@amerged/ohmyhost-cli 0.1.37 → 0.1.38

package/README.md

@@ -1,6 +1,6 @@
 # @amerged/ohmyhost-cli
 
-ohmyho.st cli client, version 0.1.37.
+ohmyho.st cli client, version 0.1.38.
 
 ```sh
 npm install --global @amerged/ohmyhost-cli

package/THIRD_PARTY_NOTICES.md

@@ -802,7 +802,7 @@ OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
 SOFTWARE.
 
 
-## fast-uri 3.1.8
+## fast-uri 3.1.9
 
 ### LICENSE
 

package/dist/bin.js

@@ -2,7 +2,7 @@
 import { createRequire as __ohmyhostCreateRequire } from "node:module"; const require = __ohmyhostCreateRequire(import.meta.url);
 import {
   runProductionCli
-} from "./chunk-IHXNADOQ.js";
+} from "./chunk-EWKJGJQU.js";
 import "./chunk-7D2RFLWM.js";
 
 // apps/product-cli/dist/bin.js

package/dist/{chunk-IHXNADOQ.js → chunk-EWKJGJQU.js}

@@ -22796,9 +22796,9 @@ var require_data = __commonJS({
   }
 });
 
-// node_modules/.pnpm/fast-uri@3.1.8/node_modules/fast-uri/lib/utils.js
+// node_modules/.pnpm/fast-uri@3.1.9/node_modules/fast-uri/lib/utils.js
 var require_utils = __commonJS({
-  "node_modules/.pnpm/fast-uri@3.1.8/node_modules/fast-uri/lib/utils.js"(exports, module) {
+  "node_modules/.pnpm/fast-uri@3.1.9/node_modules/fast-uri/lib/utils.js"(exports, module) {
     "use strict";
     var isUUID = RegExp.prototype.test.bind(/^[\da-f]{8}-[\da-f]{4}-[\da-f]{4}-[\da-f]{4}-[\da-f]{12}$/iu);
     var isIPv4 = RegExp.prototype.test.bind(/^(?:(?:25[0-5]|2[0-4]\d|1\d{2}|[1-9]\d|\d)\.){3}(?:25[0-5]|2[0-4]\d|1\d{2}|[1-9]\d|\d)$/u);
@@ -23030,6 +23030,37 @@ var require_utils = __commonJS({
       }
       return output.join("");
     }
+    function removeDotSegmentsRelative(path2) {
+      if (path2 === "" || path2[0] === "/") {
+        return removeDotSegments(path2);
+      }
+      const segments = path2.split("/");
+      const last = segments.length - 1;
+      const output = [];
+      let trailingDirectory = false;
+      for (let i = 0; i <= last; i++) {
+        const segment = segments[i];
+        if (segment === "." || segment === "..") {
+          if (segment === "..") {
+            if (output.length !== 0 && output[output.length - 1] !== "..") {
+              output.pop();
+            } else {
+              output.push("..");
+            }
+          }
+          trailingDirectory = i === last;
+        } else {
+          output.push(segment);
+        }
+      }
+      if (trailingDirectory && output[output.length - 1] !== "..") {
+        output.push("");
+      }
+      if (output.length === 0 || output[0] === "" || output[0].includes(":")) {
+        output.unshift(".");
+      }
+      return output.join("/");
+    }
     var HOST_DELIMS = { "@": "%40", "/": "%2F", "?": "%3F", "#": "%23", ":": "%3A" };
     var HOST_DELIM_RE = /[@/?#:]/g;
     var HOST_DELIM_NO_COLON_RE = /[@/?#]/g;
@@ -23290,6 +23321,7 @@ var require_utils = __commonJS({
       encodeFragment,
       escapePreservingEscapes,
       removeDotSegments,
+      removeDotSegmentsRelative,
       isIPv4,
       isUUID,
       normalizeIPv6,
@@ -23298,9 +23330,9 @@ var require_utils = __commonJS({
   }
 });
 
-// node_modules/.pnpm/fast-uri@3.1.8/node_modules/fast-uri/lib/schemes.js
+// node_modules/.pnpm/fast-uri@3.1.9/node_modules/fast-uri/lib/schemes.js
 var require_schemes = __commonJS({
-  "node_modules/.pnpm/fast-uri@3.1.8/node_modules/fast-uri/lib/schemes.js"(exports, module) {
+  "node_modules/.pnpm/fast-uri@3.1.9/node_modules/fast-uri/lib/schemes.js"(exports, module) {
     "use strict";
     var { isUUID } = require_utils();
     var URN_REG = /^([\da-z][\d\-a-z]{0,31}):((?:[\w!$'()*+,\-./:;=@]|%[\da-f]{2})+)$/iu;
@@ -23509,20 +23541,22 @@ var require_schemes = __commonJS({
   }
 });
 
-// node_modules/.pnpm/fast-uri@3.1.8/node_modules/fast-uri/index.js
+// node_modules/.pnpm/fast-uri@3.1.9/node_modules/fast-uri/index.js
 var require_fast_uri = __commonJS({
-  "node_modules/.pnpm/fast-uri@3.1.8/node_modules/fast-uri/index.js"(exports, module) {
+  "node_modules/.pnpm/fast-uri@3.1.9/node_modules/fast-uri/index.js"(exports, module) {
     "use strict";
-    var { normalizeIPv6, removeDotSegments, recomposeAuthority, normalizePercentEncoding, normalizePathEncoding, serializePathEncoding, normalizeQueryFragmentEncoding, encodeQuery, encodeFragment, reescapeHostDelimiters, isIPv4, nonSimpleDomain } = require_utils();
+    var { normalizeIPv6, removeDotSegments, removeDotSegmentsRelative, recomposeAuthority, normalizePercentEncoding, normalizePathEncoding, serializePathEncoding, normalizeQueryFragmentEncoding, encodeQuery, encodeFragment, reescapeHostDelimiters, isIPv4, nonSimpleDomain } = require_utils();
     var { SCHEMES, getSchemeHandler } = require_schemes();
     var VALID_SCHEME = /^[A-Za-z][A-Za-z0-9+.-]*$/u;
     var MALFORMED_SCHEME_ERROR = "URI scheme is malformed.";
-    function decodeValidScheme(scheme) {
-      const decodedScheme = unescape(String(scheme));
-      if (!VALID_SCHEME.test(decodedScheme)) {
+    var MALFORMED_HOST_ERROR = "URI host is malformed.";
+    var FORBIDDEN_DOMAIN_HOST_CHARACTER = /[\0-\x20"#/:<>?@[\\\]^`{|}\x7F]/u;
+    function validateScheme(scheme) {
+      const stringScheme = String(scheme);
+      if (!VALID_SCHEME.test(stringScheme)) {
         throw new TypeError(MALFORMED_SCHEME_ERROR);
       }
-      return decodedScheme;
+      return stringScheme;
     }
     function normalize(uri, options) {
       if (typeof uri === "string") {
@@ -23559,6 +23593,9 @@ var require_fast_uri = __commonJS({
       const resolvedSchemeHandler = getSchemeHandler(options && options.scheme || resolved.scheme);
       const resolvedHost = resolved.host;
       const resolvedHostIsIP = resolvedHost !== void 0 && resolvedHost !== "" && (isIPv4(resolvedHost) || normalizeIPv6(resolvedHost).isIPV6);
+      if (hasForbiddenDomainHost(resolved, options || {}, resolvedSchemeHandler, resolvedHostIsIP)) {
+        throw new Error(MALFORMED_HOST_ERROR);
+      }
       canonicalizeHost(resolved, options || {}, resolvedSchemeHandler, resolvedHostIsIP);
       const encodedASCIIHost = resolvedHost && resolvedHost.indexOf("%") !== -1 && !new RegExp("\\P{ASCII}", "u").test(resolvedHost);
       if (resolved.error && !encodedASCIIHost) {
@@ -23600,14 +23637,15 @@ var require_fast_uri = __commonJS({
             if (relative2.path[0] === "/") {
               target.path = removeDotSegments(relative2.path);
             } else {
-              if ((base.userinfo !== void 0 || base.host !== void 0 || base.port !== void 0) && !base.path) {
+              const baseHasAuthority = base.userinfo !== void 0 || base.host !== void 0 || base.port !== void 0;
+              if (baseHasAuthority && !base.path) {
                 target.path = "/" + relative2.path;
               } else if (!base.path) {
                 target.path = relative2.path;
               } else {
                 target.path = base.path.slice(0, base.path.lastIndexOf("/") + 1) + relative2.path;
               }
-              target.path = removeDotSegments(target.path);
+              target.path = base.scheme === void 0 && !baseHasAuthority && target.path[0] !== "/" ? removeDotSegmentsRelative(target.path) : removeDotSegments(target.path);
             }
             target.query = relative2.query;
           }
@@ -23645,12 +23683,13 @@ var require_fast_uri = __commonJS({
       const options = Object.assign({}, opts);
       const uriTokens = [];
       if (component.scheme) {
-        component.scheme = decodeValidScheme(component.scheme);
+        component.scheme = validateScheme(component.scheme);
       }
       const schemeHandler = getSchemeHandler(options.scheme || component.scheme);
       if (schemeHandler && schemeHandler.serialize) schemeHandler.serialize(component, options);
       const hasAuthority = component.userinfo !== void 0 || component.host !== void 0 || component.port !== void 0;
-      const pathNoScheme = !options.skipEscape && component.scheme === void 0 && !hasAuthority;
+      const schemelessReference = (component.scheme === void 0 || options.reference === "suffix") && !hasAuthority;
+      const pathNoScheme = !options.skipEscape && schemelessReference;
       if (component.path !== void 0) {
         if (!options.skipEscape) {
           component.path = serializePathEncoding(component.path, pathNoScheme);
@@ -23659,7 +23698,7 @@ var require_fast_uri = __commonJS({
         }
       }
       if (options.reference !== "suffix" && component.scheme) {
-        component.scheme = decodeValidScheme(component.scheme);
+        component.scheme = validateScheme(component.scheme);
         uriTokens.push(component.scheme, ":");
       }
       const authority = recomposeAuthority(component);
@@ -23675,9 +23714,9 @@ var require_fast_uri = __commonJS({
       if (component.path !== void 0) {
         let s = component.path;
         if (!options.absolutePath && (!schemeHandler || !schemeHandler.absolutePath)) {
-          s = removeDotSegments(s);
+          s = schemelessReference && s[0] !== "/" ? removeDotSegmentsRelative(s) : removeDotSegments(s);
         }
-        if (pathNoScheme) {
+        if (schemelessReference) {
           s = serializePathEncoding(s, true);
         }
         if (authority === void 0 && s[0] === "/" && s[1] === "/") {
@@ -23724,16 +23763,34 @@ var require_fast_uri = __commonJS({
       return hasMalformedPercentEncoding(matches[3]) || host2 !== void 0 && !isIPLiteral(host2) && hasMalformedPercentEncoding(host2) || hasMalformedPercentEncoding(matches[6]) || hasMalformedPercentEncoding(matches[7]) || hasMalformedPercentEncoding(matches[8]);
     }
     function canonicalizeHost(parsed, options, schemeHandler, isIP) {
+      if (hasForbiddenDomainHost(parsed, options, schemeHandler, isIP)) {
+        parsed.error = parsed.error || MALFORMED_HOST_ERROR;
+        return true;
+      }
       if (!options.unicodeSupport && (!schemeHandler || !schemeHandler.unicodeSupport) && parsed.host && !isIPLiteral(parsed.host) && (options.domainHost || schemeHandler && schemeHandler.domainHost) && isIP === false && nonSimpleDomain(parsed.host)) {
+        let url;
         try {
-          parsed.host = new URL("http://" + parsed.host).hostname;
+          url = new URL("http://" + parsed.host);
         } catch (e) {
           parsed.error = parsed.error || "Host's domain name can not be converted to ASCII: " + e;
           return true;
         }
+        if (!isHostOnlyURL(url)) {
+          parsed.error = parsed.error || MALFORMED_HOST_ERROR;
+          return true;
+        }
+        parsed.host = url.hostname;
       }
       return false;
     }
+    function hasForbiddenDomainHost(parsed, options, schemeHandler, isIP) {
+      return Boolean(
+        parsed.host && isIP === false && !isIPLiteral(parsed.host) && (options.domainHost || schemeHandler && schemeHandler.domainHost) && FORBIDDEN_DOMAIN_HOST_CHARACTER.test(parsed.host)
+      );
+    }
+    function isHostOnlyURL(url) {
+      return url.username === "" && url.password === "" && url.port === "" && url.pathname === "/" && url.search === "" && url.hash === "" && url.hostname !== "";
+    }
     function parseWithStatus(uri, opts) {
       const options = Object.assign({}, opts);
       const parsed = {
@@ -23788,9 +23845,8 @@ var require_fast_uri = __commonJS({
         parsed.query = matches[7];
         parsed.fragment = matches[8];
         if (parsed.scheme !== void 0) {
-          const decodedScheme = unescape(parsed.scheme);
-          if (VALID_SCHEME.test(decodedScheme)) {
-            parsed.scheme = decodedScheme.toLowerCase();
+          if (VALID_SCHEME.test(parsed.scheme)) {
+            parsed.scheme = parsed.scheme.toLowerCase();
           } else {
             parsed.error = parsed.error || MALFORMED_SCHEME_ERROR;
             malformedScheme = true;
@@ -23818,7 +23874,7 @@ var require_fast_uri = __commonJS({
             malformedIPLiteral = hasIPLiteralBracket && (!bracketedIPLiteral || ipv6result.error === true);
             parsed.host = isIP ? ipv6result.host : ipv6result.host.toLowerCase();
             if (malformedIPLiteral) {
-              parsed.error = parsed.error || "URI host is malformed.";
+              parsed.error = parsed.error || MALFORMED_HOST_ERROR;
               malformedAuthorityOrPort = true;
             }
           } else {
@@ -23846,7 +23902,7 @@ var require_fast_uri = __commonJS({
           if (!isIP) {
             host2 = normalizePercentEncoding(host2.toLowerCase());
           }
-          parsed.host = reescapeHostDelimiters(host2, isIP);
+          parsed.host = isIP || options.scheme !== "null" ? reescapeHostDelimiters(host2, isIP) : host2;
         }
         if (!schemeHandler || schemeHandler && !schemeHandler.skipNormalize) {
           if (parsed.path) {
@@ -34467,7 +34523,7 @@ var FRAMEWORK_VERSION_POLICY = Object.freeze({
     floors: Object.freeze(["14.4.0"]),
     denied: Object.freeze([])
   }),
-  next: Object.freeze({ floors: Object.freeze(["15.5.27", "16.3.8"]), denied: Object.freeze([]) }),
+  next: Object.freeze({ floors: Object.freeze(["16.4.1"]), denied: Object.freeze([]) }),
   vite: Object.freeze({ floors: Object.freeze(["5.4.6"]), denied: Object.freeze([]) }),
   "@tanstack/react-start": Object.freeze({
     floors: Object.freeze(["1.168.60"]),
@@ -40867,7 +40923,7 @@ function exact3(v, keys) {
 // apps/product-cli/package.json
 var package_default = {
   name: "@ohmyhost/product-cli",
-  version: "0.1.37",
+  version: "0.1.38",
   private: true,
   ohmyhost: {
     deployment: "production",
@@ -40899,7 +40955,7 @@ var package_default = {
   },
   scripts: {
     build: "tsc --project tsconfig.build.json",
-    typecheck: "tsc --project tsconfig.json --noEmit",
+    typecheck: "tsc --project tsconfig.json --noEmit --incremental --tsBuildInfoFile typecheck.tsbuildinfo",
     test: "vitest run --root ../.. apps/product-cli/test"
   },
   dependencies: {
@@ -48066,7 +48122,7 @@ function normalizeEgressOrigins(value) {
 }
 function forbiddenEgressHostname(hostname) {
   const normalized = hostname.toLowerCase();
-  return normalized === "localhost" || normalized.endsWith(".localhost") || normalized.endsWith(".local") || normalized.endsWith(".internal") || /^\d{1,3}(?:\.\d{1,3}){3}$/u.test(normalized) || normalized.startsWith("[") || normalized.endsWith("]");
+  return /^ohmyho-(?:mail|storage)-gateway-[a-z0-9][a-z0-9-]*\.[a-z0-9][a-z0-9-]*\.workers\.dev\.?$/u.test(normalized) || normalized === "localhost" || normalized.endsWith(".localhost") || normalized.endsWith(".local") || normalized.endsWith(".internal") || /^\d{1,3}(?:\.\d{1,3}){3}$/u.test(normalized) || normalized.startsWith("[") || normalized.endsWith("]");
 }
 function parseOhmyhostConfigYaml(source) {
   if (typeof source !== "string") {
@@ -49197,6 +49253,8 @@ var UTF8 = new TextDecoder("utf-8", { fatal: true });
 var MAXIMUM_SOURCE_BYTES = 2 * 1024 * 1024;
 var SOURCE_MODULE_PATTERN = /\.(?:[cm]?[jt]s|[jt]sx)$/u;
 var STORAGE_CLIENT_CALL_PATTERN = /\bcreatePrivateStorageClient\s*\(/u;
+var GATEWAY_BINDING_NAME = /^OHMYHOST_(?:MAIL|STORAGE)_GATEWAY$/u;
+var GATEWAY_WORD_TOKEN = /[\p{ID_Start}_$][\p{ID_Continue}$]*/uy;
 var UNNAMED_MODULE_MESSAGES = Object.freeze({
   database_binding_private: 'The module at path reads a database connection string (DATABASE_URL, HYPERDRIVE, connectionString or a postgres:// URL); none reaches a customer Worker. Call the database with createPrivateDatabaseClient from "@ohmyhost/customer-runtime/database". Commit and push the change, then plan the new commit.',
   database_driver_unsupported: 'The module at path imports a database socket driver (pg, postgres, pg-native or mysql2); customer Workers cannot open sockets. Call the database with createPrivateDatabaseClient from "@ohmyhost/customer-runtime/database". Commit and push the change, then plan the new commit.'
@@ -49207,10 +49265,14 @@ function callsStorageClient(source) {
 var STORAGE_RUNTIME_BINDINGS = Object.freeze([
   "OHMYHOST_ENVIRONMENT_ID",
   "OHMYHOST_PROJECT_ID",
-  "OHMYHOST_STORAGE_GATEWAY",
   "OHMYHOST_STORAGE_GATEWAY_URL",
   "OHMYHOST_STORAGE_KEY"
 ]);
+var MAIL_RUNTIME_BINDINGS = Object.freeze([
+  "OHMYHOST_MAIL_GATEWAY_URL",
+  "OHMYHOST_MAIL_KEY",
+  "OHMYHOST_PROJECT_ID"
+]);
 var CUSTOMER_RUNTIME_SOURCE = `npm:@amerged/ohmyhost-runtime@${package_default.version}`;
 var PENDING_CHECKS = Object.freeze({
   installed_version: "compatibility.frameworks lists a version range that no lockfile ohmyho.st reads (package-lock.json v2/v3 or pnpm-lock.yaml v6/v9) resolves. Planning admits it; after the frozen install, the build checks the installed version against the same security minimum.",
@@ -49389,6 +49451,7 @@ async function judgeSource(context) {
       ...source.findings.map((finding) => requiredCatalogBlocker(finding, context.applicationRoot)),
       ...await workerModuleBlockers(context),
       ...await databaseContractBlockers(context, context.provider),
+      ...await gatewayBindingBlockers(context),
       ...await storageClientBlockers(context),
       ...await migrationSqlBlockers(context, context.provider)
     ],
@@ -49437,6 +49500,147 @@ async function workerModuleBlockers(context) {
   const source = await readFile3(resolve5(context.applicationDirectory, path2), "utf8");
   return workerModuleFindings({ path: path2, source, fetch: framework === "functions", scheduled }).map((finding) => requiredCatalogBlocker(finding, context.applicationRoot));
 }
+function gatewaySourceTokens(source) {
+  const tokens = [];
+  let cursor = 0;
+  const quoted = (quote) => {
+    const start = cursor++;
+    while (cursor < source.length) {
+      const character = source[cursor++];
+      if (character === "\\")
+        cursor++;
+      else if (character === quote)
+        break;
+    }
+    tokens.push(source.slice(start, cursor));
+  };
+  const code = (interpolation) => {
+    let braces = 0;
+    while (cursor < source.length) {
+      const character = source[cursor];
+      if (interpolation && character === "}" && braces === 0) {
+        cursor++;
+        return;
+      }
+      if (character === '"' || character === "'") {
+        quoted(character);
+        continue;
+      }
+      if (character === "`") {
+        cursor++;
+        while (cursor < source.length) {
+          const literal = source[cursor++];
+          if (literal === "\\")
+            cursor++;
+          else if (literal === "`")
+            break;
+          else if (literal === "$" && source[cursor] === "{") {
+            cursor++;
+            tokens.push("(");
+            code(true);
+            tokens.push(")");
+          }
+        }
+        continue;
+      }
+      if (/\s/u.test(character)) {
+        cursor++;
+        continue;
+      }
+      if (character === "{")
+        braces++;
+      if (character === "}")
+        braces--;
+      GATEWAY_WORD_TOKEN.lastIndex = cursor;
+      const word = GATEWAY_WORD_TOKEN.exec(source)?.[0];
+      const token = word ?? (["?.", "=>"].includes(source.slice(cursor, cursor + 2)) ? source.slice(cursor, cursor + 2) : character);
+      tokens.push(token);
+      cursor += token.length;
+    }
+  };
+  code(false);
+  return tokens;
+}
+function usesGatewayBinding(source) {
+  const tokens = gatewaySourceTokens(sourceWithoutComments(source));
+  const objects = [];
+  let declaration;
+  let declarationDepth = 0;
+  for (let index = 0; index < tokens.length; index++) {
+    const token = tokens[index];
+    const previous = tokens[index - 1];
+    const next = tokens[index + 1];
+    if (declaration !== void 0) {
+      if (declarationDepth === 0 && (token === ";" || /^(?:export|const|let|var|function|class|type|interface)$/u.test(token))) {
+        declaration = void 0;
+        if (token === ";")
+          continue;
+      } else {
+        if (token === "{" || token === "(" || token === "[")
+          declarationDepth++;
+        if (token === "}" || token === ")" || token === "]") {
+          declarationDepth--;
+          if (declaration !== "type" && declarationDepth === 0)
+            declaration = void 0;
+        }
+        continue;
+      }
+    }
+    if ((token === "type" || token === "interface") && next !== void 0 && /^[\p{ID_Start}_$][\p{ID_Continue}$]*$/u.test(next) && previous !== "." && previous !== "?.") {
+      declaration = token;
+      continue;
+    }
+    if (token === "{" && previous === ":" && /^(?:const|let|var)$/u.test(tokens[index - 3] ?? "")) {
+      declaration = "annotation";
+      declarationDepth = 1;
+      continue;
+    }
+    if (token === "{")
+      objects.push(false);
+    if (token === "}") {
+      const gateway = objects.pop();
+      let after = index + 1;
+      if (tokens[after] === ":") {
+        after++;
+        while (after < tokens.length && !/^(?:=|;|\{|\})$/u.test(tokens[after]))
+          after++;
+      }
+      if (gateway && tokens[after] === "=")
+        return true;
+    }
+    const quoted = token.startsWith('"') || token.startsWith("'");
+    const name = quoted ? token.slice(1, -1) : token;
+    if (!GATEWAY_BINDING_NAME.test(name))
+      continue;
+    if (!quoted && (previous === "." || previous === "?."))
+      return true;
+    const receiver = tokens[index - (tokens[index - 2] === "?." ? 3 : 2)] ?? "";
+    if (quoted && previous === "[" && next === "]" && (/^[\p{ID_Start}_$][\p{ID_Continue}$]*$/u.test(receiver) || receiver === ")" || receiver === "]") && !/^(?:return|throw|yield|case|new|typeof|void|delete|await|in|of)$/u.test(receiver))
+      return true;
+    if (objects.length > 0 && (previous === "{" || previous === ",") && (next === ":" || next === "," || next === "}" || next === "="))
+      objects[objects.length - 1] = true;
+  }
+  return false;
+}
+async function gatewayBindingBlockers(context) {
+  const blockers = [];
+  for (const path2 of context.files) {
+    if (!SOURCE_MODULE_PATTERN.test(path2) || /\.d\.[cm]?ts$/u.test(path2))
+      continue;
+    const absolute = resolve5(context.applicationDirectory, path2);
+    const information = await stat2(absolute);
+    if (!information.isFile() || information.size > MAXIMUM_SOURCE_BYTES)
+      continue;
+    if (!usesGatewayBinding(await readFile3(absolute, "utf8")))
+      continue;
+    blockers.push({
+      code: "gateway_binding_unsupported",
+      path: repositoryPath(context.applicationRoot, path2),
+      message: "Mail and storage gateway Service Bindings are unsupported. In server code, create the client from its OHMYHOST_MAIL_GATEWAY_URL or OHMYHOST_STORAGE_GATEWAY_URL, environment key and project ID, plus the environment ID for storage. Use the global fetch with fetch: (request) => fetch(request), and capabilityFetch: (request) => fetch(request) for storage signed URLs."
+    });
+  }
+  return blockers;
+}
 async function storageClientBlockers(context) {
   if (context.config?.storage === void 0)
     return [];
@@ -49454,7 +49658,7 @@ async function storageClientBlockers(context) {
     {
       code: "storage_client_missing",
       path: null,
-      message: 'ohmyhost.yaml declares storage, but no application source calls createPrivateStorageClient. Import it from "@ohmyhost/customer-runtime/storage" and build it in server code from OHMYHOST_STORAGE_GATEWAY, OHMYHOST_STORAGE_GATEWAY_URL, OHMYHOST_PROJECT_ID, OHMYHOST_ENVIRONMENT_ID and OHMYHOST_STORAGE_KEY, then reserve an upload, PUT the bytes to the returned signed URL, complete it, and serve reads with createSignedRead. There is no FILES bucket binding.'
+      message: 'ohmyhost.yaml declares storage, but no application source calls createPrivateStorageClient. Import it from "@ohmyhost/customer-runtime/storage" and build it in server code from OHMYHOST_STORAGE_GATEWAY_URL, OHMYHOST_PROJECT_ID, OHMYHOST_ENVIRONMENT_ID and OHMYHOST_STORAGE_KEY, with the global fetch as fetch: (request) => fetch(request) and capabilityFetch: (request) => fetch(request). Reserve an upload, PUT the bytes to the returned signed URL, complete it, and serve reads with createSignedRead. There is no FILES bucket binding.'
     }
   ];
 }
@@ -49969,10 +50173,12 @@ async function detectR2Storage(root, files) {
 function runtimeContract(capabilities) {
   return Object.freeze({
     bindings: Object.freeze([
-      ...capabilities.auth ? ["BETTER_AUTH_SECRET"] : [],
-      ...capabilities.storage ? STORAGE_RUNTIME_BINDINGS : [],
-      ...capabilities.database ? ["OHMYHOST_DATABASE"] : [],
-      ...capabilities.mail ? ["OHMYHOST_MAIL_KEY"] : []
+      .../* @__PURE__ */ new Set([
+        ...capabilities.auth ? ["BETTER_AUTH_SECRET"] : [],
+        ...capabilities.storage ? STORAGE_RUNTIME_BINDINGS : [],
+        ...capabilities.database ? ["OHMYHOST_DATABASE"] : [],
+        ...capabilities.mail ? MAIL_RUNTIME_BINDINGS : []
+      ])
     ].sort()),
     packages: Object.freeze({
       ...capabilities.auth ? { betterAuth: MANAGED_BETTER_AUTH_VERSION } : {},

package/dist/index.js

@@ -99,7 +99,7 @@ import {
   selectWorkspace,
   verifiedUserId,
   workspaceOf
-} from "./chunk-IHXNADOQ.js";
+} from "./chunk-EWKJGJQU.js";
 import {
   CredentialStoreIntegrityError,
   CredentialStoreUnavailableError,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@amerged/ohmyhost-cli",
-  "version": "0.1.37",
+  "version": "0.1.38",
   "type": "module",
   "engines": {
     "node": ">=22"

package/src/apps/product-cli/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ohmyhost/product-cli",
-  "version": "0.1.37",
+  "version": "0.1.38",
   "private": true,
   "ohmyhost": {
     "deployment": "production",
@@ -32,7 +32,7 @@
   },
   "scripts": {
     "build": "tsc --project tsconfig.build.json",
-    "typecheck": "tsc --project tsconfig.json --noEmit",
+    "typecheck": "tsc --project tsconfig.json --noEmit --incremental --tsBuildInfoFile typecheck.tsbuildinfo",
     "test": "vitest run --root ../.. apps/product-cli/test"
   },
   "dependencies": {

package/src/apps/product-cli/src/repository-init.ts

@@ -75,6 +75,8 @@ export type RepositoryFramework = Exclude<FrameworkFamilyClassification, "ambigu
 const MAXIMUM_SOURCE_BYTES = 2 * 1024 * 1024;
 const SOURCE_MODULE_PATTERN = /\.(?:[cm]?[jt]s|[jt]sx)$/u;
 const STORAGE_CLIENT_CALL_PATTERN = /\bcreatePrivateStorageClient\s*\(/u;
+const GATEWAY_BINDING_NAME = /^OHMYHOST_(?:MAIL|STORAGE)_GATEWAY$/u;
+const GATEWAY_WORD_TOKEN = /[\p{ID_Start}_$][\p{ID_Continue}$]*/uy;
 // The catalog names a module only by a path of its grammar; a file name with a space, for example,
 // is not one, so its blocker carries the path beside a sentence that does not quote it.
 const UNNAMED_MODULE_MESSAGES: Readonly<Record<DatabaseContractCode, string>> = Object.freeze({
@@ -89,15 +91,19 @@ function callsStorageClient(source: string): boolean {
   return STORAGE_CLIENT_CALL_PATTERN.test(sourceWithoutComments(source));
 }
 
-// Storage is reached through a private Service Binding plus the three values and the key that
-// `createPrivateStorageClient` reads. No raw bucket binding is handed to customer code.
+// Global fetch reaches the private storage gateway using these values and its environment key.
+// No raw bucket binding is handed to customer code.
 const STORAGE_RUNTIME_BINDINGS = Object.freeze([
   "OHMYHOST_ENVIRONMENT_ID",
   "OHMYHOST_PROJECT_ID",
-  "OHMYHOST_STORAGE_GATEWAY",
   "OHMYHOST_STORAGE_GATEWAY_URL",
   "OHMYHOST_STORAGE_KEY",
 ]);
+const MAIL_RUNTIME_BINDINGS = Object.freeze([
+  "OHMYHOST_MAIL_GATEWAY_URL",
+  "OHMYHOST_MAIL_KEY",
+  "OHMYHOST_PROJECT_ID",
+]);
 // The runtime release is published unchanged as `@amerged/ohmyhost-runtime`; this pinned alias keeps
 // its import name and, unlike the website archive each release removes, stays installable.
 const CUSTOMER_RUNTIME_SOURCE = `npm:@amerged/ohmyhost-runtime@${cliPackage.version}`;
@@ -105,6 +111,7 @@ const CUSTOMER_RUNTIME_SOURCE = `npm:@amerged/ohmyhost-runtime@${cliPackage.vers
 /** A catalog code, which planning answers with the same sentence, or a check only init runs. */
 export type RepositoryInitBlockerCode =
   | FrameworkConversionDiagnosticCode
+  | "gateway_binding_unsupported"
   | "migration_filename_noncanonical"
   | "migration_sql_not_admitted"
   | "storage_client_missing";
@@ -507,7 +514,7 @@ interface SourceCheckContext {
 /**
  * Every blocker of a source with a valid or proposed configuration, in the order planning judges:
  * migration filenames, the shared source rules, the Worker module handlers and the database
- * contract; init's own storage client and migration SQL checks come last.
+ * contract; init's own gateway binding, storage client and migration SQL checks come last.
  */
 async function judgeSource(
   context: SourceCheckContext &
@@ -528,6 +535,7 @@ async function judgeSource(
       ...source.findings.map((finding) => requiredCatalogBlocker(finding, context.applicationRoot)),
       ...(await workerModuleBlockers(context)),
       ...(await databaseContractBlockers(context, context.provider)),
+      ...(await gatewayBindingBlockers(context)),
       ...(await storageClientBlockers(context)),
       ...(await migrationSqlBlockers(context, context.provider)),
     ],
@@ -621,6 +629,168 @@ async function workerModuleBlockers(context: SourceCheckContext): Promise<Reposi
   );
 }
 
+/** Keep literal text inert, but scan executable template interpolations as ordinary code. */
+function gatewaySourceTokens(source: string): readonly string[] {
+  const tokens: string[] = [];
+  let cursor = 0;
+  const quoted = (quote: string) => {
+    const start = cursor++;
+    while (cursor < source.length) {
+      const character = source[cursor++];
+      if (character === "\\") cursor++;
+      else if (character === quote) break;
+    }
+    tokens.push(source.slice(start, cursor));
+  };
+  const code = (interpolation: boolean): void => {
+    let braces = 0;
+    while (cursor < source.length) {
+      const character = source[cursor] as string;
+      if (interpolation && character === "}" && braces === 0) {
+        cursor++;
+        return;
+      }
+      if (character === '"' || character === "'") {
+        quoted(character);
+        continue;
+      }
+      if (character === "`") {
+        cursor++;
+        while (cursor < source.length) {
+          const literal = source[cursor++];
+          if (literal === "\\") cursor++;
+          else if (literal === "`") break;
+          else if (literal === "$" && source[cursor] === "{") {
+            cursor++;
+            tokens.push("(");
+            code(true);
+            tokens.push(")");
+          }
+        }
+        continue;
+      }
+      if (/\s/u.test(character)) {
+        cursor++;
+        continue;
+      }
+      if (character === "{") braces++;
+      if (character === "}") braces--;
+      GATEWAY_WORD_TOKEN.lastIndex = cursor;
+      const word = GATEWAY_WORD_TOKEN.exec(source)?.[0];
+      const token =
+        word ??
+        (["?.", "=>"].includes(source.slice(cursor, cursor + 2))
+          ? source.slice(cursor, cursor + 2)
+          : character);
+      tokens.push(token);
+      cursor += token.length;
+    }
+  };
+  code(false);
+  return tokens;
+}
+
+/** Static value accesses only: declarations, literal messages and object-literal keys are inert. */
+function usesGatewayBinding(source: string): boolean {
+  const tokens = gatewaySourceTokens(sourceWithoutComments(source));
+  const objects: boolean[] = [];
+  let declaration: "type" | "interface" | "annotation" | undefined;
+  let declarationDepth = 0;
+  for (let index = 0; index < tokens.length; index++) {
+    const token = tokens[index] as string;
+    const previous = tokens[index - 1];
+    const next = tokens[index + 1];
+    if (declaration !== undefined) {
+      if (
+        declarationDepth === 0 &&
+        (token === ";" || /^(?:export|const|let|var|function|class|type|interface)$/u.test(token))
+      ) {
+        declaration = undefined;
+        if (token === ";") continue;
+      } else {
+        if (token === "{" || token === "(" || token === "[") declarationDepth++;
+        if (token === "}" || token === ")" || token === "]") {
+          declarationDepth--;
+          if (declaration !== "type" && declarationDepth === 0) declaration = undefined;
+        }
+        continue;
+      }
+    }
+    if (
+      (token === "type" || token === "interface") &&
+      next !== undefined &&
+      /^[\p{ID_Start}_$][\p{ID_Continue}$]*$/u.test(next) &&
+      previous !== "." &&
+      previous !== "?."
+    ) {
+      declaration = token;
+      continue;
+    }
+    // An inline variable type is not an object binding pattern; resume at its initializer.
+    if (token === "{" && previous === ":" && /^(?:const|let|var)$/u.test(tokens[index - 3] ?? "")) {
+      declaration = "annotation";
+      declarationDepth = 1;
+      continue;
+    }
+    if (token === "{") objects.push(false);
+    if (token === "}") {
+      const gateway = objects.pop();
+      let after = index + 1;
+      if (tokens[after] === ":") {
+        after++;
+        while (after < tokens.length && !/^(?:=|;|\{|\})$/u.test(tokens[after] as string)) after++;
+      }
+      if (gateway && tokens[after] === "=") return true;
+    }
+    const quoted = token.startsWith('"') || token.startsWith("'");
+    const name = quoted ? token.slice(1, -1) : token;
+    if (!GATEWAY_BINDING_NAME.test(name)) continue;
+    if (!quoted && (previous === "." || previous === "?.")) return true;
+    const receiver = tokens[index - (tokens[index - 2] === "?." ? 3 : 2)] ?? "";
+    if (
+      quoted &&
+      previous === "[" &&
+      next === "]" &&
+      (/^[\p{ID_Start}_$][\p{ID_Continue}$]*$/u.test(receiver) ||
+        receiver === ")" ||
+        receiver === "]") &&
+      !/^(?:return|throw|yield|case|new|typeof|void|delete|await|in|of)$/u.test(receiver)
+    )
+      return true;
+    if (
+      objects.length > 0 &&
+      (previous === "{" || previous === ",") &&
+      (next === ":" || next === "," || next === "}" || next === "=")
+    )
+      objects[objects.length - 1] = true;
+  }
+  return false;
+}
+
+/**
+ * Init names legacy mail/storage bindings before a customer builds code whose gateway calls the
+ * egress policy cannot serve. This local guidance does not change planning's admission policy.
+ */
+async function gatewayBindingBlockers(
+  context: SourceCheckContext,
+): Promise<RepositoryInitBlocker[]> {
+  const blockers: RepositoryInitBlocker[] = [];
+  for (const path of context.files) {
+    if (!SOURCE_MODULE_PATTERN.test(path) || /\.d\.[cm]?ts$/u.test(path)) continue;
+    const absolute = resolve(context.applicationDirectory, path);
+    const information = await stat(absolute);
+    if (!information.isFile() || information.size > MAXIMUM_SOURCE_BYTES) continue;
+    if (!usesGatewayBinding(await readFile(absolute, "utf8"))) continue;
+    blockers.push({
+      code: "gateway_binding_unsupported",
+      path: repositoryPath(context.applicationRoot, path),
+      message:
+        "Mail and storage gateway Service Bindings are unsupported. In server code, create the client from its OHMYHOST_MAIL_GATEWAY_URL or OHMYHOST_STORAGE_GATEWAY_URL, environment key and project ID, plus the environment ID for storage. Use the global fetch with fetch: (request) => fetch(request), and capabilityFetch: (request) => fetch(request) for storage signed URLs.",
+    });
+  }
+  return blockers;
+}
+
 /**
  * Declared storage is reached only through the private gateway client. A storage-enabled app whose
  * source never constructs that client deploys green and fails at its first upload, so name it here.
@@ -641,7 +811,7 @@ async function storageClientBlockers(
       code: "storage_client_missing",
       path: null,
       message:
-        'ohmyhost.yaml declares storage, but no application source calls createPrivateStorageClient. Import it from "@ohmyhost/customer-runtime/storage" and build it in server code from OHMYHOST_STORAGE_GATEWAY, OHMYHOST_STORAGE_GATEWAY_URL, OHMYHOST_PROJECT_ID, OHMYHOST_ENVIRONMENT_ID and OHMYHOST_STORAGE_KEY, then reserve an upload, PUT the bytes to the returned signed URL, complete it, and serve reads with createSignedRead. There is no FILES bucket binding.',
+        'ohmyhost.yaml declares storage, but no application source calls createPrivateStorageClient. Import it from "@ohmyhost/customer-runtime/storage" and build it in server code from OHMYHOST_STORAGE_GATEWAY_URL, OHMYHOST_PROJECT_ID, OHMYHOST_ENVIRONMENT_ID and OHMYHOST_STORAGE_KEY, with the global fetch as fetch: (request) => fetch(request) and capabilityFetch: (request) => fetch(request). Reserve an upload, PUT the bytes to the returned signed URL, complete it, and serve reads with createSignedRead. There is no FILES bucket binding.',
     },
   ];
 }
@@ -1418,10 +1588,12 @@ function runtimeContract(capabilities: RuntimeCapabilities): Readonly<{
   return Object.freeze({
     bindings: Object.freeze(
       [
-        ...(capabilities.auth ? ["BETTER_AUTH_SECRET"] : []),
-        ...(capabilities.storage ? STORAGE_RUNTIME_BINDINGS : []),
-        ...(capabilities.database ? ["OHMYHOST_DATABASE"] : []),
-        ...(capabilities.mail ? ["OHMYHOST_MAIL_KEY"] : []),
+        ...new Set([
+          ...(capabilities.auth ? ["BETTER_AUTH_SECRET"] : []),
+          ...(capabilities.storage ? STORAGE_RUNTIME_BINDINGS : []),
+          ...(capabilities.database ? ["OHMYHOST_DATABASE"] : []),
+          ...(capabilities.mail ? MAIL_RUNTIME_BINDINGS : []),
+        ]),
       ].sort(),
     ),
     packages: Object.freeze({

package/src/packages/contracts/package.json

@@ -150,7 +150,7 @@
   },
   "scripts": {
     "build": "tsc --project tsconfig.build.json",
-    "typecheck": "tsc --project tsconfig.json --noEmit",
+    "typecheck": "tsc --project tsconfig.json --noEmit --incremental --tsBuildInfoFile typecheck.tsbuildinfo",
     "test": "vitest run --root ../.. packages/contracts/test",
     "validate": "pnpm run typecheck && pnpm run test"
   },

package/src/packages/contracts/src/framework-admission-corpus.ts

@@ -48,7 +48,7 @@ const CORPUS_NEXT_PAGE = `export default function Home() {
   return <main>Hello from ohmyho.st</main>;
 }
 `;
-// The config `create-next-app@16.4.0 --yes --no-tailwind` writes: Cache Components with partial
+// The config `create-next-app@16.4.1 --yes --no-tailwind` writes: Cache Components with partial
 // prefetching.
 const CREATE_NEXT_APP_CONFIG = `import type { NextConfig } from "next";
 
@@ -124,10 +124,7 @@ export const FRAMEWORK_ADMISSION_CONFORMANCE_CORPUS: Readonly<{
     Readonly<{ diagnostic: FrameworkConversionDiagnostic }>)[];
 }> = Object.freeze({
   admitted: Object.freeze([
-    corpusCase(
-      "Next.js 16.3.8 with npm on the edge runtime (the exact customer source)",
-      nextSource(),
-    ),
+    corpusCase("Next.js 16.4.1 with npm on the edge runtime", nextSource()),
     corpusCase("Next.js 17.0.0, a later stable major", nextSource({ declared: "17.0.0" })),
     corpusCase(
       "Vite ^8.2.0 resolved to 8.3.4 by pnpm-lock.yaml",
@@ -147,26 +144,26 @@ export const FRAMEWORK_ADMISSION_CONFORMANCE_CORPUS: Readonly<{
     Object.freeze({
       ...corpusCase(
         "Next.js ^16.3.0 with bun.lock, which ohmyho.st does not resolve",
-        nextSource({ declared: "^16.3.0", resolved: "16.4.0", manager: "bun" }),
+        nextSource({ declared: "^16.3.0", resolved: "16.4.1", manager: "bun" }),
       ),
       packages: Object.freeze(["next"] as const),
     }),
   ]),
   refused: Object.freeze([
     refusedCase(
-      "Next.js 16.3.7 below the 16.x security minimum",
-      nextSource({ declared: "16.3.7" }),
-      versionFinding("package-lock.json", "next", "16.3.7", "16.3.8"),
+      "Next.js 16.4.0 below the 16.x security minimum",
+      nextSource({ declared: "16.4.0" }),
+      versionFinding("package-lock.json", "next", "16.4.0", "16.4.1"),
     ),
     refusedCase(
-      "Next.js 15.5.26 declared with yarn below the 15.x security minimum",
-      nextSource({ declared: "15.5.26", manager: "yarn" }),
-      versionFinding("package.json", "next", "15.5.26", "15.5.27"),
+      "Next.js 15.5.28 declared with yarn, because no 15.x release is admitted",
+      nextSource({ declared: "15.5.28", manager: "yarn" }),
+      versionFinding("package.json", "next", "15.5.28", "16.4.1"),
     ),
     refusedCase(
-      "Next.js ^16.3.0 resolved to 16.3.7 by package-lock.json",
-      nextSource({ declared: "^16.3.0", resolved: "16.3.7" }),
-      versionFinding("package-lock.json", "next", "16.3.7", "16.3.8"),
+      "Next.js ^16.3.0 resolved to 16.4.0 by package-lock.json",
+      nextSource({ declared: "^16.3.0", resolved: "16.4.0" }),
+      versionFinding("package-lock.json", "next", "16.4.0", "16.4.1"),
     ),
     refusedCase(
       "TanStack Start 1.168.59 resolved by pnpm-lock.yaml below its security minimum",
@@ -354,7 +351,7 @@ function nextSource(
 ): Readonly<Record<string, string>> {
   const manager = options.manager ?? "npm";
   const [packageManager, lockfile] = CORPUS_MANAGERS[manager];
-  const next = options.declared ?? "16.3.8";
+  const next = options.declared ?? "16.4.1";
   const react = { react: "19.1.2", "react-dom": "19.1.2" };
   const runtime = options.field === "devDependencies" ? react : { next, ...react };
   return Object.freeze({
@@ -380,7 +377,7 @@ function nextSource(
 }
 
 /**
- * The next.config.ts and Tailwind CSS files and packages `create-next-app@16.4.0 --yes` writes, in
+ * The next.config.ts and Tailwind CSS files and packages `create-next-app@16.4.1 --yes` writes, in
  * an App Router source with the packageManager, lockfile and ohmyhost.yaml ohmyho.st requires;
  * `tailwind: false` is its --no-tailwind output. On Turbopack, its default bundler, it adds only the
  * Turbopack rule for Tailwind CSS; `postcss` adds the postcss.config.mjs and @tailwindcss/postcss it
@@ -390,7 +387,7 @@ function createNextAppSource(
   options: Readonly<{ tailwind: boolean; postcss?: boolean }>,
 ): Readonly<Record<string, string>> {
   const [packageManager, lockfile] = CORPUS_MANAGERS.npm;
-  const runtime = { next: "16.4.0", react: "19.3.0", "react-dom": "19.3.0" };
+  const runtime = { next: "16.4.1", react: "19.3.0", "react-dom": "19.3.0" };
   const postcss = options.postcss === true;
   return Object.freeze({
     "ohmyhost.yaml": corpusConfiguration("npm", ".open-next/assets", "edge"),

package/src/packages/contracts/src/framework-build-script.mjs

@@ -15,8 +15,15 @@ export const PINNED_BUN_VERSION = "1.2.22";
  * upper bound: later patches, minors and majors reach the real build, which reports adapter failures.
  * Denied ranges are half-open [introduced, fixed); a null fix denies every later release.
  *
- * next: GHSA-4jqv-mc3x-m676 and GHSA-mcj8-r9mp-w47p (fixed in 15.5.27 and 16.3.8); GHSA-cjq9-62q9-8jv4,
- *   GHSA-f87g-xv8r-7p7x, GHSA-3w37-wq28-93x7, GHSA-h694-7cp9-m8p3 and GHSA-39w2-rjm5-chcv (16.3.8).
+ * next: GHSA-2464-fhr4-w9xw (critical, remote code execution through the Image Optimization API with
+ *   SVG and sharp before 0.35.5) and GHSA-p3m5-59mp-jv5r (high, denial of service through Server
+ *   Actions), both fixed in 15.5.28 and 16.4.1; GHSA-673q-mjm6-r5xr (critical, remote code execution
+ *   through `use cache` functions that return typed arrays, Next.js 16 only, fixed in 16.4.1).
+ *   There is no 15.x floor: the pinned OpenNext has refused Next.js 15 since 21 October 2026, so every 15.x
+ *   release is refused with the minimum 16.4.1 instead of sending a customer to 15.5.28 and a failing build.
+ *   Earlier floors: GHSA-4jqv-mc3x-m676 and GHSA-mcj8-r9mp-w47p (fixed in 15.5.27 and 16.3.8);
+ *   GHSA-cjq9-62q9-8jv4, GHSA-f87g-xv8r-7p7x, GHSA-3w37-wq28-93x7, GHSA-h694-7cp9-m8p3 and
+ *   GHSA-39w2-rjm5-chcv (16.3.8).
  * @tanstack/react-start: GHSA-qx66-fv34-fjm8 (fixed in 1.168.60).
  * vite: GHSA-64vr-g452-qvp3 (fixed in 5.4.6), the only advisory affecting `vite build` output.
  * @type {FrameworkVersionPolicy}
@@ -27,7 +34,7 @@ export const FRAMEWORK_VERSION_POLICY = Object.freeze({
     floors: Object.freeze(["14.4.0"]),
     denied: Object.freeze([]),
   }),
-  next: Object.freeze({ floors: Object.freeze(["15.5.27", "16.3.8"]), denied: Object.freeze([]) }),
+  next: Object.freeze({ floors: Object.freeze(["16.4.1"]), denied: Object.freeze([]) }),
   vite: Object.freeze({ floors: Object.freeze(["5.4.6"]), denied: Object.freeze([]) }),
   "@tanstack/react-start": Object.freeze({
     floors: Object.freeze(["1.168.60"]),

package/src/packages/contracts/src/index.ts

@@ -209,6 +209,9 @@ function normalizeEgressOrigins(value: readonly string[] | undefined): readonly
 function forbiddenEgressHostname(hostname: string): boolean {
   const normalized = hostname.toLowerCase();
   return (
+    /^ohmyho-(?:mail|storage)-gateway-[a-z0-9][a-z0-9-]*\.[a-z0-9][a-z0-9-]*\.workers\.dev\.?$/u.test(
+      normalized,
+    ) ||
     normalized === "localhost" ||
     normalized.endsWith(".localhost") ||
     normalized.endsWith(".local") ||

package/src/packages/sdk-ts/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ohmyhost/sdk-ts",
-  "version": "0.1.37",
+  "version": "0.1.38",
   "private": true,
   "type": "module",
   "exports": {
@@ -14,7 +14,7 @@
     "build": "tsc --project tsconfig.build.json",
     "check": "pnpm --dir ../.. sdk-ts:check",
     "generate": "pnpm --dir ../.. sdk-ts:generate",
-    "typecheck": "tsc --project tsconfig.json --noEmit",
+    "typecheck": "tsc --project tsconfig.json --noEmit --incremental --tsBuildInfoFile typecheck.tsbuildinfo",
     "test": "pnpm run check && vitest run --root ../.. packages/sdk-ts"
   },
   "license": "Apache-2.0"

package/src/packages/workos-auth-contracts/package.json

@@ -32,7 +32,7 @@
   },
   "scripts": {
     "build": "tsc --project tsconfig.build.json",
-    "typecheck": "tsc --project tsconfig.json --noEmit",
+    "typecheck": "tsc --project tsconfig.json --noEmit --incremental --tsBuildInfoFile typecheck.tsbuildinfo",
     "test": "vitest run --root ../.. packages/workos-auth-contracts/src"
   },
   "license": "Apache-2.0"