astroidjs 0.10.0 → 0.12.0

package/dist/astro/csp.d.ts

@@ -1,4 +1,5 @@
-import type { AstroidConfig, CspOrigins } from "../config.js";
+import type { AstroidConfig } from "../config.js";
+export { astroidCspOrigins } from "../security/csp-origins.js";
 /** A `sha256-…` CSP hash, in the shape Astro's `security.csp.hashes` takes. */
 export type CspHash = `${"sha256" | "sha384" | "sha512"}-${string}`;
 /**
@@ -38,12 +39,6 @@ export interface AstroidSecurityConfig {
  * hash on the next build.
  */
 export declare function solidHydrationHash(): CspHash;
-/**
- * Every origin the project's enabled modules need, merged with the config's own
- * `security.cspOrigins`. Exported so a site (or `astroid doctor`) can inspect
- * what a config implies without rebuilding the whole policy.
- */
-export declare function astroidCspOrigins(config: AstroidConfig): Required<CspOrigins>;
 /**
  * The `security` block for `astro.config.mjs` — Astro's half of the split.
  *
@@ -61,4 +56,3 @@ export declare function astroidSecurity(config: AstroidConfig): AstroidSecurityC
 export declare const ASTROID_VITE_BUILD: {
     readonly assetsInlineLimit: 0;
 };
-export {};

package/dist/astro/csp.js

@@ -27,7 +27,8 @@
 // imports.
 import { createHash } from "node:crypto";
 import { generateHydrationScript } from "solid-js/web";
-import { astroidCommerceProviders } from "../commerce/roles.js";
+import { astroidCspOrigins } from "../security/csp-origins.js";
+export { astroidCspOrigins } from "../security/csp-origins.js";
 /**
  * Hash of Solid's inline hydration bootstrap.
  *
@@ -42,80 +43,6 @@ export function solidHydrationHash() {
     const inner = generateHydrationScript().match(/<script[^>]*>([\s\S]*?)<\/script>/)?.[1] ?? "";
     return `sha256-${createHash("sha256").update(inner).digest("base64")}`;
 }
-/** Origins a commerce provider's client-side SDK needs. Server-only providers
- *  (Fourthwall's storefront API) contribute nothing but their image host. */
-const COMMERCE_ORIGINS = {
-    // Square Web Payments renders the card form in an iframe from the squarecdn
-    // hosts, tokenizes against pci-connect, and pulls its own fonts. Both the
-    // sandbox and production hosts are listed so ONE build serves either
-    // environment — which environment you're in is a runtime secret, not a
-    // build-time one.
-    square: {
-        script: ["https://sandbox.web.squarecdn.com", "https://web.squarecdn.com"],
-        frame: [
-            "https://sandbox.web.squarecdn.com",
-            "https://web.squarecdn.com",
-            "https://connect.squareupsandbox.com",
-            "https://connect.squareup.com",
-        ],
-        connect: [
-            "https://pci-connect.squareupsandbox.com",
-            "https://pci-connect.squareup.com",
-            "https://sandbox.web.squarecdn.com",
-            "https://web.squarecdn.com",
-        ],
-        font: [
-            "https://square-fonts-production-f.squarecdn.com",
-            "https://d1g145x70srn7h.cloudfront.net",
-        ],
-    },
-    // Stripe.js and its Elements/Checkout iframes.
-    stripe: {
-        script: ["https://js.stripe.com"],
-        frame: ["https://js.stripe.com", "https://hooks.stripe.com"],
-        connect: ["https://api.stripe.com"],
-    },
-    // Fourthwall is read server-side; nothing runs in the browser.
-    fourthwall: {},
-};
-// Turnstile. Always allowed, not gated on the captcha being configured: the
-// scaffold ships the widget dormant (see the dormant-until-provisioned
-// convention) and it must not need a rebuild to switch on — CSP is baked at
-// build time, the secret is a runtime value.
-const TURNSTILE = {
-    script: ["https://challenges.cloudflare.com"],
-    frame: ["https://challenges.cloudflare.com"],
-    connect: ["https://challenges.cloudflare.com"],
-};
-// The map module. MapLibre spins its tile-decoding workers up from blob: URLs,
-// so `worker-src blob:` is not optional — without it the map renders an empty
-// canvas and the console fills with worker-construction errors.
-//
-// Nothing else is needed, and that's the whole argument for the self-hosted
-// basemap: the PMTiles archive is served same-origin, so `connect-src` stays
-// `'self'` with no tile host and no API key to allow.
-const MAP = { worker: ["blob:"] };
-const DIRECTIVE_KEYS = ["script", "frame", "connect", "font", "img", "worker"];
-/** Merge origin lists, de-duplicated, order preserved. */
-function mergeOrigins(...sets) {
-    const out = {};
-    for (const key of DIRECTIVE_KEYS) {
-        out[key] = [...new Set(sets.flatMap((set) => set[key] ?? []))];
-    }
-    return out;
-}
-/**
- * Every origin the project's enabled modules need, merged with the config's own
- * `security.cspOrigins`. Exported so a site (or `astroid doctor`) can inspect
- * what a config implies without rebuilding the whole policy.
- */
-export function astroidCspOrigins(config) {
-    return mergeOrigins(TURNSTILE, ...((config.modules ?? []).includes("map") ? [MAP] : []), 
-    // EVERY provider in play, not "the" provider: a site can run Stripe for
-    // invoicing beside Fourthwall for the storefront, and a policy that allowed
-    // only one of them blocks the other's SDK at runtime.
-    ...astroidCommerceProviders(config.commerce).map((p) => COMMERCE_ORIGINS[p] ?? {}), config.security?.cspOrigins ?? {});
-}
 /**
  * Render one directive. The name is a literal from the union above, so the
  * concatenation is a valid `CspDirective` by construction — which is what the

package/dist/commerce/checkout-scaffold.js

@@ -231,7 +231,11 @@ export function generateAstroidCheckoutRoute(config) {
                 "  const check = await verifyCheckout(body.lines, serverPrices, {",
                 "    scope: { locationId },",
                 "  });",
-                "  if (!check.ok) return json({ error: check.message, reason: check.reason }, 409);",
+                "  // Every stale line, with its live price — feed `issues` to `repairCart`",
+                "  // (louise-toolkit/commerce) to fix the whole cart in one step.",
+                "  if (!check.ok) {",
+                "    return json({ error: check.message, reason: check.reason, issues: check.issues }, 409);",
+                "  }",
                 "",
                 "  // 3: stable per cart, distinct per customer.",
                 '  const idempotencyKey = await checkoutIdempotencyKey(check, "order", cartId);',
@@ -239,7 +243,11 @@ export function generateAstroidCheckoutRoute(config) {
             : [
                 "  // 1 + 2: re-price and refuse on mismatch.",
                 "  const check = await verifyCheckout(body.lines, serverPrices);",
-                "  if (!check.ok) return json({ error: check.message, reason: check.reason }, 409);",
+                "  // Every stale line, with its live price — feed `issues` to `repairCart`",
+                "  // (louise-toolkit/commerce) to fix the whole cart in one step.",
+                "  if (!check.ok) {",
+                "    return json({ error: check.message, reason: check.reason, issues: check.issues }, 409);",
+                "  }",
                 "",
                 "  // 3: stable per cart, distinct per customer.",
                 '  const idempotencyKey = await checkoutIdempotencyKey(check, "order", cartId);',

package/dist/commerce/checkout.d.ts

@@ -1,3 +1,4 @@
+import { type CartIssue } from "louise-toolkit/commerce";
 /** One line as the CLIENT sent it. Every field is untrusted. */
 export interface ClientLine {
     /** Provider id of the variant/item being bought. */
@@ -32,14 +33,30 @@ export interface VerifiedLine {
  * them and guessing would put the wrong sentence on the screen.
  */
 export type CheckoutRefusal = "empty" | "unavailable" | "out-of-stock" | "price-changed" | "invalid";
+/**
+ * One way the cart disagrees with the live catalog — the toolkit's
+ * `CartIssue`, less the add-on case (checkout lines carry no add-ons yet).
+ * Hand the list to `repairCart` from `louise-toolkit/commerce` to fix the cart
+ * in one step.
+ */
+export type CheckoutIssue = Exclude<CartIssue, {
+    kind: "modifier-unavailable";
+}>;
 export type CheckoutVerification = {
     ok: true;
     lines: VerifiedLine[];
     subtotalCents: number;
 } | {
     ok: false;
+    /** The first problem, in cart order. */
     reason: CheckoutRefusal;
     message: string;
+    /**
+     * Every problem, in cart order, with what the catalog says now — empty
+     * for `"empty"` and `"invalid"`, which are about the request, not the
+     * catalog.
+     */
+    issues: CheckoutIssue[];
 };
 /** Look up current prices, in minor units, keyed by variant id. Anything the
  *  map omits is treated as no longer purchasable. */

package/dist/commerce/checkout.js

@@ -12,8 +12,36 @@
 //
 // The failure this prevents is not exotic. Accept `unitPrice` from the request
 // body and anyone can buy anything for a penny.
+//
+// The comparison itself is the toolkit's `cartIssues`, which reports EVERY
+// stale line rather than the first: a refusal that names one problem at a time
+// is how a customer ends up fixing a line, retrying, and being refused over the
+// next. What this adds is the opinion — policing the untrusted body, and the
+// sentence a customer sees.
+import { cartIssues } from "louise-toolkit/commerce";
 import { AstroidUsageError } from "../errors.js";
 const MAX_QUANTITY = 999;
+/** What a customer reads, by issue kind: one line affected, or several. */
+const ISSUE_MESSAGES = {
+    "out-of-stock": ["An item in your cart just sold out.", "Some items in your cart just sold out."],
+    unavailable: [
+        "An item in your cart is no longer available.",
+        "Some items in your cart are no longer available.",
+    ],
+    "price-changed": [
+        "Prices changed — please review your cart.",
+        "Prices changed — please review your cart.",
+    ],
+};
+/** One sentence for the whole refusal. Mixed kinds get a sentence that covers them all. */
+function issueMessage(issues) {
+    const kinds = new Set(issues.map((i) => i.kind));
+    const [kind] = kinds;
+    if (kinds.size > 1 || !kind)
+        return "Your cart changed since you filled it — please review it.";
+    const [one, many] = ISSUE_MESSAGES[kind];
+    return issues.length > 1 ? many : one;
+}
 /** Accept either lookup shape without making every caller branch. */
 function normalizeLookup(result) {
     if (result instanceof Map)
@@ -42,7 +70,7 @@ export async function verifyCheckout(lines,
 // and a union of call signatures would reject the two-argument call below.
 lookup, options = {}) {
     if (!Array.isArray(lines) || lines.length === 0) {
-        return { ok: false, reason: "empty", message: "Your cart is empty." };
+        return { ok: false, reason: "empty", message: "Your cart is empty.", issues: [] };
     }
     const parsed = [];
     for (const raw of lines) {
@@ -57,48 +85,25 @@ lookup, options = {}) {
             l.quantity > MAX_QUANTITY ||
             typeof l.unitPriceCents !== "number" ||
             !Number.isFinite(l.unitPriceCents)) {
-            return { ok: false, reason: "invalid", message: "That cart isn't valid." };
+            return { ok: false, reason: "invalid", message: "That cart isn't valid.", issues: [] };
         }
         parsed.push({ variantId: l.variantId, quantity: l.quantity, unitPriceCents: l.unitPriceCents });
     }
     const { prices, outOfStock } = normalizeLookup(await lookup([...new Set(parsed.map((l) => l.variantId))], options.scope));
-    const verified = [];
-    let subtotalCents = 0;
-    for (const line of parsed) {
-        // Checked before the price, because a sold-out variant is usually still
-        // priced: reading `prices` first would report it as available and let the
-        // charge through.
-        if (outOfStock.has(line.variantId)) {
-            return {
-                ok: false,
-                reason: "out-of-stock",
-                message: "An item in your cart just sold out.",
-            };
-        }
-        const serverPrice = prices.get(line.variantId);
-        if (serverPrice === undefined) {
-            return {
-                ok: false,
-                reason: "unavailable",
-                message: "An item in your cart is no longer available.",
-            };
-        }
-        if (serverPrice !== line.unitPriceCents) {
-            return {
-                ok: false,
-                reason: "price-changed",
-                message: "Prices changed — please review your cart.",
-            };
-        }
-        const lineSubtotal = serverPrice * line.quantity;
-        verified.push({
-            variantId: line.variantId,
-            quantity: line.quantity,
-            unitPriceCents: serverPrice,
-            subtotalCents: lineSubtotal,
-        });
-        subtotalCents += lineSubtotal;
-    }
+    // No `liveModifierIds`, so the add-on check is skipped and every issue is a
+    // variant one — which is what makes the narrowing to CheckoutIssue true.
+    const issues = cartIssues(parsed, { prices, outOfStock });
+    const [first] = issues;
+    if (first)
+        return { ok: false, reason: first.kind, message: issueMessage(issues), issues };
+    // Every line is now known to be priced, and at the price the customer saw.
+    const verified = parsed.map((line) => ({
+        variantId: line.variantId,
+        quantity: line.quantity,
+        unitPriceCents: line.unitPriceCents,
+        subtotalCents: line.unitPriceCents * line.quantity,
+    }));
+    const subtotalCents = verified.reduce((sum, l) => sum + l.subtotalCents, 0);
     return { ok: true, lines: verified, subtotalCents };
 }
 /**

package/dist/commerce/index.d.ts

@@ -1,5 +1,5 @@
 export { catalogNormalizer, type FourthwallProductLike, fourthwallToCatalogItem, type SquareAdapterOptions, squareItemSoldAt, type SquareItemLike, type SquareLocationOverrideLike, type SquarePresenceLike, squareToCatalogItem, } from "./adapters.js";
-export { type CheckoutRefusal, type CheckoutScope, type CheckoutVerification, checkoutIdempotencyKey, type ClientLine, type PriceLookup, type ScopedPriceLookup, type ScopedPrices, verifyCheckout, type VerifiedLine, type VerifyCheckoutOptions, } from "./checkout.js";
+export { type CheckoutIssue, type CheckoutRefusal, type CheckoutScope, type CheckoutVerification, checkoutIdempotencyKey, type ClientLine, type PriceLookup, type ScopedPriceLookup, type ScopedPrices, verifyCheckout, type VerifiedLine, type VerifyCheckoutOptions, } from "./checkout.js";
 export { astroidCatalogLoaderConfig, type CatalogDatabase, type CatalogProduct, type CatalogReadOptions, readCatalog, readCatalogItem, } from "./loader.js";
 export { astroidCatalogMirror, BUILT_IN_OWNED, type CatalogMirrorConfig, generateCatalogMigrationSql, generateCatalogTable, type OwnedColumn, PULLED_COLUMNS, } from "./mirror.js";
 export { COMMERCE_PROVIDER_SECRETS, type CommerceStatus, commerceSecretNames, type ProviderStatus, providerConfigured, resolveCommerceStatus, roleConfigured, } from "./secrets.js";

package/dist/config.d.ts

@@ -378,6 +378,8 @@ export interface SecurityConfig {
 /** Per-directive origin lists contributed to the CSP. */
 export interface CspOrigins {
     script?: string[];
+    /** Rendered by the generated middleware (it owns `style-src`), not by Astro. */
+    style?: string[];
     frame?: string[];
     connect?: string[];
     font?: string[];

package/dist/project/generate.js

@@ -103,7 +103,13 @@ export function generateAstroidWrangler(config) {
     p("  // Pin your account so deploys don't prompt (or set CLOUDFLARE_ACCOUNT_ID).");
     p('  // "account_id": "<your-cloudflare-account-id>",');
     p(`  "compatibility_date": ${JSON.stringify(COMPATIBILITY_DATE)},`);
-    p('  "compatibility_flags": ["nodejs_compat"],');
+    // global_fetch_strictly_public (ADR 0012): a fetch to the site's own zone goes
+    // in through Cloudflare's front door, past the WAF, like any Internet request.
+    p("  // global_fetch_strictly_public: a fetch to this zone goes through Cloudflare's");
+    p("  // front door like any Internet request, past the WAF and bot rules (ADR 0012).");
+    p("  // If the daily health scan starts reporting broken links that aren't, a zone");
+    p("  // rule is challenging its self-crawl — allow it rather than drop the flag.");
+    p('  "compatibility_flags": ["nodejs_compat", "global_fetch_strictly_public"],');
     p("  // @astrojs/cloudflare builds this entry and wires the static assets under dist/.");
     p('  "main": "src/worker.ts",');
     const tenancy = config.tenancy;

package/dist/security/csp-origins.d.ts

@@ -0,0 +1,16 @@
+import type { AstroidConfig, CspOrigins } from "../config.js";
+/**
+ * Every origin the project's enabled modules need, merged with the config's own
+ * `security.cspOrigins`. Exported so a site (or `astroid doctor`) can inspect
+ * what a config implies without rebuilding the whole policy.
+ */
+export declare function astroidCspOrigins(config: AstroidConfig): Required<CspOrigins>;
+/**
+ * The `style-src` value the generated middleware rewrites every response to.
+ *
+ * `'unsafe-inline'` is required (Louise's data-driven `style=""` carriers and
+ * the editor's runtime `<style>`), which is why Astro can't own this directive:
+ * per spec a single hash here voids `'unsafe-inline'`. Module and config
+ * `style` origins ride along, e.g. the Square SDK's own stylesheet.
+ */
+export declare function astroidCspStyleSrc(config: AstroidConfig): string;

package/dist/security/csp-origins.js

@@ -0,0 +1,76 @@
+// Copyright (c) 2026 BowenLabs. Astroid is MIT licensed.
+//
+// The CSP origins a config implies, as plain data.
+//
+// Split out of `astro/csp.ts` (build-time only: `node:crypto`, `solid-js/web`)
+// so the worker generator can read it too: Astro's `security.csp` renders every
+// directive except `style-src`, and the generated middleware renders that one.
+// Both have to see the same origin set, or a module's stylesheet host lands in
+// one half of the policy and not the other.
+import { squareWebPaymentsCsp } from "louise-toolkit/commerce/square-web";
+import { turnstileCsp } from "louise-toolkit/forms/turnstile";
+import { astroidCommerceProviders } from "../commerce/roles.js";
+/** Origins a commerce provider's client-side SDK needs. Server-only providers
+ *  (Fourthwall's storefront API) contribute nothing but their image host. */
+const COMMERCE_ORIGINS = {
+    // Square Web Payments, from the toolkit that mounts it, so a host Square adds
+    // arrives with an upgrade instead of as a console violation on every site. A
+    // hand copy lived here and had already missed two (Square's Sentry ingest,
+    // and Cash Sans's font host). Both environments by default, so ONE build
+    // serves either: which environment you're in is a runtime secret, not a
+    // build-time one.
+    square: squareWebPaymentsCsp(),
+    // Stripe.js and its Elements/Checkout iframes.
+    stripe: {
+        script: ["https://js.stripe.com"],
+        frame: ["https://js.stripe.com", "https://hooks.stripe.com"],
+        connect: ["https://api.stripe.com"],
+    },
+    // Fourthwall is read server-side; nothing runs in the browser.
+    fourthwall: {},
+};
+// Turnstile. Always allowed, not gated on the captcha being configured: the
+// scaffold ships the widget dormant (see the dormant-until-provisioned
+// convention) and it must not need a rebuild to switch on — CSP is baked at
+// build time, the secret is a runtime value.
+const TURNSTILE = turnstileCsp();
+// The map module. MapLibre spins its tile-decoding workers up from blob: URLs,
+// so `worker-src blob:` is not optional — without it the map renders an empty
+// canvas and the console fills with worker-construction errors.
+//
+// Nothing else is needed, and that's the whole argument for the self-hosted
+// basemap: the PMTiles archive is served same-origin, so `connect-src` stays
+// `'self'` with no tile host and no API key to allow.
+const MAP = { worker: ["blob:"] };
+const DIRECTIVE_KEYS = ["script", "style", "frame", "connect", "font", "img", "worker"];
+/** Merge origin lists, de-duplicated, order preserved. */
+function mergeOrigins(...sets) {
+    const out = {};
+    for (const key of DIRECTIVE_KEYS) {
+        out[key] = [...new Set(sets.flatMap((set) => set[key] ?? []))];
+    }
+    return out;
+}
+/**
+ * Every origin the project's enabled modules need, merged with the config's own
+ * `security.cspOrigins`. Exported so a site (or `astroid doctor`) can inspect
+ * what a config implies without rebuilding the whole policy.
+ */
+export function astroidCspOrigins(config) {
+    return mergeOrigins(TURNSTILE, ...((config.modules ?? []).includes("map") ? [MAP] : []), 
+    // EVERY provider in play, not "the" provider: a site can run Stripe for
+    // invoicing beside Fourthwall for the storefront, and a policy that allowed
+    // only one of them blocks the other's SDK at runtime.
+    ...astroidCommerceProviders(config.commerce).map((p) => COMMERCE_ORIGINS[p] ?? {}), config.security?.cspOrigins ?? {});
+}
+/**
+ * The `style-src` value the generated middleware rewrites every response to.
+ *
+ * `'unsafe-inline'` is required (Louise's data-driven `style=""` carriers and
+ * the editor's runtime `<style>`), which is why Astro can't own this directive:
+ * per spec a single hash here voids `'unsafe-inline'`. Module and config
+ * `style` origins ride along, e.g. the Square SDK's own stylesheet.
+ */
+export function astroidCspStyleSrc(config) {
+    return ["'self'", "'unsafe-inline'", ...astroidCspOrigins(config).style].join(" ");
+}

package/dist/worker/generate.js

@@ -17,6 +17,7 @@ import { astroidPortal } from "../portal/config.js";
 import { ASTROID_HEALTH_CRON, astroidCron, astroidUsesQueues } from "../queues/messages.js";
 import { ASTROID_EDIT_SESSION_CLASS, ASTROID_REALTIME_BINDING, usesRealtime, } from "../realtime/scaffold.js";
 import { capturesInquiries } from "../schema/framework.js";
+import { astroidCspStyleSrc } from "../security/csp-origins.js";
 import { ASTROID_REWRITE_EXCLUDE, ASTROID_TENANT_PREFIX } from "../tenancy/index.js";
 import { astroidEditorRoutePlan } from "./routes.js";
 // Astroid's default editable site_settings surface — the columns the Settings
@@ -369,6 +370,13 @@ export function generateAstroidWorker(config) {
         ? "export default composeWorker<CloudflareEnv, AstroidQueueMessage>({"
         : "export default composeWorker<CloudflareEnv>({");
     p("  routes: [...editorRoutes, mediaAssetRoute],");
+    p("  // Deny-by-default editor API (ADR 0012). Under /api/louise a request must");
+    p("  // resolve to an editor unless it's headed for a public route — the contact");
+    p("  // form and the vitals beacon mark themselves. Every route above still checks");
+    p("  // for itself; this is what catches one that forgets. It also gives route");
+    p("  // responses the security headers the middleware never sees, since these");
+    p("  // routes answer before Astro runs.");
+    p("  gate: { resolveEditor },");
     p("  // The SSR fallback, wrapped in the cookie-aware Worker cache (ADR 0004).");
     p("  //");
     p("  // Wrapped UNCONDITIONALLY, and that is safe: `withEdgeCache` only stores a");
@@ -470,8 +478,10 @@ export function generateAstroidWorker(config) {
 export function generateAstroidMiddleware(config) {
     // Louise's brand font is bundled + base64-inlined (no Google Fonts host to
     // allow); createLouiseMiddleware auto-allows `data:` fonts in the CSP, so the
-    // inlined @font-face needs no manual `font-src` entry.
-    const cspStyleSrc = "'self' 'unsafe-inline'";
+    // inlined @font-face needs no manual `font-src` entry. Module + config `style`
+    // origins (the Square SDK's stylesheet) are baked in here; `astroid build`
+    // regenerates this file, so a config change lands on the next deploy.
+    const cspStyleSrc = astroidCspStyleSrc(config);
     const portal = astroidPortal(config);
     const tenancy = config.tenancy;
     const rewritePrefix = tenancy?.rewritePrefix ?? ASTROID_TENANT_PREFIX;
@@ -538,6 +548,10 @@ export function generateAstroidMiddleware(config) {
         "export const onRequest = createLouiseMiddleware({",
         "  resolveEditor: (request) => resolveEditor(request),",
         "  rateLimit: { rules: RATE_RULES, kv: () => env.RL },",
+        "  // The same deny-by-default gate for /api/louise routes that reach Astro —",
+        "  // anything the worker's routes didn't answer. A second check behind the",
+        "  // worker's gate, and free: the editor is resolved here on every request.",
+        "  apiGate: true,",
         // `extend` runs once and may need to populate BOTH — a tenanted site with a
         // portal resolves a tenant and a customer on the same request.
         ...(portal || tenancy

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "astroidjs",
-  "version": "0.10.0",
+  "version": "0.12.0",
   "description": "Astroid — an opinionated meta-framework over Louise Toolkit and Astro for building editable, multi-editor sites on Cloudflare Workers.",
   "keywords": [
     "astro",
@@ -60,7 +60,7 @@
     "access": "public"
   },
   "dependencies": {
-    "louise-toolkit": "^0.28.0"
+    "louise-toolkit": "^0.30.1"
   },
   "devDependencies": {
     "@types/node": "^24.13.3",