@amerged/ohmyhost-mcp 0.1.33 → 0.1.35

package/dist/stdio-main.js

@@ -30,7 +30,7 @@ import {
   serverIdentityOf,
   setNegotiatedProtocolVersion,
   validateEnvelopeMeta
-} from "./chunk-YM2ZQAGS.js";
+} from "./chunk-CVTJZFHD.js";
 
 // node_modules/.pnpm/ignore@7.0.12/node_modules/ignore/index.js
 var require_ignore = __commonJS({
@@ -20235,6 +20235,11 @@ function toError(value) {
 // packages/contracts/dist/framework-build-script.mjs
 var PINNED_BUN_VERSION = "1.2.22";
 var FRAMEWORK_VERSION_POLICY = Object.freeze({
+  astro: Object.freeze({ floors: Object.freeze(["7.4.0"]), denied: Object.freeze([]) }),
+  "@astrojs/cloudflare": Object.freeze({
+    floors: Object.freeze(["14.4.0"]),
+    denied: Object.freeze([])
+  }),
   next: Object.freeze({ floors: Object.freeze(["15.5.27", "16.3.8"]), denied: Object.freeze([]) }),
   vite: Object.freeze({ floors: Object.freeze(["5.4.6"]), denied: Object.freeze([]) }),
   "@tanstack/react-start": Object.freeze({
@@ -20289,11 +20294,15 @@ var RESOLVED_VERSION_FIELD = anchoredPattern(RESOLVED_VERSION_SOURCE);
 var DECLARED_VERSION_FIELD = anchoredPattern(`[~^]?${RESOLVED_VERSION_SOURCE}`);
 var STABLE_VERSION_FIELD = anchoredPattern(STABLE_VERSION_SOURCE);
 var FRAMEWORK_VERSION_PACKAGES = Object.freeze([
+  "astro",
+  "@astrojs/cloudflare",
   "next",
   "vite",
   "@tanstack/react-start"
 ]);
 var FRAMEWORK_DEPENDENCY_PACKAGES = Object.freeze([
+  "astro",
+  "@astrojs/cloudflare",
   "next",
   "react",
   "react-dom",
@@ -20304,10 +20313,23 @@ var FRAMEWORK_DEPENDENCY_PACKAGES = Object.freeze([
   "@cloudflare/vite-plugin"
 ]);
 var REACT_PACKAGES = Object.freeze(["react", "react-dom"]);
-var BUILD_FRAMEWORKS = Object.freeze(["nextjs", "vite-static", "tanstack-start"]);
+var BUILD_FRAMEWORKS = Object.freeze([
+  "astro",
+  "nextjs",
+  "vite-static",
+  "tanstack-start"
+]);
 var PUSH_AND_PLAN = "Commit and push the change, then plan the new commit.";
 var VITE_BUILD_SCRIPT = '"vite build", optionally joined with && to one "tsc", "tsc -b", "tsc --build" or "tsc --noEmit" stage';
 var FRAMEWORK_CONVERSION_DETAILS = Object.freeze({
+  astro_template_import_unsupported: {
+    paths: ["module"],
+    template: '"{{path}}" uses a dynamic import, import.meta or require in an Astro template. Move server imports into frontmatter and dynamic browser imports into a normal statically imported browser module, then commit and push the change and plan the new commit.'
+  },
+  astro_config_unsupported: {
+    paths: ["framework_config"],
+    template: '"{{path}}" must use the standard Astro output directories and root base. For edge use output: "server", @astrojs/cloudflare with imageService: "passthrough", and session: false. Static hosting must omit a server adapter. Additional Cloudflare bindings, custom sessions and provider cache are not supported. Commit and push the change, then plan the new commit.'
+  },
   managed_auth_database_required: {
     paths: ["repository_config"],
     template: managedCustomerAuthDatabaseMessage("{{path}}")
@@ -20382,7 +20404,8 @@ var FRAMEWORK_CONVERSION_DETAILS = Object.freeze({
         text: {
           nextjs: 'exactly "next build" or "next build --webpack"; ohmyho.st adds the OpenNext build itself',
           "vite-static": VITE_BUILD_SCRIPT,
-          "tanstack-start": VITE_BUILD_SCRIPT
+          "tanstack-start": VITE_BUILD_SCRIPT,
+          astro: 'exactly "astro build"'
         }
       }
     },
@@ -20398,11 +20421,11 @@ var FRAMEWORK_CONVERSION_DETAILS = Object.freeze({
   },
   framework_unsupported: {
     paths: ["manifest"],
-    template: `"{{path}}" declares none of next, vite or @tanstack/react-start. Add the app's framework to dependencies, or set runtime.mode: functions in ohmyhost.yaml and add src/ohmyhost/worker.ts. ${PUSH_AND_PLAN}`
+    template: `"{{path}}" declares none of astro, next, vite or @tanstack/react-start. Add the app's framework to dependencies, or set runtime.mode: functions in ohmyhost.yaml and add src/ohmyhost/worker.ts. ${PUSH_AND_PLAN}`
   },
   framework_ambiguous: {
     paths: ["manifest"],
-    template: '"{{path}}" declares next together with vite or @tanstack/react-start, so ohmyho.st cannot choose one framework. Remove the packages of the framework this application does not use, commit and push the change, then plan the new commit.'
+    template: '"{{path}}" declares competing application framework packages, so ohmyho.st cannot choose one framework. Remove the packages of the framework this application does not use, commit and push the change, then plan the new commit.'
   },
   lockfile_missing: {
     paths: ["manifest"],
@@ -20441,7 +20464,8 @@ var FRAMEWORK_CONVERSION_DETAILS = Object.freeze({
         text: {
           nextjs: "runtime.mode: edge",
           "vite-static": "runtime.mode: edge with src/ohmyhost/companion.ts when database, auth, mail, storage or functions.crons is set, and static otherwise",
-          "tanstack-start": "runtime.mode: edge, or static without functions.crons and storage"
+          "tanstack-start": "runtime.mode: edge, or static without functions.crons and storage",
+          astro: "runtime.mode: static for prerendered sites, or edge with the Cloudflare adapter"
         }
       }
     },
@@ -20456,7 +20480,8 @@ var FRAMEWORK_CONVERSION_DETAILS = Object.freeze({
         text: {
           nextjs: ".open-next/assets",
           "vite-static": "dist",
-          "tanstack-start": "dist/client"
+          "tanstack-start": "dist/client",
+          astro: "dist for static, or dist/client for edge"
         }
       }
     },
@@ -20515,8 +20540,8 @@ var DETAIL_DEFINITIONS = FRAMEWORK_CONVERSION_DETAILS;
 var PLACEHOLDER = /\{\{([a-z]+)\}\}/gu;
 var PATH_PATTERN = "[A-Za-z0-9_@()[\\]./${}-]{1,240}";
 var SAFE_PATH = new RegExp(`^${PATH_PATTERN}$`, "u");
-var MODULE_PATH = /^[A-Za-z0-9_@()[\]./${}-]+\.(?:[cm]?[jt]sx?)$/u;
-var FRAMEWORK_CONFIG_NAME = /^(?:next|open-next|vite)\.config\.(?:js|mjs|ts)$/u;
+var MODULE_PATH = /^[A-Za-z0-9_@()[\]./${}-]+\.(?:astro|[cm]?[jt]sx?)$/u;
+var FRAMEWORK_CONFIG_NAME = /^(?:astro|next|open-next|vite)\.config\.(?:js|mjs|ts)$/u;
 var MAXIMUM_DETAIL_LENGTH = 2e3;
 var DETAIL_PATTERNS = Object.freeze(Object.entries(DETAIL_DEFINITIONS).map(([code, definition]) => Object.freeze({
   code,
@@ -22322,14 +22347,25 @@ var parseDevAccessTicket = (value) => {
   return input;
 };
 var parseCurrentIdentity = (value) => {
-  const input = exactRecord2(value, ["actor_id", "organization_ids"]);
+  const input = exactRecord2(value, ["actor_id", "email", "organization_ids", "organizations"]);
+  const email = input["email"];
   const organizationIds = input["organization_ids"];
+  const organizations = input["organizations"];
   if (typeof input["actor_id"] !== "string" || input["actor_id"].length === 0 || input["actor_id"].length > 256 || [...input["actor_id"]].some((character) => {
     const codePoint = character.codePointAt(0) ?? 0;
     return codePoint <= 31 || codePoint === 127;
-  }) || !Array.isArray(organizationIds) || organizationIds.some((organizationId) => !isUlid(organizationId)) || new Set(organizationIds).size !== organizationIds.length) {
+  }) || email !== null && (!boundedString(email, 3, 254) || !/^[^\s@]+@[^\s@.]+(?:\.[^\s@.]+)+$/u.test(email) || /[\p{Cc}\p{Cf}\p{Zl}\p{Zp}]/u.test(email)) || !Array.isArray(organizationIds) || organizationIds.some((organizationId) => !isUlid(organizationId)) || new Set(organizationIds).size !== organizationIds.length || !Array.isArray(organizations) || organizations.length !== organizationIds.length) {
     throw new ResponseContractError();
   }
+  organizations.forEach((organization, index) => {
+    const entry = exactRecord2(organization, ["id", "name"]);
+    if (entry["id"] !== organizationIds[index] || !boundedString(entry["name"], 1, 128) || entry["name"].trim() !== entry["name"] || [...entry["name"]].some((character) => {
+      const codePoint = character.codePointAt(0) ?? 0;
+      return codePoint <= 31 || codePoint === 127;
+    })) {
+      throw new ResponseContractError();
+    }
+  });
   return input;
 };
 var parseAccountProfile = (value) => {
@@ -23221,7 +23257,7 @@ function exact3(v, keys) {
 // apps/product-cli/package.json
 var package_default2 = {
   name: "@ohmyhost/product-cli",
-  version: "0.1.33",
+  version: "0.1.35",
   private: true,
   ohmyhost: {
     deployment: "production",
@@ -24327,7 +24363,7 @@ var HELP_USAGE = Object.freeze({
   "project flag set": "ohmyhost project flag set --project ULID --enabled true|false --idempotency-key KEY --json (shows the small Powered by ohmyho.st flag on the production site; while it shows, this project's custom domain uses no domain credits and also works on Free, and each Paid period bought through Stripe adds 250 credits to the workspace, however many projects show the flag)",
   "project handle check": "ohmyhost project handle check --handle HANDLE --json (is this address free? answers with a reason and free alternatives; the address becomes HANDLE.check.omh.st)",
   "project handle set": "ohmyhost project handle set --project ULID --handle HANDLE --if-match ETAG --idempotency-key KEY --json (moves the project to a free address; the old one stops working and anyone may claim it)",
-  "database compute set": "ohmyhost database compute set --project ULID --environment dev|prod --profile standard|performance --idempotency-key KEY --yes [--wait] --json\n  standard: Free 0.25 CU/1 GB/60s idle, Paid 0.5 CU/2 GB/60s idle. performance: Paid 1 CU/4 GB/300s idle, 2.5x database compute credits per equal active minute; longer idle time also consumes credits.",
+  "database compute set": "ohmyhost database compute set --project ULID --environment dev|prod --profile standard|performance --idempotency-key KEY --yes [--wait] --json\n  standard: Free 0.25 CU/1 GB, Paid 0.5 CU/2 GB. performance: Paid 1 CU/4 GB, 2.5x database compute credits per equal active minute. All profiles use the provider-default idle suspension.",
   "database compute get": "ohmyhost database compute get --project ULID [--environment dev|prod] --json",
   "database write": "ohmyhost database write --project ULID --environment dev|prod --statement-file PATH --idempotency-key KEY [--parameters-json JSON] --yes --json",
   "database query": "ohmyhost database query --project ULID --environment dev|prod --statement SQL [--parameters-json JSON] --json",
@@ -29147,7 +29183,7 @@ function createLocalOhmyhostMcpServer(dependencies) {
   });
   registerManagedSourceTools(server, dependencies);
   registerProductTool(server, dependencies, "database_compute_get", "Read current managed database size, memory, region and compute state without running SQL or waking the database. Shared Dev/Prod resolves to one physical database. A null database means no confirmed managed placement. suspend_timeout_seconds=0 uses the provider default; -1 disables scale to zero. A configured value is not proof that an in-progress resize finished. This read never resizes or changes billing.", external_exports.object({ project_id: identifier2, environment: external_exports.enum(["dev", "prod"]).default("dev") }), (client2, input) => client2.getDatabaseCompute({ projectId: input.project_id, environment: input.environment }));
-  registerProductTool(server, dependencies, "database_compute_set", "Select standard or performance compute for an existing database: Free 0.25 CU/1 GB/60-second idle suspension, Paid 0.5 CU/2 GB/60-second idle suspension. First read database_compute_get and explain actual size, metered compute cost, possible brief connection interruption and that shared data changes both Dev and Prod. Require the user's decision before confirm=true. SQL data is preserved. Poll the returned operation every 60 seconds; never submit a second change while it runs. Performance requires active Paid access and selects 1 CU/4 GB/300-second idle suspension at 2.5x Paid-standard compute credits per equal active minute; the longer idle window also consumes more active time. This affects only database compute. Read organization_credits_get for the published rate and active meter first. A successful choice is remembered per physical database; automatic Free downgrades preserve it, and an explicit standard choice clears it. Mixed/uncertain transition hours waive the premium; never multiply raw CU usage again.", external_exports.object({
+  registerProductTool(server, dependencies, "database_compute_set", "Select standard or performance compute for an existing database: Free 0.25 CU/1 GB, Paid 0.5 CU/2 GB. All profiles use provider-default idle suspension (suspend_timeout_seconds=0). First read database_compute_get and explain actual size, metered compute cost, possible brief connection interruption and that shared data changes both Dev and Prod. Require the user's decision before confirm=true. SQL data is preserved. Poll the returned operation every 60 seconds; never submit a second change while it runs. Performance requires active Paid access and selects 1 CU/4 GB at 2.5x Paid-standard compute credits per equal active minute. This affects only database compute. Read organization_credits_get for the published rate and active meter first. A successful choice is remembered per physical database; automatic Free downgrades preserve it, and an explicit standard choice clears it. Mixed/uncertain transition hours waive the premium; never multiply raw CU usage again.", external_exports.object({
     project_id: identifier2,
     environment: external_exports.enum(["dev", "prod"]),
     profile: external_exports.enum(["standard", "performance"]),
@@ -29411,7 +29447,7 @@ function createLocalOhmyhostMcpServer(dependencies) {
     });
     return { revoked: true, key_id: input.key_id };
   }, destructiveAnnotations());
-  registerProductTool(server, dependencies, "identity_get", "Get the ohmyho.st customer/agent identity this call acts as: user, organization and, in context, the saved login or OHMYHOST_TOKEN that supplied it. Compare it with the user and organization the customer named before any change. This does not authenticate the hosted application's end users or provision a customer AuthKit tenant; application authentication is the customer's chosen integration.", external_exports.object({}), (client2, _input, signal) => client2.getCurrentIdentity(signal));
+  registerProductTool(server, dependencies, "identity_get", "Get the ohmyho.st customer/agent identity this call acts as: user and account email, scoped organization IDs and names and, in context, the saved login or OHMYHOST_TOKEN that supplied it. Compare it with the user and organization the customer named before any change. This does not authenticate the hosted application's end users or provision a customer AuthKit tenant; application authentication is the customer's chosen integration.", external_exports.object({}), (client2, _input, signal) => client2.getCurrentIdentity(signal));
   registerProductTool(server, dependencies, "project_handle_check", "Check whether a project address is free before offering it to the customer. A handle is one to five lowercase words of letters and digits joined by single hyphens, three to fifty-nine characters, and never a reserved word such as admin, api, dev or www; it becomes <handle>.check.omh.st for Prod and dev-<handle>.check.omh.st for Dev. The answer names why a handle cannot be used and returns free alternatives, so offer one of those instead of guessing again. Check the name here first, then move an existing project onto it with project_handle_set.", external_exports.object({ handle: external_exports.string().min(1).max(120) }), (client2, input) => client2.checkProjectHandle({ handle: input.handle }));
   registerProductTool(server, dependencies, "project_handle_set", "Move a project to an address the customer chose, after project_handle_check said it is free. The Dev and Prod gateways are re-published at the new address and it is stored only once both serve it; the previous address stops answering and anyone may claim it, so a link already shared stops working. Needs the project's current ETag from project_status and one idempotency key; reuse the same key after an uncertain answer. Refused while another operation is running for the project, and refused for an address that is taken, unusable, or the one the project already has. Returns an operation to follow with operation_get.", external_exports.object({
     project_id: identifier2,
@@ -29896,7 +29932,12 @@ function registerManagedSourceTools(server, dependencies) {
       directory: input.directory,
       metadataDirectory: resolveProductCliEnvironment(dependencies.environment).linkDirectory,
       apiOrigin: client2.productApiOrigin ?? resolveProductCliEnvironment(dependencies.environment).apiOrigin,
-      identity: { actor_id: current.actor_id, organization_ids: current.organization_ids },
+      identity: {
+        actor_id: current.actor_id,
+        email: current.email,
+        organization_ids: current.organization_ids,
+        organizations: current.organizations
+      },
       projectId: input.project_id,
       request,
       explicitExpectedCommit: input.expected_commit_sha !== void 0,
@@ -29933,7 +29974,12 @@ function registerManagedSourceTools(server, dependencies) {
       directory: input.directory,
       metadataDirectory: resolveProductCliEnvironment(dependencies.environment).linkDirectory,
       apiOrigin: client2.productApiOrigin ?? resolveProductCliEnvironment(dependencies.environment).apiOrigin,
-      identity: { actor_id: current.actor_id, organization_ids: current.organization_ids },
+      identity: {
+        actor_id: current.actor_id,
+        email: current.email,
+        organization_ids: current.organization_ids,
+        organizations: current.organizations
+      },
       projectId: input.project_id,
       operationId: input.operation_id,
       api: port(client2),
@@ -29993,7 +30039,9 @@ async function handoverAccount(client2, signal) {
   const report = await client2.getCurrentIdentity(signal);
   const identity = parseCurrentIdentity({
     actor_id: report.actor_id,
-    organization_ids: report.organization_ids
+    email: report.email,
+    organization_ids: report.organization_ids,
+    organizations: report.organizations
   });
   const userId = identity.actor_id.startsWith("user:") ? identity.actor_id.slice(5) : "";
   const [organizationId, ...others] = identity.organization_ids;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@amerged/ohmyhost-mcp",
-  "version": "0.1.33",
+  "version": "0.1.35",
   "type": "module",
   "engines": {
     "node": ">=22"

package/src/apps/mcp/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ohmyhost/mcp",
-  "version": "0.1.33",
+  "version": "0.1.35",
   "private": true,
   "ohmyhost": {
     "deployment": "production",

package/src/apps/mcp/src/local-server.ts

@@ -522,7 +522,7 @@ export function createLocalOhmyhostMcpServer(dependencies: LocalOhmyhostMcpDepen
     server,
     dependencies,
     "database_compute_set",
-    "Select standard or performance compute for an existing database: Free 0.25 CU/1 GB/60-second idle suspension, Paid 0.5 CU/2 GB/60-second idle suspension. First read database_compute_get and explain actual size, metered compute cost, possible brief connection interruption and that shared data changes both Dev and Prod. Require the user's decision before confirm=true. SQL data is preserved. Poll the returned operation every 60 seconds; never submit a second change while it runs. Performance requires active Paid access and selects 1 CU/4 GB/300-second idle suspension at 2.5x Paid-standard compute credits per equal active minute; the longer idle window also consumes more active time. This affects only database compute. Read organization_credits_get for the published rate and active meter first. A successful choice is remembered per physical database; automatic Free downgrades preserve it, and an explicit standard choice clears it. Mixed/uncertain transition hours waive the premium; never multiply raw CU usage again.",
+    "Select standard or performance compute for an existing database: Free 0.25 CU/1 GB, Paid 0.5 CU/2 GB. All profiles use provider-default idle suspension (suspend_timeout_seconds=0). First read database_compute_get and explain actual size, metered compute cost, possible brief connection interruption and that shared data changes both Dev and Prod. Require the user's decision before confirm=true. SQL data is preserved. Poll the returned operation every 60 seconds; never submit a second change while it runs. Performance requires active Paid access and selects 1 CU/4 GB at 2.5x Paid-standard compute credits per equal active minute. This affects only database compute. Read organization_credits_get for the published rate and active meter first. A successful choice is remembered per physical database; automatic Free downgrades preserve it, and an explicit standard choice clears it. Mixed/uncertain transition hours waive the premium; never multiply raw CU usage again.",
     z.object({
       project_id: identifier,
       environment: z.enum(["dev", "prod"]),
@@ -1119,7 +1119,7 @@ export function createLocalOhmyhostMcpServer(dependencies: LocalOhmyhostMcpDepen
     server,
     dependencies,
     "identity_get",
-    "Get the ohmyho.st customer/agent identity this call acts as: user, organization and, in context, the saved login or OHMYHOST_TOKEN that supplied it. Compare it with the user and organization the customer named before any change. This does not authenticate the hosted application's end users or provision a customer AuthKit tenant; application authentication is the customer's chosen integration.",
+    "Get the ohmyho.st customer/agent identity this call acts as: user and account email, scoped organization IDs and names and, in context, the saved login or OHMYHOST_TOKEN that supplied it. Compare it with the user and organization the customer named before any change. This does not authenticate the hosted application's end users or provision a customer AuthKit tenant; application authentication is the customer's chosen integration.",
     z.object({}),
     (client, _input, signal) => client.getCurrentIdentity(signal),
   );
@@ -2072,7 +2072,12 @@ function registerManagedSourceTools(
         apiOrigin:
           client.productApiOrigin ??
           resolveProductCliEnvironment(dependencies.environment).apiOrigin,
-        identity: { actor_id: current.actor_id, organization_ids: current.organization_ids },
+        identity: {
+          actor_id: current.actor_id,
+          email: current.email,
+          organization_ids: current.organization_ids,
+          organizations: current.organizations,
+        },
         projectId: input.project_id,
         request,
         explicitExpectedCommit: input.expected_commit_sha !== undefined,
@@ -2120,7 +2125,12 @@ function registerManagedSourceTools(
         apiOrigin:
           client.productApiOrigin ??
           resolveProductCliEnvironment(dependencies.environment).apiOrigin,
-        identity: { actor_id: current.actor_id, organization_ids: current.organization_ids },
+        identity: {
+          actor_id: current.actor_id,
+          email: current.email,
+          organization_ids: current.organization_ids,
+          organizations: current.organizations,
+        },
         projectId: input.project_id,
         operationId: input.operation_id,
         api: port(client),
@@ -2235,7 +2245,9 @@ async function handoverAccount(
   const report = await client.getCurrentIdentity(signal);
   const identity = parseCurrentIdentity({
     actor_id: report.actor_id,
+    email: report.email,
     organization_ids: report.organization_ids,
+    organizations: report.organizations,
   });
   const userId = identity.actor_id.startsWith("user:") ? identity.actor_id.slice(5) : "";
   const [organizationId, ...others] = identity.organization_ids;

package/src/apps/product-cli/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ohmyhost/product-cli",
-  "version": "0.1.33",
+  "version": "0.1.35",
   "private": true,
   "ohmyhost": {
     "deployment": "production",

package/src/apps/product-cli/src/cli.ts

@@ -399,7 +399,7 @@ const HELP_USAGE = Object.freeze({
     "ohmyhost project handle set --project ULID --handle HANDLE --if-match ETAG --idempotency-key KEY --json (moves the project to a free address; the old one stops working and anyone may claim it)",
   "database compute set":
     "ohmyhost database compute set --project ULID --environment dev|prod --profile standard|performance --idempotency-key KEY --yes [--wait] --json\n" +
-    "  standard: Free 0.25 CU/1 GB/60s idle, Paid 0.5 CU/2 GB/60s idle. performance: Paid 1 CU/4 GB/300s idle, 2.5x database compute credits per equal active minute; longer idle time also consumes credits.",
+    "  standard: Free 0.25 CU/1 GB, Paid 0.5 CU/2 GB. performance: Paid 1 CU/4 GB, 2.5x database compute credits per equal active minute. All profiles use the provider-default idle suspension.",
   "database compute get":
     "ohmyhost database compute get --project ULID [--environment dev|prod] --json",
   "database write":

package/src/apps/product-cli/src/repository-init.ts

@@ -310,8 +310,12 @@ export async function initializeRepository(
       return match?.[1] === undefined || match[1].startsWith("_") ? [] : [match[1]];
     }),
   );
-  const apiRouteCount = applicationFiles.filter((path) =>
-    /^(?:src\/)?app\/api\/.+\/route\.(?:js|jsx|ts|tsx)$/u.test(path),
+  const apiRouteCount = applicationFiles.filter(
+    (path) =>
+      /^(?:src\/)?app\/api\/.+\/route\.(?:js|jsx|ts|tsx)$/u.test(path) ||
+      (framework === "astro" &&
+        /^src\/pages\/.+\.(?:js|ts)$/u.test(path) &&
+        !path.endsWith(".d.ts")),
   ).length;
   const supabase = dependencies.has("@supabase/supabase-js") || dependencies.has("@supabase/ssr");
   const configuredDatabase = existingConfiguration?.database?.enabled === true;
@@ -368,11 +372,15 @@ export async function initializeRepository(
   const targetStorage = r2 || supabaseStorage;
   // TanStack Start binds storage only on edge, as a Vite app does through its companion.
   const tanStackRuntime =
-    framework !== "tanstack-start"
+    framework !== "tanstack-start" && framework !== "astro"
       ? null
       : targetStorage
         ? "edge"
-        : proposedTanStackRuntime(frameworkConfig, dependencies);
+        : framework === "astro"
+          ? dependencies.has("@astrojs/cloudflare")
+            ? "edge"
+            : "static"
+          : proposedTanStackRuntime(frameworkConfig, dependencies);
   const companionRequired =
     framework === "vite" &&
     (existingConfiguration === null
@@ -390,7 +398,11 @@ export async function initializeRepository(
     databaseProvider,
     hasHealthcheck:
       applicationFiles.includes("src/app/api/health/route.ts") ||
-      applicationFiles.includes("app/api/health/route.ts"),
+      applicationFiles.includes("app/api/health/route.ts") ||
+      (framework === "astro" &&
+        applicationFiles.some((path) =>
+          /^src\/pages\/api\/health(?:\/index)?\.(?:js|ts)$/u.test(path),
+        )),
     mailEnabled: targetMail,
     betterAuthEnabled: targetBetterAuth,
     storageEnabled: targetStorage,
@@ -596,7 +608,10 @@ async function workerModuleBlockers(context: SourceCheckContext): Promise<Reposi
   const scheduled =
     (config?.functions?.crons.length ?? 0) > 0 &&
     ((mode === "edge" &&
-      (framework === "vite" || framework === "nextjs" || framework === "tanstack-start")) ||
+      (framework === "astro" ||
+        framework === "vite" ||
+        framework === "nextjs" ||
+        framework === "tanstack-start")) ||
       (mode === "functions" && framework === "functions"));
   const path = framework === "vite" ? VITE_COMPANION_ENTRY_PATH : WORKER_MODULE_PATH;
   if ((framework !== "functions" && !scheduled) || !files.includes(path)) return [];
@@ -989,7 +1004,10 @@ function hasDirectSafeBuildCommand(
   const scripts = manifest["scripts"];
   if (!isRecord(scripts) || typeof scripts["build"] !== "string") return false;
   return (
-    (framework === "nextjs" || framework === "vite" || framework === "tanstack-start") &&
+    (framework === "astro" ||
+      framework === "nextjs" ||
+      framework === "vite" ||
+      framework === "tanstack-start") &&
     isAdmittedFrameworkBuildScript(framework, scripts["build"])
   );
 }
@@ -1144,10 +1162,23 @@ async function readFrameworkConfig(
   files: readonly string[],
   framework: RepositoryFramework,
 ): Promise<FrameworkConfigText | null> {
-  if (framework !== "nextjs" && framework !== "vite" && framework !== "tanstack-start") return null;
+  if (
+    framework !== "astro" &&
+    framework !== "nextjs" &&
+    framework !== "vite" &&
+    framework !== "tanstack-start"
+  )
+    return null;
   let path: string | null;
   try {
-    path = resolveFrameworkConfig(framework === "nextjs" ? "next.config" : "vite.config", files);
+    path = resolveFrameworkConfig(
+      framework === "astro"
+        ? "astro.config"
+        : framework === "nextjs"
+          ? "next.config"
+          : "vite.config",
+      files,
+    );
   } catch (error) {
     // The shared rules name the ambiguous variants; none of them is judged.
     if (error instanceof FrameworkAdmissionError) return null;
@@ -1266,7 +1297,11 @@ function renderConfiguration(input: {
 
   let output = "dist";
   if (input.framework === "nextjs") output = ".open-next/assets";
-  else if (input.framework === "tanstack-start") output = "dist/client";
+  else if (
+    input.framework === "tanstack-start" ||
+    (input.framework === "astro" && input.tanStackRuntime === "edge")
+  )
+    output = "dist/client";
 
   let mode = "auto";
   if (input.framework === "functions") mode = "functions";

package/src/apps/product-cli/src/runtime-contract.ts

@@ -63,7 +63,9 @@ export interface SafeProblem {
 
 export interface PublicCurrentIdentity {
   readonly actor_id: string;
+  readonly email: string | null;
   readonly organization_ids: readonly string[];
+  readonly organizations: readonly { readonly id: string; readonly name: string }[];
 }
 
 /** One workspace the signed-in user belongs to, with the provider identity a selection needs. */
@@ -635,8 +637,10 @@ export function parseProjectCreditBudget(value: unknown): ProjectCreditBudget {
 }
 
 export const parseCurrentIdentity = (value: unknown): PublicCurrentIdentity => {
-  const input = exactRecord(value, ["actor_id", "organization_ids"]);
+  const input = exactRecord(value, ["actor_id", "email", "organization_ids", "organizations"]);
+  const email = input["email"];
   const organizationIds = input["organization_ids"];
+  const organizations = input["organizations"];
   if (
     typeof input["actor_id"] !== "string" ||
     input["actor_id"].length === 0 ||
@@ -645,12 +649,32 @@ export const parseCurrentIdentity = (value: unknown): PublicCurrentIdentity => {
       const codePoint = character.codePointAt(0) ?? 0;
       return codePoint <= 31 || codePoint === 127;
     }) ||
+    (email !== null &&
+      (!boundedString(email, 3, 254) ||
+        !/^[^\s@]+@[^\s@.]+(?:\.[^\s@.]+)+$/u.test(email) ||
+        /[\p{Cc}\p{Cf}\p{Zl}\p{Zp}]/u.test(email))) ||
     !Array.isArray(organizationIds) ||
     organizationIds.some((organizationId) => !isUlid(organizationId)) ||
-    new Set(organizationIds).size !== organizationIds.length
+    new Set(organizationIds).size !== organizationIds.length ||
+    !Array.isArray(organizations) ||
+    organizations.length !== organizationIds.length
   ) {
     throw new ResponseContractError();
   }
+  organizations.forEach((organization: unknown, index) => {
+    const entry = exactRecord(organization, ["id", "name"]);
+    if (
+      entry["id"] !== organizationIds[index] ||
+      !boundedString(entry["name"], 1, 128) ||
+      entry["name"].trim() !== entry["name"] ||
+      [...entry["name"]].some((character) => {
+        const codePoint = character.codePointAt(0) ?? 0;
+        return codePoint <= 31 || codePoint === 127;
+      })
+    ) {
+      throw new ResponseContractError();
+    }
+  });
   return input as unknown as PublicCurrentIdentity;
 };