@amerged/ohmyhost-cli 0.1.33 → 0.1.35

package/README.md

@@ -1,6 +1,6 @@
 # @amerged/ohmyhost-cli
 
-ohmyho.st cli client, version 0.1.33.
+ohmyho.st cli client, version 0.1.35.
 
 ```sh
 npm install --global @amerged/ohmyhost-cli

package/dist/bin.js

@@ -2,7 +2,7 @@
 import { createRequire as __ohmyhostCreateRequire } from "node:module"; const require = __ohmyhostCreateRequire(import.meta.url);
 import {
   runProductionCli
-} from "./chunk-3RDHFA76.js";
+} from "./chunk-ZQSLRNH6.js";
 import "./chunk-7D2RFLWM.js";
 
 // apps/product-cli/dist/bin.js

package/dist/{chunk-3RDHFA76.js → chunk-ZQSLRNH6.js}

@@ -34462,6 +34462,11 @@ import { dirname, isAbsolute, join, relative, resolve, sep } from "node:path";
 // packages/contracts/dist/framework-build-script.mjs
 var PINNED_BUN_VERSION = "1.2.22";
 var FRAMEWORK_VERSION_POLICY = Object.freeze({
+  astro: Object.freeze({ floors: Object.freeze(["7.4.0"]), denied: Object.freeze([]) }),
+  "@astrojs/cloudflare": Object.freeze({
+    floors: Object.freeze(["14.4.0"]),
+    denied: Object.freeze([])
+  }),
   next: Object.freeze({ floors: Object.freeze(["15.5.27", "16.3.8"]), denied: Object.freeze([]) }),
   vite: Object.freeze({ floors: Object.freeze(["5.4.6"]), denied: Object.freeze([]) }),
   "@tanstack/react-start": Object.freeze({
@@ -34539,6 +34544,8 @@ var TYPESCRIPT_BUILD_STAGE = /^tsc(?:[ \t]+(?:--noEmit|-b|--build))?$/u;
 function isAdmittedFrameworkBuildScript(framework, script) {
   if (typeof script !== "string")
     return false;
+  if (framework === "astro")
+    return script === "astro build";
   if (framework === "nextjs")
     return script === "next build" || script === "next build --webpack";
   if (framework !== "vite" && framework !== "tanstack-start")
@@ -34728,11 +34735,15 @@ function frameworkVersionDiagnostic(admission, lockfile) {
   });
 }
 var FRAMEWORK_VERSION_PACKAGES = Object.freeze([
+  "astro",
+  "@astrojs/cloudflare",
   "next",
   "vite",
   "@tanstack/react-start"
 ]);
 var FRAMEWORK_DEPENDENCY_PACKAGES = Object.freeze([
+  "astro",
+  "@astrojs/cloudflare",
   "next",
   "react",
   "react-dom",
@@ -34743,10 +34754,23 @@ var FRAMEWORK_DEPENDENCY_PACKAGES = Object.freeze([
   "@cloudflare/vite-plugin"
 ]);
 var REACT_PACKAGES = Object.freeze(["react", "react-dom"]);
-var BUILD_FRAMEWORKS = Object.freeze(["nextjs", "vite-static", "tanstack-start"]);
+var BUILD_FRAMEWORKS = Object.freeze([
+  "astro",
+  "nextjs",
+  "vite-static",
+  "tanstack-start"
+]);
 var PUSH_AND_PLAN = "Commit and push the change, then plan the new commit.";
 var VITE_BUILD_SCRIPT = '"vite build", optionally joined with && to one "tsc", "tsc -b", "tsc --build" or "tsc --noEmit" stage';
 var FRAMEWORK_CONVERSION_DETAILS = Object.freeze({
+  astro_template_import_unsupported: {
+    paths: ["module"],
+    template: '"{{path}}" uses a dynamic import, import.meta or require in an Astro template. Move server imports into frontmatter and dynamic browser imports into a normal statically imported browser module, then commit and push the change and plan the new commit.'
+  },
+  astro_config_unsupported: {
+    paths: ["framework_config"],
+    template: '"{{path}}" must use the standard Astro output directories and root base. For edge use output: "server", @astrojs/cloudflare with imageService: "passthrough", and session: false. Static hosting must omit a server adapter. Additional Cloudflare bindings, custom sessions and provider cache are not supported. Commit and push the change, then plan the new commit.'
+  },
   managed_auth_database_required: {
     paths: ["repository_config"],
     template: managedCustomerAuthDatabaseMessage("{{path}}")
@@ -34821,7 +34845,8 @@ var FRAMEWORK_CONVERSION_DETAILS = Object.freeze({
         text: {
           nextjs: 'exactly "next build" or "next build --webpack"; ohmyho.st adds the OpenNext build itself',
           "vite-static": VITE_BUILD_SCRIPT,
-          "tanstack-start": VITE_BUILD_SCRIPT
+          "tanstack-start": VITE_BUILD_SCRIPT,
+          astro: 'exactly "astro build"'
         }
       }
     },
@@ -34837,11 +34862,11 @@ var FRAMEWORK_CONVERSION_DETAILS = Object.freeze({
   },
   framework_unsupported: {
     paths: ["manifest"],
-    template: `"{{path}}" declares none of next, vite or @tanstack/react-start. Add the app's framework to dependencies, or set runtime.mode: functions in ohmyhost.yaml and add src/ohmyhost/worker.ts. ${PUSH_AND_PLAN}`
+    template: `"{{path}}" declares none of astro, next, vite or @tanstack/react-start. Add the app's framework to dependencies, or set runtime.mode: functions in ohmyhost.yaml and add src/ohmyhost/worker.ts. ${PUSH_AND_PLAN}`
   },
   framework_ambiguous: {
     paths: ["manifest"],
-    template: '"{{path}}" declares next together with vite or @tanstack/react-start, so ohmyho.st cannot choose one framework. Remove the packages of the framework this application does not use, commit and push the change, then plan the new commit.'
+    template: '"{{path}}" declares competing application framework packages, so ohmyho.st cannot choose one framework. Remove the packages of the framework this application does not use, commit and push the change, then plan the new commit.'
   },
   lockfile_missing: {
     paths: ["manifest"],
@@ -34880,7 +34905,8 @@ var FRAMEWORK_CONVERSION_DETAILS = Object.freeze({
         text: {
           nextjs: "runtime.mode: edge",
           "vite-static": "runtime.mode: edge with src/ohmyhost/companion.ts when database, auth, mail, storage or functions.crons is set, and static otherwise",
-          "tanstack-start": "runtime.mode: edge, or static without functions.crons and storage"
+          "tanstack-start": "runtime.mode: edge, or static without functions.crons and storage",
+          astro: "runtime.mode: static for prerendered sites, or edge with the Cloudflare adapter"
         }
       }
     },
@@ -34895,7 +34921,8 @@ var FRAMEWORK_CONVERSION_DETAILS = Object.freeze({
         text: {
           nextjs: ".open-next/assets",
           "vite-static": "dist",
-          "tanstack-start": "dist/client"
+          "tanstack-start": "dist/client",
+          astro: "dist for static, or dist/client for edge"
         }
       }
     },
@@ -34954,8 +34981,8 @@ var DETAIL_DEFINITIONS = FRAMEWORK_CONVERSION_DETAILS;
 var PLACEHOLDER = /\{\{([a-z]+)\}\}/gu;
 var PATH_PATTERN = "[A-Za-z0-9_@()[\\]./${}-]{1,240}";
 var SAFE_PATH = new RegExp(`^${PATH_PATTERN}$`, "u");
-var MODULE_PATH = /^[A-Za-z0-9_@()[\]./${}-]+\.(?:[cm]?[jt]sx?)$/u;
-var FRAMEWORK_CONFIG_NAME = /^(?:next|open-next|vite)\.config\.(?:js|mjs|ts)$/u;
+var MODULE_PATH = /^[A-Za-z0-9_@()[\]./${}-]+\.(?:astro|[cm]?[jt]sx?)$/u;
+var FRAMEWORK_CONFIG_NAME = /^(?:astro|next|open-next|vite)\.config\.(?:js|mjs|ts)$/u;
 var MAXIMUM_DETAIL_LENGTH = 2e3;
 var DETAIL_PATTERNS = Object.freeze(Object.entries(DETAIL_DEFINITIONS).map(([code, definition]) => Object.freeze({
   code,
@@ -37142,14 +37169,25 @@ function parseProjectCreditBudget(value) {
   return input;
 }
 var parseCurrentIdentity = (value) => {
-  const input = exactRecord2(value, ["actor_id", "organization_ids"]);
+  const input = exactRecord2(value, ["actor_id", "email", "organization_ids", "organizations"]);
+  const email = input["email"];
   const organizationIds = input["organization_ids"];
+  const organizations = input["organizations"];
   if (typeof input["actor_id"] !== "string" || input["actor_id"].length === 0 || input["actor_id"].length > 256 || [...input["actor_id"]].some((character) => {
     const codePoint = character.codePointAt(0) ?? 0;
     return codePoint <= 31 || codePoint === 127;
-  }) || !Array.isArray(organizationIds) || organizationIds.some((organizationId) => !isUlid(organizationId)) || new Set(organizationIds).size !== organizationIds.length) {
+  }) || email !== null && (!boundedString(email, 3, 254) || !/^[^\s@]+@[^\s@.]+(?:\.[^\s@.]+)+$/u.test(email) || /[\p{Cc}\p{Cf}\p{Zl}\p{Zp}]/u.test(email)) || !Array.isArray(organizationIds) || organizationIds.some((organizationId) => !isUlid(organizationId)) || new Set(organizationIds).size !== organizationIds.length || !Array.isArray(organizations) || organizations.length !== organizationIds.length) {
     throw new ResponseContractError();
   }
+  organizations.forEach((organization, index) => {
+    const entry = exactRecord2(organization, ["id", "name"]);
+    if (entry["id"] !== organizationIds[index] || !boundedString(entry["name"], 1, 128) || entry["name"].trim() !== entry["name"] || [...entry["name"]].some((character) => {
+      const codePoint = character.codePointAt(0) ?? 0;
+      return codePoint <= 31 || codePoint === 127;
+    })) {
+      throw new ResponseContractError();
+    }
+  });
   return input;
 };
 var parseAccountProfile = (value) => {
@@ -40628,7 +40666,7 @@ function exact3(v, keys) {
 // apps/product-cli/package.json
 var package_default = {
   name: "@ohmyhost/product-cli",
-  version: "0.1.33",
+  version: "0.1.35",
   private: true,
   ohmyhost: {
     deployment: "production",
@@ -40965,7 +41003,7 @@ var HELP_USAGE = Object.freeze({
   "project flag set": "ohmyhost project flag set --project ULID --enabled true|false --idempotency-key KEY --json (shows the small Powered by ohmyho.st flag on the production site; while it shows, this project's custom domain uses no domain credits and also works on Free, and each Paid period bought through Stripe adds 250 credits to the workspace, however many projects show the flag)",
   "project handle check": "ohmyhost project handle check --handle HANDLE --json (is this address free? answers with a reason and free alternatives; the address becomes HANDLE.check.omh.st)",
   "project handle set": "ohmyhost project handle set --project ULID --handle HANDLE --if-match ETAG --idempotency-key KEY --json (moves the project to a free address; the old one stops working and anyone may claim it)",
-  "database compute set": "ohmyhost database compute set --project ULID --environment dev|prod --profile standard|performance --idempotency-key KEY --yes [--wait] --json\n  standard: Free 0.25 CU/1 GB/60s idle, Paid 0.5 CU/2 GB/60s idle. performance: Paid 1 CU/4 GB/300s idle, 2.5x database compute credits per equal active minute; longer idle time also consumes credits.",
+  "database compute set": "ohmyhost database compute set --project ULID --environment dev|prod --profile standard|performance --idempotency-key KEY --yes [--wait] --json\n  standard: Free 0.25 CU/1 GB, Paid 0.5 CU/2 GB. performance: Paid 1 CU/4 GB, 2.5x database compute credits per equal active minute. All profiles use the provider-default idle suspension.",
   "database compute get": "ohmyhost database compute get --project ULID [--environment dev|prod] --json",
   "database write": "ohmyhost database write --project ULID --environment dev|prod --statement-file PATH --idempotency-key KEY [--parameters-json JSON] --yes --json",
   "database query": "ohmyhost database query --project ULID --environment dev|prod --statement SQL [--parameters-json JSON] --json",
@@ -47136,9 +47174,14 @@ var import_yaml2 = __toESM(require_dist(), 1);
 
 // packages/contracts/dist/framework-family.js
 function classifyFrameworkFamily(dependencies) {
+  const astro = dependencies.has("astro");
   const next = dependencies.has("next");
   const tanStack = dependencies.has("@tanstack/react-start");
   const vite = dependencies.has("vite");
+  if (astro && (next || tanStack))
+    return "ambiguous";
+  if (astro)
+    return "astro";
   if (next && (tanStack || vite))
     return "ambiguous";
   if (next)
@@ -47164,6 +47207,7 @@ var DEPENDENCY_FIELDS = Object.freeze({
   any: Object.freeze(["dependencies", "devDependencies", "optionalDependencies"])
 });
 var REQUIRED_DEPENDENCIES = Object.freeze({
+  astro: Object.freeze([["astro", "build"]]),
   nextjs: Object.freeze([
     ["next", "runtime"],
     ["react", "runtime"],
@@ -47182,6 +47226,7 @@ var REQUIRED_DEPENDENCIES = Object.freeze({
 });
 var TANSTACK_EDGE_DEPENDENCY = Object.freeze([CLOUDFLARE_PLUGIN, "build"]);
 var BUILD_SCRIPT_FRAMEWORKS = Object.freeze({
+  astro: "astro",
   nextjs: "nextjs",
   "vite-static": "vite",
   "tanstack-start": "tanstack-start"
@@ -47190,7 +47235,11 @@ var BUILD_OUTPUTS = Object.freeze({
   "vite-static": "dist",
   "tanstack-start": "dist/client"
 });
-var REQUIRED_CONFIG_PATHS = Object.freeze({ nextjs: "next.config.ts", "tanstack-start": "vite.config.ts" });
+var REQUIRED_CONFIG_PATHS = Object.freeze({
+  astro: "astro.config.mjs",
+  nextjs: "next.config.ts",
+  "tanstack-start": "vite.config.ts"
+});
 var POSTCSS_CONFIG_PATH = /^(?:postcss\.config\.(?:[cm]?js|json)|\.postcssrc\.(?:js|json))$/u;
 var TAILWIND_TURBOPACK_LOADER = "@tailwindcss/turbopack";
 var MAXIMUM_LOCKFILE_LENGTH = 5 * 1024 * 1024;
@@ -47252,7 +47301,7 @@ function viteCompanionRequired(configuration) {
 function frameworkVersionAdmissions(framework, manifest2, lockfile) {
   const admissions = [];
   let locked;
-  for (const [name, placement] of REQUIRED_DEPENDENCIES[framework]) {
+  for (const [name, placement] of framework === "astro" && declaredDependency(manifest2, "@astrojs/cloudflare", "build") !== null ? [...REQUIRED_DEPENDENCIES.astro, ["@astrojs/cloudflare", "build"]] : REQUIRED_DEPENDENCIES[framework]) {
     if (!isFrameworkVersionPackage(name))
       continue;
     const declared = declaredDependency(manifest2, name, placement);
@@ -47440,14 +47489,14 @@ function sourceWithoutComments(source) {
   return result;
 }
 function isDatabaseContractModule(path2) {
-  return /\.(?:ts|tsx|js|jsx|mjs|mts)$/u.test(path2) && !/\.d\.[cm]?ts$/u.test(path2);
+  return /\.(?:astro|ts|tsx|js|jsx|mjs|mts)$/u.test(path2) && !/\.d\.[cm]?ts$/u.test(path2);
 }
 function manifestFindings(input, versions) {
   const { configuration, framework, manifest: manifest2 } = input;
   const findings = [];
   if (framework !== "functions" && !isAdmittedFrameworkBuildScript(BUILD_SCRIPT_FRAMEWORKS[framework], ownValue(manifest2["scripts"], "build")))
     findings.push(diagnostic({ code: "build_script_unsupported", path: PACKAGE_MANIFEST2, framework }));
-  const required = framework === "tanstack-start" && configuration.runtime.mode === "edge" ? [...REQUIRED_DEPENDENCIES[framework], TANSTACK_EDGE_DEPENDENCY] : REQUIRED_DEPENDENCIES[framework];
+  const required = framework === "astro" && configuration.runtime.mode === "edge" ? [...REQUIRED_DEPENDENCIES.astro, ["@astrojs/cloudflare", "build"]] : framework === "tanstack-start" && configuration.runtime.mode === "edge" ? [...REQUIRED_DEPENDENCIES[framework], TANSTACK_EDGE_DEPENDENCY] : REQUIRED_DEPENDENCIES[framework];
   for (const [name, placement] of required)
     if (declaredDependency(manifest2, name, placement) === null)
       findings.push(diagnostic({
@@ -47481,14 +47530,14 @@ function configurationFindings(input) {
     findings.push(diagnostic({ code: "runtime_mode_unsupported", path: REPOSITORY_CONFIG, framework }));
   if (build !== null && framework !== "nextjs" && build.ssg_cache_max_mib !== void 0)
     findings.push(diagnostic({ code: "build_option_unsupported", path: REPOSITORY_CONFIG }));
-  const output = BUILD_OUTPUTS[framework];
+  const output = framework === "astro" ? configuration.runtime.mode === "edge" ? "dist/client" : "dist" : BUILD_OUTPUTS[framework];
   if (build !== null && output !== void 0 && build.output !== output)
     findings.push(diagnostic({ code: "build_output_unsupported", path: REPOSITORY_CONFIG, framework }));
   if (packageManager !== null && framework !== "nextjs" && (configuration.build.install !== packageManager.installCommand || build !== null && build.command !== packageManager.buildCommand))
     findings.push(diagnostic({ code: "build_command_mismatch", path: REPOSITORY_CONFIG }));
   if (framework === "vite-static" && viteCompanionRequired(configuration) && !files.includes(VITE_COMPANION_ENTRY_PATH))
     findings.push(diagnostic({ code: "companion_entry_required", path: VITE_COMPANION_ENTRY_PATH }));
-  if ((framework === "functions" || crons && (framework === "nextjs" || framework === "tanstack-start" && configuration.runtime.mode === "edge")) && !files.includes(WORKER_MODULE_PATH))
+  if ((framework === "functions" || crons && (framework === "nextjs" || framework === "astro" && configuration.runtime.mode === "edge" || framework === "tanstack-start" && configuration.runtime.mode === "edge")) && !files.includes(WORKER_MODULE_PATH))
     findings.push(diagnostic({ code: "worker_module_required", path: WORKER_MODULE_PATH }));
   if (managedCustomerAuthAdmissionIssue(configuration) !== null)
     findings.push(diagnostic({ code: "managed_auth_database_required", path: REPOSITORY_CONFIG }));
@@ -47496,6 +47545,8 @@ function configurationFindings(input) {
 }
 function runtimeModeAdmitted(framework, configuration, crons) {
   const mode = configuration.runtime.mode;
+  if (framework === "astro")
+    return mode === "edge" || mode === "static" && !crons && configuration.storage === void 0 && configuration.database?.enabled !== true && configuration.mail?.enabled !== true && configuration.auth?.provider !== "better-auth";
   if (framework === "nextjs")
     return mode === "edge";
   if (framework === "vite-static")
@@ -47510,6 +47561,8 @@ function frameworkConfigFindings(input) {
   if (frameworkConfig === null || framework === "functions")
     return [];
   const { path: path2, text } = frameworkConfig;
+  if (framework === "astro")
+    return astroConfigFindings(text, path2, input.configuration.runtime.mode);
   if (framework === "nextjs")
     return nextConfigFindings(text, path2, hasPostcssConfiguration(input));
   if (framework === "vite-static")
@@ -47534,7 +47587,7 @@ function repositoryConfiguration(text) {
 function frameworkConfigPath(framework, files, findings) {
   if (framework === "functions")
     return null;
-  const path2 = admitted(findings, () => resolveFrameworkConfig(framework === "nextjs" ? "next.config" : "vite.config", files));
+  const path2 = admitted(findings, () => resolveFrameworkConfig(framework === "astro" ? "astro.config" : framework === "nextjs" ? "next.config" : "vite.config", files));
   if (framework === "nextjs")
     admitted(findings, () => resolveFrameworkConfig("open-next.config", files));
   const required = REQUIRED_CONFIG_PATHS[framework];
@@ -47836,6 +47889,15 @@ function hasNamedImport(tokens, name, moduleName) {
 function hasModuleImport(tokens, moduleName) {
   return tokens.some((token, index) => token.value === "from" && tokens[index + 1]?.kind === "string" && tokens[index + 1]?.value === moduleName);
 }
+function astroConfigFindings(text, path2, mode) {
+  const lexed = lexFrameworkConfig(text, path2);
+  if ("finding" in lexed)
+    return [lexed.finding];
+  const tokens = lexed.tokens;
+  const hasPropertyKey = (items, name) => items.some((token, index) => token.value === name && items[index + 1]?.value === ":");
+  const invalid6 = hasNonRootProperty(tokens, ["base"], ["", "/"]) || ["srcDir", "outDir", "serverEntry", "client", "server", "assetsPrefix"].some((name) => hasPropertyKey(tokens, name)) || (mode === "edge" ? !text.includes("@astrojs/cloudflare") || !hasProperty(tokens, "output", "server") || !hasProperty(tokens, "session", "false") || !hasProperty(tokens, "imageService", "passthrough") || hasPropertyKey(tokens, "cache") : text.includes("@astrojs/cloudflare") || hasPropertyKey(tokens, "adapter") || hasProperty(tokens, "output", "server"));
+  return invalid6 ? [diagnostic({ code: "astro_config_unsupported", path: path2 })] : [];
+}
 
 // packages/contracts/dist/database-migration-errors.js
 var DatabaseMigrationAdmissionError = class extends Error {
@@ -48288,7 +48350,7 @@ async function initializeRepository(input) {
     const match = path2.match(/^supabase\/functions\/([^/]+)\//u);
     return match?.[1] === void 0 || match[1].startsWith("_") ? [] : [match[1]];
   }));
-  const apiRouteCount = applicationFiles.filter((path2) => /^(?:src\/)?app\/api\/.+\/route\.(?:js|jsx|ts|tsx)$/u.test(path2)).length;
+  const apiRouteCount = applicationFiles.filter((path2) => /^(?:src\/)?app\/api\/.+\/route\.(?:js|jsx|ts|tsx)$/u.test(path2) || framework === "astro" && /^src\/pages\/.+\.(?:js|ts)$/u.test(path2) && !path2.endsWith(".d.ts")).length;
   const supabase = dependencies.has("@supabase/supabase-js") || dependencies.has("@supabase/ssr");
   const configuredDatabase = existingConfiguration?.database?.enabled === true;
   const databaseProvider = supabaseMigrationCount > 0 ? "supabase" : postgresMigrationCount > 0 || configuredDatabase ? "postgresql" : "none";
@@ -48328,14 +48390,14 @@ async function initializeRepository(input) {
   const targetBetterAuth = existingConfiguration?.auth?.provider === "better-auth";
   const targetMail = existingConfiguration?.mail?.enabled === true;
   const targetStorage = r2 || supabaseStorage;
-  const tanStackRuntime = framework !== "tanstack-start" ? null : targetStorage ? "edge" : proposedTanStackRuntime(frameworkConfig, dependencies);
+  const tanStackRuntime = framework !== "tanstack-start" && framework !== "astro" ? null : targetStorage ? "edge" : framework === "astro" ? dependencies.has("@astrojs/cloudflare") ? "edge" : "static" : proposedTanStackRuntime(frameworkConfig, dependencies);
   const companionRequired = framework === "vite" && (existingConfiguration === null ? databaseProvider !== "none" || targetBetterAuth || targetMail || targetStorage || edgeFunctionNames.size > 0 || applicationFiles.includes(VITE_COMPANION_ENTRY_PATH) : viteCompanionRequired(existingConfiguration));
   const generatedConfigurationYaml = renderConfiguration({
     project,
     framework,
     packageManager,
     databaseProvider,
-    hasHealthcheck: applicationFiles.includes("src/app/api/health/route.ts") || applicationFiles.includes("app/api/health/route.ts"),
+    hasHealthcheck: applicationFiles.includes("src/app/api/health/route.ts") || applicationFiles.includes("app/api/health/route.ts") || framework === "astro" && applicationFiles.some((path2) => /^src\/pages\/api\/health(?:\/index)?\.(?:js|ts)$/u.test(path2)),
     mailEnabled: targetMail,
     betterAuthEnabled: targetBetterAuth,
     storageEnabled: targetStorage,
@@ -48453,7 +48515,7 @@ function requiredCatalogBlocker(diagnostic2, applicationRoot) {
 async function workerModuleBlockers(context) {
   const { config, framework, files } = context;
   const mode = config?.runtime.mode;
-  const scheduled = (config?.functions?.crons.length ?? 0) > 0 && (mode === "edge" && (framework === "vite" || framework === "nextjs" || framework === "tanstack-start") || mode === "functions" && framework === "functions");
+  const scheduled = (config?.functions?.crons.length ?? 0) > 0 && (mode === "edge" && (framework === "astro" || framework === "vite" || framework === "nextjs" || framework === "tanstack-start") || mode === "functions" && framework === "functions");
   const path2 = framework === "vite" ? VITE_COMPANION_ENTRY_PATH : WORKER_MODULE_PATH;
   if (framework !== "functions" && !scheduled || !files.includes(path2))
     return [];
@@ -48726,7 +48788,7 @@ function hasDirectSafeBuildCommand(manifest2, framework) {
   const scripts = manifest2["scripts"];
   if (!isRecord5(scripts) || typeof scripts["build"] !== "string")
     return false;
-  return (framework === "nextjs" || framework === "vite" || framework === "tanstack-start") && isAdmittedFrameworkBuildScript(framework, scripts["build"]);
+  return (framework === "astro" || framework === "nextjs" || framework === "vite" || framework === "tanstack-start") && isAdmittedFrameworkBuildScript(framework, scripts["build"]);
 }
 async function assertRepositoryRoot(root) {
   let information;
@@ -48832,11 +48894,11 @@ async function readResolvingLockfile(applicationDirectory, admission) {
   return text === null ? null : Object.freeze({ name: admission.lockfile, text });
 }
 async function readFrameworkConfig(applicationDirectory, files, framework) {
-  if (framework !== "nextjs" && framework !== "vite" && framework !== "tanstack-start")
+  if (framework !== "astro" && framework !== "nextjs" && framework !== "vite" && framework !== "tanstack-start")
     return null;
   let path2;
   try {
-    path2 = resolveFrameworkConfig(framework === "nextjs" ? "next.config" : "vite.config", files);
+    path2 = resolveFrameworkConfig(framework === "astro" ? "astro.config" : framework === "nextjs" ? "next.config" : "vite.config", files);
   } catch (error) {
     if (error instanceof FrameworkAdmissionError)
       return null;
@@ -48902,7 +48964,7 @@ function renderConfiguration(input) {
   let output = "dist";
   if (input.framework === "nextjs")
     output = ".open-next/assets";
-  else if (input.framework === "tanstack-start")
+  else if (input.framework === "tanstack-start" || input.framework === "astro" && input.tanStackRuntime === "edge")
     output = "dist/client";
   let mode = "auto";
   if (input.framework === "functions")

package/dist/index.js

@@ -99,7 +99,7 @@ import {
   selectWorkspace,
   verifiedUserId,
   workspaceOf
-} from "./chunk-3RDHFA76.js";
+} from "./chunk-ZQSLRNH6.js";
 import {
   CredentialStoreIntegrityError,
   CredentialStoreUnavailableError,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@amerged/ohmyhost-cli",
-  "version": "0.1.33",
+  "version": "0.1.35",
   "type": "module",
   "engines": {
     "node": ">=22"

package/src/apps/product-cli/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ohmyhost/product-cli",
-  "version": "0.1.33",
+  "version": "0.1.35",
   "private": true,
   "ohmyhost": {
     "deployment": "production",

package/src/apps/product-cli/src/cli.ts

@@ -399,7 +399,7 @@ const HELP_USAGE = Object.freeze({
     "ohmyhost project handle set --project ULID --handle HANDLE --if-match ETAG --idempotency-key KEY --json (moves the project to a free address; the old one stops working and anyone may claim it)",
   "database compute set":
     "ohmyhost database compute set --project ULID --environment dev|prod --profile standard|performance --idempotency-key KEY --yes [--wait] --json\n" +
-    "  standard: Free 0.25 CU/1 GB/60s idle, Paid 0.5 CU/2 GB/60s idle. performance: Paid 1 CU/4 GB/300s idle, 2.5x database compute credits per equal active minute; longer idle time also consumes credits.",
+    "  standard: Free 0.25 CU/1 GB, Paid 0.5 CU/2 GB. performance: Paid 1 CU/4 GB, 2.5x database compute credits per equal active minute. All profiles use the provider-default idle suspension.",
   "database compute get":
     "ohmyhost database compute get --project ULID [--environment dev|prod] --json",
   "database write":

package/src/apps/product-cli/src/repository-init.ts

@@ -310,8 +310,12 @@ export async function initializeRepository(
       return match?.[1] === undefined || match[1].startsWith("_") ? [] : [match[1]];
     }),
   );
-  const apiRouteCount = applicationFiles.filter((path) =>
-    /^(?:src\/)?app\/api\/.+\/route\.(?:js|jsx|ts|tsx)$/u.test(path),
+  const apiRouteCount = applicationFiles.filter(
+    (path) =>
+      /^(?:src\/)?app\/api\/.+\/route\.(?:js|jsx|ts|tsx)$/u.test(path) ||
+      (framework === "astro" &&
+        /^src\/pages\/.+\.(?:js|ts)$/u.test(path) &&
+        !path.endsWith(".d.ts")),
   ).length;
   const supabase = dependencies.has("@supabase/supabase-js") || dependencies.has("@supabase/ssr");
   const configuredDatabase = existingConfiguration?.database?.enabled === true;
@@ -368,11 +372,15 @@ export async function initializeRepository(
   const targetStorage = r2 || supabaseStorage;
   // TanStack Start binds storage only on edge, as a Vite app does through its companion.
   const tanStackRuntime =
-    framework !== "tanstack-start"
+    framework !== "tanstack-start" && framework !== "astro"
       ? null
       : targetStorage
         ? "edge"
-        : proposedTanStackRuntime(frameworkConfig, dependencies);
+        : framework === "astro"
+          ? dependencies.has("@astrojs/cloudflare")
+            ? "edge"
+            : "static"
+          : proposedTanStackRuntime(frameworkConfig, dependencies);
   const companionRequired =
     framework === "vite" &&
     (existingConfiguration === null
@@ -390,7 +398,11 @@ export async function initializeRepository(
     databaseProvider,
     hasHealthcheck:
       applicationFiles.includes("src/app/api/health/route.ts") ||
-      applicationFiles.includes("app/api/health/route.ts"),
+      applicationFiles.includes("app/api/health/route.ts") ||
+      (framework === "astro" &&
+        applicationFiles.some((path) =>
+          /^src\/pages\/api\/health(?:\/index)?\.(?:js|ts)$/u.test(path),
+        )),
     mailEnabled: targetMail,
     betterAuthEnabled: targetBetterAuth,
     storageEnabled: targetStorage,
@@ -596,7 +608,10 @@ async function workerModuleBlockers(context: SourceCheckContext): Promise<Reposi
   const scheduled =
     (config?.functions?.crons.length ?? 0) > 0 &&
     ((mode === "edge" &&
-      (framework === "vite" || framework === "nextjs" || framework === "tanstack-start")) ||
+      (framework === "astro" ||
+        framework === "vite" ||
+        framework === "nextjs" ||
+        framework === "tanstack-start")) ||
       (mode === "functions" && framework === "functions"));
   const path = framework === "vite" ? VITE_COMPANION_ENTRY_PATH : WORKER_MODULE_PATH;
   if ((framework !== "functions" && !scheduled) || !files.includes(path)) return [];
@@ -989,7 +1004,10 @@ function hasDirectSafeBuildCommand(
   const scripts = manifest["scripts"];
   if (!isRecord(scripts) || typeof scripts["build"] !== "string") return false;
   return (
-    (framework === "nextjs" || framework === "vite" || framework === "tanstack-start") &&
+    (framework === "astro" ||
+      framework === "nextjs" ||
+      framework === "vite" ||
+      framework === "tanstack-start") &&
     isAdmittedFrameworkBuildScript(framework, scripts["build"])
   );
 }
@@ -1144,10 +1162,23 @@ async function readFrameworkConfig(
   files: readonly string[],
   framework: RepositoryFramework,
 ): Promise<FrameworkConfigText | null> {
-  if (framework !== "nextjs" && framework !== "vite" && framework !== "tanstack-start") return null;
+  if (
+    framework !== "astro" &&
+    framework !== "nextjs" &&
+    framework !== "vite" &&
+    framework !== "tanstack-start"
+  )
+    return null;
   let path: string | null;
   try {
-    path = resolveFrameworkConfig(framework === "nextjs" ? "next.config" : "vite.config", files);
+    path = resolveFrameworkConfig(
+      framework === "astro"
+        ? "astro.config"
+        : framework === "nextjs"
+          ? "next.config"
+          : "vite.config",
+      files,
+    );
   } catch (error) {
     // The shared rules name the ambiguous variants; none of them is judged.
     if (error instanceof FrameworkAdmissionError) return null;
@@ -1266,7 +1297,11 @@ function renderConfiguration(input: {
 
   let output = "dist";
   if (input.framework === "nextjs") output = ".open-next/assets";
-  else if (input.framework === "tanstack-start") output = "dist/client";
+  else if (
+    input.framework === "tanstack-start" ||
+    (input.framework === "astro" && input.tanStackRuntime === "edge")
+  )
+    output = "dist/client";
 
   let mode = "auto";
   if (input.framework === "functions") mode = "functions";

package/src/apps/product-cli/src/runtime-contract.ts

@@ -63,7 +63,9 @@ export interface SafeProblem {
 
 export interface PublicCurrentIdentity {
   readonly actor_id: string;
+  readonly email: string | null;
   readonly organization_ids: readonly string[];
+  readonly organizations: readonly { readonly id: string; readonly name: string }[];
 }
 
 /** One workspace the signed-in user belongs to, with the provider identity a selection needs. */
@@ -635,8 +637,10 @@ export function parseProjectCreditBudget(value: unknown): ProjectCreditBudget {
 }
 
 export const parseCurrentIdentity = (value: unknown): PublicCurrentIdentity => {
-  const input = exactRecord(value, ["actor_id", "organization_ids"]);
+  const input = exactRecord(value, ["actor_id", "email", "organization_ids", "organizations"]);
+  const email = input["email"];
   const organizationIds = input["organization_ids"];
+  const organizations = input["organizations"];
   if (
     typeof input["actor_id"] !== "string" ||
     input["actor_id"].length === 0 ||
@@ -645,12 +649,32 @@ export const parseCurrentIdentity = (value: unknown): PublicCurrentIdentity => {
       const codePoint = character.codePointAt(0) ?? 0;
       return codePoint <= 31 || codePoint === 127;
     }) ||
+    (email !== null &&
+      (!boundedString(email, 3, 254) ||
+        !/^[^\s@]+@[^\s@.]+(?:\.[^\s@.]+)+$/u.test(email) ||
+        /[\p{Cc}\p{Cf}\p{Zl}\p{Zp}]/u.test(email))) ||
     !Array.isArray(organizationIds) ||
     organizationIds.some((organizationId) => !isUlid(organizationId)) ||
-    new Set(organizationIds).size !== organizationIds.length
+    new Set(organizationIds).size !== organizationIds.length ||
+    !Array.isArray(organizations) ||
+    organizations.length !== organizationIds.length
   ) {
     throw new ResponseContractError();
   }
+  organizations.forEach((organization: unknown, index) => {
+    const entry = exactRecord(organization, ["id", "name"]);
+    if (
+      entry["id"] !== organizationIds[index] ||
+      !boundedString(entry["name"], 1, 128) ||
+      entry["name"].trim() !== entry["name"] ||
+      [...entry["name"]].some((character) => {
+        const codePoint = character.codePointAt(0) ?? 0;
+        return codePoint <= 31 || codePoint === 127;
+      })
+    ) {
+      throw new ResponseContractError();
+    }
+  });
   return input as unknown as PublicCurrentIdentity;
 };
 

package/src/packages/contracts/src/framework-admission.ts

@@ -19,7 +19,11 @@ export type LockfileName =
   | "package-lock.json"
   | "pnpm-lock.yaml"
   | "yarn.lock";
-export type FrameworkConfigBasename = "next.config" | "open-next.config" | "vite.config";
+export type FrameworkConfigBasename =
+  | "astro.config"
+  | "next.config"
+  | "open-next.config"
+  | "vite.config";
 
 export type FrameworkAdmissionReason =
   | "ambiguous_config"
@@ -311,11 +315,15 @@ interface DetailDefinition {
 }
 
 const FRAMEWORK_VERSION_PACKAGES = Object.freeze([
+  "astro",
+  "@astrojs/cloudflare",
   "next",
   "vite",
   "@tanstack/react-start",
 ] as const satisfies readonly FrameworkVersionPackage[]);
 const FRAMEWORK_DEPENDENCY_PACKAGES = Object.freeze([
+  "astro",
+  "@astrojs/cloudflare",
   "next",
   "react",
   "react-dom",
@@ -326,7 +334,12 @@ const FRAMEWORK_DEPENDENCY_PACKAGES = Object.freeze([
   "@cloudflare/vite-plugin",
 ] as const);
 const REACT_PACKAGES = Object.freeze(["react", "react-dom"] as const);
-const BUILD_FRAMEWORKS = Object.freeze(["nextjs", "vite-static", "tanstack-start"] as const);
+const BUILD_FRAMEWORKS = Object.freeze([
+  "astro",
+  "nextjs",
+  "vite-static",
+  "tanstack-start",
+] as const);
 
 const PUSH_AND_PLAN = "Commit and push the change, then plan the new commit.";
 const VITE_BUILD_SCRIPT =
@@ -335,6 +348,16 @@ const VITE_BUILD_SCRIPT =
 // Each sentence names the file, the rule and the exact change. Render and parse both derive from
 // the template, so a client maps a detail back to exactly one typed diagnostic.
 const FRAMEWORK_CONVERSION_DETAILS = Object.freeze({
+  astro_template_import_unsupported: {
+    paths: ["module"],
+    template:
+      '"{{path}}" uses a dynamic import, import.meta or require in an Astro template. Move server imports into frontmatter and dynamic browser imports into a normal statically imported browser module, then commit and push the change and plan the new commit.',
+  },
+  astro_config_unsupported: {
+    paths: ["framework_config"],
+    template:
+      '"{{path}}" must use the standard Astro output directories and root base. For edge use output: "server", @astrojs/cloudflare with imageService: "passthrough", and session: false. Static hosting must omit a server adapter. Additional Cloudflare bindings, custom sessions and provider cache are not supported. Commit and push the change, then plan the new commit.',
+  },
   managed_auth_database_required: {
     paths: ["repository_config"],
     template: managedCustomerAuthDatabaseMessage("{{path}}"),
@@ -417,6 +440,7 @@ const FRAMEWORK_CONVERSION_DETAILS = Object.freeze({
             'exactly "next build" or "next build --webpack"; ohmyho.st adds the OpenNext build itself',
           "vite-static": VITE_BUILD_SCRIPT,
           "tanstack-start": VITE_BUILD_SCRIPT,
+          astro: 'exactly "astro build"',
         },
       },
     },
@@ -435,12 +459,12 @@ const FRAMEWORK_CONVERSION_DETAILS = Object.freeze({
   },
   framework_unsupported: {
     paths: ["manifest"],
-    template: `"{{path}}" declares none of next, vite or @tanstack/react-start. Add the app's framework to dependencies, or set runtime.mode: functions in ohmyhost.yaml and add src/ohmyhost/worker.ts. ${PUSH_AND_PLAN}`,
+    template: `"{{path}}" declares none of astro, next, vite or @tanstack/react-start. Add the app's framework to dependencies, or set runtime.mode: functions in ohmyhost.yaml and add src/ohmyhost/worker.ts. ${PUSH_AND_PLAN}`,
   },
   framework_ambiguous: {
     paths: ["manifest"],
     template:
-      '"{{path}}" declares next together with vite or @tanstack/react-start, so ohmyho.st cannot choose one framework. Remove the packages of the framework this application does not use, commit and push the change, then plan the new commit.',
+      '"{{path}}" declares competing application framework packages, so ohmyho.st cannot choose one framework. Remove the packages of the framework this application does not use, commit and push the change, then plan the new commit.',
   },
   lockfile_missing: {
     paths: ["manifest"],
@@ -487,6 +511,7 @@ const FRAMEWORK_CONVERSION_DETAILS = Object.freeze({
           "vite-static":
             "runtime.mode: edge with src/ohmyhost/companion.ts when database, auth, mail, storage or functions.crons is set, and static otherwise",
           "tanstack-start": "runtime.mode: edge, or static without functions.crons and storage",
+          astro: "runtime.mode: static for prerendered sites, or edge with the Cloudflare adapter",
         },
       },
     },
@@ -502,6 +527,7 @@ const FRAMEWORK_CONVERSION_DETAILS = Object.freeze({
           nextjs: ".open-next/assets",
           "vite-static": "dist",
           "tanstack-start": "dist/client",
+          astro: "dist for static, or dist/client for edge",
         },
       },
     },
@@ -585,8 +611,8 @@ const DETAIL_DEFINITIONS: Readonly<Record<FrameworkConversionDiagnosticCode, Det
 const PLACEHOLDER = /\{\{([a-z]+)\}\}/gu;
 const PATH_PATTERN = "[A-Za-z0-9_@()[\\]./${}-]{1,240}";
 const SAFE_PATH = new RegExp(`^${PATH_PATTERN}$`, "u");
-const MODULE_PATH = /^[A-Za-z0-9_@()[\]./${}-]+\.(?:[cm]?[jt]sx?)$/u;
-const FRAMEWORK_CONFIG_NAME = /^(?:next|open-next|vite)\.config\.(?:js|mjs|ts)$/u;
+const MODULE_PATH = /^[A-Za-z0-9_@()[\]./${}-]+\.(?:astro|[cm]?[jt]sx?)$/u;
+const FRAMEWORK_CONFIG_NAME = /^(?:astro|next|open-next|vite)\.config\.(?:js|mjs|ts)$/u;
 // The public problem detail bound; every rendered sentence stays far below it.
 const MAXIMUM_DETAIL_LENGTH = 2_000;
 const DETAIL_PATTERNS = Object.freeze(

package/src/packages/contracts/src/framework-build-script.mjs

@@ -1,7 +1,7 @@
 export const PINNED_BUN_VERSION = "1.2.22";
 
 /**
- * @typedef {"next" | "vite" | "@tanstack/react-start"} FrameworkVersionPackage
+ * @typedef {"next" | "vite" | "astro" | "@astrojs/cloudflare" | "@tanstack/react-start"} FrameworkVersionPackage
  * @typedef {Readonly<{
  *   floors: readonly string[];
  *   denied: readonly (readonly [string, string | null])[];
@@ -22,6 +22,11 @@ export const PINNED_BUN_VERSION = "1.2.22";
  * @type {FrameworkVersionPolicy}
  */
 export const FRAMEWORK_VERSION_POLICY = Object.freeze({
+  astro: Object.freeze({ floors: Object.freeze(["7.4.0"]), denied: Object.freeze([]) }),
+  "@astrojs/cloudflare": Object.freeze({
+    floors: Object.freeze(["14.4.0"]),
+    denied: Object.freeze([]),
+  }),
   next: Object.freeze({ floors: Object.freeze(["15.5.27", "16.3.8"]), denied: Object.freeze([]) }),
   vite: Object.freeze({ floors: Object.freeze(["5.4.6"]), denied: Object.freeze([]) }),
   "@tanstack/react-start": Object.freeze({
@@ -164,12 +169,13 @@ const TYPESCRIPT_BUILD_STAGE = /^tsc(?:[ \t]+(?:--noEmit|-b|--build))?$/u;
 
 /**
  * The same source is consumed by local admission, framework adapters and the build sandbox.
- * @param {"nextjs" | "tanstack-start" | "vite"} framework
+ * @param {"astro" | "nextjs" | "tanstack-start" | "vite"} framework
  * @param {unknown} script
  * @returns {boolean}
  */
 export function isAdmittedFrameworkBuildScript(framework, script) {
   if (typeof script !== "string") return false;
+  if (framework === "astro") return script === "astro build";
   if (framework === "nextjs") return script === "next build" || script === "next build --webpack";
   if (framework !== "vite" && framework !== "tanstack-start") return false;
   const stages = script.trim().split(/[ \t]*&&[ \t]*/u);

package/src/packages/contracts/src/framework-family.ts

@@ -1,4 +1,5 @@
 export type FrameworkFamilyClassification =
+  | "astro"
   | "ambiguous"
   | "nextjs"
   | "tanstack-start"
@@ -8,9 +9,12 @@ export type FrameworkFamilyClassification =
 export function classifyFrameworkFamily(
   dependencies: ReadonlySet<string>,
 ): FrameworkFamilyClassification {
+  const astro = dependencies.has("astro");
   const next = dependencies.has("next");
   const tanStack = dependencies.has("@tanstack/react-start");
   const vite = dependencies.has("vite");
+  if (astro && (next || tanStack)) return "ambiguous";
+  if (astro) return "astro";
   if (next && (tanStack || vite)) return "ambiguous";
   if (next) return "nextjs";
   if (tanStack) return "tanstack-start";

package/src/packages/contracts/src/framework-source-rules.ts

@@ -40,7 +40,12 @@ export const WORKER_MODULE_PATH = "src/ohmyhost/worker.ts" as const;
 /** The Worker module of a Vite application with a server runtime. */
 export const VITE_COMPANION_ENTRY_PATH = "src/ohmyhost/companion.ts" as const;
 
-export type FrameworkSourceFramework = "functions" | "nextjs" | "tanstack-start" | "vite-static";
+export type FrameworkSourceFramework =
+  | "astro"
+  | "functions"
+  | "nextjs"
+  | "tanstack-start"
+  | "vite-static";
 export type PackageManifest = Readonly<Record<string, unknown>>;
 /**
  * Where package.json may declare a dependency: `runtime` only in dependencies, `build` also in
@@ -91,6 +96,7 @@ const DEPENDENCY_FIELDS = Object.freeze({
 // Next.js and TanStack Start load their runtime packages in the server bundle, so package.json
 // declares them in dependencies; Vite and its plugins only build, so devDependencies suffice.
 const REQUIRED_DEPENDENCIES = Object.freeze({
+  astro: Object.freeze([["astro", "build"]] as const),
   nextjs: Object.freeze([
     ["next", "runtime"],
     ["react", "runtime"],
@@ -109,6 +115,7 @@ const REQUIRED_DEPENDENCIES = Object.freeze({
 } satisfies Record<FrameworkSourceFramework, readonly (readonly [string, DependencyPlacement])[]>);
 const TANSTACK_EDGE_DEPENDENCY = Object.freeze([CLOUDFLARE_PLUGIN, "build"] as const);
 const BUILD_SCRIPT_FRAMEWORKS = Object.freeze({
+  astro: "astro",
   nextjs: "nextjs",
   "vite-static": "vite",
   "tanstack-start": "tanstack-start",
@@ -118,7 +125,11 @@ const BUILD_OUTPUTS: Readonly<Partial<Record<FrameworkSourceFramework, string>>>
   "tanstack-start": "dist/client",
 });
 const REQUIRED_CONFIG_PATHS: Readonly<Partial<Record<FrameworkSourceFramework, string>>> =
-  Object.freeze({ nextjs: "next.config.ts", "tanstack-start": "vite.config.ts" });
+  Object.freeze({
+    astro: "astro.config.mjs",
+    nextjs: "next.config.ts",
+    "tanstack-start": "vite.config.ts",
+  });
 // The PostCSS configuration the Next.js Webpack build reads: package.json "postcss" or one of these
 // files at the application root. It never reads a TypeScript one such as postcss.config.ts.
 const POSTCSS_CONFIG_PATH = /^(?:postcss\.config\.(?:[cm]?js|json)|\.postcssrc\.(?:js|json))$/u;
@@ -214,7 +225,10 @@ export function frameworkVersionAdmissions(
 ): readonly FrameworkVersionAdmission[] {
   const admissions: FrameworkVersionAdmission[] = [];
   let locked: ((packageName: string) => string | null) | undefined;
-  for (const [name, placement] of REQUIRED_DEPENDENCIES[framework]) {
+  for (const [name, placement] of framework === "astro" &&
+  declaredDependency(manifest, "@astrojs/cloudflare", "build") !== null
+    ? [...REQUIRED_DEPENDENCIES.astro, ["@astrojs/cloudflare", "build"] as const]
+    : REQUIRED_DEPENDENCIES[framework]) {
     if (!isFrameworkVersionPackage(name)) continue;
     const declared = declaredDependency(manifest, name, placement);
     if (declared === null) continue;
@@ -504,7 +518,7 @@ export function sourceWithoutComments(source: string): string {
  * extensions planning reads, without TypeScript declaration files, which never run.
  */
 export function isDatabaseContractModule(path: string): boolean {
-  return /\.(?:ts|tsx|js|jsx|mjs|mts)$/u.test(path) && !/\.d\.[cm]?ts$/u.test(path);
+  return /\.(?:astro|ts|tsx|js|jsx|mjs|mts)$/u.test(path) && !/\.d\.[cm]?ts$/u.test(path);
 }
 
 function manifestFindings(
@@ -524,9 +538,11 @@ function manifestFindings(
       diagnostic({ code: "build_script_unsupported", path: PACKAGE_MANIFEST, framework }),
     );
   const required =
-    framework === "tanstack-start" && configuration.runtime.mode === "edge"
-      ? [...REQUIRED_DEPENDENCIES[framework], TANSTACK_EDGE_DEPENDENCY]
-      : REQUIRED_DEPENDENCIES[framework];
+    framework === "astro" && configuration.runtime.mode === "edge"
+      ? [...REQUIRED_DEPENDENCIES.astro, ["@astrojs/cloudflare", "build"] as const]
+      : framework === "tanstack-start" && configuration.runtime.mode === "edge"
+        ? [...REQUIRED_DEPENDENCIES[framework], TANSTACK_EDGE_DEPENDENCY]
+        : REQUIRED_DEPENDENCIES[framework];
   for (const [name, placement] of required)
     if (declaredDependency(manifest, name, placement) === null)
       findings.push(
@@ -567,7 +583,12 @@ function configurationFindings(input: FrameworkSourceRuleInput): FrameworkConver
     );
   if (build !== null && framework !== "nextjs" && build.ssg_cache_max_mib !== undefined)
     findings.push(diagnostic({ code: "build_option_unsupported", path: REPOSITORY_CONFIG }));
-  const output = BUILD_OUTPUTS[framework];
+  const output =
+    framework === "astro"
+      ? configuration.runtime.mode === "edge"
+        ? "dist/client"
+        : "dist"
+      : BUILD_OUTPUTS[framework];
   if (build !== null && output !== undefined && build.output !== output)
     findings.push(
       diagnostic({ code: "build_output_unsupported", path: REPOSITORY_CONFIG, framework }),
@@ -592,6 +613,7 @@ function configurationFindings(input: FrameworkSourceRuleInput): FrameworkConver
     (framework === "functions" ||
       (crons &&
         (framework === "nextjs" ||
+          (framework === "astro" && configuration.runtime.mode === "edge") ||
           (framework === "tanstack-start" && configuration.runtime.mode === "edge")))) &&
     !files.includes(WORKER_MODULE_PATH)
   )
@@ -607,6 +629,16 @@ function runtimeModeAdmitted(
   crons: boolean,
 ): boolean {
   const mode = configuration.runtime.mode;
+  if (framework === "astro")
+    return (
+      mode === "edge" ||
+      (mode === "static" &&
+        !crons &&
+        configuration.storage === undefined &&
+        configuration.database?.enabled !== true &&
+        configuration.mail?.enabled !== true &&
+        configuration.auth?.provider !== "better-auth")
+    );
   if (framework === "nextjs") return mode === "edge";
   if (framework === "vite-static")
     return mode === (viteCompanionRequired(configuration) ? "edge" : "static");
@@ -629,6 +661,8 @@ function frameworkConfigFindings(
   const { frameworkConfig, framework } = input;
   if (frameworkConfig === null || framework === "functions") return [];
   const { path, text } = frameworkConfig;
+  if (framework === "astro")
+    return astroConfigFindings(text, path, input.configuration.runtime.mode);
   if (framework === "nextjs") return nextConfigFindings(text, path, hasPostcssConfiguration(input));
   if (framework === "vite-static") return viteConfigFindings(text, path);
   const mode = input.configuration.runtime.mode;
@@ -660,7 +694,14 @@ function frameworkConfigPath(
 ): string | null {
   if (framework === "functions") return null;
   const path = admitted(findings, () =>
-    resolveFrameworkConfig(framework === "nextjs" ? "next.config" : "vite.config", files),
+    resolveFrameworkConfig(
+      framework === "astro"
+        ? "astro.config"
+        : framework === "nextjs"
+          ? "next.config"
+          : "vite.config",
+      files,
+    ),
   );
   if (framework === "nextjs")
     admitted(findings, () => resolveFrameworkConfig("open-next.config", files));
@@ -1116,3 +1157,31 @@ function hasModuleImport(tokens: readonly ConfigToken[], moduleName: string): bo
       tokens[index + 1]?.value === moduleName,
   );
 }
+
+/** Astro's build validates executable config; admission rejects known incompatible contracts. */
+function astroConfigFindings(
+  text: string,
+  path: string,
+  mode: string,
+): readonly FrameworkConversionDiagnostic[] {
+  const lexed = lexFrameworkConfig(text, path);
+  if ("finding" in lexed) return [lexed.finding];
+  const tokens = lexed.tokens;
+  const hasPropertyKey = (items: readonly ConfigToken[], name: string) =>
+    items.some((token, index) => token.value === name && items[index + 1]?.value === ":");
+  const invalid =
+    hasNonRootProperty(tokens, ["base"], ["", "/"]) ||
+    ["srcDir", "outDir", "serverEntry", "client", "server", "assetsPrefix"].some((name) =>
+      hasPropertyKey(tokens, name),
+    ) ||
+    (mode === "edge"
+      ? !text.includes("@astrojs/cloudflare") ||
+        !hasProperty(tokens, "output", "server") ||
+        !hasProperty(tokens, "session", "false") ||
+        !hasProperty(tokens, "imageService", "passthrough") ||
+        hasPropertyKey(tokens, "cache")
+      : text.includes("@astrojs/cloudflare") ||
+        hasPropertyKey(tokens, "adapter") ||
+        hasProperty(tokens, "output", "server"));
+  return invalid ? [diagnostic({ code: "astro_config_unsupported", path })] : [];
+}

package/src/packages/sdk-ts/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ohmyhost/sdk-ts",
-  "version": "0.1.33",
+  "version": "0.1.35",
   "private": true,
   "type": "module",
   "exports": {

package/src/packages/sdk-ts/src/generated/sdk.gen.ts

@@ -945,7 +945,7 @@ export const completeCloudflareDnsAuthorization = <ThrowOnError extends boolean
 /**
  * Get the current authenticated identity
  *
- * Returns the stable ohmyhost actor and internal organization identifiers derived from the bearer credential.
+ * Returns the stable ohmyhost actor, the current user's or API-key owner's email, and the credential's organization scope with current display names. Machine-to-machine credentials have a null email. Organizations match organization_ids in the same order.
  */
 export const getCurrentIdentity = <ThrowOnError extends boolean = true>(
   parameters?: {

package/src/packages/sdk-ts/src/generated/types.gen.ts

@@ -1148,11 +1148,25 @@ export type OrganizationAccount = {
 };
 
 /**
- * Minimal customer-visible identity and organization scope for authenticated agent clients.
+ * Customer-visible current account and credential organization scope for authenticated agent clients.
  */
 export type CurrentIdentity = {
   actor_id: string;
+  /**
+   * Email of the current user or user API-key owner; null for machine-to-machine credentials.
+   */
+  email: string | null;
   organization_ids: Array<Ulid>;
+  /**
+   * Current names for exactly the organization_ids scope, in the same order.
+   */
+  organizations: Array<{
+    id: Ulid;
+    /**
+     * Current organization display name without surrounding whitespace or ASCII control characters.
+     */
+    name: string;
+  }>;
 };
 
 export type Project = {