@louise-toolkit/astro 0.4.0 → 0.6.0

package/README.md

@@ -43,9 +43,19 @@ Pass `apiGate: true` to deny the editor API by default: every request under
 `/api/louise` must come from a signed-in editor before any route runs, with
 writes and WebSocket upgrades origin-checked. This is the same gate as
 `composeWorker({ gate })` (ADR 0012), for routes mounted as Astro API routes.
+
+An error a page, an endpoint, or the middleware throws is reported as an
+incident, then re-thrown, so Astro still renders its error page. Astro catches
+the error outside every middleware, so `composeWorker` never sees a throw; this
+is how it still reaches the sinks you gave `composeWorker`'s `onIncident`
+(ADR 0022). Pass `reportErrors: false` to turn it off.
 Middleware runs before Astro knows which route file answers, so a public route
 is declared by path: the toolkit's form, vitals, and status routes are exempt
 at their default paths, and `apiGate: { isPublic: (path) => … }` adds your own.
+An MCP endpoint that takes agent tokens is declared the same way:
+`apiGate: { takesBearer: (path) => path === LOUISE_MCP_PATH }` lets a request
+with `Authorization: Bearer` through to that path, and only that path, for the
+route to verify the token itself. It's off unless you set it.
 
 **Actions**: the editor write path as Astro Actions, so a save is a typed call
 rather than a hand-rolled endpoint. `louiseSaveAction`, `louiseSaveDraftAction`,

package/dist/form-schema.d.ts

@@ -1,5 +1,5 @@
 import { z } from "astro/zod";
-import type { FormConfig } from "louise-toolkit/forms";
+import { type FormConfig } from "louise-toolkit/forms";
 /**
  * Build a Zod schema from a `defineForm` definition's fields—the form is the
  * single source of truth for its Astro Action `input`, so the handler receives a

package/dist/form-schema.js

@@ -19,18 +19,30 @@
 // Zod builder from `astro/zod` (an optional peer), so the framework-agnostic
 // core never takes a Zod dependency.
 import { z } from "astro/zod";
+import { coerceFormValue } from "louise-toolkit/forms";
+/** Coerce the way `formRoute` does, first, so an Action accepts what the route
+ *  accepts: a URL without a scheme, a number with the locale's separators. A
+ *  blank value becomes `undefined`, which an optional field allows. */
+function forgiving(field, locale, schema) {
+    return z.preprocess((raw) => coerceFormValue(field, raw, { locale }) ?? undefined, schema);
+}
 /** Map one form field to its Zod type, including the type's built-in format
  *  check (email/url) and coercion (number/date/checkbox). */
-function formFieldToZod(field) {
+function formFieldToZod(field, locale) {
     const required = field.required ?? false;
     switch (field.type) {
         case "email":
             return required ? z.email() : z.email().optional();
-        case "url":
-            return required ? z.url() : z.url().optional();
-        case "number":
-            // Form values arrive as strings; `coerce` turns "5" into 5.
-            return required ? z.coerce.number() : z.coerce.number().optional();
+        case "url": {
+            const url = z.url({ error: "Enter a web address, like example.com." });
+            return forgiving(field, locale, required ? url : url.optional());
+        }
+        case "number": {
+            // Form values arrive as strings; the shared coercion turns "1,200" into
+            // 1200 under the form's locale, and leaves anything else a string.
+            const number = z.number({ error: "Enter a number, like 1200." });
+            return forgiving(field, locale, required ? number : number.optional());
+        }
         case "date":
             // Accepts an ISO string, an epoch number, or a Date.
             return required ? z.coerce.date() : z.coerce.date().optional();
@@ -69,7 +81,7 @@ function formFieldToZod(field) {
 export function formToAstroSchema(form) {
     const shape = {};
     for (const [key, field] of Object.entries(form.fields)) {
-        shape[key] = formFieldToZod(field);
+        shape[key] = formFieldToZod(field, form.locale);
     }
     return z.object(shape);
 }

package/dist/middleware.d.ts

@@ -26,6 +26,18 @@ export interface LouiseMiddlewareApiGate {
      * way `publicRoute` does for `composeWorker`.
      */
     isPublic?: (pathname: string) => boolean;
+    /**
+     * Paths under the prefix whose route checks a bearer token itself—in
+     * practice, an `mcpRoute` given `resolveAgent`, at `LOUISE_MCP_PATH`. A
+     * request that carries `Authorization: Bearer` skips the gate on these paths
+     * and nowhere else; one without a bearer token is gated as usual.
+     *
+     * Off unless you set it: the gate can't see whether the route at a path
+     * checks tokens, and a route that relies on the gate alone would be open to
+     * any request with a bearer header. `composeWorker` needs none of this; it
+     * reads `bearerRoute`'s mark instead.
+     */
+    takesBearer?: (pathname: string) => boolean;
 }
 export interface LouiseMiddlewareConfig<TEditor = unknown> {
     /**
@@ -132,6 +144,18 @@ export interface LouiseMiddlewareConfig<TEditor = unknown> {
         location: string;
         status: number;
     } | null>;
+    /**
+     * Report an error a page, an endpoint, or this middleware throws as an
+     * incident (ADR 0022), then re-throw it, so Astro still renders its error
+     * page. Astro catches the error outside every middleware and answers with
+     * its 500, so `composeWorker` never sees a throw; this is how the error still
+     * reaches `composeWorker`'s `onIncident` sinks. Without `onIncident` it does
+     * nothing. Default `true`.
+     *
+     * An error a streamed page throws after its first bytes are sent happens
+     * outside every middleware, so no middleware can report it.
+     */
+    reportErrors?: boolean;
     /** Edit-mode cookie name. Default {@link LOUISE_EDIT_COOKIE} (`"louise_edit"`).
      *  Change it and the `withEdgeCache` bypass predicate must be told too, or an
      *  editor gets served the cached public page. */
@@ -140,7 +164,8 @@ export interface LouiseMiddlewareConfig<TEditor = unknown> {
 /**
  * Build the shared Louise Astro middleware: rate-limit → resolve the editor
  * session + sticky `?louise` edit mode → `next()` → content-freshness cache headers
- * + CSP `style-src` rewrite + transport security headers. Sites supply the bits
+ * + CSP `style-src` rewrite + transport security headers. A thrown error is
+ * reported as an incident and re-thrown (see {@link LouiseMiddlewareConfig.reportErrors}). Sites supply the bits
  * that vary via {@link LouiseMiddlewareConfig} and export the result as
  * `onRequest`.
  */

package/dist/middleware.js

@@ -19,11 +19,12 @@
 // This subpath is the ONE place Louise touches Astro's types—`astro` is an
 // optional peer, pulled in only by sites that import `louise-toolkit/astro`.
 import { allowCspDataFonts, louiseSecurityHeaders, matchRateRule, rateLimit, rewriteCspStyleSrc, } from "louise-toolkit/security";
-import { isLouisePublicPath, LOUISE_API_PREFIX, LOUISE_EDIT_COOKIE, louiseApiGate, underPrefix, } from "louise-toolkit/worker";
+import { hasBearerCredential, isLouisePublicPath, LOUISE_API_PREFIX, LOUISE_EDIT_COOKIE, louiseApiGate, reportIncident, underPrefix, } from "louise-toolkit/worker";
 /**
  * Build the shared Louise Astro middleware: rate-limit → resolve the editor
  * session + sticky `?louise` edit mode → `next()` → content-freshness cache headers
- * + CSP `style-src` rewrite + transport security headers. Sites supply the bits
+ * + CSP `style-src` rewrite + transport security headers. A thrown error is
+ * reported as an incident and re-thrown (see {@link LouiseMiddlewareConfig.reportErrors}). Sites supply the bits
  * that vary via {@link LouiseMiddlewareConfig} and export the result as
  * `onRequest`.
  */
@@ -33,7 +34,7 @@ export function createLouiseMiddleware(config) {
     const editCookie = config.editCookie ?? LOUISE_EDIT_COOKIE;
     const apiGate = config.apiGate === true ? {} : config.apiGate || undefined;
     const apiPrefix = apiGate?.prefix ?? LOUISE_API_PREFIX;
-    return async (context, next) => {
+    const handle = async (context, next) => {
         // Rate-limit the public, unauthenticated POST surfaces before any other
         // work. Keyed by client IP via a KV counter; `rateLimit` fails open on a KV
         // error so a limiter outage never takes down sign-in or the contact form.
@@ -100,7 +101,8 @@ export function createLouiseMiddleware(config) {
         const gatedApi = apiGate !== undefined &&
             underPrefix(pathname, apiPrefix) &&
             !isLouisePublicPath(pathname) &&
-            !apiGate.isPublic?.(pathname);
+            !apiGate.isPublic?.(pathname) &&
+            !(apiGate.takesBearer?.(pathname) && hasBearerCredential(context.request));
         if (gatedApi) {
             const denied = await louiseApiGate(context.request, undefined, {
                 resolveEditor: () => locals.editor,
@@ -159,6 +161,18 @@ export function createLouiseMiddleware(config) {
         }
         return finish(context, response);
     };
+    if (config.reportErrors === false)
+        return handle;
+    const reporting = async (context, next) => {
+        try {
+            return await handle(context, next);
+        }
+        catch (err) {
+            reportIncident({ kind: "fetch", cause: err, request: context.request });
+            throw err;
+        }
+    };
+    return reporting;
     /** The response-side work every answer gets, a gate refusal included. */
     function finish(context, response) {
         const locals = context.locals;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@louise-toolkit/astro",
-  "version": "0.4.0",
+  "version": "0.6.0",
   "description": "Astro adapter for louise-toolkit: middleware, Actions, content-layer loaders, and the forms schema bridge.",
   "keywords": [
     "astro",
@@ -35,7 +35,7 @@
     "access": "public"
   },
   "dependencies": {
-    "louise-toolkit": "0.35.0"
+    "louise-toolkit": "0.37.0"
   },
   "devDependencies": {
     "@cloudflare/workers-types": "^5.20260829.1",