@louise-toolkit/astro 0.5.0 → 0.6.0

package/README.md

@@ -43,9 +43,19 @@ Pass `apiGate: true` to deny the editor API by default: every request under
 `/api/louise` must come from a signed-in editor before any route runs, with
 writes and WebSocket upgrades origin-checked. This is the same gate as
 `composeWorker({ gate })` (ADR 0012), for routes mounted as Astro API routes.
+
+An error a page, an endpoint, or the middleware throws is reported as an
+incident, then re-thrown, so Astro still renders its error page. Astro catches
+the error outside every middleware, so `composeWorker` never sees a throw; this
+is how it still reaches the sinks you gave `composeWorker`'s `onIncident`
+(ADR 0022). Pass `reportErrors: false` to turn it off.
 Middleware runs before Astro knows which route file answers, so a public route
 is declared by path: the toolkit's form, vitals, and status routes are exempt
 at their default paths, and `apiGate: { isPublic: (path) => … }` adds your own.
+An MCP endpoint that takes agent tokens is declared the same way:
+`apiGate: { takesBearer: (path) => path === LOUISE_MCP_PATH }` lets a request
+with `Authorization: Bearer` through to that path, and only that path, for the
+route to verify the token itself. It's off unless you set it.
 
 **Actions**: the editor write path as Astro Actions, so a save is a typed call
 rather than a hand-rolled endpoint. `louiseSaveAction`, `louiseSaveDraftAction`,

package/dist/middleware.d.ts

@@ -26,6 +26,18 @@ export interface LouiseMiddlewareApiGate {
      * way `publicRoute` does for `composeWorker`.
      */
     isPublic?: (pathname: string) => boolean;
+    /**
+     * Paths under the prefix whose route checks a bearer token itself—in
+     * practice, an `mcpRoute` given `resolveAgent`, at `LOUISE_MCP_PATH`. A
+     * request that carries `Authorization: Bearer` skips the gate on these paths
+     * and nowhere else; one without a bearer token is gated as usual.
+     *
+     * Off unless you set it: the gate can't see whether the route at a path
+     * checks tokens, and a route that relies on the gate alone would be open to
+     * any request with a bearer header. `composeWorker` needs none of this; it
+     * reads `bearerRoute`'s mark instead.
+     */
+    takesBearer?: (pathname: string) => boolean;
 }
 export interface LouiseMiddlewareConfig<TEditor = unknown> {
     /**
@@ -132,6 +144,18 @@ export interface LouiseMiddlewareConfig<TEditor = unknown> {
         location: string;
         status: number;
     } | null>;
+    /**
+     * Report an error a page, an endpoint, or this middleware throws as an
+     * incident (ADR 0022), then re-throw it, so Astro still renders its error
+     * page. Astro catches the error outside every middleware and answers with
+     * its 500, so `composeWorker` never sees a throw; this is how the error still
+     * reaches `composeWorker`'s `onIncident` sinks. Without `onIncident` it does
+     * nothing. Default `true`.
+     *
+     * An error a streamed page throws after its first bytes are sent happens
+     * outside every middleware, so no middleware can report it.
+     */
+    reportErrors?: boolean;
     /** Edit-mode cookie name. Default {@link LOUISE_EDIT_COOKIE} (`"louise_edit"`).
      *  Change it and the `withEdgeCache` bypass predicate must be told too, or an
      *  editor gets served the cached public page. */
@@ -140,7 +164,8 @@ export interface LouiseMiddlewareConfig<TEditor = unknown> {
 /**
  * Build the shared Louise Astro middleware: rate-limit → resolve the editor
  * session + sticky `?louise` edit mode → `next()` → content-freshness cache headers
- * + CSP `style-src` rewrite + transport security headers. Sites supply the bits
+ * + CSP `style-src` rewrite + transport security headers. A thrown error is
+ * reported as an incident and re-thrown (see {@link LouiseMiddlewareConfig.reportErrors}). Sites supply the bits
  * that vary via {@link LouiseMiddlewareConfig} and export the result as
  * `onRequest`.
  */

package/dist/middleware.js

@@ -19,11 +19,12 @@
 // This subpath is the ONE place Louise touches Astro's types—`astro` is an
 // optional peer, pulled in only by sites that import `louise-toolkit/astro`.
 import { allowCspDataFonts, louiseSecurityHeaders, matchRateRule, rateLimit, rewriteCspStyleSrc, } from "louise-toolkit/security";
-import { isLouisePublicPath, LOUISE_API_PREFIX, LOUISE_EDIT_COOKIE, louiseApiGate, underPrefix, } from "louise-toolkit/worker";
+import { hasBearerCredential, isLouisePublicPath, LOUISE_API_PREFIX, LOUISE_EDIT_COOKIE, louiseApiGate, reportIncident, underPrefix, } from "louise-toolkit/worker";
 /**
  * Build the shared Louise Astro middleware: rate-limit → resolve the editor
  * session + sticky `?louise` edit mode → `next()` → content-freshness cache headers
- * + CSP `style-src` rewrite + transport security headers. Sites supply the bits
+ * + CSP `style-src` rewrite + transport security headers. A thrown error is
+ * reported as an incident and re-thrown (see {@link LouiseMiddlewareConfig.reportErrors}). Sites supply the bits
  * that vary via {@link LouiseMiddlewareConfig} and export the result as
  * `onRequest`.
  */
@@ -33,7 +34,7 @@ export function createLouiseMiddleware(config) {
     const editCookie = config.editCookie ?? LOUISE_EDIT_COOKIE;
     const apiGate = config.apiGate === true ? {} : config.apiGate || undefined;
     const apiPrefix = apiGate?.prefix ?? LOUISE_API_PREFIX;
-    return async (context, next) => {
+    const handle = async (context, next) => {
         // Rate-limit the public, unauthenticated POST surfaces before any other
         // work. Keyed by client IP via a KV counter; `rateLimit` fails open on a KV
         // error so a limiter outage never takes down sign-in or the contact form.
@@ -100,7 +101,8 @@ export function createLouiseMiddleware(config) {
         const gatedApi = apiGate !== undefined &&
             underPrefix(pathname, apiPrefix) &&
             !isLouisePublicPath(pathname) &&
-            !apiGate.isPublic?.(pathname);
+            !apiGate.isPublic?.(pathname) &&
+            !(apiGate.takesBearer?.(pathname) && hasBearerCredential(context.request));
         if (gatedApi) {
             const denied = await louiseApiGate(context.request, undefined, {
                 resolveEditor: () => locals.editor,
@@ -159,6 +161,18 @@ export function createLouiseMiddleware(config) {
         }
         return finish(context, response);
     };
+    if (config.reportErrors === false)
+        return handle;
+    const reporting = async (context, next) => {
+        try {
+            return await handle(context, next);
+        }
+        catch (err) {
+            reportIncident({ kind: "fetch", cause: err, request: context.request });
+            throw err;
+        }
+    };
+    return reporting;
     /** The response-side work every answer gets, a gate refusal included. */
     function finish(context, response) {
         const locals = context.locals;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@louise-toolkit/astro",
-  "version": "0.5.0",
+  "version": "0.6.0",
   "description": "Astro adapter for louise-toolkit: middleware, Actions, content-layer loaders, and the forms schema bridge.",
   "keywords": [
     "astro",
@@ -35,7 +35,7 @@
     "access": "public"
   },
   "dependencies": {
-    "louise-toolkit": "0.36.0"
+    "louise-toolkit": "0.37.0"
   },
   "devDependencies": {
     "@cloudflare/workers-types": "^5.20260829.1",