astroidjs 0.10.1 → 0.12.1

package/dist/commerce/checkout-scaffold.js

@@ -231,7 +231,11 @@ export function generateAstroidCheckoutRoute(config) {
                 "  const check = await verifyCheckout(body.lines, serverPrices, {",
                 "    scope: { locationId },",
                 "  });",
-                "  if (!check.ok) return json({ error: check.message, reason: check.reason }, 409);",
+                "  // Every stale line, with its live price — feed `issues` to `repairCart`",
+                "  // (louise-toolkit/commerce) to fix the whole cart in one step.",
+                "  if (!check.ok) {",
+                "    return json({ error: check.message, reason: check.reason, issues: check.issues }, 409);",
+                "  }",
                 "",
                 "  // 3: stable per cart, distinct per customer.",
                 '  const idempotencyKey = await checkoutIdempotencyKey(check, "order", cartId);',
@@ -239,7 +243,11 @@ export function generateAstroidCheckoutRoute(config) {
             : [
                 "  // 1 + 2: re-price and refuse on mismatch.",
                 "  const check = await verifyCheckout(body.lines, serverPrices);",
-                "  if (!check.ok) return json({ error: check.message, reason: check.reason }, 409);",
+                "  // Every stale line, with its live price — feed `issues` to `repairCart`",
+                "  // (louise-toolkit/commerce) to fix the whole cart in one step.",
+                "  if (!check.ok) {",
+                "    return json({ error: check.message, reason: check.reason, issues: check.issues }, 409);",
+                "  }",
                 "",
                 "  // 3: stable per cart, distinct per customer.",
                 '  const idempotencyKey = await checkoutIdempotencyKey(check, "order", cartId);',

package/dist/commerce/checkout.d.ts

@@ -1,3 +1,4 @@
+import { type CartIssue } from "louise-toolkit/commerce";
 /** One line as the CLIENT sent it. Every field is untrusted. */
 export interface ClientLine {
     /** Provider id of the variant/item being bought. */
@@ -32,14 +33,30 @@ export interface VerifiedLine {
  * them and guessing would put the wrong sentence on the screen.
  */
 export type CheckoutRefusal = "empty" | "unavailable" | "out-of-stock" | "price-changed" | "invalid";
+/**
+ * One way the cart disagrees with the live catalog — the toolkit's
+ * `CartIssue`, less the add-on case (checkout lines carry no add-ons yet).
+ * Hand the list to `repairCart` from `louise-toolkit/commerce` to fix the cart
+ * in one step.
+ */
+export type CheckoutIssue = Exclude<CartIssue, {
+    kind: "modifier-unavailable";
+}>;
 export type CheckoutVerification = {
     ok: true;
     lines: VerifiedLine[];
     subtotalCents: number;
 } | {
     ok: false;
+    /** The first problem, in cart order. */
     reason: CheckoutRefusal;
     message: string;
+    /**
+     * Every problem, in cart order, with what the catalog says now — empty
+     * for `"empty"` and `"invalid"`, which are about the request, not the
+     * catalog.
+     */
+    issues: CheckoutIssue[];
 };
 /** Look up current prices, in minor units, keyed by variant id. Anything the
  *  map omits is treated as no longer purchasable. */

package/dist/commerce/checkout.js

@@ -12,8 +12,36 @@
 //
 // The failure this prevents is not exotic. Accept `unitPrice` from the request
 // body and anyone can buy anything for a penny.
+//
+// The comparison itself is the toolkit's `cartIssues`, which reports EVERY
+// stale line rather than the first: a refusal that names one problem at a time
+// is how a customer ends up fixing a line, retrying, and being refused over the
+// next. What this adds is the opinion — policing the untrusted body, and the
+// sentence a customer sees.
+import { cartIssues } from "louise-toolkit/commerce";
 import { AstroidUsageError } from "../errors.js";
 const MAX_QUANTITY = 999;
+/** What a customer reads, by issue kind: one line affected, or several. */
+const ISSUE_MESSAGES = {
+    "out-of-stock": ["An item in your cart just sold out.", "Some items in your cart just sold out."],
+    unavailable: [
+        "An item in your cart is no longer available.",
+        "Some items in your cart are no longer available.",
+    ],
+    "price-changed": [
+        "Prices changed — please review your cart.",
+        "Prices changed — please review your cart.",
+    ],
+};
+/** One sentence for the whole refusal. Mixed kinds get a sentence that covers them all. */
+function issueMessage(issues) {
+    const kinds = new Set(issues.map((i) => i.kind));
+    const [kind] = kinds;
+    if (kinds.size > 1 || !kind)
+        return "Your cart changed since you filled it — please review it.";
+    const [one, many] = ISSUE_MESSAGES[kind];
+    return issues.length > 1 ? many : one;
+}
 /** Accept either lookup shape without making every caller branch. */
 function normalizeLookup(result) {
     if (result instanceof Map)
@@ -42,7 +70,7 @@ export async function verifyCheckout(lines,
 // and a union of call signatures would reject the two-argument call below.
 lookup, options = {}) {
     if (!Array.isArray(lines) || lines.length === 0) {
-        return { ok: false, reason: "empty", message: "Your cart is empty." };
+        return { ok: false, reason: "empty", message: "Your cart is empty.", issues: [] };
     }
     const parsed = [];
     for (const raw of lines) {
@@ -57,48 +85,25 @@ lookup, options = {}) {
             l.quantity > MAX_QUANTITY ||
             typeof l.unitPriceCents !== "number" ||
             !Number.isFinite(l.unitPriceCents)) {
-            return { ok: false, reason: "invalid", message: "That cart isn't valid." };
+            return { ok: false, reason: "invalid", message: "That cart isn't valid.", issues: [] };
         }
         parsed.push({ variantId: l.variantId, quantity: l.quantity, unitPriceCents: l.unitPriceCents });
     }
     const { prices, outOfStock } = normalizeLookup(await lookup([...new Set(parsed.map((l) => l.variantId))], options.scope));
-    const verified = [];
-    let subtotalCents = 0;
-    for (const line of parsed) {
-        // Checked before the price, because a sold-out variant is usually still
-        // priced: reading `prices` first would report it as available and let the
-        // charge through.
-        if (outOfStock.has(line.variantId)) {
-            return {
-                ok: false,
-                reason: "out-of-stock",
-                message: "An item in your cart just sold out.",
-            };
-        }
-        const serverPrice = prices.get(line.variantId);
-        if (serverPrice === undefined) {
-            return {
-                ok: false,
-                reason: "unavailable",
-                message: "An item in your cart is no longer available.",
-            };
-        }
-        if (serverPrice !== line.unitPriceCents) {
-            return {
-                ok: false,
-                reason: "price-changed",
-                message: "Prices changed — please review your cart.",
-            };
-        }
-        const lineSubtotal = serverPrice * line.quantity;
-        verified.push({
-            variantId: line.variantId,
-            quantity: line.quantity,
-            unitPriceCents: serverPrice,
-            subtotalCents: lineSubtotal,
-        });
-        subtotalCents += lineSubtotal;
-    }
+    // No `liveModifierIds`, so the add-on check is skipped and every issue is a
+    // variant one — which is what makes the narrowing to CheckoutIssue true.
+    const issues = cartIssues(parsed, { prices, outOfStock });
+    const [first] = issues;
+    if (first)
+        return { ok: false, reason: first.kind, message: issueMessage(issues), issues };
+    // Every line is now known to be priced, and at the price the customer saw.
+    const verified = parsed.map((line) => ({
+        variantId: line.variantId,
+        quantity: line.quantity,
+        unitPriceCents: line.unitPriceCents,
+        subtotalCents: line.unitPriceCents * line.quantity,
+    }));
+    const subtotalCents = verified.reduce((sum, l) => sum + l.subtotalCents, 0);
     return { ok: true, lines: verified, subtotalCents };
 }
 /**

package/dist/commerce/index.d.ts

@@ -1,5 +1,5 @@
 export { catalogNormalizer, type FourthwallProductLike, fourthwallToCatalogItem, type SquareAdapterOptions, squareItemSoldAt, type SquareItemLike, type SquareLocationOverrideLike, type SquarePresenceLike, squareToCatalogItem, } from "./adapters.js";
-export { type CheckoutRefusal, type CheckoutScope, type CheckoutVerification, checkoutIdempotencyKey, type ClientLine, type PriceLookup, type ScopedPriceLookup, type ScopedPrices, verifyCheckout, type VerifiedLine, type VerifyCheckoutOptions, } from "./checkout.js";
+export { type CheckoutIssue, type CheckoutRefusal, type CheckoutScope, type CheckoutVerification, checkoutIdempotencyKey, type ClientLine, type PriceLookup, type ScopedPriceLookup, type ScopedPrices, verifyCheckout, type VerifiedLine, type VerifyCheckoutOptions, } from "./checkout.js";
 export { astroidCatalogLoaderConfig, type CatalogDatabase, type CatalogProduct, type CatalogReadOptions, readCatalog, readCatalogItem, } from "./loader.js";
 export { astroidCatalogMirror, BUILT_IN_OWNED, type CatalogMirrorConfig, generateCatalogMigrationSql, generateCatalogTable, type OwnedColumn, PULLED_COLUMNS, } from "./mirror.js";
 export { COMMERCE_PROVIDER_SECRETS, type CommerceStatus, commerceSecretNames, type ProviderStatus, providerConfigured, resolveCommerceStatus, roleConfigured, } from "./secrets.js";

package/dist/project/generate.js

@@ -103,7 +103,13 @@ export function generateAstroidWrangler(config) {
     p("  // Pin your account so deploys don't prompt (or set CLOUDFLARE_ACCOUNT_ID).");
     p('  // "account_id": "<your-cloudflare-account-id>",');
     p(`  "compatibility_date": ${JSON.stringify(COMPATIBILITY_DATE)},`);
-    p('  "compatibility_flags": ["nodejs_compat"],');
+    // global_fetch_strictly_public (ADR 0012): a fetch to the site's own zone goes
+    // in through Cloudflare's front door, past the WAF, like any Internet request.
+    p("  // global_fetch_strictly_public: a fetch to this zone goes through Cloudflare's");
+    p("  // front door like any Internet request, past the WAF and bot rules (ADR 0012).");
+    p("  // If the daily health scan starts reporting broken links that aren't, a zone");
+    p("  // rule is challenging its self-crawl — allow it rather than drop the flag.");
+    p('  "compatibility_flags": ["nodejs_compat", "global_fetch_strictly_public"],');
     p("  // @astrojs/cloudflare builds this entry and wires the static assets under dist/.");
     p('  "main": "src/worker.ts",');
     const tenancy = config.tenancy;

package/dist/security/csp-origins.js

@@ -7,38 +7,19 @@
 // directive except `style-src`, and the generated middleware renders that one.
 // Both have to see the same origin set, or a module's stylesheet host lands in
 // one half of the policy and not the other.
+import { squareWebPaymentsCsp } from "louise-toolkit/commerce/square-web";
+import { turnstileCsp } from "louise-toolkit/forms/turnstile";
 import { astroidCommerceProviders } from "../commerce/roles.js";
 /** Origins a commerce provider's client-side SDK needs. Server-only providers
  *  (Fourthwall's storefront API) contribute nothing but their image host. */
 const COMMERCE_ORIGINS = {
-    // Square Web Payments renders the card form in an iframe from the squarecdn
-    // hosts, tokenizes against pci-connect, and pulls its own fonts. Both the
-    // sandbox and production hosts are listed so ONE build serves either
-    // environment — which environment you're in is a runtime secret, not a
+    // Square Web Payments, from the toolkit that mounts it, so a host Square adds
+    // arrives with an upgrade instead of as a console violation on every site. A
+    // hand copy lived here and had already missed two (Square's Sentry ingest,
+    // and Cash Sans's font host). Both environments by default, so ONE build
+    // serves either: which environment you're in is a runtime secret, not a
     // build-time one.
-    square: {
-        script: ["https://sandbox.web.squarecdn.com", "https://web.squarecdn.com"],
-        frame: [
-            "https://sandbox.web.squarecdn.com",
-            "https://web.squarecdn.com",
-            "https://connect.squareupsandbox.com",
-            "https://connect.squareup.com",
-        ],
-        connect: [
-            "https://pci-connect.squareupsandbox.com",
-            "https://pci-connect.squareup.com",
-            "https://sandbox.web.squarecdn.com",
-            "https://web.squarecdn.com",
-        ],
-        // Web Payments SDK 1.85+ attaches its own `card-wrapper.css` to the HOST
-        // page (not just inside the iframe). Block it and `card.attach()` rejects,
-        // so the card form never mounts.
-        style: ["https://sandbox.web.squarecdn.com", "https://web.squarecdn.com"],
-        font: [
-            "https://square-fonts-production-f.squarecdn.com",
-            "https://d1g145x70srn7h.cloudfront.net",
-        ],
-    },
+    square: squareWebPaymentsCsp(),
     // Stripe.js and its Elements/Checkout iframes.
     stripe: {
         script: ["https://js.stripe.com"],
@@ -52,11 +33,7 @@ const COMMERCE_ORIGINS = {
 // scaffold ships the widget dormant (see the dormant-until-provisioned
 // convention) and it must not need a rebuild to switch on — CSP is baked at
 // build time, the secret is a runtime value.
-const TURNSTILE = {
-    script: ["https://challenges.cloudflare.com"],
-    frame: ["https://challenges.cloudflare.com"],
-    connect: ["https://challenges.cloudflare.com"],
-};
+const TURNSTILE = turnstileCsp();
 // The map module. MapLibre spins its tile-decoding workers up from blob: URLs,
 // so `worker-src blob:` is not optional — without it the map renders an empty
 // canvas and the console fills with worker-construction errors.

package/dist/worker/generate.js

@@ -370,6 +370,13 @@ export function generateAstroidWorker(config) {
         ? "export default composeWorker<CloudflareEnv, AstroidQueueMessage>({"
         : "export default composeWorker<CloudflareEnv>({");
     p("  routes: [...editorRoutes, mediaAssetRoute],");
+    p("  // Deny-by-default editor API (ADR 0012). Under /api/louise a request must");
+    p("  // resolve to an editor unless it's headed for a public route — the contact");
+    p("  // form and the vitals beacon mark themselves. Every route above still checks");
+    p("  // for itself; this is what catches one that forgets. It also gives route");
+    p("  // responses the security headers the middleware never sees, since these");
+    p("  // routes answer before Astro runs.");
+    p("  gate: { resolveEditor },");
     p("  // The SSR fallback, wrapped in the cookie-aware Worker cache (ADR 0004).");
     p("  //");
     p("  // Wrapped UNCONDITIONALLY, and that is safe: `withEdgeCache` only stores a");
@@ -541,6 +548,10 @@ export function generateAstroidMiddleware(config) {
         "export const onRequest = createLouiseMiddleware({",
         "  resolveEditor: (request) => resolveEditor(request),",
         "  rateLimit: { rules: RATE_RULES, kv: () => env.RL },",
+        "  // The same deny-by-default gate for /api/louise routes that reach Astro —",
+        "  // anything the worker's routes didn't answer. A second check behind the",
+        "  // worker's gate, and free: the editor is resolved here on every request.",
+        "  apiGate: true,",
         // `extend` runs once and may need to populate BOTH — a tenanted site with a
         // portal resolves a tenant and a customer on the same request.
         ...(portal || tenancy

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "astroidjs",
-  "version": "0.10.1",
+  "version": "0.12.1",
   "description": "Astroid — an opinionated meta-framework over Louise Toolkit and Astro for building editable, multi-editor sites on Cloudflare Workers.",
   "keywords": [
     "astro",
@@ -60,11 +60,12 @@
     "access": "public"
   },
   "dependencies": {
-    "louise-toolkit": "^0.28.0"
+    "louise-toolkit": "^0.31.0"
   },
   "devDependencies": {
     "@types/node": "^24.13.3",
     "@typescript/native-preview": "7.0.0-dev.20260707.2",
+    "@vitest/coverage-v8": "4.1.11",
     "astro": "^7.2.9",
     "solid-js": "^1.9.15",
     "typescript": "^5.9.3",
@@ -87,7 +88,7 @@
   },
   "scripts": {
     "build": "tsgo -p tsconfig.build.json",
-    "test": "vitest run",
+    "test": "vitest run --coverage",
     "typecheck": "tsgo --noEmit"
   }
 }