@amerged/ohmyhost-mcp 0.1.36 → 0.1.38

package/dist/stdio-main.js

@@ -30,7 +30,7 @@ import {
   serverIdentityOf,
   setNegotiatedProtocolVersion,
   validateEnvelopeMeta
-} from "./chunk-LV7JW4C4.js";
+} from "./chunk-Z7AT2PTU.js";
 
 // node_modules/.pnpm/ignore@7.0.12/node_modules/ignore/index.js
 var require_ignore = __commonJS({
@@ -57,8 +57,8 @@ var require_ignore = __commonJS({
       TMP_KEY_IGNORE = /* @__PURE__ */ Symbol.for("node-ignore");
     }
     var KEY_IGNORE = TMP_KEY_IGNORE;
-    var define2 = (object3, key, value) => {
-      Object.defineProperty(object3, key, { value });
+    var define2 = (object4, key, value) => {
+      Object.defineProperty(object4, key, { value });
       return value;
     };
     var RETURN_FALSE = () => false;
@@ -1959,13 +1959,13 @@ var require_for_each = __commonJS({
         }
       }
     };
-    var forEachObject = function forEachObject2(object3, iterator, receiver) {
-      for (var k in object3) {
-        if (hasOwnProperty.call(object3, k)) {
+    var forEachObject = function forEachObject2(object4, iterator, receiver) {
+      for (var k in object4) {
+        if (hasOwnProperty.call(object4, k)) {
           if (receiver == null) {
-            iterator(object3[k], k, object3);
+            iterator(object4[k], k, object4);
           } else {
-            iterator.call(receiver, object3[k], k, object3);
+            iterator.call(receiver, object4[k], k, object4);
           }
         }
       }
@@ -7241,7 +7241,7 @@ var require_ignore2 = __commonJS({
       TMP_KEY_IGNORE = /* @__PURE__ */ Symbol.for("node-ignore");
     }
     var KEY_IGNORE = TMP_KEY_IGNORE;
-    var define2 = (object3, key, value) => Object.defineProperty(object3, key, { value });
+    var define2 = (object4, key, value) => Object.defineProperty(object4, key, { value });
     var REGEX_REGEXP_RANGE = /([0-z])-([0-z])/g;
     var RETURN_FALSE = () => false;
     var sanitizeRange = (range) => range.replace(
@@ -9862,15 +9862,15 @@ If you're a developer and you believe this is a bug in isomorphic-git, please fi
        * @param {Uint8Array} params.object - The raw object data to wrap.
        * @returns {Uint8Array} The wrapped Git object as a single buffer.
        */
-      static wrap({ type, object: object3 }) {
-        const header = `${type} ${object3.length}\0`;
+      static wrap({ type, object: object4 }) {
+        const header = `${type} ${object4.length}\0`;
         const headerLen = header.length;
-        const totalLength = headerLen + object3.length;
+        const totalLength = headerLen + object4.length;
         const wrappedObject = new Uint8Array(totalLength);
         for (let i = 0; i < headerLen; i++) {
           wrappedObject[i] = header.charCodeAt(i);
         }
-        wrappedObject.set(object3, headerLen);
+        wrappedObject.set(object4, headerLen);
         return wrappedObject;
       }
       /**
@@ -10361,9 +10361,9 @@ If you're a developer and you believe this is a bug in isomorphic-git, please fi
           try {
             p.readDepth = 0;
             p.externalReadDepth = 0;
-            const { type, object: object3 } = await p.readSlice({ start: offset });
+            const { type, object: object4 } = await p.readSlice({ start: offset });
             objectsByDepth[p.readDepth] += 1;
-            const oid = await shasum(GitObject.wrap({ type, object: object3 }));
+            const oid = await shasum(GitObject.wrap({ type, object: object4 }));
             o.oid = oid;
             hashes.push(oid);
             offsets.set(oid, offset);
@@ -10463,7 +10463,7 @@ If you're a developer and you believe this is a bug in isomorphic-git, please fi
           length = otherVarIntDecode(reader, lastFour);
         }
         let base = null;
-        let object3 = null;
+        let object4 = null;
         if (type === "ofs_delta") {
           const offset = decodeVarInt(reader);
           const baseOffset = start - offset;
@@ -10474,19 +10474,19 @@ If you're a developer and you believe this is a bug in isomorphic-git, please fi
           ({ object: base, type } = await this.read({ oid }));
         }
         const buffer = raw.slice(reader.tell());
-        object3 = Buffer.from(await inflate(buffer));
-        if (object3.byteLength !== length) {
+        object4 = Buffer.from(await inflate(buffer));
+        if (object4.byteLength !== length) {
           throw new InternalError(
-            `Packfile told us object would have length ${length} but it had length ${object3.byteLength}`
+            `Packfile told us object would have length ${length} but it had length ${object4.byteLength}`
           );
         }
         if (base) {
-          object3 = Buffer.from(applyDelta(object3, base));
+          object4 = Buffer.from(applyDelta(object4, base));
         }
         if (this.readDepth > 3) {
-          this.offsetCache[start] = { type, object: object3 };
+          this.offsetCache[start] = { type, object: object4 };
         }
-        return { type, format: "content", object: object3 };
+        return { type, format: "content", object: object4 };
       }
     };
     var PackfileCache = /* @__PURE__ */ Symbol("PackfileCache");
@@ -10636,9 +10636,9 @@ If you're a developer and you believe this is a bug in isomorphic-git, please fi
           `SHA check failed! Expected ${oid}, computed ${sha}`
         );
       }
-      const { object: object3, type } = GitObject.unwrap(result.object);
+      const { object: object4, type } = GitObject.unwrap(result.object);
       result.type = type;
-      result.object = object3;
+      result.object = object4;
       result.format = "content";
       return result;
     }
@@ -11330,19 +11330,19 @@ ${obj.gpgsig ? obj.gpgsig : ""}`;
       if (oid === "4b825dc642cb6eb9a060e54bf8d69288fbee4904") {
         return { tree: GitTree.from([]), oid };
       }
-      const { type, object: object3 } = await _readObject({ fs: fs3, cache, gitdir, oid });
+      const { type, object: object4 } = await _readObject({ fs: fs3, cache, gitdir, oid });
       if (type === "tag") {
-        oid = GitAnnotatedTag.from(object3).parse().object;
+        oid = GitAnnotatedTag.from(object4).parse().object;
         return resolveTree({ fs: fs3, cache, gitdir, oid });
       }
       if (type === "commit") {
-        oid = GitCommit.from(object3).parse().tree;
+        oid = GitCommit.from(object4).parse().tree;
         return resolveTree({ fs: fs3, cache, gitdir, oid });
       }
       if (type !== "tree") {
         throw new ObjectTypeError(oid, type, "tree");
       }
-      return { tree: GitTree.from(object3), oid };
+      return { tree: GitTree.from(object4), oid };
     }
     var GitWalkerRepo = class {
       constructor({ fs: fs3, gitdir, ref, cache }) {
@@ -11405,11 +11405,11 @@ ${obj.gpgsig ? obj.gpgsig : ""}`;
         if (obj.type !== "tree") {
           return null;
         }
-        const { type, object: object3 } = await _readObject({ fs: fs3, cache, gitdir, oid });
+        const { type, object: object4 } = await _readObject({ fs: fs3, cache, gitdir, oid });
         if (type !== obj.type) {
           throw new ObjectTypeError(oid, type, obj.type);
         }
-        const tree = GitTree.from(object3);
+        const tree = GitTree.from(object4);
         for (const entry2 of tree) {
           map.set(join5(filepath, entry2.path), entry2);
         }
@@ -11439,11 +11439,11 @@ ${obj.gpgsig ? obj.gpgsig : ""}`;
           const { fs: fs3, cache, gitdir } = this;
           const obj = map.get(entry._fullpath);
           const oid = obj.oid;
-          const { type, object: object3 } = await _readObject({ fs: fs3, cache, gitdir, oid });
+          const { type, object: object4 } = await _readObject({ fs: fs3, cache, gitdir, oid });
           if (type !== "blob") {
             entry._content = void 0;
           } else {
-            entry._content = new Uint8Array(object3);
+            entry._content = new Uint8Array(object4);
           }
         }
         return entry._content;
@@ -12223,7 +12223,7 @@ ${obj.gpgsig ? obj.gpgsig : ""}`;
         return ignoredStatus;
       }
     };
-    async function writeObjectLoose({ fs: fs3, gitdir, object: object3, format, oid }) {
+    async function writeObjectLoose({ fs: fs3, gitdir, object: object4, format, oid }) {
       if (format !== "deflated") {
         throw new InternalError(
           "GitObjectStoreLoose expects objects to write to be in deflated format"
@@ -12231,7 +12231,7 @@ ${obj.gpgsig ? obj.gpgsig : ""}`;
       }
       const source = `objects/${oid.slice(0, 2)}/${oid.slice(2)}`;
       const filepath = `${gitdir}/${source}`;
-      if (!await fs3.exists(filepath)) await fs3.write(filepath, object3);
+      if (!await fs3.exists(filepath)) await fs3.write(filepath, object4);
     }
     var supportsCompressionStream = null;
     async function deflate(buffer) {
@@ -12260,20 +12260,20 @@ ${obj.gpgsig ? obj.gpgsig : ""}`;
       fs: fs3,
       gitdir,
       type,
-      object: object3,
+      object: object4,
       format = "content",
       oid = void 0,
       dryRun = false
     }) {
       if (format !== "deflated") {
         if (format !== "wrapped") {
-          object3 = GitObject.wrap({ type, object: object3 });
+          object4 = GitObject.wrap({ type, object: object4 });
         }
-        oid = await shasum(object3);
-        object3 = Buffer.from(await deflate(object3));
+        oid = await shasum(object4);
+        object4 = Buffer.from(await deflate(object4));
       }
       if (!dryRun) {
-        await writeObjectLoose({ fs: fs3, gitdir, object: object3, format: "deflated", oid });
+        await writeObjectLoose({ fs: fs3, gitdir, object: object4, format: "deflated", oid });
       }
       return oid;
     }
@@ -12382,9 +12382,9 @@ ${obj.gpgsig ? obj.gpgsig : ""}`;
             }
           }
         } else {
-          const object3 = stats.isSymbolicLink() ? await fs3.readlink(join5(dir, currentFilepath)).then(posixifyPathBuffer) : await fs3.read(join5(dir, currentFilepath), { autocrlf });
-          if (object3 === null) throw new NotFoundError(currentFilepath);
-          const oid = await _writeObject({ fs: fs3, gitdir, type: "blob", object: object3 });
+          const object4 = stats.isSymbolicLink() ? await fs3.readlink(join5(dir, currentFilepath)).then(posixifyPathBuffer) : await fs3.read(join5(dir, currentFilepath), { autocrlf });
+          if (object4 === null) throw new NotFoundError(currentFilepath);
+          const oid = await _writeObject({ fs: fs3, gitdir, type: "blob", object: object4 });
           index2.insert({ filepath: currentFilepath, stats, oid });
         }
       });
@@ -12464,15 +12464,15 @@ ${obj.gpgsig ? obj.gpgsig : ""}`;
       return normalizedCommitter;
     }
     async function resolveCommit({ fs: fs3, cache, gitdir, oid }) {
-      const { type, object: object3 } = await _readObject({ fs: fs3, cache, gitdir, oid });
+      const { type, object: object4 } = await _readObject({ fs: fs3, cache, gitdir, oid });
       if (type === "tag") {
-        oid = GitAnnotatedTag.from(object3).parse().object;
+        oid = GitAnnotatedTag.from(object4).parse().object;
         return resolveCommit({ fs: fs3, cache, gitdir, oid });
       }
       if (type !== "commit") {
         throw new ObjectTypeError(oid, type, "commit");
       }
-      return { commit: GitCommit.from(object3), oid };
+      return { commit: GitCommit.from(object4), oid };
     }
     async function _readCommit({ fs: fs3, cache, gitdir, oid }) {
       const { commit: commit3, oid: commitOid } = await resolveCommit({
@@ -12693,7 +12693,7 @@ ${obj.gpgsig ? obj.gpgsig : ""}`;
           if (pathArray.length === 0) {
             return entry;
           } else {
-            const { type, object: object3 } = await _readObject({
+            const { type, object: object4 } = await _readObject({
               fs: fs3,
               cache,
               gitdir,
@@ -12702,7 +12702,7 @@ ${obj.gpgsig ? obj.gpgsig : ""}`;
             if (type !== "tree") {
               throw new ObjectTypeError(oid, type, "tree", filepath);
             }
-            tree = GitTree.from(object3);
+            tree = GitTree.from(object4);
             return _resolveFilepath({
               fs: fs3,
               cache,
@@ -12735,12 +12735,12 @@ ${obj.gpgsig ? obj.gpgsig : ""}`;
       return result;
     }
     async function _writeTree({ fs: fs3, gitdir, tree }) {
-      const object3 = GitTree.from(tree).toObject();
+      const object4 = GitTree.from(tree).toObject();
       const oid = await _writeObject({
         fs: fs3,
         gitdir,
         type: "tree",
-        object: object3,
+        object: object4,
         format: "content"
       });
       return oid;
@@ -12921,7 +12921,7 @@ ${obj.gpgsig ? obj.gpgsig : ""}`;
       tagger,
       message = ref,
       gpgsig,
-      object: object3,
+      object: object4,
       signingKey,
       force = false
     }) {
@@ -12932,7 +12932,7 @@ ${obj.gpgsig ? obj.gpgsig : ""}`;
       const oid = await GitRefManager.resolve({
         fs: fs3,
         gitdir,
-        ref: object3 || "HEAD"
+        ref: object4 || "HEAD"
       });
       const { type } = await _readObject({ fs: fs3, cache, gitdir, oid });
       let tagObject = GitAnnotatedTag.from({
@@ -12963,7 +12963,7 @@ ${obj.gpgsig ? obj.gpgsig : ""}`;
       tagger: _tagger,
       message = ref,
       gpgsig,
-      object: object3,
+      object: object4,
       signingKey,
       force = false,
       cache = {}
@@ -12992,7 +12992,7 @@ ${obj.gpgsig ? obj.gpgsig : ""}`;
           tagger,
           message,
           gpgsig,
-          object: object3,
+          object: object4,
           signingKey,
           force
         });
@@ -13005,7 +13005,7 @@ ${obj.gpgsig ? obj.gpgsig : ""}`;
       fs: fs3,
       gitdir,
       ref,
-      object: object3,
+      object: object4,
       checkout: checkout2 = false,
       force = false
     }) {
@@ -13021,7 +13021,7 @@ ${obj.gpgsig ? obj.gpgsig : ""}`;
       }
       let oid;
       try {
-        oid = await GitRefManager.resolve({ fs: fs3, gitdir, ref: object3 || "HEAD" });
+        oid = await GitRefManager.resolve({ fs: fs3, gitdir, ref: object4 || "HEAD" });
       } catch (e) {
       }
       if (oid) {
@@ -13041,7 +13041,7 @@ ${obj.gpgsig ? obj.gpgsig : ""}`;
       dir,
       gitdir = join5(dir, ".git"),
       ref,
-      object: object3,
+      object: object4,
       checkout: checkout2 = false,
       force = false
     }) {
@@ -13055,7 +13055,7 @@ ${obj.gpgsig ? obj.gpgsig : ""}`;
           fs: fsp,
           gitdir: updatedGitdir,
           ref,
-          object: object3,
+          object: object4,
           checkout: checkout2,
           force
         });
@@ -13292,7 +13292,7 @@ ${obj.gpgsig ? obj.gpgsig : ""}`;
                   const filepath = `${dir}/${fullpath}`;
                   if (method !== "create-index" && method !== "mkdir-index") {
                     await assertNoSymlinkInLeadingPath(fs3, dir, fullpath);
-                    const { object: object3 } = await _readObject({
+                    const { object: object4 } = await _readObject({
                       fs: fs3,
                       cache,
                       gitdir,
@@ -13302,11 +13302,11 @@ ${obj.gpgsig ? obj.gpgsig : ""}`;
                       await fs3.rm(filepath);
                     }
                     if (mode === 33188) {
-                      await fs3.write(filepath, object3);
+                      await fs3.write(filepath, object4);
                     } else if (mode === 33261) {
-                      await fs3.write(filepath, object3, { mode: 511 });
+                      await fs3.write(filepath, object4, { mode: 511 });
                     } else if (mode === 40960) {
-                      await fs3.writelink(filepath, object3);
+                      await fs3.writelink(filepath, object4);
                     } else {
                       throw new InternalError(
                         `Invalid mode 0o${mode.toString(
@@ -13643,16 +13643,16 @@ ${obj.gpgsig ? obj.gpgsig : ""}`;
       const filepath = `${dir}/${fullpath}`;
       if (method !== "create-index" && method !== "mkdir-index") {
         await assertNoSymlinkInLeadingPath(fs3, dir, fullpath);
-        const { object: object3 } = await _readObject({ fs: fs3, cache, gitdir, oid });
+        const { object: object4 } = await _readObject({ fs: fs3, cache, gitdir, oid });
         if (chmod2) {
           await fs3.rm(filepath);
         }
         if (mode === 33188) {
-          await fs3.write(filepath, object3);
+          await fs3.write(filepath, object4);
         } else if (mode === 33261) {
-          await fs3.write(filepath, object3, { mode: 511 });
+          await fs3.write(filepath, object4, { mode: 511 });
         } else if (mode === 40960) {
-          await fs3.writelink(filepath, object3);
+          await fs3.writelink(filepath, object4);
         } else {
           throw new InternalError(
             `Invalid mode 0o${mode.toString(8)} detected in blob ${oid}`
@@ -13951,12 +13951,12 @@ ${obj.gpgsig ? obj.gpgsig : ""}`;
             return;
           if (entries.length > 0 || parent.path === "." && entries.length === 0) {
             const tree = new GitTree(entries);
-            const object3 = tree.toObject();
+            const object4 = tree.toObject();
             const oid = await _writeObject({
               fs: fs3,
               gitdir,
               type: "tree",
-              object: object3,
+              object: object4,
               dryRun
             });
             parent.oid = oid;
@@ -14065,9 +14065,9 @@ ${obj.gpgsig ? obj.gpgsig : ""}`;
       let retOid = objContent ? oid : void 0;
       if (!objContent) {
         await acquireLock(currentFilepath, async () => {
-          const object3 = stats.isSymbolicLink() ? await fs3.readlink(currentFilepath).then(posixifyPathBuffer) : await fs3.read(currentFilepath);
-          if (object3 === null) throw new NotFoundError(currentFilepath);
-          retOid = await _writeObject({ fs: fs3, gitdir, type: "blob", object: object3 });
+          const object4 = stats.isSymbolicLink() ? await fs3.readlink(currentFilepath).then(posixifyPathBuffer) : await fs3.read(currentFilepath);
+          if (object4 === null) throw new NotFoundError(currentFilepath);
+          retOid = await _writeObject({ fs: fs3, gitdir, type: "blob", object: object4 });
         });
       }
       return retOid;
@@ -14253,7 +14253,7 @@ ${obj.gpgsig ? obj.gpgsig : ""}`;
                 (removedDir) => currentFilepath.startsWith(removedDir)
               )) {
                 await assertNoSymlinkInLeadingPath(fs3, dir, op.filepath);
-                const { object: object3 } = await _readObject({
+                const { object: object4 } = await _readObject({
                   fs: fs3,
                   cache: {},
                   gitdir,
@@ -14262,7 +14262,7 @@ ${obj.gpgsig ? obj.gpgsig : ""}`;
                 if (await fs3.exists(currentFilepath)) {
                   await fs3.rm(currentFilepath);
                 }
-                await fs3.write(currentFilepath, object3);
+                await fs3.write(currentFilepath, object4);
               }
               break;
           }
@@ -15469,8 +15469,8 @@ ${obj.gpgsig ? obj.gpgsig : ""}`;
       for (const oid2 of response.shallows) {
         if (!oids.has(oid2)) {
           try {
-            const { object: object3 } = await _readObject({ fs: fs3, cache, gitdir, oid: oid2 });
-            const commit3 = new GitCommit(object3);
+            const { object: object4 } = await _readObject({ fs: fs3, cache, gitdir, oid: oid2 });
+            const commit3 = new GitCommit(object4);
             const hasParents = await Promise.all(
               commit3.headers().parent.map((oid3) => hasObject({ fs: fs3, cache, gitdir, oid: oid3 }))
             );
@@ -16040,11 +16040,11 @@ ${obj.gpgsig ? obj.gpgsig : ""}`;
       const shallows = await GitShallowManager.read({ fs: fs3, gitdir });
       const readParents = async (oid) => {
         if (parents.has(oid)) return parents.get(oid);
-        const { object: object3, type } = await _readObject({ fs: fs3, cache, gitdir, oid });
+        const { object: object4, type } = await _readObject({ fs: fs3, cache, gitdir, oid });
         if (type !== "commit") {
           throw new ObjectTypeError(oid, type, "commit");
         }
-        const commit3 = GitCommit.from(object3);
+        const commit3 = GitCommit.from(object4);
         const { parent } = commit3.parseHeaders();
         const result = shallows.has(oid) ? [] : parent;
         parents.set(oid, result);
@@ -16634,31 +16634,31 @@ ${obj.gpgsig ? obj.gpgsig : ""}`;
     }
     async function hashObject({
       type,
-      object: object3,
+      object: object4,
       format = "content",
       oid = void 0
     }) {
       if (format !== "deflated") {
         if (format !== "wrapped") {
-          object3 = GitObject.wrap({ type, object: object3 });
+          object4 = GitObject.wrap({ type, object: object4 });
         }
-        oid = await shasum(object3);
+        oid = await shasum(object4);
       }
-      return { oid, object: object3 };
+      return { oid, object: object4 };
     }
-    async function hashBlob({ object: object3 }) {
+    async function hashBlob({ object: object4 }) {
       try {
-        assertParameter("object", object3);
-        if (typeof object3 === "string") {
-          object3 = Buffer.from(object3, "utf8");
-        } else if (!(object3 instanceof Uint8Array)) {
-          object3 = new Uint8Array(object3);
+        assertParameter("object", object4);
+        if (typeof object4 === "string") {
+          object4 = Buffer.from(object4, "utf8");
+        } else if (!(object4 instanceof Uint8Array)) {
+          object4 = new Uint8Array(object4);
         }
         const type = "blob";
         const { oid, object: _object } = await hashObject({
           type,
           format: "content",
-          object: object3
+          object: object4
         });
         return { oid, type, object: _object, format: "wrapped" };
       } catch (err) {
@@ -16771,7 +16771,7 @@ ${obj.gpgsig ? obj.gpgsig : ""}`;
           throw new MaxDepthError(depth);
         }
         const oid2 = queue.shift();
-        const { type, object: object3 } = await _readObject({
+        const { type, object: object4 } = await _readObject({
           fs: fs3,
           cache,
           gitdir,
@@ -16780,7 +16780,7 @@ ${obj.gpgsig ? obj.gpgsig : ""}`;
         if (type !== "commit") {
           throw new ObjectTypeError(oid2, type, "commit");
         }
-        const commit3 = GitCommit.from(object3).parse();
+        const commit3 = GitCommit.from(object4).parse();
         for (const parent of commit3.parent) {
           if (parent === ancestor) return true;
         }
@@ -17171,12 +17171,12 @@ ${obj.gpgsig ? obj.gpgsig : ""}`;
             cache,
             gitdir,
             oid: entry.oid
-          }).then(function({ object: object3 }) {
+          }).then(function({ object: object4 }) {
             return _resolveFileId({
               fs: fs3,
               cache,
               gitdir,
-              tree: GitTree.from(object3),
+              tree: GitTree.from(object4),
               fileId,
               oid,
               filepaths,
@@ -17480,9 +17480,9 @@ ${obj.gpgsig ? obj.gpgsig : ""}`;
         outputStream.push(buff);
         hash.update(buff);
       }
-      async function writeObject2({ stype, object: object3 }) {
+      async function writeObject2({ stype, object: object4 }) {
         const type = types[stype];
-        let length = object3.length;
+        let length = object4.length;
         let multibyte = length > 15 ? 128 : 0;
         const lastFour = length & 15;
         length = length >>> 4;
@@ -17494,14 +17494,14 @@ ${obj.gpgsig ? obj.gpgsig : ""}`;
           write(padHex(2, byte), "hex");
           length = length >>> 7;
         }
-        write(Buffer.from(await deflate(object3)));
+        write(Buffer.from(await deflate(object4)));
       }
       write("PACK");
       write("00000002", "hex");
       write(padHex(8, oids.length), "hex");
       for (const oid of oids) {
-        const { type, object: object3 } = await _readObject({ fs: fs3, cache, gitdir, oid });
-        await writeObject2({ write, object: object3, stype: type });
+        const { type, object: object4 } = await _readObject({ fs: fs3, cache, gitdir, oid });
+        await writeObject2({ write, object: object4, stype: type });
       }
       const digest2 = hash.digest();
       outputStream.push(digest2);
@@ -17646,9 +17646,9 @@ ${obj.gpgsig ? obj.gpgsig : ""}`;
       const visited = /* @__PURE__ */ new Set();
       async function walk2(oid) {
         visited.add(oid);
-        const { type, object: object3 } = await _readObject({ fs: fs3, cache, gitdir, oid });
+        const { type, object: object4 } = await _readObject({ fs: fs3, cache, gitdir, oid });
         if (type === "tag") {
-          const tag2 = GitAnnotatedTag.from(object3);
+          const tag2 = GitAnnotatedTag.from(object4);
           const commit3 = tag2.headers().object;
           return walk2(commit3);
         }
@@ -17656,7 +17656,7 @@ ${obj.gpgsig ? obj.gpgsig : ""}`;
           throw new ObjectTypeError(oid, type, "commit");
         }
         if (!shallows.has(oid)) {
-          const commit3 = GitCommit.from(object3);
+          const commit3 = GitCommit.from(object4);
           const parents = commit3.headers().parent;
           for (oid of parents) {
             if (!finishingSet.has(oid) && !visited.has(oid)) {
@@ -17681,17 +17681,17 @@ ${obj.gpgsig ? obj.gpgsig : ""}`;
       async function walk2(oid) {
         if (visited.has(oid)) return;
         visited.add(oid);
-        const { type, object: object3 } = await _readObject({ fs: fs3, cache, gitdir, oid });
+        const { type, object: object4 } = await _readObject({ fs: fs3, cache, gitdir, oid });
         if (type === "tag") {
-          const tag2 = GitAnnotatedTag.from(object3);
+          const tag2 = GitAnnotatedTag.from(object4);
           const obj = tag2.headers().object;
           await walk2(obj);
         } else if (type === "commit") {
-          const commit3 = GitCommit.from(object3);
+          const commit3 = GitCommit.from(object4);
           const tree = commit3.headers().tree;
           await walk2(tree);
         } else if (type === "tree") {
-          const tree = GitTree.from(object3);
+          const tree = GitTree.from(object4);
           for (const entry of tree) {
             if (entry.type === "blob") {
               visited.add(entry.oid);
@@ -18022,15 +18022,15 @@ ${obj.gpgsig ? obj.gpgsig : ""}`;
       }
     }
     async function resolveBlob({ fs: fs3, cache, gitdir, oid }) {
-      const { type, object: object3 } = await _readObject({ fs: fs3, cache, gitdir, oid });
+      const { type, object: object4 } = await _readObject({ fs: fs3, cache, gitdir, oid });
       if (type === "tag") {
-        oid = GitAnnotatedTag.from(object3).parse().object;
+        oid = GitAnnotatedTag.from(object4).parse().object;
         return resolveBlob({ fs: fs3, cache, gitdir, oid });
       }
       if (type !== "blob") {
         throw new ObjectTypeError(oid, type, "blob");
       }
-      return { oid, blob: new Uint8Array(object3) };
+      return { oid, blob: new Uint8Array(object4) };
     }
     async function _readBlob({
       fs: fs3,
@@ -18215,7 +18215,7 @@ ${obj.gpgsig ? obj.gpgsig : ""}`;
       }
     }
     async function _readTag({ fs: fs3, cache, gitdir, oid }) {
-      const { type, object: object3 } = await _readObject({
+      const { type, object: object4 } = await _readObject({
         fs: fs3,
         cache,
         gitdir,
@@ -18225,7 +18225,7 @@ ${obj.gpgsig ? obj.gpgsig : ""}`;
       if (type !== "tag") {
         throw new ObjectTypeError(oid, type, "tag");
       }
-      const tag2 = GitAnnotatedTag.from(object3);
+      const tag2 = GitAnnotatedTag.from(object4);
       const result = {
         oid,
         tag: tag2.parse(),
@@ -18474,8 +18474,8 @@ ${obj.gpgsig ? obj.gpgsig : ""}`;
         throw err;
       }
     }
-    async function hashObject$1({ gitdir, type, object: object3 }) {
-      return shasum(GitObject.wrap({ type, object: object3 }));
+    async function hashObject$1({ gitdir, type, object: object4 }) {
+      return shasum(GitObject.wrap({ type, object: object4 }));
     }
     async function resetIndex({
       fs: _fs,
@@ -18527,12 +18527,12 @@ ${obj.gpgsig ? obj.gpgsig : ""}`;
           gid: 0,
           size: 0
         };
-        const object3 = dir && await fs3.read(join5(dir, filepath));
-        if (object3) {
+        const object4 = dir && await fs3.read(join5(dir, filepath));
+        if (object4) {
           workdirOid = await hashObject$1({
             gitdir: updatedGitdir,
             type: "blob",
-            object: object3
+            object: object4
           });
           if (oid === workdirOid) {
             stats = await fs3.lstat(join5(dir, filepath));
@@ -18604,12 +18604,12 @@ ${obj.gpgsig ? obj.gpgsig : ""}`;
       }
     }
     async function _writeCommit({ fs: fs3, gitdir, commit: commit3 }) {
-      const object3 = GitCommit.from(commit3).toObject();
+      const object4 = GitCommit.from(commit3).toObject();
       const oid = await _writeObject({
         fs: fs3,
         gitdir,
         type: "commit",
-        object: object3,
+        object: object4,
         format: "content"
       });
       return oid;
@@ -19094,11 +19094,11 @@ ${obj.gpgsig ? obj.gpgsig : ""}`;
           } else {
             const config = await GitConfigManager.get({ fs: fs3, gitdir: updatedGitdir });
             const autocrlf = await config.get("core.autocrlf");
-            const object3 = await fs3.read(join5(dir, filepath), { autocrlf });
+            const object4 = await fs3.read(join5(dir, filepath), { autocrlf });
             const workdirOid = await hashObject$1({
               gitdir: updatedGitdir,
               type: "blob",
-              object: object3
+              object: object4
             });
             if (refresh && I && indexEntry.oid === workdirOid) {
               if (stats.size !== -1) {
@@ -19149,14 +19149,14 @@ ${obj.gpgsig ? obj.gpgsig : ""}`;
           if (path2.length === 0) {
             return entry.oid;
           }
-          const { type, object: object3 } = await _readObject({
+          const { type, object: object4 } = await _readObject({
             fs: fs3,
             cache,
             gitdir: updatedGitdir,
             oid: entry.oid
           });
           if (type === "tree") {
-            const tree2 = GitTree.from(object3);
+            const tree2 = GitTree.from(object4);
             return getOidAtPath({ fs: fs3, cache, gitdir: updatedGitdir, tree: tree2, path: path2 });
           }
           if (type === "blob") {
@@ -19260,7 +19260,7 @@ ${obj.gpgsig ? obj.gpgsig : ""}`;
       dir,
       gitdir = join5(dir, ".git"),
       ref,
-      object: object3,
+      object: object4,
       force = false
     }) {
       try {
@@ -19276,7 +19276,7 @@ ${obj.gpgsig ? obj.gpgsig : ""}`;
         const value = await GitRefManager.resolve({
           fs: fs3,
           gitdir: updatedGitdir,
-          ref: object3 || "HEAD"
+          ref: object4 || "HEAD"
         });
         if (!force && await GitRefManager.exists({ fs: fs3, gitdir: updatedGitdir, ref })) {
           throw new AlreadyExistsError("tag", ref);
@@ -19349,13 +19349,13 @@ ${obj.gpgsig ? obj.gpgsig : ""}`;
             let stats;
             if (!oid) {
               stats = fileStats;
-              const object3 = stats.isSymbolicLink() ? await fs3.readlink(join5(dir, filepath)) : await fs3.read(join5(dir, filepath));
+              const object4 = stats.isSymbolicLink() ? await fs3.readlink(join5(dir, filepath)) : await fs3.read(join5(dir, filepath));
               oid = await _writeObject({
                 fs: fs3,
                 gitdir: updatedGitdir,
                 type: "blob",
                 format: "content",
-                object: object3
+                object: object4
               });
             } else {
               stats = {
@@ -19467,7 +19467,7 @@ ${obj.gpgsig ? obj.gpgsig : ""}`;
       dir,
       gitdir = join5(dir, ".git"),
       type,
-      object: object3,
+      object: object4,
       format = "parsed",
       oid,
       encoding = void 0
@@ -19478,16 +19478,16 @@ ${obj.gpgsig ? obj.gpgsig : ""}`;
         if (format === "parsed") {
           switch (type) {
             case "commit":
-              object3 = GitCommit.from(object3).toObject();
+              object4 = GitCommit.from(object4).toObject();
               break;
             case "tree":
-              object3 = GitTree.from(object3).toObject();
+              object4 = GitTree.from(object4).toObject();
               break;
             case "blob":
-              object3 = Buffer.from(object3, encoding);
+              object4 = Buffer.from(object4, encoding);
               break;
             case "tag":
-              object3 = GitAnnotatedTag.from(object3).toObject();
+              object4 = GitAnnotatedTag.from(object4).toObject();
               break;
             default:
               throw new ObjectTypeError(oid || "", type, "blob|commit|tag|tree");
@@ -19498,7 +19498,7 @@ ${obj.gpgsig ? obj.gpgsig : ""}`;
           fs: fs3,
           gitdir: updatedGitdir,
           type,
-          object: object3,
+          object: object4,
           oid,
           format
         });
@@ -19556,12 +19556,12 @@ ${obj.gpgsig ? obj.gpgsig : ""}`;
       }
     }
     async function _writeTag({ fs: fs3, gitdir, tag: tag2 }) {
-      const object3 = GitAnnotatedTag.from(tag2).toObject();
+      const object4 = GitAnnotatedTag.from(tag2).toObject();
       const oid = await _writeObject({
         fs: fs3,
         gitdir,
         type: "tag",
-        object: object3,
+        object: object4,
         format: "content"
       });
       return oid;
@@ -19748,7 +19748,8 @@ ${obj.gpgsig ? obj.gpgsig : ""}`;
   }
 });
 
-// node_modules/.pnpm/@modelcontextprotocol+server@2.0.0/node_modules/@modelcontextprotocol/server/dist/stdio.mjs
+// node_modules/.pnpm/@modelcontextprotocol+server@2.3.0/node_modules/@modelcontextprotocol/server/dist/stdio.mjs
+var swallowsErrorsAfterClose = /* @__PURE__ */ Symbol("swallowsErrorsAfterClose");
 var StdioServerTransport = class {
   _readBuffer;
   _started = false;
@@ -19775,18 +19776,27 @@ var StdioServerTransport = class {
     this.onerror?.(error);
   };
   _onstdouterror = (error) => {
+    if (this._closed) return;
     this.onerror?.(error);
     this.close().catch(() => {
     });
   };
+  _onstdinclose = () => {
+    this.close().catch(() => {
+    });
+  };
   /**
   * Starts listening for messages on `stdin`.
   */
   async start() {
     if (this._started) throw new Error("StdioServerTransport already started! If using Server class, note that connect() calls start() automatically.");
     this._started = true;
+    for (const listener of this._stdout.listeners("error")) if (listener[swallowsErrorsAfterClose]) this._stdout.off("error", listener);
+    if (this._stdin.readableEnded || this._stdin.destroyed) setImmediate(this._onstdinclose);
     this._stdin.on("data", this._ondata);
     this._stdin.on("error", this._onerror);
+    this._stdin.on("end", this._onstdinclose);
+    this._stdin.on("close", this._onstdinclose);
     this._stdout.on("error", this._onstdouterror);
   }
   processReadBuffer() {
@@ -19803,7 +19813,9 @@ var StdioServerTransport = class {
     this._closed = true;
     this._stdin.off("data", this._ondata);
     this._stdin.off("error", this._onerror);
-    this._stdout.off("error", this._onstdouterror);
+    this._stdin.off("end", this._onstdinclose);
+    this._stdin.off("close", this._onstdinclose);
+    this._onstdouterror[swallowsErrorsAfterClose] = true;
     if (this._stdin.listenerCount("data") === 0) this._stdin.pause();
     this._readBuffer.clear();
     this.onclose?.();
@@ -19855,8 +19867,8 @@ var StdioConnectionChannel = class {
   }
   async send(message, options) {
     if (isJSONRPCResultResponse(message) || isJSONRPCErrorResponse(message)) {
-      const { id: id3 } = message;
-      if (id3 !== void 0) this._settle(id3);
+      const { id: id4 } = message;
+      if (id4 !== void 0) this._settle(id4);
     }
     if (this._closed) return;
     if (this._outboundIntercept?.(message) === "handled") return;
@@ -19909,8 +19921,8 @@ var StdioConnectionChannel = class {
       this.onclose?.();
     }
   }
-  _settle(id3) {
-    this._pendingRequests.delete(id3);
+  _settle(id4) {
+    this._pendingRequests.delete(id4);
     if (this._pendingRequests.size === 0) this._releaseDrainWaiters();
   }
   _releaseDrainWaiters() {
@@ -19966,9 +19978,9 @@ function serveStdio(factory, options = {}) {
     } catch {
     }
   };
-  const writeErrorResponse = (id3, code, message, data) => wire.send({
+  const writeErrorResponse = (id4, code, message, data) => wire.send({
     jsonrpc: "2.0",
-    id: id3,
+    id: id4,
     error: {
       code,
       message,
@@ -20080,6 +20092,7 @@ function serveStdio(factory, options = {}) {
         return;
       }
       if (state.era === "modern" && await tryServeListen(message)) return;
+      if (isTornDown()) return;
       state.instance.channel.deliver(message);
       return;
     }
@@ -20146,6 +20159,7 @@ function serveStdio(factory, options = {}) {
           };
         }
         if (await tryServeListen(message)) return;
+        if (isTornDown()) return;
         state.instance.channel.deliver(message, { classification: opening.classification });
         return;
       case "legacy": {
@@ -20240,7 +20254,7 @@ var FRAMEWORK_VERSION_POLICY = Object.freeze({
     floors: Object.freeze(["14.4.0"]),
     denied: Object.freeze([])
   }),
-  next: Object.freeze({ floors: Object.freeze(["15.5.27", "16.3.8"]), denied: Object.freeze([]) }),
+  next: Object.freeze({ floors: Object.freeze(["16.4.1"]), denied: Object.freeze([]) }),
   vite: Object.freeze({ floors: Object.freeze(["5.4.6"]), denied: Object.freeze([]) }),
   "@tanstack/react-start": Object.freeze({
     floors: Object.freeze(["1.168.60"]),
@@ -22035,13 +22049,13 @@ var PROBLEM_POLICY = {
   mail_domain_conflict: {
     status: 409,
     retryable: false,
-    action: "Use the sender domain already configured for this project, or retire it with 'ohmyhost mail domain delete' (repeat while the removal is pending) and then set up the new domain; a domain registered to another project cannot be set up.",
+    action: "Read the workspace sender resource and project binding. Reuse requires explicit domain-use authority, target-project editing and a current verified application identity with the same registrable main domain. Read the current revision before changing settings. Detach a shared project binding explicitly; legacy domain deletion cannot retire a resource used by another project.",
     title: "Mail domain conflict"
   },
   mail_domain_required: {
     status: 409,
     retryable: false,
-    action: "This app declares mail.enabled. Configure the project's own sender domain with 'ohmyhost mail setup' using its Prod environment ID, or set mail.enabled to false if the app sends no mail, then plan again.",
+    action: "This app declares mail.enabled. Configure a sender with 'ohmyhost mail setup' or explicitly attach an authorized workspace sender using the project's Prod environment ID. Reuse first requires proof of the intended application hostname with the same registrable main domain; declare and verify that identity before mail-gated deployment. Then plan again.",
     title: "Mail domain required"
   },
   storage_jurisdiction_conflict: {
@@ -22479,16 +22493,16 @@ var parseOperation = (value) => {
     "reconciliation",
     "progress"
   ]);
-  const id3 = input["id"];
+  const id4 = input["id"];
   const state = input["state"];
   const createdAt = input["created_at"];
   const updatedAt = input["updated_at"];
   const result = input["result"];
   const blockingOperationId = input["blocking_operation_id"];
   const deploymentId = input["deployment_id"];
-  if (blockingOperationId !== void 0 && (state !== "queued" || !isUlid(blockingOperationId) || blockingOperationId === id3) || deploymentId !== void 0 && !isUlid(deploymentId))
+  if (blockingOperationId !== void 0 && (state !== "queued" || !isUlid(blockingOperationId) || blockingOperationId === id4) || deploymentId !== void 0 && !isUlid(deploymentId))
     throw new ResponseContractError();
-  if (!isUlid(id3) || !isOperationState(state) || !isIsoInstant(createdAt) || !isIsoInstant(updatedAt) || result !== void 0 && !isRecord(result)) {
+  if (!isUlid(id4) || !isOperationState(state) || !isIsoInstant(createdAt) || !isIsoInstant(updatedAt) || result !== void 0 && !isRecord(result)) {
     throw new ResponseContractError();
   }
   let progress;
@@ -22528,7 +22542,7 @@ var parseOperation = (value) => {
       throw new ResponseContractError();
   }
   return {
-    id: id3,
+    id: id4,
     state,
     created_at: createdAt,
     updated_at: updatedAt,
@@ -23261,7 +23275,7 @@ function exact3(v, keys) {
 // apps/product-cli/package.json
 var package_default2 = {
   name: "@ohmyhost/product-cli",
-  version: "0.1.36",
+  version: "0.1.38",
   private: true,
   ohmyhost: {
     deployment: "production",
@@ -23293,7 +23307,7 @@ var package_default2 = {
   },
   scripts: {
     build: "tsc --project tsconfig.build.json",
-    typecheck: "tsc --project tsconfig.json --noEmit",
+    typecheck: "tsc --project tsconfig.json --noEmit --incremental --tsBuildInfoFile typecheck.tsbuildinfo",
     test: "vitest run --root ../.. apps/product-cli/test"
   },
   dependencies: {
@@ -23635,12 +23649,12 @@ function assertBillingTaxIssue(value) {
 }
 var ulid4 = /^[0-7][0-9A-HJKMNP-TV-Z]{25}$/u;
 var timestamp5 = (v) => typeof v === "string" && Number.isFinite(Date.parse(v)) && new Date(v).toISOString() === v;
-function stripeUrl(value, host) {
+function stripeUrl(value, host2) {
   if (typeof value !== "string" || value.length > 8192)
     return false;
   try {
     const u = new URL(value);
-    return u.protocol === "https:" && u.hostname === host && !u.username && !u.password && !u.port;
+    return u.protocol === "https:" && u.hostname === host2 && !u.username && !u.password && !u.port;
   } catch {
     return false;
   }
@@ -24077,9 +24091,9 @@ var selectProfileForOrganization = (profiles, request) => {
   if (inOrganization.length > 1)
     return { outcome: "ambiguous", candidates: inOrganization };
   const unscoped = candidates.filter((profile) => profile.organizationId === null);
-  const [member] = inOrganization;
-  if (member !== void 0)
-    return { outcome: "selected", profile: member };
+  const [member2] = inOrganization;
+  if (member2 !== void 0)
+    return { outcome: "selected", profile: member2 };
   const [open4] = unscoped;
   if (unscoped.length === 1 && open4 !== void 0)
     return { outcome: "selected", profile: open4 };
@@ -24410,6 +24424,23 @@ var HELP_USAGE = Object.freeze({
   "function runs": "ohmyhost function runs --project ULID --environment ENVIRONMENT_ULID [--limit 1-100] --json",
   "secret set": `printf '%s' "$SECRET_VALUE" | ohmyhost secret set NAME --project ULID --environment ENVIRONMENT_ULID --idempotency-key KEY [--profile-user USER_ID --profile-organization ULID | --token-user USER_ID --token-organization ULID] --stdin [--wait] --json (with --profile-user and --profile-organization the saved login that runs it must belong to that user and organization; with --token-user and --token-organization it runs only with an OHMYHOST_TOKEN of that user and organization, never with a saved login)`,
   "secret delete": "ohmyhost secret delete NAME --project ULID --environment ENVIRONMENT_ULID --idempotency-key KEY [--wait] --json",
+  "mail workspace list": "ohmyhost mail workspace list --organization ULID --json",
+  "mail workspace create": "ohmyhost mail workspace create --organization ULID --domain DOMAIN --sending true --idempotency-key KEY --json",
+  "mail workspace status": "ohmyhost mail workspace status --organization ULID --mail-domain ULID --json",
+  "mail workspace retire": "ohmyhost mail workspace retire --organization ULID --mail-domain ULID --expected-revision N --idempotency-key KEY --yes --json",
+  "mail workspace dns-authorize": "ohmyhost mail workspace dns-authorize --organization ULID --mail-domain ULID --expected-revision N --zone DOMAIN --idempotency-key KEY --json",
+  "mail workspace dns-revoke": "ohmyhost mail workspace dns-revoke --organization ULID --mail-domain ULID --expected-revision N --idempotency-key KEY --yes --json",
+  "mail workspace dns-status": "ohmyhost mail workspace dns-status --organization ULID --mail-domain ULID --json",
+  "mail binding get": "ohmyhost mail binding get --project ULID --environment PROD_ULID --json",
+  "mail binding set": "ohmyhost mail binding set --project ULID --environment PROD_ULID --mail-domain ULID --sending true --sender-addresses contact@mail.example.com,contracts@mail.example.com --default-from contracts@mail.example.com [--reply-to owner@example.com] --expected-revision N --idempotency-key KEY --json",
+  "mail binding detach": "ohmyhost mail binding detach --project ULID --environment PROD_ULID --expected-revision N --idempotency-key KEY --yes --json",
+  "mail identity get": "ohmyhost mail identity get --project ULID --json",
+  "mail identity declare": "ohmyhost mail identity declare --project ULID --hostname sign.example.com --idempotency-key KEY --json",
+  "mail identity verify": "ohmyhost mail identity verify --project ULID --expected-revision N --idempotency-key KEY --json",
+  "mail identity revoke": "ohmyhost mail identity revoke --project ULID --expected-revision N --idempotency-key KEY --yes --json",
+  "mail identity authorize": "ohmyhost mail identity authorize --project ULID --expected-revision N --zone example.com --idempotency-key KEY --json",
+  "mail identity authorization-revoke": "ohmyhost mail identity authorization-revoke --project ULID --expected-revision N --idempotency-key KEY --yes --json",
+  "mail identity authorization-status": "ohmyhost mail identity authorization-status --project ULID --json",
   "mail setup": "ohmyhost mail setup --project ULID --environment ULID --domain DOMAIN --sending true --receiving false --idempotency-key KEY --json",
   "mail status": "ohmyhost mail status --project ULID --environment ULID --json",
   "mail webhook set": "ohmyhost mail webhook set --project ULID --environment ULID --url HTTPS_URL --idempotency-key KEY --json",
@@ -25015,27 +25046,27 @@ var Interceptors = class {
   clear() {
     this.fns = [];
   }
-  eject(id3) {
-    const index = this.getInterceptorIndex(id3);
+  eject(id4) {
+    const index = this.getInterceptorIndex(id4);
     if (this.fns[index]) {
       this.fns[index] = null;
     }
   }
-  exists(id3) {
-    const index = this.getInterceptorIndex(id3);
+  exists(id4) {
+    const index = this.getInterceptorIndex(id4);
     return Boolean(this.fns[index]);
   }
-  getInterceptorIndex(id3) {
-    if (typeof id3 === "number") {
-      return this.fns[id3] ? id3 : -1;
+  getInterceptorIndex(id4) {
+    if (typeof id4 === "number") {
+      return this.fns[id4] ? id4 : -1;
     }
-    return this.fns.indexOf(id3);
+    return this.fns.indexOf(id4);
   }
-  update(id3, fn) {
-    const index = this.getInterceptorIndex(id3);
+  update(id4, fn) {
+    const index = this.getInterceptorIndex(id4);
     if (this.fns[index]) {
       this.fns[index] = fn;
-      return id3;
+      return id4;
     }
     return false;
   }
@@ -25270,113 +25301,106 @@ var createClient = (config = {}) => {
 var client = createClient(createConfig({ throwOnError: true }));
 
 // packages/sdk-ts/dist/generated/sdk.gen.js
-var getAccountProfile = (options) => (options?.client ?? client).get({
-  responseStyle: "data",
-  security: [{ scheme: "bearer", type: "http" }],
-  url: "/v1/me/profile",
-  ...options
-});
-var connectGithubOrganization = (parameters, options) => {
+var listWorkspaceMailDomains = (parameters, options) => {
   const params = buildClientParams([parameters], [
     {
       args: [
         { in: "headers", key: "X-Request-Id" },
-        { in: "headers", key: "Idempotency-Key" },
-        { in: "path", key: "organization_id" },
-        { key: "connectGithubOrganizationRequest", map: "body" }
+        { in: "path", key: "organization_id" }
       ]
     }
   ]);
-  return (options?.client ?? client).post({
+  return (options?.client ?? client).get({
     responseStyle: "data",
     security: [{ scheme: "bearer", type: "http" }],
-    url: "/v1/organizations/{organization_id}/github:connect",
+    url: "/v1/organizations/{organization_id}/mail-domains",
     ...options,
-    ...params,
-    headers: {
-      "Content-Type": "application/json",
-      ...options?.headers,
-      ...params.headers
-    }
+    ...params
   });
 };
-var getGithubOrganizationConnection = (parameters, options) => {
+var createWorkspaceMailDomain = (parameters, options) => {
   const params = buildClientParams([parameters], [
     {
       args: [
         { in: "headers", key: "X-Request-Id" },
-        { in: "path", key: "organization_id" }
+        { in: "headers", key: "Idempotency-Key" },
+        { in: "path", key: "organization_id" },
+        { key: "createWorkspaceMailDomainRequest", map: "body" }
       ]
     }
   ]);
-  return (options?.client ?? client).get({
+  return (options?.client ?? client).post({
     responseStyle: "data",
     security: [{ scheme: "bearer", type: "http" }],
-    url: "/v1/organizations/{organization_id}/github",
+    url: "/v1/organizations/{organization_id}/mail-domains",
     ...options,
-    ...params
+    ...params,
+    headers: {
+      "Content-Type": "application/json",
+      ...options?.headers,
+      ...params.headers
+    }
   });
 };
-var getOrganizationReferral = (parameters, options) => {
+var retireWorkspaceMailDomain = (parameters, options) => {
   const params = buildClientParams([parameters], [
     {
       args: [
         { in: "headers", key: "X-Request-Id" },
-        { in: "path", key: "organization_id" }
+        { in: "headers", key: "Idempotency-Key" },
+        { in: "path", key: "organization_id" },
+        { in: "path", key: "mail_domain_id" },
+        { key: "mailRevisionRequest", map: "body" }
       ]
     }
   ]);
-  return (options?.client ?? client).get({
-    responseStyle: "data",
-    security: [{ scheme: "bearer", type: "http" }],
-    url: "/v1/organizations/{organization_id}/referral",
-    ...options,
-    ...params
-  });
-};
-var getOrganizationAccount = (parameters, options) => {
-  const params = buildClientParams([parameters], [{ args: [{ in: "path", key: "organization_id" }] }]);
-  return (options?.client ?? client).get({
+  return (options?.client ?? client).delete({
     responseStyle: "data",
     security: [{ scheme: "bearer", type: "http" }],
-    url: "/v1/organizations/{organization_id}/account",
+    url: "/v1/organizations/{organization_id}/mail-domains/{mail_domain_id}",
     ...options,
-    ...params
+    ...params,
+    headers: {
+      "Content-Type": "application/json",
+      ...options?.headers,
+      ...params.headers
+    }
   });
 };
-var listUserApiKeys = (parameters, options) => {
+var getWorkspaceMailDomain = (parameters, options) => {
   const params = buildClientParams([parameters], [
     {
       args: [
         { in: "headers", key: "X-Request-Id" },
         { in: "path", key: "organization_id" },
-        { in: "query", key: "after" }
+        { in: "path", key: "mail_domain_id" }
       ]
     }
   ]);
   return (options?.client ?? client).get({
     responseStyle: "data",
     security: [{ scheme: "bearer", type: "http" }],
-    url: "/v1/organizations/{organization_id}/user-api-keys",
+    url: "/v1/organizations/{organization_id}/mail-domains/{mail_domain_id}",
     ...options,
     ...params
   });
 };
-var createUserApiKey = (parameters, options) => {
+var revokeWorkspaceMailDomainDnsAuthorization = (parameters, options) => {
   const params = buildClientParams([parameters], [
     {
       args: [
         { in: "headers", key: "X-Request-Id" },
         { in: "headers", key: "Idempotency-Key" },
         { in: "path", key: "organization_id" },
-        { in: "body", key: "name" }
+        { in: "path", key: "mail_domain_id" },
+        { key: "mailRevisionRequest", map: "body" }
       ]
     }
   ]);
-  return (options?.client ?? client).post({
+  return (options?.client ?? client).delete({
     responseStyle: "data",
     security: [{ scheme: "bearer", type: "http" }],
-    url: "/v1/organizations/{organization_id}/user-api-keys",
+    url: "/v1/organizations/{organization_id}/mail-domains/{mail_domain_id}/dns-authorization",
     ...options,
     ...params,
     headers: {
@@ -25386,38 +25410,40 @@ var createUserApiKey = (parameters, options) => {
     }
   });
 };
-var revokeUserApiKey = (parameters, options) => {
+var getWorkspaceMailDomainDnsAuthorization = (parameters, options) => {
   const params = buildClientParams([parameters], [
     {
       args: [
         { in: "headers", key: "X-Request-Id" },
         { in: "path", key: "organization_id" },
-        { in: "path", key: "key_id" }
+        { in: "path", key: "mail_domain_id" }
       ]
     }
   ]);
-  return (options?.client ?? client).delete({
+  return (options?.client ?? client).get({
     responseStyle: "data",
     security: [{ scheme: "bearer", type: "http" }],
-    url: "/v1/organizations/{organization_id}/user-api-keys/{key_id}",
+    url: "/v1/organizations/{organization_id}/mail-domains/{mail_domain_id}/dns-authorization",
     ...options,
     ...params
   });
 };
-var submitFeedback = (parameters, options) => {
+var authorizeWorkspaceMailDomainDns = (parameters, options) => {
   const params = buildClientParams([parameters], [
     {
       args: [
         { in: "headers", key: "X-Request-Id" },
         { in: "headers", key: "Idempotency-Key" },
-        { key: "feedbackSubmission", map: "body" }
+        { in: "path", key: "organization_id" },
+        { in: "path", key: "mail_domain_id" },
+        { key: "sharedMailDnsAuthorizationRequest", map: "body" }
       ]
     }
   ]);
   return (options?.client ?? client).post({
     responseStyle: "data",
     security: [{ scheme: "bearer", type: "http" }],
-    url: "/v1/feedback",
+    url: "/v1/organizations/{organization_id}/mail-domains/{mail_domain_id}/dns-authorization",
     ...options,
     ...params,
     headers: {
@@ -25427,48 +25453,65 @@ var submitFeedback = (parameters, options) => {
     }
   });
 };
-var getFeedback = (parameters, options) => {
+var detachProjectMailDomainBinding = (parameters, options) => {
   const params = buildClientParams([parameters], [
     {
       args: [
         { in: "headers", key: "X-Request-Id" },
-        { in: "path", key: "feedback_id" },
-        { in: "query", key: "cursor" }
+        { in: "headers", key: "Idempotency-Key" },
+        { in: "path", key: "project_id" },
+        { in: "path", key: "environment_id" },
+        { key: "mailRevisionRequest", map: "body" }
       ]
     }
   ]);
-  return (options?.client ?? client).get({
+  return (options?.client ?? client).delete({
     responseStyle: "data",
     security: [{ scheme: "bearer", type: "http" }],
-    url: "/v1/feedback/{feedback_id}",
+    url: "/v1/projects/{project_id}/environments/{environment_id}/mail-domain-binding",
     ...options,
-    ...params
+    ...params,
+    headers: {
+      "Content-Type": "application/json",
+      ...options?.headers,
+      ...params.headers
+    }
   });
 };
-var getCurrentIdentity = (parameters, options) => {
-  const params = buildClientParams([parameters], [{ args: [{ in: "headers", key: "X-Request-Id" }] }]);
+var getProjectMailDomainBinding = (parameters, options) => {
+  const params = buildClientParams([parameters], [
+    {
+      args: [
+        { in: "headers", key: "X-Request-Id" },
+        { in: "path", key: "project_id" },
+        { in: "path", key: "environment_id" }
+      ]
+    }
+  ]);
   return (options?.client ?? client).get({
     responseStyle: "data",
     security: [{ scheme: "bearer", type: "http" }],
-    url: "/v1/me",
+    url: "/v1/projects/{project_id}/environments/{environment_id}/mail-domain-binding",
     ...options,
     ...params
   });
 };
-var createOrganization = (parameters, options) => {
+var putProjectMailDomainBinding = (parameters, options) => {
   const params = buildClientParams([parameters], [
     {
       args: [
         { in: "headers", key: "X-Request-Id" },
         { in: "headers", key: "Idempotency-Key" },
-        { key: "createOrganizationRequest", map: "body" }
+        { in: "path", key: "project_id" },
+        { in: "path", key: "environment_id" },
+        { key: "projectMailDomainBindingRequest", map: "body" }
       ]
     }
   ]);
-  return (options?.client ?? client).post({
+  return (options?.client ?? client).put({
     responseStyle: "data",
     security: [{ scheme: "bearer", type: "http" }],
-    url: "/v1/organizations",
+    url: "/v1/projects/{project_id}/environments/{environment_id}/mail-domain-binding",
     ...options,
     ...params,
     headers: {
@@ -25478,22 +25521,21 @@ var createOrganization = (parameters, options) => {
     }
   });
 };
-var createBillingCheckout = (parameters, options) => {
+var revokeApplicationDomainIdentity = (parameters, options) => {
   const params = buildClientParams([parameters], [
     {
       args: [
         { in: "headers", key: "X-Request-Id" },
         { in: "headers", key: "Idempotency-Key" },
-        { in: "path", key: "organization_id" },
-        { in: "body", key: "offer" },
-        { in: "body", key: "packs" }
+        { in: "path", key: "project_id" },
+        { key: "mailRevisionRequest", map: "body" }
       ]
     }
   ]);
-  return (options?.client ?? client).post({
+  return (options?.client ?? client).delete({
     responseStyle: "data",
     security: [{ scheme: "bearer", type: "http" }],
-    url: "/v1/organizations/{organization_id}/billing/checkouts",
+    url: "/v1/projects/{project_id}/application-domain-identity",
     ...options,
     ...params,
     headers: {
@@ -25503,38 +25545,38 @@ var createBillingCheckout = (parameters, options) => {
     }
   });
 };
-var getBillingCheckout = (parameters, options) => {
+var getApplicationDomainIdentity = (parameters, options) => {
   const params = buildClientParams([parameters], [
     {
       args: [
         { in: "headers", key: "X-Request-Id" },
-        { in: "path", key: "organization_id" },
-        { in: "path", key: "checkout_id" }
+        { in: "path", key: "project_id" }
       ]
     }
   ]);
   return (options?.client ?? client).get({
     responseStyle: "data",
     security: [{ scheme: "bearer", type: "http" }],
-    url: "/v1/organizations/{organization_id}/billing/checkouts/{checkout_id}",
+    url: "/v1/projects/{project_id}/application-domain-identity",
     ...options,
     ...params
   });
 };
-var createBillingPortal = (parameters, options) => {
+var declareApplicationDomainIdentity = (parameters, options) => {
   const params = buildClientParams([parameters], [
     {
       args: [
         { in: "headers", key: "X-Request-Id" },
-        { in: "path", key: "organization_id" },
-        { key: "body", map: "body" }
+        { in: "headers", key: "Idempotency-Key" },
+        { in: "path", key: "project_id" },
+        { key: "applicationDomainIdentityRequest", map: "body" }
       ]
     }
   ]);
-  return (options?.client ?? client).post({
+  return (options?.client ?? client).put({
     responseStyle: "data",
     security: [{ scheme: "bearer", type: "http" }],
-    url: "/v1/organizations/{organization_id}/billing/portal",
+    url: "/v1/projects/{project_id}/application-domain-identity",
     ...options,
     ...params,
     headers: {
@@ -25544,41 +25586,45 @@ var createBillingPortal = (parameters, options) => {
     }
   });
 };
-var getBillingRecharge = (parameters, options) => {
+var verifyApplicationDomainIdentity = (parameters, options) => {
   const params = buildClientParams([parameters], [
     {
       args: [
         { in: "headers", key: "X-Request-Id" },
-        { in: "path", key: "organization_id" }
+        { in: "headers", key: "Idempotency-Key" },
+        { in: "path", key: "project_id" },
+        { key: "mailRevisionRequest", map: "body" }
       ]
     }
   ]);
-  return (options?.client ?? client).get({
+  return (options?.client ?? client).post({
     responseStyle: "data",
     security: [{ scheme: "bearer", type: "http" }],
-    url: "/v1/organizations/{organization_id}/billing/recharge",
+    url: "/v1/projects/{project_id}/application-domain-identity/verify",
     ...options,
-    ...params
+    ...params,
+    headers: {
+      "Content-Type": "application/json",
+      ...options?.headers,
+      ...params.headers
+    }
   });
 };
-var configureBillingRecharge = (parameters, options) => {
+var revokeApplicationDomainIdentityDnsAuthorization = (parameters, options) => {
   const params = buildClientParams([parameters], [
     {
       args: [
         { in: "headers", key: "X-Request-Id" },
         { in: "headers", key: "Idempotency-Key" },
-        { in: "path", key: "organization_id" },
-        { in: "body", key: "enabled" },
-        { in: "body", key: "monthly_limit_minor" },
-        { in: "body", key: "consent" },
-        { in: "body", key: "revision" }
+        { in: "path", key: "project_id" },
+        { key: "mailRevisionRequest", map: "body" }
       ]
     }
   ]);
-  return (options?.client ?? client).put({
+  return (options?.client ?? client).delete({
     responseStyle: "data",
     security: [{ scheme: "bearer", type: "http" }],
-    url: "/v1/organizations/{organization_id}/billing/recharge",
+    url: "/v1/projects/{project_id}/application-domain-identity/dns-authorization",
     ...options,
     ...params,
     headers: {
@@ -25588,57 +25634,68 @@ var configureBillingRecharge = (parameters, options) => {
     }
   });
 };
-var getOrganizationCredits = (parameters, options) => {
+var getApplicationDomainIdentityDnsAuthorization = (parameters, options) => {
   const params = buildClientParams([parameters], [
     {
       args: [
         { in: "headers", key: "X-Request-Id" },
-        { in: "path", key: "organization_id" }
+        { in: "path", key: "project_id" }
       ]
     }
   ]);
   return (options?.client ?? client).get({
     responseStyle: "data",
     security: [{ scheme: "bearer", type: "http" }],
-    url: "/v1/organizations/{organization_id}/credits",
+    url: "/v1/projects/{project_id}/application-domain-identity/dns-authorization",
     ...options,
     ...params
   });
 };
-var getOrganizationCreditUsage = (parameters, options) => {
+var authorizeApplicationDomainIdentityDns = (parameters, options) => {
   const params = buildClientParams([parameters], [
     {
       args: [
         { in: "headers", key: "X-Request-Id" },
-        { in: "path", key: "organization_id" },
-        { in: "query", key: "month" },
-        { in: "query", key: "cursor" }
+        { in: "headers", key: "Idempotency-Key" },
+        { in: "path", key: "project_id" },
+        { key: "sharedMailDnsAuthorizationRequest", map: "body" }
       ]
     }
   ]);
-  return (options?.client ?? client).get({
+  return (options?.client ?? client).post({
     responseStyle: "data",
     security: [{ scheme: "bearer", type: "http" }],
-    url: "/v1/organizations/{organization_id}/credit-usage",
+    url: "/v1/projects/{project_id}/application-domain-identity/dns-authorization",
     ...options,
-    ...params
+    ...params,
+    headers: {
+      "Content-Type": "application/json",
+      ...options?.headers,
+      ...params.headers
+    }
   });
 };
-var createProjectExport = (parameters, options) => {
+var getAccountProfile = (options) => (options?.client ?? client).get({
+  responseStyle: "data",
+  security: [{ scheme: "bearer", type: "http" }],
+  url: "/v1/me/profile",
+  ...options
+});
+var connectGithubOrganization = (parameters, options) => {
   const params = buildClientParams([parameters], [
     {
       args: [
         { in: "headers", key: "X-Request-Id" },
         { in: "headers", key: "Idempotency-Key" },
-        { in: "path", key: "project_id" },
-        { in: "body", key: "password" }
+        { in: "path", key: "organization_id" },
+        { key: "connectGithubOrganizationRequest", map: "body" }
       ]
     }
   ]);
   return (options?.client ?? client).post({
     responseStyle: "data",
     security: [{ scheme: "bearer", type: "http" }],
-    url: "/v1/projects/{project_id}/exports",
+    url: "/v1/organizations/{organization_id}/github:connect",
     ...options,
     ...params,
     headers: {
@@ -25648,97 +25705,83 @@ var createProjectExport = (parameters, options) => {
     }
   });
 };
-var getProjectExport = (parameters, options) => {
+var getGithubOrganizationConnection = (parameters, options) => {
   const params = buildClientParams([parameters], [
     {
       args: [
         { in: "headers", key: "X-Request-Id" },
-        { in: "path", key: "project_id" },
-        { in: "path", key: "export_id" }
+        { in: "path", key: "organization_id" }
       ]
     }
   ]);
   return (options?.client ?? client).get({
     responseStyle: "data",
     security: [{ scheme: "bearer", type: "http" }],
-    url: "/v1/projects/{project_id}/exports/{export_id}",
+    url: "/v1/organizations/{organization_id}/github",
     ...options,
     ...params
   });
 };
-var getProjectCreditBudget = (parameters, options) => {
+var getOrganizationReferral = (parameters, options) => {
   const params = buildClientParams([parameters], [
     {
       args: [
         { in: "headers", key: "X-Request-Id" },
-        { in: "path", key: "project_id" }
+        { in: "path", key: "organization_id" }
       ]
     }
   ]);
   return (options?.client ?? client).get({
     responseStyle: "data",
     security: [{ scheme: "bearer", type: "http" }],
-    url: "/v1/projects/{project_id}/credit-budget",
+    url: "/v1/organizations/{organization_id}/referral",
     ...options,
     ...params
   });
 };
-var setProjectCreditBudget = (parameters, options) => {
-  const params = buildClientParams([parameters], [
-    {
-      args: [
-        { in: "headers", key: "X-Request-Id" },
-        { in: "headers", key: "Idempotency-Key" },
-        { in: "path", key: "project_id" },
-        { key: "setProjectCreditBudgetRequest", map: "body" }
-      ]
-    }
-  ]);
-  return (options?.client ?? client).put({
+var getOrganizationAccount = (parameters, options) => {
+  const params = buildClientParams([parameters], [{ args: [{ in: "path", key: "organization_id" }] }]);
+  return (options?.client ?? client).get({
     responseStyle: "data",
     security: [{ scheme: "bearer", type: "http" }],
-    url: "/v1/projects/{project_id}/credit-budget",
+    url: "/v1/organizations/{organization_id}/account",
     ...options,
-    ...params,
-    headers: {
-      "Content-Type": "application/json",
-      ...options?.headers,
-      ...params.headers
-    }
+    ...params
   });
 };
-var listProjects = (parameters, options) => {
+var listUserApiKeys = (parameters, options) => {
   const params = buildClientParams([parameters], [
     {
       args: [
         { in: "headers", key: "X-Request-Id" },
-        { in: "query", key: "cursor" },
-        { in: "query", key: "limit" }
+        { in: "path", key: "organization_id" },
+        { in: "query", key: "after" }
       ]
     }
   ]);
   return (options?.client ?? client).get({
     responseStyle: "data",
     security: [{ scheme: "bearer", type: "http" }],
-    url: "/v1/projects",
+    url: "/v1/organizations/{organization_id}/user-api-keys",
     ...options,
     ...params
   });
 };
-var createProject = (parameters, options) => {
+var createUserApiKey = (parameters, options) => {
   const params = buildClientParams([parameters], [
     {
       args: [
         { in: "headers", key: "X-Request-Id" },
         { in: "headers", key: "Idempotency-Key" },
-        { key: "createProjectRequest", map: "body" }
+        { in: "path", key: "organization_id" },
+        { in: "body", key: "name" }
       ]
     }
   ]);
   return (options?.client ?? client).post({
     responseStyle: "data",
     security: [{ scheme: "bearer", type: "http" }],
-    url: "/v1/projects",
+    url: "/v1/organizations/{organization_id}/user-api-keys",
     ...options,
     ...params,
     headers: {
@@ -25748,22 +25791,384 @@ var createProject = (parameters, options) => {
     }
   });
 };
-var deleteProject = (parameters, options) => {
+var revokeUserApiKey = (parameters, options) => {
   const params = buildClientParams([parameters], [
     {
       args: [
         { in: "headers", key: "X-Request-Id" },
-        { in: "headers", key: "Idempotency-Key" },
-        { in: "headers", key: "If-Match" },
-        { in: "headers", key: "X-Confirmation-Token" },
-        { in: "path", key: "project_id" }
+        { in: "path", key: "organization_id" },
+        { in: "path", key: "key_id" }
       ]
     }
   ]);
   return (options?.client ?? client).delete({
     responseStyle: "data",
     security: [{ scheme: "bearer", type: "http" }],
-    url: "/v1/projects/{project_id}",
+    url: "/v1/organizations/{organization_id}/user-api-keys/{key_id}",
+    ...options,
+    ...params
+  });
+};
+var submitFeedback = (parameters, options) => {
+  const params = buildClientParams([parameters], [
+    {
+      args: [
+        { in: "headers", key: "X-Request-Id" },
+        { in: "headers", key: "Idempotency-Key" },
+        { key: "feedbackSubmission", map: "body" }
+      ]
+    }
+  ]);
+  return (options?.client ?? client).post({
+    responseStyle: "data",
+    security: [{ scheme: "bearer", type: "http" }],
+    url: "/v1/feedback",
+    ...options,
+    ...params,
+    headers: {
+      "Content-Type": "application/json",
+      ...options?.headers,
+      ...params.headers
+    }
+  });
+};
+var getFeedback = (parameters, options) => {
+  const params = buildClientParams([parameters], [
+    {
+      args: [
+        { in: "headers", key: "X-Request-Id" },
+        { in: "path", key: "feedback_id" },
+        { in: "query", key: "cursor" }
+      ]
+    }
+  ]);
+  return (options?.client ?? client).get({
+    responseStyle: "data",
+    security: [{ scheme: "bearer", type: "http" }],
+    url: "/v1/feedback/{feedback_id}",
+    ...options,
+    ...params
+  });
+};
+var getCurrentIdentity = (parameters, options) => {
+  const params = buildClientParams([parameters], [{ args: [{ in: "headers", key: "X-Request-Id" }] }]);
+  return (options?.client ?? client).get({
+    responseStyle: "data",
+    security: [{ scheme: "bearer", type: "http" }],
+    url: "/v1/me",
+    ...options,
+    ...params
+  });
+};
+var createOrganization = (parameters, options) => {
+  const params = buildClientParams([parameters], [
+    {
+      args: [
+        { in: "headers", key: "X-Request-Id" },
+        { in: "headers", key: "Idempotency-Key" },
+        { key: "createOrganizationRequest", map: "body" }
+      ]
+    }
+  ]);
+  return (options?.client ?? client).post({
+    responseStyle: "data",
+    security: [{ scheme: "bearer", type: "http" }],
+    url: "/v1/organizations",
+    ...options,
+    ...params,
+    headers: {
+      "Content-Type": "application/json",
+      ...options?.headers,
+      ...params.headers
+    }
+  });
+};
+var createBillingCheckout = (parameters, options) => {
+  const params = buildClientParams([parameters], [
+    {
+      args: [
+        { in: "headers", key: "X-Request-Id" },
+        { in: "headers", key: "Idempotency-Key" },
+        { in: "path", key: "organization_id" },
+        { in: "body", key: "offer" },
+        { in: "body", key: "packs" }
+      ]
+    }
+  ]);
+  return (options?.client ?? client).post({
+    responseStyle: "data",
+    security: [{ scheme: "bearer", type: "http" }],
+    url: "/v1/organizations/{organization_id}/billing/checkouts",
+    ...options,
+    ...params,
+    headers: {
+      "Content-Type": "application/json",
+      ...options?.headers,
+      ...params.headers
+    }
+  });
+};
+var getBillingCheckout = (parameters, options) => {
+  const params = buildClientParams([parameters], [
+    {
+      args: [
+        { in: "headers", key: "X-Request-Id" },
+        { in: "path", key: "organization_id" },
+        { in: "path", key: "checkout_id" }
+      ]
+    }
+  ]);
+  return (options?.client ?? client).get({
+    responseStyle: "data",
+    security: [{ scheme: "bearer", type: "http" }],
+    url: "/v1/organizations/{organization_id}/billing/checkouts/{checkout_id}",
+    ...options,
+    ...params
+  });
+};
+var createBillingPortal = (parameters, options) => {
+  const params = buildClientParams([parameters], [
+    {
+      args: [
+        { in: "headers", key: "X-Request-Id" },
+        { in: "path", key: "organization_id" },
+        { key: "body", map: "body" }
+      ]
+    }
+  ]);
+  return (options?.client ?? client).post({
+    responseStyle: "data",
+    security: [{ scheme: "bearer", type: "http" }],
+    url: "/v1/organizations/{organization_id}/billing/portal",
+    ...options,
+    ...params,
+    headers: {
+      "Content-Type": "application/json",
+      ...options?.headers,
+      ...params.headers
+    }
+  });
+};
+var getBillingRecharge = (parameters, options) => {
+  const params = buildClientParams([parameters], [
+    {
+      args: [
+        { in: "headers", key: "X-Request-Id" },
+        { in: "path", key: "organization_id" }
+      ]
+    }
+  ]);
+  return (options?.client ?? client).get({
+    responseStyle: "data",
+    security: [{ scheme: "bearer", type: "http" }],
+    url: "/v1/organizations/{organization_id}/billing/recharge",
+    ...options,
+    ...params
+  });
+};
+var configureBillingRecharge = (parameters, options) => {
+  const params = buildClientParams([parameters], [
+    {
+      args: [
+        { in: "headers", key: "X-Request-Id" },
+        { in: "headers", key: "Idempotency-Key" },
+        { in: "path", key: "organization_id" },
+        { in: "body", key: "enabled" },
+        { in: "body", key: "monthly_limit_minor" },
+        { in: "body", key: "consent" },
+        { in: "body", key: "revision" }
+      ]
+    }
+  ]);
+  return (options?.client ?? client).put({
+    responseStyle: "data",
+    security: [{ scheme: "bearer", type: "http" }],
+    url: "/v1/organizations/{organization_id}/billing/recharge",
+    ...options,
+    ...params,
+    headers: {
+      "Content-Type": "application/json",
+      ...options?.headers,
+      ...params.headers
+    }
+  });
+};
+var getOrganizationCredits = (parameters, options) => {
+  const params = buildClientParams([parameters], [
+    {
+      args: [
+        { in: "headers", key: "X-Request-Id" },
+        { in: "path", key: "organization_id" }
+      ]
+    }
+  ]);
+  return (options?.client ?? client).get({
+    responseStyle: "data",
+    security: [{ scheme: "bearer", type: "http" }],
+    url: "/v1/organizations/{organization_id}/credits",
+    ...options,
+    ...params
+  });
+};
+var getOrganizationCreditUsage = (parameters, options) => {
+  const params = buildClientParams([parameters], [
+    {
+      args: [
+        { in: "headers", key: "X-Request-Id" },
+        { in: "path", key: "organization_id" },
+        { in: "query", key: "month" },
+        { in: "query", key: "cursor" }
+      ]
+    }
+  ]);
+  return (options?.client ?? client).get({
+    responseStyle: "data",
+    security: [{ scheme: "bearer", type: "http" }],
+    url: "/v1/organizations/{organization_id}/credit-usage",
+    ...options,
+    ...params
+  });
+};
+var createProjectExport = (parameters, options) => {
+  const params = buildClientParams([parameters], [
+    {
+      args: [
+        { in: "headers", key: "X-Request-Id" },
+        { in: "headers", key: "Idempotency-Key" },
+        { in: "path", key: "project_id" },
+        { in: "body", key: "password" }
+      ]
+    }
+  ]);
+  return (options?.client ?? client).post({
+    responseStyle: "data",
+    security: [{ scheme: "bearer", type: "http" }],
+    url: "/v1/projects/{project_id}/exports",
+    ...options,
+    ...params,
+    headers: {
+      "Content-Type": "application/json",
+      ...options?.headers,
+      ...params.headers
+    }
+  });
+};
+var getProjectExport = (parameters, options) => {
+  const params = buildClientParams([parameters], [
+    {
+      args: [
+        { in: "headers", key: "X-Request-Id" },
+        { in: "path", key: "project_id" },
+        { in: "path", key: "export_id" }
+      ]
+    }
+  ]);
+  return (options?.client ?? client).get({
+    responseStyle: "data",
+    security: [{ scheme: "bearer", type: "http" }],
+    url: "/v1/projects/{project_id}/exports/{export_id}",
+    ...options,
+    ...params
+  });
+};
+var getProjectCreditBudget = (parameters, options) => {
+  const params = buildClientParams([parameters], [
+    {
+      args: [
+        { in: "headers", key: "X-Request-Id" },
+        { in: "path", key: "project_id" }
+      ]
+    }
+  ]);
+  return (options?.client ?? client).get({
+    responseStyle: "data",
+    security: [{ scheme: "bearer", type: "http" }],
+    url: "/v1/projects/{project_id}/credit-budget",
+    ...options,
+    ...params
+  });
+};
+var setProjectCreditBudget = (parameters, options) => {
+  const params = buildClientParams([parameters], [
+    {
+      args: [
+        { in: "headers", key: "X-Request-Id" },
+        { in: "headers", key: "Idempotency-Key" },
+        { in: "path", key: "project_id" },
+        { key: "setProjectCreditBudgetRequest", map: "body" }
+      ]
+    }
+  ]);
+  return (options?.client ?? client).put({
+    responseStyle: "data",
+    security: [{ scheme: "bearer", type: "http" }],
+    url: "/v1/projects/{project_id}/credit-budget",
+    ...options,
+    ...params,
+    headers: {
+      "Content-Type": "application/json",
+      ...options?.headers,
+      ...params.headers
+    }
+  });
+};
+var listProjects = (parameters, options) => {
+  const params = buildClientParams([parameters], [
+    {
+      args: [
+        { in: "headers", key: "X-Request-Id" },
+        { in: "query", key: "cursor" },
+        { in: "query", key: "limit" }
+      ]
+    }
+  ]);
+  return (options?.client ?? client).get({
+    responseStyle: "data",
+    security: [{ scheme: "bearer", type: "http" }],
+    url: "/v1/projects",
+    ...options,
+    ...params
+  });
+};
+var createProject = (parameters, options) => {
+  const params = buildClientParams([parameters], [
+    {
+      args: [
+        { in: "headers", key: "X-Request-Id" },
+        { in: "headers", key: "Idempotency-Key" },
+        { key: "createProjectRequest", map: "body" }
+      ]
+    }
+  ]);
+  return (options?.client ?? client).post({
+    responseStyle: "data",
+    security: [{ scheme: "bearer", type: "http" }],
+    url: "/v1/projects",
+    ...options,
+    ...params,
+    headers: {
+      "Content-Type": "application/json",
+      ...options?.headers,
+      ...params.headers
+    }
+  });
+};
+var deleteProject = (parameters, options) => {
+  const params = buildClientParams([parameters], [
+    {
+      args: [
+        { in: "headers", key: "X-Request-Id" },
+        { in: "headers", key: "Idempotency-Key" },
+        { in: "headers", key: "If-Match" },
+        { in: "headers", key: "X-Confirmation-Token" },
+        { in: "path", key: "project_id" }
+      ]
+    }
+  ]);
+  return (options?.client ?? client).delete({
+    responseStyle: "data",
+    security: [{ scheme: "bearer", type: "http" }],
+    url: "/v1/projects/{project_id}",
     ...options,
     ...params
   });
@@ -27426,6 +27831,320 @@ async function executeManagedMail(client2, input) {
   return result;
 }
 
+// packages/sdk-ts/dist/generated/shared-mail-response.js
+var ULID4 = /^[0-7][0-9A-HJKMNP-TV-Z]{25}$/u;
+var HOST = /^(?=.{1,253}$)(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\.)+[a-z]{2,63}$/u;
+function assertSharedMailResponse(value, input) {
+  const v = object3(value);
+  if (input.action === "domains_list") {
+    exact5(v, ["items"]);
+    if (!Array.isArray(v["items"]) || v["items"].length > 100)
+      invalid6();
+    for (const item of v["items"])
+      assertSharedMailResponse(item, {
+        ...input,
+        action: "domain_get",
+        mailDomainId: String(object3(item)["domain_id"])
+      });
+    return;
+  }
+  if (["domain_get", "domain_create", "domain_retire"].includes(input.action)) {
+    exact5(v, [
+      "domain_id",
+      "organization_id",
+      "domain",
+      "registrable_domain",
+      "revision",
+      "status",
+      "sending",
+      "receiving",
+      "configured_at",
+      "observed_at",
+      "dns_records",
+      "bindings_count"
+    ]);
+    id3(v["domain_id"]);
+    id3(v["organization_id"]);
+    if (!("organizationId" in input) || v["organization_id"] !== input.organizationId || "mailDomainId" in input && v["domain_id"] !== input.mailDomainId)
+      invalid6();
+    host(v["domain"]);
+    host(v["registrable_domain"]);
+    positive(v["revision"]);
+    member(v["status"], ["active", "retiring", "retired"]);
+    for (const k of ["sending", "receiving"])
+      member(v[k], ["disabled", "pending", "ready", "failed"]);
+    time2(v["configured_at"]);
+    if (v["observed_at"] !== null)
+      time2(v["observed_at"]);
+    if (!Number.isSafeInteger(v["bindings_count"]) || Number(v["bindings_count"]) < 0)
+      invalid6();
+    if (!Array.isArray(v["dns_records"]))
+      invalid6();
+    for (const entry of v["dns_records"]) {
+      const r = object3(entry);
+      exact5(r, ["type", "name", "value", "purpose", "status"], ["priority"]);
+      member(r["type"], ["TXT", "MX", "CNAME"]);
+      for (const k of ["name", "value", "purpose", "status"])
+        if (typeof r[k] !== "string" || /[\r\n\0]/u.test(r[k]))
+          invalid6();
+      if (r["priority"] !== void 0 && (!Number.isSafeInteger(r["priority"]) || Number(r["priority"]) < 0 || Number(r["priority"]) > 65535))
+        invalid6();
+      if (r["type"] === "MX" && r["priority"] === void 0)
+        invalid6();
+    }
+    return;
+  }
+  if (["binding_get", "binding_set", "binding_detach"].includes(input.action)) {
+    exact5(v, [
+      "mail_domain_id",
+      "organization_id",
+      "project_id",
+      "environment_id",
+      "revision",
+      "sending",
+      "sender_addresses",
+      "default_from",
+      "default_reply_to",
+      "legacy",
+      "status",
+      "application_domain_identity"
+    ]);
+    for (const k of ["mail_domain_id", "organization_id", "project_id", "environment_id"])
+      id3(v[k]);
+    if (!("projectId" in input) || !("environmentId" in input) || v["project_id"] !== input.projectId || v["environment_id"] !== input.environmentId || "mailDomainId" in input && v["mail_domain_id"] !== input.mailDomainId)
+      invalid6();
+    positive(v["revision"]);
+    for (const k of ["sending", "legacy"])
+      if (typeof v[k] !== "boolean")
+        invalid6();
+    member(v["status"], ["active", "detached", "suspended"]);
+    if (!Array.isArray(v["sender_addresses"]) || v["sender_addresses"].length > 32 || new Set(v["sender_addresses"]).size !== v["sender_addresses"].length)
+      invalid6();
+    for (const a of v["sender_addresses"])
+      mailbox(a);
+    for (const k of ["default_from", "default_reply_to"])
+      if (v[k] !== null)
+        mailbox(v[k]);
+    if (!v["legacy"] && (!v["sender_addresses"].includes(v["default_from"]) || v["sender_addresses"].length === 0))
+      invalid6();
+    if (v["application_domain_identity"] !== null) {
+      const identity = object3(v["application_domain_identity"]);
+      exact5(identity, ["hostname", "registrable_domain", "revision", "status"]);
+      host(identity["hostname"]);
+      host(identity["registrable_domain"]);
+      positive(identity["revision"]);
+      member(identity["status"], ["pending", "verified", "expired", "revoked"]);
+    }
+    return;
+  }
+  if (["identity_get", "identity_declare", "identity_verify", "identity_revoke"].includes(input.action)) {
+    exact5(v, [
+      "organization_id",
+      "project_id",
+      "hostname",
+      "registrable_domain",
+      "status",
+      "revision",
+      "challenge",
+      "verified_at",
+      "expires_at"
+    ]);
+    id3(v["organization_id"]);
+    id3(v["project_id"]);
+    if (!("projectId" in input) || v["project_id"] !== input.projectId)
+      invalid6();
+    host(v["hostname"]);
+    host(v["registrable_domain"]);
+    positive(v["revision"]);
+    member(v["status"], ["pending", "verified", "expired", "revoked"]);
+    const challenge = object3(v["challenge"]);
+    exact5(challenge, ["type", "name", "value"]);
+    if (challenge["type"] !== "TXT" || typeof challenge["name"] !== "string" || challenge["name"] !== `_omh-project.${v["hostname"]}` || typeof challenge["value"] !== "string" || challenge["value"].length < 16 || challenge["value"].length > 255 || /[\r\n\0]/u.test(challenge["value"]))
+      invalid6();
+    if (v["verified_at"] !== null)
+      time2(v["verified_at"]);
+    time2(v["expires_at"]);
+    return;
+  }
+  if (input.action === "domain_dns_authorize" || input.action === "identity_authorize") {
+    exact5(v, ["authorization_id", "authorization_url", "expires_at"]);
+    id3(v["authorization_id"]);
+    time2(v["expires_at"]);
+    if (typeof v["authorization_url"] !== "string" || !/^https:\/\/dash\.cloudflare\.com\/oauth2\/auth\?/u.test(v["authorization_url"]))
+      invalid6();
+    return;
+  }
+  exact5(v, ["status", "zone", "scopes", "expires_at"]);
+  member(v["status"], ["not_authorized", "pending", "authorized", "expired", "revoked"]);
+  if (!Array.isArray(v["scopes"]) || v["scopes"].length > 2 || new Set(v["scopes"]).size !== v["scopes"].length || v["scopes"].some((s) => s !== "dns.write" && s !== "zone.read"))
+    invalid6();
+  if (v["zone"] !== null)
+    host(v["zone"]);
+  if (v["expires_at"] !== null)
+    time2(v["expires_at"]);
+  if (v["status"] === "not_authorized" && (v["zone"] !== null || v["expires_at"] !== null || v["scopes"].length))
+    invalid6();
+}
+function object3(v) {
+  if (v === null || typeof v !== "object" || Array.isArray(v))
+    invalid6();
+  return v;
+}
+function exact5(v, required, optional = []) {
+  if (required.some((k) => !(k in v)) || Object.keys(v).some((k) => !required.includes(k) && !optional.includes(k)))
+    invalid6();
+}
+function member(v, values) {
+  if (typeof v !== "string" || !values.includes(v))
+    invalid6();
+}
+function id3(v) {
+  if (typeof v !== "string" || !ULID4.test(v))
+    invalid6();
+}
+function host(v) {
+  if (typeof v !== "string" || !HOST.test(v))
+    invalid6();
+}
+function positive(v) {
+  if (!Number.isSafeInteger(v) || Number(v) < 1)
+    invalid6();
+}
+function time2(v) {
+  if (typeof v !== "string" || !Number.isFinite(Date.parse(v)) || new Date(v).toISOString() !== v)
+    invalid6();
+}
+function mailbox(v) {
+  if (typeof v !== "string" || v.length > 254 || !/^[A-Za-z0-9.!#$%&'*+\-/=?^_`{|}~]+@[a-z0-9.-]+\.[a-z]{2,63}$/u.test(v) || v.startsWith(".") || v.includes("..") || v.includes(".@"))
+    invalid6();
+}
+function invalid6() {
+  throw new TypeError("Shared mail response contract invalid");
+}
+
+// packages/sdk-ts/dist/shared-mail.js
+async function executeSharedMail(client2, input) {
+  const options = { client: client2 };
+  let result;
+  switch (input.action) {
+    case "domains_list":
+      result = await listWorkspaceMailDomains({ organization_id: input.organizationId }, options);
+      break;
+    case "domain_create":
+      result = await createWorkspaceMailDomain({
+        organization_id: input.organizationId,
+        "Idempotency-Key": input.idempotencyKey,
+        createWorkspaceMailDomainRequest: { domain: input.domain, sending: input.sending }
+      }, options);
+      break;
+    case "domain_get":
+      result = await getWorkspaceMailDomain({ organization_id: input.organizationId, mail_domain_id: input.mailDomainId }, options);
+      break;
+    case "domain_retire":
+      result = await retireWorkspaceMailDomain({
+        organization_id: input.organizationId,
+        mail_domain_id: input.mailDomainId,
+        "Idempotency-Key": input.idempotencyKey,
+        mailRevisionRequest: { expected_revision: input.expectedRevision }
+      }, options);
+      break;
+    case "domain_dns_authorize":
+      result = await authorizeWorkspaceMailDomainDns({
+        organization_id: input.organizationId,
+        mail_domain_id: input.mailDomainId,
+        "Idempotency-Key": input.idempotencyKey,
+        sharedMailDnsAuthorizationRequest: {
+          expected_revision: input.expectedRevision,
+          zone: input.zone
+        }
+      }, options);
+      break;
+    case "domain_dns_revoke":
+      result = await revokeWorkspaceMailDomainDnsAuthorization({
+        organization_id: input.organizationId,
+        mail_domain_id: input.mailDomainId,
+        "Idempotency-Key": input.idempotencyKey,
+        mailRevisionRequest: { expected_revision: input.expectedRevision }
+      }, options);
+      break;
+    case "identity_authorization_revoke":
+      result = await revokeApplicationDomainIdentityDnsAuthorization({
+        project_id: input.projectId,
+        "Idempotency-Key": input.idempotencyKey,
+        mailRevisionRequest: { expected_revision: input.expectedRevision }
+      }, options);
+      break;
+    case "domain_dns_status":
+      result = await getWorkspaceMailDomainDnsAuthorization({ organization_id: input.organizationId, mail_domain_id: input.mailDomainId }, options);
+      break;
+    case "binding_get":
+      result = await getProjectMailDomainBinding({ project_id: input.projectId, environment_id: input.environmentId }, options);
+      break;
+    case "binding_set":
+      result = await putProjectMailDomainBinding({
+        project_id: input.projectId,
+        environment_id: input.environmentId,
+        "Idempotency-Key": input.idempotencyKey,
+        projectMailDomainBindingRequest: {
+          mail_domain_id: input.mailDomainId,
+          sending: input.sending,
+          sender_addresses: [...input.senderAddresses],
+          default_from: input.defaultFrom,
+          default_reply_to: input.defaultReplyTo,
+          expected_revision: input.expectedRevision
+        }
+      }, options);
+      break;
+    case "binding_detach":
+      result = await detachProjectMailDomainBinding({
+        project_id: input.projectId,
+        environment_id: input.environmentId,
+        "Idempotency-Key": input.idempotencyKey,
+        mailRevisionRequest: { expected_revision: input.expectedRevision }
+      }, options);
+      break;
+    case "identity_get":
+      result = await getApplicationDomainIdentity({ project_id: input.projectId }, options);
+      break;
+    case "identity_declare":
+      result = await declareApplicationDomainIdentity({
+        project_id: input.projectId,
+        "Idempotency-Key": input.idempotencyKey,
+        applicationDomainIdentityRequest: { hostname: input.hostname }
+      }, options);
+      break;
+    case "identity_verify":
+      result = await verifyApplicationDomainIdentity({
+        project_id: input.projectId,
+        "Idempotency-Key": input.idempotencyKey,
+        mailRevisionRequest: { expected_revision: input.expectedRevision }
+      }, options);
+      break;
+    case "identity_revoke":
+      result = await revokeApplicationDomainIdentity({
+        project_id: input.projectId,
+        "Idempotency-Key": input.idempotencyKey,
+        mailRevisionRequest: { expected_revision: input.expectedRevision }
+      }, options);
+      break;
+    case "identity_authorize":
+      result = await authorizeApplicationDomainIdentityDns({
+        project_id: input.projectId,
+        "Idempotency-Key": input.idempotencyKey,
+        sharedMailDnsAuthorizationRequest: {
+          expected_revision: input.expectedRevision,
+          zone: input.zone
+        }
+      }, options);
+      break;
+    case "identity_authorization_status":
+      result = await getApplicationDomainIdentityDnsAuthorization({ project_id: input.projectId }, options);
+      break;
+  }
+  assertSharedMailResponse(result, input);
+  return result;
+}
+
 // packages/workos-auth-contracts/dist/device-flow.js
 var WORKOS_AUTHKIT_DEVICE_TOKEN_ENDPOINT = "https://api.workos.com/user_management/authenticate";
 var allowedDeviceTokenFields = /* @__PURE__ */ new Set([
@@ -27996,6 +28715,9 @@ var GeneratedSdkProductApi = class {
       secret_name: input.name
     }, { client: this.#client });
   }
+  sharedMail(input) {
+    return executeSharedMail(this.#client, input);
+  }
   managedMail(input) {
     return executeManagedMail(this.#client, input);
   }
@@ -28014,10 +28736,14 @@ var UNNAMED_MODULE_MESSAGES = Object.freeze({
 var STORAGE_RUNTIME_BINDINGS = Object.freeze([
   "OHMYHOST_ENVIRONMENT_ID",
   "OHMYHOST_PROJECT_ID",
-  "OHMYHOST_STORAGE_GATEWAY",
   "OHMYHOST_STORAGE_GATEWAY_URL",
   "OHMYHOST_STORAGE_KEY"
 ]);
+var MAIL_RUNTIME_BINDINGS = Object.freeze([
+  "OHMYHOST_MAIL_GATEWAY_URL",
+  "OHMYHOST_MAIL_KEY",
+  "OHMYHOST_PROJECT_ID"
+]);
 var CUSTOMER_RUNTIME_SOURCE = `npm:@amerged/ohmyhost-runtime@${package_default2.version}`;
 var PENDING_CHECKS = Object.freeze({
   installed_version: "compatibility.frameworks lists a version range that no lockfile ohmyho.st reads (package-lock.json v2/v3 or pnpm-lock.yaml v6/v9) resolves. Planning admits it; after the frozen install, the build checks the installed version against the same security minimum.",
@@ -28876,6 +29602,9 @@ var GeneratedSdkLocalMcpClient = class {
       operation_id: input.operationId
     }, { client: this.#client });
   }
+  sharedMail(input) {
+    return executeSharedMail(this.#client, input);
+  }
   managedMail(input) {
     return executeManagedMail(this.#client, input);
   }
@@ -29080,13 +29809,13 @@ function normalizeSourceChanges(value) {
   const body = record6(value);
   const changes = body["changes"];
   if (!Array.isArray(changes) || changes.length < 1 || changes.length > MANAGED_SOURCE_LIMITS.files)
-    invalid6();
+    invalid7();
   let textBytes = 0;
   const normalized = changes.map((change) => {
     const entry = record6(change);
     const hasText = Object.hasOwn(entry, "content_text");
     if (hasText === Object.hasOwn(entry, "content_base64"))
-      invalid6();
+      invalid7();
     const result = {
       ...entry,
       executable: Object.hasOwn(entry, "executable") ? entry["executable"] : false
@@ -29094,13 +29823,13 @@ function normalizeSourceChanges(value) {
     if (hasText) {
       const text = entry["content_text"];
       if (typeof text !== "string" || text.length > MANAGED_SOURCE_LIMITS.fileBytes)
-        invalid6();
+        invalid7();
       const bytes = new TextEncoder().encode(text);
       if (bytes.byteLength > MANAGED_SOURCE_LIMITS.fileBytes || new TextDecoder("utf-8", { fatal: true, ignoreBOM: true }).decode(bytes) !== text)
-        invalid6();
+        invalid7();
       textBytes += bytes.byteLength;
       if (textBytes > MANAGED_SOURCE_LIMITS.uploadBytes)
-        invalid6();
+        invalid7();
       result["content_base64"] = encodeBase64(bytes);
       delete result["content_text"];
     }
@@ -29110,7 +29839,7 @@ function normalizeSourceChanges(value) {
 }
 function formatMcpSourceFileResponse(value, format = "text") {
   if (format !== "text" && format !== "base64")
-    invalid6();
+    invalid7();
   assertManagedSourceResponse("files", value);
   const response = value;
   if (format === "base64" || !("file" in response))
@@ -29144,10 +29873,10 @@ function encodeBase64(bytes) {
 }
 function record6(value) {
   if (typeof value !== "object" || value === null || Array.isArray(value))
-    invalid6();
+    invalid7();
   return value;
 }
-function invalid6() {
+function invalid7() {
   throw new TypeError("MCP source content is invalid");
 }
 
@@ -29624,6 +30353,236 @@ function createLocalOhmyhostMcpServer(dependencies) {
     operationId: input.operation_id,
     idempotencyKey: input.idempotency_key
   })), mutationAnnotations());
+  registerProductTool(server, dependencies, "workspace_mail_domain_dns_revoke", "Revoke the selected workspace sender DNS grant at its current revision with explicit confirmation. This does not retire the sender or remove existing DNS records.", external_exports.object({
+    organization_id: identifier2,
+    mail_domain_id: identifier2,
+    expected_revision: external_exports.number().int().min(0).max(Number.MAX_SAFE_INTEGER),
+    idempotency_key: idempotencyKey,
+    confirmed: external_exports.literal(true)
+  }).strict(), async (client2, input) => {
+    if (!client2.sharedMail)
+      throw new Error("Shared mail unavailable");
+    return client2.sharedMail({
+      action: "domain_dns_revoke",
+      organizationId: input.organization_id,
+      mailDomainId: input.mail_domain_id,
+      expectedRevision: input.expected_revision,
+      idempotencyKey: input.idempotency_key
+    });
+  }, mutationAnnotations());
+  registerProductTool(server, dependencies, "application_domain_identity_authorization_revoke", "Revoke the current application identity DNS grant with explicit confirmation. The application hostname and its verified proof remain unchanged; no website routing or DNS records are removed.", external_exports.object({
+    project_id: identifier2,
+    expected_revision: external_exports.number().int().min(0).max(Number.MAX_SAFE_INTEGER),
+    idempotency_key: idempotencyKey,
+    confirmed: external_exports.literal(true)
+  }).strict(), async (client2, input) => {
+    if (!client2.sharedMail)
+      throw new Error("Shared mail unavailable");
+    return client2.sharedMail({
+      action: "identity_authorization_revoke",
+      projectId: input.project_id,
+      expectedRevision: input.expected_revision,
+      idempotencyKey: input.idempotency_key
+    });
+  }, mutationAnnotations());
+  registerProductTool(server, dependencies, "workspace_mail_domains_list", "List only workspace sender domains this account and connected client may read. Project edit consent alone grants no sender-domain access.", external_exports.object({ organization_id: identifier2 }).strict(), async (client2, input) => {
+    if (!client2.sharedMail)
+      throw new Error("Shared mail unavailable");
+    return client2.sharedMail({ action: "domains_list", organizationId: input.organization_id });
+  });
+  registerProductTool(server, dependencies, "workspace_mail_domain_create", "Create one workspace-owned transactional sender domain. Requires explicit workspace mail administration. This creates no mailbox and preserves existing MX records.", external_exports.object({
+    organization_id: identifier2,
+    domain: external_exports.string().min(1).max(253),
+    sending: external_exports.literal(true),
+    idempotency_key: idempotencyKey
+  }).strict(), async (client2, input) => {
+    if (!client2.sharedMail)
+      throw new Error("Shared mail unavailable");
+    return client2.sharedMail({
+      action: "domain_create",
+      organizationId: input.organization_id,
+      domain: input.domain,
+      sending: input.sending,
+      idempotencyKey: input.idempotency_key
+    });
+  }, mutationAnnotations());
+  registerProductTool(server, dependencies, "workspace_mail_domain_get", "Read sender verification, lifecycle, revision and DNS records for one authorized workspace resource.", external_exports.object({ organization_id: identifier2, mail_domain_id: identifier2 }).strict(), async (client2, input) => {
+    if (!client2.sharedMail)
+      throw new Error("Shared mail unavailable");
+    return client2.sharedMail({
+      action: "domain_get",
+      organizationId: input.organization_id,
+      mailDomainId: input.mail_domain_id
+    });
+  });
+  registerProductTool(server, dependencies, "workspace_mail_domain_retire", "Retire an explicitly selected workspace sender only after every send and inbound reference is detached and provider effects settle. Requires current revision and explicit confirmation. Retain the same request key after uncertainty.", external_exports.object({
+    organization_id: identifier2,
+    mail_domain_id: identifier2,
+    expected_revision: external_exports.number().int().min(0).max(Number.MAX_SAFE_INTEGER),
+    idempotency_key: idempotencyKey,
+    confirmed: external_exports.literal(true)
+  }).strict(), async (client2, input) => {
+    if (!client2.sharedMail)
+      throw new Error("Shared mail unavailable");
+    return client2.sharedMail({
+      action: "domain_retire",
+      organizationId: input.organization_id,
+      mailDomainId: input.mail_domain_id,
+      expectedRevision: input.expected_revision,
+      idempotencyKey: input.idempotency_key
+    });
+  }, mutationAnnotations());
+  registerProductTool(server, dependencies, "workspace_mail_domain_dns_authorize", "Request human Cloudflare consent for this selected workspace sender, zone and revision. No provider credentials are accepted. Open the returned link for the human; never approve it automatically.", external_exports.object({
+    organization_id: identifier2,
+    mail_domain_id: identifier2,
+    expected_revision: external_exports.number().int().min(0).max(Number.MAX_SAFE_INTEGER),
+    zone: external_exports.string().min(1).max(253),
+    idempotency_key: idempotencyKey
+  }).strict(), async (client2, input) => {
+    if (!client2.sharedMail)
+      throw new Error("Shared mail unavailable");
+    return client2.sharedMail({
+      action: "domain_dns_authorize",
+      organizationId: input.organization_id,
+      mailDomainId: input.mail_domain_id,
+      expectedRevision: input.expected_revision,
+      zone: input.zone,
+      idempotencyKey: input.idempotency_key
+    });
+  }, mutationAnnotations());
+  registerProductTool(server, dependencies, "workspace_mail_domain_dns_status", "Read exact workspace sender DNS authorization status. An existing verified resource needs no new DNS grant merely to attach a same-domain project.", external_exports.object({ organization_id: identifier2, mail_domain_id: identifier2 }).strict(), async (client2, input) => {
+    if (!client2.sharedMail)
+      throw new Error("Shared mail unavailable");
+    return client2.sharedMail({
+      action: "domain_dns_status",
+      organizationId: input.organization_id,
+      mailDomainId: input.mail_domain_id
+    });
+  });
+  registerProductTool(server, dependencies, "mail_binding_get", "Read the Prod sender binding and per-project From addresses, default From and default Reply-To. Dev uses this logical project sender identity.", external_exports.object({ project_id: identifier2, environment_id: identifier2 }).strict(), async (client2, input) => {
+    if (!client2.sharedMail)
+      throw new Error("Shared mail unavailable");
+    return client2.sharedMail({
+      action: "binding_get",
+      projectId: input.project_id,
+      environmentId: input.environment_id
+    });
+  });
+  registerProductTool(server, dependencies, "mail_binding_set", "Attach a verified workspace sender or update its project settings. Requires target project edit and explicit sender use permission. The verified application and sender must share the registrable main domain. Set exact From addresses; no per-prefix DNS is needed. Reply-To may name an external existing mailbox and a per-message value overrides the default. Attaching changes no sender DNS and grants no receiving access.", external_exports.object({
+    project_id: identifier2,
+    environment_id: identifier2,
+    mail_domain_id: identifier2,
+    sending: external_exports.boolean(),
+    sender_addresses: external_exports.array(external_exports.email().max(320)).min(1).max(32),
+    default_from: external_exports.email().max(320),
+    default_reply_to: external_exports.email().max(320).nullable(),
+    expected_revision: external_exports.number().int().min(0).max(Number.MAX_SAFE_INTEGER),
+    idempotency_key: idempotencyKey
+  }).strict(), async (client2, input) => {
+    if (!client2.sharedMail)
+      throw new Error("Shared mail unavailable");
+    return client2.sharedMail({
+      action: "binding_set",
+      projectId: input.project_id,
+      environmentId: input.environment_id,
+      mailDomainId: input.mail_domain_id,
+      sending: input.sending,
+      senderAddresses: input.sender_addresses,
+      defaultFrom: input.default_from,
+      defaultReplyTo: input.default_reply_to,
+      expectedRevision: input.expected_revision,
+      idempotencyKey: input.idempotency_key
+    });
+  }, mutationAnnotations());
+  registerProductTool(server, dependencies, "mail_binding_detach", "Detach only this project send binding with current revision and explicit confirmation. Sibling senders, provider verification and the exclusive inbound owner remain intact.", external_exports.object({
+    project_id: identifier2,
+    environment_id: identifier2,
+    expected_revision: external_exports.number().int().min(0).max(Number.MAX_SAFE_INTEGER),
+    idempotency_key: idempotencyKey,
+    confirmed: external_exports.literal(true)
+  }).strict(), async (client2, input) => {
+    if (!client2.sharedMail)
+      throw new Error("Shared mail unavailable");
+    return client2.sharedMail({
+      action: "binding_detach",
+      projectId: input.project_id,
+      environmentId: input.environment_id,
+      expectedRevision: input.expected_revision,
+      idempotencyKey: input.idempotency_key
+    });
+  }, mutationAnnotations());
+  registerProductTool(server, dependencies, "application_domain_identity_get", "Read the project intended application hostname, current revision and ownership proof. An awaiting deployment declaration or technical OMH hostname alone is not verified customer-domain identity.", external_exports.object({ project_id: identifier2 }).strict(), async (client2, input) => {
+    if (!client2.sharedMail)
+      throw new Error("Shared mail unavailable");
+    return client2.sharedMail({ action: "identity_get", projectId: input.project_id });
+  });
+  registerProductTool(server, dependencies, "application_domain_identity_declare", "Declare the intended customer application hostname before deployment. Returns a project-bound TXT ownership challenge. This does not route website traffic or prove ownership; verify the challenge before attaching a shared sender.", external_exports.object({
+    project_id: identifier2,
+    hostname: external_exports.string().min(1).max(253),
+    idempotency_key: idempotencyKey
+  }).strict(), async (client2, input) => {
+    if (!client2.sharedMail)
+      throw new Error("Shared mail unavailable");
+    return client2.sharedMail({
+      action: "identity_declare",
+      projectId: input.project_id,
+      hostname: input.hostname,
+      idempotencyKey: input.idempotency_key
+    });
+  }, mutationAnnotations());
+  registerProductTool(server, dependencies, "application_domain_identity_verify", "Verify the exact current project and hostname TXT challenge independently of deployment. Read the resulting proof before attaching a same-main-domain workspace sender.", external_exports.object({
+    project_id: identifier2,
+    expected_revision: external_exports.number().int().min(0).max(Number.MAX_SAFE_INTEGER),
+    idempotency_key: idempotencyKey
+  }).strict(), async (client2, input) => {
+    if (!client2.sharedMail)
+      throw new Error("Shared mail unavailable");
+    return client2.sharedMail({
+      action: "identity_verify",
+      projectId: input.project_id,
+      expectedRevision: input.expected_revision,
+      idempotencyKey: input.idempotency_key
+    });
+  }, mutationAnnotations());
+  registerProductTool(server, dependencies, "application_domain_identity_revoke", "Revoke only the selected current application-domain proof with explicit confirmation. This does not delete or retarget the website. Sender reuse requires a current eligible identity.", external_exports.object({
+    project_id: identifier2,
+    expected_revision: external_exports.number().int().min(0).max(Number.MAX_SAFE_INTEGER),
+    idempotency_key: idempotencyKey,
+    confirmed: external_exports.literal(true)
+  }).strict(), async (client2, input) => {
+    if (!client2.sharedMail)
+      throw new Error("Shared mail unavailable");
+    return client2.sharedMail({
+      action: "identity_revoke",
+      projectId: input.project_id,
+      expectedRevision: input.expected_revision,
+      idempotencyKey: input.idempotency_key
+    });
+  }, mutationAnnotations());
+  registerProductTool(server, dependencies, "application_domain_identity_authorize", "Request exact-purpose Cloudflare consent to write this project hostname ownership challenge at the current revision. Open the private authorization URL for the human; never approve it automatically. Manual DNS remains available.", external_exports.object({
+    project_id: identifier2,
+    expected_revision: external_exports.number().int().min(0).max(Number.MAX_SAFE_INTEGER),
+    zone: external_exports.string().min(1).max(253),
+    idempotency_key: idempotencyKey
+  }).strict(), async (client2, input) => {
+    if (!client2.sharedMail)
+      throw new Error("Shared mail unavailable");
+    return client2.sharedMail({
+      action: "identity_authorize",
+      projectId: input.project_id,
+      expectedRevision: input.expected_revision,
+      zone: input.zone,
+      idempotencyKey: input.idempotency_key
+    });
+  }, mutationAnnotations());
+  registerProductTool(server, dependencies, "application_domain_identity_authorization_status", "Read the selected project application-domain identity DNS authorization status. Zone visibility or consent alone is not ownership proof; run verification.", external_exports.object({ project_id: identifier2 }).strict(), async (client2, input) => {
+    if (!client2.sharedMail)
+      throw new Error("Shared mail unavailable");
+    return client2.sharedMail({
+      action: "identity_authorization_status",
+      projectId: input.project_id
+    });
+  });
   registerProductTool(server, dependencies, "mail_setup", "Configure the customer's one production mail domain using the project Prod environment ID, only when the customer wants mail or the app declares mail.enabled; hosting needs no mail domain and none is registered automatically. The Dev and Prod application URLs do not create separate mail domains. Ask whether they want sending and receiving. Configure sending first; receiving requires mail_webhook_set, application signature verification and mail_webhook_verify. Preserve existing mailbox MX records. No Resend account or key is needed.", external_exports.object({
     project_id: identifier2,
     environment_id: identifier2,
@@ -29987,7 +30946,7 @@ function registerManagedSourceTools(server, dependencies) {
       projectId: input.project_id,
       operationId: input.operation_id,
       api: port(client2),
-      getOperation: (id3) => client2.getOperation(id3)
+      getOperation: (id4) => client2.getOperation(id4)
     });
   }, mutationAnnotations());
   registerProductTool(server, dependencies, "source_upload", "Observe the exact managed snapshot upload after an uncertain response. sealed and committed uploads must not be uploaded again; commit_sha identifies the saved version.", external_exports.object({ project_id: identifier2, operation_id: identifier2 }), (client2, input) => port(client2).getUpload({ projectId: input.project_id, operationId: input.operation_id }));