@amerged/ohmyhost-mcp 0.1.37 → 0.1.38

package/src/packages/contracts/package.json

@@ -150,7 +150,7 @@
   },
   "scripts": {
     "build": "tsc --project tsconfig.build.json",
-    "typecheck": "tsc --project tsconfig.json --noEmit",
+    "typecheck": "tsc --project tsconfig.json --noEmit --incremental --tsBuildInfoFile typecheck.tsbuildinfo",
     "test": "vitest run --root ../.. packages/contracts/test",
     "validate": "pnpm run typecheck && pnpm run test"
   },

package/src/packages/contracts/src/framework-admission-corpus.ts

@@ -48,7 +48,7 @@ const CORPUS_NEXT_PAGE = `export default function Home() {
   return <main>Hello from ohmyho.st</main>;
 }
 `;
-// The config `create-next-app@16.4.0 --yes --no-tailwind` writes: Cache Components with partial
+// The config `create-next-app@16.4.1 --yes --no-tailwind` writes: Cache Components with partial
 // prefetching.
 const CREATE_NEXT_APP_CONFIG = `import type { NextConfig } from "next";
 
@@ -124,10 +124,7 @@ export const FRAMEWORK_ADMISSION_CONFORMANCE_CORPUS: Readonly<{
     Readonly<{ diagnostic: FrameworkConversionDiagnostic }>)[];
 }> = Object.freeze({
   admitted: Object.freeze([
-    corpusCase(
-      "Next.js 16.3.8 with npm on the edge runtime (the exact customer source)",
-      nextSource(),
-    ),
+    corpusCase("Next.js 16.4.1 with npm on the edge runtime", nextSource()),
     corpusCase("Next.js 17.0.0, a later stable major", nextSource({ declared: "17.0.0" })),
     corpusCase(
       "Vite ^8.2.0 resolved to 8.3.4 by pnpm-lock.yaml",
@@ -147,26 +144,26 @@ export const FRAMEWORK_ADMISSION_CONFORMANCE_CORPUS: Readonly<{
     Object.freeze({
       ...corpusCase(
         "Next.js ^16.3.0 with bun.lock, which ohmyho.st does not resolve",
-        nextSource({ declared: "^16.3.0", resolved: "16.4.0", manager: "bun" }),
+        nextSource({ declared: "^16.3.0", resolved: "16.4.1", manager: "bun" }),
       ),
       packages: Object.freeze(["next"] as const),
     }),
   ]),
   refused: Object.freeze([
     refusedCase(
-      "Next.js 16.3.7 below the 16.x security minimum",
-      nextSource({ declared: "16.3.7" }),
-      versionFinding("package-lock.json", "next", "16.3.7", "16.3.8"),
+      "Next.js 16.4.0 below the 16.x security minimum",
+      nextSource({ declared: "16.4.0" }),
+      versionFinding("package-lock.json", "next", "16.4.0", "16.4.1"),
     ),
     refusedCase(
-      "Next.js 15.5.26 declared with yarn below the 15.x security minimum",
-      nextSource({ declared: "15.5.26", manager: "yarn" }),
-      versionFinding("package.json", "next", "15.5.26", "15.5.27"),
+      "Next.js 15.5.28 declared with yarn, because no 15.x release is admitted",
+      nextSource({ declared: "15.5.28", manager: "yarn" }),
+      versionFinding("package.json", "next", "15.5.28", "16.4.1"),
     ),
     refusedCase(
-      "Next.js ^16.3.0 resolved to 16.3.7 by package-lock.json",
-      nextSource({ declared: "^16.3.0", resolved: "16.3.7" }),
-      versionFinding("package-lock.json", "next", "16.3.7", "16.3.8"),
+      "Next.js ^16.3.0 resolved to 16.4.0 by package-lock.json",
+      nextSource({ declared: "^16.3.0", resolved: "16.4.0" }),
+      versionFinding("package-lock.json", "next", "16.4.0", "16.4.1"),
     ),
     refusedCase(
       "TanStack Start 1.168.59 resolved by pnpm-lock.yaml below its security minimum",
@@ -354,7 +351,7 @@ function nextSource(
 ): Readonly<Record<string, string>> {
   const manager = options.manager ?? "npm";
   const [packageManager, lockfile] = CORPUS_MANAGERS[manager];
-  const next = options.declared ?? "16.3.8";
+  const next = options.declared ?? "16.4.1";
   const react = { react: "19.1.2", "react-dom": "19.1.2" };
   const runtime = options.field === "devDependencies" ? react : { next, ...react };
   return Object.freeze({
@@ -380,7 +377,7 @@ function nextSource(
 }
 
 /**
- * The next.config.ts and Tailwind CSS files and packages `create-next-app@16.4.0 --yes` writes, in
+ * The next.config.ts and Tailwind CSS files and packages `create-next-app@16.4.1 --yes` writes, in
  * an App Router source with the packageManager, lockfile and ohmyhost.yaml ohmyho.st requires;
  * `tailwind: false` is its --no-tailwind output. On Turbopack, its default bundler, it adds only the
  * Turbopack rule for Tailwind CSS; `postcss` adds the postcss.config.mjs and @tailwindcss/postcss it
@@ -390,7 +387,7 @@ function createNextAppSource(
   options: Readonly<{ tailwind: boolean; postcss?: boolean }>,
 ): Readonly<Record<string, string>> {
   const [packageManager, lockfile] = CORPUS_MANAGERS.npm;
-  const runtime = { next: "16.4.0", react: "19.3.0", "react-dom": "19.3.0" };
+  const runtime = { next: "16.4.1", react: "19.3.0", "react-dom": "19.3.0" };
   const postcss = options.postcss === true;
   return Object.freeze({
     "ohmyhost.yaml": corpusConfiguration("npm", ".open-next/assets", "edge"),

package/src/packages/contracts/src/framework-build-script.mjs

@@ -15,8 +15,15 @@ export const PINNED_BUN_VERSION = "1.2.22";
  * upper bound: later patches, minors and majors reach the real build, which reports adapter failures.
  * Denied ranges are half-open [introduced, fixed); a null fix denies every later release.
  *
- * next: GHSA-4jqv-mc3x-m676 and GHSA-mcj8-r9mp-w47p (fixed in 15.5.27 and 16.3.8); GHSA-cjq9-62q9-8jv4,
- *   GHSA-f87g-xv8r-7p7x, GHSA-3w37-wq28-93x7, GHSA-h694-7cp9-m8p3 and GHSA-39w2-rjm5-chcv (16.3.8).
+ * next: GHSA-2464-fhr4-w9xw (critical, remote code execution through the Image Optimization API with
+ *   SVG and sharp before 0.35.5) and GHSA-p3m5-59mp-jv5r (high, denial of service through Server
+ *   Actions), both fixed in 15.5.28 and 16.4.1; GHSA-673q-mjm6-r5xr (critical, remote code execution
+ *   through `use cache` functions that return typed arrays, Next.js 16 only, fixed in 16.4.1).
+ *   There is no 15.x floor: the pinned OpenNext has refused Next.js 15 since 21 October 2026, so every 15.x
+ *   release is refused with the minimum 16.4.1 instead of sending a customer to 15.5.28 and a failing build.
+ *   Earlier floors: GHSA-4jqv-mc3x-m676 and GHSA-mcj8-r9mp-w47p (fixed in 15.5.27 and 16.3.8);
+ *   GHSA-cjq9-62q9-8jv4, GHSA-f87g-xv8r-7p7x, GHSA-3w37-wq28-93x7, GHSA-h694-7cp9-m8p3 and
+ *   GHSA-39w2-rjm5-chcv (16.3.8).
  * @tanstack/react-start: GHSA-qx66-fv34-fjm8 (fixed in 1.168.60).
  * vite: GHSA-64vr-g452-qvp3 (fixed in 5.4.6), the only advisory affecting `vite build` output.
  * @type {FrameworkVersionPolicy}
@@ -27,7 +34,7 @@ export const FRAMEWORK_VERSION_POLICY = Object.freeze({
     floors: Object.freeze(["14.4.0"]),
     denied: Object.freeze([]),
   }),
-  next: Object.freeze({ floors: Object.freeze(["15.5.27", "16.3.8"]), denied: Object.freeze([]) }),
+  next: Object.freeze({ floors: Object.freeze(["16.4.1"]), denied: Object.freeze([]) }),
   vite: Object.freeze({ floors: Object.freeze(["5.4.6"]), denied: Object.freeze([]) }),
   "@tanstack/react-start": Object.freeze({
     floors: Object.freeze(["1.168.60"]),

package/src/packages/contracts/src/index.ts

@@ -209,6 +209,9 @@ function normalizeEgressOrigins(value: readonly string[] | undefined): readonly
 function forbiddenEgressHostname(hostname: string): boolean {
   const normalized = hostname.toLowerCase();
   return (
+    /^ohmyho-(?:mail|storage)-gateway-[a-z0-9][a-z0-9-]*\.[a-z0-9][a-z0-9-]*\.workers\.dev\.?$/u.test(
+      normalized,
+    ) ||
     normalized === "localhost" ||
     normalized.endsWith(".localhost") ||
     normalized.endsWith(".local") ||

package/src/packages/sdk-ts/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ohmyhost/sdk-ts",
-  "version": "0.1.37",
+  "version": "0.1.38",
   "private": true,
   "type": "module",
   "exports": {
@@ -14,7 +14,7 @@
     "build": "tsc --project tsconfig.build.json",
     "check": "pnpm --dir ../.. sdk-ts:check",
     "generate": "pnpm --dir ../.. sdk-ts:generate",
-    "typecheck": "tsc --project tsconfig.json --noEmit",
+    "typecheck": "tsc --project tsconfig.json --noEmit --incremental --tsBuildInfoFile typecheck.tsbuildinfo",
     "test": "pnpm run check && vitest run --root ../.. packages/sdk-ts"
   },
   "license": "Apache-2.0"

package/src/packages/workos-auth-contracts/package.json

@@ -32,7 +32,7 @@
   },
   "scripts": {
     "build": "tsc --project tsconfig.build.json",
-    "typecheck": "tsc --project tsconfig.json --noEmit",
+    "typecheck": "tsc --project tsconfig.json --noEmit --incremental --tsBuildInfoFile typecheck.tsbuildinfo",
     "test": "vitest run --root ../.. packages/workos-auth-contracts/src"
   },
   "license": "Apache-2.0"