astroidjs 0.13.0 → 0.15.0

package/dist/schema/collections.d.ts

@@ -37,12 +37,43 @@ export declare function assertAstroidPageSections(config: AstroidConfig, data: R
  *
  *   pagesRoute({ table: pages, resolveEditor, fields, ...astroidPagesWriteHooks(config) })
  */
-export declare function astroidPagesWriteHooks(config: AstroidConfig): {
+/** The write context `pagesRoute` passes to a transform or validator. */
+export interface AstroidPagesWriteContext {
+    operation: "create" | "update";
+}
+/**
+ * A site's own `pagesRoute` hooks, exported as `pagesHooks` from the
+ * scaffold-once `src/pages-hooks.ts` when `pages.hooks` is on.
+ */
+export interface AstroidPagesHooks {
+    /**
+     * Clean a page write before Astroid's section sanitize and validate run, for
+     * example to normalize the slug, clamp a title, or fill a new page's defaults.
+     * It gets only the allowlisted fields of the write.
+     */
+    transform?: (data: Record<string, unknown>, ctx: AstroidPagesWriteContext) => Record<string, unknown> | Promise<Record<string, unknown>>;
+    /**
+     * Reject a write, after both transforms and before Astroid's own section
+     * validation. Throw a `LouiseValidationError` for a 422 with per-field
+     * violations, for example when a required field is empty.
+     */
+    validate?: (data: Record<string, unknown>, ctx: AstroidPagesWriteContext) => void | Promise<void>;
+    /** Slugs to refuse on top of {@link ASTROID_RESERVED_SLUGS}, such as a path
+     *  a site's own file route serves. */
+    reservedSlugs?: Iterable<string>;
+}
+/**
+ * Slugs no page may take, on any site. Each one is a path Astro, Cloudflare,
+ * or Astroid serves before the catch-all page route, so a page saved under it
+ * would be unreachable, and nothing would say why. `pagesRoute` refuses them
+ * with a 422 instead.
+ */
+export declare const ASTROID_RESERVED_SLUGS: readonly string[];
+export declare function astroidPagesWriteHooks(config: AstroidConfig, site?: AstroidPagesHooks): {
     sanitize: (html: string) => string;
-    transform: (data: Record<string, unknown>) => Record<string, unknown>;
-    validate: (data: Record<string, unknown>, ctx: {
-        operation: "create" | "update";
-    }) => Promise<void>;
+    transform: (data: Record<string, unknown>, ctx: AstroidPagesWriteContext) => Promise<Record<string, unknown>>;
+    validate: (data: Record<string, unknown>, ctx: AstroidPagesWriteContext) => Promise<void>;
+    reservedSlugs: string[];
 };
 export declare function astroidPagesCollection(config: AstroidConfig): CollectionConfig;
 /**

package/dist/schema/collections.js

@@ -99,24 +99,20 @@ export async function assertAstroidPageSections(config, data, operation = "updat
     });
 }
 /**
- * The write-time hooks the raw `pagesRoute` (louise-toolkit/editor) needs to
- * enforce the same section contract as the draft path.
- *
- * `pagesRoute` writes straight to the table and—unlike `versionsRoute`—takes
- * no collection config, so it never runs the `beforeChange` hook below. Left
- * bare (as it was), a direct `POST` / `PATCH /api/louise/pages/:id` persists an
- * unknown section `_type`, a setting outside its options, or unsanitized section
- * rich text: exactly what the hook exists to stop, silently missing from the one
- * route the on-canvas *structural* edits flow through. `<Sections>` then skips
- * the bad `_type`, so the section just vanishes with no error anywhere.
- *
- * These wire the SAME sanitize + validate the hook uses into `pagesRoute`'s
- * `sanitize` / `transform` / `validate` seams, so both write paths enforce one
- * contract. Spread into the route config:
- *
- *   pagesRoute({ table: pages, resolveEditor, fields, ...astroidPagesWriteHooks(config) })
+ * Slugs no page may take, on any site. Each one is a path Astro, Cloudflare,
+ * or Astroid serves before the catch-all page route, so a page saved under it
+ * would be unreachable, and nothing would say why. `pagesRoute` refuses them
+ * with a 422 instead.
  */
-export function astroidPagesWriteHooks(config) {
+export const ASTROID_RESERVED_SLUGS = [
+    "404",
+    "_astro",
+    "api",
+    "cdn-cgi",
+    "robots.txt",
+    "sitemap.xml",
+];
+export function astroidPagesWriteHooks(config, site = {}) {
     const mediaBase = pageMediaBase(config);
     return {
         // `body` is a richField, so it goes through pagesRoute's own sanitize seam—with
@@ -125,9 +121,14 @@ export function astroidPagesWriteHooks(config) {
         sanitize: (html) => sanitizeRichHtml(html, { mediaBase }),
         // `sections` is not a richField, so it's sanitized here in the transform,
         // which pagesRoute runs BEFORE validate—the hook's sanitize-then-validate
-        // order.
-        transform: (data) => sanitizeAstroidPageSections(config, data),
-        validate: (data, ctx) => assertAstroidPageSections(config, data, ctx.operation),
+        // order. The site's own transform runs first, so Astroid's sanitize sees
+        // the value the site is about to store.
+        transform: async (data, ctx) => sanitizeAstroidPageSections(config, site.transform ? await site.transform(data, ctx) : data),
+        validate: async (data, ctx) => {
+            await site.validate?.(data, ctx);
+            await assertAstroidPageSections(config, data, ctx.operation);
+        },
+        reservedSlugs: [...ASTROID_RESERVED_SLUGS, ...(site.reservedSlugs ?? [])],
     };
 }
 export function astroidPagesCollection(config) {

package/dist/schema/generate.js

@@ -31,7 +31,7 @@ export function generateAstroidSchema(config) {
     if (catalog?.includes("real("))
         drizzleImports.push("real");
     return [
-        "// Generated by astroidjs — do not hand-edit.",
+        "// Generated by astroidjs—do not hand-edit.",
         "// Source: your defineAstroid config.",
         `import { ${drizzleImports.sort().join(", ")} } from "drizzle-orm/sqlite-core";`,
         'import { collectionVersionsTable, type JsonValue } from "louise-toolkit/content";',
@@ -46,8 +46,8 @@ export function generateAstroidSchema(config) {
         '  publishedVersionId: integer("published_version_id"),',
         "});",
         "",
-        "// Version snapshots for pages. Field-independent — each saved version is one",
-        "// JSON blob — so the table only needs the slug.",
+        "// Version snapshots for pages. Field-independent—each saved version is one",
+        "// JSON blob—so the table only needs the slug.",
         'export const pagesVersions = collectionVersionsTable({ slug: "pages", fields: {} });',
         "",
         ...(catalog ? [catalog] : []),
@@ -56,7 +56,7 @@ export function generateAstroidSchema(config) {
         "// Site-owned tables (the ones Astroid doesn't manage): a project declares",
         "// its own Drizzle tables in src/schema.site.ts and they're re-exported here",
         "// so drizzle-kit sees them and the generated worker can import them. The file",
-        "// is scaffold-once — empty until a project adds a table — so this re-export is",
+        "// is scaffold-once—empty until a project adds a table—so this re-export is",
         "// always safe.",
         'export * from "./schema.site.js";',
         "",

package/dist/security/csp-origins.js

@@ -34,14 +34,13 @@ const COMMERCE_ORIGINS = {
 // convention) and it must not need a rebuild to switch on—CSP is baked at
 // build time, the secret is a runtime value.
 const TURNSTILE = turnstileCsp();
-// The map module. MapLibre spins its tile-decoding workers up from blob: URLs,
-// so `worker-src blob:` is not optional—without it the map renders an empty
-// canvas and the console fills with worker-construction errors.
-//
-// Nothing else is needed, and that's the whole argument for the self-hosted
-// basemap: the PMTiles archive is served same-origin, so `connect-src` stays
-// `'self'` with no tile host and no API key to allow.
-const MAP = { worker: ["blob:"] };
+// The map module adds nothing, and that's the whole argument for the
+// self-hosted basemap: the PMTiles archive is served same-origin, so
+// `connect-src` stays `'self'` with no tile host and no API key to allow. The
+// generated `<MapEmbed>` hands MapLibre 6 a same-origin worker URL, which it
+// constructs directly, so `worker-src 'self'` covers it with no `blob:`.
+// (MapLibre 5 built its workers from blob: URLs; a site still on 5 adds
+// `worker: ["blob:"]` to its own `security.cspOrigins`.)
 const DIRECTIVE_KEYS = ["script", "style", "frame", "connect", "font", "img", "worker"];
 /** Merge origin lists, de-duplicated, order preserved. */
 function mergeOrigins(...sets) {
@@ -57,7 +56,7 @@ function mergeOrigins(...sets) {
  * what a config implies without rebuilding the whole policy.
  */
 export function astroidCspOrigins(config) {
-    return mergeOrigins(TURNSTILE, ...((config.modules ?? []).includes("map") ? [MAP] : []), 
+    return mergeOrigins(TURNSTILE, 
     // EVERY provider in play, not "the" provider: a site can run Stripe for
     // invoicing beside Fourthwall for the storefront, and a policy that allowed
     // only one of them blocks the other's SDK at runtime.

package/dist/tenancy/index.js

@@ -110,7 +110,7 @@ export function generateAstroidTenancy(config) {
     const prefix = tenancy.rewritePrefix ?? ASTROID_TENANT_PREFIX;
     const example = (tenancy.hostPattern ?? "*.example.com").replace(/^\*\./, "");
     return [
-        "// Scaffolded once by astroidjs — yours to edit.",
+        "// Scaffolded once by astroidjs—yours to edit.",
         "//",
         "// What a subdomain MEANS. The generated middleware has already decided this",
         "// host is a tenant candidate (it matches your wildcard and is not reserved);",
@@ -128,17 +128,17 @@ export function generateAstroidTenancy(config) {
         "/**",
         " * Resolve a subdomain label to a tenant, or `null` if there isn't one.",
         " *",
-        " * `null` falls through to the ordinary site — which is a real choice, not a",
+        " * `null` falls through to the ordinary site—which is a real choice, not a",
         " * default: a stranger's subdomain then renders your homepage. If that is wrong",
         ' * for this project, set `tenancy.unknown: "404"` in astroid.config.ts and the',
-        " * generated middleware refuses the host instead — unambiguously not a page.",
+        " * generated middleware refuses the host instead—unambiguously not a page.",
         " *",
         " * This runs on EVERY request to a tenant host, so a database lookup here is a",
-        " * query per request. Cache it — a module-scope Map is enough within an isolate,",
+        " * query per request. Cache it—a module-scope Map is enough within an isolate,",
         " * KV if the tenant set is large or changes without a deploy.",
         " */",
         "export async function resolveTenant(label: string): Promise<Tenant | null> {",
-        `  // TODO(astroid): look \`label\` up — a D1 table, a KV entry, or a literal map`,
+        `  // TODO(astroid): look \`label\` up—a D1 table, a KV entry, or a literal map`,
         `  // while the set is small. Example: acme.${example} → { slug: "acme" }.`,
         "  return { slug: label };",
         "}",

package/dist/worker/generate.js

@@ -101,7 +101,12 @@ export function generateAstroidWorker(config) {
                 // POST/PATCH path would persist an unknown section `_type`, a setting
                 // outside its options, or unsanitized section rich text. See
                 // `astroidPagesWriteHooks`.
-                return 'pagesRoute({ table: pages, resolveEditor, fields: [...DEFAULT_PAGE_FIELDS, "sections"], ...pagesWriteHooks })';
+                //
+                // `versionsTable` makes a DELETE remove the page's version snapshots,
+                // which have no foreign key to the page and would otherwise orphan.
+                // `afterWrite` rebuilds the search index, which plain CRUD writes leave
+                // stale.
+                return 'pagesRoute({ table: pages, versionsTable: pagesVersions, resolveEditor, fields: [...DEFAULT_PAGE_FIELDS, "sections"], ...pagesWriteHooks, afterWrite: reindexPagesSearch })';
             case "save":
                 // No `bufferKv` here, deliberately: `saveRoute` has no such option. It
                 // writes live field saves (title, SEO) straight through, and the draft
@@ -114,7 +119,10 @@ export function generateAstroidWorker(config) {
                 const customArg = (config.settings?.customKeys ?? []).length
                     ? ", customKeys: SETTINGS_CUSTOM_KEYS"
                     : "";
-                return `settingsRoute({ table: siteSettings, resolveEditor, columns: SETTINGS_COLUMNS, imageKeys: SETTINGS_IMAGE_KEYS, mediaBase: MEDIA_BASE${customArg} })`;
+                // The site's sanitize + read hooks (config.settings.hooks), spread last
+                // so they add to the call rather than replace any part of it.
+                const hooksArg = config.settings?.hooks ? ", ...settingsHooks" : "";
+                return `settingsRoute({ table: siteSettings, resolveEditor, columns: SETTINGS_COLUMNS, imageKeys: SETTINGS_IMAGE_KEYS, mediaBase: MEDIA_BASE${customArg}${hooksArg} })`;
             }
             // `aiRunner` rather than `(env) => env.AI`: it reads the binding AND the
             // LOUISE_AI kill switch, so all three assists share one definition of
@@ -159,10 +167,16 @@ export function generateAstroidWorker(config) {
     };
     const lines = [];
     const p = (s = "") => lines.push(s);
-    p("// Generated by astroidjs — do not hand-edit.");
+    p("// Generated by astroidjs—do not hand-edit.");
     p("// Source: your defineAstroid config. The editor route ORDER is fixed by");
-    p("// Astroid to avoid matcher collisions — see each route's note below.");
+    p("// Astroid to avoid matcher collisions—see each route's note below.");
+    p('import { env } from "cloudflare:workers";');
     p('import { handle } from "@astrojs/cloudflare/handler";');
+    p('import type { EditorSession } from "louise-toolkit/auth";');
+    p('import { createLocalApi } from "louise-toolkit/content";');
+    p(inquiries
+        ? 'import { db, inquiriesForm } from "louise-toolkit/db";'
+        : 'import { db } from "louise-toolkit/db";');
     p("import {");
     for (const name of editorImports)
         p(`  ${name},`);
@@ -182,8 +196,6 @@ export function generateAstroidWorker(config) {
     p('import { checkLinks } from "louise-toolkit/browser";');
     p('import { readHealthSummary, summarizeHealth, writeHealthSummary } from "louise-toolkit/health";');
     p('import { composeWorker, isEditRequest, type WorkerRoute, withEdgeCache } from "louise-toolkit/worker";');
-    if (inquiries)
-        p('import { inquiriesForm } from "louise-toolkit/db";');
     p(`import { ${tables.join(", ")} } from "./schema.js";`);
     const astroidImports = [
         "astroidPagesCollection",
@@ -200,17 +212,36 @@ export function generateAstroidWorker(config) {
     p("// from a request; a truthy result authorizes editor writes. A generated auth");
     p("// module is a later slice.");
     p('import { resolveEditor } from "./auth.js";');
+    if (config.pages?.hooks) {
+        p("// Your PAGES seam: a transform and extra reserved slugs for the pages");
+        p("// route. Scaffolded once and yours to edit.");
+        p('import { pagesHooks } from "./pages-hooks.js";');
+    }
+    if (config.settings?.hooks) {
+        p("// Your SETTINGS seam: per-key sanitizers and a GET transform for the");
+        p("// Settings panel. Scaffolded once and yours to edit.");
+        p('import { settingsHooks } from "./settings-hooks.js";');
+    }
     if (queues) {
         p("// Your QUEUE seam: what each message actually does. Scaffolded once and");
-        p("// yours to edit — `astroidQueueHandler` there covers the catalog dispatch.");
+        p("// yours to edit—`astroidQueueHandler` there covers the catalog dispatch.");
         p('import { handleQueueMessage } from "./queue.js";');
     }
     p();
     p(`const MEDIA_BASE = ${JSON.stringify(mediaBase)};`);
     p("const pagesCollection = astroidPagesCollection(astroidConfig);");
     p("// Sanitize + section-catalog validation for the raw pagesRoute, which runs");
-    p("// no collection hook — the same contract versionsRoute gets from the config.");
-    p("const pagesWriteHooks = astroidPagesWriteHooks(astroidConfig);");
+    p("// no collection hook—the same contract versionsRoute gets from the config.");
+    p(config.pages?.hooks
+        ? "const pagesWriteHooks = astroidPagesWriteHooks(astroidConfig, pagesHooks);"
+        : "const pagesWriteHooks = astroidPagesWriteHooks(astroidConfig);");
+    p();
+    p("// pagesRoute writes with plain Drizzle, so the full-text index doesn't see a");
+    p("// title or slug change until something rebuilds it. Best-effort: pagesRoute");
+    p("// swallows a throw here, so a stale index never fails the write itself.");
+    p("async function reindexPagesSearch(editor: EditorSession): Promise<void> {");
+    p("  await createLocalApi(db(env.DB), pages, pagesCollection).reindexSearch({ session: editor });");
+    p("}");
     p();
     p("// Editable site_settings columns the Settings panel may write, and which of");
     p("// them resolve to a media-library asset.");
@@ -230,11 +261,14 @@ export function generateAstroidWorker(config) {
     p("// Delete-safety for the media library: where a media key can be REFERENCED,");
     p("// so deleting an asset that's live on a page warns instead of silently");
     p("// breaking it. Without these the scan has nothing to look at and every");
-    p("// delete reports 'no references'. Column names are SQL, not Drizzle keys —");
+    p("// delete reports 'no references'. Column names are SQL, not Drizzle keys—");
     p("// the scan is raw SQL over the table.");
     p("const MEDIA_REFERENCE_SOURCES = [");
     p('  { collection: "pages", table: "pages", columns: ["body", "sections", "og_image"], labelColumn: "title" },');
-    p('  { collection: "settings", table: "site_settings", columns: ["logo_url", "favicon_url", "default_og_image_url"], labelColumn: "site_name" },');
+    p(
+    // `custom` too: a site's own image settings (settings.imageKeys) live in
+    // that JSON column, and an unscanned column reports 'no references'.
+    '  { collection: "settings", table: "site_settings", columns: ["logo_url", "favicon_url", "default_og_image_url", "custom"], labelColumn: "site_name" },');
     p("];");
     p();
     p();
@@ -246,7 +280,7 @@ export function generateAstroidWorker(config) {
     p();
     p("// The same read, adapted for the overview slice. `readHealthSummary` yields");
     p("// `null` for 'no scan yet' while a slice resolver signals absence with");
-    p("// `undefined` — the two types are otherwise identical, and this one-line");
+    p("// `undefined`—the two types are otherwise identical, and this one-line");
     p("// coercion is the whole difference.");
     p("const overviewHealth = async (env: CloudflareEnv) =>");
     p("  (await readSiteHealth(env)) ?? undefined;");
@@ -256,7 +290,7 @@ export function generateAstroidWorker(config) {
     p();
     p("// The daily scan. Crawls the site's own pages for broken links and counts the");
     p("// two accessibility/SEO gaps that are cheap to compute, then persists one");
-    p("// snapshot for the dashboard to read. Every part degrades on its own — a");
+    p("// snapshot for the dashboard to read. Every part degrades on its own—a");
     p("// failed crawl or a failed COUNT yields zero rather than aborting the scan,");
     p("// because a partial health report is worth strictly more than none.");
     p("async function runHealthScan(env: CloudflareEnv) {");
@@ -279,7 +313,7 @@ export function generateAstroidWorker(config) {
     p("  return summary;");
     p("}");
     p();
-    p("/** One COUNT, degrading to 0 — a missing table must not abort the scan. */");
+    p("/** One COUNT, degrading to 0—a missing table must not abort the scan. */");
     p("async function countRows(env: CloudflareEnv, sql: string): Promise<number> {");
     p("  try {");
     p("    const row = await env.DB.prepare(sql).first<{ n: number }>();");
@@ -294,7 +328,7 @@ export function generateAstroidWorker(config) {
         p("// Unhandled inquiries. The COUNT is the whole table on purpose: the");
         p("// Inquiries tab reviews and CLEARS submissions (GET lists, DELETE removes),");
         p("// so a row that still exists is a message still waiting on you. There is no");
-        p("// read/unread column because deletion IS the acknowledgement — which also");
+        p("// read/unread column because deletion IS the acknowledgement—which also");
         p("// means this number goes down as you work through them, rather than being a");
         p("// total that only ever climbs.");
         p("const overviewInbox = async (env: CloudflareEnv) => {");
@@ -303,7 +337,7 @@ export function generateAstroidWorker(config) {
         p("};");
     }
     p("// The Home dashboard's content counts. Raw SQL because these are COUNTs over");
-    p("// THIS project's tables — the toolkit deliberately makes no assumption about");
+    p("// THIS project's tables—the toolkit deliberately makes no assumption about");
     p("// column names. A throw here degrades to a hidden card, never a 500.");
     p("const overviewContent = async (env: CloudflareEnv) => {");
     p("  const row = await env.DB.prepare(");
@@ -331,8 +365,8 @@ export function generateAstroidWorker(config) {
     p();
     p("// `sections` writes are validated + sanitized against the section catalog");
     p("// before they persist, on BOTH write paths: versionsRoute runs the pages");
-    p("// collection's beforeChange hook (via `config`), and pagesRoute — which takes");
-    p("// no collection config — gets the same contract from the `pagesWriteHooks`");
+    p("// collection's beforeChange hook (via `config`), and pagesRoute—which takes");
+    p("// no collection config—gets the same contract from the `pagesWriteHooks`");
     p("// spread. An unknown `_type`, a field of the wrong shape, or a setting outside");
     p("// its declared options is a 422, not a hole in the page.");
     p("const editorRoutes: WorkerRoute<CloudflareEnv>[] = [");
@@ -371,7 +405,7 @@ export function generateAstroidWorker(config) {
         : "export default composeWorker<CloudflareEnv>({");
     p("  routes: [...editorRoutes, mediaAssetRoute],");
     p("  // Deny-by-default editor API (ADR 0012). Under /api/louise a request must");
-    p("  // resolve to an editor unless it's headed for a public route — the contact");
+    p("  // resolve to an editor unless it's headed for a public route—the contact");
     p("  // form and the vitals beacon mark themselves. Every route above still checks");
     p("  // for itself; this is what catches one that forgets. It also gives route");
     p("  // responses the security headers the middleware never sees, since these");
@@ -381,13 +415,13 @@ export function generateAstroidWorker(config) {
     p("  //");
     p("  // Wrapped UNCONDITIONALLY, and that is safe: `withEdgeCache` only stores a");
     p("  // response that carries a cacheable Cloudflare-CDN-Cache-Control directive,");
-    p("  // and a page emits one only via `Astro.cache.set(...)` — which the scaffold");
+    p("  // and a page emits one only via `Astro.cache.set(...)`—which the scaffold");
     p('  // gates on ASTROID_EDGE_CACHE being "true" AND the request not being in edit');
     p("  // mode. With the var off (the default) every render is `no-store`, so this");
     p("  // layer stores nothing and is a transparent pass-through.");
     p("  //");
     p("  // It must be THIS cache and not Cloudflare's automatic edge cache: that one");
-    p("  // is keyed by URL, runs BEFORE the Worker, and is therefore cookie-blind —");
+    p("  // is keyed by URL, runs BEFORE the Worker, and is therefore cookie-blind—");
     p("  // it will happily serve an editor a cached public page. That exact bug got");
     p("  // this feature reverted twice (#163, #165). `withEdgeCache` strips the CDN");
     p("  // directive from every response so the automatic cache never engages.");
@@ -421,8 +455,8 @@ export function generateAstroidWorker(config) {
     p("    }");
     if (cron) {
         p(`    if (controller.cron === ${JSON.stringify(cron)}) {`);
-        p("      // Catalog safety net. Webhooks get missed — a provider outage, a");
-        p("      // deploy mid-delivery, a DLQ'd message — and without this the site");
+        p("      // Catalog safety net. Webhooks get missed—a provider outage, a");
+        p("      // deploy mid-delivery, a DLQ'd message—and without this the site");
         p("      // serves stale data until a human notices. Enqueued rather than run");
         p("      // inline so it takes the same retry + DLQ path as everything else.");
         p('      ctx.waitUntil(env.COMMERCE_QUEUE.send({ kind: "catalog_refresh" }));');
@@ -487,7 +521,7 @@ export function generateAstroidMiddleware(config) {
     const rewritePrefix = tenancy?.rewritePrefix ?? ASTROID_TENANT_PREFIX;
     const rewriteExclude = tenancy?.rewriteExclude ?? ASTROID_REWRITE_EXCLUDE;
     return [
-        "// Generated by astroidjs — do not hand-edit.",
+        "// Generated by astroidjs—do not hand-edit.",
         "// The shared Louise middleware: rate-limit the unauthenticated POST surfaces,",
         "// then resolve the editor session + sticky ?louise edit mode, then apply",
         "// content-freshness + transport-security headers, and rewrite the style-src of",
@@ -508,11 +542,11 @@ export function generateAstroidMiddleware(config) {
         'import astroidConfig from "../astroid.config.js";',
         ...(tenancy
             ? [
-                "// TODO(astroid): your TENANT seam — what a subdomain maps to (src/tenancy.ts).",
+                "// TODO(astroid): your TENANT seam—what a subdomain maps to (src/tenancy.ts).",
                 'import { resolveTenant } from "./tenancy.js";',
             ]
             : []),
-        "// TODO(astroid): your AUTH seam — same resolveEditor as the generated worker.ts.",
+        "// TODO(astroid): your AUTH seam—same resolveEditor as the generated worker.ts.",
         'import { resolveEditor } from "./auth.js";',
         // The portal's resolver lives in its OWN module, not the editor's auth
         // seam—they're separate Better Auth instances and must not share a file.
@@ -521,9 +555,9 @@ export function generateAstroidMiddleware(config) {
         "// Rate-limit the public, unauthenticated POST surface, keyed by client IP",
         "// (fixed-window KV counter that fails open). Derived from your config: the",
         "// editor magic-link always, plus the portal credential surfaces and checkout",
-        "// when those are enabled. Add your own via `security.rateRules` in the config —",
+        "// when those are enabled. Add your own via `security.rateRules` in the config—",
         "// they're matched first, so they can also override a default's budget.",
-        "// `env.RL` is read per request (a getter) — a KV binding is only valid in",
+        "// `env.RL` is read per request (a getter)—a KV binding is only valid in",
         "// request scope.",
         "const RATE_RULES = astroidRateRules(astroidConfig);",
         ...(tenancy
@@ -538,7 +572,7 @@ export function generateAstroidMiddleware(config) {
             ? [
                 "const PORTAL_GUARD = astroidPortalGuardConfig(astroidConfig)!;",
                 "",
-                "// The PORTAL session — a second, cookie- and table-isolated Better Auth",
+                "// The PORTAL session—a second, cookie- and table-isolated Better Auth",
                 "// instance beside the editor's. `resolvePortalSession` shares the in-flight",
                 "// lookup per request, so the guard here and the handler that runs next",
                 "// don't each pay a session round-trip.",
@@ -548,7 +582,7 @@ export function generateAstroidMiddleware(config) {
         "export const onRequest = createLouiseMiddleware({",
         "  resolveEditor: (request) => resolveEditor(request),",
         "  rateLimit: { rules: RATE_RULES, kv: () => env.RL },",
-        "  // The same deny-by-default gate for /api/louise routes that reach Astro —",
+        "  // The same deny-by-default gate for /api/louise routes that reach Astro—",
         "  // anything the worker's routes didn't answer. A second check behind the",
         "  // worker's gate, and free: the editor is resolved here on every request.",
         "  apiGate: true,",
@@ -583,7 +617,7 @@ export function generateAstroidMiddleware(config) {
                         "    // A syntactically-valid tenant host whose label resolved to nothing is",
                         '    // NOT a page (config `tenancy.unknown: "404"`). Falling through would',
                         "    // render the marketing homepage on a stranger's subdomain. Reserved",
-                        "    // labels, app labels, and the apex never reach here — tenantLabel",
+                        "    // labels, app labels, and the apex never reach here—tenantLabel",
                         "    // returns null for all of them, so they are not tenant candidates.",
                         "    if (tenantLabel(context.url.hostname, TENANCY) && !context.locals.tenant) {",
                         '      return new Response("Not found", { status: 404 });',
@@ -593,7 +627,7 @@ export function generateAstroidMiddleware(config) {
                 ...(portal
                     ? [
                         "    // Route guard: the declarative prefix→roles table from your config.",
-                        "    // An /api/* route always answers in JSON — redirecting fetch() to an",
+                        "    // An /api/* route always answers in JSON—redirecting fetch() to an",
                         "    // HTML login page returns 200 and markup, which reads as success.",
                         "    const decision = portalGuard(",
                         "      context.url.pathname,",
@@ -612,16 +646,16 @@ export function generateAstroidMiddleware(config) {
             ? [
                 "  // Host dispatch: map the resolved tenant onto an internal path prefix.",
                 "  // Runs after `guard`, so route policy stays written against the PUBLIC",
-                "  // path. The visitor's URL is unchanged — an internal rewrite, not a",
-                "  // redirect — so links built from Astro.url stay correct.",
+                "  // path. The visitor's URL is unchanged—an internal rewrite, not a",
+                "  // redirect—so links built from Astro.url stay correct.",
                 "  //",
                 "  // An unknown subdomain is YOUR decision: `resolveTenant` returning null",
-                "  // falls through to the ordinary site below — or 404s first, when the",
+                "  // falls through to the ordinary site below—or answers 404 first, when the",
                 '  // config sets `tenancy.unknown: "404"` (see the guard above).',
                 "  rewrite: (context) => {",
                 "    // Host-agnostic paths render from their own address. An API route is",
                 "    // addressed absolutely by whatever calls it and reads the host from",
-                "    // `locals.tenant`, so rewriting it moves it where no route matches —",
+                "    // `locals.tenant`, so rewriting it moves it where no route matches—",
                 "    // and on an app host with a catch-all page, the PAGE answers, so",
                 "    // fetch() gets HTML instead of JSON and every data load quietly fails.",
                 `    if (isRewriteExcluded(context.url.pathname, ${JSON.stringify(rewriteExclude)})) {`,
@@ -630,12 +664,12 @@ export function generateAstroidMiddleware(config) {
                 ...(Object.keys(tenancy.apps ?? {}).length
                     ? [
                         "    // First-party app hosts (config `tenancy.apps`): a static label→prefix",
-                        "    // map, checked before the tenant — an app exists whether or not any",
+                        "    // map, checked before the tenant—an app exists whether or not any",
                         "    // tenant does, and needs no lookup.",
                         "    const app = appPrefix(context.url.hostname, TENANCY);",
                         "    // `search` is preserved: the rewrite chooses which page renders, not",
                         "    // what was asked of it. Dropping it silently loses filters, pagination,",
-                        "    // campaign tags — and every typed search param a routed island reads.",
+                        "    // campaign tags—and every typed search param a routed island reads.",
                         "    if (app) return `${app}${context.url.pathname}${context.url.search}`;",
                     ]
                     : []),

package/dist/worker/routes.js

@@ -23,7 +23,7 @@ export function astroidEditorRoutePlan(config) {
         {
             name: "versions",
             factory: "versionsRoute",
-            note: "Draft/publish + version history for pages. MUST precede pagesRoute — pagesRoute's /:id matcher would otherwise claim /pages/:id/versions and 400 on the non-integer id.",
+            note: "Draft/publish + version history for pages. MUST precede pagesRoute—pagesRoute's /:id matcher would otherwise claim /pages/:id/versions and 400 on the non-integer id.",
         },
         {
             name: "search",
@@ -33,7 +33,7 @@ export function astroidEditorRoutePlan(config) {
         {
             name: "seoFix",
             factory: "seoFixRoute",
-            note: "One-click SEO backfill for published pages missing a title/description. MUST precede pagesRoute for the same reason versions/search do: it mounts at /api/louise/pages/generate-seo, and pagesRoute claims EVERY path under /api/louise/pages/ as an item id — so mounted after, it would never be reached and the request would 400 on the non-integer id `generate-seo`.",
+            note: "One-click SEO backfill for published pages missing a title/description. MUST precede pagesRoute for the same reason versions/search do: it mounts at /api/louise/pages/generate-seo, and pagesRoute claims EVERY path under /api/louise/pages/ as an item id—so mounted after, it would never be reached and the request would 400 on the non-integer id `generate-seo`.",
         },
         {
             name: "pages",
@@ -43,7 +43,7 @@ export function astroidEditorRoutePlan(config) {
         {
             name: "save",
             factory: "saveRoute",
-            note: "Live field saves (title, SEO) — the versioned body stages drafts via versionsRoute instead.",
+            note: "Live field saves (title, SEO)—the versioned body stages drafts via versionsRoute instead.",
         },
         {
             name: "settings",
@@ -53,12 +53,12 @@ export function astroidEditorRoutePlan(config) {
         {
             name: "media",
             factory: "mediaRoute",
-            note: "Media library — list, upload, delete, reference checks.",
+            note: "Media library—list, upload, delete, reference checks.",
         },
         {
             name: "editors",
             factory: "editorsRoute",
-            note: "Editor roster (the Users panel) over Better Auth's `user` table — a row IS an editor, and the same table is the magic-link allowlist (resolveAdmins).",
+            note: "Editor roster (the Users panel) over Better Auth's `user` table—a row IS an editor, and the same table is the magic-link allowlist (resolveAdmins).",
         },
     ];
     // AI assists that own their own path prefix. `/api/louise/ai/*` collides with
@@ -74,23 +74,23 @@ export function astroidEditorRoutePlan(config) {
         routes.push({
             name: "realtime",
             factory: "realtimeRoute",
-            note: "WebSocket upgrade for the per-page live editing session (ADR 0002). Owns /api/louise/realtime/*. Guards the handshake as a same-origin, session-gated mutation, then forwards to the per-page Durable Object with the SERVER-resolved editor identity — presence is never taken from the client.",
+            note: "WebSocket upgrade for the per-page live editing session (ADR 0002). Owns /api/louise/realtime/*. Guards the handshake as a same-origin, session-gated mutation, then forwards to the per-page Durable Object with the SERVER-resolved editor identity—presence is never taken from the client.",
         });
     }
     routes.push({
         name: "vitals",
         factory: "vitalsRoute",
-        note: "Public CWV ingestion (POST /api/louise/vitals). NOT session-gated — these are anonymous visitor beacons — but same-origin only, and it accepts-and-drops without the dataset binding. Always 204.",
+        note: "Public CWV ingestion (POST /api/louise/vitals). NOT session-gated—these are anonymous visitor beacons—but same-origin only, and it accepts-and-drops without the dataset binding. Always 204.",
     });
     routes.push({
         name: "health",
         factory: "healthRoute",
-        note: "The site-health panel's read of the persisted scan summary. Owns /api/louise/health. Like overviewRoute, its client half already ships in the editor drawer — unmounted, the Health card was dead UI. Returns `{ summary: null }` (a 200) until the daily cron writes the first scan, which the panel renders as 'not checked yet'.",
+        note: "The site-health panel's read of the persisted scan summary. Owns /api/louise/health. Like overviewRoute, its client half already ships in the editor drawer—unmounted, the Health card was dead UI. Returns `{ summary: null }` (a 200) until the daily cron writes the first scan, which the panel renders as 'not checked yet'.",
     });
     routes.push({
         name: "ai",
         factory: "aiRoute",
-        note: "Editor AI assists — rewrite/expand/shorten a selection, suggest SEO for a page. Owns /api/louise/ai/*, so it collides with nothing. POST-only and editor-gated, since each call spends AI budget.",
+        note: "Editor AI assists—rewrite/expand/shorten a selection, suggest SEO for a page. Owns /api/louise/ai/*, so it collides with nothing. POST-only and editor-gated, since each call spends AI budget.",
     });
     if (capturesInquiries(config)) {
         routes.push({
@@ -106,7 +106,7 @@ export function astroidEditorRoutePlan(config) {
     routes.push({
         name: "seed",
         factory: "seedRoute",
-        note: "First-run site_settings seed. Last — it's a one-shot bootstrap, not a hot path.",
+        note: "First-run site_settings seed. Last—it's a one-shot bootstrap, not a hot path.",
     });
     return routes;
 }