@amerged/ohmyhost-cli 0.1.36 → 0.1.38

package/dist/index.js

@@ -99,7 +99,7 @@ import {
   selectWorkspace,
   verifiedUserId,
   workspaceOf
-} from "./chunk-LU7ONYZG.js";
+} from "./chunk-EWKJGJQU.js";
 import {
   CredentialStoreIntegrityError,
   CredentialStoreUnavailableError,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@amerged/ohmyhost-cli",
-  "version": "0.1.36",
+  "version": "0.1.38",
   "type": "module",
   "engines": {
     "node": ">=22"

package/src/apps/product-cli/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ohmyhost/product-cli",
-  "version": "0.1.36",
+  "version": "0.1.38",
   "private": true,
   "ohmyhost": {
     "deployment": "production",
@@ -32,7 +32,7 @@
   },
   "scripts": {
     "build": "tsc --project tsconfig.build.json",
-    "typecheck": "tsc --project tsconfig.json --noEmit",
+    "typecheck": "tsc --project tsconfig.json --noEmit --incremental --tsBuildInfoFile typecheck.tsbuildinfo",
     "test": "vitest run --root ../.. apps/product-cli/test"
   },
   "dependencies": {

package/src/apps/product-cli/src/cli.ts

@@ -470,6 +470,37 @@ const HELP_USAGE = Object.freeze({
     "printf '%s' \"$SECRET_VALUE\" | ohmyhost secret set NAME --project ULID --environment ENVIRONMENT_ULID --idempotency-key KEY [--profile-user USER_ID --profile-organization ULID | --token-user USER_ID --token-organization ULID] --stdin [--wait] --json (with --profile-user and --profile-organization the saved login that runs it must belong to that user and organization; with --token-user and --token-organization it runs only with an OHMYHOST_TOKEN of that user and organization, never with a saved login)",
   "secret delete":
     "ohmyhost secret delete NAME --project ULID --environment ENVIRONMENT_ULID --idempotency-key KEY [--wait] --json",
+  "mail workspace list": "ohmyhost mail workspace list --organization ULID --json",
+  "mail workspace create":
+    "ohmyhost mail workspace create --organization ULID --domain DOMAIN --sending true --idempotency-key KEY --json",
+  "mail workspace status":
+    "ohmyhost mail workspace status --organization ULID --mail-domain ULID --json",
+  "mail workspace retire":
+    "ohmyhost mail workspace retire --organization ULID --mail-domain ULID --expected-revision N --idempotency-key KEY --yes --json",
+  "mail workspace dns-authorize":
+    "ohmyhost mail workspace dns-authorize --organization ULID --mail-domain ULID --expected-revision N --zone DOMAIN --idempotency-key KEY --json",
+  "mail workspace dns-revoke":
+    "ohmyhost mail workspace dns-revoke --organization ULID --mail-domain ULID --expected-revision N --idempotency-key KEY --yes --json",
+  "mail workspace dns-status":
+    "ohmyhost mail workspace dns-status --organization ULID --mail-domain ULID --json",
+  "mail binding get": "ohmyhost mail binding get --project ULID --environment PROD_ULID --json",
+  "mail binding set":
+    "ohmyhost mail binding set --project ULID --environment PROD_ULID --mail-domain ULID --sending true --sender-addresses contact@mail.example.com,contracts@mail.example.com --default-from contracts@mail.example.com [--reply-to owner@example.com] --expected-revision N --idempotency-key KEY --json",
+  "mail binding detach":
+    "ohmyhost mail binding detach --project ULID --environment PROD_ULID --expected-revision N --idempotency-key KEY --yes --json",
+  "mail identity get": "ohmyhost mail identity get --project ULID --json",
+  "mail identity declare":
+    "ohmyhost mail identity declare --project ULID --hostname sign.example.com --idempotency-key KEY --json",
+  "mail identity verify":
+    "ohmyhost mail identity verify --project ULID --expected-revision N --idempotency-key KEY --json",
+  "mail identity revoke":
+    "ohmyhost mail identity revoke --project ULID --expected-revision N --idempotency-key KEY --yes --json",
+  "mail identity authorize":
+    "ohmyhost mail identity authorize --project ULID --expected-revision N --zone example.com --idempotency-key KEY --json",
+  "mail identity authorization-revoke":
+    "ohmyhost mail identity authorization-revoke --project ULID --expected-revision N --idempotency-key KEY --yes --json",
+  "mail identity authorization-status":
+    "ohmyhost mail identity authorization-status --project ULID --json",
   "mail setup":
     "ohmyhost mail setup --project ULID --environment ULID --domain DOMAIN --sending true --receiving false --idempotency-key KEY --json",
   "mail status": "ohmyhost mail status --project ULID --environment ULID --json",
@@ -1114,6 +1145,11 @@ export class ProductCli {
       if (command.kind === "secret-list") return await this.listEnvironmentSecrets(command, signal);
       if (command.kind === "function-runs") return await this.listFunctionRuns(command, signal);
       if (command.kind === "secret-set") return await this.putEnvironmentSecret(command, signal);
+      if (command.kind === "shared-mail") {
+        const api = await this.authenticatedApi(command.credentialStore, signal);
+        if (!api.sharedMail) throw new Error("Shared mail unavailable");
+        return success(command.label, { mail: await api.sharedMail(command.request) });
+      }
       if (command.kind === "managed-mail") {
         const api = await this.authenticatedApi(command.credentialStore, signal);
         if (!api.managedMail) throw new Error("Mail unavailable");
@@ -3120,7 +3156,7 @@ const parsedCommandName = (command: ProductCliCommand): CommandLabel => {
   if (command.kind === "function-runs") return "function runs";
   if (command.kind === "secret-set") return "secret set";
   if (command.kind === "secret-delete") return "secret delete";
-  if (command.kind === "managed-mail") return command.label;
+  if (command.kind === "shared-mail" || command.kind === "managed-mail") return command.label;
   if (command.kind === "profile-list") return "profile list";
   return command.kind;
 };

package/src/apps/product-cli/src/command.ts

@@ -3,7 +3,7 @@ import {
   isProjectDataChangeKind,
   type ProjectDataChangeKind,
 } from "@ohmyhost/contracts/project-data-changes";
-import type { ManagedMailCommand } from "@ohmyhost/sdk-ts";
+import type { ManagedMailCommand, SharedMailCommand } from "@ohmyhost/sdk-ts";
 import { USER_API_KEY_ID } from "@ohmyhost/contracts/user-api-keys";
 import { WORKOS_USER_API_KEY_PATTERN } from "@ohmyhost/workos-auth-contracts/user-api-keys";
 import { isProfileName, isProfileUserId } from "./profile-store.js";
@@ -536,6 +536,12 @@ export type ProductCliCommand =
       readonly wait: boolean;
       readonly credentialStore: "native";
     }
+  | {
+      readonly kind: "shared-mail";
+      readonly request: SharedMailCommand;
+      readonly label: SharedMailCommandLabel;
+      readonly credentialStore: "native";
+    }
   | {
       readonly kind: "managed-mail";
       readonly request: ManagedMailCommand;
@@ -902,7 +908,27 @@ export type RecognizedCommandLabel =
   | "mail messages retry"
   | "mail domain set"
   | "mail domain status"
-  | "mail domain delete";
+  | "mail domain delete"
+  | SharedMailCommandLabel;
+
+export type SharedMailCommandLabel =
+  | "mail workspace list"
+  | "mail workspace create"
+  | "mail workspace status"
+  | "mail workspace retire"
+  | "mail workspace dns-authorize"
+  | "mail workspace dns-status"
+  | "mail workspace dns-revoke"
+  | "mail binding get"
+  | "mail binding set"
+  | "mail binding detach"
+  | "mail identity get"
+  | "mail identity declare"
+  | "mail identity verify"
+  | "mail identity revoke"
+  | "mail identity authorize"
+  | "mail identity authorization-status"
+  | "mail identity authorization-revoke";
 
 export const recognizedCommandLabel = (argv: readonly string[]): RecognizedCommandLabel => {
   const values = [...argv];
@@ -1052,6 +1078,11 @@ export const recognizedCommandLabel = (argv: readonly string[]): RecognizedComma
     }
     if (value === "function" && values[0] === "runs") return "function runs";
     if (value === "mail") {
+      if (["workspace", "binding", "identity"].includes(values[0] ?? "")) {
+        const candidate = `mail ${values[0]} ${values[1]}`;
+        if (SHARED_MAIL_LABELS.includes(candidate as SharedMailCommandLabel))
+          return candidate as SharedMailCommandLabel;
+      }
       if (values[0] === "setup") return "mail setup";
       if (values[0] === "status") return "mail status";
       if (values[0] === "webhook") {
@@ -2328,6 +2359,10 @@ export const parseProductCliCommand = (argv: readonly string[]): ProductCliComma
     }
     throw new InvalidCommandError();
   }
+  if (first === "mail" && ["workspace", "binding", "identity"].includes(values[0] ?? "")) {
+    if (wait || follow || stdin) throw new InvalidCommandError();
+    return parseSharedMailCommand(values, yes);
+  }
   if (first === "mail") {
     const area = values.shift();
     const sub =
@@ -2538,3 +2573,194 @@ const validPaidHostname = (value: string): boolean =>
   !value.endsWith(".omh.st") &&
   value !== "ohmyho.st" &&
   !value.endsWith(".ohmyho.st");
+
+const SHARED_MAIL_LABELS: readonly SharedMailCommandLabel[] = [
+  "mail workspace list",
+  "mail workspace create",
+  "mail workspace status",
+  "mail workspace retire",
+  "mail workspace dns-authorize",
+  "mail workspace dns-status",
+  "mail workspace dns-revoke",
+  "mail binding get",
+  "mail binding set",
+  "mail binding detach",
+  "mail identity get",
+  "mail identity declare",
+  "mail identity verify",
+  "mail identity revoke",
+  "mail identity authorize",
+  "mail identity authorization-status",
+  "mail identity authorization-revoke",
+];
+
+/** New workspace sender operations stay separate from the exact legacy project mail contract. */
+function parseSharedMailCommand(values: string[], yes: boolean): ProductCliCommand {
+  const area = values.shift(),
+    operation = values.shift();
+  const label = `mail ${area} ${operation}` as SharedMailCommandLabel;
+  if (!SHARED_MAIL_LABELS.includes(label)) throw new InvalidCommandError();
+  const destructive =
+    operation === "retire" ||
+    operation === "detach" ||
+    operation === "revoke" ||
+    operation === "dns-revoke" ||
+    operation === "authorization-revoke";
+  if (yes !== destructive) throw new InvalidCommandError();
+  const allowed = area === "workspace" ? ["--organization"] : ["--project"];
+  const writing = [
+    "create",
+    "retire",
+    "dns-authorize",
+    "dns-revoke",
+    "set",
+    "detach",
+    "declare",
+    "verify",
+    "revoke",
+    "authorize",
+    "authorization-revoke",
+  ].includes(operation ?? "");
+  if (area === "workspace" && operation !== "list" && operation !== "create")
+    allowed.push("--mail-domain");
+  if (area === "binding") allowed.push("--environment");
+  if (operation === "create") allowed.push("--domain", "--sending");
+  if (area === "binding" && operation === "set")
+    allowed.push(
+      "--mail-domain",
+      "--sending",
+      "--sender-addresses",
+      "--default-from",
+      "--reply-to",
+    );
+  if (operation === "declare") allowed.push("--hostname");
+  if (operation === "authorize" || operation === "dns-authorize") allowed.push("--zone");
+  if (writing) allowed.push("--idempotency-key");
+  if (writing && operation !== "create" && operation !== "declare")
+    allowed.push("--expected-revision");
+  const options = parseOptionalOptions(values, allowed);
+  const required = (key: keyof typeof options) => {
+    const value = options[key];
+    if (!value) throw new InvalidCommandError();
+    return value;
+  };
+  const revision = () => {
+    const value = required("--expected-revision");
+    if (!/^(?:0|[1-9][0-9]*)$/u.test(value) || !Number.isSafeInteger(Number(value)))
+      throw new InvalidCommandError();
+    return Number(value);
+  };
+  const sending = () => {
+    const value = required("--sending");
+    if (value !== "true" && value !== "false") throw new InvalidCommandError();
+    return value === "true";
+  };
+  const idempotencyKey = () => required("--idempotency-key");
+  let request: SharedMailCommand;
+  if (area === "workspace") {
+    const scope = { organizationId: required("--organization") };
+    if (operation === "list") request = { ...scope, action: "domains_list" };
+    else if (operation === "create") {
+      const enabled = sending();
+      if (!enabled) throw new InvalidCommandError();
+      request = {
+        ...scope,
+        action: "domain_create",
+        domain: required("--domain"),
+        sending: enabled,
+        idempotencyKey: idempotencyKey(),
+      };
+    } else {
+      const target = { ...scope, mailDomainId: required("--mail-domain") };
+      if (operation === "status") request = { ...target, action: "domain_get" };
+      else if (operation === "dns-status") request = { ...target, action: "domain_dns_status" };
+      else if (operation === "dns-revoke")
+        request = {
+          ...target,
+          action: "domain_dns_revoke",
+          expectedRevision: revision(),
+          idempotencyKey: idempotencyKey(),
+        };
+      else if (operation === "retire")
+        request = {
+          ...target,
+          action: "domain_retire",
+          expectedRevision: revision(),
+          idempotencyKey: idempotencyKey(),
+        };
+      else
+        request = {
+          ...target,
+          action: "domain_dns_authorize",
+          expectedRevision: revision(),
+          zone: required("--zone"),
+          idempotencyKey: idempotencyKey(),
+        };
+    }
+  } else if (area === "binding") {
+    const scope = { projectId: required("--project"), environmentId: required("--environment") };
+    if (operation === "get") request = { ...scope, action: "binding_get" };
+    else if (operation === "detach")
+      request = {
+        ...scope,
+        action: "binding_detach",
+        expectedRevision: revision(),
+        idempotencyKey: idempotencyKey(),
+      };
+    else {
+      const senderAddresses = required("--sender-addresses").split(",");
+      if (
+        senderAddresses.length > 32 ||
+        senderAddresses.some((address) => !address || address.trim() !== address) ||
+        new Set(senderAddresses).size !== senderAddresses.length
+      )
+        throw new InvalidCommandError();
+      request = {
+        ...scope,
+        action: "binding_set",
+        mailDomainId: required("--mail-domain"),
+        sending: sending(),
+        senderAddresses,
+        defaultFrom: required("--default-from"),
+        defaultReplyTo: options["--reply-to"] ?? null,
+        expectedRevision: revision(),
+        idempotencyKey: idempotencyKey(),
+      };
+    }
+  } else {
+    const scope = { projectId: required("--project") };
+    if (operation === "get") request = { ...scope, action: "identity_get" };
+    else if (operation === "authorization-status")
+      request = { ...scope, action: "identity_authorization_status" };
+    else if (operation === "authorization-revoke")
+      request = {
+        ...scope,
+        action: "identity_authorization_revoke",
+        expectedRevision: revision(),
+        idempotencyKey: idempotencyKey(),
+      };
+    else if (operation === "declare")
+      request = {
+        ...scope,
+        action: "identity_declare",
+        hostname: required("--hostname"),
+        idempotencyKey: idempotencyKey(),
+      };
+    else if (operation === "authorize")
+      request = {
+        ...scope,
+        action: "identity_authorize",
+        zone: required("--zone"),
+        expectedRevision: revision(),
+        idempotencyKey: idempotencyKey(),
+      };
+    else
+      request = {
+        ...scope,
+        action: operation === "verify" ? "identity_verify" : "identity_revoke",
+        expectedRevision: revision(),
+        idempotencyKey: idempotencyKey(),
+      };
+  }
+  return { kind: "shared-mail", request, label, credentialStore: "native" };
+}

package/src/apps/product-cli/src/composition.ts

@@ -528,6 +528,8 @@ const readTokenIdentity = async (input: {
 /** The organization a command names explicitly; `organization use` names its target instead. */
 const commandOrganizationId = (command: ProductCliCommand): string | undefined => {
   if (command.kind === "organization-use" || command.kind === "login") return undefined;
+  if (command.kind === "shared-mail" && "organizationId" in command.request)
+    return command.request.organizationId;
   if (command.kind === "feedback-submit") return command.report.organization_id;
   return "organizationId" in command && typeof command.organizationId === "string"
     ? command.organizationId
@@ -535,6 +537,8 @@ const commandOrganizationId = (command: ProductCliCommand): string | undefined =
 };
 
 const commandProjectId = (command: ProductCliCommand): string | undefined => {
+  if (command.kind === "shared-mail")
+    return "projectId" in command.request ? command.request.projectId : undefined;
   if (command.kind === "managed-mail") return command.request.projectId;
   return "projectId" in command && typeof command.projectId === "string"
     ? command.projectId

package/src/apps/product-cli/src/product-api.ts

@@ -1,4 +1,9 @@
-import { executeManagedMail, type ManagedMailCommand } from "@ohmyhost/sdk-ts";
+import {
+  executeManagedMail,
+  executeSharedMail,
+  type ManagedMailCommand,
+  type SharedMailCommand,
+} from "@ohmyhost/sdk-ts";
 import type {
   ProjectDataChangeKind,
   ProjectDataChangePlan,
@@ -434,6 +439,7 @@ export interface ProductApi {
     readonly name: string;
     readonly idempotencyKey: string;
   }): Promise<DeleteEnvironmentSecretResult>;
+  sharedMail?(input: SharedMailCommand): Promise<unknown>;
   managedMail?(input: ManagedMailCommand): Promise<unknown>;
 }
 
@@ -1237,6 +1243,10 @@ export class GeneratedSdkProductApi implements ProductApi {
     );
   }
 
+  public sharedMail(input: SharedMailCommand) {
+    return executeSharedMail(this.#client, input);
+  }
+
   public managedMail(input: ManagedMailCommand) {
     return executeManagedMail(this.#client, input);
   }

package/src/apps/product-cli/src/repository-init.ts

@@ -75,6 +75,8 @@ export type RepositoryFramework = Exclude<FrameworkFamilyClassification, "ambigu
 const MAXIMUM_SOURCE_BYTES = 2 * 1024 * 1024;
 const SOURCE_MODULE_PATTERN = /\.(?:[cm]?[jt]s|[jt]sx)$/u;
 const STORAGE_CLIENT_CALL_PATTERN = /\bcreatePrivateStorageClient\s*\(/u;
+const GATEWAY_BINDING_NAME = /^OHMYHOST_(?:MAIL|STORAGE)_GATEWAY$/u;
+const GATEWAY_WORD_TOKEN = /[\p{ID_Start}_$][\p{ID_Continue}$]*/uy;
 // The catalog names a module only by a path of its grammar; a file name with a space, for example,
 // is not one, so its blocker carries the path beside a sentence that does not quote it.
 const UNNAMED_MODULE_MESSAGES: Readonly<Record<DatabaseContractCode, string>> = Object.freeze({
@@ -89,15 +91,19 @@ function callsStorageClient(source: string): boolean {
   return STORAGE_CLIENT_CALL_PATTERN.test(sourceWithoutComments(source));
 }
 
-// Storage is reached through a private Service Binding plus the three values and the key that
-// `createPrivateStorageClient` reads. No raw bucket binding is handed to customer code.
+// Global fetch reaches the private storage gateway using these values and its environment key.
+// No raw bucket binding is handed to customer code.
 const STORAGE_RUNTIME_BINDINGS = Object.freeze([
   "OHMYHOST_ENVIRONMENT_ID",
   "OHMYHOST_PROJECT_ID",
-  "OHMYHOST_STORAGE_GATEWAY",
   "OHMYHOST_STORAGE_GATEWAY_URL",
   "OHMYHOST_STORAGE_KEY",
 ]);
+const MAIL_RUNTIME_BINDINGS = Object.freeze([
+  "OHMYHOST_MAIL_GATEWAY_URL",
+  "OHMYHOST_MAIL_KEY",
+  "OHMYHOST_PROJECT_ID",
+]);
 // The runtime release is published unchanged as `@amerged/ohmyhost-runtime`; this pinned alias keeps
 // its import name and, unlike the website archive each release removes, stays installable.
 const CUSTOMER_RUNTIME_SOURCE = `npm:@amerged/ohmyhost-runtime@${cliPackage.version}`;
@@ -105,6 +111,7 @@ const CUSTOMER_RUNTIME_SOURCE = `npm:@amerged/ohmyhost-runtime@${cliPackage.vers
 /** A catalog code, which planning answers with the same sentence, or a check only init runs. */
 export type RepositoryInitBlockerCode =
   | FrameworkConversionDiagnosticCode
+  | "gateway_binding_unsupported"
   | "migration_filename_noncanonical"
   | "migration_sql_not_admitted"
   | "storage_client_missing";
@@ -507,7 +514,7 @@ interface SourceCheckContext {
 /**
  * Every blocker of a source with a valid or proposed configuration, in the order planning judges:
  * migration filenames, the shared source rules, the Worker module handlers and the database
- * contract; init's own storage client and migration SQL checks come last.
+ * contract; init's own gateway binding, storage client and migration SQL checks come last.
  */
 async function judgeSource(
   context: SourceCheckContext &
@@ -528,6 +535,7 @@ async function judgeSource(
       ...source.findings.map((finding) => requiredCatalogBlocker(finding, context.applicationRoot)),
       ...(await workerModuleBlockers(context)),
       ...(await databaseContractBlockers(context, context.provider)),
+      ...(await gatewayBindingBlockers(context)),
       ...(await storageClientBlockers(context)),
       ...(await migrationSqlBlockers(context, context.provider)),
     ],
@@ -621,6 +629,168 @@ async function workerModuleBlockers(context: SourceCheckContext): Promise<Reposi
   );
 }
 
+/** Keep literal text inert, but scan executable template interpolations as ordinary code. */
+function gatewaySourceTokens(source: string): readonly string[] {
+  const tokens: string[] = [];
+  let cursor = 0;
+  const quoted = (quote: string) => {
+    const start = cursor++;
+    while (cursor < source.length) {
+      const character = source[cursor++];
+      if (character === "\\") cursor++;
+      else if (character === quote) break;
+    }
+    tokens.push(source.slice(start, cursor));
+  };
+  const code = (interpolation: boolean): void => {
+    let braces = 0;
+    while (cursor < source.length) {
+      const character = source[cursor] as string;
+      if (interpolation && character === "}" && braces === 0) {
+        cursor++;
+        return;
+      }
+      if (character === '"' || character === "'") {
+        quoted(character);
+        continue;
+      }
+      if (character === "`") {
+        cursor++;
+        while (cursor < source.length) {
+          const literal = source[cursor++];
+          if (literal === "\\") cursor++;
+          else if (literal === "`") break;
+          else if (literal === "$" && source[cursor] === "{") {
+            cursor++;
+            tokens.push("(");
+            code(true);
+            tokens.push(")");
+          }
+        }
+        continue;
+      }
+      if (/\s/u.test(character)) {
+        cursor++;
+        continue;
+      }
+      if (character === "{") braces++;
+      if (character === "}") braces--;
+      GATEWAY_WORD_TOKEN.lastIndex = cursor;
+      const word = GATEWAY_WORD_TOKEN.exec(source)?.[0];
+      const token =
+        word ??
+        (["?.", "=>"].includes(source.slice(cursor, cursor + 2))
+          ? source.slice(cursor, cursor + 2)
+          : character);
+      tokens.push(token);
+      cursor += token.length;
+    }
+  };
+  code(false);
+  return tokens;
+}
+
+/** Static value accesses only: declarations, literal messages and object-literal keys are inert. */
+function usesGatewayBinding(source: string): boolean {
+  const tokens = gatewaySourceTokens(sourceWithoutComments(source));
+  const objects: boolean[] = [];
+  let declaration: "type" | "interface" | "annotation" | undefined;
+  let declarationDepth = 0;
+  for (let index = 0; index < tokens.length; index++) {
+    const token = tokens[index] as string;
+    const previous = tokens[index - 1];
+    const next = tokens[index + 1];
+    if (declaration !== undefined) {
+      if (
+        declarationDepth === 0 &&
+        (token === ";" || /^(?:export|const|let|var|function|class|type|interface)$/u.test(token))
+      ) {
+        declaration = undefined;
+        if (token === ";") continue;
+      } else {
+        if (token === "{" || token === "(" || token === "[") declarationDepth++;
+        if (token === "}" || token === ")" || token === "]") {
+          declarationDepth--;
+          if (declaration !== "type" && declarationDepth === 0) declaration = undefined;
+        }
+        continue;
+      }
+    }
+    if (
+      (token === "type" || token === "interface") &&
+      next !== undefined &&
+      /^[\p{ID_Start}_$][\p{ID_Continue}$]*$/u.test(next) &&
+      previous !== "." &&
+      previous !== "?."
+    ) {
+      declaration = token;
+      continue;
+    }
+    // An inline variable type is not an object binding pattern; resume at its initializer.
+    if (token === "{" && previous === ":" && /^(?:const|let|var)$/u.test(tokens[index - 3] ?? "")) {
+      declaration = "annotation";
+      declarationDepth = 1;
+      continue;
+    }
+    if (token === "{") objects.push(false);
+    if (token === "}") {
+      const gateway = objects.pop();
+      let after = index + 1;
+      if (tokens[after] === ":") {
+        after++;
+        while (after < tokens.length && !/^(?:=|;|\{|\})$/u.test(tokens[after] as string)) after++;
+      }
+      if (gateway && tokens[after] === "=") return true;
+    }
+    const quoted = token.startsWith('"') || token.startsWith("'");
+    const name = quoted ? token.slice(1, -1) : token;
+    if (!GATEWAY_BINDING_NAME.test(name)) continue;
+    if (!quoted && (previous === "." || previous === "?.")) return true;
+    const receiver = tokens[index - (tokens[index - 2] === "?." ? 3 : 2)] ?? "";
+    if (
+      quoted &&
+      previous === "[" &&
+      next === "]" &&
+      (/^[\p{ID_Start}_$][\p{ID_Continue}$]*$/u.test(receiver) ||
+        receiver === ")" ||
+        receiver === "]") &&
+      !/^(?:return|throw|yield|case|new|typeof|void|delete|await|in|of)$/u.test(receiver)
+    )
+      return true;
+    if (
+      objects.length > 0 &&
+      (previous === "{" || previous === ",") &&
+      (next === ":" || next === "," || next === "}" || next === "=")
+    )
+      objects[objects.length - 1] = true;
+  }
+  return false;
+}
+
+/**
+ * Init names legacy mail/storage bindings before a customer builds code whose gateway calls the
+ * egress policy cannot serve. This local guidance does not change planning's admission policy.
+ */
+async function gatewayBindingBlockers(
+  context: SourceCheckContext,
+): Promise<RepositoryInitBlocker[]> {
+  const blockers: RepositoryInitBlocker[] = [];
+  for (const path of context.files) {
+    if (!SOURCE_MODULE_PATTERN.test(path) || /\.d\.[cm]?ts$/u.test(path)) continue;
+    const absolute = resolve(context.applicationDirectory, path);
+    const information = await stat(absolute);
+    if (!information.isFile() || information.size > MAXIMUM_SOURCE_BYTES) continue;
+    if (!usesGatewayBinding(await readFile(absolute, "utf8"))) continue;
+    blockers.push({
+      code: "gateway_binding_unsupported",
+      path: repositoryPath(context.applicationRoot, path),
+      message:
+        "Mail and storage gateway Service Bindings are unsupported. In server code, create the client from its OHMYHOST_MAIL_GATEWAY_URL or OHMYHOST_STORAGE_GATEWAY_URL, environment key and project ID, plus the environment ID for storage. Use the global fetch with fetch: (request) => fetch(request), and capabilityFetch: (request) => fetch(request) for storage signed URLs.",
+    });
+  }
+  return blockers;
+}
+
 /**
  * Declared storage is reached only through the private gateway client. A storage-enabled app whose
  * source never constructs that client deploys green and fails at its first upload, so name it here.
@@ -641,7 +811,7 @@ async function storageClientBlockers(
       code: "storage_client_missing",
       path: null,
       message:
-        'ohmyhost.yaml declares storage, but no application source calls createPrivateStorageClient. Import it from "@ohmyhost/customer-runtime/storage" and build it in server code from OHMYHOST_STORAGE_GATEWAY, OHMYHOST_STORAGE_GATEWAY_URL, OHMYHOST_PROJECT_ID, OHMYHOST_ENVIRONMENT_ID and OHMYHOST_STORAGE_KEY, then reserve an upload, PUT the bytes to the returned signed URL, complete it, and serve reads with createSignedRead. There is no FILES bucket binding.',
+        'ohmyhost.yaml declares storage, but no application source calls createPrivateStorageClient. Import it from "@ohmyhost/customer-runtime/storage" and build it in server code from OHMYHOST_STORAGE_GATEWAY_URL, OHMYHOST_PROJECT_ID, OHMYHOST_ENVIRONMENT_ID and OHMYHOST_STORAGE_KEY, with the global fetch as fetch: (request) => fetch(request) and capabilityFetch: (request) => fetch(request). Reserve an upload, PUT the bytes to the returned signed URL, complete it, and serve reads with createSignedRead. There is no FILES bucket binding.',
     },
   ];
 }
@@ -1418,10 +1588,12 @@ function runtimeContract(capabilities: RuntimeCapabilities): Readonly<{
   return Object.freeze({
     bindings: Object.freeze(
       [
-        ...(capabilities.auth ? ["BETTER_AUTH_SECRET"] : []),
-        ...(capabilities.storage ? STORAGE_RUNTIME_BINDINGS : []),
-        ...(capabilities.database ? ["OHMYHOST_DATABASE"] : []),
-        ...(capabilities.mail ? ["OHMYHOST_MAIL_KEY"] : []),
+        ...new Set([
+          ...(capabilities.auth ? ["BETTER_AUTH_SECRET"] : []),
+          ...(capabilities.storage ? STORAGE_RUNTIME_BINDINGS : []),
+          ...(capabilities.database ? ["OHMYHOST_DATABASE"] : []),
+          ...(capabilities.mail ? MAIL_RUNTIME_BINDINGS : []),
+        ]),
       ].sort(),
     ),
     packages: Object.freeze({