astroidjs 0.12.1 → 0.14.0

package/README.md

@@ -1,16 +1,16 @@
 # astroidjs
 
-**Astroid** — an opinionated meta-framework over
+**Astroid**—an opinionated meta-framework over
 [Louise Toolkit](https://github.com/bowenlabs/louise-toolkit/tree/main/packages/louise)
 and Astro for building editable, multi-editor sites on Cloudflare Workers.
 
-> **Status: pre-1.0, experimental.** The API will change between minor versions —
+> **Status: pre-1.0, experimental.** The API will change between minor versions—
 > pin an exact version if you depend on it. Astroid lives in the same workspace as
 > Louise so its opinions co-evolve with the toolkit.
 
 ## What it is
 
-Louise is the unopinionated toolkit — primitives you assemble by hand. Astroid is
+Louise is the unopinionated toolkit—primitives you assemble by hand. Astroid is
 the opinionated preset on top: a theme system, a section library, and a single
 config that generates the Louise wiring (worker routes, middleware, schema,
 theme) a site would otherwise hand-write per repo.
@@ -29,12 +29,12 @@ exports. This keeps the toolkit neutral while Astroid holds the opinions.
 
 ## Configure
 
-The whole shape of a project — its brand + theme + editable home, its commerce
-backend and optional modules — collapses into one typed config. **One brand per
+The whole shape of a project—its brand + theme + editable home, its commerce
+backend and optional modules—collapses into one typed config. **One brand per
 project:** every site Astroid targets serves a single brand from a single deploy,
 so the config describes one brand, not an array. What actually multiplexes is
 _editors_ (Louise's org plugin) and _audiences_ (a gated portal beside the public
-site) — both options on the one brand. The vocabulary is drawn from the real
+site)—both options on the one brand. The vocabulary is drawn from the real
 sites Astroid targets: a storefront (coracle.coffee), a wholesale front
 (ghostfire.coffee), an artist portfolio (themidwestartist.com), and a plain
 marketing baseline (louise-web).
@@ -71,14 +71,14 @@ export default defineAstroid({
 
 `media.maxUploadBytes` is checked at generate time, not in production: a value
 above Cloudflare's **100 MB request-body limit** is rejected outright, because
-the edge drops an oversized body before the Worker runs — the media route never
+the edge drops an oversized body before the Worker runs—the media route never
 gets to answer with its own `413`, so the editor would see an opaque failure.
 Zero, negatives, and non-integers are rejected too (that last one catches the
 megabytes-not-bytes slip).
 
 ## Commerce
 
-**Providers fill roles.** Not "the commerce provider" — the toolkit's clients
+**Providers fill roles.** Not "the commerce provider"—the toolkit's clients
 make that impossible: `commerce/stripe` has no catalog API, `commerce/fourthwall`
 has no invoicing, Square does both. So `storefront` and `invoicing` are assigned
 independently, and a provider put in a role it can't serve fails at config load
@@ -93,7 +93,7 @@ commerce: { provider: "square" }                              // shorthand → s
 of truth; D1 holds the owner's edits. `mode: "mirror"` keeps the catalog fields
 in D1 (fast reads, briefly stale); `mode: "overlay"` keeps only the owner's
 columns (never stale, one provider round-trip per read). The sync **never writes
-an owned column** — a sync that does silently reverts the owner's work, and
+an owned column**—a sync that does silently reverts the owner's work, and
 they find out days later. `slug` is owned for that reason: it's the public URL,
 so a provider rename must not break links.
 
@@ -106,14 +106,14 @@ commerce: {
 
 Everything else follows from that table. `astroidCatalogLoaderConfig` reads it
 for the Live Content Collection, and the adapters normalize before the row is
-written — so one loader definition serves a Square site and a Fourthwall site,
+written—so one loader definition serves a Square site and a Fourthwall site,
 which is the drift the module exists to kill.
 
 **Checkout is server-authoritative.** `verifyCheckout` treats the client's price
 as a staleness check, never an input to the charge: re-price server-side, refuse
 on mismatch. `checkoutIdempotencyKey` derives a stable key from the verified cart
-**and a required `identity`**, so a double-clicked Pay button charges once —
-while two customers buying the same thing stay two charges.
+**and a required `identity`**, so a double-clicked Pay button charges once—while
+two customers buying the same thing stay two charges.
 
 ```ts
 const key = await checkoutIdempotencyKey(check, "order", cartId);
@@ -122,7 +122,7 @@ const key = await checkoutIdempotencyKey(check, "order", cartId);
 Pass something stable across a retry of this attempt and distinct between buyers
 (a cart id, checkout-session id, or portal user id). It is required, and empty is
 refused, because a key derived from cart contents alone collides between
-customers: providers scope idempotency keys per account for ~24h, so the second
+customers: providers scope idempotency keys per account for about 24 hours, so the second
 buyer's charge is deduped into the first buyer's order and never happens.
 
 ## The webhook pipeline
@@ -133,7 +133,7 @@ gains a webhook receiver plus a consumer seam. `--commerce <provider>` on
 `pnpm create astroid` sets it all up.
 
 The receiver's ordering is the part worth knowing. `handleWebhook` verifies the
-HMAC over the **raw body before anything parses it** — parse first and an
+HMAC over the **raw body before anything parses it**—parse first and an
 unauthenticated caller reaches the JSON parser and everything downstream, and
 re-serializing a parsed body to check a signature is how signature checks quietly
 stop checking anything. It then enqueues and returns, so the response doesn't
@@ -144,15 +144,15 @@ is picked for what it tells the sender to do:
 
 | Situation               | Code | Why                                                                                           |
 | ----------------------- | ---- | --------------------------------------------------------------------------------------------- |
-| Secret unprovisioned    | 503  | Dormant is temporary — keep retrying so events delivered before you set the secret still land |
+| Secret unprovisioned    | 503  | Dormant is temporary—keep retrying so events delivered before you set the secret still land   |
 | Bad / missing signature | 401  | Terminal. It won't verify on retry either, and retrying turns a misconfiguration into a flood |
 | Body isn't JSON         | 400  | Terminal for the same reason                                                                  |
-| Enqueue failed          | 503  | The signature checked out, so the event is real — ask for redelivery                          |
+| Enqueue failed          | 503  | The signature checked out, so the event is real—ask for redelivery                            |
 | Enqueued                | 202  | Accepted, not done. That's the point of a queue                                               |
 
 On the consumer side `astroidQueueHandler` owns the dispatch every site wrote: a
 periodic refresh re-syncs, a webhook re-syncs _only_ if it touched the catalog,
-and everything else acks as a no-op. That last part matters — order and payment
+and everything else acks as a no-op. That last part matters—order and payment
 events arrive in volume and have nothing local to update, so treating them as
 actionable turns a busy sales day into a refresh storm.
 
@@ -162,8 +162,8 @@ the same retry and DLQ path as everything else. Retries and DLQ routing live in
 
 ## Transactional email
 
-Four templates — sign-in link, password reset, and the inquiry pair (notify the
-owner, confirm to the sender) — over the toolkit's email shell. Each renders HTML
+Four templates—sign-in link, password reset, and the inquiry pair (notify the
+owner, confirm to the sender)—over the toolkit's email shell. Each renders HTML
 **and** plaintext from one definition: a message with no text/plain part scores
 worse with spam filters, and for a sign-in link the plaintext body is what a
 terminal client shows and what the dev log prints.
@@ -172,12 +172,12 @@ terminal client shows and what the dev log prints.
 Neutrals stay fixed (they're typography choices, not brand ones); what varies is
 the accent and the five-cell masthead band, built as a ramp so it reads as
 designed whether you configured one brand colour or three. The accent is
-**contrast-corrected** — a brand yellow used verbatim as 11px uppercase text on a
+**contrast-corrected**—a brand yellow used verbatim as 11px uppercase text on a
 near-white card is unreadable, and mail clients have no dark-mode escape hatch.
 Pass overrides for any slot you want to own.
 
 Delivery is best-effort and never throws. Mail here is always the notification of
-something already durable — the inquiry row is inserted, the account exists — so
+something already durable—the inquiry row is inserted, the account exists—so
 a failure must not fail the request that caused it, and messages send
 independently so the owner's copy still arrives when a visitor typos their
 address. With no `EMAIL` binding the mailer is **dormant**: it logs the rendered
@@ -194,7 +194,7 @@ formRoute({
 
 ## SEO
 
-A settings-driven head, structured data, and the two crawler files — first-party,
+A settings-driven head, structured data, and the two crawler files—first-party,
 no `astro-seo` dependency.
 
 `<Seo>` resolves three levels (page override → the page's own default →
@@ -202,20 +202,20 @@ no `astro-seo` dependency.
 clearing a field in the editor falls back instead of publishing a blank `<meta>`.
 The title template applies only when a page supplies its own title, so the home
 page reads `Acme Coffee`, not `Acme Coffee | Acme Coffee`. `disableIndexing` in
-settings is a site-wide kill switch that beats any page asking to be indexed —
-useful for staging.
+settings is a site-wide kill switch that beats any page asking to be indexed—useful
+for staging.
 
 `<StructuredData>` emits a schema.org `@graph`: the business, the `WebSite`, and
 optionally the entity the page is _about_ (a Product, a VisualArtwork). The
 business `@type` comes from the archetype (`storefront` → `Store`, `portfolio` →
 `Person`); set `seo.businessType` to a narrower subtype whenever you know one.
-The payload is escaped with `escapeJsonLd`, not `JSON.stringify` — `stringify`
+The payload is escaped with `escapeJsonLd`, not `JSON.stringify`—`stringify`
 doesn't escape `<`, so an editor-authored value containing `</script>` would
 close the tag early and inject markup into `<head>`.
 
 `robots.txt` and `sitemap.xml` derive their disallow list from the same config
 (`astroidNoindexPaths`), so the two files can't disagree about what's crawlable.
-Both are **origin-aware** — built from the serving origin rather than a
+Both are **origin-aware**—built from the serving origin rather than a
 configured domain, because a preview deploy advertising the production host
 invites its content to be indexed under the real domain.
 
@@ -228,21 +228,21 @@ framework.
 calls `astroidRateRules(config)`: the editor magic-link always (the
 email-bombing target, so the tightest budget in the set), the portal's
 credential surfaces when `portal.enabled`, checkout when `commerce` is set. The
-session-gated editor API stays out on purpose — a limiter that can lock the
+session-gated editor API stays out on purpose—a limiter that can lock the
 owner out of their own studio is worse than the abuse it stops. Add or override
 via `security.rateRules`, which is matched _before_ the defaults, so you replace
 one budget rather than the whole set.
 
 **The CSP is composed, and it's split for a reason.** `astroidSecurity(config)`
-gives `astro.config.mjs` its `security` block. Astro owns `script-src` — it
-hashes every script it processes, so the policy needs no `'unsafe-inline'` — and
+gives `astro.config.mjs` its `security` block. Astro owns `script-src`—it
+hashes every script it processes, so the policy needs no `'unsafe-inline'`—and
 Astroid adds the one hash Astro can't produce itself: Solid's hydration
 bootstrap, injected by `@astrojs/solid-js` on every page with an island.
 Computing it from `generateHydrationScript()` means it tracks solid-js upgrades
 instead of going stale as a copy-pasted literal. Meanwhile the generated
 middleware rewrites _only_ `style-src`, because Louise's data-driven `style=""`
 carriers need `'unsafe-inline'` and a single hash in that directive would void
-it per spec — the two cannot share one directive.
+it per spec—the two cannot share one directive.
 
 ```js
 // astro.config.mjs
@@ -262,14 +262,14 @@ the captcha frame); `security.cspOrigins` adds anything Astroid can't see.
 
 Astroid's optional modules are opt-in at the _config_ level, never at the
 _account_ level: switching commerce on must not require a Square account before
-`pnpm dev` will boot. So a module whose secrets aren't provisioned is **dormant**
-— it renders, it serves, it says out loud that it's simulated, and it never calls
+`pnpm dev` will boot. So a module whose secrets aren't provisioned is **dormant**—it
+renders, it serves, it says out loud that it's simulated, and it never calls
 upstream with a dummy credential. A fresh clone runs with zero external accounts.
 
 `create-astroid` seeds every module secret with one loud sentinel,
 `DUMMY_REPLACE_ME`, so a scaffold has a complete and valid binding set and no
-real credentials. Reading a secret back that still holds the sentinel — or that
-is absent, empty, or bound to an unprovisioned store — yields `null`:
+real credentials. Reading a secret back that still holds the sentinel—or that
+is absent, empty, or bound to an unprovisioned store—yields `null`:
 
 ```ts
 import { resolveModuleSecrets, describeModuleStatus } from "astroidjs";
@@ -292,15 +292,15 @@ exists to prevent.
 
 The scaffold ships one worked example: Turnstile captcha on the **editor
 sign-in**, seeded with the sentinel secret plus Cloudflare's always-passing test
-site key, enforcing only once **both** halves are real — so provisioning one of
+site key, enforcing only once **both** halves are real—so provisioning one of
 them can't lock you out of your own sign-in.
 
 Both halves matter, and the second one is the reason this is worth spelling out.
 `getLouiseAuth` registers Better Auth's captcha plugin on `/sign-in/magic-link`
 as soon as the pair is real, and that plugin rejects any request without an
 `x-captcha-response` header. So the login page renders the widget under exactly
-the same condition the server arms the check — `turnstileSiteKey` returns null
-for the test key, the same test `activeCaptchaSecret` applies — and forwards the
+the same condition the server arms the check—`turnstileSiteKey` returns null
+for the test key, the same test `activeCaptchaSecret` applies—and forwards the
 token in that header. A gate that turns on server-side while the page keeps
 posting without a token is not a half-configured integration; it is a locked
 door with the owner outside.
@@ -328,22 +328,22 @@ astroid deploy     provision bindings + migrate + secrets + deploy (--dry-run /
 `deploy` is plan-first: it prints exactly what it will run and refuses to
 provision non-interactively without `--yes` (use `--dry-run` to preview).
 
-The generated trio carries a "do not hand-edit" banner — `generate` (and
+The generated trio carries a "do not hand-edit" banner—`generate` (and
 `dev`/`build`) rewrite them on every run, and `doctor` diffs them against your
 config to catch drift. Your `wrangler.jsonc` is scaffolded once and then yours to
 edit (real binding ids, secrets); `generate` never touches it.
 
 New projects come from the `create-astroid` scaffold (`pnpm create astroid`), which
-writes the floor — config, the generated trio, `wrangler.jsonc`, and the baseline
-Astro app — in one step.
+writes the floor—config, the generated trio, `wrangler.jsonc`, and the baseline
+Astro app—in one step.
 
 ## Roadmap
 
-1. ✅ **Config surface** (`defineAstroid`) — single brand per project.
+1. ✅ **Config surface** (`defineAstroid`)—single brand per project.
 2. ✅ Config → generated Drizzle schema.
 3. ✅ Config → generated `worker.ts` + middleware (no hand-wired route ordering).
 4. ✅ `<Section>` / `<Editable>` / `<Collection>` component primitives.
-5. ✅ **CLI** — `astroid generate / doctor / dev / build / deploy`; `create-astroid`
+5. ✅ **CLI**—`astroid generate / doctor / dev / build / deploy`; `create-astroid`
    scaffold (`pnpm create astroid`).
 
 ## License

package/bin/astroid.mjs

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 // Copyright (c) 2026 BowenLabs. Astroid is MIT licensed.
 //
-// The `astroid` CLI — the meta-framework's project commands:
+// The `astroid` CLI—the meta-framework's project commands:
 //
 //   astroid generate [--config <path>] [--cwd <dir>]   regenerate schema/worker/middleware from the config
 //   astroid doctor   [--config <path>] [--cwd <dir>]   validate config + bindings + generated-file freshness
@@ -11,7 +11,7 @@
 //
 // It loads the project's `astroid.config.ts` with Node's native TypeScript
 // stripping (the config only imports the built `astroidjs`, so it resolves), and
-// consumes this package's own built generators from ../dist — the same version the
+// consumes this package's own built generators from ../dist—the same version the
 // CLI ships in, no dependency on node_modules layout (mirrors the louise bin).
 
 import { execFileSync, spawn, spawnSync } from "node:child_process";
@@ -89,7 +89,7 @@ async function cmdGenerate(cwd, flags, { quiet = false } = {}) {
 
   // Scaffold-once files for whatever modules the config switched on.
   //
-  // Written only when ABSENT — each is a seam the project owns, so overwriting
+  // Written only when ABSENT—each is a seam the project owns, so overwriting
   // one would destroy the edit it exists to hold. But a MISSING one is not a
   // choice the user made: the trio above emits static imports of `./queue.js`
   // and `./portal-auth.js`, so a config that gained a module after scaffold
@@ -138,7 +138,7 @@ async function cmdDoctor(cwd, flags) {
 
   ok(`config loads and validates (${rel(cwd, configPath)})`);
 
-  // 1. Generated trio freshness — regenerate in memory, diff against disk.
+  // 1. Generated trio freshness—regenerate in memory, diff against disk.
   for (const file of generateAstroidProject(config)) {
     const abs = join(cwd, file.path);
     if (!existsSync(abs)) {
@@ -146,7 +146,7 @@ async function cmdDoctor(cwd, flags) {
     } else if (readFileSync(abs, "utf8") !== file.contents) {
       // An ERROR, not a warning. These three carry a "do not hand-edit" banner
       // and are a pure function of the config, so "stale" means the project on
-      // disk is not the project the config describes — which is the single
+      // disk is not the project the config describes—which is the single
       // condition doctor exists to catch. As a warning it printed "healthy" and
       // exited 0, so `pnpm doctor` could not gate CI on it.
       err(`${file.path} is stale (out of sync with your config) — run \`astroid generate\`.`);
@@ -159,14 +159,14 @@ async function cmdDoctor(cwd, flags) {
   //     emits static imports of `./queue.js` / `./portal-auth.js`, so a config
   //     that names a module whose seam was never written produces a project that
   //     cannot resolve its own imports. This is precisely the state that used to
-  //     report "healthy, 2 warning(s)" and exit 0.
+  //     report "healthy" with two warnings and exit 0.
   for (const file of generateAstroidScaffoldFiles(config)) {
-    if (file.apply === "append-once") continue; // accumulated, not owned — see below
+    if (file.apply === "append-once") continue; // accumulated, not owned—see below
     if (existsSync(join(cwd, file.path))) ok(`${file.path} present`);
     else err(`${file.path} is missing (required by your config) — run \`astroid generate\`.`);
   }
 
-  // 2. wrangler.jsonc bindings — presence checks + placeholder detection. Read as
+  // 2. wrangler.jsonc bindings—presence checks + placeholder detection. Read as
   //    text (JSONC with comments/trailing commas) rather than parse, to stay robust.
   const wranglerPath = join(cwd, "wrangler.jsonc");
   if (!existsSync(wranglerPath)) {
@@ -209,7 +209,7 @@ async function cmdDoctor(cwd, flags) {
     // Email Sending declares its binding as `"name"`, not `"binding"`, so the
     // regex above cannot see it. Checked separately because sign-in depends on
     // it: the magic link is console-logged in dev and EMAILED in production, so
-    // a missing binding is a site nobody can sign in to — and it fails only once
+    // a missing binding is a site nobody can sign in to—and it fails only once
     // deployed, which is the one place nothing in this repo exercises.
     if (/"send_email"\s*:/.test(w)) ok("wrangler: Email Sending `EMAIL` binding present");
     else
@@ -228,8 +228,8 @@ async function cmdDoctor(cwd, flags) {
     // Cron triggers. The generated `scheduled` handler dispatches on a fixed set
     // of cron strings (`astroidCrons`); every one of them MUST be declared here
     // or Cloudflare never fires it and that job silently never runs. Because
-    // wrangler.jsonc is scaffold-once, a config that gains a cron (e.g. the daily
-    // health scan alongside the hourly catalog sync) can't update it — the exact
+    // wrangler.jsonc is scaffold-once, a config that gains a cron (for example, the daily
+    // health scan alongside the hourly catalog sync) can't update it—the exact
     // drift that shipped a dead daily scan while the handler dispatched on it and
     // doctor reported healthy. Parse the array from the JSONC text rather than
     // JSON.parse (comments/trailing commas), matching the binding checks above.
@@ -264,18 +264,24 @@ async function cmdDoctor(cwd, flags) {
     }
   }
 
-  // 3. migrations directory (matches the generated wrangler `migrations_dir`).
-  if (existsSync(join(cwd, "migrations"))) ok("migrations/ directory present");
-  else warn("no migrations/ directory — create your D1 schema migrations there.");
-
-  // 4. Local secret provisioning — which modules will run dormant under
+  // 3. migrations directory: the D1 `migrations_dir` wrangler.jsonc declares,
+  //    or `migrations/`, the generated default, when it names none. A site that
+  //    keeps its migrations under another name (drizzle/) isn't missing them.
+  const wranglerText = existsSync(wranglerPath) ? readFileSync(wranglerPath, "utf8") : "";
+  const migrationsDir =
+    wranglerText.match(/"migrations_dir"\s*:\s*"([^"]+)"/)?.[1]?.replace(/\/+$/, "") ??
+    "migrations";
+  if (existsSync(join(cwd, migrationsDir))) ok(`${migrationsDir}/ directory present`);
+  else warn(`no ${migrationsDir}/ directory — create your D1 schema migrations there.`);
+
+  // 4. Local secret provisioning—which modules will run dormant under
   //    `astroid dev`, and what to set to wake them.
   //
   //    Scoped deliberately to SECRETS, read from .dev.vars. Doctor is a static
   //    CLI: it cannot see runtime bindings (EMAIL, the queue), so claiming
   //    "email is dormant" here would be reporting its own blindness as the
   //    project's state. What it CAN say for certain is whether a value is still
-  //    the placeholder — and that is the half developers actually forget.
+  //    the placeholder—and that is the half developers actually forget.
   //
   //    A dormant module is never an error. It is the documented default, and a
   //    fresh scaffold is expected to report every module dormant.
@@ -295,7 +301,7 @@ async function cmdDoctor(cwd, flags) {
       const value = (devVars?.[name] ?? "").trim();
       return value === "" || value === ASTROID_SECRET_PLACEHOLDER;
     });
-    // `core` is not a module — its secrets each gate their own thing (sessions
+    // `core` is not a module—its secrets each gate their own thing (sessions
     // fail closed off localhost, Turnstile needs a matched pair), so a blanket
     // "dormant" line would be wrong. Report it as provisioning, not dormancy.
     if (unset.length === 0) ok(`${moduleName}: all secrets provisioned in .dev.vars`);
@@ -337,7 +343,7 @@ async function cmdAstro(cwd, subcommand, flags, rest) {
 }
 
 /** Resolve a project-local CLI bin (astro, wrangler) to an absolute path via the
- *  project's own dependency resolution — so we run the version it ships. */
+ *  project's own dependency resolution—so we run the version it ships. */
 function resolveBin(cwd, pkgName, binName) {
   try {
     const require = createRequire(join(cwd, "package.json"));
@@ -353,14 +359,14 @@ function resolveBin(cwd, pkgName, binName) {
 // --- deploy ----------------------------------------------------------------
 // `astroid deploy` orchestrates the one-time platform bring-up: provision the
 // bindings that still hold placeholder ids (D1/R2/KV), apply migrations, prompt
-// for secrets, and deploy — all by shelling out to the project's own `wrangler`.
+// for secrets, and deploy—all by shelling out to the project's own `wrangler`.
 // It's plan-first: it prints exactly what it will run, and only proceeds past the
 // irreversible steps on an interactive `y` (or `--yes`). `--dry-run` prints the
 // plan and stops; `--local` targets the local D1 for migrations.
 
 const isPlaceholder = (v) => !v || /^<.*>$/.test(v);
 
-/** Pull the deploy-relevant bits out of wrangler.jsonc by regex — robust against
+/** Pull the deploy-relevant bits out of wrangler.jsonc by regex—robust against
  *  its JSONC comments + trailing commas (a strict JSON.parse would throw). */
 function readWranglerFacts(text) {
   return {
@@ -373,8 +379,8 @@ function readWranglerFacts(text) {
       id: m[2],
     })),
     // Queue names, from the producer + the consumer's dead_letter_queue. Unlike
-    // D1/R2/KV these are referenced BY NAME, so there's no id to patch back —
-    // creating them is the whole job.
+    // D1/R2/KV these are referenced BY NAME, so there's no id to patch back—creating
+    // them is the whole job.
     queues: [
       ...new Set([
         ...[...text.matchAll(/"queue":\s*"([^"]+)"/g)].map((m) => m[1]),
@@ -400,7 +406,7 @@ function provisionPlan(facts) {
       steps.push({ kind: "kv", name: binding, args: ["kv", "namespace", "create", binding] });
     }
   }
-  // Queues carry no id, so there's no placeholder to test — creating one that
+  // Queues carry no id, so there's no placeholder to test—creating one that
   // already exists just errors, which the runner tolerates (same as R2).
   for (const queue of facts.queues) {
     steps.push({ kind: "queue", name: queue, args: ["queues", "create", queue] });
@@ -437,9 +443,9 @@ async function cmdDeploy(cwd, flags, rest) {
   const wranglerPath = join(cwd, "wrangler.jsonc");
   if (!existsSync(wranglerPath)) fail("wrangler.jsonc not found — run inside an Astroid project.");
 
-  // Regenerate so the shipped worker/schema always match the config — but NOT
+  // Regenerate so the shipped worker/schema always match the config—but NOT
   // on a dry run. This used to sit above the `--dry-run` guard, so a command
-  // that ends by printing "(dry run — nothing executed)" had already rewritten
+  // that ends by printing "(dry run—nothing executed)" had already rewritten
   // three files and silently discarded any local edits to them. Probing the
   // plan on a working branch is exactly when someone has local edits.
   if (!dryRun) await cmdGenerate(cwd, flags, { quiet: true });
@@ -494,8 +500,8 @@ async function cmdDeploy(cwd, flags, rest) {
   for (const s of plan) {
     out(`\n▸ wrangler ${s.args.join(" ")}`);
     const res = runInherit(s.args);
-    // R2 bucket + queue creates are idempotent-ish (an existing one errors) —
-    // tolerate those so a re-run of `astroid deploy` isn't a hard stop.
+    // R2 bucket + queue creates are idempotent-ish (an existing one errors)—tolerate
+    // those so a re-run of `astroid deploy` isn't a hard stop.
     if (res.status !== 0 && s.kind !== "r2" && s.kind !== "queue") {
       fail(`Provisioning failed at: wrangler ${s.args.join(" ")}`);
     }
@@ -551,7 +557,7 @@ async function cmdDeploy(cwd, flags, rest) {
 
 // --- helpers ---------------------------------------------------------------
 /**
- * Minimal KEY=VALUE reader for .dev.vars. Not a dotenv implementation — doctor
+ * Minimal KEY=VALUE reader for .dev.vars. Not a dotenv implementation—doctor
  * only needs to know whether a value is absent, empty, or the placeholder, so
  * expansion, multiline values, and `export` prefixes are out of scope. Quotes
  * are stripped because wrangler accepts them and a quoted placeholder must

package/dist/analytics/index.d.ts

@@ -5,7 +5,7 @@ export declare const ASTROID_VITALS_BINDING = "VITALS";
  *  account don't write into the same table. */
 export declare function astroidVitalsDataset(config: AstroidConfig): string;
 /**
- * Credentials the CWV READ-BACK needs — not the collection.
+ * Credentials the CWV READ-BACK needs—not the collection.
  *
  * The Analytics Engine SQL API is account-scoped and has no binding, so a token
  * is unavoidable. Both are required together: an account id without a token (or
@@ -18,7 +18,7 @@ export declare const ASTROID_VITALS_SECRET_NAMES: readonly ["CF_ACCOUNT_ID", "CF
  *
  * A FILE rather than an inline script, and that is a CSP decision, not a style
  * one: Astro hashes the scripts it processes into `script-src`, and an
- * `is:inline` script carrying generated content cannot be hashed — it would be
+ * `is:inline` script carrying generated content cannot be hashed—it would be
  * blocked. Served from `public/`, it is same-origin and covered by
  * `script-src 'self'` with no policy change at all.
  */
@@ -29,7 +29,7 @@ export declare function generateAstroidVitalsBeacon(config: AstroidConfig, beaco
 /**
  * The health scan's CWV read-back, as source for the generated worker.
  *
- * Returns `undefined` — so the badge stays "not measured yet" — when the API
+ * Returns `undefined`—so the badge stays "not measured yet"—when the API
  * credentials aren't set, the query fails, or there is no field data yet. Never
  * throws: a failed vitals query must not take down the rest of the health scan,
  * which is mostly cheap COUNTs that have nothing to do with it.

package/dist/analytics/index.js

@@ -1,25 +1,25 @@
 // Copyright (c) 2026 BowenLabs. Astroid is MIT licensed.
 //
-// Real-visitor Core Web Vitals (#106 CWV) — the field-data half of the health
+// Real-visitor Core Web Vitals (#106 CWV)—the field-data half of the health
 // co-pilot.
 //
 // `HealthSummary` has carried an optional `cwv` field since the health module
 // landed, and the Health panel renders a "not measured yet" badge when it's
 // absent. Astroid never populated it, so that badge was permanently accurate and
-// permanently useless — the same dead-UI shape as the missing overview route.
+// permanently useless—the same dead-UI shape as the missing overview route.
 //
 // The loop has three parts and needs all three to close:
 //
-//   1. INGEST — a beacon in the page POSTs LCP/CLS/INP to `/api/louise/vitals`,
+//   1. INGEST—a beacon in the page POSTs LCP/CLS/INP to `/api/louise/vitals`,
 //      which writes a data point to an Analytics Engine dataset.
-//   2. STORE — the `analytics_engine_datasets` binding. Free, and the route
+//   2. STORE—the `analytics_engine_datasets` binding. Free, and the route
 //      degrades to accept-and-drop without it.
-//   3. READ BACK — the daily health scan queries the p75 over the last day via
+//   3. READ BACK—the daily health scan queries the p75 over the last day via
 //      the Analytics Engine SQL API and folds it into the summary.
 //
 // Step 3 is the one with credentials: the SQL API is account-scoped and needs an
 // API token, which no binding provides. So it follows the dormant-until-
-// provisioned convention — collection runs regardless, and the badge stays "not
+// provisioned convention—collection runs regardless, and the badge stays "not
 // measured yet" until the pair is real, rather than the scan erroring.
 /** The Analytics Engine dataset binding name. */
 export const ASTROID_VITALS_BINDING = "VITALS";
@@ -29,7 +29,7 @@ export function astroidVitalsDataset(config) {
     return `${config.key.replace(/[^a-z0-9_]/gi, "_")}_web_vitals`;
 }
 /**
- * Credentials the CWV READ-BACK needs — not the collection.
+ * Credentials the CWV READ-BACK needs—not the collection.
  *
  * The Analytics Engine SQL API is account-scoped and has no binding, so a token
  * is unavoidable. Both are required together: an account id without a token (or
@@ -42,7 +42,7 @@ export const ASTROID_VITALS_SECRET_NAMES = ["CF_ACCOUNT_ID", "CF_API_TOKEN"];
  *
  * A FILE rather than an inline script, and that is a CSP decision, not a style
  * one: Astro hashes the scripts it processes into `script-src`, and an
- * `is:inline` script carrying generated content cannot be hashed — it would be
+ * `is:inline` script carrying generated content cannot be hashed—it would be
  * blocked. Served from `public/`, it is same-origin and covered by
  * `script-src 'self'` with no policy change at all.
  */
@@ -51,14 +51,14 @@ export function generateAstroidVitalsBeacon(config, beacon) {
     return {
         path: "public/vitals.js",
         contents: [
-            "// Real-visitor Core Web Vitals beacon — generated by astroidjs.",
+            "// Real-visitor Core Web Vitals beacon—generated by astroidjs.",
             "//",
             "// A static file, not an inline script: Astro hashes processed scripts into",
             "// script-src, and an is:inline script with generated content can't be",
             "// hashed, so it would be CSP-blocked. From public/ it is same-origin and",
             "// already covered by script-src 'self'.",
             "//",
-            "// It reports once per page, on visibilitychange → hidden, via sendBeacon —",
+            "// It reports once per page, on visibilitychange → hidden, via sendBeacon—",
             "// so it costs nothing on the critical path and never blocks unload.",
             beacon,
             "",
@@ -68,7 +68,7 @@ export function generateAstroidVitalsBeacon(config, beacon) {
 /**
  * The health scan's CWV read-back, as source for the generated worker.
  *
- * Returns `undefined` — so the badge stays "not measured yet" — when the API
+ * Returns `undefined`—so the badge stays "not measured yet"—when the API
  * credentials aren't set, the query fails, or there is no field data yet. Never
  * throws: a failed vitals query must not take down the rest of the health scan,
  * which is mostly cheap COUNTs that have nothing to do with it.

package/dist/astro/csp.d.ts

@@ -4,7 +4,7 @@ export { astroidCspOrigins } from "../security/csp-origins.js";
 export type CspHash = `${"sha256" | "sha384" | "sha512"}-${string}`;
 /**
  * The directives Astro lets a config own. `script-src` and `style-src` are
- * absent by design — Astro owns the first (it hashes what it processes) and the
+ * absent by design—Astro owns the first (it hashes what it processes) and the
  * middleware owns the second.
  *
  * Mirrored from Astro's own union rather than imported, so `astroidjs/astro`
@@ -14,7 +14,7 @@ export type CspHash = `${"sha256" | "sha384" | "sha512"}-${string}`;
  * silently producing a directive no browser enforces.
  */
 type CspDirectiveName = "base-uri" | "child-src" | "connect-src" | "default-src" | "fenced-frame-src" | "font-src" | "form-action" | "frame-ancestors" | "frame-src" | "img-src" | "manifest-src" | "media-src" | "object-src" | "referrer" | "report-to" | "report-uri" | "require-trusted-types-for" | "sandbox" | "trusted-types" | "upgrade-insecure-requests" | "worker-src";
-/** One rendered directive line, e.g. `"default-src 'self'"`. */
+/** One rendered directive line, for example, `"default-src 'self'"`. */
 export type CspDirective = `${CspDirectiveName}${string}`;
 /** The `security` block for `astro.config.mjs`, structurally typed so Astroid
  *  doesn't take a hard dependency on Astro's types. */
@@ -32,7 +32,7 @@ export interface AstroidSecurityConfig {
  * Hash of Solid's inline hydration bootstrap.
  *
  * `@astrojs/solid-js` injects this script on every page with an island, but
- * Astro's CSP tracker only hashes scripts it processed itself — so without this
+ * Astro's CSP tracker only hashes scripts it processed itself—so without this
  * the bootstrap is blocked under `script-src 'self'` and every island silently
  * fails to hydrate. Computed from `generateHydrationScript()` (the same call the
  * renderer makes), so a solid-js upgrade that changes the bootstrap updates the
@@ -40,7 +40,7 @@ export interface AstroidSecurityConfig {
  */
 export declare function solidHydrationHash(): CspHash;
 /**
- * The `security` block for `astro.config.mjs` — Astro's half of the split.
+ * The `security` block for `astro.config.mjs`—Astro's half of the split.
  *
  * `style-src` is deliberately absent: the generated middleware rewrites it per
  * response, and declaring it here would be the hash-vs-`'unsafe-inline'`
@@ -49,7 +49,7 @@ export declare function solidHydrationHash(): CspHash;
 export declare function astroidSecurity(config: AstroidConfig): AstroidSecurityConfig;
 /**
  * Vite build options the CSP depends on. `assetsInlineLimit: 0` stops Vite from
- * inlining small assets as `data:` URLs — an inlined script would be inline, and
+ * inlining small assets as `data:` URLs—an inlined script would be inline, and
  * therefore unhashed, and therefore blocked by `script-src 'self'`. Spread this
  * into `vite.build` rather than remembering why the number is zero.
  */