@amerged/ohmyhost-mcp 0.1.34 → 0.1.35

package/README.md

@@ -1,6 +1,6 @@
 # @amerged/ohmyhost-mcp
 
-Local MCP server of ohmyho.st, version 0.1.34. Sign-in and setting secrets need the CLI too:
+Local MCP server of ohmyho.st, version 0.1.35. Sign-in and setting secrets need the CLI too:
 
 ```sh
 npm install --global @amerged/ohmyhost-cli @amerged/ohmyhost-mcp

package/dist/{chunk-E3ZJXGBW.js → chunk-CVTJZFHD.js}

@@ -42,7 +42,7 @@ var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__ge
 // apps/mcp/package.json
 var package_default = {
   name: "@ohmyhost/mcp",
-  version: "0.1.34",
+  version: "0.1.35",
   private: true,
   ohmyhost: {
     deployment: "production",
@@ -30615,7 +30615,7 @@ var GENERATED_SKILL_RESOURCES = Object.freeze([
     title: "ohmyhost-build-portable-app",
     description: "Build or adapt a TypeScript Vite, TanStack Start, Next.js (including Cache Components) or plain Worker application for ohmyho.st, with managed PostgreSQL, private files, mail, schedules, declared browser origins, egress, video or microphone access. Use for application feature work and source preparation; use the migration Skill for selected Supabase conversion.",
     mimeType: "text/markdown",
-    text: "---\nname: ohmyhost-build-portable-app\ndescription: Build or adapt a TypeScript Vite, TanStack Start, Next.js (including Cache Components) or plain Worker application for ohmyho.st, with managed PostgreSQL, private files, mail, schedules, declared browser origins, egress, video or microphone access. Use for application feature work and source preparation; use the migration Skill for selected Supabase conversion.\n---\n\n# Build an app for ohmyho.st\n\nPrepare the application's real capabilities, then verify them after deployment.\n\n1. Inspect the selected repository and, with a local checkout, run `ohmyhost init --dry-run --json`. In a native chat, inspect the saved source files and apply the runtime references through the remote file tools; use the actual plan/build diagnostics, without claiming a local command ran. Preserve a valid existing `ohmyhost.yaml`, application root, egress rules, auth choice and migrations. Resolve the returned blockers and requirements rather than replacing the configuration with a reduced file.\n2. Keep one exactly pinned package manager and its matching lockfile. Read `compatibility.frameworks[].status`: `admitted` meets the framework's security floor, `pending` is a version range the build checks after installing it, and `unsupported` blocks until the package is at its `minimum` or a later stable release.\n3. Read [the runtime contracts](references/stack-contracts.md) for the capabilities the app needs. Keep ordinary Next.js routes, native TanStack Start server functions, the returned Vite API companion contract, or a plain Worker module (`runtime.mode: functions`, `src/ohmyhost/worker.ts`). The service supplies its build adapter; do not add customer Wrangler/OpenNext configuration merely to host the app. Next.js 16 Cache Components and `\"use cache\"` build here: request-time `\"use cache\"` values are never stored, prerendered values stay until the next deployment, and revalidation is refused, so follow the contracts' Cache Components rules. A `create-next-app` 16.4 app with Tailwind CSS first needs the PostCSS configuration the contracts describe (`next_tailwind_turbopack_only`). Video, audio or microphone need the `_headers` opt-in from the contracts.\n4. For managed Postgres, use the supported application database binding and immutable expand-only migrations. Reach it through `createPrivateDatabaseClient`; use bounded `withConnection` for interactive transactions. Keep network transfers, email and AI calls outside that connection scope. Adding nullable columns without defaults is admitted; DROP, row changes, CREATE OR REPLACE and other changes to existing schema are refused. Preserve production records and read the database Skill for migration limits, sizing, data assignments or reset.\n5. Keep the application's own authentication provider. Better Auth and customer-owned WorkOS are the verified integrations; any other OAuth or OIDC provider is an ordinary application dependency with its own setup and runtime requirements and no completed support claim. Configure actual callback/logout URLs and server secrets, then test login, a protected route, reload and logout. A public app needs no auth provider. Detect actual Supabase capability usage before proposing a migration; an SDK declaration alone does not justify replacing it.\n6. For sending or receiving email, follow [the mail workflow](references/mail.md): choose the customer domain explicitly, prepare and verify a signed application webhook before receiving, and store incoming mail in the customer database. Enable only used capabilities. Server requests to an origin omitted from `runtime.egress.allow` answer HTTP 403 `Egress denied`; browser resources use the separate declared `runtime.browser` policy. Use the current client/runtime libraries and let `init` report missing routes or capabilities. Do not remove a required feature just to obtain a successful build.\n7. Run the application's relevant tests, typecheck and framework build through the available execution tools. Prefer focused regressions for the changed behavior and real hosted capability checks; respect the customer's requested verification scope without adding a broad test program. A native chat without test execution must identify that limitation and use actual hosted plan/build results and interaction checks, not invent test success. Use **ohmyhost-deploy** to reuse the saved source, deliver environment secrets privately and verify the hosted app's required reads, writes and integrations.\n\nResolve hosted bindings and trusted configuration from the framework's actual request context. A localhost-only test runtime or a successful health endpoint does not establish production login, tenant setup or background processing. Follow the runtime reference for first-user bootstrap, private uploads and bounded scheduled work when the application needs them.\n\nFor first account setup, use **ohmyhost-get-started**. For publishing, use **ohmyhost-deploy**;\nuse **ohmyhost-deploy-github** only for the selected GitHub source route. [The CLI reference](references/cli-deploy.md) supplies detailed commands when a local checkout is available. For a failed operation, use **ohmyhost-troubleshoot-deployment** and retain its original ID.\n\nReport a suspected hosting bug with `feedback_submit` and a minimal redacted reproduction. Return a working application URL only after its required flows pass. Promotion, rollback and deletion follow the customer's requested scope; an ordinary deploy does not require deleting their app for a cleanup test.\n"
+    text: "---\nname: ohmyhost-build-portable-app\ndescription: Build or adapt a TypeScript Vite, TanStack Start, Next.js (including Cache Components) or plain Worker application for ohmyho.st, with managed PostgreSQL, private files, mail, schedules, declared browser origins, egress, video or microphone access. Use for application feature work and source preparation; use the migration Skill for selected Supabase conversion.\n---\n\n# Build an app for ohmyho.st\n\nPrepare the application's real capabilities, then verify them after deployment.\n\n1. Inspect the selected repository and, with a local checkout, run `ohmyhost init --dry-run --json`. In a native chat, inspect the saved source files and apply the runtime references through the remote file tools; use the actual plan/build diagnostics, without claiming a local command ran. Preserve a valid existing `ohmyhost.yaml`, application root, egress rules, auth choice and migrations. Resolve the returned blockers and requirements rather than replacing the configuration with a reduced file.\n2. Keep one exactly pinned package manager and its matching lockfile. Read `compatibility.frameworks[].status`: `admitted` meets the framework's security floor, `pending` is a version range the build checks after installing it, and `unsupported` blocks until the package is at its `minimum` or a later stable release.\n3. Read [the runtime contracts](references/stack-contracts.md) for the capabilities the app needs. Keep ordinary Astro pages/endpoints, Next.js routes, native TanStack Start server functions, the returned Vite API companion contract, or a plain Worker module (`runtime.mode: functions`, `src/ohmyhost/worker.ts`). The service supplies its build adapter; do not add customer Wrangler/OpenNext configuration merely to host the app. Next.js 16 Cache Components and `\"use cache\"` build here: request-time `\"use cache\"` values are never stored, prerendered values stay until the next deployment, and revalidation is refused, so follow the contracts' Cache Components rules. A `create-next-app` 16.4 app with Tailwind CSS first needs the PostCSS configuration the contracts describe (`next_tailwind_turbopack_only`). Video, audio or microphone need the `_headers` opt-in from the contracts.\n4. For managed Postgres, use the supported application database binding and immutable expand-only migrations. Reach it through `createPrivateDatabaseClient`; use bounded `withConnection` for interactive transactions. Keep network transfers, email and AI calls outside that connection scope. Adding nullable columns without defaults is admitted; DROP, row changes, CREATE OR REPLACE and other changes to existing schema are refused. Preserve production records and read the database Skill for migration limits, sizing, data assignments or reset.\n5. Keep the application's own authentication provider. Better Auth and customer-owned WorkOS are the verified integrations; any other OAuth or OIDC provider is an ordinary application dependency with its own setup and runtime requirements and no completed support claim. Configure actual callback/logout URLs and server secrets, then test login, a protected route, reload and logout. A public app needs no auth provider. Detect actual Supabase capability usage before proposing a migration; an SDK declaration alone does not justify replacing it.\n6. For sending or receiving email, follow [the mail workflow](references/mail.md): choose the customer domain explicitly, prepare and verify a signed application webhook before receiving, and store incoming mail in the customer database. Enable only used capabilities. Server requests to an origin omitted from `runtime.egress.allow` answer HTTP 403 `Egress denied`; browser resources use the separate declared `runtime.browser` policy. Use the current client/runtime libraries and let `init` report missing routes or capabilities. Do not remove a required feature just to obtain a successful build.\n7. Run the application's relevant tests, typecheck and framework build through the available execution tools. Prefer focused regressions for the changed behavior and real hosted capability checks; respect the customer's requested verification scope without adding a broad test program. A native chat without test execution must identify that limitation and use actual hosted plan/build results and interaction checks, not invent test success. Use **ohmyhost-deploy** to reuse the saved source, deliver environment secrets privately and verify the hosted app's required reads, writes and integrations.\n\nResolve hosted bindings and trusted configuration from the framework's actual request context. A localhost-only test runtime or a successful health endpoint does not establish production login, tenant setup or background processing. Follow the runtime reference for first-user bootstrap, private uploads and bounded scheduled work when the application needs them.\n\nFor first account setup, use **ohmyhost-get-started**. For publishing, use **ohmyhost-deploy**;\nuse **ohmyhost-deploy-github** only for the selected GitHub source route. [The CLI reference](references/cli-deploy.md) supplies detailed commands when a local checkout is available. For a failed operation, use **ohmyhost-troubleshoot-deployment** and retain its original ID.\n\nReport a suspected hosting bug with `feedback_submit` and a minimal redacted reproduction. Return a working application URL only after its required flows pass. Promotion, rollback and deletion follow the customer's requested scope; an ordinary deploy does not require deleting their app for a cleanup test.\n\n## Astro\n\nUse the [Astro guide](https://docs.ohmyho.st/frameworks/astro). Static uses `astro build`, `runtime.mode: static` and `build.output: dist` without a server adapter. SSR uses the official `@astrojs/cloudflare` adapter, `output: \"server\"`, `runtime.mode: edge`, `build.output: dist/client`, `session: false` and `cloudflare({ imageService: \"passthrough\" })`. Keep the standard `src/` and output directories. The service supplies the deployment config. No native KV sessions, provider cache, Images or customer-defined Cloudflare resources are supported initially. Keep server imports in frontmatter or ordinary modules; put dynamic browser imports in a normal statically imported browser module rather than an Astro template. Verify request-time behavior plus browser islands under hosted CSP. Static build-time filesystem/MDX work remains ordinary Node build work; enable no request-time capabilities on a static plan.\n"
   },
   {
     skillName: "ohmyhost-build-portable-app",

package/dist/index.js

@@ -2,7 +2,7 @@ import { createRequire as __ohmyhostCreateRequire } from "node:module"; const re
 import {
   createOhmyhostMcpServer,
   ohmyhostMcpHandler
-} from "./chunk-E3ZJXGBW.js";
+} from "./chunk-CVTJZFHD.js";
 export {
   createOhmyhostMcpServer,
   ohmyhostMcpHandler

package/dist/stdio-main.js

@@ -30,7 +30,7 @@ import {
   serverIdentityOf,
   setNegotiatedProtocolVersion,
   validateEnvelopeMeta
-} from "./chunk-E3ZJXGBW.js";
+} from "./chunk-CVTJZFHD.js";
 
 // node_modules/.pnpm/ignore@7.0.12/node_modules/ignore/index.js
 var require_ignore = __commonJS({
@@ -20235,6 +20235,11 @@ function toError(value) {
 // packages/contracts/dist/framework-build-script.mjs
 var PINNED_BUN_VERSION = "1.2.22";
 var FRAMEWORK_VERSION_POLICY = Object.freeze({
+  astro: Object.freeze({ floors: Object.freeze(["7.4.0"]), denied: Object.freeze([]) }),
+  "@astrojs/cloudflare": Object.freeze({
+    floors: Object.freeze(["14.4.0"]),
+    denied: Object.freeze([])
+  }),
   next: Object.freeze({ floors: Object.freeze(["15.5.27", "16.3.8"]), denied: Object.freeze([]) }),
   vite: Object.freeze({ floors: Object.freeze(["5.4.6"]), denied: Object.freeze([]) }),
   "@tanstack/react-start": Object.freeze({
@@ -20289,11 +20294,15 @@ var RESOLVED_VERSION_FIELD = anchoredPattern(RESOLVED_VERSION_SOURCE);
 var DECLARED_VERSION_FIELD = anchoredPattern(`[~^]?${RESOLVED_VERSION_SOURCE}`);
 var STABLE_VERSION_FIELD = anchoredPattern(STABLE_VERSION_SOURCE);
 var FRAMEWORK_VERSION_PACKAGES = Object.freeze([
+  "astro",
+  "@astrojs/cloudflare",
   "next",
   "vite",
   "@tanstack/react-start"
 ]);
 var FRAMEWORK_DEPENDENCY_PACKAGES = Object.freeze([
+  "astro",
+  "@astrojs/cloudflare",
   "next",
   "react",
   "react-dom",
@@ -20304,10 +20313,23 @@ var FRAMEWORK_DEPENDENCY_PACKAGES = Object.freeze([
   "@cloudflare/vite-plugin"
 ]);
 var REACT_PACKAGES = Object.freeze(["react", "react-dom"]);
-var BUILD_FRAMEWORKS = Object.freeze(["nextjs", "vite-static", "tanstack-start"]);
+var BUILD_FRAMEWORKS = Object.freeze([
+  "astro",
+  "nextjs",
+  "vite-static",
+  "tanstack-start"
+]);
 var PUSH_AND_PLAN = "Commit and push the change, then plan the new commit.";
 var VITE_BUILD_SCRIPT = '"vite build", optionally joined with && to one "tsc", "tsc -b", "tsc --build" or "tsc --noEmit" stage';
 var FRAMEWORK_CONVERSION_DETAILS = Object.freeze({
+  astro_template_import_unsupported: {
+    paths: ["module"],
+    template: '"{{path}}" uses a dynamic import, import.meta or require in an Astro template. Move server imports into frontmatter and dynamic browser imports into a normal statically imported browser module, then commit and push the change and plan the new commit.'
+  },
+  astro_config_unsupported: {
+    paths: ["framework_config"],
+    template: '"{{path}}" must use the standard Astro output directories and root base. For edge use output: "server", @astrojs/cloudflare with imageService: "passthrough", and session: false. Static hosting must omit a server adapter. Additional Cloudflare bindings, custom sessions and provider cache are not supported. Commit and push the change, then plan the new commit.'
+  },
   managed_auth_database_required: {
     paths: ["repository_config"],
     template: managedCustomerAuthDatabaseMessage("{{path}}")
@@ -20382,7 +20404,8 @@ var FRAMEWORK_CONVERSION_DETAILS = Object.freeze({
         text: {
           nextjs: 'exactly "next build" or "next build --webpack"; ohmyho.st adds the OpenNext build itself',
           "vite-static": VITE_BUILD_SCRIPT,
-          "tanstack-start": VITE_BUILD_SCRIPT
+          "tanstack-start": VITE_BUILD_SCRIPT,
+          astro: 'exactly "astro build"'
         }
       }
     },
@@ -20398,11 +20421,11 @@ var FRAMEWORK_CONVERSION_DETAILS = Object.freeze({
   },
   framework_unsupported: {
     paths: ["manifest"],
-    template: `"{{path}}" declares none of next, vite or @tanstack/react-start. Add the app's framework to dependencies, or set runtime.mode: functions in ohmyhost.yaml and add src/ohmyhost/worker.ts. ${PUSH_AND_PLAN}`
+    template: `"{{path}}" declares none of astro, next, vite or @tanstack/react-start. Add the app's framework to dependencies, or set runtime.mode: functions in ohmyhost.yaml and add src/ohmyhost/worker.ts. ${PUSH_AND_PLAN}`
   },
   framework_ambiguous: {
     paths: ["manifest"],
-    template: '"{{path}}" declares next together with vite or @tanstack/react-start, so ohmyho.st cannot choose one framework. Remove the packages of the framework this application does not use, commit and push the change, then plan the new commit.'
+    template: '"{{path}}" declares competing application framework packages, so ohmyho.st cannot choose one framework. Remove the packages of the framework this application does not use, commit and push the change, then plan the new commit.'
   },
   lockfile_missing: {
     paths: ["manifest"],
@@ -20441,7 +20464,8 @@ var FRAMEWORK_CONVERSION_DETAILS = Object.freeze({
         text: {
           nextjs: "runtime.mode: edge",
           "vite-static": "runtime.mode: edge with src/ohmyhost/companion.ts when database, auth, mail, storage or functions.crons is set, and static otherwise",
-          "tanstack-start": "runtime.mode: edge, or static without functions.crons and storage"
+          "tanstack-start": "runtime.mode: edge, or static without functions.crons and storage",
+          astro: "runtime.mode: static for prerendered sites, or edge with the Cloudflare adapter"
         }
       }
     },
@@ -20456,7 +20480,8 @@ var FRAMEWORK_CONVERSION_DETAILS = Object.freeze({
         text: {
           nextjs: ".open-next/assets",
           "vite-static": "dist",
-          "tanstack-start": "dist/client"
+          "tanstack-start": "dist/client",
+          astro: "dist for static, or dist/client for edge"
         }
       }
     },
@@ -20515,8 +20540,8 @@ var DETAIL_DEFINITIONS = FRAMEWORK_CONVERSION_DETAILS;
 var PLACEHOLDER = /\{\{([a-z]+)\}\}/gu;
 var PATH_PATTERN = "[A-Za-z0-9_@()[\\]./${}-]{1,240}";
 var SAFE_PATH = new RegExp(`^${PATH_PATTERN}$`, "u");
-var MODULE_PATH = /^[A-Za-z0-9_@()[\]./${}-]+\.(?:[cm]?[jt]sx?)$/u;
-var FRAMEWORK_CONFIG_NAME = /^(?:next|open-next|vite)\.config\.(?:js|mjs|ts)$/u;
+var MODULE_PATH = /^[A-Za-z0-9_@()[\]./${}-]+\.(?:astro|[cm]?[jt]sx?)$/u;
+var FRAMEWORK_CONFIG_NAME = /^(?:astro|next|open-next|vite)\.config\.(?:js|mjs|ts)$/u;
 var MAXIMUM_DETAIL_LENGTH = 2e3;
 var DETAIL_PATTERNS = Object.freeze(Object.entries(DETAIL_DEFINITIONS).map(([code, definition]) => Object.freeze({
   code,
@@ -23232,7 +23257,7 @@ function exact3(v, keys) {
 // apps/product-cli/package.json
 var package_default2 = {
   name: "@ohmyhost/product-cli",
-  version: "0.1.34",
+  version: "0.1.35",
   private: true,
   ohmyhost: {
     deployment: "production",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@amerged/ohmyhost-mcp",
-  "version": "0.1.34",
+  "version": "0.1.35",
   "type": "module",
   "engines": {
     "node": ">=22"

package/src/apps/mcp/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ohmyhost/mcp",
-  "version": "0.1.34",
+  "version": "0.1.35",
   "private": true,
   "ohmyhost": {
     "deployment": "production",

package/src/apps/product-cli/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ohmyhost/product-cli",
-  "version": "0.1.34",
+  "version": "0.1.35",
   "private": true,
   "ohmyhost": {
     "deployment": "production",

package/src/apps/product-cli/src/repository-init.ts

@@ -310,8 +310,12 @@ export async function initializeRepository(
       return match?.[1] === undefined || match[1].startsWith("_") ? [] : [match[1]];
     }),
   );
-  const apiRouteCount = applicationFiles.filter((path) =>
-    /^(?:src\/)?app\/api\/.+\/route\.(?:js|jsx|ts|tsx)$/u.test(path),
+  const apiRouteCount = applicationFiles.filter(
+    (path) =>
+      /^(?:src\/)?app\/api\/.+\/route\.(?:js|jsx|ts|tsx)$/u.test(path) ||
+      (framework === "astro" &&
+        /^src\/pages\/.+\.(?:js|ts)$/u.test(path) &&
+        !path.endsWith(".d.ts")),
   ).length;
   const supabase = dependencies.has("@supabase/supabase-js") || dependencies.has("@supabase/ssr");
   const configuredDatabase = existingConfiguration?.database?.enabled === true;
@@ -368,11 +372,15 @@ export async function initializeRepository(
   const targetStorage = r2 || supabaseStorage;
   // TanStack Start binds storage only on edge, as a Vite app does through its companion.
   const tanStackRuntime =
-    framework !== "tanstack-start"
+    framework !== "tanstack-start" && framework !== "astro"
       ? null
       : targetStorage
         ? "edge"
-        : proposedTanStackRuntime(frameworkConfig, dependencies);
+        : framework === "astro"
+          ? dependencies.has("@astrojs/cloudflare")
+            ? "edge"
+            : "static"
+          : proposedTanStackRuntime(frameworkConfig, dependencies);
   const companionRequired =
     framework === "vite" &&
     (existingConfiguration === null
@@ -390,7 +398,11 @@ export async function initializeRepository(
     databaseProvider,
     hasHealthcheck:
       applicationFiles.includes("src/app/api/health/route.ts") ||
-      applicationFiles.includes("app/api/health/route.ts"),
+      applicationFiles.includes("app/api/health/route.ts") ||
+      (framework === "astro" &&
+        applicationFiles.some((path) =>
+          /^src\/pages\/api\/health(?:\/index)?\.(?:js|ts)$/u.test(path),
+        )),
     mailEnabled: targetMail,
     betterAuthEnabled: targetBetterAuth,
     storageEnabled: targetStorage,
@@ -596,7 +608,10 @@ async function workerModuleBlockers(context: SourceCheckContext): Promise<Reposi
   const scheduled =
     (config?.functions?.crons.length ?? 0) > 0 &&
     ((mode === "edge" &&
-      (framework === "vite" || framework === "nextjs" || framework === "tanstack-start")) ||
+      (framework === "astro" ||
+        framework === "vite" ||
+        framework === "nextjs" ||
+        framework === "tanstack-start")) ||
       (mode === "functions" && framework === "functions"));
   const path = framework === "vite" ? VITE_COMPANION_ENTRY_PATH : WORKER_MODULE_PATH;
   if ((framework !== "functions" && !scheduled) || !files.includes(path)) return [];
@@ -989,7 +1004,10 @@ function hasDirectSafeBuildCommand(
   const scripts = manifest["scripts"];
   if (!isRecord(scripts) || typeof scripts["build"] !== "string") return false;
   return (
-    (framework === "nextjs" || framework === "vite" || framework === "tanstack-start") &&
+    (framework === "astro" ||
+      framework === "nextjs" ||
+      framework === "vite" ||
+      framework === "tanstack-start") &&
     isAdmittedFrameworkBuildScript(framework, scripts["build"])
   );
 }
@@ -1144,10 +1162,23 @@ async function readFrameworkConfig(
   files: readonly string[],
   framework: RepositoryFramework,
 ): Promise<FrameworkConfigText | null> {
-  if (framework !== "nextjs" && framework !== "vite" && framework !== "tanstack-start") return null;
+  if (
+    framework !== "astro" &&
+    framework !== "nextjs" &&
+    framework !== "vite" &&
+    framework !== "tanstack-start"
+  )
+    return null;
   let path: string | null;
   try {
-    path = resolveFrameworkConfig(framework === "nextjs" ? "next.config" : "vite.config", files);
+    path = resolveFrameworkConfig(
+      framework === "astro"
+        ? "astro.config"
+        : framework === "nextjs"
+          ? "next.config"
+          : "vite.config",
+      files,
+    );
   } catch (error) {
     // The shared rules name the ambiguous variants; none of them is judged.
     if (error instanceof FrameworkAdmissionError) return null;
@@ -1266,7 +1297,11 @@ function renderConfiguration(input: {
 
   let output = "dist";
   if (input.framework === "nextjs") output = ".open-next/assets";
-  else if (input.framework === "tanstack-start") output = "dist/client";
+  else if (
+    input.framework === "tanstack-start" ||
+    (input.framework === "astro" && input.tanStackRuntime === "edge")
+  )
+    output = "dist/client";
 
   let mode = "auto";
   if (input.framework === "functions") mode = "functions";

package/src/packages/agent-skills/src/generated-skill-resources.ts

@@ -8,7 +8,7 @@ export const GENERATED_SKILL_RESOURCES = Object.freeze([
     description:
       "Build or adapt a TypeScript Vite, TanStack Start, Next.js (including Cache Components) or plain Worker application for ohmyho.st, with managed PostgreSQL, private files, mail, schedules, declared browser origins, egress, video or microphone access. Use for application feature work and source preparation; use the migration Skill for selected Supabase conversion.",
     mimeType: "text/markdown",
-    text: "---\nname: ohmyhost-build-portable-app\ndescription: Build or adapt a TypeScript Vite, TanStack Start, Next.js (including Cache Components) or plain Worker application for ohmyho.st, with managed PostgreSQL, private files, mail, schedules, declared browser origins, egress, video or microphone access. Use for application feature work and source preparation; use the migration Skill for selected Supabase conversion.\n---\n\n# Build an app for ohmyho.st\n\nPrepare the application's real capabilities, then verify them after deployment.\n\n1. Inspect the selected repository and, with a local checkout, run `ohmyhost init --dry-run --json`. In a native chat, inspect the saved source files and apply the runtime references through the remote file tools; use the actual plan/build diagnostics, without claiming a local command ran. Preserve a valid existing `ohmyhost.yaml`, application root, egress rules, auth choice and migrations. Resolve the returned blockers and requirements rather than replacing the configuration with a reduced file.\n2. Keep one exactly pinned package manager and its matching lockfile. Read `compatibility.frameworks[].status`: `admitted` meets the framework's security floor, `pending` is a version range the build checks after installing it, and `unsupported` blocks until the package is at its `minimum` or a later stable release.\n3. Read [the runtime contracts](references/stack-contracts.md) for the capabilities the app needs. Keep ordinary Next.js routes, native TanStack Start server functions, the returned Vite API companion contract, or a plain Worker module (`runtime.mode: functions`, `src/ohmyhost/worker.ts`). The service supplies its build adapter; do not add customer Wrangler/OpenNext configuration merely to host the app. Next.js 16 Cache Components and `\"use cache\"` build here: request-time `\"use cache\"` values are never stored, prerendered values stay until the next deployment, and revalidation is refused, so follow the contracts' Cache Components rules. A `create-next-app` 16.4 app with Tailwind CSS first needs the PostCSS configuration the contracts describe (`next_tailwind_turbopack_only`). Video, audio or microphone need the `_headers` opt-in from the contracts.\n4. For managed Postgres, use the supported application database binding and immutable expand-only migrations. Reach it through `createPrivateDatabaseClient`; use bounded `withConnection` for interactive transactions. Keep network transfers, email and AI calls outside that connection scope. Adding nullable columns without defaults is admitted; DROP, row changes, CREATE OR REPLACE and other changes to existing schema are refused. Preserve production records and read the database Skill for migration limits, sizing, data assignments or reset.\n5. Keep the application's own authentication provider. Better Auth and customer-owned WorkOS are the verified integrations; any other OAuth or OIDC provider is an ordinary application dependency with its own setup and runtime requirements and no completed support claim. Configure actual callback/logout URLs and server secrets, then test login, a protected route, reload and logout. A public app needs no auth provider. Detect actual Supabase capability usage before proposing a migration; an SDK declaration alone does not justify replacing it.\n6. For sending or receiving email, follow [the mail workflow](references/mail.md): choose the customer domain explicitly, prepare and verify a signed application webhook before receiving, and store incoming mail in the customer database. Enable only used capabilities. Server requests to an origin omitted from `runtime.egress.allow` answer HTTP 403 `Egress denied`; browser resources use the separate declared `runtime.browser` policy. Use the current client/runtime libraries and let `init` report missing routes or capabilities. Do not remove a required feature just to obtain a successful build.\n7. Run the application's relevant tests, typecheck and framework build through the available execution tools. Prefer focused regressions for the changed behavior and real hosted capability checks; respect the customer's requested verification scope without adding a broad test program. A native chat without test execution must identify that limitation and use actual hosted plan/build results and interaction checks, not invent test success. Use **ohmyhost-deploy** to reuse the saved source, deliver environment secrets privately and verify the hosted app's required reads, writes and integrations.\n\nResolve hosted bindings and trusted configuration from the framework's actual request context. A localhost-only test runtime or a successful health endpoint does not establish production login, tenant setup or background processing. Follow the runtime reference for first-user bootstrap, private uploads and bounded scheduled work when the application needs them.\n\nFor first account setup, use **ohmyhost-get-started**. For publishing, use **ohmyhost-deploy**;\nuse **ohmyhost-deploy-github** only for the selected GitHub source route. [The CLI reference](references/cli-deploy.md) supplies detailed commands when a local checkout is available. For a failed operation, use **ohmyhost-troubleshoot-deployment** and retain its original ID.\n\nReport a suspected hosting bug with `feedback_submit` and a minimal redacted reproduction. Return a working application URL only after its required flows pass. Promotion, rollback and deletion follow the customer's requested scope; an ordinary deploy does not require deleting their app for a cleanup test.\n",
+    text: "---\nname: ohmyhost-build-portable-app\ndescription: Build or adapt a TypeScript Vite, TanStack Start, Next.js (including Cache Components) or plain Worker application for ohmyho.st, with managed PostgreSQL, private files, mail, schedules, declared browser origins, egress, video or microphone access. Use for application feature work and source preparation; use the migration Skill for selected Supabase conversion.\n---\n\n# Build an app for ohmyho.st\n\nPrepare the application's real capabilities, then verify them after deployment.\n\n1. Inspect the selected repository and, with a local checkout, run `ohmyhost init --dry-run --json`. In a native chat, inspect the saved source files and apply the runtime references through the remote file tools; use the actual plan/build diagnostics, without claiming a local command ran. Preserve a valid existing `ohmyhost.yaml`, application root, egress rules, auth choice and migrations. Resolve the returned blockers and requirements rather than replacing the configuration with a reduced file.\n2. Keep one exactly pinned package manager and its matching lockfile. Read `compatibility.frameworks[].status`: `admitted` meets the framework's security floor, `pending` is a version range the build checks after installing it, and `unsupported` blocks until the package is at its `minimum` or a later stable release.\n3. Read [the runtime contracts](references/stack-contracts.md) for the capabilities the app needs. Keep ordinary Astro pages/endpoints, Next.js routes, native TanStack Start server functions, the returned Vite API companion contract, or a plain Worker module (`runtime.mode: functions`, `src/ohmyhost/worker.ts`). The service supplies its build adapter; do not add customer Wrangler/OpenNext configuration merely to host the app. Next.js 16 Cache Components and `\"use cache\"` build here: request-time `\"use cache\"` values are never stored, prerendered values stay until the next deployment, and revalidation is refused, so follow the contracts' Cache Components rules. A `create-next-app` 16.4 app with Tailwind CSS first needs the PostCSS configuration the contracts describe (`next_tailwind_turbopack_only`). Video, audio or microphone need the `_headers` opt-in from the contracts.\n4. For managed Postgres, use the supported application database binding and immutable expand-only migrations. Reach it through `createPrivateDatabaseClient`; use bounded `withConnection` for interactive transactions. Keep network transfers, email and AI calls outside that connection scope. Adding nullable columns without defaults is admitted; DROP, row changes, CREATE OR REPLACE and other changes to existing schema are refused. Preserve production records and read the database Skill for migration limits, sizing, data assignments or reset.\n5. Keep the application's own authentication provider. Better Auth and customer-owned WorkOS are the verified integrations; any other OAuth or OIDC provider is an ordinary application dependency with its own setup and runtime requirements and no completed support claim. Configure actual callback/logout URLs and server secrets, then test login, a protected route, reload and logout. A public app needs no auth provider. Detect actual Supabase capability usage before proposing a migration; an SDK declaration alone does not justify replacing it.\n6. For sending or receiving email, follow [the mail workflow](references/mail.md): choose the customer domain explicitly, prepare and verify a signed application webhook before receiving, and store incoming mail in the customer database. Enable only used capabilities. Server requests to an origin omitted from `runtime.egress.allow` answer HTTP 403 `Egress denied`; browser resources use the separate declared `runtime.browser` policy. Use the current client/runtime libraries and let `init` report missing routes or capabilities. Do not remove a required feature just to obtain a successful build.\n7. Run the application's relevant tests, typecheck and framework build through the available execution tools. Prefer focused regressions for the changed behavior and real hosted capability checks; respect the customer's requested verification scope without adding a broad test program. A native chat without test execution must identify that limitation and use actual hosted plan/build results and interaction checks, not invent test success. Use **ohmyhost-deploy** to reuse the saved source, deliver environment secrets privately and verify the hosted app's required reads, writes and integrations.\n\nResolve hosted bindings and trusted configuration from the framework's actual request context. A localhost-only test runtime or a successful health endpoint does not establish production login, tenant setup or background processing. Follow the runtime reference for first-user bootstrap, private uploads and bounded scheduled work when the application needs them.\n\nFor first account setup, use **ohmyhost-get-started**. For publishing, use **ohmyhost-deploy**;\nuse **ohmyhost-deploy-github** only for the selected GitHub source route. [The CLI reference](references/cli-deploy.md) supplies detailed commands when a local checkout is available. For a failed operation, use **ohmyhost-troubleshoot-deployment** and retain its original ID.\n\nReport a suspected hosting bug with `feedback_submit` and a minimal redacted reproduction. Return a working application URL only after its required flows pass. Promotion, rollback and deletion follow the customer's requested scope; an ordinary deploy does not require deleting their app for a cleanup test.\n\n## Astro\n\nUse the [Astro guide](https://docs.ohmyho.st/frameworks/astro). Static uses `astro build`, `runtime.mode: static` and `build.output: dist` without a server adapter. SSR uses the official `@astrojs/cloudflare` adapter, `output: \"server\"`, `runtime.mode: edge`, `build.output: dist/client`, `session: false` and `cloudflare({ imageService: \"passthrough\" })`. Keep the standard `src/` and output directories. The service supplies the deployment config. No native KV sessions, provider cache, Images or customer-defined Cloudflare resources are supported initially. Keep server imports in frontmatter or ordinary modules; put dynamic browser imports in a normal statically imported browser module rather than an Astro template. Verify request-time behavior plus browser islands under hosted CSP. Static build-time filesystem/MDX work remains ordinary Node build work; enable no request-time capabilities on a static plan.\n",
   },
   {
     skillName: "ohmyhost-build-portable-app",

package/src/packages/contracts/src/framework-admission.ts

@@ -19,7 +19,11 @@ export type LockfileName =
   | "package-lock.json"
   | "pnpm-lock.yaml"
   | "yarn.lock";
-export type FrameworkConfigBasename = "next.config" | "open-next.config" | "vite.config";
+export type FrameworkConfigBasename =
+  | "astro.config"
+  | "next.config"
+  | "open-next.config"
+  | "vite.config";
 
 export type FrameworkAdmissionReason =
   | "ambiguous_config"
@@ -311,11 +315,15 @@ interface DetailDefinition {
 }
 
 const FRAMEWORK_VERSION_PACKAGES = Object.freeze([
+  "astro",
+  "@astrojs/cloudflare",
   "next",
   "vite",
   "@tanstack/react-start",
 ] as const satisfies readonly FrameworkVersionPackage[]);
 const FRAMEWORK_DEPENDENCY_PACKAGES = Object.freeze([
+  "astro",
+  "@astrojs/cloudflare",
   "next",
   "react",
   "react-dom",
@@ -326,7 +334,12 @@ const FRAMEWORK_DEPENDENCY_PACKAGES = Object.freeze([
   "@cloudflare/vite-plugin",
 ] as const);
 const REACT_PACKAGES = Object.freeze(["react", "react-dom"] as const);
-const BUILD_FRAMEWORKS = Object.freeze(["nextjs", "vite-static", "tanstack-start"] as const);
+const BUILD_FRAMEWORKS = Object.freeze([
+  "astro",
+  "nextjs",
+  "vite-static",
+  "tanstack-start",
+] as const);
 
 const PUSH_AND_PLAN = "Commit and push the change, then plan the new commit.";
 const VITE_BUILD_SCRIPT =
@@ -335,6 +348,16 @@ const VITE_BUILD_SCRIPT =
 // Each sentence names the file, the rule and the exact change. Render and parse both derive from
 // the template, so a client maps a detail back to exactly one typed diagnostic.
 const FRAMEWORK_CONVERSION_DETAILS = Object.freeze({
+  astro_template_import_unsupported: {
+    paths: ["module"],
+    template:
+      '"{{path}}" uses a dynamic import, import.meta or require in an Astro template. Move server imports into frontmatter and dynamic browser imports into a normal statically imported browser module, then commit and push the change and plan the new commit.',
+  },
+  astro_config_unsupported: {
+    paths: ["framework_config"],
+    template:
+      '"{{path}}" must use the standard Astro output directories and root base. For edge use output: "server", @astrojs/cloudflare with imageService: "passthrough", and session: false. Static hosting must omit a server adapter. Additional Cloudflare bindings, custom sessions and provider cache are not supported. Commit and push the change, then plan the new commit.',
+  },
   managed_auth_database_required: {
     paths: ["repository_config"],
     template: managedCustomerAuthDatabaseMessage("{{path}}"),
@@ -417,6 +440,7 @@ const FRAMEWORK_CONVERSION_DETAILS = Object.freeze({
             'exactly "next build" or "next build --webpack"; ohmyho.st adds the OpenNext build itself',
           "vite-static": VITE_BUILD_SCRIPT,
           "tanstack-start": VITE_BUILD_SCRIPT,
+          astro: 'exactly "astro build"',
         },
       },
     },
@@ -435,12 +459,12 @@ const FRAMEWORK_CONVERSION_DETAILS = Object.freeze({
   },
   framework_unsupported: {
     paths: ["manifest"],
-    template: `"{{path}}" declares none of next, vite or @tanstack/react-start. Add the app's framework to dependencies, or set runtime.mode: functions in ohmyhost.yaml and add src/ohmyhost/worker.ts. ${PUSH_AND_PLAN}`,
+    template: `"{{path}}" declares none of astro, next, vite or @tanstack/react-start. Add the app's framework to dependencies, or set runtime.mode: functions in ohmyhost.yaml and add src/ohmyhost/worker.ts. ${PUSH_AND_PLAN}`,
   },
   framework_ambiguous: {
     paths: ["manifest"],
     template:
-      '"{{path}}" declares next together with vite or @tanstack/react-start, so ohmyho.st cannot choose one framework. Remove the packages of the framework this application does not use, commit and push the change, then plan the new commit.',
+      '"{{path}}" declares competing application framework packages, so ohmyho.st cannot choose one framework. Remove the packages of the framework this application does not use, commit and push the change, then plan the new commit.',
   },
   lockfile_missing: {
     paths: ["manifest"],
@@ -487,6 +511,7 @@ const FRAMEWORK_CONVERSION_DETAILS = Object.freeze({
           "vite-static":
             "runtime.mode: edge with src/ohmyhost/companion.ts when database, auth, mail, storage or functions.crons is set, and static otherwise",
           "tanstack-start": "runtime.mode: edge, or static without functions.crons and storage",
+          astro: "runtime.mode: static for prerendered sites, or edge with the Cloudflare adapter",
         },
       },
     },
@@ -502,6 +527,7 @@ const FRAMEWORK_CONVERSION_DETAILS = Object.freeze({
           nextjs: ".open-next/assets",
           "vite-static": "dist",
           "tanstack-start": "dist/client",
+          astro: "dist for static, or dist/client for edge",
         },
       },
     },
@@ -585,8 +611,8 @@ const DETAIL_DEFINITIONS: Readonly<Record<FrameworkConversionDiagnosticCode, Det
 const PLACEHOLDER = /\{\{([a-z]+)\}\}/gu;
 const PATH_PATTERN = "[A-Za-z0-9_@()[\\]./${}-]{1,240}";
 const SAFE_PATH = new RegExp(`^${PATH_PATTERN}$`, "u");
-const MODULE_PATH = /^[A-Za-z0-9_@()[\]./${}-]+\.(?:[cm]?[jt]sx?)$/u;
-const FRAMEWORK_CONFIG_NAME = /^(?:next|open-next|vite)\.config\.(?:js|mjs|ts)$/u;
+const MODULE_PATH = /^[A-Za-z0-9_@()[\]./${}-]+\.(?:astro|[cm]?[jt]sx?)$/u;
+const FRAMEWORK_CONFIG_NAME = /^(?:astro|next|open-next|vite)\.config\.(?:js|mjs|ts)$/u;
 // The public problem detail bound; every rendered sentence stays far below it.
 const MAXIMUM_DETAIL_LENGTH = 2_000;
 const DETAIL_PATTERNS = Object.freeze(

package/src/packages/contracts/src/framework-build-script.mjs

@@ -1,7 +1,7 @@
 export const PINNED_BUN_VERSION = "1.2.22";
 
 /**
- * @typedef {"next" | "vite" | "@tanstack/react-start"} FrameworkVersionPackage
+ * @typedef {"next" | "vite" | "astro" | "@astrojs/cloudflare" | "@tanstack/react-start"} FrameworkVersionPackage
  * @typedef {Readonly<{
  *   floors: readonly string[];
  *   denied: readonly (readonly [string, string | null])[];
@@ -22,6 +22,11 @@ export const PINNED_BUN_VERSION = "1.2.22";
  * @type {FrameworkVersionPolicy}
  */
 export const FRAMEWORK_VERSION_POLICY = Object.freeze({
+  astro: Object.freeze({ floors: Object.freeze(["7.4.0"]), denied: Object.freeze([]) }),
+  "@astrojs/cloudflare": Object.freeze({
+    floors: Object.freeze(["14.4.0"]),
+    denied: Object.freeze([]),
+  }),
   next: Object.freeze({ floors: Object.freeze(["15.5.27", "16.3.8"]), denied: Object.freeze([]) }),
   vite: Object.freeze({ floors: Object.freeze(["5.4.6"]), denied: Object.freeze([]) }),
   "@tanstack/react-start": Object.freeze({
@@ -164,12 +169,13 @@ const TYPESCRIPT_BUILD_STAGE = /^tsc(?:[ \t]+(?:--noEmit|-b|--build))?$/u;
 
 /**
  * The same source is consumed by local admission, framework adapters and the build sandbox.
- * @param {"nextjs" | "tanstack-start" | "vite"} framework
+ * @param {"astro" | "nextjs" | "tanstack-start" | "vite"} framework
  * @param {unknown} script
  * @returns {boolean}
  */
 export function isAdmittedFrameworkBuildScript(framework, script) {
   if (typeof script !== "string") return false;
+  if (framework === "astro") return script === "astro build";
   if (framework === "nextjs") return script === "next build" || script === "next build --webpack";
   if (framework !== "vite" && framework !== "tanstack-start") return false;
   const stages = script.trim().split(/[ \t]*&&[ \t]*/u);

package/src/packages/contracts/src/framework-family.ts

@@ -1,4 +1,5 @@
 export type FrameworkFamilyClassification =
+  | "astro"
   | "ambiguous"
   | "nextjs"
   | "tanstack-start"
@@ -8,9 +9,12 @@ export type FrameworkFamilyClassification =
 export function classifyFrameworkFamily(
   dependencies: ReadonlySet<string>,
 ): FrameworkFamilyClassification {
+  const astro = dependencies.has("astro");
   const next = dependencies.has("next");
   const tanStack = dependencies.has("@tanstack/react-start");
   const vite = dependencies.has("vite");
+  if (astro && (next || tanStack)) return "ambiguous";
+  if (astro) return "astro";
   if (next && (tanStack || vite)) return "ambiguous";
   if (next) return "nextjs";
   if (tanStack) return "tanstack-start";

package/src/packages/contracts/src/framework-source-rules.ts

@@ -40,7 +40,12 @@ export const WORKER_MODULE_PATH = "src/ohmyhost/worker.ts" as const;
 /** The Worker module of a Vite application with a server runtime. */
 export const VITE_COMPANION_ENTRY_PATH = "src/ohmyhost/companion.ts" as const;
 
-export type FrameworkSourceFramework = "functions" | "nextjs" | "tanstack-start" | "vite-static";
+export type FrameworkSourceFramework =
+  | "astro"
+  | "functions"
+  | "nextjs"
+  | "tanstack-start"
+  | "vite-static";
 export type PackageManifest = Readonly<Record<string, unknown>>;
 /**
  * Where package.json may declare a dependency: `runtime` only in dependencies, `build` also in
@@ -91,6 +96,7 @@ const DEPENDENCY_FIELDS = Object.freeze({
 // Next.js and TanStack Start load their runtime packages in the server bundle, so package.json
 // declares them in dependencies; Vite and its plugins only build, so devDependencies suffice.
 const REQUIRED_DEPENDENCIES = Object.freeze({
+  astro: Object.freeze([["astro", "build"]] as const),
   nextjs: Object.freeze([
     ["next", "runtime"],
     ["react", "runtime"],
@@ -109,6 +115,7 @@ const REQUIRED_DEPENDENCIES = Object.freeze({
 } satisfies Record<FrameworkSourceFramework, readonly (readonly [string, DependencyPlacement])[]>);
 const TANSTACK_EDGE_DEPENDENCY = Object.freeze([CLOUDFLARE_PLUGIN, "build"] as const);
 const BUILD_SCRIPT_FRAMEWORKS = Object.freeze({
+  astro: "astro",
   nextjs: "nextjs",
   "vite-static": "vite",
   "tanstack-start": "tanstack-start",
@@ -118,7 +125,11 @@ const BUILD_OUTPUTS: Readonly<Partial<Record<FrameworkSourceFramework, string>>>
   "tanstack-start": "dist/client",
 });
 const REQUIRED_CONFIG_PATHS: Readonly<Partial<Record<FrameworkSourceFramework, string>>> =
-  Object.freeze({ nextjs: "next.config.ts", "tanstack-start": "vite.config.ts" });
+  Object.freeze({
+    astro: "astro.config.mjs",
+    nextjs: "next.config.ts",
+    "tanstack-start": "vite.config.ts",
+  });
 // The PostCSS configuration the Next.js Webpack build reads: package.json "postcss" or one of these
 // files at the application root. It never reads a TypeScript one such as postcss.config.ts.
 const POSTCSS_CONFIG_PATH = /^(?:postcss\.config\.(?:[cm]?js|json)|\.postcssrc\.(?:js|json))$/u;
@@ -214,7 +225,10 @@ export function frameworkVersionAdmissions(
 ): readonly FrameworkVersionAdmission[] {
   const admissions: FrameworkVersionAdmission[] = [];
   let locked: ((packageName: string) => string | null) | undefined;
-  for (const [name, placement] of REQUIRED_DEPENDENCIES[framework]) {
+  for (const [name, placement] of framework === "astro" &&
+  declaredDependency(manifest, "@astrojs/cloudflare", "build") !== null
+    ? [...REQUIRED_DEPENDENCIES.astro, ["@astrojs/cloudflare", "build"] as const]
+    : REQUIRED_DEPENDENCIES[framework]) {
     if (!isFrameworkVersionPackage(name)) continue;
     const declared = declaredDependency(manifest, name, placement);
     if (declared === null) continue;
@@ -504,7 +518,7 @@ export function sourceWithoutComments(source: string): string {
  * extensions planning reads, without TypeScript declaration files, which never run.
  */
 export function isDatabaseContractModule(path: string): boolean {
-  return /\.(?:ts|tsx|js|jsx|mjs|mts)$/u.test(path) && !/\.d\.[cm]?ts$/u.test(path);
+  return /\.(?:astro|ts|tsx|js|jsx|mjs|mts)$/u.test(path) && !/\.d\.[cm]?ts$/u.test(path);
 }
 
 function manifestFindings(
@@ -524,9 +538,11 @@ function manifestFindings(
       diagnostic({ code: "build_script_unsupported", path: PACKAGE_MANIFEST, framework }),
     );
   const required =
-    framework === "tanstack-start" && configuration.runtime.mode === "edge"
-      ? [...REQUIRED_DEPENDENCIES[framework], TANSTACK_EDGE_DEPENDENCY]
-      : REQUIRED_DEPENDENCIES[framework];
+    framework === "astro" && configuration.runtime.mode === "edge"
+      ? [...REQUIRED_DEPENDENCIES.astro, ["@astrojs/cloudflare", "build"] as const]
+      : framework === "tanstack-start" && configuration.runtime.mode === "edge"
+        ? [...REQUIRED_DEPENDENCIES[framework], TANSTACK_EDGE_DEPENDENCY]
+        : REQUIRED_DEPENDENCIES[framework];
   for (const [name, placement] of required)
     if (declaredDependency(manifest, name, placement) === null)
       findings.push(
@@ -567,7 +583,12 @@ function configurationFindings(input: FrameworkSourceRuleInput): FrameworkConver
     );
   if (build !== null && framework !== "nextjs" && build.ssg_cache_max_mib !== undefined)
     findings.push(diagnostic({ code: "build_option_unsupported", path: REPOSITORY_CONFIG }));
-  const output = BUILD_OUTPUTS[framework];
+  const output =
+    framework === "astro"
+      ? configuration.runtime.mode === "edge"
+        ? "dist/client"
+        : "dist"
+      : BUILD_OUTPUTS[framework];
   if (build !== null && output !== undefined && build.output !== output)
     findings.push(
       diagnostic({ code: "build_output_unsupported", path: REPOSITORY_CONFIG, framework }),
@@ -592,6 +613,7 @@ function configurationFindings(input: FrameworkSourceRuleInput): FrameworkConver
     (framework === "functions" ||
       (crons &&
         (framework === "nextjs" ||
+          (framework === "astro" && configuration.runtime.mode === "edge") ||
           (framework === "tanstack-start" && configuration.runtime.mode === "edge")))) &&
     !files.includes(WORKER_MODULE_PATH)
   )
@@ -607,6 +629,16 @@ function runtimeModeAdmitted(
   crons: boolean,
 ): boolean {
   const mode = configuration.runtime.mode;
+  if (framework === "astro")
+    return (
+      mode === "edge" ||
+      (mode === "static" &&
+        !crons &&
+        configuration.storage === undefined &&
+        configuration.database?.enabled !== true &&
+        configuration.mail?.enabled !== true &&
+        configuration.auth?.provider !== "better-auth")
+    );
   if (framework === "nextjs") return mode === "edge";
   if (framework === "vite-static")
     return mode === (viteCompanionRequired(configuration) ? "edge" : "static");
@@ -629,6 +661,8 @@ function frameworkConfigFindings(
   const { frameworkConfig, framework } = input;
   if (frameworkConfig === null || framework === "functions") return [];
   const { path, text } = frameworkConfig;
+  if (framework === "astro")
+    return astroConfigFindings(text, path, input.configuration.runtime.mode);
   if (framework === "nextjs") return nextConfigFindings(text, path, hasPostcssConfiguration(input));
   if (framework === "vite-static") return viteConfigFindings(text, path);
   const mode = input.configuration.runtime.mode;
@@ -660,7 +694,14 @@ function frameworkConfigPath(
 ): string | null {
   if (framework === "functions") return null;
   const path = admitted(findings, () =>
-    resolveFrameworkConfig(framework === "nextjs" ? "next.config" : "vite.config", files),
+    resolveFrameworkConfig(
+      framework === "astro"
+        ? "astro.config"
+        : framework === "nextjs"
+          ? "next.config"
+          : "vite.config",
+      files,
+    ),
   );
   if (framework === "nextjs")
     admitted(findings, () => resolveFrameworkConfig("open-next.config", files));
@@ -1116,3 +1157,31 @@ function hasModuleImport(tokens: readonly ConfigToken[], moduleName: string): bo
       tokens[index + 1]?.value === moduleName,
   );
 }
+
+/** Astro's build validates executable config; admission rejects known incompatible contracts. */
+function astroConfigFindings(
+  text: string,
+  path: string,
+  mode: string,
+): readonly FrameworkConversionDiagnostic[] {
+  const lexed = lexFrameworkConfig(text, path);
+  if ("finding" in lexed) return [lexed.finding];
+  const tokens = lexed.tokens;
+  const hasPropertyKey = (items: readonly ConfigToken[], name: string) =>
+    items.some((token, index) => token.value === name && items[index + 1]?.value === ":");
+  const invalid =
+    hasNonRootProperty(tokens, ["base"], ["", "/"]) ||
+    ["srcDir", "outDir", "serverEntry", "client", "server", "assetsPrefix"].some((name) =>
+      hasPropertyKey(tokens, name),
+    ) ||
+    (mode === "edge"
+      ? !text.includes("@astrojs/cloudflare") ||
+        !hasProperty(tokens, "output", "server") ||
+        !hasProperty(tokens, "session", "false") ||
+        !hasProperty(tokens, "imageService", "passthrough") ||
+        hasPropertyKey(tokens, "cache")
+      : text.includes("@astrojs/cloudflare") ||
+        hasPropertyKey(tokens, "adapter") ||
+        hasProperty(tokens, "output", "server"));
+  return invalid ? [diagnostic({ code: "astro_config_unsupported", path })] : [];
+}

package/src/packages/sdk-ts/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ohmyhost/sdk-ts",
-  "version": "0.1.34",
+  "version": "0.1.35",
   "private": true,
   "type": "module",
   "exports": {