag({ fs: fs3, cache, gitdir, oid }) {
-      const { type, object: object3 } = await _readObject({
+      const { type, object: object4 } = await _readObject({
         fs: fs3,
         cache,
         gitdir,
@@ -18203,7 +18203,7 @@ ${obj.gpgsig ? obj.gpgsig : ""}`;
       if (type !== "tag") {
         throw new ObjectTypeError(oid, type, "tag");
       }
-      const tag2 = GitAnnotatedTag.from(object3);
+      const tag2 = GitAnnotatedTag.from(object4);
       const result = {
         oid,
         tag: tag2.parse(),
@@ -18452,8 +18452,8 @@ ${obj.gpgsig ? obj.gpgsig : ""}`;
         throw err;
       }
     }
-    async function hashObject$1({ gitdir, type, object: object3 }) {
-      return shasum(GitObject.wrap({ type, object: object3 }));
+    async function hashObject$1({ gitdir, type, object: object4 }) {
+      return shasum(GitObject.wrap({ type, object: object4 }));
     }
     async function resetIndex({
       fs: _fs,
@@ -18505,12 +18505,12 @@ ${obj.gpgsig ? obj.gpgsig : ""}`;
           gid: 0,
           size: 0
         };
-        const object3 = dir && await fs3.read(join7(dir, filepath));
-        if (object3) {
+        const object4 = dir && await fs3.read(join7(dir, filepath));
+        if (object4) {
           workdirOid = await hashObject$1({
             gitdir: updatedGitdir,
             type: "blob",
-            object: object3
+            object: object4
           });
           if (oid === workdirOid) {
             stats = await fs3.lstat(join7(dir, filepath));
@@ -18582,12 +18582,12 @@ ${obj.gpgsig ? obj.gpgsig : ""}`;
       }
     }
     async function _writeCommit({ fs: fs3, gitdir, commit: commit3 }) {
-      const object3 = GitCommit.from(commit3).toObject();
+      const object4 = GitCommit.from(commit3).toObject();
       const oid = await _writeObject({
         fs: fs3,
         gitdir,
         type: "commit",
-        object: object3,
+        object: object4,
         format: "content"
       });
       return oid;
@@ -19072,11 +19072,11 @@ ${obj.gpgsig ? obj.gpgsig : ""}`;
           } else {
             const config = await GitConfigManager.get({ fs: fs3, gitdir: updatedGitdir });
             const autocrlf = await config.get("core.autocrlf");
-            const object3 = await fs3.read(join7(dir, filepath), { autocrlf });
+            const object4 = await fs3.read(join7(dir, filepath), { autocrlf });
             const workdirOid = await hashObject$1({
               gitdir: updatedGitdir,
               type: "blob",
-              object: object3
+              object: object4
             });
             if (refresh && I && indexEntry.oid === workdirOid) {
               if (stats.size !== -1) {
@@ -19127,14 +19127,14 @@ ${obj.gpgsig ? obj.gpgsig : ""}`;
           if (path2.length === 0) {
             return entry.oid;
           }
-          const { type, object: object3 } = await _readObject({
+          const { type, object: object4 } = await _readObject({
             fs: fs3,
             cache,
             gitdir: updatedGitdir,
             oid: entry.oid
           });
           if (type === "tree") {
-            const tree2 = GitTree.from(object3);
+            const tree2 = GitTree.from(object4);
             return getOidAtPath({ fs: fs3, cache, gitdir: updatedGitdir, tree: tree2, path: path2 });
           }
           if (type === "blob") {
@@ -19238,7 +19238,7 @@ ${obj.gpgsig ? obj.gpgsig : ""}`;
       dir,
       gitdir = join7(dir, ".git"),
       ref,
-      object: object3,
+      object: object4,
       force = false
     }) {
       try {
@@ -19254,7 +19254,7 @@ ${obj.gpgsig ? obj.gpgsig : ""}`;
         const value = await GitRefManager.resolve({
           fs: fs3,
           gitdir: updatedGitdir,
-          ref: object3 || "HEAD"
+          ref: object4 || "HEAD"
         });
         if (!force && await GitRefManager.exists({ fs: fs3, gitdir: updatedGitdir, ref })) {
           throw new AlreadyExistsError("tag", ref);
@@ -19327,13 +19327,13 @@ ${obj.gpgsig ? obj.gpgsig : ""}`;
             let stats;
             if (!oid) {
               stats = fileStats;
-              const object3 = stats.isSymbolicLink() ? await fs3.readlink(join7(dir, filepath)) : await fs3.read(join7(dir, filepath));
+              const object4 = stats.isSymbolicLink() ? await fs3.readlink(join7(dir, filepath)) : await fs3.read(join7(dir, filepath));
               oid = await _writeObject({
                 fs: fs3,
                 gitdir: updatedGitdir,
                 type: "blob",
                 format: "content",
-                object: object3
+                object: object4
               });
             } else {
               stats = {
@@ -19445,7 +19445,7 @@ ${obj.gpgsig ? obj.gpgsig : ""}`;
       dir,
       gitdir = join7(dir, ".git"),
       type,
-      object: object3,
+      object: object4,
       format = "parsed",
       oid,
       encoding = void 0
@@ -19456,16 +19456,16 @@ ${obj.gpgsig ? obj.gpgsig : ""}`;
         if (format === "parsed") {
           switch (type) {
             case "commit":
-              object3 = GitCommit.from(object3).toObject();
+              object4 = GitCommit.from(object4).toObject();
               break;
             case "tree":
-              object3 = GitTree.from(object3).toObject();
+              object4 = GitTree.from(object4).toObject();
               break;
             case "blob":
-              object3 = Buffer.from(object3, encoding);
+              object4 = Buffer.from(object4, encoding);
               break;
             case "tag":
-              object3 = GitAnnotatedTag.from(object3).toObject();
+              object4 = GitAnnotatedTag.from(object4).toObject();
               break;
             default:
               throw new ObjectTypeError(oid || "", type, "blob|commit|tag|tree");
@@ -19476,7 +19476,7 @@ ${obj.gpgsig ? obj.gpgsig : ""}`;
           fs: fs3,
           gitdir: updatedGitdir,
           type,
-          object: object3,
+          object: object4,
           oid,
           format
         });
@@ -19534,12 +19534,12 @@ ${obj.gpgsig ? obj.gpgsig : ""}`;
       }
     }
     async function _writeTag({ fs: fs3, gitdir, tag: tag2 }) {
-      const object3 = GitAnnotatedTag.from(tag2).toObject();
+      const object4 = GitAnnotatedTag.from(tag2).toObject();
       const oid = await _writeObject({
         fs: fs3,
         gitdir,
         type: "tag",
-        object: object3,
+        object: object4,
         format: "content"
       });
       return oid;
@@ -21928,10 +21928,10 @@ var require_resolve = __commonJS({
       }
       return count;
     }
-    function getFullPath(resolver, id3 = "", normalize) {
+    function getFullPath(resolver, id4 = "", normalize) {
       if (normalize !== false)
-        id3 = normalizeId(id3);
-      const p = resolver.parse(id3);
+        id4 = normalizeId(id4);
+      const p = resolver.parse(id4);
       return _getFullPath(resolver, p);
     }
     exports.getFullPath = getFullPath;
@@ -21941,13 +21941,13 @@ var require_resolve = __commonJS({
     }
     exports._getFullPath = _getFullPath;
     var TRAILING_SLASH_HASH = /#\/?$/;
-    function normalizeId(id3) {
-      return id3 ? id3.replace(TRAILING_SLASH_HASH, "") : "";
+    function normalizeId(id4) {
+      return id4 ? id4.replace(TRAILING_SLASH_HASH, "") : "";
     }
     exports.normalizeId = normalizeId;
-    function resolveUrl(resolver, baseId, id3) {
-      id3 = normalizeId(id3);
-      return resolver.resolve(baseId, id3);
+    function resolveUrl(resolver, baseId, id4) {
+      id4 = normalizeId(id4);
+      return resolver.resolve(baseId, id4);
     }
     exports.resolveUrl = resolveUrl;
     var ANCHOR = /^[a-z_][-a-z0-9._]*$/i;
@@ -22717,8 +22717,8 @@ var require_compile = __commonJS({
       if (Object.keys(root.schema).length > 0 && refPath === baseId) {
         return getJsonPointer.call(this, p, root);
       }
-      const id3 = (0, resolve_1.normalizeId)(refPath);
-      const schOrRef = this.refs[id3] || this.schemas[id3];
+      const id4 = (0, resolve_1.normalizeId)(refPath);
+      const schOrRef = this.refs[id4] || this.schemas[id4];
       if (typeof schOrRef == "string") {
         const sch = resolveSchema.call(this, root, schOrRef);
         if (typeof (sch === null || sch === void 0 ? void 0 : sch.schema) !== "object")
@@ -22729,7 +22729,7 @@ var require_compile = __commonJS({
         return;
       if (!schOrRef.validate)
         compileSchema.call(this, schOrRef);
-      if (id3 === (0, resolve_1.normalizeId)(ref)) {
+      if (id4 === (0, resolve_1.normalizeId)(ref)) {
         const { schema } = schOrRef;
         const { schemaId } = this.opts;
         const schId = schema[schemaId];
@@ -22796,9 +22796,9 @@ var require_data = __commonJS({
   }
 });
 
-// node_modules/.pnpm/fast-uri@3.1.8/node_modules/fast-uri/lib/utils.js
+// node_modules/.pnpm/fast-uri@3.1.9/node_modules/fast-uri/lib/utils.js
 var require_utils = __commonJS({
-  "node_modules/.pnpm/fast-uri@3.1.8/node_modules/fast-uri/lib/utils.js"(exports, module) {
+  "node_modules/.pnpm/fast-uri@3.1.9/node_modules/fast-uri/lib/utils.js"(exports, module) {
     "use strict";
     var isUUID = RegExp.prototype.test.bind(/^[\da-f]{8}-[\da-f]{4}-[\da-f]{4}-[\da-f]{4}-[\da-f]{12}$/iu);
     var isIPv4 = RegExp.prototype.test.bind(/^(?:(?:25[0-5]|2[0-4]\d|1\d{2}|[1-9]\d|\d)\.){3}(?:25[0-5]|2[0-4]\d|1\d{2}|[1-9]\d|\d)$/u);
@@ -22920,28 +22920,28 @@ var require_utils = __commonJS({
       for (let i = left.length; i < parts.length; i++) expanded.push(parts[i]);
       return compressIPv6ZeroRun(expanded);
     }
-    function normalizeIPv6(host) {
-      const bracketed = host[0] === "[" && host[host.length - 1] === "]";
-      const hasBracket = host[0] === "[" || host[host.length - 1] === "]";
-      if (hasBracket && !bracketed) return { host, isIPV6: false, error: true };
-      let input = bracketed ? host.slice(1, -1) : host;
+    function normalizeIPv6(host2) {
+      const bracketed = host2[0] === "[" && host2[host2.length - 1] === "]";
+      const hasBracket = host2[0] === "[" || host2[host2.length - 1] === "]";
+      if (hasBracket && !bracketed) return { host: host2, isIPV6: false, error: true };
+      let input = bracketed ? host2.slice(1, -1) : host2;
       if (bracketed && isIPvFuture(input)) {
         input = input.toLowerCase();
         return { host: `[${input}]`, escapedHost: input, isIPV6: false, isIPVFuture: true };
       }
       if (findToken(input, ":") < 2) {
-        return { host, isIPV6: false, error: bracketed };
+        return { host: host2, isIPV6: false, error: bracketed };
       }
       let zoneIdentifier = "";
       const zoneSeparator = input.indexOf("%");
       if (zoneSeparator !== -1) {
         const separatorLength = input.slice(zoneSeparator, zoneSeparator + 3).toLowerCase() === "%25" ? 3 : 1;
         zoneIdentifier = input.slice(zoneSeparator + separatorLength);
-        if (!isZoneIdentifier(zoneIdentifier)) return { host, isIPV6: false, error: true };
+        if (!isZoneIdentifier(zoneIdentifier)) return { host: host2, isIPV6: false, error: true };
         input = input.slice(0, zoneSeparator);
       }
       const address = normalizeIPv6Address(input);
-      if (address === void 0) return { host, isIPV6: false, error: true };
+      if (address === void 0) return { host: host2, isIPV6: false, error: true };
       return {
         host: address + (zoneIdentifier ? "%" + zoneIdentifier : ""),
         escapedHost: address + (zoneIdentifier ? "%25" + zoneIdentifier : ""),
@@ -23030,13 +23030,44 @@ var require_utils = __commonJS({
       }
       return output.join("");
     }
+    function removeDotSegmentsRelative(path2) {
+      if (path2 === "" || path2[0] === "/") {
+        return removeDotSegments(path2);
+      }
+      const segments = path2.split("/");
+      const last = segments.length - 1;
+      const output = [];
+      let trailingDirectory = false;
+      for (let i = 0; i <= last; i++) {
+        const segment = segments[i];
+        if (segment === "." || segment === "..") {
+          if (segment === "..") {
+            if (output.length !== 0 && output[output.length - 1] !== "..") {
+              output.pop();
+            } else {
+              output.push("..");
+            }
+          }
+          trailingDirectory = i === last;
+        } else {
+          output.push(segment);
+        }
+      }
+      if (trailingDirectory && output[output.length - 1] !== "..") {
+        output.push("");
+      }
+      if (output.length === 0 || output[0] === "" || output[0].includes(":")) {
+        output.unshift(".");
+      }
+      return output.join("/");
+    }
     var HOST_DELIMS = { "@": "%40", "/": "%2F", "?": "%3F", "#": "%23", ":": "%3A" };
     var HOST_DELIM_RE = /[@/?#:]/g;
     var HOST_DELIM_NO_COLON_RE = /[@/?#]/g;
-    function reescapeHostDelimiters(host, isIP) {
+    function reescapeHostDelimiters(host2, isIP) {
       const re = isIP ? HOST_DELIM_NO_COLON_RE : HOST_DELIM_RE;
       re.lastIndex = 0;
-      return host.replace(re, (ch) => HOST_DELIMS[ch]);
+      return host2.replace(re, (ch) => HOST_DELIMS[ch]);
     }
     function normalizePercentEncoding(input, decodeUnreserved = false) {
       if (input.indexOf("%") === -1) {
@@ -23252,20 +23283,20 @@ var require_utils = __commonJS({
         uriTokens.push("@");
       }
       if (component.host !== void 0) {
-        let host = component.host;
-        if (!isIPv4(host)) {
-          let ipV6res = normalizeIPv6(host);
+        let host2 = component.host;
+        if (!isIPv4(host2)) {
+          let ipV6res = normalizeIPv6(host2);
           if (ipV6res.isIPV6 !== true && ipV6res.isIPVFuture !== true) {
-            host = normalizePercentEncoding(host, true);
-            ipV6res = normalizeIPv6(host);
+            host2 = normalizePercentEncoding(host2, true);
+            ipV6res = normalizeIPv6(host2);
           }
           if (ipV6res.isIPV6 === true || ipV6res.isIPVFuture === true) {
-            host = `[${ipV6res.escapedHost}]`;
+            host2 = `[${ipV6res.escapedHost}]`;
           } else {
-            host = reescapeHostDelimiters(host, false);
+            host2 = reescapeHostDelimiters(host2, false);
           }
         }
-        uriTokens.push(host);
+        uriTokens.push(host2);
       }
       if (typeof component.port === "number" || typeof component.port === "string") {
         const port = String(component.port);
@@ -23290,6 +23321,7 @@ var require_utils = __commonJS({
       encodeFragment,
       escapePreservingEscapes,
       removeDotSegments,
+      removeDotSegmentsRelative,
       isIPv4,
       isUUID,
       normalizeIPv6,
@@ -23298,9 +23330,9 @@ var require_utils = __commonJS({
   }
 });
 
-// node_modules/.pnpm/fast-uri@3.1.8/node_modules/fast-uri/lib/schemes.js
+// node_modules/.pnpm/fast-uri@3.1.9/node_modules/fast-uri/lib/schemes.js
 var require_schemes = __commonJS({
-  "node_modules/.pnpm/fast-uri@3.1.8/node_modules/fast-uri/lib/schemes.js"(exports, module) {
+  "node_modules/.pnpm/fast-uri@3.1.9/node_modules/fast-uri/lib/schemes.js"(exports, module) {
     "use strict";
     var { isUUID } = require_utils();
     var URN_REG = /^([\da-z][\d\-a-z]{0,31}):((?:[\w!$'()*+,\-./:;=@]|%[\da-f]{2})+)$/iu;
@@ -23509,20 +23541,22 @@ var require_schemes = __commonJS({
   }
 });
 
-// node_modules/.pnpm/fast-uri@3.1.8/node_modules/fast-uri/index.js
+// node_modules/.pnpm/fast-uri@3.1.9/node_modules/fast-uri/index.js
 var require_fast_uri = __commonJS({
-  "node_modules/.pnpm/fast-uri@3.1.8/node_modules/fast-uri/index.js"(exports, module) {
+  "node_modules/.pnpm/fast-uri@3.1.9/node_modules/fast-uri/index.js"(exports, module) {
     "use strict";
-    var { normalizeIPv6, removeDotSegments, recomposeAuthority, normalizePercentEncoding, normalizePathEncoding, serializePathEncoding, normalizeQueryFragmentEncoding, encodeQuery, encodeFragment, reescapeHostDelimiters, isIPv4, nonSimpleDomain } = require_utils();
+    var { normalizeIPv6, removeDotSegments, removeDotSegmentsRelative, recomposeAuthority, normalizePercentEncoding, normalizePathEncoding, serializePathEncoding, normalizeQueryFragmentEncoding, encodeQuery, encodeFragment, reescapeHostDelimiters, isIPv4, nonSimpleDomain } = require_utils();
     var { SCHEMES, getSchemeHandler } = require_schemes();
     var VALID_SCHEME = /^[A-Za-z][A-Za-z0-9+.-]*$/u;
     var MALFORMED_SCHEME_ERROR = "URI scheme is malformed.";
-    function decodeValidScheme(scheme) {
-      const decodedScheme = unescape(String(scheme));
-      if (!VALID_SCHEME.test(decodedScheme)) {
+    var MALFORMED_HOST_ERROR = "URI host is malformed.";
+    var FORBIDDEN_DOMAIN_HOST_CHARACTER = /[\0-\x20"#/:<>?@[\\\]^`{|}\x7F]/u;
+    function validateScheme(scheme) {
+      const stringScheme = String(scheme);
+      if (!VALID_SCHEME.test(stringScheme)) {
         throw new TypeError(MALFORMED_SCHEME_ERROR);
       }
-      return decodedScheme;
+      return stringScheme;
     }
     function normalize(uri, options) {
       if (typeof uri === "string") {
@@ -23559,6 +23593,9 @@ var require_fast_uri = __commonJS({
       const resolvedSchemeHandler = getSchemeHandler(options && options.scheme || resolved.scheme);
       const resolvedHost = resolved.host;
       const resolvedHostIsIP = resolvedHost !== void 0 && resolvedHost !== "" && (isIPv4(resolvedHost) || normalizeIPv6(resolvedHost).isIPV6);
+      if (hasForbiddenDomainHost(resolved, options || {}, resolvedSchemeHandler, resolvedHostIsIP)) {
+        throw new Error(MALFORMED_HOST_ERROR);
+      }
       canonicalizeHost(resolved, options || {}, resolvedSchemeHandler, resolvedHostIsIP);
       const encodedASCIIHost = resolvedHost && resolvedHost.indexOf("%") !== -1 && !new RegExp("\\P{ASCII}", "u").test(resolvedHost);
       if (resolved.error && !encodedASCIIHost) {
@@ -23600,14 +23637,15 @@ var require_fast_uri = __commonJS({
             if (relative2.path[0] === "/") {
               target.path = removeDotSegments(relative2.path);
             } else {
-              if ((base.userinfo !== void 0 || base.host !== void 0 || base.port !== void 0) && !base.path) {
+              const baseHasAuthority = base.userinfo !== void 0 || base.host !== void 0 || base.port !== void 0;
+              if (baseHasAuthority && !base.path) {
                 target.path = "/" + relative2.path;
               } else if (!base.path) {
                 target.path = relative2.path;
               } else {
                 target.path = base.path.slice(0, base.path.lastIndexOf("/") + 1) + relative2.path;
               }
-              target.path = removeDotSegments(target.path);
+              target.path = base.scheme === void 0 && !baseHasAuthority && target.path[0] !== "/" ? removeDotSegmentsRelative(target.path) : removeDotSegments(target.path);
             }
             target.query = relative2.query;
           }
@@ -23645,12 +23683,13 @@ var require_fast_uri = __commonJS({
       const options = Object.assign({}, opts);
       const uriTokens = [];
       if (component.scheme) {
-        component.scheme = decodeValidScheme(component.scheme);
+        component.scheme = validateScheme(component.scheme);
       }
       const schemeHandler = getSchemeHandler(options.scheme || component.scheme);
       if (schemeHandler && schemeHandler.serialize) schemeHandler.serialize(component, options);
       const hasAuthority = component.userinfo !== void 0 || component.host !== void 0 || component.port !== void 0;
-      const pathNoScheme = !options.skipEscape && component.scheme === void 0 && !hasAuthority;
+      const schemelessReference = (component.scheme === void 0 || options.reference === "suffix") && !hasAuthority;
+      const pathNoScheme = !options.skipEscape && schemelessReference;
       if (component.path !== void 0) {
         if (!options.skipEscape) {
           component.path = serializePathEncoding(component.path, pathNoScheme);
@@ -23659,7 +23698,7 @@ var require_fast_uri = __commonJS({
         }
       }
       if (options.reference !== "suffix" && component.scheme) {
-        component.scheme = decodeValidScheme(component.scheme);
+        component.scheme = validateScheme(component.scheme);
         uriTokens.push(component.scheme, ":");
       }
       const authority = recomposeAuthority(component);
@@ -23675,9 +23714,9 @@ var require_fast_uri = __commonJS({
       if (component.path !== void 0) {
         let s = component.path;
         if (!options.absolutePath && (!schemeHandler || !schemeHandler.absolutePath)) {
-          s = removeDotSegments(s);
+          s = schemelessReference && s[0] !== "/" ? removeDotSegmentsRelative(s) : removeDotSegments(s);
         }
-        if (pathNoScheme) {
+        if (schemelessReference) {
           s = serializePathEncoding(s, true);
         }
         if (authority === void 0 && s[0] === "/" && s[1] === "/") {
@@ -23716,24 +23755,42 @@ var require_fast_uri = __commonJS({
       }
       return false;
     }
-    function isIPLiteral(host) {
-      return host[0] === "[" && host[host.length - 1] === "]";
+    function isIPLiteral(host2) {
+      return host2[0] === "[" && host2[host2.length - 1] === "]";
     }
     function hasMalformedComponentPercentEncoding(matches) {
-      const host = matches[4];
-      return hasMalformedPercentEncoding(matches[3]) || host !== void 0 && !isIPLiteral(host) && hasMalformedPercentEncoding(host) || hasMalformedPercentEncoding(matches[6]) || hasMalformedPercentEncoding(matches[7]) || hasMalformedPercentEncoding(matches[8]);
+      const host2 = matches[4];
+      return hasMalformedPercentEncoding(matches[3]) || host2 !== void 0 && !isIPLiteral(host2) && hasMalformedPercentEncoding(host2) || hasMalformedPercentEncoding(matches[6]) || hasMalformedPercentEncoding(matches[7]) || hasMalformedPercentEncoding(matches[8]);
     }
     function canonicalizeHost(parsed, options, schemeHandler, isIP) {
+      if (hasForbiddenDomainHost(parsed, options, schemeHandler, isIP)) {
+        parsed.error = parsed.error || MALFORMED_HOST_ERROR;
+        return true;
+      }
       if (!options.unicodeSupport && (!schemeHandler || !schemeHandler.unicodeSupport) && parsed.host && !isIPLiteral(parsed.host) && (options.domainHost || schemeHandler && schemeHandler.domainHost) && isIP === false && nonSimpleDomain(parsed.host)) {
+        let url;
         try {
-          parsed.host = new URL("http://" + parsed.host).hostname;
+          url = new URL("http://" + parsed.host);
         } catch (e) {
           parsed.error = parsed.error || "Host's domain name can not be converted to ASCII: " + e;
           return true;
         }
+        if (!isHostOnlyURL(url)) {
+          parsed.error = parsed.error || MALFORMED_HOST_ERROR;
+          return true;
+        }
+        parsed.host = url.hostname;
       }
       return false;
     }
+    function hasForbiddenDomainHost(parsed, options, schemeHandler, isIP) {
+      return Boolean(
+        parsed.host && isIP === false && !isIPLiteral(parsed.host) && (options.domainHost || schemeHandler && schemeHandler.domainHost) && FORBIDDEN_DOMAIN_HOST_CHARACTER.test(parsed.host)
+      );
+    }
+    function isHostOnlyURL(url) {
+      return url.username === "" && url.password === "" && url.port === "" && url.pathname === "/" && url.search === "" && url.hash === "" && url.hostname !== "";
+    }
     function parseWithStatus(uri, opts) {
       const options = Object.assign({}, opts);
       const parsed = {
@@ -23788,9 +23845,8 @@ var require_fast_uri = __commonJS({
         parsed.query = matches[7];
         parsed.fragment = matches[8];
         if (parsed.scheme !== void 0) {
-          const decodedScheme = unescape(parsed.scheme);
-          if (VALID_SCHEME.test(decodedScheme)) {
-            parsed.scheme = decodedScheme.toLowerCase();
+          if (VALID_SCHEME.test(parsed.scheme)) {
+            parsed.scheme = parsed.scheme.toLowerCase();
           } else {
             parsed.error = parsed.error || MALFORMED_SCHEME_ERROR;
             malformedScheme = true;
@@ -23818,7 +23874,7 @@ var require_fast_uri = __commonJS({
             malformedIPLiteral = hasIPLiteralBracket && (!bracketedIPLiteral || ipv6result.error === true);
             parsed.host = isIP ? ipv6result.host : ipv6result.host.toLowerCase();
             if (malformedIPLiteral) {
-              parsed.error = parsed.error || "URI host is malformed.";
+              parsed.error = parsed.error || MALFORMED_HOST_ERROR;
               malformedAuthorityOrPort = true;
             }
           } else {
@@ -23842,11 +23898,11 @@ var require_fast_uri = __commonJS({
           malformedHost = canonicalizeHost(parsed, options, schemeHandler, isIP);
         }
         if (uri.indexOf("%") !== -1 && parsed.host !== void 0 && !malformedIPLiteral) {
-          let host = isIP ? parsed.host : normalizePercentEncoding(parsed.host, true);
+          let host2 = isIP ? parsed.host : normalizePercentEncoding(parsed.host, true);
           if (!isIP) {
-            host = normalizePercentEncoding(host.toLowerCase());
+            host2 = normalizePercentEncoding(host2.toLowerCase());
           }
-          parsed.host = reescapeHostDelimiters(host, isIP);
+          parsed.host = isIP || options.scheme !== "null" ? reescapeHostDelimiters(host2, isIP) : host2;
         }
         if (!schemeHandler || schemeHandler && !schemeHandler.skipNormalize) {
           if (parsed.path) {
@@ -24156,15 +24212,15 @@ var require_core = __commonJS({
             this.addSchema(sch, void 0, _meta, _validateSchema);
           return this;
         }
-        let id3;
+        let id4;
         if (typeof schema === "object") {
           const { schemaId } = this.opts;
-          id3 = schema[schemaId];
-          if (id3 !== void 0 && typeof id3 != "string") {
+          id4 = schema[schemaId];
+          if (id4 !== void 0 && typeof id4 != "string") {
             throw new Error(`schema ${schemaId} must be string`);
           }
         }
-        key = (0, resolve_1.normalizeId)(key || id3);
+        key = (0, resolve_1.normalizeId)(key || id4);
         this._checkUnique(key);
         this.schemas[key] = this._addSchema(schema, _meta, key, _validateSchema, true);
         return this;
@@ -24243,11 +24299,11 @@ var require_core = __commonJS({
           case "object": {
             const cacheKey = schemaKeyRef;
             this._cache.delete(cacheKey);
-            let id3 = schemaKeyRef[this.opts.schemaId];
-            if (id3) {
-              id3 = (0, resolve_1.normalizeId)(id3);
-              delete this.schemas[id3];
-              delete this.refs[id3];
+            let id4 = schemaKeyRef[this.opts.schemaId];
+            if (id4) {
+              id4 = (0, resolve_1.normalizeId)(id4);
+              delete this.schemas[id4];
+              delete this.refs[id4];
             }
             return this;
           }
@@ -24354,10 +24410,10 @@ var require_core = __commonJS({
         }
       }
       _addSchema(schema, meta, baseId, validateSchema = this.opts.validateSchema, addSchema = this.opts.addUsedSchema) {
-        let id3;
+        let id4;
         const { schemaId } = this.opts;
         if (typeof schema == "object") {
-          id3 = schema[schemaId];
+          id4 = schema[schemaId];
         } else {
           if (this.opts.jtd)
             throw new Error("schema must be object");
@@ -24367,7 +24423,7 @@ var require_core = __commonJS({
         let sch = this._cache.get(schema);
         if (sch !== void 0)
           return sch;
-        baseId = (0, resolve_1.normalizeId)(id3 || baseId);
+        baseId = (0, resolve_1.normalizeId)(id4 || baseId);
         const localRefs = resolve_1.getSchemaRefs.call(this, schema, baseId);
         sch = new compile_1.SchemaEnv({ schema, schemaId, meta, baseId, localRefs });
         this._cache.set(sch.schema, sch);
@@ -24380,9 +24436,9 @@ var require_core = __commonJS({
           this.validateSchema(schema, true);
         return sch;
       }
-      _checkUnique(id3) {
-        if (this.schemas[id3] || this.refs[id3]) {
-          throw new Error(`schema with key or id "${id3}" already exists`);
+      _checkUnique(id4) {
+        if (this.schemas[id4] || this.refs[id4]) {
+          throw new Error(`schema with key or id "${id4}" already exists`);
         }
       }
       _compileSchemaEnv(sch) {
@@ -24747,8 +24803,8 @@ var require_multipleOf = __commonJS({
         const { gen, data, schemaCode, it } = cxt;
         const prec = it.opts.multipleOfPrecision;
         const res = gen.let("res");
-        const invalid6 = prec ? (0, codegen_1._)`Math.abs(Math.round(${res}) - ${res}) > 1e-${prec}` : (0, codegen_1._)`${res} !== parseInt(${res})`;
-        cxt.fail$data((0, codegen_1._)`(${schemaCode} === 0 || (${res} = ${data}/${schemaCode}, ${invalid6}))`);
+        const invalid7 = prec ? (0, codegen_1._)`Math.abs(Math.round(${res}) - ${res}) > 1e-${prec}` : (0, codegen_1._)`${res} !== parseInt(${res})`;
+        cxt.fail$data((0, codegen_1._)`(${schemaCode} === 0 || (${res} = ${data}/${schemaCode}, ${invalid7}))`);
       }
     };
     exports.default = def;
@@ -34467,7 +34523,7 @@ var FRAMEWORK_VERSION_POLICY = Object.freeze({
     floors: Object.freeze(["14.4.0"]),
     denied: Object.freeze([])
   }),
-  next: Object.freeze({ floors: Object.freeze(["15.5.27", "16.3.8"]), denied: Object.freeze([]) }),
+  next: Object.freeze({ floors: Object.freeze(["16.4.1"]), denied: Object.freeze([]) }),
   vite: Object.freeze({ floors: Object.freeze(["5.4.6"]), denied: Object.freeze([]) }),
   "@tanstack/react-start": Object.freeze({
     floors: Object.freeze(["1.168.60"]),
@@ -36678,13 +36734,13 @@ var PROBLEM_POLICY = {
   mail_domain_conflict: {
     status: 409,
     retryable: false,
-    action: "Use the sender domain already configured for this project, or retire it with 'ohmyhost mail domain delete' (repeat while the removal is pending) and then set up the new domain; a domain registered to another project cannot be set up.",
+    action: "Read the workspace sender resource and project binding. Reuse requires explicit domain-use authority, target-project editing and a current verified application identity with the same registrable main domain. Read the current revision before changing settings. Detach a shared project binding explicitly; legacy domain deletion cannot retire a resource used by another project.",
     title: "Mail domain conflict"
   },
   mail_domain_required: {
     status: 409,
     retryable: false,
-    action: "This app declares mail.enabled. Configure the project's own sender domain with 'ohmyhost mail setup' using its Prod environment ID, or set mail.enabled to false if the app sends no mail, then plan again.",
+    action: "This app declares mail.enabled. Configure a sender with 'ohmyhost mail setup' or explicitly attach an authorized workspace sender using the project's Prod environment ID. Reuse first requires proof of the intended application hostname with the same registrable main domain; declare and verify that identity before mail-gated deployment. Then plan again.",
     title: "Mail domain required"
   },
   storage_jurisdiction_conflict: {
@@ -37285,10 +37341,10 @@ var parseProjectStatus = (value) => {
     const ids = /* @__PURE__ */ new Set(), names = /* @__PURE__ */ new Set();
     for (const raw of environments) {
       const environment = exactRecord2(raw, ["id", "name"]);
-      const id3 = environment["id"], name = environment["name"];
-      if (!isUlid(id3) || name !== "dev" && name !== "prod" || ids.has(id3) || names.has(name))
+      const id4 = environment["id"], name = environment["name"];
+      if (!isUlid(id4) || name !== "dev" && name !== "prod" || ids.has(id4) || names.has(name))
         throw new ResponseContractError();
-      ids.add(id3);
+      ids.add(id4);
       names.add(name);
     }
   }
@@ -37586,16 +37642,16 @@ var parseOperation = (value) => {
     "reconciliation",
     "progress"
   ]);
-  const id3 = input["id"];
+  const id4 = input["id"];
   const state = input["state"];
   const createdAt = input["created_at"];
   const updatedAt = input["updated_at"];
   const result = input["result"];
   const blockingOperationId = input["blocking_operation_id"];
   const deploymentId = input["deployment_id"];
-  if (blockingOperationId !== void 0 && (state !== "queued" || !isUlid(blockingOperationId) || blockingOperationId === id3) || deploymentId !== void 0 && !isUlid(deploymentId))
+  if (blockingOperationId !== void 0 && (state !== "queued" || !isUlid(blockingOperationId) || blockingOperationId === id4) || deploymentId !== void 0 && !isUlid(deploymentId))
     throw new ResponseContractError();
-  if (!isUlid(id3) || !isOperationState(state) || !isIsoInstant(createdAt) || !isIsoInstant(updatedAt) || result !== void 0 && !isRecord2(result)) {
+  if (!isUlid(id4) || !isOperationState(state) || !isIsoInstant(createdAt) || !isIsoInstant(updatedAt) || result !== void 0 && !isRecord2(result)) {
     throw new ResponseContractError();
   }
   let progress;
@@ -37635,7 +37691,7 @@ var parseOperation = (value) => {
       throw new ResponseContractError();
   }
   return {
-    id: id3,
+    id: id4,
     state,
     created_at: createdAt,
     updated_at: updatedAt,
@@ -38621,9 +38677,9 @@ var selectProfileForOrganization = (profiles, request) => {
   if (inOrganization.length > 1)
     return { outcome: "ambiguous", candidates: inOrganization };
   const unscoped = candidates.filter((profile) => profile.organizationId === null);
-  const [member] = inOrganization;
-  if (member !== void 0)
-    return { outcome: "selected", profile: member };
+  const [member2] = inOrganization;
+  if (member2 !== void 0)
+    return { outcome: "selected", profile: member2 };
   const [open5] = unscoped;
   if (unscoped.length === 1 && open5 !== void 0)
     return { outcome: "selected", profile: open5 };
@@ -39073,6 +39129,11 @@ var recognizedCommandLabel = (argv) => {
     if (value === "function" && values[0] === "runs")
       return "function runs";
     if (value === "mail") {
+      if (["workspace", "binding", "identity"].includes(values[0] ?? "")) {
+        const candidate = `mail ${values[0]} ${values[1]}`;
+        if (SHARED_MAIL_LABELS.includes(candidate))
+          return candidate;
+      }
       if (values[0] === "setup")
         return "mail setup";
       if (values[0] === "status")
@@ -40277,6 +40338,11 @@ var parseProductCliCommand = (argv) => {
     }
     throw new InvalidCommandError();
   }
+  if (first === "mail" && ["workspace", "binding", "identity"].includes(values[0] ?? "")) {
+    if (wait || follow || stdin)
+      throw new InvalidCommandError();
+    return parseSharedMailCommand(values, yes);
+  }
   if (first === "mail") {
     const area = values.shift();
     const sub = area === "webhook" || area === "messages" || area === "domain" ? values.shift() : void 0;
@@ -40440,6 +40506,193 @@ var validGithubBranchName = (value) => !(value.length < 1 || value.length > 1024
   return code <= 32 || code === 127 || "\\~^:?*[]".includes(character);
 }) || value.split("/").some((component) => component.startsWith(".") || component.endsWith(".lock")));
 var validPaidHostname = (value) => /^(?=.{1,253}$)(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\.)+[a-z]{2,63}$/u.test(value) && !value.endsWith(".poc.aixyte.com") && value !== "omh.st" && !value.endsWith(".omh.st") && value !== "ohmyho.st" && !value.endsWith(".ohmyho.st");
+var SHARED_MAIL_LABELS = [
+  "mail workspace list",
+  "mail workspace create",
+  "mail workspace status",
+  "mail workspace retire",
+  "mail workspace dns-authorize",
+  "mail workspace dns-status",
+  "mail workspace dns-revoke",
+  "mail binding get",
+  "mail binding set",
+  "mail binding detach",
+  "mail identity get",
+  "mail identity declare",
+  "mail identity verify",
+  "mail identity revoke",
+  "mail identity authorize",
+  "mail identity authorization-status",
+  "mail identity authorization-revoke"
+];
+function parseSharedMailCommand(values, yes) {
+  const area = values.shift(), operation = values.shift();
+  const label = `mail ${area} ${operation}`;
+  if (!SHARED_MAIL_LABELS.includes(label))
+    throw new InvalidCommandError();
+  const destructive = operation === "retire" || operation === "detach" || operation === "revoke" || operation === "dns-revoke" || operation === "authorization-revoke";
+  if (yes !== destructive)
+    throw new InvalidCommandError();
+  const allowed = area === "workspace" ? ["--organization"] : ["--project"];
+  const writing = [
+    "create",
+    "retire",
+    "dns-authorize",
+    "dns-revoke",
+    "set",
+    "detach",
+    "declare",
+    "verify",
+    "revoke",
+    "authorize",
+    "authorization-revoke"
+  ].includes(operation ?? "");
+  if (area === "workspace" && operation !== "list" && operation !== "create")
+    allowed.push("--mail-domain");
+  if (area === "binding")
+    allowed.push("--environment");
+  if (operation === "create")
+    allowed.push("--domain", "--sending");
+  if (area === "binding" && operation === "set")
+    allowed.push("--mail-domain", "--sending", "--sender-addresses", "--default-from", "--reply-to");
+  if (operation === "declare")
+    allowed.push("--hostname");
+  if (operation === "authorize" || operation === "dns-authorize")
+    allowed.push("--zone");
+  if (writing)
+    allowed.push("--idempotency-key");
+  if (writing && operation !== "create" && operation !== "declare")
+    allowed.push("--expected-revision");
+  const options = parseOptionalOptions(values, allowed);
+  const required = (key) => {
+    const value = options[key];
+    if (!value)
+      throw new InvalidCommandError();
+    return value;
+  };
+  const revision = () => {
+    const value = required("--expected-revision");
+    if (!/^(?:0|[1-9][0-9]*)$/u.test(value) || !Number.isSafeInteger(Number(value)))
+      throw new InvalidCommandError();
+    return Number(value);
+  };
+  const sending = () => {
+    const value = required("--sending");
+    if (value !== "true" && value !== "false")
+      throw new InvalidCommandError();
+    return value === "true";
+  };
+  const idempotencyKey = () => required("--idempotency-key");
+  let request;
+  if (area === "workspace") {
+    const scope = { organizationId: required("--organization") };
+    if (operation === "list")
+      request = { ...scope, action: "domains_list" };
+    else if (operation === "create") {
+      const enabled = sending();
+      if (!enabled)
+        throw new InvalidCommandError();
+      request = {
+        ...scope,
+        action: "domain_create",
+        domain: required("--domain"),
+        sending: enabled,
+        idempotencyKey: idempotencyKey()
+      };
+    } else {
+      const target = { ...scope, mailDomainId: required("--mail-domain") };
+      if (operation === "status")
+        request = { ...target, action: "domain_get" };
+      else if (operation === "dns-status")
+        request = { ...target, action: "domain_dns_status" };
+      else if (operation === "dns-revoke")
+        request = {
+          ...target,
+          action: "domain_dns_revoke",
+          expectedRevision: revision(),
+          idempotencyKey: idempotencyKey()
+        };
+      else if (operation === "retire")
+        request = {
+          ...target,
+          action: "domain_retire",
+          expectedRevision: revision(),
+          idempotencyKey: idempotencyKey()
+        };
+      else
+        request = {
+          ...target,
+          action: "domain_dns_authorize",
+          expectedRevision: revision(),
+          zone: required("--zone"),
+          idempotencyKey: idempotencyKey()
+        };
+    }
+  } else if (area === "binding") {
+    const scope = { projectId: required("--project"), environmentId: required("--environment") };
+    if (operation === "get")
+      request = { ...scope, action: "binding_get" };
+    else if (operation === "detach")
+      request = {
+        ...scope,
+        action: "binding_detach",
+        expectedRevision: revision(),
+        idempotencyKey: idempotencyKey()
+      };
+    else {
+      const senderAddresses = required("--sender-addresses").split(",");
+      if (senderAddresses.length > 32 || senderAddresses.some((address) => !address || address.trim() !== address) || new Set(senderAddresses).size !== senderAddresses.length)
+        throw new InvalidCommandError();
+      request = {
+        ...scope,
+        action: "binding_set",
+        mailDomainId: required("--mail-domain"),
+        sending: sending(),
+        senderAddresses,
+        defaultFrom: required("--default-from"),
+        defaultReplyTo: options["--reply-to"] ?? null,
+        expectedRevision: revision(),
+        idempotencyKey: idempotencyKey()
+      };
+    }
+  } else {
+    const scope = { projectId: required("--project") };
+    if (operation === "get")
+      request = { ...scope, action: "identity_get" };
+    else if (operation === "authorization-status")
+      request = { ...scope, action: "identity_authorization_status" };
+    else if (operation === "authorization-revoke")
+      request = {
+        ...scope,
+        action: "identity_authorization_revoke",
+        expectedRevision: revision(),
+        idempotencyKey: idempotencyKey()
+      };
+    else if (operation === "declare")
+      request = {
+        ...scope,
+        action: "identity_declare",
+        hostname: required("--hostname"),
+        idempotencyKey: idempotencyKey()
+      };
+    else if (operation === "authorize")
+      request = {
+        ...scope,
+        action: "identity_authorize",
+        zone: required("--zone"),
+        expectedRevision: revision(),
+        idempotencyKey: idempotencyKey()
+      };
+    else
+      request = {
+        ...scope,
+        action: operation === "verify" ? "identity_verify" : "identity_revoke",
+        expectedRevision: revision(),
+        idempotencyKey: idempotencyKey()
+      };
+  }
+  return { kind: "shared-mail", request, label, credentialStore: "native" };
+}
 
 // apps/product-cli/dist/workspace.js
 var InteractiveSessionRequiredError = class extends Error {
@@ -40670,7 +40923,7 @@ function exact3(v, keys) {
 // apps/product-cli/package.json
 var package_default = {
   name: "@ohmyhost/product-cli",
-  version: "0.1.36",
+  version: "0.1.38",
   private: true,
   ohmyhost: {
     deployment: "production",
@@ -40702,7 +40955,7 @@ var package_default = {
   },
   scripts: {
     build: "tsc --project tsconfig.build.json",
-    typecheck: "tsc --project tsconfig.json --noEmit",
+    typecheck: "tsc --project tsconfig.json --noEmit --incremental --tsBuildInfoFile typecheck.tsbuildinfo",
     test: "vitest run --root ../.. apps/product-cli/test"
   },
   dependencies: {
@@ -40800,12 +41053,12 @@ function assertBillingTaxIssue(value) {
 }
 var ulid4 = /^[0-7][0-9A-HJKMNP-TV-Z]{25}$/u;
 var timestamp5 = (v) => typeof v === "string" && Number.isFinite(Date.parse(v)) && new Date(v).toISOString() === v;
-function stripeUrl(value, host) {
+function stripeUrl(value, host2) {
   if (typeof value !== "string" || value.length > 8192)
     return false;
   try {
     const u = new URL(value);
-    return u.protocol === "https:" && u.hostname === host && !u.username && !u.password && !u.port;
+    return u.protocol === "https:" && u.hostname === host2 && !u.username && !u.password && !u.port;
   } catch {
     return false;
   }
@@ -41050,6 +41303,23 @@ var HELP_USAGE = Object.freeze({
   "function runs": "ohmyhost function runs --project ULID --environment ENVIRONMENT_ULID [--limit 1-100] --json",
   "secret set": `printf '%s' "$SECRET_VALUE" | ohmyhost secret set NAME --project ULID --environment ENVIRONMENT_ULID --idempotency-key KEY [--profile-user USER_ID --profile-organization ULID | --token-user USER_ID --token-organization ULID] --stdin [--wait] --json (with --profile-user and --profile-organization the saved login that runs it must belong to that user and organization; with --token-user and --token-organization it runs only with an OHMYHOST_TOKEN of that user and organization, never with a saved login)`,
   "secret delete": "ohmyhost secret delete NAME --project ULID --environment ENVIRONMENT_ULID --idempotency-key KEY [--wait] --json",
+  "mail workspace list": "ohmyhost mail workspace list --organization ULID --json",
+  "mail workspace create": "ohmyhost mail workspace create --organization ULID --domain DOMAIN --sending true --idempotency-key KEY --json",
+  "mail workspace status": "ohmyhost mail workspace status --organization ULID --mail-domain ULID --json",
+  "mail workspace retire": "ohmyhost mail workspace retire --organization ULID --mail-domain ULID --expected-revision N --idempotency-key KEY --yes --json",
+  "mail workspace dns-authorize": "ohmyhost mail workspace dns-authorize --organization ULID --mail-domain ULID --expected-revision N --zone DOMAIN --idempotency-key KEY --json",
+  "mail workspace dns-revoke": "ohmyhost mail workspace dns-revoke --organization ULID --mail-domain ULID --expected-revision N --idempotency-key KEY --yes --json",
+  "mail workspace dns-status": "ohmyhost mail workspace dns-status --organization ULID --mail-domain ULID --json",
+  "mail binding get": "ohmyhost mail binding get --project ULID --environment PROD_ULID --json",
+  "mail binding set": "ohmyhost mail binding set --project ULID --environment PROD_ULID --mail-domain ULID --sending true --sender-addresses contact@mail.example.com,contracts@mail.example.com --default-from contracts@mail.example.com [--reply-to owner@example.com] --expected-revision N --idempotency-key KEY --json",
+  "mail binding detach": "ohmyhost mail binding detach --project ULID --environment PROD_ULID --expected-revision N --idempotency-key KEY --yes --json",
+  "mail identity get": "ohmyhost mail identity get --project ULID --json",
+  "mail identity declare": "ohmyhost mail identity declare --project ULID --hostname sign.example.com --idempotency-key KEY --json",
+  "mail identity verify": "ohmyhost mail identity verify --project ULID --expected-revision N --idempotency-key KEY --json",
+  "mail identity revoke": "ohmyhost mail identity revoke --project ULID --expected-revision N --idempotency-key KEY --yes --json",
+  "mail identity authorize": "ohmyhost mail identity authorize --project ULID --expected-revision N --zone example.com --idempotency-key KEY --json",
+  "mail identity authorization-revoke": "ohmyhost mail identity authorization-revoke --project ULID --expected-revision N --idempotency-key KEY --yes --json",
+  "mail identity authorization-status": "ohmyhost mail identity authorization-status --project ULID --json",
   "mail setup": "ohmyhost mail setup --project ULID --environment ULID --domain DOMAIN --sending true --receiving false --idempotency-key KEY --json",
   "mail status": "ohmyhost mail status --project ULID --environment ULID --json",
   "mail webhook set": "ohmyhost mail webhook set --project ULID --environment ULID --url HTTPS_URL --idempotency-key KEY --json",
@@ -41502,6 +41772,12 @@ var ProductCli = class {
         return await this.listFunctionRuns(command, signal);
       if (command.kind === "secret-set")
         return await this.putEnvironmentSecret(command, signal);
+      if (command.kind === "shared-mail") {
+        const api = await this.authenticatedApi(command.credentialStore, signal);
+        if (!api.sharedMail)
+          throw new Error("Shared mail unavailable");
+        return success(command.label, { mail: await api.sharedMail(command.request) });
+      }
       if (command.kind === "managed-mail") {
         const api = await this.authenticatedApi(command.credentialStore, signal);
         if (!api.managedMail)
@@ -42068,7 +42344,7 @@ var ProductCli = class {
     if (command.kind === "source-complete") {
       const completed = await completeLocalSourcePublication({
         api: source,
-        getOperation: (id3) => api.getOperation(id3),
+        getOperation: (id4) => api.getOperation(id4),
         directory: resolve4(this.dependencies.sourceDirectory ?? process.cwd(), command.directory),
         metadataDirectory: this.dependencies.sourceMetadataDirectory,
         apiOrigin: this.dependencies.productApiOrigin,
@@ -42153,7 +42429,7 @@ var ProductCli = class {
     if (operation.state === "succeeded" && command.kind === "source-publish") {
       const completed = await completeLocalSourcePublication({
         api: source,
-        getOperation: (id3) => api.getOperation(id3),
+        getOperation: (id4) => api.getOperation(id4),
         directory: resolve4(this.dependencies.sourceDirectory ?? process.cwd(), command.directory),
         metadataDirectory: this.dependencies.sourceMetadataDirectory,
         apiOrigin: this.dependencies.productApiOrigin,
@@ -42614,18 +42890,18 @@ var reusedKeyProblem = (error) => {
 };
 var OPERATION_STREAM_CONNECTIONS = 4;
 var readStatementFile = async (path2) => {
-  const invalid6 = () => new ProductCliFailure(2, "statement_file_invalid", false, STATEMENT_FILE_INVALID_ACTION);
+  const invalid7 = () => new ProductCliFailure(2, "statement_file_invalid", false, STATEMENT_FILE_INVALID_ACTION);
   let file;
   try {
     file = await open3(path2, "r");
   } catch {
-    throw invalid6();
+    throw invalid7();
   }
   const buffer = Buffer.alloc(65537);
   try {
     const stat3 = await file.stat();
     if (!stat3.isFile() || stat3.size > 65536)
-      throw invalid6();
+      throw invalid7();
     let length = 0;
     while (length < buffer.length) {
       const read = await file.read(buffer, length, buffer.length - length, null);
@@ -42634,12 +42910,12 @@ var readStatementFile = async (path2) => {
       length += read.bytesRead;
     }
     if (length > 65536)
-      throw invalid6();
+      throw invalid7();
     return new TextDecoder("utf-8", { fatal: true }).decode(buffer.subarray(0, length));
   } catch (error) {
     if (error instanceof ProductCliFailure)
       throw error;
-    throw invalid6();
+    throw invalid7();
   } finally {
     buffer.fill(0);
     await file.close();
@@ -42820,7 +43096,7 @@ var parsedCommandName = (command) => {
     return "secret set";
   if (command.kind === "secret-delete")
     return "secret delete";
-  if (command.kind === "managed-mail")
+  if (command.kind === "shared-mail" || command.kind === "managed-mail")
     return command.label;
   if (command.kind === "profile-list")
     return "profile list";
@@ -43508,27 +43784,27 @@ var Interceptors = class {
   clear() {
     this.fns = [];
   }
-  eject(id3) {
-    const index = this.getInterceptorIndex(id3);
+  eject(id4) {
+    const index = this.getInterceptorIndex(id4);
     if (this.fns[index]) {
       this.fns[index] = null;
     }
   }
-  exists(id3) {
-    const index = this.getInterceptorIndex(id3);
+  exists(id4) {
+    const index = this.getInterceptorIndex(id4);
     return Boolean(this.fns[index]);
   }
-  getInterceptorIndex(id3) {
-    if (typeof id3 === "number") {
-      return this.fns[id3] ? id3 : -1;
+  getInterceptorIndex(id4) {
+    if (typeof id4 === "number") {
+      return this.fns[id4] ? id4 : -1;
     }
-    return this.fns.indexOf(id3);
+    return this.fns.indexOf(id4);
   }
-  update(id3, fn) {
-    const index = this.getInterceptorIndex(id3);
+  update(id4, fn) {
+    const index = this.getInterceptorIndex(id4);
     if (this.fns[index]) {
       this.fns[index] = fn;
-      return id3;
+      return id4;
     }
     return false;
   }
@@ -43763,6 +44039,380 @@ var createClient = (config = {}) => {
 var client = createClient(createConfig({ throwOnError: true }));
 
 // packages/sdk-ts/dist/generated/sdk.gen.js
+var listWorkspaceMailDomains = (parameters, options) => {
+  const params = buildClientParams([parameters], [
+    {
+      args: [
+        { in: "headers", key: "X-Request-Id" },
+        { in: "path", key: "organization_id" }
+      ]
+    }
+  ]);
+  return (options?.client ?? client).get({
+    responseStyle: "data",
+    security: [{ scheme: "bearer", type: "http" }],
+    url: "/v1/organizations/{organization_id}/mail-domains",
+    ...options,
+    ...params
+  });
+};
+var createWorkspaceMailDomain = (parameters, options) => {
+  const params = buildClientParams([parameters], [
+    {
+      args: [
+        { in: "headers", key: "X-Request-Id" },
+        { in: "headers", key: "Idempotency-Key" },
+        { in: "path", key: "organization_id" },
+        { key: "createWorkspaceMailDomainRequest", map: "body" }
+      ]
+    }
+  ]);
+  return (options?.client ?? client).post({
+    responseStyle: "data",
+    security: [{ scheme: "bearer", type: "http" }],
+    url: "/v1/organizations/{organization_id}/mail-domains",
+    ...options,
+    ...params,
+    headers: {
+      "Content-Type": "application/json",
+      ...options?.headers,
+      ...params.headers
+    }
+  });
+};
+var retireWorkspaceMailDomain = (parameters, options) => {
+  const params = buildClientParams([parameters], [
+    {
+      args: [
+        { in: "headers", key: "X-Request-Id" },
+        { in: "headers", key: "Idempotency-Key" },
+        { in: "path", key: "organization_id" },
+        { in: "path", key: "mail_domain_id" },
+        { key: "mailRevisionRequest", map: "body" }
+      ]
+    }
+  ]);
+  return (options?.client ?? client).delete({
+    responseStyle: "data",
+    security: [{ scheme: "bearer", type: "http" }],
+    url: "/v1/organizations/{organization_id}/mail-domains/{mail_domain_id}",
+    ...options,
+    ...params,
+    headers: {
+      "Content-Type": "application/json",
+      ...options?.headers,
+      ...params.headers
+    }
+  });
+};
+var getWorkspaceMailDomain = (parameters, options) => {
+  const params = buildClientParams([parameters], [
+    {
+      args: [
+        { in: "headers", key: "X-Request-Id" },
+        { in: "path", key: "organization_id" },
+        { in: "path", key: "mail_domain_id" }
+      ]
+    }
+  ]);
+  return (options?.client ?? client).get({
+    responseStyle: "data",
+    security: [{ scheme: "bearer", type: "http" }],
+    url: "/v1/organizations/{organization_id}/mail-domains/{mail_domain_id}",
+    ...options,
+    ...params
+  });
+};
+var revokeWorkspaceMailDomainDnsAuthorization = (parameters, options) => {
+  const params = buildClientParams([parameters], [
+    {
+      args: [
+        { in: "headers", key: "X-Request-Id" },
+        { in: "headers", key: "Idempotency-Key" },
+        { in: "path", key: "organization_id" },
+        { in: "path", key: "mail_domain_id" },
+        { key: "mailRevisionRequest", map: "body" }
+      ]
+    }
+  ]);
+  return (options?.client ?? client).delete({
+    responseStyle: "data",
+    security: [{ scheme: "bearer", type: "http" }],
+    url: "/v1/organizations/{organization_id}/mail-domains/{mail_domain_id}/dns-authorization",
+    ...options,
+    ...params,
+    headers: {
+      "Content-Type": "application/json",
+      ...options?.headers,
+      ...params.headers
+    }
+  });
+};
+var getWorkspaceMailDomainDnsAuthorization = (parameters, options) => {
+  const params = buildClientParams([parameters], [
+    {
+      args: [
+        { in: "headers", key: "X-Request-Id" },
+        { in: "path", key: "organization_id" },
+        { in: "path", key: "mail_domain_id" }
+      ]
+    }
+  ]);
+  return (options?.client ?? client).get({
+    responseStyle: "data",
+    security: [{ scheme: "bearer", type: "http" }],
+    url: "/v1/organizations/{organization_id}/mail-domains/{mail_domain_id}/dns-authorization",
+    ...options,
+    ...params
+  });
+};
+var authorizeWorkspaceMailDomainDns = (parameters, options) => {
+  const params = buildClientParams([parameters], [
+    {
+      args: [
+        { in: "headers", key: "X-Request-Id" },
+        { in: "headers", key: "Idempotency-Key" },
+        { in: "path", key: "organization_id" },
+        { in: "path", key: "mail_domain_id" },
+        { key: "sharedMailDnsAuthorizationRequest", map: "body" }
+      ]
+    }
+  ]);
+  return (options?.client ?? client).post({
+    responseStyle: "data",
+    security: [{ scheme: "bearer", type: "http" }],
+    url: "/v1/organizations/{organization_id}/mail-domains/{mail_domain_id}/dns-authorization",
+    ...options,
+    ...params,
+    headers: {
+      "Content-Type": "application/json",
+      ...options?.headers,
+      ...params.headers
+    }
+  });
+};
+var detachProjectMailDomainBinding = (parameters, options) => {
+  const params = buildClientParams([parameters], [
+    {
+      args: [
+        { in: "headers", key: "X-Request-Id" },
+        { in: "headers", key: "Idempotency-Key" },
+        { in: "path", key: "project_id" },
+        { in: "path", key: "environment_id" },
+        { key: "mailRevisionRequest", map: "body" }
+      ]
+    }
+  ]);
+  return (options?.client ?? client).delete({
+    responseStyle: "data",
+    security: [{ scheme: "bearer", type: "http" }],
+    url: "/v1/projects/{project_id}/environments/{environment_id}/mail-domain-binding",
+    ...options,
+    ...params,
+    headers: {
+      "Content-Type": "application/json",
+      ...options?.headers,
+      ...params.headers
+    }
+  });
+};
+var getProjectMailDomainBinding = (parameters, options) => {
+  const params = buildClientParams([parameters], [
+    {
+      args: [
+        { in: "headers", key: "X-Request-Id" },
+        { in: "path", key: "project_id" },
+        { in: "path", key: "environment_id" }
+      ]
+    }
+  ]);
+  return (options?.client ?? client).get({
+    responseStyle: "data",
+    security: [{ scheme: "bearer", type: "http" }],
+    url: "/v1/projects/{project_id}/environments/{environment_id}/mail-domain-binding",
+    ...options,
+    ...params
+  });
+};
+var putProjectMailDomainBinding = (parameters, options) => {
+  const params = buildClientParams([parameters], [
+    {
+      args: [
+        { in: "headers", key: "X-Request-Id" },
+        { in: "headers", key: "Idempotency-Key" },
+        { in: "path", key: "project_id" },
+        { in: "path", key: "environment_id" },
+        { key: "projectMailDomainBindingRequest", map: "body" }
+      ]
+    }
+  ]);
+  return (options?.client ?? client).put({
+    responseStyle: "data",
+    security: [{ scheme: "bearer", type: "http" }],
+    url: "/v1/projects/{project_id}/environments/{environment_id}/mail-domain-binding",
+    ...options,
+    ...params,
+    headers: {
+      "Content-Type": "application/json",
+      ...options?.headers,
+      ...params.headers
+    }
+  });
+};
+var revokeApplicationDomainIdentity = (parameters, options) => {
+  const params = buildClientParams([parameters], [
+    {
+      args: [
+        { in: "headers", key: "X-Request-Id" },
+        { in: "headers", key: "Idempotency-Key" },
+        { in: "path", key: "project_id" },
+        { key: "mailRevisionRequest", map: "body" }
+      ]
+    }
+  ]);
+  return (options?.client ?? client).delete({
+    responseStyle: "data",
+    security: [{ scheme: "bearer", type: "http" }],
+    url: "/v1/projects/{project_id}/application-domain-identity",
+    ...options,
+    ...params,
+    headers: {
+      "Content-Type": "application/json",
+      ...options?.headers,
+      ...params.headers
+    }
+  });
+};
+var getApplicationDomainIdentity = (parameters, options) => {
+  const params = buildClientParams([parameters], [
+    {
+      args: [
+        { in: "headers", key: "X-Request-Id" },
+        { in: "path", key: "project_id" }
+      ]
+    }
+  ]);
+  return (options?.client ?? client).get({
+    responseStyle: "data",
+    security: [{ scheme: "bearer", type: "http" }],
+    url: "/v1/projects/{project_id}/application-domain-identity",
+    ...options,
+    ...params
+  });
+};
+var declareApplicationDomainIdentity = (parameters, options) => {
+  const params = buildClientParams([parameters], [
+    {
+      args: [
+        { in: "headers", key: "X-Request-Id" },
+        { in: "headers", key: "Idempotency-Key" },
+        { in: "path", key: "project_id" },
+        { key: "applicationDomainIdentityRequest", map: "body" }
+      ]
+    }
+  ]);
+  return (options?.client ?? client).put({
+    responseStyle: "data",
+    security: [{ scheme: "bearer", type: "http" }],
+    url: "/v1/projects/{project_id}/application-domain-identity",
+    ...options,
+    ...params,
+    headers: {
+      "Content-Type": "application/json",
+      ...options?.headers,
+      ...params.headers
+    }
+  });
+};
+var verifyApplicationDomainIdentity = (parameters, options) => {
+  const params = buildClientParams([parameters], [
+    {
+      args: [
+        { in: "headers", key: "X-Request-Id" },
+        { in: "headers", key: "Idempotency-Key" },
+        { in: "path", key: "project_id" },
+        { key: "mailRevisionRequest", map: "body" }
+      ]
+    }
+  ]);
+  return (options?.client ?? client).post({
+    responseStyle: "data",
+    security: [{ scheme: "bearer", type: "http" }],
+    url: "/v1/projects/{project_id}/application-domain-identity/verify",
+    ...options,
+    ...params,
+    headers: {
+      "Content-Type": "application/json",
+      ...options?.headers,
+      ...params.headers
+    }
+  });
+};
+var revokeApplicationDomainIdentityDnsAuthorization = (parameters, options) => {
+  const params = buildClientParams([parameters], [
+    {
+      args: [
+        { in: "headers", key: "X-Request-Id" },
+        { in: "headers", key: "Idempotency-Key" },
+        { in: "path", key: "project_id" },
+        { key: "mailRevisionRequest", map: "body" }
+      ]
+    }
+  ]);
+  return (options?.client ?? client).delete({
+    responseStyle: "data",
+    security: [{ scheme: "bearer", type: "http" }],
+    url: "/v1/projects/{project_id}/application-domain-identity/dns-authorization",
+    ...options,
+    ...params,
+    headers: {
+      "Content-Type": "application/json",
+      ...options?.headers,
+      ...params.headers
+    }
+  });
+};
+var getApplicationDomainIdentityDnsAuthorization = (parameters, options) => {
+  const params = buildClientParams([parameters], [
+    {
+      args: [
+        { in: "headers", key: "X-Request-Id" },
+        { in: "path", key: "project_id" }
+      ]
+    }
+  ]);
+  return (options?.client ?? client).get({
+    responseStyle: "data",
+    security: [{ scheme: "bearer", type: "http" }],
+    url: "/v1/projects/{project_id}/application-domain-identity/dns-authorization",
+    ...options,
+    ...params
+  });
+};
+var authorizeApplicationDomainIdentityDns = (parameters, options) => {
+  const params = buildClientParams([parameters], [
+    {
+      args: [
+        { in: "headers", key: "X-Request-Id" },
+        { in: "headers", key: "Idempotency-Key" },
+        { in: "path", key: "project_id" },
+        { key: "sharedMailDnsAuthorizationRequest", map: "body" }
+      ]
+    }
+  ]);
+  return (options?.client ?? client).post({
+    responseStyle: "data",
+    security: [{ scheme: "bearer", type: "http" }],
+    url: "/v1/projects/{project_id}/application-domain-identity/dns-authorization",
+    ...options,
+    ...params,
+    headers: {
+      "Content-Type": "application/json",
+      ...options?.headers,
+      ...params.headers
+    }
+  });
+};
 var getAccountProfile = (options) => (options?.client ?? client).get({
   responseStyle: "data",
   security: [{ scheme: "bearer", type: "http" }],
@@ -45917,6 +46567,320 @@ async function executeManagedMail(client2, input) {
   return result;
 }
 
+// packages/sdk-ts/dist/generated/shared-mail-response.js
+var ULID4 = /^[0-7][0-9A-HJKMNP-TV-Z]{25}$/u;
+var HOST = /^(?=.{1,253}$)(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\.)+[a-z]{2,63}$/u;
+function assertSharedMailResponse(value, input) {
+  const v = object3(value);
+  if (input.action === "domains_list") {
+    exact5(v, ["items"]);
+    if (!Array.isArray(v["items"]) || v["items"].length > 100)
+      invalid6();
+    for (const item of v["items"])
+      assertSharedMailResponse(item, {
+        ...input,
+        action: "domain_get",
+        mailDomainId: String(object3(item)["domain_id"])
+      });
+    return;
+  }
+  if (["domain_get", "domain_create", "domain_retire"].includes(input.action)) {
+    exact5(v, [
+      "domain_id",
+      "organization_id",
+      "domain",
+      "registrable_domain",
+      "revision",
+      "status",
+      "sending",
+      "receiving",
+      "configured_at",
+      "observed_at",
+      "dns_records",
+      "bindings_count"
+    ]);
+    id3(v["domain_id"]);
+    id3(v["organization_id"]);
+    if (!("organizationId" in input) || v["organization_id"] !== input.organizationId || "mailDomainId" in input && v["domain_id"] !== input.mailDomainId)
+      invalid6();
+    host(v["domain"]);
+    host(v["registrable_domain"]);
+    positive(v["revision"]);
+    member(v["status"], ["active", "retiring", "retired"]);
+    for (const k of ["sending", "receiving"])
+      member(v[k], ["disabled", "pending", "ready", "failed"]);
+    time2(v["configured_at"]);
+    if (v["observed_at"] !== null)
+      time2(v["observed_at"]);
+    if (!Number.isSafeInteger(v["bindings_count"]) || Number(v["bindings_count"]) < 0)
+      invalid6();
+    if (!Array.isArray(v["dns_records"]))
+      invalid6();
+    for (const entry of v["dns_records"]) {
+      const r = object3(entry);
+      exact5(r, ["type", "name", "value", "purpose", "status"], ["priority"]);
+      member(r["type"], ["TXT", "MX", "CNAME"]);
+      for (const k of ["name", "value", "purpose", "status"])
+        if (typeof r[k] !== "string" || /[\r\n\0]/u.test(r[k]))
+          invalid6();
+      if (r["priority"] !== void 0 && (!Number.isSafeInteger(r["priority"]) || Number(r["priority"]) < 0 || Number(r["priority"]) > 65535))
+        invalid6();
+      if (r["type"] === "MX" && r["priority"] === void 0)
+        invalid6();
+    }
+    return;
+  }
+  if (["binding_get", "binding_set", "binding_detach"].includes(input.action)) {
+    exact5(v, [
+      "mail_domain_id",
+      "organization_id",
+      "project_id",
+      "environment_id",
+      "revision",
+      "sending",
+      "sender_addresses",
+      "default_from",
+      "default_reply_to",
+      "legacy",
+      "status",
+      "application_domain_identity"
+    ]);
+    for (const k of ["mail_domain_id", "organization_id", "project_id", "environment_id"])
+      id3(v[k]);
+    if (!("projectId" in input) || !("environmentId" in input) || v["project_id"] !== input.projectId || v["environment_id"] !== input.environmentId || "mailDomainId" in input && v["mail_domain_id"] !== input.mailDomainId)
+      invalid6();
+    positive(v["revision"]);
+    for (const k of ["sending", "legacy"])
+      if (typeof v[k] !== "boolean")
+        invalid6();
+    member(v["status"], ["active", "detached", "suspended"]);
+    if (!Array.isArray(v["sender_addresses"]) || v["sender_addresses"].length > 32 || new Set(v["sender_addresses"]).size !== v["sender_addresses"].length)
+      invalid6();
+    for (const a of v["sender_addresses"])
+      mailbox(a);
+    for (const k of ["default_from", "default_reply_to"])
+      if (v[k] !== null)
+        mailbox(v[k]);
+    if (!v["legacy"] && (!v["sender_addresses"].includes(v["default_from"]) || v["sender_addresses"].length === 0))
+      invalid6();
+    if (v["application_domain_identity"] !== null) {
+      const identity = object3(v["application_domain_identity"]);
+      exact5(identity, ["hostname", "registrable_domain", "revision", "status"]);
+      host(identity["hostname"]);
+      host(identity["registrable_domain"]);
+      positive(identity["revision"]);
+      member(identity["status"], ["pending", "verified", "expired", "revoked"]);
+    }
+    return;
+  }
+  if (["identity_get", "identity_declare", "identity_verify", "identity_revoke"].includes(input.action)) {
+    exact5(v, [
+      "organization_id",
+      "project_id",
+      "hostname",
+      "registrable_domain",
+      "status",
+      "revision",
+      "challenge",
+      "verified_at",
+      "expires_at"
+    ]);
+    id3(v["organization_id"]);
+    id3(v["project_id"]);
+    if (!("projectId" in input) || v["project_id"] !== input.projectId)
+      invalid6();
+    host(v["hostname"]);
+    host(v["registrable_domain"]);
+    positive(v["revision"]);
+    member(v["status"], ["pending", "verified", "expired", "revoked"]);
+    const challenge = object3(v["challenge"]);
+    exact5(challenge, ["type", "name", "value"]);
+    if (challenge["type"] !== "TXT" || typeof challenge["name"] !== "string" || challenge["name"] !== `_omh-project.${v["hostname"]}` || typeof challenge["value"] !== "string" || challenge["value"].length < 16 || challenge["value"].length > 255 || /[\r\n\0]/u.test(challenge["value"]))
+      invalid6();
+    if (v["verified_at"] !== null)
+      time2(v["verified_at"]);
+    time2(v["expires_at"]);
+    return;
+  }
+  if (input.action === "domain_dns_authorize" || input.action === "identity_authorize") {
+    exact5(v, ["authorization_id", "authorization_url", "expires_at"]);
+    id3(v["authorization_id"]);
+    time2(v["expires_at"]);
+    if (typeof v["authorization_url"] !== "string" || !/^https:\/\/dash\.cloudflare\.com\/oauth2\/auth\?/u.test(v["authorization_url"]))
+      invalid6();
+    return;
+  }
+  exact5(v, ["status", "zone", "scopes", "expires_at"]);
+  member(v["status"], ["not_authorized", "pending", "authorized", "expired", "revoked"]);
+  if (!Array.isArray(v["scopes"]) || v["scopes"].length > 2 || new Set(v["scopes"]).size !== v["scopes"].length || v["scopes"].some((s) => s !== "dns.write" && s !== "zone.read"))
+    invalid6();
+  if (v["zone"] !== null)
+    host(v["zone"]);
+  if (v["expires_at"] !== null)
+    time2(v["expires_at"]);
+  if (v["status"] === "not_authorized" && (v["zone"] !== null || v["expires_at"] !== null || v["scopes"].length))
+    invalid6();
+}
+function object3(v) {
+  if (v === null || typeof v !== "object" || Array.isArray(v))
+    invalid6();
+  return v;
+}
+function exact5(v, required, optional = []) {
+  if (required.some((k) => !(k in v)) || Object.keys(v).some((k) => !required.includes(k) && !optional.includes(k)))
+    invalid6();
+}
+function member(v, values) {
+  if (typeof v !== "string" || !values.includes(v))
+    invalid6();
+}
+function id3(v) {
+  if (typeof v !== "string" || !ULID4.test(v))
+    invalid6();
+}
+function host(v) {
+  if (typeof v !== "string" || !HOST.test(v))
+    invalid6();
+}
+function positive(v) {
+  if (!Number.isSafeInteger(v) || Number(v) < 1)
+    invalid6();
+}
+function time2(v) {
+  if (typeof v !== "string" || !Number.isFinite(Date.parse(v)) || new Date(v).toISOString() !== v)
+    invalid6();
+}
+function mailbox(v) {
+  if (typeof v !== "string" || v.length > 254 || !/^[A-Za-z0-9.!#$%&'*+\-/=?^_`{|}~]+@[a-z0-9.-]+\.[a-z]{2,63}$/u.test(v) || v.startsWith(".") || v.includes("..") || v.includes(".@"))
+    invalid6();
+}
+function invalid6() {
+  throw new TypeError("Shared mail response contract invalid");
+}
+
+// packages/sdk-ts/dist/shared-mail.js
+async function executeSharedMail(client2, input) {
+  const options = { client: client2 };
+  let result;
+  switch (input.action) {
+    case "domains_list":
+      result = await listWorkspaceMailDomains({ organization_id: input.organizationId }, options);
+      break;
+    case "domain_create":
+      result = await createWorkspaceMailDomain({
+        organization_id: input.organizationId,
+        "Idempotency-Key": input.idempotencyKey,
+        createWorkspaceMailDomainRequest: { domain: input.domain, sending: input.sending }
+      }, options);
+      break;
+    case "domain_get":
+      result = await getWorkspaceMailDomain({ organization_id: input.organizationId, mail_domain_id: input.mailDomainId }, options);
+      break;
+    case "domain_retire":
+      result = await retireWorkspaceMailDomain({
+        organization_id: input.organizationId,
+        mail_domain_id: input.mailDomainId,
+        "Idempotency-Key": input.idempotencyKey,
+        mailRevisionRequest: { expected_revision: input.expectedRevision }
+      }, options);
+      break;
+    case "domain_dns_authorize":
+      result = await authorizeWorkspaceMailDomainDns({
+        organization_id: input.organizationId,
+        mail_domain_id: input.mailDomainId,
+        "Idempotency-Key": input.idempotencyKey,
+        sharedMailDnsAuthorizationRequest: {
+          expected_revision: input.expectedRevision,
+          zone: input.zone
+        }
+      }, options);
+      break;
+    case "domain_dns_revoke":
+      result = await revokeWorkspaceMailDomainDnsAuthorization({
+        organization_id: input.organizationId,
+        mail_domain_id: input.mailDomainId,
+        "Idempotency-Key": input.idempotencyKey,
+        mailRevisionRequest: { expected_revision: input.expectedRevision }
+      }, options);
+      break;
+    case "identity_authorization_revoke":
+      result = await revokeApplicationDomainIdentityDnsAuthorization({
+        project_id: input.projectId,
+        "Idempotency-Key": input.idempotencyKey,
+        mailRevisionRequest: { expected_revision: input.expectedRevision }
+      }, options);
+      break;
+    case "domain_dns_status":
+      result = await getWorkspaceMailDomainDnsAuthorization({ organization_id: input.organizationId, mail_domain_id: input.mailDomainId }, options);
+      break;
+    case "binding_get":
+      result = await getProjectMailDomainBinding({ project_id: input.projectId, environment_id: input.environmentId }, options);
+      break;
+    case "binding_set":
+      result = await putProjectMailDomainBinding({
+        project_id: input.projectId,
+        environment_id: input.environmentId,
+        "Idempotency-Key": input.idempotencyKey,
+        projectMailDomainBindingRequest: {
+          mail_domain_id: input.mailDomainId,
+          sending: input.sending,
+          sender_addresses: [...input.senderAddresses],
+          default_from: input.defaultFrom,
+          default_reply_to: input.defaultReplyTo,
+          expected_revision: input.expectedRevision
+        }
+      }, options);
+      break;
+    case "binding_detach":
+      result = await detachProjectMailDomainBinding({
+        project_id: input.projectId,
+        environment_id: input.environmentId,
+        "Idempotency-Key": input.idempotencyKey,
+        mailRevisionRequest: { expected_revision: input.expectedRevision }
+      }, options);
+      break;
+    case "identity_get":
+      result = await getApplicationDomainIdentity({ project_id: input.projectId }, options);
+      break;
+    case "identity_declare":
+      result = await declareApplicationDomainIdentity({
+        project_id: input.projectId,
+        "Idempotency-Key": input.idempotencyKey,
+        applicationDomainIdentityRequest: { hostname: input.hostname }
+      }, options);
+      break;
+    case "identity_verify":
+      result = await verifyApplicationDomainIdentity({
+        project_id: input.projectId,
+        "Idempotency-Key": input.idempotencyKey,
+        mailRevisionRequest: { expected_revision: input.expectedRevision }
+      }, options);
+      break;
+    case "identity_revoke":
+      result = await revokeApplicationDomainIdentity({
+        project_id: input.projectId,
+        "Idempotency-Key": input.idempotencyKey,
+        mailRevisionRequest: { expected_revision: input.expectedRevision }
+      }, options);
+      break;
+    case "identity_authorize":
+      result = await authorizeApplicationDomainIdentityDns({
+        project_id: input.projectId,
+        "Idempotency-Key": input.idempotencyKey,
+        sharedMailDnsAuthorizationRequest: {
+          expected_revision: input.expectedRevision,
+          zone: input.zone
+        }
+      }, options);
+      break;
+    case "identity_authorization_status":
+      result = await getApplicationDomainIdentityDnsAuthorization({ project_id: input.projectId }, options);
+      break;
+  }
+  assertSharedMailResponse(result, input);
+  return result;
+}
+
 // apps/product-cli/dist/source-managed-client.js
 var GeneratedSdkManagedSourceApi = class {
   client;
@@ -46456,6 +47420,9 @@ var GeneratedSdkProductApi = class {
       secret_name: input.name
     }, { client: this.#client });
   }
+  sharedMail(input) {
+    return executeSharedMail(this.#client, input);
+  }
   managedMail(input) {
     return executeManagedMail(this.#client, input);
   }
@@ -47155,7 +48122,7 @@ function normalizeEgressOrigins(value) {
 }
 function forbiddenEgressHostname(hostname) {
   const normalized = hostname.toLowerCase();
-  return normalized === "localhost" || normalized.endsWith(".localhost") || normalized.endsWith(".local") || normalized.endsWith(".internal") || /^\d{1,3}(?:\.\d{1,3}){3}$/u.test(normalized) || normalized.startsWith("[") || normalized.endsWith("]");
+  return /^ohmyho-(?:mail|storage)-gateway-[a-z0-9][a-z0-9-]*\.[a-z0-9][a-z0-9-]*\.workers\.dev\.?$/u.test(normalized) || normalized === "localhost" || normalized.endsWith(".localhost") || normalized.endsWith(".local") || normalized.endsWith(".internal") || /^\d{1,3}(?:\.\d{1,3}){3}$/u.test(normalized) || normalized.startsWith("[") || normalized.endsWith("]");
 }
 function parseOhmyhostConfigYaml(source) {
   if (typeof source !== "string") {
@@ -47846,10 +48813,10 @@ function callOptions(tokens, closing, name) {
   return calls;
 }
 function nestedPropertyValue(tokens, closing, start, end, outer, inner) {
-  const object3 = directProperty(tokens, closing, start, end, outer);
-  if (object3?.value !== "{")
+  const object4 = directProperty(tokens, closing, start, end, outer);
+  if (object4?.value !== "{")
     return null;
-  return directProperty(tokens, closing, object3.start, object3.end, inner)?.value ?? null;
+  return directProperty(tokens, closing, object4.start, object4.end, inner)?.value ?? null;
 }
 function directProperty(tokens, closing, start, end, name) {
   let depth = 0;
@@ -47899,8 +48866,8 @@ function astroConfigFindings(text, path2, mode) {
     return [lexed.finding];
   const tokens = lexed.tokens;
   const hasPropertyKey = (items, name) => items.some((token, index) => token.value === name && items[index + 1]?.value === ":");
-  const invalid6 = hasNonRootProperty(tokens, ["base"], ["", "/"]) || ["srcDir", "outDir", "serverEntry", "client", "server", "assetsPrefix"].some((name) => hasPropertyKey(tokens, name)) || (mode === "edge" ? !text.includes("@astrojs/cloudflare") || !hasProperty(tokens, "output", "server") || !hasProperty(tokens, "session", "false") || !hasProperty(tokens, "imageService", "passthrough") || hasPropertyKey(tokens, "cache") : text.includes("@astrojs/cloudflare") || hasPropertyKey(tokens, "adapter") || hasProperty(tokens, "output", "server"));
-  return invalid6 ? [diagnostic({ code: "astro_config_unsupported", path: path2 })] : [];
+  const invalid7 = hasNonRootProperty(tokens, ["base"], ["", "/"]) || ["srcDir", "outDir", "serverEntry", "client", "server", "assetsPrefix"].some((name) => hasPropertyKey(tokens, name)) || (mode === "edge" ? !text.includes("@astrojs/cloudflare") || !hasProperty(tokens, "output", "server") || !hasProperty(tokens, "session", "false") || !hasProperty(tokens, "imageService", "passthrough") || hasPropertyKey(tokens, "cache") : text.includes("@astrojs/cloudflare") || hasPropertyKey(tokens, "adapter") || hasProperty(tokens, "output", "server"));
+  return invalid7 ? [diagnostic({ code: "astro_config_unsupported", path: path2 })] : [];
 }
 
 // packages/contracts/dist/database-migration-errors.js
@@ -48286,6 +49253,8 @@ var UTF8 = new TextDecoder("utf-8", { fatal: true });
 var MAXIMUM_SOURCE_BYTES = 2 * 1024 * 1024;
 var SOURCE_MODULE_PATTERN = /\.(?:[cm]?[jt]s|[jt]sx)$/u;
 var STORAGE_CLIENT_CALL_PATTERN = /\bcreatePrivateStorageClient\s*\(/u;
+var GATEWAY_BINDING_NAME = /^OHMYHOST_(?:MAIL|STORAGE)_GATEWAY$/u;
+var GATEWAY_WORD_TOKEN = /[\p{ID_Start}_$][\p{ID_Continue}$]*/uy;
 var UNNAMED_MODULE_MESSAGES = Object.freeze({
   database_binding_private: 'The module at path reads a database connection string (DATABASE_URL, HYPERDRIVE, connectionString or a postgres:// URL); none reaches a customer Worker. Call the database with createPrivateDatabaseClient from "@ohmyhost/customer-runtime/database". Commit and push the change, then plan the new commit.',
   database_driver_unsupported: 'The module at path imports a database socket driver (pg, postgres, pg-native or mysql2); customer Workers cannot open sockets. Call the database with createPrivateDatabaseClient from "@ohmyhost/customer-runtime/database". Commit and push the change, then plan the new commit.'
@@ -48296,10 +49265,14 @@ function callsStorageClient(source) {
 var STORAGE_RUNTIME_BINDINGS = Object.freeze([
   "OHMYHOST_ENVIRONMENT_ID",
   "OHMYHOST_PROJECT_ID",
-  "OHMYHOST_STORAGE_GATEWAY",
   "OHMYHOST_STORAGE_GATEWAY_URL",
   "OHMYHOST_STORAGE_KEY"
 ]);
+var MAIL_RUNTIME_BINDINGS = Object.freeze([
+  "OHMYHOST_MAIL_GATEWAY_URL",
+  "OHMYHOST_MAIL_KEY",
+  "OHMYHOST_PROJECT_ID"
+]);
 var CUSTOMER_RUNTIME_SOURCE = `npm:@amerged/ohmyhost-runtime@${package_default.version}`;
 var PENDING_CHECKS = Object.freeze({
   installed_version: "compatibility.frameworks lists a version range that no lockfile ohmyho.st reads (package-lock.json v2/v3 or pnpm-lock.yaml v6/v9) resolves. Planning admits it; after the frozen install, the build checks the installed version against the same security minimum.",
@@ -48478,6 +49451,7 @@ async function judgeSource(context) {
       ...source.findings.map((finding) => requiredCatalogBlocker(finding, context.applicationRoot)),
       ...await workerModuleBlockers(context),
       ...await databaseContractBlockers(context, context.provider),
+      ...await gatewayBindingBlockers(context),
       ...await storageClientBlockers(context),
       ...await migrationSqlBlockers(context, context.provider)
     ],
@@ -48526,6 +49500,147 @@ async function workerModuleBlockers(context) {
   const source = await readFile3(resolve5(context.applicationDirectory, path2), "utf8");
   return workerModuleFindings({ path: path2, source, fetch: framework === "functions", scheduled }).map((finding) => requiredCatalogBlocker(finding, context.applicationRoot));
 }
+function gatewaySourceTokens(source) {
+  const tokens = [];
+  let cursor = 0;
+  const quoted = (quote) => {
+    const start = cursor++;
+    while (cursor < source.length) {
+      const character = source[cursor++];
+      if (character === "\\")
+        cursor++;
+      else if (character === quote)
+        break;
+    }
+    tokens.push(source.slice(start, cursor));
+  };
+  const code = (interpolation) => {
+    let braces = 0;
+    while (cursor < source.length) {
+      const character = source[cursor];
+      if (interpolation && character === "}" && braces === 0) {
+        cursor++;
+        return;
+      }
+      if (character === '"' || character === "'") {
+        quoted(character);
+        continue;
+      }
+      if (character === "`") {
+        cursor++;
+        while (cursor < source.length) {
+          const literal = source[cursor++];
+          if (literal === "\\")
+            cursor++;
+          else if (literal === "`")
+            break;
+          else if (literal === "$" && source[cursor] === "{") {
+            cursor++;
+            tokens.push("(");
+            code(true);
+            tokens.push(")");
+          }
+        }
+        continue;
+      }
+      if (/\s/u.test(character)) {
+        cursor++;
+        continue;
+      }
+      if (character === "{")
+        braces++;
+      if (character === "}")
+        braces--;
+      GATEWAY_WORD_TOKEN.lastIndex = cursor;
+      const word = GATEWAY_WORD_TOKEN.exec(source)?.[0];
+      const token = word ?? (["?.", "=>"].includes(source.slice(cursor, cursor + 2)) ? source.slice(cursor, cursor + 2) : character);
+      tokens.push(token);
+      cursor += token.length;
+    }
+  };
+  code(false);
+  return tokens;
+}
+function usesGatewayBinding(source) {
+  const tokens = gatewaySourceTokens(sourceWithoutComments(source));
+  const objects = [];
+  let declaration;
+  let declarationDepth = 0;
+  for (let index = 0; index < tokens.length; index++) {
+    const token = tokens[index];
+    const previous = tokens[index - 1];
+    const next = tokens[index + 1];
+    if (declaration !== void 0) {
+      if (declarationDepth === 0 && (token === ";" || /^(?:export|const|let|var|function|class|type|interface)$/u.test(token))) {
+        declaration = void 0;
+        if (token === ";")
+          continue;
+      } else {
+        if (token === "{" || token === "(" || token === "[")
+          declarationDepth++;
+        if (token === "}" || token === ")" || token === "]") {
+          declarationDepth--;
+          if (declaration !== "type" && declarationDepth === 0)
+            declaration = void 0;
+        }
+        continue;
+      }
+    }
+    if ((token === "type" || token === "interface") && next !== void 0 && /^[\p{ID_Start}_$][\p{ID_Continue}$]*$/u.test(next) && previous !== "." && previous !== "?.") {
+      declaration = token;
+      continue;
+    }
+    if (token === "{" && previous === ":" && /^(?:const|let|var)$/u.test(tokens[index - 3] ?? "")) {
+      declaration = "annotation";
+      declarationDepth = 1;
+      continue;
+    }
+    if (token === "{")
+      objects.push(false);
+    if (token === "}") {
+      const gateway = objects.pop();
+      let after = index + 1;
+      if (tokens[after] === ":") {
+        after++;
+        while (after < tokens.length && !/^(?:=|;|\{|\})$/u.test(tokens[after]))
+          after++;
+      }
+      if (gateway && tokens[after] === "=")
+        return true;
+    }
+    const quoted = token.startsWith('"') || token.startsWith("'");
+    const name = quoted ? token.slice(1, -1) : token;
+    if (!GATEWAY_BINDING_NAME.test(name))
+      continue;
+    if (!quoted && (previous === "." || previous === "?."))
+      return true;
+    const receiver = tokens[index - (tokens[index - 2] === "?." ? 3 : 2)] ?? "";
+    if (quoted && previous === "[" && next === "]" && (/^[\p{ID_Start}_$][\p{ID_Continue}$]*$/u.test(receiver) || receiver === ")" || receiver === "]") && !/^(?:return|throw|yield|case|new|typeof|void|delete|await|in|of)$/u.test(receiver))
+      return true;
+    if (objects.length > 0 && (previous === "{" || previous === ",") && (next === ":" || next === "," || next === "}" || next === "="))
+      objects[objects.length - 1] = true;
+  }
+  return false;
+}
+async function gatewayBindingBlockers(context) {
+  const blockers = [];
+  for (const path2 of context.files) {
+    if (!SOURCE_MODULE_PATTERN.test(path2) || /\.d\.[cm]?ts$/u.test(path2))
+      continue;
+    const absolute = resolve5(context.applicationDirectory, path2);
+    const information = await stat2(absolute);
+    if (!information.isFile() || information.size > MAXIMUM_SOURCE_BYTES)
+      continue;
+    if (!usesGatewayBinding(await readFile3(absolute, "utf8")))
+      continue;
+    blockers.push({
+      code: "gateway_binding_unsupported",
+      path: repositoryPath(context.applicationRoot, path2),
+      message: "Mail and storage gateway Service Bindings are unsupported. In server code, create the client from its OHMYHOST_MAIL_GATEWAY_URL or OHMYHOST_STORAGE_GATEWAY_URL, environment key and project ID, plus the environment ID for storage. Use the global fetch with fetch: (request) => fetch(request), and capabilityFetch: (request) => fetch(request) for storage signed URLs."
+    });
+  }
+  return blockers;
+}
 async function storageClientBlockers(context) {
   if (context.config?.storage === void 0)
     return [];
@@ -48543,7 +49658,7 @@ async function storageClientBlockers(context) {
     {
       code: "storage_client_missing",
       path: null,
-      message: 'ohmyhost.yaml declares storage, but no application source calls createPrivateStorageClient. Import it from "@ohmyhost/customer-runtime/storage" and build it in server code from OHMYHOST_STORAGE_GATEWAY, OHMYHOST_STORAGE_GATEWAY_URL, OHMYHOST_PROJECT_ID, OHMYHOST_ENVIRONMENT_ID and OHMYHOST_STORAGE_KEY, then reserve an upload, PUT the bytes to the returned signed URL, complete it, and serve reads with createSignedRead. There is no FILES bucket binding.'
+      message: 'ohmyhost.yaml declares storage, but no application source calls createPrivateStorageClient. Import it from "@ohmyhost/customer-runtime/storage" and build it in server code from OHMYHOST_STORAGE_GATEWAY_URL, OHMYHOST_PROJECT_ID, OHMYHOST_ENVIRONMENT_ID and OHMYHOST_STORAGE_KEY, with the global fetch as fetch: (request) => fetch(request) and capabilityFetch: (request) => fetch(request). Reserve an upload, PUT the bytes to the returned signed URL, complete it, and serve reads with createSignedRead. There is no FILES bucket binding.'
     }
   ];
 }
@@ -48572,12 +49687,12 @@ function migrationFilenameBlockers(context, provider) {
     return [];
   const root = context.config?.database?.migrations ?? "postgres/migrations";
   const prefix = `${root}/`;
-  const invalid6 = context.files.filter((path2) => path2.startsWith(prefix)).map((path2) => path2.slice(prefix.length)).find((path2) => !/^(?:[A-Za-z0-9][A-Za-z0-9._-]*\/)*\d{14}_[a-z0-9][a-z0-9_-]*\.sql$/u.test(path2));
-  return invalid6 === void 0 ? [] : [
+  const invalid7 = context.files.filter((path2) => path2.startsWith(prefix)).map((path2) => path2.slice(prefix.length)).find((path2) => !/^(?:[A-Za-z0-9][A-Za-z0-9._-]*\/)*\d{14}_[a-z0-9][a-z0-9_-]*\.sql$/u.test(path2));
+  return invalid7 === void 0 ? [] : [
     {
       code: "migration_filename_noncanonical",
-      path: repositoryPath(context.applicationRoot, `${prefix}${invalid6}`),
-      message: `Migration file '${invalid6}' in ${root} is not named YYYYMMDDHHMMSS_name.sql (14 digits, an underscore, then lowercase letters, digits, _ or -). Every file in that directory must match, README and .gitkeep included: rename or move it, keeping the run order.`
+      path: repositoryPath(context.applicationRoot, `${prefix}${invalid7}`),
+      message: `Migration file '${invalid7}' in ${root} is not named YYYYMMDDHHMMSS_name.sql (14 digits, an underscore, then lowercase letters, digits, _ or -). Every file in that directory must match, README and .gitkeep included: rename or move it, keeping the run order.`
     }
   ];
 }
@@ -49058,10 +50173,12 @@ async function detectR2Storage(root, files) {
 function runtimeContract(capabilities) {
   return Object.freeze({
     bindings: Object.freeze([
-      ...capabilities.auth ? ["BETTER_AUTH_SECRET"] : [],
-      ...capabilities.storage ? STORAGE_RUNTIME_BINDINGS : [],
-      ...capabilities.database ? ["OHMYHOST_DATABASE"] : [],
-      ...capabilities.mail ? ["OHMYHOST_MAIL_KEY"] : []
+      .../* @__PURE__ */ new Set([
+        ...capabilities.auth ? ["BETTER_AUTH_SECRET"] : [],
+        ...capabilities.storage ? STORAGE_RUNTIME_BINDINGS : [],
+        ...capabilities.database ? ["OHMYHOST_DATABASE"] : [],
+        ...capabilities.mail ? MAIL_RUNTIME_BINDINGS : []
+      ])
     ].sort()),
     packages: Object.freeze({
       ...capabilities.auth ? { betterAuth: MANAGED_BETTER_AUTH_VERSION } : {},
@@ -49521,11 +50638,15 @@ var readTokenIdentity = async (input) => {
 var commandOrganizationId = (command) => {
   if (command.kind === "organization-use" || command.kind === "login")
     return void 0;
+  if (command.kind === "shared-mail" && "organizationId" in command.request)
+    return command.request.organizationId;
   if (command.kind === "feedback-submit")
     return command.report.organization_id;
   return "organizationId" in command && typeof command.organizationId === "string" ? command.organizationId : void 0;
 };
 var commandProjectId = (command) => {
+  if (command.kind === "shared-mail")
+    return "projectId" in command.request ? command.request.projectId : void 0;
   if (command.kind === "managed-mail")
     return command.request.projectId;
   return "projectId" in command && typeof command.projectId === "string" ? command.projectId : void 0;