astroidjs 0.16.0 → 0.18.0

package/dist/project/ship.js

@@ -0,0 +1,115 @@
+// Copyright (c) 2026 BowenLabs. Astroid is MIT licensed.
+//
+// What `astroid ship` runs, as a plan: Workers Builds calls
+// `astroid ship production` on the `deploy/production` build and
+// `astroid ship preview` on every other branch.
+//
+// By default both targets apply D1 migrations first. An app whose database
+// another app migrates sets `deploy.migrations: false`, and then neither target
+// touches the migrations ledger. Two apps on one database that both migrated
+// would race: one release tag deploys both Workers in no guaranteed order,
+// nothing serializes two `wrangler d1 migrations apply` runs, and a
+// non-idempotent statement such as `ALTER TABLE … ADD COLUMN` then fails the
+// second deploy.
+//
+// Pure: config and wrangler.jsonc text in, steps out, so it's tested directly
+// and the CLI only runs them.
+import { parseJsonc } from "./previews.js";
+/** Whether this app applies D1 migrations when it deploys. Default `true`. */
+export function astroidRunsMigrations(config) {
+    return config.deploy?.migrations !== false;
+}
+/** Where `ship preview` writes the config that names the staging database. */
+export const ASTROID_PREVIEW_MIGRATIONS_CONFIG = ".wrangler/astroid-preview-migrations.jsonc";
+/** Printed in place of the migrations step when `deploy.migrations` is `false`. */
+export const ASTROID_SKIP_MIGRATIONS_NOTE = "(deploy.migrations is false, so this app applies no migrations: another app owns this database's schema)";
+/** The steps `astroid ship <target>` runs for a project. */
+export function astroidShipPlan(target, config, { wrangler, root, branch }) {
+    const migrate = astroidRunsMigrations(config);
+    if (target === "production") {
+        return [
+            migrate
+                ? { run: ["d1", "migrations", "apply", "DB", "--remote"] }
+                : { note: ASTROID_SKIP_MIGRATIONS_NOTE },
+            { run: ["deploy"] },
+        ];
+    }
+    const steps = [];
+    if (!migrate) {
+        steps.push({ note: ASTROID_SKIP_MIGRATIONS_NOTE });
+    }
+    else {
+        // The staging database is declared only inside `previews`, and wrangler's
+        // migrations command reads top-level `d1_databases`. So write a throwaway
+        // config naming it, derived from wrangler.jsonc on every run, rather than a
+        // second committed file that could drift from the binding.
+        const parsed = parseJsonc(wrangler);
+        const prodDb = (parsed.d1_databases ?? []).find((d) => d.binding === "DB");
+        const stagingDb = (parsed.previews?.d1_databases ?? []).find((d) => d.binding === "DB");
+        if (stagingDb && prodDb) {
+            steps.push({
+                write: {
+                    path: ASTROID_PREVIEW_MIGRATIONS_CONFIG,
+                    contents: JSON.stringify({
+                        d1_databases: [
+                            {
+                                binding: "PREVIEW_DB",
+                                database_name: stagingDb.database_name,
+                                database_id: stagingDb.database_id,
+                                // Absolute, so it doesn't depend on how Wrangler resolves a
+                                // relative path in a config that lives in `.wrangler/`.
+                                migrations_dir: fromRoot(root, prodDb.migrations_dir ?? "migrations"),
+                            },
+                        ],
+                    }, null, 2),
+                },
+            }, {
+                run: [
+                    "d1",
+                    "migrations",
+                    "apply",
+                    "PREVIEW_DB",
+                    "--remote",
+                    "--config",
+                    ASTROID_PREVIEW_MIGRATIONS_CONFIG,
+                ],
+            });
+        }
+        else {
+            steps.push({ note: "(no staging D1 in `previews`, so no staging migrations to apply)" });
+        }
+    }
+    // Workers Builds names the branch in WORKERS_CI_BRANCH; a Preview name is a
+    // DNS label, so a branch like feature/12-login becomes feature-12-login.
+    const name = branch
+        ? branch
+            .toLowerCase()
+            .replace(/[^a-z0-9-]+/g, "-")
+            .replace(/^-+|-+$/g, "")
+            .slice(0, 63)
+        : undefined;
+    steps.push({ run: ["preview", ...(name ? ["--name", name] : [])] });
+    return steps;
+}
+/** A project-relative path made absolute. An absolute one is kept. */
+function fromRoot(root, path) {
+    if (path.startsWith("/"))
+        return path;
+    const relative = path.replace(/^\.\//, "").replace(/\/+$/, "");
+    return `${root.replace(/\/+$/, "")}/${relative}`;
+}
+/**
+ * `astroid doctor`'s check on who migrates this app's database. Returns an
+ * error when `deploy.migrations` is `false` but `wrangler.jsonc` still names a
+ * `migrations_dir` for `DB`, since that contradiction means someone expects
+ * this app to migrate. `null` when there's nothing to report.
+ */
+export function migrationsOwnershipError(config, wrangler) {
+    if (astroidRunsMigrations(config))
+        return null;
+    if (!/"migrations_dir"\s*:/.test(wrangler))
+        return null;
+    return ("astroid.config sets deploy.migrations to false, but wrangler.jsonc still declares a " +
+        "`migrations_dir`. Remove `migrations_dir` if another app owns this database's schema, " +
+        "or drop `migrations: false` if this app does.");
+}

package/dist/queues/index.d.ts

@@ -1,4 +1,4 @@
 export { astroidQueueHandler, type QueueHandlerOptions } from "./consumer.js";
-export { affectsCatalog, ASTROID_DEFAULT_CRON, ASTROID_HEALTH_CRON, ASTROID_QUEUE_BINDING, type AstroidQueueMessage, astroidCron, astroidCrons, astroidQueueNames, astroidUsesQueues, type CatalogRefreshMessage, type WebhookMessage, } from "./messages.js";
+export { affectsCatalog, ASTROID_DEFAULT_CRON, ASTROID_HEALTH_CRON, ASTROID_QUEUE_BINDING, ASTROID_QUEUE_RETRY_DELAY, type AstroidQueueMessage, astroidCron, astroidCrons, astroidQueueNames, astroidUsesQueues, type CatalogRefreshMessage, type WebhookMessage, } from "./messages.js";
 export { generateAstroidEnvBindings, generateAstroidQueueSeam, generateAstroidWebhookRoute, generateAstroidWebhookRoutes, } from "./scaffold.js";
-export { handleWebhook, type QueueProducer, type WebhookRouteOptions, type WebhookVerifyInput, } from "./webhook.js";
+export { astroidQueue, handleWebhook, type QueueProducer, type WebhookRouteOptions, type WebhookVerifyInput, } from "./webhook.js";

package/dist/queues/index.js

@@ -1,5 +1,5 @@
 // Copyright (c) 2026 BowenLabs. Astroid is MIT licensed.
 export { astroidQueueHandler } from "./consumer.js";
-export { affectsCatalog, ASTROID_DEFAULT_CRON, ASTROID_HEALTH_CRON, ASTROID_QUEUE_BINDING, astroidCron, astroidCrons, astroidQueueNames, astroidUsesQueues, } from "./messages.js";
+export { affectsCatalog, ASTROID_DEFAULT_CRON, ASTROID_HEALTH_CRON, ASTROID_QUEUE_BINDING, ASTROID_QUEUE_RETRY_DELAY, astroidCron, astroidCrons, astroidQueueNames, astroidUsesQueues, } from "./messages.js";
 export { generateAstroidEnvBindings, generateAstroidQueueSeam, generateAstroidWebhookRoute, generateAstroidWebhookRoutes, } from "./scaffold.js";
-export { handleWebhook, } from "./webhook.js";
+export { astroidQueue, handleWebhook, } from "./webhook.js";

package/dist/queues/messages.d.ts

@@ -31,6 +31,12 @@ export declare const ASTROID_HEALTH_CRON = "17 4 * * *";
 export declare function astroidCrons(config: AstroidConfig): string[];
 /** Binding name for the project's queue producer. */
 export declare const ASTROID_QUEUE_BINDING = "COMMERCE_QUEUE";
+/**
+ * Seconds Cloudflare waits before redelivering a failed message, when the
+ * config sets no `queues.retryDelay`. A consumer that sets its own delay per
+ * message, as `processBatch` can, overrides it.
+ */
+export declare const ASTROID_QUEUE_RETRY_DELAY = 30;
 /** Queue names derived from the project key—the main queue and its DLQ. */
 export declare function astroidQueueNames(config: AstroidConfig): {
     queue: string;

package/dist/queues/messages.js

@@ -52,6 +52,12 @@ export function astroidCrons(config) {
 }
 /** Binding name for the project's queue producer. */
 export const ASTROID_QUEUE_BINDING = "COMMERCE_QUEUE";
+/**
+ * Seconds Cloudflare waits before redelivering a failed message, when the
+ * config sets no `queues.retryDelay`. A consumer that sets its own delay per
+ * message, as `processBatch` can, overrides it.
+ */
+export const ASTROID_QUEUE_RETRY_DELAY = 30;
 /** Queue names derived from the project key—the main queue and its DLQ. */
 export function astroidQueueNames(config) {
     return { queue: `${config.key}-commerce`, dlq: `${config.key}-commerce-dlq` };

package/dist/queues/scaffold.js

@@ -105,9 +105,20 @@ export function generateAstroidQueueSeam(config) {
         "// MEANS for this project.",
         "//",
         "// Throwing marks the message for retry. That's usually right—a failed",
-        "// refresh means the site is serving stale data—and Cloudflare routes it to",
-        "// the DLQ once it exceeds max_retries (wrangler.jsonc).",
-        'import { astroidQueueHandler, type AstroidQueueMessage } from "astroidjs";',
+        "// refresh means the site is serving stale data—and the queue owns the",
+        "// retries: it waits `retry_delay` between deliveries and routes the message",
+        "// to the DLQ once it exceeds max_retries (wrangler.jsonc).",
+        'import { astroidQueue, astroidQueueHandler, type AstroidQueueMessage } from "astroidjs";',
+        "",
+        `// Send every message through this, never \`env.${ASTROID_QUEUE_BINDING}\` directly: the`,
+        "// queue binding when there is one, otherwise `handleQueueMessage` run in the",
+        "// request. A staging Preview has no queue, because a consumer can't target a",
+        "// Preview, so a producer that sends straight to the binding throws there.",
+        "// The inline path outlasts nothing but the request, with no retry and no",
+        "// DLQ, so it's a Preview fallback, not a production path.",
+        "export function commerceQueue(env: CloudflareEnv) {",
+        `  return astroidQueue(env.${ASTROID_QUEUE_BINDING}, (message) => handleQueueMessage(env, message));`,
+        "}",
         "",
         "export async function handleQueueMessage(",
         "  env: CloudflareEnv,",
@@ -135,20 +146,22 @@ export function generateAstroidQueueSeam(config) {
         `      //   const r = await astroidCatalogSync(items, { db: env.DB, table: ${JSON.stringify(table)} });`,
         '      //   if (r.failed > 0) console.warn("[catalog] skipped", r.failed, r.errors);',
         "      //",
-        // Nobody is watching a queue message, which flips the retry trade-off that
-        // an attended checkout route settles the other way.
+        // One layer owns retries, and it's the queue: it survives the isolate,
+        // waits between deliveries, and ends in the DLQ. Retries inside the handler
+        // multiply with the queue's (#61).
         ...(provider === "square"
             ? [
-                "      // Nobody is watching this run, so let the client retry: SquareConfig",
-                "      // takes `retry: { attempts: 3 }`, backing off on 429/5xx inside every",
-                "      // verb. It is off by default because a checkout route has a customer",
-                "      // watching a spinner, and there a fast failure beats a slow one. Here",
-                "      // the opposite holds—a catalog push that gives up halfway is worse.",
+                "      // Leave SquareConfig's `retry` off here. The queue already redelivers",
+                "      // a failed message, `retry_delay` apart, up to max_retries times",
+                "      // (wrangler.jsonc). Client retries multiply with those deliveries:",
+                "      // `retry: { attempts: 3 }` on a queue with max_retries 5 is up to 24",
+                "      // Square calls for one message, against a provider that's already",
+                "      // failing or rate limiting.",
             ]
             : [
-                "      // Nobody is watching this run, so ask for backoff on 429/5xx wherever",
-                "      // the client offers it. Attended paths are better off failing fast; a",
-                "      // catalog push that gives up halfway is not.",
+                "      // Leave the client's own retries off here. The queue already",
+                "      // redelivers a failed message, `retry_delay` apart, up to max_retries",
+                "      // times (wrangler.jsonc), and client retries multiply with those.",
             ]),
         "      //",
         "      // The sync is idempotent (keyed on the provider's id) and never",
@@ -198,12 +211,13 @@ export function generateAstroidWebhookRoute(config, forProvider) {
         "// secret land afterwards instead of being lost.",
         "//",
         "// A staging Preview has no queue, since a consumer can't target one, so",
-        "// there the event runs in the request through the same handler instead.",
+        "// `commerceQueue` runs the event in the request through the consumer's own",
+        "// handler instead (src/queue.ts).",
         'import type { APIRoute } from "astro";',
         'import { handleWebhook, readModuleSecret } from "astroidjs";',
         'import { env } from "cloudflare:workers";',
         `import { ${p.verifier} } from ${JSON.stringify(p.module)};`,
-        'import { handleQueueMessage } from "../../../queue";',
+        'import { commerceQueue } from "../../../queue";',
         "",
         "export const prerender = false;",
         "",
@@ -214,8 +228,7 @@ export function generateAstroidWebhookRoute(config, forProvider) {
         "  return handleWebhook(request, url, {",
         `    provider: ${JSON.stringify(provider)},`,
         `    secret: await readModuleSecret(env.${COMMERCE_PROVIDER_SECRETS[provider].webhook}),`,
-        `    queue: env.${ASTROID_QUEUE_BINDING},`,
-        "    inline: (message) => handleQueueMessage(env, message),",
+        "    queue: commerceQueue(env),",
         `    verify: ({ raw, secret }) => ${p.call},`,
         "  });",
         "};",

package/dist/queues/webhook.d.ts

@@ -10,6 +10,29 @@ import type { AstroidQueueMessage } from "./messages.js";
 export interface QueueProducer<T = AstroidQueueMessage> {
     send(message: T): Promise<unknown>;
 }
+/**
+ * The queue binding when it's bound, and otherwise a stand-in producer that
+ * runs `handler` on each message in the request.
+ *
+ * A staging Preview leaves the queue unbound, because a queue consumer can't
+ * target a Preview (louise-toolkit ADR 0017), so every producer that sends
+ * straight to the binding throws there. Send through this instead, with the
+ * handler the queue consumer runs, and the same code works on both:
+ *
+ * ```ts
+ * export const commerceQueue = (env: CloudflareEnv) =>
+ *   astroidQueue(env.COMMERCE_QUEUE, (message) => handleQueueMessage(env, message));
+ *
+ * await commerceQueue(env).send({ kind: "catalog_refresh" });
+ * ```
+ *
+ * It's a Preview fallback, not a production path. A message run inline lasts
+ * only as long as the request, gets no retry and no dead-letter queue, and a
+ * slow one holds the response open. The stand-in's `send` throws whatever the
+ * handler throws, where a real `send` would have succeeded and left the failure
+ * to the consumer. The binding always wins when it's there.
+ */
+export declare function astroidQueue<T = AstroidQueueMessage>(queue: QueueProducer<T> | null | undefined, handler: (message: T) => Promise<void>): QueueProducer<T>;
 export interface WebhookVerifyInput {
     /** The raw request body, exactly as received. */
     raw: string;
@@ -28,10 +51,16 @@ export interface WebhookRouteOptions {
     secret: string | null;
     /** Signature check over the raw body—for example, `verifySquareSignature`. */
     verify: (input: WebhookVerifyInput) => boolean | Promise<boolean>;
-    /** The queue binding, or null/undefined when Queues aren't provisioned. */
+    /**
+     * The queue binding, or null/undefined when Queues aren't provisioned. Pass
+     * {@link astroidQueue}'s producer to run the message in the request when the
+     * binding is absent, such as on a staging Preview.
+     */
     queue?: QueueProducer | null;
     /**
-     * Run a message in the request instead, when `queue` is absent. A staging
+     * Run a message in the request instead, when `queue` is absent. Prefer
+     * passing {@link astroidQueue}'s producer as `queue`, which covers every
+     * producer in a site rather than this one route. A staging
      * Preview leaves the queue unbound, because a queue consumer can't target a
      * Preview (louise-toolkit ADR 0017), so without this every webhook a Preview
      * receives answers 503 and the provider retries it forever.

package/dist/queues/webhook.js

@@ -14,6 +14,37 @@
 // available: a 5xx means "try again", a 4xx means "never again", and returning
 // the wrong one either loses the event permanently or pins the provider in a
 // retry loop. Each code below is chosen for what it tells the sender to do.
+/**
+ * The queue binding when it's bound, and otherwise a stand-in producer that
+ * runs `handler` on each message in the request.
+ *
+ * A staging Preview leaves the queue unbound, because a queue consumer can't
+ * target a Preview (louise-toolkit ADR 0017), so every producer that sends
+ * straight to the binding throws there. Send through this instead, with the
+ * handler the queue consumer runs, and the same code works on both:
+ *
+ * ```ts
+ * export const commerceQueue = (env: CloudflareEnv) =>
+ *   astroidQueue(env.COMMERCE_QUEUE, (message) => handleQueueMessage(env, message));
+ *
+ * await commerceQueue(env).send({ kind: "catalog_refresh" });
+ * ```
+ *
+ * It's a Preview fallback, not a production path. A message run inline lasts
+ * only as long as the request, gets no retry and no dead-letter queue, and a
+ * slow one holds the response open. The stand-in's `send` throws whatever the
+ * handler throws, where a real `send` would have succeeded and left the failure
+ * to the consumer. The binding always wins when it's there.
+ */
+export function astroidQueue(queue, handler) {
+    if (queue)
+        return queue;
+    return {
+        send: async (message) => {
+            await handler(message);
+        },
+    };
+}
 const text = (body, status) => new Response(body, { status, headers: { "content-type": "text/plain; charset=utf-8" } });
 /** Default event-type reader: a top-level `type` string. */
 function defaultEventType(payload) {

package/dist/schema/framework.d.ts

@@ -1,13 +1,14 @@
 import type { AstroidConfig } from "../config.js";
 /** A ready-made table Astroid re-exports from `louise-toolkit/db`. */
-export type AstroidFrameworkTable = "inquiries" | "media" | "siteSettings";
+export type AstroidFrameworkTable = "inquiries" | "media" | "pageRedirects" | "siteSettings";
 /** True when the site captures inquiries—a contact section or a
  *  wholesale-inquiry module. Shared by table selection (here) and route selection
  *  (the worker route plan). */
 export declare function capturesInquiries(config: AstroidConfig): boolean;
 /**
  * The framework tables this project needs, sorted alphabetically (so the emitted
- * import/export lists are stable). `media` + `siteSettings` always; `inquiries`
- * when a brand captures them.
+ * import/export lists are stable). `media`, `pageRedirects`, and `siteSettings`
+ * always; `inquiries` when a brand captures them. `pageRedirects` keeps a
+ * renamed page's old URL working, which every site with a Pages panel needs.
  */
 export declare function astroidFrameworkTables(config: AstroidConfig): AstroidFrameworkTable[];

package/dist/schema/framework.js

@@ -2,9 +2,9 @@
 //
 // Which ready-made Louise tables (louise-toolkit/db) an Astroid project needs.
 // Astroid re-exports these rather than redefining them, so the core content
-// tables never drift from Louise. `media` and `siteSettings` are universal;
-// `inquiries` is pulled in only when a brand actually captures inquiries (a
-// contact section, or a wholesale-inquiry module).
+// tables never drift from Louise. `media`, `pageRedirects`, and `siteSettings`
+// are universal; `inquiries` is pulled in only when a brand actually captures
+// inquiries (a contact section, or a wholesale-inquiry module).
 /** True when the site captures inquiries—a contact section or a
  *  wholesale-inquiry module. Shared by table selection (here) and route selection
  *  (the worker route plan). */
@@ -21,11 +21,12 @@ export function capturesInquiries(config) {
 }
 /**
  * The framework tables this project needs, sorted alphabetically (so the emitted
- * import/export lists are stable). `media` + `siteSettings` always; `inquiries`
- * when a brand captures them.
+ * import/export lists are stable). `media`, `pageRedirects`, and `siteSettings`
+ * always; `inquiries` when a brand captures them. `pageRedirects` keeps a
+ * renamed page's old URL working, which every site with a Pages panel needs.
  */
 export function astroidFrameworkTables(config) {
-    const tables = ["media", "siteSettings"];
+    const tables = ["media", "pageRedirects", "siteSettings"];
     if (capturesInquiries(config))
         tables.push("inquiries");
     return tables.sort();

package/dist/worker/gateway.d.ts

@@ -0,0 +1,12 @@
+import type { AiGatewayOptions } from "louise-toolkit/ai";
+/** The `vars` entry that names the site's AI Gateway. */
+export declare const ASTROID_AI_GATEWAY_VAR = "AI_GATEWAY_ID";
+/**
+ * The AI Gateway options for this request's environment, or `undefined` to
+ * call Workers AI directly. Reads `AI_GATEWAY_ID`: unset, empty, or the
+ * placeholder sentinel all mean off.
+ *
+ * Takes `env` as `unknown`, like the toolkit's `aiRunner`, so a site whose
+ * `CloudflareEnv` doesn't declare the variable still compiles.
+ */
+export declare function astroidAiGateway(env: unknown): AiGatewayOptions | undefined;

package/dist/worker/gateway.js

@@ -0,0 +1,32 @@
+// Copyright (c) 2026 BowenLabs. Astroid is MIT licensed.
+//
+// AI Gateway for the editor's AI assists, off until a site names one.
+//
+// Every louise-toolkit AI route takes a `gateway` option, and without one no
+// successful AI call is logged anywhere: no latency, no error rate, and no
+// cache. A gateway gives all three with no toolkit change. It's a variable,
+// not config, so production can log through one while a Preview, which sets
+// no variable, calls Workers AI directly.
+//
+// The log holds the text an editor sends to the assists. Say so on the site's
+// privacy page before you set the variable.
+import { ASTROID_SECRET_PLACEHOLDER } from "../secrets.js";
+/** The `vars` entry that names the site's AI Gateway. */
+export const ASTROID_AI_GATEWAY_VAR = "AI_GATEWAY_ID";
+/**
+ * The AI Gateway options for this request's environment, or `undefined` to
+ * call Workers AI directly. Reads `AI_GATEWAY_ID`: unset, empty, or the
+ * placeholder sentinel all mean off.
+ *
+ * Takes `env` as `unknown`, like the toolkit's `aiRunner`, so a site whose
+ * `CloudflareEnv` doesn't declare the variable still compiles.
+ */
+export function astroidAiGateway(env) {
+    const id = env?.[ASTROID_AI_GATEWAY_VAR];
+    if (typeof id !== "string")
+        return undefined;
+    const trimmed = id.trim();
+    if (!trimmed || trimmed === ASTROID_SECRET_PLACEHOLDER)
+        return undefined;
+    return { id: trimmed };
+}

package/dist/worker/generate.js

@@ -68,10 +68,14 @@ export function generateAstroidWorker(config) {
     const AI_ROUTES = new Set(["ai", "seoFix", "media"]);
     const editorImports = [
         "DEFAULT_PAGE_FIELDS",
+        "type PagesWrite",
+        "MEDIA_ALT_MISSING_SQL",
+        "d1Check",
         ...new Set(plan.map((route) => route.factory).filter((f) => !realtimeRouteFactories.has(f))),
     ].sort();
     const tables = [
         "media",
+        "pageRedirects",
         "pages",
         "pagesVersions",
         "siteSettings",
@@ -89,10 +93,13 @@ export function generateAstroidWorker(config) {
                 return `vitalsRoute({ dataset: (env) => env.${ASTROID_VITALS_BINDING} })`;
             case "health":
                 return "healthRoute({ resolveEditor, read: readSiteHealth })";
+            case "status":
+                return "statusRoute({ checks: STATUS_CHECKS, reuseMs: STATUS_REUSE_MS })";
             case "realtime":
                 return `realtimeRoute({ resolveEditor, namespace: (env) => env.${ASTROID_REALTIME_BINDING} })`;
             case "versions":
-                return "versionsRoute({ table: pages, versionsTable: pagesVersions, config: pagesCollection, resolveEditor, bufferKv: (env) => env.DRAFTS })";
+                // `redirects` records `/old → /new` when a publish changes the slug.
+                return "versionsRoute({ table: pages, versionsTable: pagesVersions, config: pagesCollection, resolveEditor, bufferKv: (env) => env.DRAFTS, redirects: pageRedirects })";
             case "search":
                 return "searchRoute({ table: pages, config: pagesCollection, resolveEditor })";
             case "pages":
@@ -104,9 +111,17 @@ export function generateAstroidWorker(config) {
                 //
                 // `versionsTable` makes a DELETE remove the page's version snapshots,
                 // which have no foreign key to the page and would otherwise orphan.
-                // `afterWrite` rebuilds the search index, which plain CRUD writes leave
-                // stale.
-                return 'pagesRoute({ table: pages, versionsTable: pagesVersions, resolveEditor, fields: [...DEFAULT_PAGE_FIELDS, "sections"], ...pagesWriteHooks, afterWrite: reindexPagesSearch })';
+                // `afterWrite` syncs the written page's search index entry, which plain
+                // CRUD writes leave stale.
+                //
+                // `drafts` carries a Pages panel update into the page's pending draft,
+                // with the same config and buffer versionsRoute uses. Without it, a
+                // rename made while a draft was pending came undone at the next
+                // publish, which copies the whole draft snapshot onto the live row.
+                //
+                // `redirects` records `/old → /new` in the same batch as a slug change,
+                // and the middleware's `redirectFor` serves it.
+                return 'pagesRoute({ table: pages, versionsTable: pagesVersions, drafts: { config: pagesCollection, bufferKv: (env) => env.DRAFTS }, redirects: pageRedirects, resolveEditor, fields: [...DEFAULT_PAGE_FIELDS, "sections"], ...pagesWriteHooks, afterWrite: reindexPagesSearch })';
             case "save":
                 // No `bufferKv` here, deliberately: `saveRoute` has no such option. It
                 // writes live field saves (title, SEO) straight through, and the draft
@@ -130,10 +145,12 @@ export function generateAstroidWorker(config) {
             // LOUISE_AI kill switch, so all three assists share one definition of
             // "is generation on?" instead of each re-deriving it. Embeddings keep
             // binding-presence as their switch—see the helper's comment.
+            // `gateway` routes both through AI Gateway when the site sets
+            // `AI_GATEWAY_ID`, and calls Workers AI directly when it doesn't.
             case "ai":
-                return "aiRoute({ resolveEditor, ai: aiRunner })";
+                return "aiRoute({ resolveEditor, ai: aiRunner, gateway: astroidAiGateway })";
             case "seoFix":
-                return "seoFixRoute({ table: pages, resolveEditor, ai: aiRunner })";
+                return "seoFixRoute({ table: pages, resolveEditor, ai: aiRunner, gateway: astroidAiGateway })";
             case "media": {
                 // `altText` fills a new upload's alt from the image itself. Best-effort
                 // by contract—a model error or a missing binding never fails the
@@ -175,7 +192,7 @@ export function generateAstroidWorker(config) {
     p('import { env } from "cloudflare:workers";');
     p('import { handle } from "@astrojs/cloudflare/handler";');
     p('import type { EditorSession } from "louise-toolkit/auth";');
-    p('import { createLocalApi } from "louise-toolkit/content";');
+    p('import { reindexDoc } from "louise-toolkit/content";');
     p(inquiries
         ? 'import { db, inquiriesForm } from "louise-toolkit/db";'
         : 'import { db } from "louise-toolkit/db";');
@@ -196,10 +213,14 @@ export function generateAstroidWorker(config) {
         p('import { aiRunner } from "louise-toolkit/ai";');
     }
     p('import { checkLinks } from "louise-toolkit/browser";');
+    p('import { reportDegraded } from "louise-toolkit/errors";');
     p('import { readHealthSummary, summarizeHealth, writeHealthSummary } from "louise-toolkit/health";');
     p('import { composeWorker, isEditRequest, type WorkerRoute, withEdgeCache } from "louise-toolkit/worker";');
     p(`import { ${tables.join(", ")} } from "./schema.js";`);
     const astroidImports = [
+        ...(plan.some((route) => route.name === "ai" || route.name === "seoFix")
+            ? ["astroidAiGateway"]
+            : []),
         "astroidPagesCollection",
         "astroidPagesWriteHooks",
         "readModuleSecret",
@@ -220,6 +241,11 @@ export function generateAstroidWorker(config) {
         p("// route. Scaffolded once and yours to edit.");
         p('import { pagesHooks } from "./pages-hooks.js";');
     }
+    if (config.status?.checks) {
+        p("// Your STATUS seam: the site's own checks for the public status route,");
+        p("// such as a catalog snapshot's age. Scaffolded once and yours to edit.");
+        p('import { statusChecks } from "./status-checks.js";');
+    }
     if (config.settings?.hooks) {
         p("// Your SETTINGS seam: per-key sanitizers and a GET transform for the");
         p("// Settings panel. Scaffolded once and yours to edit.");
@@ -251,10 +277,12 @@ export function generateAstroidWorker(config) {
         : "const pagesWriteHooks = astroidPagesWriteHooks(astroidConfig);");
     p();
     p("// pagesRoute writes with plain Drizzle, so the full-text index doesn't see a");
-    p("// title or slug change until something rebuilds it. Best-effort: pagesRoute");
-    p("// swallows a throw here, so a stale index never fails the write itself.");
-    p("async function reindexPagesSearch(editor: EditorSession): Promise<void> {");
-    p("  await createLocalApi(db(env.DB), pages, pagesCollection).reindexSearch({ session: editor });");
+    p("// title or slug change until something syncs it. This syncs only the page the");
+    p("// write touched, rather than rebuilding the whole index on every save. After a");
+    p("// delete the row is gone, and reindexDoc removes its entry. Best-effort:");
+    p("// pagesRoute swallows a throw here, so a stale index never fails the write.");
+    p("async function reindexPagesSearch(_editor: EditorSession, { id }: PagesWrite): Promise<void> {");
+    p("  await reindexDoc(db(env.DB), pages, pagesCollection, id);");
     p("}");
     p();
     p("// Editable site_settings columns the Settings panel may write, and which of");
@@ -311,7 +339,9 @@ export function generateAstroidWorker(config) {
     p("  const origin = env.SITE_URL ?? mediaBaseOf(env);");
     p("  const [brokenLinks, missingAlt, seoGaps] = await Promise.all([");
     p('    checkLinks({ base: origin, paths: ["/"] }).catch(() => []),');
-    p("    countRows(env, \"SELECT COUNT(*) AS n FROM media WHERE alt IS NULL OR alt = ''\"),");
+    p("    // Only an unwritten alt (NULL) is missing. An empty one is an image the");
+    p("    // owner marked decorative, which HTML says to skip.");
+    p("    countRows(env, `SELECT COUNT(*) AS n FROM media WHERE ${MEDIA_ALT_MISSING_SQL}`),");
     p("    countRows(");
     p("      env,");
     p("      \"SELECT COUNT(*) AS n FROM pages WHERE status = 'published'\" +");
@@ -327,6 +357,27 @@ export function generateAstroidWorker(config) {
     p("  return summary;");
     p("}");
     p();
+    p("// --- public status ---------------------------------------------------------");
+    p("// What statusRoute answers an outside probe with: 200 when every check");
+    p("// passes, 503 when any fails, throws, or takes over two seconds. Anyone can");
+    p("// make these run, so each is one cheap read, and a burst of probes reuses one");
+    p("// result per isolate for STATUS_REUSE_MS.");
+    p("const STATUS_REUSE_MS = 10_000;");
+    p("const STATUS_CHECKS = {");
+    p("  // D1 answers `SELECT 1`.");
+    p("  d1: d1Check((env: CloudflareEnv) => env.DB),");
+    p("  // The public home page reads real content, not the seed-me fallback the");
+    p("  // page renders when its row is missing (an unseeded or wiped database,");
+    p("  // or a migration that never ran, which throws and fails the check too).");
+    p("  content: async (env: CloudflareEnv) =>");
+    p(`    (await env.DB.prepare("SELECT 1 FROM pages WHERE slug = 'home'").first()) !== null,`);
+    if (config.status?.checks) {
+        p("  // The site's own, from src/status-checks.ts. Spread last, so a site");
+        p("  // check with the same name replaces Astroid's on purpose.");
+        p("  ...statusChecks,");
+    }
+    p("};");
+    p();
     p("/** One COUNT, degrading to 0—a missing table must not abort the scan. */");
     p("async function countRows(env: CloudflareEnv, sql: string): Promise<number> {");
     p("  try {");
@@ -473,7 +524,9 @@ export function generateAstroidWorker(config) {
     p(`    if (controller.cron === ${JSON.stringify(ASTROID_HEALTH_CRON)}) {`);
     p("      // Daily site-health scan. `waitUntil` because the crawl outlives the");
     p("      // handler's return, and a scan that throws must not retry the cron.");
-    p("      ctx.waitUntil(runHealthScan(env).catch(() => {}));");
+    p("      // Reported rather than swallowed: the Health panel keeps showing the");
+    p("      // last good scan, so this log line is the only sign that one failed.");
+    p('      ctx.waitUntil(runHealthScan(env).catch((error) => reportDegraded("health.scan", error)));');
     p("      return;");
     p("    }");
     if (cron) {
@@ -552,6 +605,7 @@ export function generateAstroidMiddleware(config) {
         "// styles + inlined data: brand font are allowed.",
         'import { env } from "cloudflare:workers";',
         'import { createLouiseMiddleware } from "@louise-toolkit/astro";',
+        'import { db, pageRedirects, resolvePageRedirect } from "louise-toolkit/db";',
         // One `astroidjs` import, composed from what this config actually uses—two
         // import statements for the same module is legal and reads as an
         // oversight in a file nobody is supposed to hand-edit.
@@ -609,6 +663,9 @@ export function generateAstroidMiddleware(config) {
         "  // anything the worker's routes didn't answer. A second check behind the",
         "  // worker's gate, and free: the editor is resolved here on every request.",
         "  apiGate: true,",
+        "  // A renamed page's old URL answers a 301 to the new one. It runs only after",
+        "  // the page answered 404, so a page later created on the old path wins.",
+        "  redirectFor: (path) => resolvePageRedirect(db(env.DB), pageRedirects, path),",
         // `extend` runs once and may need to populate BOTH—a tenanted site with a
         // portal resolves a tenant and a customer on the same request.
         ...(portal || tenancy

package/dist/worker/index.d.ts

@@ -1,2 +1,3 @@
 export * from "./routes.js";
 export * from "./generate.js";
+export * from "./gateway.js";

package/dist/worker/index.js

@@ -4,3 +4,4 @@
 // → the Worker entrypoint and Astro middleware a site would otherwise hand-write.
 export * from "./routes.js";
 export * from "./generate.js";
+export * from "./gateway.js";