@amerged/ohmyhost-mcp 0.1.11 → 0.1.14

package/src/apps/product-cli/command.ts

@@ -1,3 +1,4 @@
+import type { ManagedMailCommand } from "@ohmyhost/sdk-ts";
 import { USER_API_KEY_ID } from "@ohmyhost/contracts/user-api-keys";
 export type ProductCliCommand =
   | {
@@ -132,6 +133,15 @@ export type ProductCliCommand =
       readonly idempotencyKey: string;
       readonly credentialStore: "native";
     }
+  | {
+      /** Moves a project to a chosen address once its gateways serve it. */
+      readonly kind: "project-handle-set";
+      readonly projectId: string;
+      readonly handle: string;
+      readonly ifMatch: string;
+      readonly idempotencyKey: string;
+      readonly credentialStore: "native";
+    }
   | {
       /** Asks whether a project address is free; the candidate is sent exactly as the agent typed it. */
       readonly kind: "project-handle-check";
@@ -388,15 +398,19 @@ export type ProductCliCommand =
       readonly credentialStore: "native";
     }
   | {
-      readonly kind: "mail-domain-set";
-      readonly projectId: string;
-      readonly domain: string;
-      readonly idempotencyKey: string;
-      readonly credentialStore: "native";
-    }
-  | {
-      readonly kind: "mail-domain-status";
-      readonly projectId: string;
+      readonly kind: "managed-mail";
+      readonly request: ManagedMailCommand;
+      readonly label:
+        | "mail domain set"
+        | "mail domain status"
+        | "mail setup"
+        | "mail status"
+        | "mail webhook set"
+        | "mail webhook verify"
+        | "mail webhook disable"
+        | "mail messages list"
+        | "mail messages get"
+        | "mail messages retry";
       readonly credentialStore: "native";
     }
   | {
@@ -494,6 +508,7 @@ export type RecognizedCommandLabel =
   | "project status"
   | "project dev-access create"
   | "project handle check"
+  | "project handle set"
   | "database write"
   | "database query"
   | "database access create"
@@ -524,6 +539,14 @@ export type RecognizedCommandLabel =
   | "function runs"
   | "secret set"
   | "secret delete"
+  | "mail setup"
+  | "mail status"
+  | "mail webhook set"
+  | "mail webhook verify"
+  | "mail webhook disable"
+  | "mail messages list"
+  | "mail messages get"
+  | "mail messages retry"
   | "mail domain set"
   | "mail domain status";
 
@@ -585,6 +608,8 @@ export const recognizedCommandLabel = (argv: readonly string[]): RecognizedComma
     if (value === "project" && values[0] === "status") return "project status";
     if (value === "project" && values[0] === "handle" && values[1] === "check")
       return "project handle check";
+    if (value === "project" && values[0] === "handle" && values[1] === "set")
+      return "project handle set";
     if (value === "project" && values[0] === "dev-access" && values[1] === "create")
       return "project dev-access create";
     if (value === "database" && values[0] === "compute" && values[1] === "set")
@@ -627,6 +652,20 @@ export const recognizedCommandLabel = (argv: readonly string[]): RecognizedComma
       if (values[0] === "delete") return "secret delete";
     }
     if (value === "function" && values[0] === "runs") return "function runs";
+    if (value === "mail") {
+      if (values[0] === "setup") return "mail setup";
+      if (values[0] === "status") return "mail status";
+      if (values[0] === "webhook") {
+        if (values[1] === "set") return "mail webhook set";
+        if (values[1] === "verify") return "mail webhook verify";
+        if (values[1] === "disable") return "mail webhook disable";
+      }
+      if (values[0] === "messages") {
+        if (values[1] === "list") return "mail messages list";
+        if (values[1] === "get") return "mail messages get";
+        if (values[1] === "retry") return "mail messages retry";
+      }
+    }
     if (value === "mail" && values[0] === "domain") {
       if (values[1] === "set") return "mail domain set";
       if (values[1] === "status") return "mail domain status";
@@ -1054,6 +1093,24 @@ export const parseProductCliCommand = (argv: readonly string[]): ProductCliComma
   }
   if (first === "project") {
     const subcommand = values.shift();
+    if (subcommand === "handle" && values[0] === "set") {
+      values.shift();
+      if (yes || wait || follow || stdin) throw new InvalidCommandError();
+      const options = parseOptions(values, [
+        "--project",
+        "--handle",
+        "--if-match",
+        "--idempotency-key",
+      ]);
+      return {
+        kind: "project-handle-set",
+        projectId: options["--project"],
+        handle: options["--handle"],
+        ifMatch: options["--if-match"],
+        idempotencyKey: options["--idempotency-key"],
+        credentialStore,
+      };
+    }
     if (subcommand === "handle" && values.shift() === "check") {
       if (yes || wait || follow || stdin) throw new InvalidCommandError();
       const options = parseOptions(values, ["--handle"]);
@@ -1694,34 +1751,82 @@ export const parseProductCliCommand = (argv: readonly string[]): ProductCliComma
     }
     throw new InvalidCommandError();
   }
-  if (first === "mail" && values[0] === "domain" && values[1] === "set") {
+  if (first === "mail") {
     if (yes || wait || follow || stdin) throw new InvalidCommandError();
-    values.splice(0, 2);
-    const options = parseOptions(values, ["--project", "--domain", "--idempotency-key"]);
-    if (
-      !/^(?=.{1,253}$)(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\.)+[a-z]{2,63}$/u.test(
-        options["--domain"],
-      )
-    ) {
-      throw new InvalidCommandError();
-    }
-    return {
-      kind: "mail-domain-set",
-      projectId: options["--project"],
-      domain: options["--domain"],
-      idempotencyKey: options["--idempotency-key"],
-      credentialStore,
-    };
-  }
-  if (first === "mail" && values[0] === "domain" && values[1] === "status") {
-    if (yes || wait || follow || stdin) throw new InvalidCommandError();
-    values.splice(0, 2);
-    const options = parseOptions(values, ["--project"]);
-    return {
-      kind: "mail-domain-status",
-      projectId: options["--project"],
-      credentialStore,
+    const area = values.shift();
+    const sub =
+      area === "webhook" || area === "messages" || area === "domain" ? values.shift() : undefined;
+    const options = parseOptionalOptions(values, [
+      "--project",
+      "--environment",
+      "--domain",
+      "--sending",
+      "--receiving",
+      "--url",
+      "--idempotency-key",
+      "--message",
+      "--after",
+    ]);
+    const required = (key: keyof typeof options) => {
+      const value = options[key];
+      if (!value) throw new InvalidCommandError();
+      return value;
     };
+    const scope = { projectId: required("--project"), environmentId: required("--environment") };
+    let request: ManagedMailCommand,
+      label: Extract<ProductCliCommand, { kind: "managed-mail" }>["label"];
+    if (area === "setup" || (area === "domain" && sub === "set")) {
+      const sending = required("--sending"),
+        receiving = required("--receiving");
+      if (!["true", "false"].includes(sending) || !["true", "false"].includes(receiving))
+        throw new InvalidCommandError();
+      request = {
+        ...scope,
+        action: "configure",
+        domain: required("--domain"),
+        sending: sending === "true",
+        receiving: receiving === "true",
+        idempotencyKey: required("--idempotency-key"),
+      };
+      label = area === "domain" ? "mail domain set" : "mail setup";
+    } else if (area === "status" || (area === "domain" && sub === "status")) {
+      request = { ...scope, action: "status" };
+      label = area === "domain" ? "mail domain status" : "mail status";
+    } else if (area === "webhook" && sub === "set") {
+      request = {
+        ...scope,
+        action: "webhook_set",
+        url: required("--url"),
+        idempotencyKey: required("--idempotency-key"),
+      };
+      label = "mail webhook set";
+    } else if (area === "webhook" && (sub === "verify" || sub === "disable")) {
+      request = {
+        ...scope,
+        action: sub === "verify" ? "webhook_verify" : "webhook_disable",
+        idempotencyKey: required("--idempotency-key"),
+      };
+      label = sub === "verify" ? "mail webhook verify" : "mail webhook disable";
+    } else if (area === "messages" && sub === "list") {
+      request = {
+        ...scope,
+        action: "messages_list",
+        ...(options["--after"] ? { after: options["--after"] } : {}),
+      };
+      label = "mail messages list";
+    } else if (area === "messages" && sub === "get") {
+      request = { ...scope, action: "message_get", messageId: required("--message") };
+      label = "mail messages get";
+    } else if (area === "messages" && sub === "retry") {
+      request = {
+        ...scope,
+        action: "message_retry",
+        messageId: required("--message"),
+        idempotencyKey: required("--idempotency-key"),
+      };
+      label = "mail messages retry";
+    } else throw new InvalidCommandError();
+    return { kind: "managed-mail", request, label, credentialStore };
   }
   throw new InvalidCommandError();
 };

package/src/apps/product-cli/composition.ts

@@ -429,9 +429,11 @@ const runOfflineInit = async (
       false,
       error instanceof RepositoryInitConflictError
         ? "Keep the existing ohmyhost.yaml or remove it explicitly before retrying."
-        : error instanceof RepositoryInitError && error.code === "project_name_invalid"
-          ? "Pass a lowercase deployment slug with '--project', then rerun init."
-          : "Run 'ohmyhost init --dry-run --json' and resolve every reported blocker.",
+        : error instanceof RepositoryInitError && error.code === "repository_root_required"
+          ? "Run ohmyhost init from the Git repository root with --root set to the application directory (for example --root website); commit the root ohmyhost.yaml before planning."
+          : error instanceof RepositoryInitError && error.code === "project_name_invalid"
+            ? "Pass a lowercase deployment slug with '--project', then rerun init."
+            : "Run 'ohmyhost init --dry-run --json' and resolve every reported blocker.",
     );
     io.writeStdout(result.stdout);
     return result.exitCode;

package/src/apps/product-cli/product-api.ts

@@ -1,3 +1,4 @@
+import { executeManagedMail, type ManagedMailCommand } from "@ohmyhost/sdk-ts";
 import {
   assertProjectDatabaseAccess,
   assertProjectDatabaseAccessCredential,
@@ -53,7 +54,6 @@ import {
   type ProjectCreditBudget,
   applyPaidProjectDomain,
   configureProjectDomains,
-  configureProjectMailDomain,
   configureProjectSourceAutoDeploy,
   createCloudflareDnsAuthorization,
   createProjectDevAccessTicket,
@@ -74,7 +74,6 @@ import {
   getAccountProfile,
   getCurrentIdentity,
   getDeployment,
-  getProjectMailDomain,
   getProjectSourceAutoDeploy,
   getProjectStatus,
   getPaidProjectDomain,
@@ -83,6 +82,7 @@ import {
   listEnvironmentSecrets,
   listFunctionRuns,
   listProjects,
+  changeProjectHandle,
   getProjectHandleAvailability,
   planDeployment,
   planPaidProjectDomain,
@@ -112,7 +112,6 @@ import {
   type DeleteEnvironmentSecretResult,
   type OhMyHostClient,
   type ProviderReconciliationAttempt,
-  type ProjectMailDomain,
   type CurrentIdentity,
   type DevAccessTicket,
   type ProjectPage,
@@ -211,6 +210,12 @@ export interface ProductApi {
   getAccountProfile(): Promise<readonly PublicWorkspace[]>;
   listProjects(input: { readonly cursor?: string; readonly limit: number }): Promise<ProjectPage>;
   checkProjectHandle(input: { readonly handle: string }): Promise<ProjectHandleAvailability>;
+  changeProjectHandle(input: {
+    readonly projectId: string;
+    readonly handle: string;
+    readonly ifMatch: string;
+    readonly idempotencyKey: string;
+  }): Promise<Operation>;
   getProjectStatus(projectId: string): Promise<ProjectStatus>;
   writeProjectDatabase(
     input: ProjectDatabaseWriteRequest & { projectId: string; idempotencyKey: string },
@@ -368,12 +373,7 @@ export interface ProductApi {
     readonly name: string;
     readonly idempotencyKey: string;
   }): Promise<DeleteEnvironmentSecretResult>;
-  configureMailDomain(input: {
-    readonly projectId: string;
-    readonly domain: string;
-    readonly idempotencyKey: string;
-  }): Promise<ProjectMailDomain>;
-  getMailDomain(projectId: string): Promise<ProjectMailDomain>;
+  managedMail?(input: ManagedMailCommand): Promise<unknown>;
 }
 
 export class GeneratedSdkProductApi implements ProductApi {
@@ -585,6 +585,23 @@ export class GeneratedSdkProductApi implements ProductApi {
     return listProjects(input, { client: this.#client });
   }
 
+  public async changeProjectHandle(input: {
+    readonly projectId: string;
+    readonly handle: string;
+    readonly ifMatch: string;
+    readonly idempotencyKey: string;
+  }): Promise<Operation> {
+    return changeProjectHandle(
+      {
+        project_id: input.projectId,
+        "Idempotency-Key": input.idempotencyKey,
+        "If-Match": input.ifMatch,
+        handle: input.handle,
+      },
+      { client: this.#client },
+    );
+  }
+
   public async checkProjectHandle(input: {
     readonly handle: string;
   }): Promise<ProjectHandleAvailability> {
@@ -1070,22 +1087,7 @@ export class GeneratedSdkProductApi implements ProductApi {
     );
   }
 
-  public async configureMailDomain(input: {
-    readonly projectId: string;
-    readonly domain: string;
-    readonly idempotencyKey: string;
-  }): Promise<ProjectMailDomain> {
-    return configureProjectMailDomain(
-      {
-        "Idempotency-Key": input.idempotencyKey,
-        project_id: input.projectId,
-        configureProjectMailDomainRequest: { domain: input.domain },
-      },
-      { client: this.#client },
-    );
-  }
-
-  public async getMailDomain(projectId: string): Promise<ProjectMailDomain> {
-    return getProjectMailDomain({ project_id: projectId }, { client: this.#client });
+  public managedMail(input: ManagedMailCommand) {
+    return executeManagedMail(this.#client, input);
   }
 }

package/src/apps/product-cli/repository-init.ts

@@ -1,6 +1,6 @@
 import { createHash } from "node:crypto";
 import { lstat, open, readFile, readdir, stat } from "node:fs/promises";
-import { posix, resolve } from "node:path";
+import { dirname, posix, resolve } from "node:path";
 
 import {
   normalizeApplicationRoot,
@@ -50,7 +50,7 @@ const MAXIMUM_SOURCE_BYTES = 2 * 1024 * 1024;
 const SOURCE_MODULE_PATTERN = /\.(?:[cm]?[jt]s|[jt]sx)$/u;
 const STORAGE_CLIENT_CALL_PATTERN = /\bcreatePrivateStorageClient\s*\(/u;
 // Both database mistakes of 2026-09-18 are visible in the source before anything is built: one read
-// a Hyperdrive connection string, the other opened a socket driver. Neither can work in a Worker, so
+// a retired database binding, the other opened a socket driver. Neither can work in a customer Worker, so
 // naming them here costs a customer minutes instead of a deployment that fails its health check.
 const DATABASE_PRIVATE_BINDING_PATTERN =
   /\bHYPERDRIVE\b|\bconnectionString\b|\bDATABASE_URL\b|postgres(?:ql)?:\/\//u;
@@ -549,7 +549,7 @@ async function databaseContractBlockers(
     if (DATABASE_PRIVATE_BINDING_PATTERN.test(source)) {
       blockers.push({
         code: "database_binding_private",
-        message: `${path} reaches for a managed database connection string. Hyperdrive, DATABASE_URL and postgres:// URLs are platform-private and never reach a customer Worker. Call the database with createPrivateDatabaseClient from "@ohmyhost/customer-runtime/database".`,
+        message: `${path} reaches for a managed database connection string. HYPERDRIVE is retired; DATABASE_URL and postgres:// URLs never reach a customer Worker. Call the database with createPrivateDatabaseClient from "@ohmyhost/customer-runtime/database".`,
       });
     }
     if (DATABASE_SOCKET_DRIVER_PATTERN.test(source)) {
@@ -876,6 +876,30 @@ async function assertRepositoryRoot(root: string): Promise<void> {
   if (!information.isDirectory()) {
     throw new RepositoryInitError("repository_not_directory", "Repository path is not a directory");
   }
+  // A Git worktree uses a .git file; never read or follow that file's target.
+  for (let ancestor = root; ; ancestor = dirname(ancestor)) {
+    let marker;
+    try {
+      marker = await lstat(resolve(ancestor, ".git"));
+    } catch (error) {
+      if ((error as NodeJS.ErrnoException).code !== "ENOENT") {
+        throw new RepositoryInitError(
+          "repository_unreadable",
+          "Could not determine the Git repository root",
+        );
+      }
+    }
+    if (marker !== undefined) {
+      if (ancestor !== root) {
+        throw new RepositoryInitError(
+          "repository_root_required",
+          "Run ohmyhost init from the Git repository root and select the application directory with --root; ohmyhost.yaml must be at the repository root.",
+        );
+      }
+      return;
+    }
+    if (dirname(ancestor) === ancestor) return;
+  }
 }
 
 async function collectRepositoryFiles(root: string): Promise<string[]> {

package/src/apps/product-cli/runtime-contract.ts

@@ -129,6 +129,29 @@ const PROBLEM_POLICY = {
     retryable: true,
     action: "Retry project creation with the same idempotency key.",
   },
+  project_handle_taken: {
+    status: 409,
+    retryable: false,
+    action:
+      "Run 'ohmyhost project handle check' for a free address, then rename to one of the alternatives it returns.",
+  },
+  project_handle_invalid: {
+    status: 409,
+    retryable: false,
+    action:
+      "Choose one to five lowercase words of letters and digits, three to fifty-nine characters, avoiding reserved words.",
+  },
+  project_handle_unchanged: {
+    status: 409,
+    retryable: false,
+    action: "The project already answers on this address; no rename is needed.",
+  },
+  project_rename_blocked: {
+    status: 409,
+    retryable: true,
+    action:
+      "Wait for the running operation to finish, read the project again, then rename with the new ETag.",
+  },
   project_identity_unavailable: {
     status: 503,
     retryable: true,
@@ -196,6 +219,12 @@ const PROBLEM_POLICY = {
     action:
       "Run 'ohmyhost init', apply the matching ohmyhost framework skill, then plan the new commit.",
   },
+  repository_configuration_missing: {
+    status: 409,
+    retryable: false,
+    action:
+      "Place ohmyhost.yaml at the Git repository root and set applicationRoot to the application directory (for example website). Commit and push the change, then plan the new commit.",
+  },
   migration_filename_noncanonical: {
     status: 409,
     retryable: false,
@@ -278,6 +307,7 @@ export class ResponseContractError extends Error {
 }
 
 export interface SafeProblem {
+  readonly requestId: string;
   readonly retryAfterSeconds?: number;
   readonly code: ProblemCode;
   readonly retryable: boolean;
@@ -676,9 +706,9 @@ export const parseDevAccessTicket = (value: unknown): PublicDevAccessTicket => {
     !isUlid(input["project_id"]) ||
     !isUlid(input["environment_id"]) ||
     typeof origin !== "string" ||
-    !/^https:\/\/dev-[a-z]+-[a-z]+-[a-z]+\.(?:dev\.)?check\.omh\.st$/u.test(origin) ||
+    !/^https:\/\/dev-[a-z0-9]+(?:-[a-z0-9]+){0,4}\.(?:dev\.)?check\.omh\.st$/u.test(origin) ||
     typeof redeemUrl !== "string" ||
-    !/^https:\/\/dev-[a-z]+-[a-z]+-[a-z]+\.(?:dev\.)?check\.omh\.st\/\.ohmyhost\/dev-access\/redeem\?stage=dev&ticket=[A-Za-z0-9_-]{43}$/u.test(
+    !/^https:\/\/dev-[a-z0-9]+(?:-[a-z0-9]+){0,4}\.(?:dev\.)?check\.omh\.st\/\.ohmyhost\/dev-access\/redeem\?stage=dev&ticket=[A-Za-z0-9_-]{43}$/u.test(
       redeemUrl,
     ) ||
     new URL(redeemUrl).origin !== origin ||
@@ -880,8 +910,8 @@ const parseProject = (value: unknown): PublicProject => {
     !isUlid(input["organization_id"]) ||
     !boundedString(input["name"], 1, 128) ||
     input["name"] !== input["name"].trim() ||
-    !boundedString(input["handle"], 5, 59) ||
-    !/^[a-z]+-[a-z]+-[a-z]+$/u.test(input["handle"]) ||
+    !boundedString(input["handle"], 3, 59) ||
+    !/^[a-z0-9]+(?:-[a-z0-9]+){0,4}$/u.test(input["handle"]) ||
     (input["data_mode"] !== "shared" && input["data_mode"] !== "isolated") ||
     (input["region"] !== "us" && input["region"] !== "eu") ||
     !isIsoInstant(input["created_at"])
@@ -910,6 +940,7 @@ export const parseProjectPage = (
 export const parseProjectStatus = (value: unknown): Readonly<Record<string, unknown>> => {
   const input = exactRecord(value, [
     "project_id",
+    "etag",
     "handle",
     "region",
     "lifecycle",
@@ -925,8 +956,10 @@ export const parseProjectStatus = (value: unknown): Readonly<Record<string, unkn
   const handle = input["handle"];
   if (
     !isUlid(input["project_id"]) ||
-    !boundedString(handle, 5, 59) ||
-    !/^[a-z]+-[a-z]+-[a-z]+$/u.test(handle) ||
+    typeof input["etag"] !== "string" ||
+    !/^"sha256-[a-f0-9]{64}"$/u.test(input["etag"]) ||
+    !boundedString(handle, 3, 59) ||
+    !/^[a-z0-9]+(?:-[a-z0-9]+){0,4}$/u.test(handle) ||
     (input["region"] !== "us" && input["region"] !== "eu") ||
     (input["lifecycle"] !== "active" &&
       input["lifecycle"] !== "deleting" &&
@@ -1271,100 +1304,6 @@ function validDelivery(input: Readonly<Record<string, unknown>>): boolean {
   );
 }
 
-export type PublicProjectMailDomain =
-  | Readonly<{ domain: string; status: "configured"; configured_at: string }>
-  | Readonly<{
-      domain: string;
-      status: "delegation_required" | "ready" | "verification_pending" | "verification_failed";
-      observed_at?: string;
-      verification_issue?:
-        | "identity_missing"
-        | "identity_verification_failed"
-        | "dkim_verification_failed"
-        | "dkim_records_changed"
-        | "tenant_association_missing"
-        | null;
-      next_check_after_seconds?: 3600 | null;
-      configured_at: string;
-      name_servers: readonly [string, string, string, string];
-      change_id: string;
-    }>;
-
-export const parseProjectMailDomain = (value: unknown): PublicProjectMailDomain => {
-  const input = exactRecord(value, [
-    "domain",
-    "status",
-    "configured_at",
-    "name_servers",
-    "change_id",
-    "observed_at",
-    "verification_issue",
-    "next_check_after_seconds",
-  ]);
-  if (
-    typeof input["domain"] !== "string" ||
-    !/^(?=.{1,253}$)(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\.)+[a-z]{2,63}$/u.test(
-      input["domain"],
-    ) ||
-    !isIsoInstant(input["configured_at"])
-  ) {
-    throw new ResponseContractError();
-  }
-  if (input["status"] === "configured") {
-    if (
-      input["name_servers"] !== undefined ||
-      input["change_id"] !== undefined ||
-      input["observed_at"] !== undefined ||
-      input["verification_issue"] !== undefined ||
-      input["next_check_after_seconds"] !== undefined
-    ) {
-      throw new ResponseContractError();
-    }
-    return input as unknown as PublicProjectMailDomain;
-  }
-  if (
-    !["delegation_required", "ready", "verification_pending", "verification_failed"].includes(
-      String(input["status"]),
-    ) ||
-    !Array.isArray(input["name_servers"]) ||
-    input["name_servers"].length !== 4 ||
-    new Set(input["name_servers"]).size !== 4 ||
-    input["name_servers"].some(
-      (nameServer) =>
-        typeof nameServer !== "string" ||
-        !/^ns-[0-9]{1,4}\.awsdns-[0-9]{1,2}\.(?:com|net|org|co\.uk)$/u.test(nameServer),
-    ) ||
-    typeof input["change_id"] !== "string" ||
-    !/^C[A-Z0-9]{8,31}$/u.test(input["change_id"])
-  ) {
-    throw new ResponseContractError();
-  }
-  if (input["observed_at"] !== undefined) {
-    if (
-      ![
-        null,
-        "identity_missing",
-        "identity_verification_failed",
-        "dkim_verification_failed",
-        "dkim_records_changed",
-        "tenant_association_missing",
-      ].includes(input["verification_issue"] as string | null)
-    )
-      throw new ResponseContractError();
-    if (
-      !isIsoInstant(input["observed_at"]) ||
-      input["next_check_after_seconds"] !== (input["status"] === "ready" ? null : 3600)
-    )
-      throw new ResponseContractError();
-  } else if (
-    input["next_check_after_seconds"] !== undefined ||
-    input["verification_issue"] !== undefined ||
-    ["verification_pending", "verification_failed"].includes(String(input["status"]))
-  )
-    throw new ResponseContractError();
-  return input as unknown as PublicProjectMailDomain;
-};
-
 export const parseDeploymentPlan = (value: unknown): Readonly<Record<string, unknown>> => {
   const input = exactRecord(value, [
     "id",
@@ -1540,6 +1479,7 @@ export const parseSafeProblem = (value: unknown): SafeProblem => {
     !isHttpsUrl(input["type"]) ||
     !boundedString(input["title"], 1, 160) ||
     !boundedString(input["request_id"], 1, 128) ||
+    /[\p{Cc}\p{Cf}\p{Zl}\p{Zp}]/u.test(input["request_id"]) ||
     typeof input["retryable"] !== "boolean" ||
     !boundedString(input["suggested_action"], 1, 500) ||
     (input["detail"] !== undefined && !boundedString(input["detail"], 1, 2_000)) ||
@@ -1558,6 +1498,7 @@ export const parseSafeProblem = (value: unknown): SafeProblem => {
   )
     throw new ResponseContractError();
   return {
+    requestId: input["request_id"],
     code: code as ProblemCode,
     retryable: policy.retryable,
     suggestedAction: