@amerged/ohmyhost-mcp 0.1.20 → 0.1.21

package/dist/stdio-main.js

@@ -26,7 +26,7 @@ import {
   serverIdentityOf,
   setNegotiatedProtocolVersion,
   validateEnvelopeMeta
-} from "./chunk-NESQZ3BS.js";
+} from "./chunk-4WY7AAPR.js";
 
 // node_modules/.pnpm/@modelcontextprotocol+server@2.0.0/node_modules/@modelcontextprotocol/server/dist/stdio.mjs
 var StdioServerTransport = class {
@@ -516,7 +516,7 @@ function toError(value) {
 var failures = {
   operation_abandoned: [
     "The operation stopped renewing its execution lease and was ended.",
-    "Inspect project status and deployment diagnostics before creating a fresh plan. Keep this operation ID; the expired execution cannot resume."
+    "Inspect project status and, when this operation names a deployment_id, its diagnostics with 'ohmyhost deployment logs --project PROJECT_ULID --deployment DEPLOYMENT_ULID --follow --json' or MCP deployment_logs before creating a fresh plan. Keep this operation ID; the expired execution cannot resume."
   ],
   database_write_rejected: [
     "The database rejected this write; it was not committed.",
@@ -580,7 +580,7 @@ var failures = {
   ],
   build_failed: [
     "The build did not produce a verified deployable artifact.",
-    "Inspect the deployment build diagnostics and verify the install and build commands for the admitted commit. Correct the reported failure before planning a new deployment."
+    "Read the BUILD_FAILED diagnostic of this operation's deployment_id with 'ohmyhost deployment logs --project PROJECT_ULID --deployment DEPLOYMENT_ULID --follow --json' or MCP deployment_logs; its excerpt is the tail of the install and build output. Correct that failure and verify the commands for the admitted commit before planning a new deployment."
   ],
   insufficient_organization_credits: [
     "The organization does not have sufficient available credits for this operation.",
@@ -596,7 +596,7 @@ var failures = {
   ],
   runtime_candidate_failed: [
     "The deployed candidate failed its runtime checks.",
-    "Inspect deployment runtime diagnostics, required secrets and the health-check route before creating a new deployment plan."
+    "Read the HEALTH_CHECK_FAILED diagnostic of this operation's deployment_id with 'ohmyhost deployment logs --project PROJECT_ULID --deployment DEPLOYMENT_ULID --follow --json' or MCP deployment_logs. Its route must answer 2xx to a cookieless GET without a redirect; status_code and, for owners, excerpt show what it answered. Fix that, often a missing secret or a redirect, then plan a new deployment."
   ],
   runtime_candidate_rejected: [
     "The runtime rejected the built Worker script.",
@@ -799,7 +799,7 @@ function exact2(v, keys) {
 // apps/product-cli/package.json
 var package_default = {
   name: "@ohmyhost/product-cli",
-  version: "0.1.20",
+  version: "0.1.21",
   private: true,
   ohmyhost: {
     deployment: "production",
@@ -2168,6 +2168,11 @@ var PROBLEM_POLICY = {
     retryable: false,
     action: "Finish database provisioning, then request the export again. No backup was accepted."
   },
+  powered_by_flag_required: {
+    status: 409,
+    retryable: false,
+    action: "Keep the flag on, remove the custom domain with 'ohmyhost domain paid delete', or buy Paid, then switch the flag off."
+  },
   rate_limited: { status: 429, retryable: true, action: "Retry after the server delay." },
   insufficient_organization_credits: {
     status: 402,
@@ -2182,7 +2187,7 @@ var PROBLEM_POLICY = {
   paid_plan_required: {
     status: 402,
     retryable: false,
-    action: "Ask the organization Owner to activate Paid through billing checkout, then retry. Top-ups and signup credits do not activate Paid."
+    action: "Ask the organization Owner to activate Paid through billing checkout, then retry. Top-ups and signup credits do not activate Paid. For a website domain alone, a Free workspace may instead show the powered-by flag on the project."
   },
   interactive_login_required: {
     status: 403,
@@ -2290,6 +2295,18 @@ var parseDevAccessState = (value) => {
     throw new ResponseContractError();
   return input;
 };
+var parsePoweredByFlag = (value) => {
+  const input = exactRecord2(value, ["project_id", "enabled", "enabled_at"]);
+  if (!isUlid(input["project_id"]) || typeof input["enabled"] !== "boolean" || (input["enabled"] ? !isIsoInstant(input["enabled_at"]) : input["enabled_at"] !== null))
+    throw new ResponseContractError();
+  return input;
+};
+var parseOrganizationReferral = (value) => {
+  const input = exactRecord2(value, ["organization_id", "referral_url"]);
+  if (!isUlid(input["organization_id"]) || input["referral_url"] !== `https://ohmyho.st/?r=ref-${String(input["organization_id"]).toLowerCase()}`)
+    throw new ResponseContractError();
+  return input;
+};
 var parseDevAccessTicket = (value) => {
   const input = exactRecord2(value, [
     "ticket_id",
@@ -2381,6 +2398,7 @@ var parseSafeProblem = (value) => {
 var parseOperation = (value) => {
   const input = exactRecord2(value, [
     "blocking_operation_id",
+    "deployment_id",
     "id",
     "state",
     "created_at",
@@ -2396,7 +2414,8 @@ var parseOperation = (value) => {
   const updatedAt = input["updated_at"];
   const result = input["result"];
   const blockingOperationId = input["blocking_operation_id"];
-  if (blockingOperationId !== void 0 && (state !== "queued" || !isUlid(blockingOperationId) || blockingOperationId === id3))
+  const deploymentId = input["deployment_id"];
+  if (blockingOperationId !== void 0 && (state !== "queued" || !isUlid(blockingOperationId) || blockingOperationId === id3) || deploymentId !== void 0 && !isUlid(deploymentId))
     throw new ResponseContractError();
   if (!isUlid(id3) || !isOperationState(state) || !isIsoInstant(createdAt) || !isIsoInstant(updatedAt) || result !== void 0 && !isRecord2(result)) {
     throw new ResponseContractError();
@@ -2443,6 +2462,7 @@ var parseOperation = (value) => {
     created_at: createdAt,
     updated_at: updatedAt,
     ...blockingOperationId === void 0 ? {} : { blocking_operation_id: blockingOperationId },
+    ...deploymentId === void 0 ? {} : { deployment_id: deploymentId },
     ...progress === void 0 ? {} : { progress },
     ...result === void 0 ? {} : { result },
     ...error === void 0 ? {} : { error },
@@ -2597,6 +2617,7 @@ var HELP_USAGE = Object.freeze({
   "export create": "ohmyhost export create --project ULID --idempotency-key KEY --stdin --json (password on stdin only; one accepted SQL ZIP per project per 24 hours)",
   "export get": "ohmyhost export get EXPORT_ULID --project ULID --json (poll the original job; signed ZIP download lasts 24 hours)",
   "credits account": "ohmyhost credits account --organization ULID --json",
+  "referral link": "ohmyhost referral link --organization ULID --json (the workspace's link to share; a new user who signs up through it starts with a free Paid month and 1,000 credits, and their first payment gives this workspace the same)",
   "credits balance": "ohmyhost credits balance --organization ULID --json",
   "billing recharge get": "ohmyhost billing recharge get --organization ULID --json",
   "billing recharge set": "ohmyhost billing recharge set --organization ULID --enabled true|false --monthly-limit-minor CENTS --revision N --idempotency-key KEY [--consent off_session_v1] --json (explicit Owner consent required before enabling)",
@@ -2626,6 +2647,8 @@ var HELP_USAGE = Object.freeze({
   "project dev-share rotate": "ohmyhost project dev-share rotate --project ULID --idempotency-key KEY --yes --json",
   "project dev-share revoke": "ohmyhost project dev-share revoke --project ULID --idempotency-key KEY --yes --json",
   "project dev-access mode": "ohmyhost project dev-access mode --project ULID --mode protected|public --idempotency-key KEY --yes --json",
+  "project flag status": "ohmyhost project flag status --project ULID --json",
+  "project flag set": "ohmyhost project flag set --project ULID --enabled true|false --idempotency-key KEY --json (shows the small Powered by ohmyho.st flag on the production site; while it shows, a Free workspace may connect its own domain without the domain fee and each Paid period adds 250 credits)",
   "project handle check": "ohmyhost project handle check --handle HANDLE --json (is this address free? answers with a reason and free alternatives; the address becomes HANDLE.check.omh.st)",
   "project handle set": "ohmyhost project handle set --project ULID --handle HANDLE --if-match ETAG --idempotency-key KEY --json (moves the project to a free address; the old one stops working and anyone may claim it)",
   "database compute set": "ohmyhost database compute set --project ULID --environment dev|prod --profile standard|performance --idempotency-key KEY --yes [--wait] --json\n  standard: Free 0.25 CU/1 GB/60s idle, Paid 0.5 CU/2 GB/60s idle. performance: Paid 1 CU/4 GB/300s idle, 2.5x database compute credits per equal active minute; longer idle time also consumes credits.",
@@ -3567,6 +3590,23 @@ var getGithubOrganizationConnection = (parameters, options) => {
     ...params
   });
 };
+var getOrganizationReferral = (parameters, options) => {
+  const params = buildClientParams([parameters], [
+    {
+      args: [
+        { in: "headers", key: "X-Request-Id" },
+        { in: "path", key: "organization_id" }
+      ]
+    }
+  ]);
+  return (options?.client ?? client).get({
+    responseStyle: "data",
+    security: [{ scheme: "bearer", type: "http" }],
+    url: "/v1/organizations/{organization_id}/referral",
+    ...options,
+    ...params
+  });
+};
 var getOrganizationAccount = (parameters, options) => {
   const params = buildClientParams([parameters], [{ args: [{ in: "path", key: "organization_id" }] }]);
   return (options?.client ?? client).get({
@@ -4171,6 +4211,47 @@ var setProjectDevAccessMode = (parameters, options) => {
     }
   });
 };
+var getProjectPoweredByFlag = (parameters, options) => {
+  const params = buildClientParams([parameters], [
+    {
+      args: [
+        { in: "headers", key: "X-Request-Id" },
+        { in: "path", key: "project_id" }
+      ]
+    }
+  ]);
+  return (options?.client ?? client).get({
+    responseStyle: "data",
+    security: [{ scheme: "bearer", type: "http" }],
+    url: "/v1/projects/{project_id}/powered-by-flag",
+    ...options,
+    ...params
+  });
+};
+var setProjectPoweredByFlag = (parameters, options) => {
+  const params = buildClientParams([parameters], [
+    {
+      args: [
+        { in: "headers", key: "X-Request-Id" },
+        { in: "headers", key: "Idempotency-Key" },
+        { in: "path", key: "project_id" },
+        { key: "setPoweredByFlagRequest", map: "body" }
+      ]
+    }
+  ]);
+  return (options?.client ?? client).put({
+    responseStyle: "data",
+    security: [{ scheme: "bearer", type: "http" }],
+    url: "/v1/projects/{project_id}/powered-by-flag",
+    ...options,
+    ...params,
+    headers: {
+      "Content-Type": "application/json",
+      ...options?.headers,
+      ...params.headers
+    }
+  });
+};
 var createProjectDevAccessTicket = (parameters, options) => {
   const params = buildClientParams([parameters], [
     {
@@ -5429,6 +5510,9 @@ var GeneratedSdkProductApi = class {
   async getAccountProfile() {
     return parseAccountProfile(await getAccountProfile({ client: this.#client }));
   }
+  getOrganizationReferral(organizationId) {
+    return getOrganizationReferral({ organization_id: organizationId }, { client: this.#client });
+  }
   getOrganizationAccount(organizationId) {
     return getOrganizationAccount({ organization_id: organizationId }, { client: this.#client });
   }
@@ -5602,6 +5686,16 @@ var GeneratedSdkProductApi = class {
       setDevAccessModeRequest: { mode }
     }, { client: this.#client });
   }
+  async getPoweredByFlag(projectId) {
+    return getProjectPoweredByFlag({ project_id: projectId }, { client: this.#client });
+  }
+  async setPoweredByFlag(projectId, enabled, idempotencyKey2) {
+    return setProjectPoweredByFlag({
+      project_id: projectId,
+      "Idempotency-Key": idempotencyKey2,
+      setPoweredByFlagRequest: { enabled }
+    }, { client: this.#client });
+  }
   async createDevAccessTicket(projectId) {
     return createProjectDevAccessTicket({ project_id: projectId }, { client: this.#client });
   }
@@ -6361,6 +6455,9 @@ var GeneratedSdkLocalMcpClient = class {
     assertOrganizationAccount(account);
     return account;
   }
+  async getOrganizationReferral(organizationId) {
+    return parseOrganizationReferral(await getOrganizationReferral({ organization_id: organizationId }, { client: this.#client }));
+  }
   getOrganizationCredits(organizationId) {
     return getOrganizationCredits({ organization_id: organizationId }, { client: this.#client });
   }
@@ -6489,6 +6586,16 @@ var GeneratedSdkLocalMcpClient = class {
       setDevAccessModeRequest: { mode: input.mode }
     }, { client: this.#client }));
   }
+  async getPoweredByFlag(projectId) {
+    return parsePoweredByFlag(await getProjectPoweredByFlag({ project_id: projectId }, { client: this.#client }));
+  }
+  async setPoweredByFlag(input) {
+    return parsePoweredByFlag(await setProjectPoweredByFlag({
+      project_id: input.projectId,
+      "Idempotency-Key": input.idempotencyKey,
+      setPoweredByFlagRequest: { enabled: input.enabled }
+    }, { client: this.#client }));
+  }
   async rotateDevShareLink(input) {
     return parseDevAccessState(await rotateProjectDevShareLink({ project_id: input.projectId, "Idempotency-Key": input.idempotencyKey }, { client: this.#client }));
   }
@@ -6894,6 +7001,7 @@ function createLocalOhmyhostMcpServer(dependencies) {
     ...input.cursor ? { cursor: input.cursor } : {}
   }));
   registerProductTool(server, dependencies, "organization_account_get", "Owner-only: read the effective Free/Paid plan, its Stripe or granted source, available expiring Free credits and purchased credits that never expire, reservations and next expiry. Granted Paid features do not imply a Stripe subscription or extra monthly Paid allowance. This read grants no access or credits.", external_exports.object({ organization_id: identifier2 }), (client2, input) => client2.getOrganizationAccount(input.organization_id));
+  registerProductTool(server, dependencies, "referral_link_get", "Read the workspace's referral link to share. A new user whose first workspace comes from it starts with a free Paid month and 1,000 credits; that workspace's first payment gives this workspace the same. Any member may read it.", external_exports.object({ organization_id: identifier2 }), (client2, input) => client2.getOrganizationReferral(input.organization_id));
   registerProductTool(server, dependencies, "organization_credits_get", "Read the owner's shared organization credit pool, seven-day grace_started_at/grace_expires_at and published rate_cards. Existing services/domains are not immediately shut down at zero credit; an explicit project stop budget is separate. One credit is 1000000 microcredits. Each rate states credit_micros for units_per_charge; publication alone does not enable billing. active_meters identifies billed sources; provider outages and platform overrun are not customer debt. Works at zero credit.", external_exports.object({ organization_id: identifier2 }), (client2, input) => client2.getOrganizationCredits(input.organization_id));
   registerProductTool(server, dependencies, "project_budget_get", "Read the owner's project UTC-month budget, measured usage and open reservations. A budget never allocates a second wallet.", external_exports.object({ project_id: identifier2 }), (client2, input) => client2.getProjectCreditBudget(input.project_id));
   registerProductTool(server, dependencies, "project_budget_set", "Set an owner's optional monthly project budget in microcredits (1000000 = one credit). continue is the default and uses the org pool after the threshold; stop blocks new billable work. null clears the budget and requires continue. Changing it never resets usage or adds credits. Replay the same key after uncertainty; read the budget again for current usage.", external_exports.object({
@@ -7095,6 +7203,12 @@ function createLocalOhmyhostMcpServer(dependencies) {
     mode: input.mode,
     idempotencyKey: input.idempotency_key
   }), destructiveAnnotations());
+  registerProductTool(server, dependencies, "powered_by_flag_get", 'Read whether the production site shows the opt-in "Powered by ohmyho.st" flag.', external_exports.object({ project_id: identifier2 }), (client2, input) => client2.getPoweredByFlag(input.project_id));
+  registerProductTool(server, dependencies, "powered_by_flag_set", `Owner only, ask the human first: show or hide a small "Powered by ohmyho.st" flag on the right edge of the production site. While it is on, a Free workspace may connect its own domain to this project free of the domain fee, and each Paid period adds 250 credits. Hiding it is refused while a Free workspace's domain depends on it. Replay the same key and value after uncertainty to get the first answer without switching again; every new switch needs a new key.`, external_exports.object({ project_id: identifier2, enabled: external_exports.boolean(), idempotency_key: idempotencyKey }), (client2, input) => client2.setPoweredByFlag({
+    projectId: input.project_id,
+    enabled: input.enabled,
+    idempotencyKey: input.idempotency_key
+  }), mutationAnnotations());
   registerProductTool(server, dependencies, "project_dev_share_link_rotate", "Owner only: replace the persistent Dev link and immediately revoke old links and sessions. Repeat the same key after uncertainty.", external_exports.object({ project_id: identifier2, idempotency_key: idempotencyKey }), (client2, input) => client2.rotateDevShareLink({
     projectId: input.project_id,
     idempotencyKey: input.idempotency_key
@@ -7145,7 +7259,7 @@ function createLocalOhmyhostMcpServer(dependencies) {
     ...input.limit === void 0 ? {} : { limit: input.limit }
   }));
   registerProductTool(server, dependencies, "deployment_get", "Get one deployment", external_exports.object({ project_id: identifier2, deployment_id: identifier2 }), (client2, input) => client2.getDeployment({ projectId: input.project_id, deploymentId: input.deployment_id }));
-  registerProductTool(server, dependencies, "deployment_logs", "List the newest normalized diagnostics of one deployment (build, control, runtime and function failures with catalog codes). A BUILD_FAILED item carries excerpt: the sanitized tail of the customer's own install/build output, newest lines last, with excerpt_truncated when earlier output was omitted. Read it after build_failed before changing source; scheduled runs are in function_runs_list, not here.", external_exports.object({
+  registerProductTool(server, dependencies, "deployment_logs", "List the newest normalized diagnostics of one deployment (build, control, runtime and function failures with catalog codes). A failed operation_get names the deployment as deployment_id. A BUILD_FAILED item carries excerpt: the sanitized tail of the customer's own install/build output, newest lines last, with excerpt_truncated when earlier output was omitted. A HEALTH_CHECK_FAILED item carries the probed route and status_code and, only for a project owner, excerpt: the head (at most 4096 characters, control characters removed, never a header) of what the app answered. The probe is a cookieless GET that follows no redirect, 5 s per try and up to four tries, so a 3xx or an empty 503 is unhealthy too. Read the item before changing source; scheduled runs are in function_runs_list, not here.", external_exports.object({
     project_id: identifier2,
     deployment_id: identifier2,
     limit: external_exports.number().int().min(1).max(100).default(100)
@@ -7154,7 +7268,7 @@ function createLocalOhmyhostMcpServer(dependencies) {
     deploymentId: input.deployment_id,
     limit: input.limit
   }));
-  registerProductTool(server, dependencies, "operation_get", "Get durable operation status and current deployment progress/reconciliation guidance. Follow progress.phase and progress.suggested_action. waiting_for_mail requires mail_domain_status now for the current verification issue and DNS records; publishing means the build completed but runtime preparation/publication is unfinished. Poll this operation after progress.next_poll_after_seconds. A queued/running operation with reconciliation.state=required needs one confirmed operation_reconcile using the same operation; pending means poll this operation after 60 seconds. Never infer deployment success from a completed reconciliation attempt or start another build to recover it.", external_exports.object({ operation_id: identifier2 }), (client2, input) => client2.getOperation(input.operation_id));
+  registerProductTool(server, dependencies, "operation_get", "Get durable operation status and current deployment progress/reconciliation guidance. Follow progress.phase and progress.suggested_action. waiting_for_mail requires mail_domain_status now for the current verification issue and DNS records; publishing means the build completed but runtime preparation/publication is unfinished. Poll this operation after progress.next_poll_after_seconds. A queued/running operation with reconciliation.state=required needs one confirmed operation_reconcile using the same operation; pending means poll this operation after 60 seconds. Never infer deployment success from a completed reconciliation attempt or start another build to recover it. A deploy, promotion or rollback names its deployment_id in every state; when state is failed, read that deployment with deployment_logs and follow error.suggested_action before changing source.", external_exports.object({ operation_id: identifier2 }), (client2, input) => client2.getOperation(input.operation_id));
   registerProductTool(server, dependencies, "operation_logs", "Read available operation events for at most ten seconds, stopping earlier at max_events or a terminal event. This is a bounded snapshot, not a wait for deployment completion. Use operation_get for current progress and keep the same operation. Stream failures are errors, not empty logs.", external_exports.object({
     operation_id: identifier2,
     max_events: external_exports.number().int().min(1).max(100).default(50)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@amerged/ohmyhost-mcp",
-  "version": "0.1.20",
+  "version": "0.1.21",
   "type": "module",
   "engines": {
     "node": ">=22"

package/src/apps/mcp/local-client.ts

@@ -26,6 +26,8 @@ import {
   createProjectDevAccessTicket,
   ensureProjectDevShareLink,
   setProjectDevAccessMode,
+  getProjectPoweredByFlag,
+  setProjectPoweredByFlag,
   rotateProjectDevShareLink,
   revokeProjectDevShareLink,
   createCloudflareDnsAuthorization,
@@ -52,6 +54,7 @@ import {
   deletePaidProjectDomain,
   getOrganizationCredits,
   getOrganizationAccount,
+  getOrganizationReferral,
   getOrganizationCreditUsage,
   getProjectCreditBudget,
   setProjectCreditBudget,
@@ -93,6 +96,8 @@ import {
   streamOperationEvents,
   type DevAccessTicket,
   type DevAccessState,
+  type PoweredByFlag,
+  type OrganizationReferral,
   type CloudflareDnsAuthorization,
   type CloudflareDnsAuthorizationStatus,
   type OhMyHostClient,
@@ -113,6 +118,8 @@ import {
   ProductApiAuthenticationError,
   parseDevAccessTicket,
   parseDevAccessState,
+  parsePoweredByFlag,
+  parseOrganizationReferral,
   parseCloudflareDnsAuthorization,
   parseCloudflareDnsAuthorizationStatus,
   parsePaidDomain,
@@ -419,6 +426,11 @@ export class GeneratedSdkLocalMcpClient implements LocalMcpProductClient {
     assertOrganizationAccount(account);
     return account;
   }
+  public async getOrganizationReferral(organizationId: string): Promise<OrganizationReferral> {
+    return parseOrganizationReferral(
+      await getOrganizationReferral({ organization_id: organizationId }, { client: this.#client }),
+    );
+  }
   public getOrganizationCredits(organizationId: string) {
     return getOrganizationCredits({ organization_id: organizationId }, { client: this.#client });
   }
@@ -606,6 +618,27 @@ export class GeneratedSdkLocalMcpClient implements LocalMcpProductClient {
       ),
     );
   }
+  public async getPoweredByFlag(projectId: string): Promise<PoweredByFlag> {
+    return parsePoweredByFlag(
+      await getProjectPoweredByFlag({ project_id: projectId }, { client: this.#client }),
+    );
+  }
+  public async setPoweredByFlag(input: {
+    projectId: string;
+    enabled: boolean;
+    idempotencyKey: string;
+  }): Promise<PoweredByFlag> {
+    return parsePoweredByFlag(
+      await setProjectPoweredByFlag(
+        {
+          project_id: input.projectId,
+          "Idempotency-Key": input.idempotencyKey,
+          setPoweredByFlagRequest: { enabled: input.enabled },
+        },
+        { client: this.#client },
+      ),
+    );
+  }
   public async rotateDevShareLink(input: {
     projectId: string;
     idempotencyKey: string;

package/src/apps/mcp/local-server.ts

@@ -70,6 +70,12 @@ export interface LocalMcpProductClient {
     projectId: string;
     idempotencyKey: string;
   }): Promise<import("@ohmyhost/sdk-ts").DevAccessState>;
+  getPoweredByFlag(projectId: string): Promise<import("@ohmyhost/sdk-ts").PoweredByFlag>;
+  setPoweredByFlag(input: {
+    projectId: string;
+    enabled: boolean;
+    idempotencyKey: string;
+  }): Promise<import("@ohmyhost/sdk-ts").PoweredByFlag>;
   revokeDevShareLink(input: {
     projectId: string;
     idempotencyKey: string;
@@ -156,6 +162,9 @@ export interface LocalMcpProductClient {
   getOrganizationAccount(
     organizationId: string,
   ): Promise<import("@ohmyhost/sdk-ts").OrganizationAccount>;
+  getOrganizationReferral(
+    organizationId: string,
+  ): Promise<import("@ohmyhost/sdk-ts").OrganizationReferral>;
   getOrganizationCredits(
     organizationId: string,
   ): Promise<import("@ohmyhost/sdk-ts").OrganizationCredits>;
@@ -706,6 +715,14 @@ export function createLocalOhmyhostMcpServer(dependencies: LocalOhmyhostMcpDepen
     z.object({ organization_id: identifier }),
     (client, input) => client.getOrganizationAccount(input.organization_id),
   );
+  registerProductTool(
+    server,
+    dependencies,
+    "referral_link_get",
+    "Read the workspace's referral link to share. A new user whose first workspace comes from it starts with a free Paid month and 1,000 credits; that workspace's first payment gives this workspace the same. Any member may read it.",
+    z.object({ organization_id: identifier }),
+    (client, input) => client.getOrganizationReferral(input.organization_id),
+  );
   registerProductTool(
     server,
     dependencies,
@@ -1163,6 +1180,28 @@ export function createLocalOhmyhostMcpServer(dependencies: LocalOhmyhostMcpDepen
       }),
     destructiveAnnotations(),
   );
+  registerProductTool(
+    server,
+    dependencies,
+    "powered_by_flag_get",
+    'Read whether the production site shows the opt-in "Powered by ohmyho.st" flag.',
+    z.object({ project_id: identifier }),
+    (client, input) => client.getPoweredByFlag(input.project_id),
+  );
+  registerProductTool(
+    server,
+    dependencies,
+    "powered_by_flag_set",
+    'Owner only, ask the human first: show or hide a small "Powered by ohmyho.st" flag on the right edge of the production site. While it is on, a Free workspace may connect its own domain to this project free of the domain fee, and each Paid period adds 250 credits. Hiding it is refused while a Free workspace\'s domain depends on it. Replay the same key and value after uncertainty to get the first answer without switching again; every new switch needs a new key.',
+    z.object({ project_id: identifier, enabled: z.boolean(), idempotency_key: idempotencyKey }),
+    (client, input) =>
+      client.setPoweredByFlag({
+        projectId: input.project_id,
+        enabled: input.enabled,
+        idempotencyKey: input.idempotency_key,
+      }),
+    mutationAnnotations(),
+  );
   registerProductTool(
     server,
     dependencies,
@@ -1308,7 +1347,7 @@ export function createLocalOhmyhostMcpServer(dependencies: LocalOhmyhostMcpDepen
     server,
     dependencies,
     "deployment_logs",
-    "List the newest normalized diagnostics of one deployment (build, control, runtime and function failures with catalog codes). A BUILD_FAILED item carries excerpt: the sanitized tail of the customer's own install/build output, newest lines last, with excerpt_truncated when earlier output was omitted. Read it after build_failed before changing source; scheduled runs are in function_runs_list, not here.",
+    "List the newest normalized diagnostics of one deployment (build, control, runtime and function failures with catalog codes). A failed operation_get names the deployment as deployment_id. A BUILD_FAILED item carries excerpt: the sanitized tail of the customer's own install/build output, newest lines last, with excerpt_truncated when earlier output was omitted. A HEALTH_CHECK_FAILED item carries the probed route and status_code and, only for a project owner, excerpt: the head (at most 4096 characters, control characters removed, never a header) of what the app answered. The probe is a cookieless GET that follows no redirect, 5 s per try and up to four tries, so a 3xx or an empty 503 is unhealthy too. Read the item before changing source; scheduled runs are in function_runs_list, not here.",
     z.object({
       project_id: identifier,
       deployment_id: identifier,
@@ -1325,7 +1364,7 @@ export function createLocalOhmyhostMcpServer(dependencies: LocalOhmyhostMcpDepen
     server,
     dependencies,
     "operation_get",
-    "Get durable operation status and current deployment progress/reconciliation guidance. Follow progress.phase and progress.suggested_action. waiting_for_mail requires mail_domain_status now for the current verification issue and DNS records; publishing means the build completed but runtime preparation/publication is unfinished. Poll this operation after progress.next_poll_after_seconds. A queued/running operation with reconciliation.state=required needs one confirmed operation_reconcile using the same operation; pending means poll this operation after 60 seconds. Never infer deployment success from a completed reconciliation attempt or start another build to recover it.",
+    "Get durable operation status and current deployment progress/reconciliation guidance. Follow progress.phase and progress.suggested_action. waiting_for_mail requires mail_domain_status now for the current verification issue and DNS records; publishing means the build completed but runtime preparation/publication is unfinished. Poll this operation after progress.next_poll_after_seconds. A queued/running operation with reconciliation.state=required needs one confirmed operation_reconcile using the same operation; pending means poll this operation after 60 seconds. Never infer deployment success from a completed reconciliation attempt or start another build to recover it. A deploy, promotion or rollback names its deployment_id in every state; when state is failed, read that deployment with deployment_logs and follow error.suggested_action before changing source.",
     z.object({ operation_id: identifier }),
     (client, input) => client.getOperation(input.operation_id),
   );

package/src/apps/product-cli/cli.ts

@@ -80,6 +80,8 @@ import {
   parseProjectCreditBudget,
   parseDevAccessTicket,
   parseDevAccessState,
+  parsePoweredByFlag,
+  parseOrganizationReferral,
   parseGuardedActionPlan,
   parseEnvironmentSecret,
   parseEnvironmentSecretDeletion,
@@ -304,6 +306,8 @@ const HELP_USAGE = Object.freeze({
   "export get":
     "ohmyhost export get EXPORT_ULID --project ULID --json (poll the original job; signed ZIP download lasts 24 hours)",
   "credits account": "ohmyhost credits account --organization ULID --json",
+  "referral link":
+    "ohmyhost referral link --organization ULID --json (the workspace's link to share; a new user who signs up through it starts with a free Paid month and 1,000 credits, and their first payment gives this workspace the same)",
   "credits balance": "ohmyhost credits balance --organization ULID --json",
   "billing recharge get": "ohmyhost billing recharge get --organization ULID --json",
   "billing recharge set":
@@ -350,6 +354,9 @@ const HELP_USAGE = Object.freeze({
     "ohmyhost project dev-share revoke --project ULID --idempotency-key KEY --yes --json",
   "project dev-access mode":
     "ohmyhost project dev-access mode --project ULID --mode protected|public --idempotency-key KEY --yes --json",
+  "project flag status": "ohmyhost project flag status --project ULID --json",
+  "project flag set":
+    "ohmyhost project flag set --project ULID --enabled true|false --idempotency-key KEY --json (shows the small Powered by ohmyho.st flag on the production site; while it shows, a Free workspace may connect its own domain without the domain fee and each Paid period adds 250 credits)",
   "project handle check":
     "ohmyhost project handle check --handle HANDLE --json (is this address free? answers with a reason and free alternatives; the address becomes HANDLE.check.omh.st)",
   "project handle set":
@@ -619,6 +626,13 @@ export class ProductCli {
         }
         return success(name, { status: "succeeded", billing: result });
       }
+      if (command.kind === "referral-link") {
+        const api = await this.authenticatedApi(command.credentialStore, signal);
+        const referral = parseOrganizationReferral(
+          await api.getOrganizationReferral(command.organizationId),
+        );
+        return success("referral link", { status: "succeeded", referral });
+      }
       if (command.kind === "credits-account") {
         const api = await this.authenticatedApi(command.credentialStore, signal);
         const account = await api.getOrganizationAccount(command.organizationId);
@@ -809,6 +823,22 @@ export class ProductCli {
       if (command.kind === "project-status") return await this.getProjectStatus(command, signal);
       if (command.kind === "project-dev-access-create")
         return await this.createDevAccessTicket(command, signal);
+      if (command.kind === "project-flag-status" || command.kind === "project-flag-set") {
+        const api = await this.authenticatedApi(command.credentialStore, signal);
+        const flag = parsePoweredByFlag(
+          command.kind === "project-flag-status"
+            ? await api.getPoweredByFlag(command.projectId)
+            : await api.setPoweredByFlag(
+                command.projectId,
+                command.enabled,
+                command.idempotencyKey,
+              ),
+        );
+        return success(
+          command.kind === "project-flag-status" ? "project flag status" : "project flag set",
+          { status: "succeeded", flag },
+        );
+      }
       if (
         command.kind === "project-dev-share-link" ||
         command.kind === "project-dev-share-rotate" ||
@@ -2450,6 +2480,7 @@ const parsedCommandName = (command: ProductCliCommand): CommandLabel => {
   if (command.kind === "billing-status") return "billing status";
   if (command.kind === "billing-portal") return "billing portal";
   if (command.kind === "credits-account") return "credits account";
+  if (command.kind === "referral-link") return "referral link";
   if (command.kind === "credits-balance") return "credits balance";
   if (command.kind === "credits-usage") return "credits usage";
   if (command.kind === "budget-get") return "budget get";
@@ -2475,6 +2506,8 @@ const parsedCommandName = (command: ProductCliCommand): CommandLabel => {
   if (command.kind === "project-dev-share-rotate") return "project dev-share rotate";
   if (command.kind === "project-dev-share-revoke") return "project dev-share revoke";
   if (command.kind === "project-dev-access-mode-set") return "project dev-access mode";
+  if (command.kind === "project-flag-status") return "project flag status";
+  if (command.kind === "project-flag-set") return "project flag set";
   if (command.kind === "project-handle-check") return "project handle check";
   if (command.kind === "project-handle-set") return "project handle set";
   if (command.kind === "database-write") return "database write";

package/src/apps/product-cli/command.ts

@@ -127,6 +127,11 @@ export type ProductCliCommand =
       readonly organizationId: string;
       readonly credentialStore: "native";
     }
+  | {
+      readonly kind: "referral-link";
+      readonly organizationId: string;
+      readonly credentialStore: "native";
+    }
   | {
       readonly kind: "credits-balance";
       readonly organizationId: string;
@@ -256,6 +261,18 @@ export type ProductCliCommand =
       readonly projectId: string;
       readonly credentialStore: "native";
     }
+  | {
+      readonly kind: "project-flag-status";
+      readonly projectId: string;
+      readonly credentialStore: "native";
+    }
+  | {
+      readonly kind: "project-flag-set";
+      readonly projectId: string;
+      readonly enabled: boolean;
+      readonly idempotencyKey: string;
+      readonly credentialStore: "native";
+    }
   | {
       readonly kind: "database-write";
       readonly projectId: string;
@@ -549,6 +566,7 @@ export type RecognizedCommandLabel =
   | "version"
   | "whoami"
   | "credits account"
+  | "referral link"
   | "credits balance"
   | "credits usage"
   | "budget get"
@@ -577,6 +595,8 @@ export type RecognizedCommandLabel =
   | "project dev-share rotate"
   | "project dev-share revoke"
   | "project dev-access mode"
+  | "project flag status"
+  | "project flag set"
   | "project handle check"
   | "project handle set"
   | "database write"
@@ -656,6 +676,7 @@ export const recognizedCommandLabel = (argv: readonly string[]): RecognizedComma
     if (value === "github" && values[0] === "status") return "github status";
     if (value === "operation" && values[0] === "get") return "operation get";
     if (value === "credits" && values[0] === "account") return "credits account";
+    if (value === "referral" && values[0] === "link") return "referral link";
     if (value === "credits" && values[0] === "balance") return "credits balance";
     if (value === "billing" && values[0] === "recharge" && values[1] === "get")
       return "billing recharge get";
@@ -701,6 +722,10 @@ export const recognizedCommandLabel = (argv: readonly string[]): RecognizedComma
       return "project dev-access mode";
     if (value === "project" && values[0] === "dev-access" && values[1] === "create")
       return "project dev-access create";
+    if (value === "project" && values[0] === "flag" && values[1] === "status")
+      return "project flag status";
+    if (value === "project" && values[0] === "flag" && values[1] === "set")
+      return "project flag set";
     if (value === "database" && values[0] === "compute" && values[1] === "set")
       return "database compute set";
     if (value === "database" && values[0] === "compute" && values[1] === "get")
@@ -1080,6 +1105,12 @@ export const parseProductCliCommand = (argv: readonly string[]): ProductCliComma
     const options = parseOptions(values, ["--organization"]);
     return { kind: "credits-account", organizationId: options["--organization"], credentialStore };
   }
+  if (first === "referral" && values[0] === "link") {
+    values.shift();
+    if (yes || wait || follow || stdin) throw new InvalidCommandError();
+    const options = parseOptions(values, ["--organization"]);
+    return { kind: "referral-link", organizationId: options["--organization"], credentialStore };
+  }
   if (first === "credits" && values.shift() === "balance") {
     if (yes || wait || follow || stdin) throw new InvalidCommandError();
     const options = parseOptions(values, ["--organization"]);
@@ -1266,6 +1297,27 @@ export const parseProductCliCommand = (argv: readonly string[]): ProductCliComma
         credentialStore,
       };
     }
+    if (subcommand === "flag") {
+      const action = values.shift();
+      if (yes || wait || follow || stdin) throw new InvalidCommandError();
+      if (action === "status") {
+        const options = parseOptions(values, ["--project"]);
+        return { kind: "project-flag-status", projectId: options["--project"], credentialStore };
+      }
+      if (action === "set") {
+        const options = parseOptions(values, ["--project", "--enabled", "--idempotency-key"]);
+        if (options["--enabled"] !== "true" && options["--enabled"] !== "false")
+          throw new InvalidCommandError();
+        return {
+          kind: "project-flag-set",
+          projectId: options["--project"],
+          enabled: options["--enabled"] === "true",
+          idempotencyKey: options["--idempotency-key"],
+          credentialStore,
+        };
+      }
+      throw new InvalidCommandError();
+    }
     if (subcommand === "dev-access" && values.shift() === "create") {
       if (yes || wait || follow || stdin) throw new InvalidCommandError();
       const options = parseOptions(values, ["--project"]);