@amerged/ohmyhost-cli 0.1.36 → 0.1.38

package/src/packages/contracts/package.json

@@ -5,6 +5,11 @@
   "type": "module",
   "sideEffects": false,
   "exports": {
+    "./shared-mail": {
+      "source": "./src/shared-mail.ts",
+      "types": "./dist/shared-mail.d.ts",
+      "import": "./dist/shared-mail.js"
+    },
     "./mcp-source-codec": {
       "source": "./src/mcp-source-codec.ts",
       "types": "./dist/mcp-source-codec.d.ts",
@@ -145,7 +150,7 @@
   },
   "scripts": {
     "build": "tsc --project tsconfig.build.json",
-    "typecheck": "tsc --project tsconfig.json --noEmit",
+    "typecheck": "tsc --project tsconfig.json --noEmit --incremental --tsBuildInfoFile typecheck.tsbuildinfo",
     "test": "vitest run --root ../.. packages/contracts/test",
     "validate": "pnpm run typecheck && pnpm run test"
   },

package/src/packages/contracts/src/framework-admission-corpus.ts

@@ -48,7 +48,7 @@ const CORPUS_NEXT_PAGE = `export default function Home() {
   return <main>Hello from ohmyho.st</main>;
 }
 `;
-// The config `create-next-app@16.4.0 --yes --no-tailwind` writes: Cache Components with partial
+// The config `create-next-app@16.4.1 --yes --no-tailwind` writes: Cache Components with partial
 // prefetching.
 const CREATE_NEXT_APP_CONFIG = `import type { NextConfig } from "next";
 
@@ -124,10 +124,7 @@ export const FRAMEWORK_ADMISSION_CONFORMANCE_CORPUS: Readonly<{
     Readonly<{ diagnostic: FrameworkConversionDiagnostic }>)[];
 }> = Object.freeze({
   admitted: Object.freeze([
-    corpusCase(
-      "Next.js 16.3.8 with npm on the edge runtime (the exact customer source)",
-      nextSource(),
-    ),
+    corpusCase("Next.js 16.4.1 with npm on the edge runtime", nextSource()),
     corpusCase("Next.js 17.0.0, a later stable major", nextSource({ declared: "17.0.0" })),
     corpusCase(
       "Vite ^8.2.0 resolved to 8.3.4 by pnpm-lock.yaml",
@@ -147,26 +144,26 @@ export const FRAMEWORK_ADMISSION_CONFORMANCE_CORPUS: Readonly<{
     Object.freeze({
       ...corpusCase(
         "Next.js ^16.3.0 with bun.lock, which ohmyho.st does not resolve",
-        nextSource({ declared: "^16.3.0", resolved: "16.4.0", manager: "bun" }),
+        nextSource({ declared: "^16.3.0", resolved: "16.4.1", manager: "bun" }),
       ),
       packages: Object.freeze(["next"] as const),
     }),
   ]),
   refused: Object.freeze([
     refusedCase(
-      "Next.js 16.3.7 below the 16.x security minimum",
-      nextSource({ declared: "16.3.7" }),
-      versionFinding("package-lock.json", "next", "16.3.7", "16.3.8"),
+      "Next.js 16.4.0 below the 16.x security minimum",
+      nextSource({ declared: "16.4.0" }),
+      versionFinding("package-lock.json", "next", "16.4.0", "16.4.1"),
     ),
     refusedCase(
-      "Next.js 15.5.26 declared with yarn below the 15.x security minimum",
-      nextSource({ declared: "15.5.26", manager: "yarn" }),
-      versionFinding("package.json", "next", "15.5.26", "15.5.27"),
+      "Next.js 15.5.28 declared with yarn, because no 15.x release is admitted",
+      nextSource({ declared: "15.5.28", manager: "yarn" }),
+      versionFinding("package.json", "next", "15.5.28", "16.4.1"),
     ),
     refusedCase(
-      "Next.js ^16.3.0 resolved to 16.3.7 by package-lock.json",
-      nextSource({ declared: "^16.3.0", resolved: "16.3.7" }),
-      versionFinding("package-lock.json", "next", "16.3.7", "16.3.8"),
+      "Next.js ^16.3.0 resolved to 16.4.0 by package-lock.json",
+      nextSource({ declared: "^16.3.0", resolved: "16.4.0" }),
+      versionFinding("package-lock.json", "next", "16.4.0", "16.4.1"),
     ),
     refusedCase(
       "TanStack Start 1.168.59 resolved by pnpm-lock.yaml below its security minimum",
@@ -354,7 +351,7 @@ function nextSource(
 ): Readonly<Record<string, string>> {
   const manager = options.manager ?? "npm";
   const [packageManager, lockfile] = CORPUS_MANAGERS[manager];
-  const next = options.declared ?? "16.3.8";
+  const next = options.declared ?? "16.4.1";
   const react = { react: "19.1.2", "react-dom": "19.1.2" };
   const runtime = options.field === "devDependencies" ? react : { next, ...react };
   return Object.freeze({
@@ -380,7 +377,7 @@ function nextSource(
 }
 
 /**
- * The next.config.ts and Tailwind CSS files and packages `create-next-app@16.4.0 --yes` writes, in
+ * The next.config.ts and Tailwind CSS files and packages `create-next-app@16.4.1 --yes` writes, in
  * an App Router source with the packageManager, lockfile and ohmyhost.yaml ohmyho.st requires;
  * `tailwind: false` is its --no-tailwind output. On Turbopack, its default bundler, it adds only the
  * Turbopack rule for Tailwind CSS; `postcss` adds the postcss.config.mjs and @tailwindcss/postcss it
@@ -390,7 +387,7 @@ function createNextAppSource(
   options: Readonly<{ tailwind: boolean; postcss?: boolean }>,
 ): Readonly<Record<string, string>> {
   const [packageManager, lockfile] = CORPUS_MANAGERS.npm;
-  const runtime = { next: "16.4.0", react: "19.3.0", "react-dom": "19.3.0" };
+  const runtime = { next: "16.4.1", react: "19.3.0", "react-dom": "19.3.0" };
   const postcss = options.postcss === true;
   return Object.freeze({
     "ohmyhost.yaml": corpusConfiguration("npm", ".open-next/assets", "edge"),

package/src/packages/contracts/src/framework-build-script.mjs

@@ -15,8 +15,15 @@ export const PINNED_BUN_VERSION = "1.2.22";
  * upper bound: later patches, minors and majors reach the real build, which reports adapter failures.
  * Denied ranges are half-open [introduced, fixed); a null fix denies every later release.
  *
- * next: GHSA-4jqv-mc3x-m676 and GHSA-mcj8-r9mp-w47p (fixed in 15.5.27 and 16.3.8); GHSA-cjq9-62q9-8jv4,
- *   GHSA-f87g-xv8r-7p7x, GHSA-3w37-wq28-93x7, GHSA-h694-7cp9-m8p3 and GHSA-39w2-rjm5-chcv (16.3.8).
+ * next: GHSA-2464-fhr4-w9xw (critical, remote code execution through the Image Optimization API with
+ *   SVG and sharp before 0.35.5) and GHSA-p3m5-59mp-jv5r (high, denial of service through Server
+ *   Actions), both fixed in 15.5.28 and 16.4.1; GHSA-673q-mjm6-r5xr (critical, remote code execution
+ *   through `use cache` functions that return typed arrays, Next.js 16 only, fixed in 16.4.1).
+ *   There is no 15.x floor: the pinned OpenNext has refused Next.js 15 since 21 October 2026, so every 15.x
+ *   release is refused with the minimum 16.4.1 instead of sending a customer to 15.5.28 and a failing build.
+ *   Earlier floors: GHSA-4jqv-mc3x-m676 and GHSA-mcj8-r9mp-w47p (fixed in 15.5.27 and 16.3.8);
+ *   GHSA-cjq9-62q9-8jv4, GHSA-f87g-xv8r-7p7x, GHSA-3w37-wq28-93x7, GHSA-h694-7cp9-m8p3 and
+ *   GHSA-39w2-rjm5-chcv (16.3.8).
  * @tanstack/react-start: GHSA-qx66-fv34-fjm8 (fixed in 1.168.60).
  * vite: GHSA-64vr-g452-qvp3 (fixed in 5.4.6), the only advisory affecting `vite build` output.
  * @type {FrameworkVersionPolicy}
@@ -27,7 +34,7 @@ export const FRAMEWORK_VERSION_POLICY = Object.freeze({
     floors: Object.freeze(["14.4.0"]),
     denied: Object.freeze([]),
   }),
-  next: Object.freeze({ floors: Object.freeze(["15.5.27", "16.3.8"]), denied: Object.freeze([]) }),
+  next: Object.freeze({ floors: Object.freeze(["16.4.1"]), denied: Object.freeze([]) }),
   vite: Object.freeze({ floors: Object.freeze(["5.4.6"]), denied: Object.freeze([]) }),
   "@tanstack/react-start": Object.freeze({
     floors: Object.freeze(["1.168.60"]),

package/src/packages/contracts/src/index.ts

@@ -209,6 +209,9 @@ function normalizeEgressOrigins(value: readonly string[] | undefined): readonly
 function forbiddenEgressHostname(hostname: string): boolean {
   const normalized = hostname.toLowerCase();
   return (
+    /^ohmyho-(?:mail|storage)-gateway-[a-z0-9][a-z0-9-]*\.[a-z0-9][a-z0-9-]*\.workers\.dev\.?$/u.test(
+      normalized,
+    ) ||
     normalized === "localhost" ||
     normalized.endsWith(".localhost") ||
     normalized.endsWith(".local") ||

package/src/packages/contracts/src/problem-policy.ts

@@ -313,14 +313,14 @@ export const PROBLEM_POLICY = {
     status: 409,
     retryable: false,
     action:
-      "Use the sender domain already configured for this project, or retire it with 'ohmyhost mail domain delete' (repeat while the removal is pending) and then set up the new domain; a domain registered to another project cannot be set up.",
+      "Read the workspace sender resource and project binding. Reuse requires explicit domain-use authority, target-project editing and a current verified application identity with the same registrable main domain. Read the current revision before changing settings. Detach a shared project binding explicitly; legacy domain deletion cannot retire a resource used by another project.",
     title: "Mail domain conflict",
   },
   mail_domain_required: {
     status: 409,
     retryable: false,
     action:
-      "This app declares mail.enabled. Configure the project's own sender domain with 'ohmyhost mail setup' using its Prod environment ID, or set mail.enabled to false if the app sends no mail, then plan again.",
+      "This app declares mail.enabled. Configure a sender with 'ohmyhost mail setup' or explicitly attach an authorized workspace sender using the project's Prod environment ID. Reuse first requires proof of the intended application hostname with the same registrable main domain; declare and verify that identity before mail-gated deployment. Then plan again.",
     title: "Mail domain required",
   },
   storage_jurisdiction_conflict: {

package/src/packages/contracts/src/shared-mail.ts

@@ -0,0 +1,236 @@
+export interface SharedMailResponseContext {
+  readonly action: string;
+  readonly organizationId?: string;
+  readonly projectId?: string;
+  readonly environmentId?: string;
+  readonly mailDomainId?: string;
+}
+const ULID = /^[0-7][0-9A-HJKMNP-TV-Z]{25}$/u;
+const HOST = /^(?=.{1,253}$)(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\.)+[a-z]{2,63}$/u;
+
+/** Strict validation keeps provider data and out-of-scope resources out of client guidance. */
+export function assertSharedMailResponse(value: unknown, input: SharedMailResponseContext): void {
+  const v = object(value);
+  if (input.action === "domains_list") {
+    exact(v, ["items"]);
+    if (!Array.isArray(v["items"]) || v["items"].length > 100) invalid();
+    for (const item of v["items"])
+      assertSharedMailResponse(item, {
+        ...input,
+        action: "domain_get",
+        mailDomainId: String(object(item)["domain_id"]),
+      });
+    return;
+  }
+  if (["domain_get", "domain_create", "domain_retire"].includes(input.action)) {
+    exact(v, [
+      "domain_id",
+      "organization_id",
+      "domain",
+      "registrable_domain",
+      "revision",
+      "status",
+      "sending",
+      "receiving",
+      "configured_at",
+      "observed_at",
+      "dns_records",
+      "bindings_count",
+    ]);
+    id(v["domain_id"]);
+    id(v["organization_id"]);
+    if (
+      !("organizationId" in input) ||
+      v["organization_id"] !== input.organizationId ||
+      ("mailDomainId" in input && v["domain_id"] !== input.mailDomainId)
+    )
+      invalid();
+    host(v["domain"]);
+    host(v["registrable_domain"]);
+    positive(v["revision"]);
+    member(v["status"], ["active", "retiring", "retired"]);
+    for (const k of ["sending", "receiving"])
+      member(v[k], ["disabled", "pending", "ready", "failed"]);
+    time(v["configured_at"]);
+    if (v["observed_at"] !== null) time(v["observed_at"]);
+    if (!Number.isSafeInteger(v["bindings_count"]) || Number(v["bindings_count"]) < 0) invalid();
+    if (!Array.isArray(v["dns_records"])) invalid();
+    for (const entry of v["dns_records"]) {
+      const r = object(entry);
+      exact(r, ["type", "name", "value", "purpose", "status"], ["priority"]);
+      member(r["type"], ["TXT", "MX", "CNAME"]);
+      for (const k of ["name", "value", "purpose", "status"])
+        if (typeof r[k] !== "string" || /[\r\n\0]/u.test(r[k])) invalid();
+      if (
+        r["priority"] !== undefined &&
+        (!Number.isSafeInteger(r["priority"]) ||
+          Number(r["priority"]) < 0 ||
+          Number(r["priority"]) > 65535)
+      )
+        invalid();
+      if (r["type"] === "MX" && r["priority"] === undefined) invalid();
+    }
+    return;
+  }
+  if (["binding_get", "binding_set", "binding_detach"].includes(input.action)) {
+    exact(v, [
+      "mail_domain_id",
+      "organization_id",
+      "project_id",
+      "environment_id",
+      "revision",
+      "sending",
+      "sender_addresses",
+      "default_from",
+      "default_reply_to",
+      "legacy",
+      "status",
+      "application_domain_identity",
+    ]);
+    for (const k of ["mail_domain_id", "organization_id", "project_id", "environment_id"]) id(v[k]);
+    if (
+      !("projectId" in input) ||
+      !("environmentId" in input) ||
+      v["project_id"] !== input.projectId ||
+      v["environment_id"] !== input.environmentId ||
+      ("mailDomainId" in input && v["mail_domain_id"] !== input.mailDomainId)
+    )
+      invalid();
+    positive(v["revision"]);
+    for (const k of ["sending", "legacy"]) if (typeof v[k] !== "boolean") invalid();
+    member(v["status"], ["active", "detached", "suspended"]);
+    if (
+      !Array.isArray(v["sender_addresses"]) ||
+      v["sender_addresses"].length > 32 ||
+      new Set(v["sender_addresses"]).size !== v["sender_addresses"].length
+    )
+      invalid();
+    for (const a of v["sender_addresses"]) mailbox(a);
+    for (const k of ["default_from", "default_reply_to"]) if (v[k] !== null) mailbox(v[k]);
+    if (
+      !v["legacy"] &&
+      (!v["sender_addresses"].includes(v["default_from"]) || v["sender_addresses"].length === 0)
+    )
+      invalid();
+    if (v["application_domain_identity"] !== null) {
+      const identity = object(v["application_domain_identity"]);
+      exact(identity, ["hostname", "registrable_domain", "revision", "status"]);
+      host(identity["hostname"]);
+      host(identity["registrable_domain"]);
+      positive(identity["revision"]);
+      member(identity["status"], ["pending", "verified", "expired", "revoked"]);
+    }
+    return;
+  }
+  if (
+    ["identity_get", "identity_declare", "identity_verify", "identity_revoke"].includes(
+      input.action,
+    )
+  ) {
+    exact(v, [
+      "organization_id",
+      "project_id",
+      "hostname",
+      "registrable_domain",
+      "status",
+      "revision",
+      "challenge",
+      "verified_at",
+      "expires_at",
+    ]);
+    id(v["organization_id"]);
+    id(v["project_id"]);
+    if (!("projectId" in input) || v["project_id"] !== input.projectId) invalid();
+    host(v["hostname"]);
+    host(v["registrable_domain"]);
+    positive(v["revision"]);
+    member(v["status"], ["pending", "verified", "expired", "revoked"]);
+    const challenge = object(v["challenge"]);
+    exact(challenge, ["type", "name", "value"]);
+    if (
+      challenge["type"] !== "TXT" ||
+      typeof challenge["name"] !== "string" ||
+      challenge["name"] !== `_omh-project.${v["hostname"]}` ||
+      typeof challenge["value"] !== "string" ||
+      challenge["value"].length < 16 ||
+      challenge["value"].length > 255 ||
+      /[\r\n\0]/u.test(challenge["value"])
+    )
+      invalid();
+    if (v["verified_at"] !== null) time(v["verified_at"]);
+    time(v["expires_at"]);
+    return;
+  }
+  if (input.action === "domain_dns_authorize" || input.action === "identity_authorize") {
+    exact(v, ["authorization_id", "authorization_url", "expires_at"]);
+    id(v["authorization_id"]);
+    time(v["expires_at"]);
+    if (
+      typeof v["authorization_url"] !== "string" ||
+      !/^https:\/\/dash\.cloudflare\.com\/oauth2\/auth\?/u.test(v["authorization_url"])
+    )
+      invalid();
+    return;
+  }
+  exact(v, ["status", "zone", "scopes", "expires_at"]);
+  member(v["status"], ["not_authorized", "pending", "authorized", "expired", "revoked"]);
+  if (
+    !Array.isArray(v["scopes"]) ||
+    v["scopes"].length > 2 ||
+    new Set(v["scopes"]).size !== v["scopes"].length ||
+    v["scopes"].some((s) => s !== "dns.write" && s !== "zone.read")
+  )
+    invalid();
+  if (v["zone"] !== null) host(v["zone"]);
+  if (v["expires_at"] !== null) time(v["expires_at"]);
+  if (
+    v["status"] === "not_authorized" &&
+    (v["zone"] !== null || v["expires_at"] !== null || v["scopes"].length)
+  )
+    invalid();
+}
+function object(v: unknown): Record<string, unknown> {
+  if (v === null || typeof v !== "object" || Array.isArray(v)) invalid();
+  return v as Record<string, unknown>;
+}
+function exact(
+  v: Record<string, unknown>,
+  required: readonly string[],
+  optional: readonly string[] = [],
+) {
+  if (
+    required.some((k) => !(k in v)) ||
+    Object.keys(v).some((k) => !required.includes(k) && !optional.includes(k))
+  )
+    invalid();
+}
+function member(v: unknown, values: readonly string[]) {
+  if (typeof v !== "string" || !values.includes(v)) invalid();
+}
+function id(v: unknown) {
+  if (typeof v !== "string" || !ULID.test(v)) invalid();
+}
+function host(v: unknown) {
+  if (typeof v !== "string" || !HOST.test(v)) invalid();
+}
+function positive(v: unknown) {
+  if (!Number.isSafeInteger(v) || Number(v) < 1) invalid();
+}
+function time(v: unknown) {
+  if (typeof v !== "string" || !Number.isFinite(Date.parse(v)) || new Date(v).toISOString() !== v)
+    invalid();
+}
+function mailbox(v: unknown) {
+  if (
+    typeof v !== "string" ||
+    v.length > 254 ||
+    !/^[A-Za-z0-9.!#$%&'*+\-/=?^_`{|}~]+@[a-z0-9.-]+\.[a-z]{2,63}$/u.test(v) ||
+    v.startsWith(".") ||
+    v.includes("..") ||
+    v.includes(".@")
+  )
+    invalid();
+}
+function invalid(): never {
+  throw new TypeError("Shared mail response contract invalid");
+}

package/src/packages/sdk-ts/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ohmyhost/sdk-ts",
-  "version": "0.1.36",
+  "version": "0.1.38",
   "private": true,
   "type": "module",
   "exports": {
@@ -14,7 +14,7 @@
     "build": "tsc --project tsconfig.build.json",
     "check": "pnpm --dir ../.. sdk-ts:check",
     "generate": "pnpm --dir ../.. sdk-ts:generate",
-    "typecheck": "tsc --project tsconfig.json --noEmit",
+    "typecheck": "tsc --project tsconfig.json --noEmit --incremental --tsBuildInfoFile typecheck.tsbuildinfo",
     "test": "pnpm run check && vitest run --root ../.. packages/sdk-ts"
   },
   "license": "Apache-2.0"