astroidjs 0.14.0 → 0.15.0

package/bin/astroid.mjs

@@ -148,7 +148,7 @@ async function cmdDoctor(cwd, flags) {
       // and are a pure function of the config, so "stale" means the project on
       // disk is not the project the config describes—which is the single
       // condition doctor exists to catch. As a warning it printed "healthy" and
-      // exited 0, so `pnpm doctor` could not gate CI on it.
+      // exited 0, so `pnpm run doctor` could not gate CI on it.
       err(`${file.path} is stale (out of sync with your config) — run \`astroid generate\`.`);
     } else {
       ok(`${file.path} is up to date`);

package/dist/map/scaffold.d.ts

@@ -24,6 +24,6 @@ export declare function generateMapTileRoute(config: AstroidConfig): string | nu
 export declare function generateMapEmbedComponent(config: AstroidConfig): string | null;
 /** The npm dependencies the map module needs in the scaffold. */
 export declare const ASTROID_MAP_DEPENDENCIES: {
-    readonly "maplibre-gl": "^5.9.0";
+    readonly "maplibre-gl": "^6.11.2";
     readonly pmtiles: "^4.4.0";
 };

package/dist/map/scaffold.js

@@ -149,14 +149,19 @@ export function generateMapEmbedComponent(config) {
         "    const load = () =>",
         "      (loader ??= Promise.all([",
         '        import("maplibre-gl"),',
+        "        // MapLibre 6 looks for its worker next to its own module, which a",
+        "        // bundle moves, so hand it the worker. `?worker&url` sends the file",
+        "        // through Vite's worker pipeline, which emits one self-contained",
+        "        // chunk; a plain `?url` copies it without the shared module it",
+        "        // imports, and then no tiles load. The worker is same-origin, so",
+        "        // `worker-src 'self'` covers it with no `blob:`.",
+        '        import("maplibre-gl/dist/maplibre-gl-worker.mjs?worker&url"),',
         '        import("pmtiles"),',
         '        import("maplibre-gl/dist/maplibre-gl.css"),',
-        "      ]).then(([maplibre, pmtiles]) => ({",
-        "        // maplibre-gl ships as CJS: under ESM interop the API may be on",
-        "        // `.default` or be the namespace itself. Accept either.",
-        "        maplibregl: (maplibre as any).default ?? maplibre,",
-        "        Protocol: (pmtiles as any).Protocol,",
-        "      })));",
+        "      ]).then(([maplibregl, worker, pmtiles]) => {",
+        "        maplibregl.setWorkerUrl(worker.default);",
+        "        return { maplibregl, Protocol: pmtiles.Protocol };",
+        "      }));",
         "",
         "    const init = async (el: HTMLElement) => {",
         "      const lat = Number(el.dataset.lat);",
@@ -168,18 +173,26 @@ export function generateMapEmbedComponent(config) {
         "      // archive instead of requesting tile URLs.",
         '      maplibregl.addProtocol("pmtiles", new Protocol().tile);',
         "",
-        "      const map = new maplibregl.Map({",
-        "        container: el,",
-        '        style: JSON.parse(el.dataset.style ?? "{}"),',
-        "        center: [lng, lat],",
-        "        zoom: Number(el.dataset.zoom ?? 15),",
-        "        // A map that swallows page scroll is a trap on mobile; cooperative",
-        "        // gestures require an explicit modifier/two fingers to pan.",
-        "        cooperativeGestures: true,",
-        "        dragRotate: false,",
-        "        pitchWithRotate: false,",
-        "        touchPitch: false,",
-        "      });",
+        "      let map;",
+        "      try {",
+        "        map = new maplibregl.Map({",
+        "          container: el,",
+        '          style: JSON.parse(el.dataset.style ?? "{}"),',
+        "          center: [lng, lat],",
+        "          zoom: Number(el.dataset.zoom ?? 15),",
+        "          // A map that swallows page scroll is a trap on mobile; cooperative",
+        "          // gestures require an explicit modifier/two fingers to pan.",
+        "          cooperativeGestures: true,",
+        "          dragRotate: false,",
+        "          pitchWithRotate: false,",
+        "          touchPitch: false,",
+        "        });",
+        "      } catch (err) {",
+        "        // MapLibre 6 needs WebGL2 and throws `GPUInitializationError` without",
+        "        // it. Leave the tinted container in place rather than a broken canvas.",
+        "        if (err instanceof maplibregl.GPUInitializationError) return;",
+        "        throw err;",
+        "      }",
         '      map.addControl(new maplibregl.NavigationControl({ showCompass: false }), "top-right");',
         "",
         '      const pin = document.createElement("div");',
@@ -213,6 +226,6 @@ export function generateMapEmbedComponent(config) {
 }
 /** The npm dependencies the map module needs in the scaffold. */
 export const ASTROID_MAP_DEPENDENCIES = {
-    "maplibre-gl": "^5.9.0",
+    "maplibre-gl": "^6.11.2",
     pmtiles: "^4.4.0",
 };

package/dist/security/csp-origins.js

@@ -34,14 +34,13 @@ const COMMERCE_ORIGINS = {
 // convention) and it must not need a rebuild to switch on—CSP is baked at
 // build time, the secret is a runtime value.
 const TURNSTILE = turnstileCsp();
-// The map module. MapLibre spins its tile-decoding workers up from blob: URLs,
-// so `worker-src blob:` is not optional—without it the map renders an empty
-// canvas and the console fills with worker-construction errors.
-//
-// Nothing else is needed, and that's the whole argument for the self-hosted
-// basemap: the PMTiles archive is served same-origin, so `connect-src` stays
-// `'self'` with no tile host and no API key to allow.
-const MAP = { worker: ["blob:"] };
+// The map module adds nothing, and that's the whole argument for the
+// self-hosted basemap: the PMTiles archive is served same-origin, so
+// `connect-src` stays `'self'` with no tile host and no API key to allow. The
+// generated `<MapEmbed>` hands MapLibre 6 a same-origin worker URL, which it
+// constructs directly, so `worker-src 'self'` covers it with no `blob:`.
+// (MapLibre 5 built its workers from blob: URLs; a site still on 5 adds
+// `worker: ["blob:"]` to its own `security.cspOrigins`.)
 const DIRECTIVE_KEYS = ["script", "style", "frame", "connect", "font", "img", "worker"];
 /** Merge origin lists, de-duplicated, order preserved. */
 function mergeOrigins(...sets) {
@@ -57,7 +56,7 @@ function mergeOrigins(...sets) {
  * what a config implies without rebuilding the whole policy.
  */
 export function astroidCspOrigins(config) {
-    return mergeOrigins(TURNSTILE, ...((config.modules ?? []).includes("map") ? [MAP] : []), 
+    return mergeOrigins(TURNSTILE, 
     // EVERY provider in play, not "the" provider: a site can run Stripe for
     // invoicing beside Fourthwall for the storefront, and a policy that allowed
     // only one of them blocks the other's SDK at runtime.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "astroidjs",
-  "version": "0.14.0",
+  "version": "0.15.0",
   "description": "Astroid — an opinionated meta-framework over Louise Toolkit and Astro for building editable, multi-editor sites on Cloudflare Workers.",
   "keywords": [
     "astro",
@@ -64,14 +64,14 @@
     "@typescript/native-preview": "7.0.0-dev.20260707.2",
     "@vitest/coverage-v8": "4.1.11",
     "astro": "^7.2.9",
-    "louise-toolkit": "^0.31.1",
+    "louise-toolkit": "^0.33.0",
     "solid-js": "^1.9.15",
-    "typescript": "^5.9.3",
+    "typescript": "^6.0.3",
     "vitest": "^4.1.11"
   },
   "peerDependencies": {
     "astro": "^7.0.9",
-    "louise-toolkit": "^0.31.1",
+    "louise-toolkit": "^0.33.0",
     "solid-js": "^1.9.0"
   },
   "peerDependenciesMeta": {