astroidjs 0.16.0 → 0.18.0

package/bin/astroid.mjs

@@ -6,7 +6,7 @@
 //   astroid generate [--config <path>] [--cwd <dir>]   regenerate schema/worker/middleware from the config
 //   astroid doctor   [--config <path>] [--cwd <dir>]   validate config + bindings + generated-file freshness
 //   astroid dev      [...astro args]                   generate, then `astro dev`
-//   astroid build    [...astro args]                   generate, then `astro build`
+//   astroid build    [...astro args]                   generate, `astro build`, then fix the built wrangler.json
 //   astroid deploy   [--dry-run] [--yes] [--local]     provision + migrate + secrets + deploy
 //   astroid ship     production | preview              migrate, then deploy or preview (Workers Builds)
 //
@@ -16,6 +16,7 @@
 // CLI ships in, no dependency on node_modules layout (mirrors the louise bin).
 
 import { execFileSync, spawn, spawnSync } from "node:child_process";
+import { randomBytes } from "node:crypto";
 import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
 import { createRequire } from "node:module";
 import { dirname, isAbsolute, join, resolve } from "node:path";
@@ -156,6 +157,8 @@ async function cmdDoctor(cwd, flags) {
     astroidUsesQueues,
     astroidCrons,
     checkWranglerPreviews,
+    astroidRunsMigrations,
+    migrationsOwnershipError,
     generateAstroidReleaseWorkflow,
     ASTROID_RELEASE_WORKFLOW_PATH,
   } = await import(GENERATORS_URL);
@@ -325,12 +328,21 @@ async function cmdDoctor(cwd, flags) {
   // 3. migrations directory: the D1 `migrations_dir` wrangler.jsonc declares,
   //    or `migrations/`, the generated default, when it names none. A site that
   //    keeps its migrations under another name (drizzle/) isn't missing them.
+  //    An app with `deploy.migrations: false` applies none, because another
+  //    app owns the database's schema, so it needs no directory. It must not
+  //    name one either: that contradiction means someone expects it to migrate.
   const wranglerText = existsSync(wranglerPath) ? readFileSync(wranglerPath, "utf8") : "";
-  const migrationsDir =
-    wranglerText.match(/"migrations_dir"\s*:\s*"([^"]+)"/)?.[1]?.replace(/\/+$/, "") ??
-    "migrations";
-  if (existsSync(join(cwd, migrationsDir))) ok(`${migrationsDir}/ directory present`);
-  else warn(`no ${migrationsDir}/ directory — create your D1 schema migrations there.`);
+  if (!astroidRunsMigrations(config)) {
+    const ownership = migrationsOwnershipError(config, wranglerText);
+    if (ownership) err(ownership);
+    else ok("deploy.migrations is false: another app migrates this database");
+  } else {
+    const migrationsDir =
+      wranglerText.match(/"migrations_dir"\s*:\s*"([^"]+)"/)?.[1]?.replace(/\/+$/, "") ??
+      "migrations";
+    if (existsSync(join(cwd, migrationsDir))) ok(`${migrationsDir}/ directory present`);
+    else warn(`no ${migrationsDir}/ directory — create your D1 schema migrations there.`);
+  }
 
   // 4. Local secret provisioning—which modules will run dormant under
   //    `astroid dev`, and what to set to wake them.
@@ -397,7 +409,33 @@ async function cmdAstro(cwd, subcommand, flags, rest) {
     );
   }
   const child = spawn(process.execPath, [astroBin, subcommand, ...rest], { stdio: "inherit", cwd });
-  child.on("exit", (code) => process.exit(code ?? 0));
+  child.on("exit", async (code) => {
+    // A failed build keeps its exit code and its output as it left them.
+    if (subcommand === "build" && code === 0) await fixBuiltWranglerConfig(cwd);
+    process.exit(code ?? 0);
+  });
+}
+
+/** Delete `legacy_env` from the built Wrangler config, which current Wrangler
+ *  rejects (see src/project/build-output.ts). Warns rather than failing: the
+ *  build itself succeeded, and an older Wrangler deploys the file as is. */
+async function fixBuiltWranglerConfig(cwd) {
+  const { WRANGLER_DEPLOY_REDIRECT, builtWranglerConfigPath, stripLegacyEnv } = await import(
+    GENERATORS_URL
+  );
+  const redirectPath = join(cwd, WRANGLER_DEPLOY_REDIRECT);
+  const redirect = existsSync(redirectPath) ? readFileSync(redirectPath, "utf8") : null;
+  const configPath = resolve(cwd, builtWranglerConfigPath(redirect));
+  try {
+    const next = stripLegacyEnv(readFileSync(configPath, "utf8"));
+    if (next === null) return;
+    writeFileSync(configPath, next);
+    out(`astroid: removed legacy_env from ${rel(cwd, configPath)}`);
+  } catch (err) {
+    process.stderr.write(
+      `astroid: warning: couldn't check ${rel(cwd, configPath)} for legacy_env: ${err instanceof Error ? err.message : String(err)}\n`,
+    );
+  }
 }
 
 /** Resolve a project-local CLI bin (astro, wrangler) to an absolute path via the
@@ -500,7 +538,9 @@ async function cmdDeploy(cwd, flags, rest) {
   const assumeYes = rest.includes("--yes") || rest.includes("-y");
   const remoteArgs = rest.includes("--local") ? [] : ["--remote"];
 
-  await loadConfig(cwd, flags.config); // validates the config (throws on a bad shape)
+  const { config } = await loadConfig(cwd, flags.config); // validates the shape, or throws
+  const { astroidRunsMigrations, ASTROID_SKIP_MIGRATIONS_NOTE } = await import(GENERATORS_URL);
+  const migrate = astroidRunsMigrations(config);
   const wranglerPath = join(cwd, "wrangler.jsonc");
   if (!existsSync(wranglerPath)) fail("wrangler.jsonc not found — run inside an Astroid project.");
 
@@ -520,7 +560,11 @@ async function cmdDeploy(cwd, flags, rest) {
   out("  Provision:");
   if (plan.length === 0) out("    (all bindings already have ids)");
   for (const s of plan) out(`    wrangler ${s.args.join(" ")}`);
-  out(`\n  Migrate:  wrangler d1 migrations apply DB ${remoteArgs.join(" ")}`.trimEnd());
+  out(
+    migrate
+      ? `\n  Migrate:  wrangler d1 migrations apply DB ${remoteArgs.join(" ")}`.trimEnd()
+      : `\n  Migrate:  ${ASTROID_SKIP_MIGRATIONS_NOTE}`,
+  );
   out("  Secrets:  wrangler secret put SESSION_SECRET   (prompted)");
   out("  Deploy:   wrangler deploy\n");
   if (!facts.hasAccount) {
@@ -601,10 +645,14 @@ async function cmdDeploy(cwd, flags, rest) {
     }
   }
 
-  // 2) Migrations.
-  out(`\n▸ wrangler d1 migrations apply DB ${remoteArgs.join(" ")}`.trimEnd());
-  if (runInherit(["d1", "migrations", "apply", "DB", ...remoteArgs]).status !== 0)
-    fail("Migrations failed.");
+  // 2) Migrations, unless another app owns this database's schema.
+  if (!migrate) {
+    out(`\n${ASTROID_SKIP_MIGRATIONS_NOTE}`);
+  } else {
+    out(`\n▸ wrangler d1 migrations apply DB ${remoteArgs.join(" ")}`.trimEnd());
+    if (runInherit(["d1", "migrations", "apply", "DB", ...remoteArgs]).status !== 0)
+      fail("Migrations failed.");
+  }
 
   // 3) Secrets (interactive; wrangler prompts for the value).
   out("\n▸ wrangler secret put SESSION_SECRET");
@@ -656,7 +704,7 @@ Usage:
   astroid generate [--config <path>] [--cwd <dir>]   regenerate src/schema.ts, src/worker.ts, src/middleware.ts
   astroid doctor   [--config <path>] [--cwd <dir>]   validate config, bindings, and generated-file freshness
   astroid dev      [...astro args]                   regenerate, then run \`astro dev\`
-  astroid build    [...astro args]                   regenerate, then run \`astro build\`
+  astroid build    [...astro args]                   regenerate, run \`astro build\`, then drop legacy_env from its Wrangler config
   astroid deploy   [--dry-run] [--yes] [--local]     provision bindings + migrate + secrets + deploy
   astroid ship     production | preview              migrate D1, then deploy or preview (Workers Builds runs this)
   astroid provision [--dry-run] [--yes]              create the resources wrangler.jsonc names by placeholder, staging included
@@ -667,17 +715,42 @@ New project:  pnpm create astroid@latest
 // `astroid provision` creates what `wrangler.jsonc` still names by placeholder,
 // top level and `previews` alike, and writes each new ID back in place of its
 // placeholder. It never deploys, so it's safe to run before a site's first
-// release, and re-running it only creates what's still missing. Secrets and
-// dashboard settings need a person, so it prints those instead.
+// release, and re-running it only creates what's still missing. It creates the
+// staging secrets that need no person (a random SESSION_SECRET and Turnstile's
+// test secret), skipping any the store already has. Every other secret, and
+// dashboard settings, need a person, so it prints those instead.
+//
+// Every wrangler call runs in the site's directory, so wrangler reads the same
+// `wrangler.jsonc` for each and picks the same account: its `account_id`, which
+// wrangler prefers to CLOUDFLARE_ACCOUNT_ID.
 async function cmdProvision(cwd, rest) {
   const dryRun = rest.includes("--dry-run");
   const assumeYes = rest.includes("--yes") || rest.includes("-y");
   const wranglerPath = join(cwd, "wrangler.jsonc");
   if (!existsSync(wranglerPath)) fail("wrangler.jsonc not found — run inside an Astroid project.");
 
-  const { provisionPlan, applyProvisionedId } = await import(GENERATORS_URL);
+  const {
+    provisionPlan,
+    applyProvisionedId,
+    stagingSecretSteps,
+    secretNamesFromList,
+    TURNSTILE_TEST_SECRET,
+  } = await import(GENERATORS_URL);
   let text = readFileSync(wranglerPath, "utf8");
   const plan = provisionPlan(text);
+  const wranglerBin = resolveBin(cwd, "wrangler", "wrangler");
+
+  // Which staging secrets already exist, per store, so a re-run creates nothing
+  // twice. Listing is read-only, so a dry run does it too.
+  const existing = new Map();
+  if (wranglerBin) {
+    for (const storeId of new Set(plan.secrets.filter((s) => s.create).map((s) => s.storeId))) {
+      const names = listStoreSecrets(wranglerBin, cwd, storeId, secretNamesFromList);
+      if (names) existing.set(storeId, names);
+    }
+  }
+  const secretSteps = stagingSecretSteps(plan.secrets, existing);
+  const toCreate = secretSteps.filter((s) => s.status === "create");
 
   out("astroid provision — plan:\n");
   if (plan.steps.length === 0) out("  (nothing to create: every binding has an ID)");
@@ -685,15 +758,42 @@ async function cmdProvision(cwd, rest) {
     const note = s.kind === "r2" ? "   (an existing bucket is fine)" : "";
     out(`  wrangler ${s.args.join(" ")}${note}`);
   }
-  if (!plan.hasAccount && !process.env.CLOUDFLARE_ACCOUNT_ID) {
+  const envAccount = process.env.CLOUDFLARE_ACCOUNT_ID;
+  if (!plan.hasAccount && !envAccount) {
     out(
       "\n  ! No account_id in wrangler.jsonc and no CLOUDFLARE_ACCOUNT_ID, so wrangler picks one.",
     );
+  } else if (plan.accountId && envAccount && envAccount !== plan.accountId) {
+    out(
+      `\n  ! wrangler.jsonc's account_id (${plan.accountId}) wins over ` +
+        `CLOUDFLARE_ACCOUNT_ID (${envAccount}), so provision uses ${plan.accountId}.`,
+    );
   }
-  const printSecrets = () => {
-    if (plan.secrets.length === 0) return;
+  if (secretSteps.length > 0) {
+    out("\nStaging secrets it creates itself:");
+    for (const { secret, status } of secretSteps) {
+      const what =
+        status === "create"
+          ? `will create, with ${secret.create === "random" ? "a new random value" : "Turnstile's always-passes test secret"}`
+          : status === "exists"
+            ? "exists, so it's left alone"
+            : wranglerBin
+              ? "couldn't list the store, so it's left for you"
+              : "can't check without wrangler, so it's left for you";
+      out(`  [staging] ${secret.secretName} in store ${secret.storeId}: ${what}`);
+    }
+  }
+  // The secrets a person still sets: every one provision doesn't create, and
+  // any it meant to but couldn't.
+  const printSecrets = (failed = []) => {
+    const byHand = [
+      ...plan.secrets.filter((s) => !s.create),
+      ...secretSteps.filter((s) => s.status === "unknown").map((s) => s.secret),
+      ...failed,
+    ];
+    if (byHand.length === 0) return;
     out("\nSecrets Store secrets it binds; create any that don't exist yet:");
-    for (const s of plan.secrets) {
+    for (const s of byHand) {
       out(
         `  [${s.environment}] wrangler secrets-store secret create ${s.storeId} ` +
           `--name ${s.secretName} --scopes workers --remote`,
@@ -706,7 +806,7 @@ async function cmdProvision(cwd, rest) {
     out("\n(dry run — nothing created)");
     return;
   }
-  if (plan.steps.length > 0 && !assumeYes) {
+  if ((plan.steps.length > 0 || toCreate.length > 0) && !assumeYes) {
     if (!process.stdin.isTTY)
       fail("Refusing to create resources non-interactively. Re-run with --yes.");
     const rl = createInterface({ input: process.stdin, output: process.stdout });
@@ -718,7 +818,6 @@ async function cmdProvision(cwd, rest) {
     }
   }
 
-  const wranglerBin = resolveBin(cwd, "wrangler", "wrangler");
   if (!wranglerBin) fail("Could not find `wrangler` in this project.");
   for (const s of plan.steps) {
     out(`\n▸ wrangler ${s.args.join(" ")}`);
@@ -745,83 +844,123 @@ async function cmdProvision(cwd, rest) {
     writeFileSync(wranglerPath, text);
     out(`  ↳ ${s.name} = ${id}`);
   }
-  printSecrets();
+
+  // The value goes to wrangler as an argument of a direct spawn, never through
+  // a shell, and is never printed: wrangler shows it as REDACTED.
+  const failed = [];
+  for (const { secret } of toCreate) {
+    const args = [
+      "secrets-store",
+      "secret",
+      "create",
+      secret.storeId,
+      "--name",
+      secret.secretName,
+      "--scopes",
+      "workers",
+      "--remote",
+    ];
+    out(`\n▸ wrangler ${args.join(" ")} --value <${secret.create}>`);
+    const value =
+      secret.create === "random" ? randomBytes(48).toString("base64") : TURNSTILE_TEST_SECRET;
+    const res = spawnSync(process.execPath, [wranglerBin, ...args, "--value", value], {
+      cwd,
+      stdio: "inherit",
+    });
+    if (res.status !== 0) failed.push(secret);
+  }
+
+  printSecrets(failed);
+  const unlisted = [
+    ...new Set(secretSteps.filter((s) => s.status === "unknown").map((s) => s.secret.storeId)),
+  ];
+  if (unlisted.length > 0 || failed.length > 0) {
+    if (unlisted.length > 0) {
+      out(
+        `\n✘ Couldn't list Secrets Store ${unlisted.join(", ")}, so its staging secrets ` +
+          "weren't created. Check that the store is in this account, then re-run.",
+      );
+    }
+    if (failed.length > 0) {
+      out(`\n✘ Couldn't create ${failed.map((s) => s.secretName).join(", ")}. Re-run to retry.`);
+    }
+    process.exitCode = 1;
+    return;
+  }
   out("\n✓ Provisioned. Commit wrangler.jsonc; the dashboard steps are in the site's RUNBOOK.");
 }
 
+/**
+ * The secret names in a Secrets Store, or null when it can't be listed. Wrangler
+ * prints a table, a page at a time, and fails on a page with no secrets, which
+ * is how an empty store, or the page after the last one, reads.
+ */
+function listStoreSecrets(wranglerBin, cwd, storeId, secretNamesFromList) {
+  const PER_PAGE = 100; // The API's maximum.
+  const names = new Set();
+  for (let page = 1; page <= 50; page++) {
+    const res = spawnSync(
+      process.execPath,
+      [
+        wranglerBin,
+        ...["secrets-store", "secret", "list", storeId, "--remote"],
+        ...["--per-page", String(PER_PAGE), "--page", String(page)],
+      ],
+      { cwd, encoding: "utf8", stdio: ["ignore", "pipe", "pipe"] },
+    );
+    if (res.status !== 0) {
+      return `${res.stdout}${res.stderr}`.includes("returned no secrets") ? names : null;
+    }
+    const found = secretNamesFromList(res.stdout);
+    const before = names.size;
+    for (const name of found) names.add(name);
+    if (found.length < PER_PAGE || names.size === before) break;
+  }
+  return names;
+}
+
 // `astroid ship` is what Workers Builds runs, so the deploy logic lives in the
 // repository instead of a dashboard field. An account move once rewrote a
 // site's dashboard deploy command to a bare `wrangler deploy`, and migrations
-// silently stopped. Migrations run first, so new code never meets an old schema.
+// silently stopped. Migrations run first, so new code never meets an old schema,
+// unless `deploy.migrations` is false because another app owns the database.
 //
 //   astroid ship production   the deploy/production build: migrate D1, then deploy
 //   astroid ship preview      every other branch: migrate the staging D1, then
 //                             `wrangler preview`, named for the branch
-async function cmdShip(cwd, target) {
+async function cmdShip(cwd, target, flags) {
   if (target !== "production" && target !== "preview") {
     fail("Usage: astroid ship production | preview");
   }
   const wranglerBin = resolveBin(cwd, "wrangler", "wrangler");
   if (!wranglerBin) fail("Could not find `wrangler` in this project.");
-  const run = (args) => {
-    out(`\n▸ wrangler ${args.join(" ")}`);
-    const res = spawnSync(process.execPath, [wranglerBin, ...args], { cwd, stdio: "inherit" });
-    if (res.status !== 0) process.exit(res.status ?? 1);
-  };
   const wranglerPath = join(cwd, "wrangler.jsonc");
   if (!existsSync(wranglerPath)) fail("wrangler.jsonc not found — run inside an Astroid project.");
 
-  if (target === "production") {
-    run(["d1", "migrations", "apply", "DB", "--remote"]);
-    run(["deploy"]);
-    return;
+  // The plan is pure and tested in src/project/ship.ts; this only runs it.
+  const { astroidShipPlan } = await import(GENERATORS_URL);
+  const { config } = await loadConfig(cwd, flags.config);
+  const steps = astroidShipPlan(target, config, {
+    wrangler: readFileSync(wranglerPath, "utf8"),
+    root: cwd,
+    branch: process.env.WORKERS_CI_BRANCH,
+  });
+  for (const step of steps) {
+    if (step.note) {
+      out(`\n${step.note}`);
+    } else if (step.write) {
+      const abs = join(cwd, step.write.path);
+      mkdirSync(dirname(abs), { recursive: true });
+      writeFileSync(abs, step.write.contents);
+    } else {
+      out(`\n▸ wrangler ${step.run.join(" ")}`);
+      const res = spawnSync(process.execPath, [wranglerBin, ...step.run], {
+        cwd,
+        stdio: "inherit",
+      });
+      if (res.status !== 0) process.exit(res.status ?? 1);
+    }
   }
-
-  // The staging database is declared only inside `previews`, and wrangler's
-  // migrations command reads top-level `d1_databases`. So write a throwaway
-  // config naming it, derived from wrangler.jsonc on every run, rather than a
-  // second committed file that could drift from the binding.
-  const { parseJsonc } = await import(GENERATORS_URL);
-  const config = parseJsonc(readFileSync(wranglerPath, "utf8"));
-  const prodDb = (config.d1_databases ?? []).find((d) => d.binding === "DB");
-  const stagingDb = (config.previews?.d1_databases ?? []).find((d) => d.binding === "DB");
-  if (stagingDb && prodDb) {
-    const migrationsDir = resolve(cwd, prodDb.migrations_dir ?? "migrations");
-    const tmp = join(cwd, ".wrangler", "astroid-preview-migrations.jsonc");
-    mkdirSync(dirname(tmp), { recursive: true });
-    writeFileSync(
-      tmp,
-      JSON.stringify(
-        {
-          d1_databases: [
-            {
-              binding: "PREVIEW_DB",
-              database_name: stagingDb.database_name,
-              database_id: stagingDb.database_id,
-              migrations_dir: migrationsDir,
-            },
-          ],
-        },
-        null,
-        2,
-      ),
-    );
-    run(["d1", "migrations", "apply", "PREVIEW_DB", "--remote", "--config", tmp]);
-  } else {
-    out("\n(no staging D1 in `previews`, so no staging migrations to apply)");
-  }
-
-  // Workers Builds names the branch in WORKERS_CI_BRANCH; a Preview name is a
-  // DNS label, so a branch like feature/12-login becomes feature-12-login.
-  const branch = process.env.WORKERS_CI_BRANCH;
-  const name = branch
-    ? branch
-        .toLowerCase()
-        .replace(/[^a-z0-9-]+/g, "-")
-        .replace(/^-+|-+$/g, "")
-        .slice(0, 63)
-    : undefined;
-  run(["preview", ...(name ? ["--name", name] : [])]);
 }
 
 async function main() {
@@ -846,7 +985,7 @@ async function main() {
       await cmdDeploy(cwd, flags, rest);
       break;
     case "ship":
-      await cmdShip(cwd, rest[0]);
+      await cmdShip(cwd, rest[0], flags);
       break;
     case "provision":
       await cmdProvision(cwd, rest);

package/dist/auth/index.js

@@ -50,10 +50,10 @@ export function assertAuthIsolation(config) {
         return;
     if (!portal.cookiePrefix || portal.cookiePrefix === ASTROID_EDITOR_COOKIE_PREFIX) {
         throw new AstroidConfigError(`portal.cookiePrefix must be set and distinct from the editor's (${JSON.stringify(ASTROID_EDITOR_COOKIE_PREFIX)}). Two instances sharing a cookie prefix silently sign you out of one when ` +
-            'you sign into the other. Pick a project-specific prefix (e.g. "acme_shop").');
+            'you sign into the other. Pick a project-specific prefix (for example, "acme_shop").');
     }
     if (portal.tablePrefix === ASTROID_EDITOR_TABLE_PREFIX) {
-        throw new AstroidConfigError(`portal.tablePrefix must differ from the editor's (${JSON.stringify(ASTROID_EDITOR_TABLE_PREFIX)}) — a shared table prefix merges the two instances into one user table. ` +
+        throw new AstroidConfigError(`portal.tablePrefix must differ from the editor's (${JSON.stringify(ASTROID_EDITOR_TABLE_PREFIX)}): a shared table prefix merges the two instances into one user table. ` +
             "Leave it unset (the unprefixed `user`/`session` tables) or use a distinct prefix.");
     }
 }

package/dist/commerce/roles.js

@@ -109,7 +109,7 @@ export function assertCommerceRoles(commerce) {
                 invoicing: "invoicing",
                 pos: "locations/inventory",
             }[role];
-            throw new AstroidConfigError(`commerce: ${provider} can't serve the "${role}" role — its louise-toolkit client has no ${missing} API. Providers that can: ${able.join(", ")}.`);
+            throw new AstroidConfigError(`commerce: ${provider} can't serve the "${role}" role, because its louise-toolkit client has no ${missing} API. Providers that can: ${able.join(", ")}.`);
         }
     };
     // The shorthand assigns itself to a role it can serve, so it only has to be a

package/dist/commerce/sync.js

@@ -145,7 +145,8 @@ export async function astroidCatalogSync(items, options) {
         }
     }
     if (items.length > 0 && result.failed === items.length) {
-        throw new AstroidUsageError(`Catalog sync failed for all ${items.length} item(s) — nothing was written. ` +
+        const scope = items.length === 1 ? "the only item" : `all ${items.length} items`;
+        throw new AstroidUsageError(`Catalog sync failed for ${scope}, so nothing was written. ` +
             `First error: ${result.errors[0]?.message ?? "unknown"}. ` +
             "This is usually an unapplied migration (the catalog table doesn't exist yet) " +
             "or an unavailable D1 binding.");

package/dist/config.d.ts

@@ -207,6 +207,12 @@ export interface QueuesConfig {
     cron?: string | false;
     /** Deliveries before Cloudflare routes a message to the DLQ. Default 5. */
     maxRetries?: number;
+    /**
+     * Seconds Cloudflare waits before redelivering a failed message. Default
+     * 30. The queue owns retries, so keep a handler's own client retries off
+     * rather than stacking them on top of these.
+     */
+    retryDelay?: number;
     /** Messages per consumer invocation. Default 10. */
     maxBatchSize?: number;
     /** Seconds the consumer waits to fill a batch. Default 30. */
@@ -451,11 +457,29 @@ export interface PagesConfig {
      */
     hooks?: boolean;
 }
+export interface StatusConfig {
+    /**
+     * Add the site's own checks to the public status route, from the
+     * scaffold-once `src/status-checks.ts`: for example, the catalog snapshot's
+     * age, or the last health scan's. The generated worker spreads them after
+     * Astroid's own `d1` and `content` checks.
+     */
+    checks?: boolean;
+}
 export interface DeployConfig {
     platform: "cloudflare";
     /** Media base for R2 + `cf-image` resizing—matches Louise's media route
      *  (`media.<brand>/cdn-cgi/image`). Default `"/media"`. */
     mediaBase?: string;
+    /**
+     * Whether `astroid ship` applies D1 migrations before it deploys. Default
+     * `true`. Set `false` for an app whose database another app migrates, such
+     * as a second Worker in the same repository that binds the first one's D1.
+     * One app owns a database's schema. When both migrate, one release tag runs
+     * two `wrangler d1 migrations apply` at once against one ledger, and a
+     * non-idempotent statement fails the second deploy.
+     */
+    migrations?: boolean;
 }
 export interface AstroidConfig {
     /**
@@ -531,6 +555,8 @@ export interface AstroidConfig {
     media?: MediaConfig;
     /** The editable `pages` collection's site-owned write hooks. */
     pages?: PagesConfig;
+    /** The public status route's site-owned checks. */
+    status?: StatusConfig;
     /**
      * Force the contact form + `inquiries` table on or off. Omit to detect from
      * the config (a `contact` section, or a wholesale-inquiry module). Set `true`

package/dist/config.js

@@ -102,7 +102,7 @@ function assertCrons(config) {
         }
         const owner = seen.get(expression);
         if (owner) {
-            throw new AstroidConfigError(`Duplicate cron \`${expression}\` — it already belongs to ${owner}. One \`scheduled\` ` +
+            throw new AstroidConfigError(`Duplicate cron \`${expression}\`: it already belongs to ${owner}. One \`scheduled\` ` +
                 "handler dispatches on the expression, so the first branch wins and this one would " +
                 "never run. Use a different minute.");
         }
@@ -123,10 +123,10 @@ function assertTenancy(config) {
         return;
     const pattern = tenancy.hostPattern?.trim();
     if (!pattern) {
-        throw new AstroidConfigError('`tenancy.hostPattern` is required, e.g. `"*.example.com"`');
+        throw new AstroidConfigError('`tenancy.hostPattern` is required: a wildcard such as `"*.example.com"`');
     }
     if (!pattern.startsWith("*.")) {
-        throw new AstroidConfigError(`\`tenancy.hostPattern\` must be a wildcard starting with "*." — got "${pattern}". ` +
+        throw new AstroidConfigError(`\`tenancy.hostPattern\` must be a wildcard starting with "*.", but it's "${pattern}". ` +
             "A fixed host is a custom domain: put it in `hosts` instead.");
     }
     const apex = pattern.slice(2);
@@ -145,17 +145,17 @@ function assertTenancy(config) {
     // that renders the wrong page, with nothing pointing back at the config.
     for (const [label, prefix] of Object.entries(tenancy.apps ?? {})) {
         if (!label || label.includes(".")) {
-            throw new AstroidConfigError(`\`tenancy.apps\` label "${label}" must be a single subdomain label — ` +
-                "Cloudflare's wildcard matches one level.");
+            throw new AstroidConfigError(`\`tenancy.apps\` label "${label}" must be a single subdomain label, ` +
+                "because Cloudflare's wildcard matches one level.");
         }
         if ((tenancy.reserved ?? []).includes(label)) {
             throw new AstroidConfigError(`"${label}" is in both \`tenancy.apps\` and \`tenancy.reserved\`. ` +
-                "An app label is implicitly reserved — keep it in `apps` only, or the " +
+                "An app label is implicitly reserved, so keep it in `apps` only, or the " +
                 "two lists drift and `reserved` silently wins.");
         }
         if (!prefix.startsWith("/") || prefix === "/" || prefix.endsWith("/")) {
             throw new AstroidConfigError(`\`tenancy.apps.${label}\` must be an internal path prefix like "/studio" ` +
-                `(leading slash, no trailing slash, not "/") — got "${prefix}". ` +
+                `(leading slash, no trailing slash, not "/"), but it's "${prefix}". ` +
                 'The rewrite is `prefix + pathname`, so "/" or a trailing slash produces "//…".');
         }
     }
@@ -212,9 +212,9 @@ export function defineAstroid(config) {
     assertCrons(config);
     assertTenancy(config);
     if (config.portal?.gated) {
-        throw new AstroidConfigError("`portal.gated` is not implemented — it is accepted but wires no guard, so the site " +
+        throw new AstroidConfigError("`portal.gated` is not implemented: it is accepted but wires no guard, so the site " +
             "would be fully public while appearing gated. Remove it, and gate the whole site by " +
-            'listing the prefixes you mean in `portal.routes` (e.g. `[{ prefix: "/" }]` with your ' +
+            'listing the prefixes you mean in `portal.routes` (for example, `[{ prefix: "/" }]` with your ' +
             "login and auth paths ahead of it).");
     }
     return config;

package/dist/project/build-output.d.ts

@@ -0,0 +1,18 @@
+/** Where `@astrojs/cloudflare` writes the built config when there's no redirect. */
+export declare const ASTROID_BUILT_WRANGLER_CONFIG = "dist/server/wrangler.json";
+/** The redirect file Wrangler reads to find the built config. */
+export declare const WRANGLER_DEPLOY_REDIRECT = ".wrangler/deploy/config.json";
+/**
+ * The built config's path, relative to the project root, found the way
+ * Wrangler finds it: the `configPath` in `.wrangler/deploy/config.json`, which
+ * is relative to that file's own folder, else {@link ASTROID_BUILT_WRANGLER_CONFIG}.
+ * Pass the redirect's text, or `null` when there isn't one.
+ */
+export declare function builtWranglerConfigPath(redirect: string | null): string;
+/**
+ * Remove `legacy_env` from a built Wrangler config. Returns the new text, or
+ * `null` when the field isn't there, so the caller leaves the file untouched.
+ * Keeps the file's indentation and every other key in its order. Throws when
+ * the text isn't a JSON object.
+ */
+export declare function stripLegacyEnv(text: string): string | null;