astroidjs 0.18.0 → 0.20.0

package/dist/schema/framework.js

@@ -10,7 +10,7 @@
  *  (the worker route plan). */
 export function capturesInquiries(config) {
     // Explicit override wins—a site whose inquiry surface is a bespoke section
-    // (coracle's custom `contactForm`) can't be detected from the built-in
+    // (a custom `contactForm`, say) can't be detected from the built-in
     // vocabulary, so it says so directly.
     if (typeof config.inquiries === "boolean")
         return config.inquiries;

package/dist/schema/generate.js

@@ -11,7 +11,51 @@
 // result to disk and formats it. Import ordering matches the site's schema.ts so
 // a formatter never re-flags the generated file.
 import { generateCatalogTable } from "../commerce/mirror.js";
+import { astroidHasEditor } from "../shape.js";
 import { astroidFrameworkTables } from "./framework.js";
+/** The Drizzle column builders a catalog table's source uses. */
+function catalogBuilders(catalog) {
+    const builders = ["integer", "sqliteTable", "text"];
+    if (catalog?.includes("real("))
+        builders.push("real");
+    return builders.sort();
+}
+/**
+ * The schema of an app with no editor (`editor: false`): no `pages`, no
+ * versions, and no framework tables, because nothing here edits them. What's
+ * left is what the config itself implies, the commerce catalog, and the site's
+ * own tables.
+ *
+ * A framework table the app only READS, such as `siteSettings` in a database
+ * another app owns, is imported straight from `louise-toolkit/db` where it's
+ * queried. Re-exporting it here would put it in front of drizzle-kit, which
+ * would then write migrations for a table this app doesn't own.
+ */
+function generateAppSchema(config) {
+    const catalog = generateCatalogTable(config);
+    return [
+        "// Generated by astroidjs—do not hand-edit.",
+        "// Source: your defineAstroid config. This app has no editor (`editor: false`),",
+        "// so it owns no content tables. To read one that another app owns, such as",
+        '// `siteSettings`, import it from "louise-toolkit/db" where you query it.',
+        ...(catalog
+            ? [
+                `import { ${catalogBuilders(catalog).join(", ")} } from "drizzle-orm/sqlite-core";`,
+                // The catalog's JSON columns are typed with it; the editor schema
+                // imports it for `pages.sections` anyway.
+                ...(catalog.includes("JsonValue")
+                    ? ['import type { JsonValue } from "louise-toolkit/content";']
+                    : []),
+                "",
+                catalog,
+            ]
+            : [""]),
+        "// Site-owned tables, declared in src/schema.site.ts and re-exported here so",
+        "// drizzle-kit and the worker see them. Empty until the app adds one.",
+        'export * from "./schema.site.js";',
+        "",
+    ].join("\n");
+}
 /**
  * Generate the TypeScript source of a site's Drizzle schema from an Astroid
  * config. The output is a drop-in replacement for the hand-written `schema.ts`:
@@ -19,6 +63,8 @@ import { astroidFrameworkTables } from "./framework.js";
  * table, and the re-exported framework tables the config selects.
  */
 export function generateAstroidSchema(config) {
+    if (!astroidHasEditor(config))
+        return generateAppSchema(config);
     const framework = astroidFrameworkTables(config); // sorted
     // pagesColumns is spread into `pages`; the framework tables are re-exported.
     // One import brings them all in (matching the site) so nothing is unused.
@@ -27,13 +73,11 @@ export function generateAstroidSchema(config) {
     // Only import the column builders the emitted source actually uses—an
     // unused import is a lint error in the project we're generating into, and a
     // missing one (`real`, from the catalog's price/sortOrder) is a type error.
-    const drizzleImports = ["integer", "sqliteTable", "text"];
-    if (catalog?.includes("real("))
-        drizzleImports.push("real");
+    const drizzleImports = catalogBuilders(catalog);
     return [
         "// Generated by astroidjs—do not hand-edit.",
         "// Source: your defineAstroid config.",
-        `import { ${drizzleImports.sort().join(", ")} } from "drizzle-orm/sqlite-core";`,
+        `import { ${drizzleImports.join(", ")} } from "drizzle-orm/sqlite-core";`,
         'import { collectionVersionsTable, type JsonValue } from "louise-toolkit/content";',
         `import { ${dbImports.join(", ")} } from "louise-toolkit/db";`,
         "",

package/dist/security/index.d.ts

@@ -1 +1 @@
-export { ASTROID_CHECKOUT_PATH, ASTROID_PORTAL_BASE_PATH, astroidRateRules, type RateRule, } from "./rate-rules.js";
+export { ASTROID_API_PREFIX, ASTROID_CHECKOUT_PATH, ASTROID_PORTAL_BASE_PATH, astroidRateRules, type RateRule, } from "./rate-rules.js";

package/dist/security/index.js

@@ -1,2 +1,2 @@
 // Copyright (c) 2026 BowenLabs. Astroid is MIT licensed.
-export { ASTROID_CHECKOUT_PATH, ASTROID_PORTAL_BASE_PATH, astroidRateRules, } from "./rate-rules.js";
+export { ASTROID_API_PREFIX, ASTROID_CHECKOUT_PATH, ASTROID_PORTAL_BASE_PATH, astroidRateRules, } from "./rate-rules.js";

package/dist/security/rate-rules.d.ts

@@ -9,10 +9,17 @@ export type { RateRule };
 export declare const ASTROID_PORTAL_BASE_PATH = "/api/portal-auth";
 /** Path the commerce module's checkout POSTs to. */
 export declare const ASTROID_CHECKOUT_PATH = "/api/checkout";
+/**
+ * Where an app with no editor (`editor: false`) serves its versioned JSON API.
+ * A web client and a later native client call the same routes, so a new
+ * version is a new prefix rather than a change to the one clients already use.
+ */
+export declare const ASTROID_API_PREFIX = "/api/v1";
 /**
  * The rule set for a project, derived from its config: the editor sign-in
- * surface always, the portal's credential surfaces when a portal is enabled, and
- * checkout when commerce is configured.
+ * surface unless the project has no editor, the portal's credential surfaces
+ * when a portal is enabled, checkout when commerce is configured, and the
+ * versioned API for an app with no editor.
  *
  * Rules are matched first-wins, and `security.rateRules` from the config are
  * placed FIRST—so a site tightens or loosens any default by declaring its own

package/dist/security/rate-rules.js

@@ -16,6 +16,7 @@
 // The contact form is also absent by design: it's a worker route with its own
 // per-form limiter, and worker routes are matched before Astro's middleware ever
 // runs, so a rule here would never fire.
+import { astroidHasEditor } from "../shape.js";
 /**
  * Base path the customer/portal Better Auth instance mounts at—its own
  * handler, separate from the editor's `/api/auth`. Fixed by Astroid so the rate
@@ -24,14 +25,21 @@
 export const ASTROID_PORTAL_BASE_PATH = "/api/portal-auth";
 /** Path the commerce module's checkout POSTs to. */
 export const ASTROID_CHECKOUT_PATH = "/api/checkout";
+/**
+ * Where an app with no editor (`editor: false`) serves its versioned JSON API.
+ * A web client and a later native client call the same routes, so a new
+ * version is a new prefix rather than a change to the one clients already use.
+ */
+export const ASTROID_API_PREFIX = "/api/v1";
 /** Ten minutes. Every default budget uses this window—long enough that a
  *  burst can't wait it out, short enough that a false positive self-heals. */
 const WINDOW = 600;
 const exact = (path) => (p) => p === path;
 /**
  * The rule set for a project, derived from its config: the editor sign-in
- * surface always, the portal's credential surfaces when a portal is enabled, and
- * checkout when commerce is configured.
+ * surface unless the project has no editor, the portal's credential surfaces
+ * when a portal is enabled, checkout when commerce is configured, and the
+ * versioned API for an app with no editor.
  *
  * Rules are matched first-wins, and `security.rateRules` from the config are
  * placed FIRST—so a site tightens or loosens any default by declaring its own
@@ -39,26 +47,29 @@ const exact = (path) => (p) => p === path;
  */
 export function astroidRateRules(config) {
     const rules = [...(config.security?.rateRules ?? [])];
-    // Magic-link sign-in is the email-bombing target: without a cap, anyone who
-    // knows an editor's address can trigger unbounded sign-in mail (their inbox,
-    // your Email + Worker spend). Tightest budget in the set.
-    rules.push({
-        name: "magic-link",
-        method: "POST",
-        match: exact("/api/auth/sign-in/magic-link"),
-        limit: 5,
-        windowSec: WINDOW,
-    });
-    // Everything else Better Auth serves (passkey challenges, sign-out, callbacks)
-    // behind a looser catch-all. Ordered after the specific rule above, which
-    // matters: `matchRateRule` takes the first match.
-    rules.push({
-        name: "auth",
-        method: "POST",
-        match: (p) => p.startsWith("/api/auth/"),
-        limit: 30,
-        windowSec: WINDOW,
-    });
+    // The editor's sign-in, which an app with no editor doesn't serve.
+    if (astroidHasEditor(config)) {
+        // Magic-link sign-in is the email-bombing target: without a cap, anyone who
+        // knows an editor's address can trigger unbounded sign-in mail (their inbox,
+        // your Email + Worker spend). Tightest budget in the set.
+        rules.push({
+            name: "magic-link",
+            method: "POST",
+            match: exact("/api/auth/sign-in/magic-link"),
+            limit: 5,
+            windowSec: WINDOW,
+        });
+        // Everything else Better Auth serves (passkey challenges, sign-out, callbacks)
+        // behind a looser catch-all. Ordered after the specific rule above, which
+        // matters: `matchRateRule` takes the first match.
+        rules.push({
+            name: "auth",
+            method: "POST",
+            match: (p) => p.startsWith("/api/auth/"),
+            limit: 30,
+            windowSec: WINDOW,
+        });
+    }
     if (config.portal?.enabled) {
         // The portal's mount is configurable (a site may already ship a second
         // instance at its own path), so the credential-surface rules must track the
@@ -106,5 +117,18 @@ export function astroidRateRules(config) {
             windowSec: WINDOW,
         });
     }
+    if (!astroidHasEditor(config)) {
+        // An app's own JSON API: quotes, orders, account changes. Looser than
+        // checkout because a client posts here as a cart changes, not once per
+        // purchase, so this is abuse control rather than flow control. After the
+        // specific rules, so a tighter budget for one route wins.
+        rules.push({
+            name: "api",
+            method: "POST",
+            match: (p) => p.startsWith(`${ASTROID_API_PREFIX}/`),
+            limit: 120,
+            windowSec: WINDOW,
+        });
+    }
     return rules;
 }

package/dist/seo/routes.js

@@ -13,6 +13,7 @@
 // rules are: which routes exist is a function of which modules are enabled, and
 // a hand-maintained list drifts the moment someone turns a portal on.
 import { ASTROID_PORTAL_BASE_PATH } from "../security/rate-rules.js";
+import { astroidHasEditor } from "../shape.js";
 /**
  * Paths that must never be indexed, derived from the config: the editor and its
  * API always, plus the portal's account + auth surfaces and checkout when those
@@ -25,8 +26,8 @@ export function astroidNoindexPaths(config) {
     const paths = [
         // Every worker route (editor CRUD, media, forms) and Better Auth.
         "/api/",
-        // The editor entry point.
-        "/louise",
+        // The editor entry point, when there is an editor.
+        ...(astroidHasEditor(config) ? ["/louise"] : []),
     ];
     if (config.portal?.enabled) {
         paths.push(ASTROID_PORTAL_BASE_PATH, "/account", "/login", "/register", "/reset-password");

package/dist/shape.d.ts

@@ -0,0 +1,6 @@
+import type { AstroidConfig } from "./config.js";
+/**
+ * Whether the project has a Louise editor: its routes, its sign-in, and the
+ * content tables it edits. True unless the config sets `editor: false`.
+ */
+export declare function astroidHasEditor(config: AstroidConfig): boolean;

package/dist/shape.js

@@ -0,0 +1,14 @@
+// Copyright (c) 2026 BowenLabs. Astroid is MIT licensed.
+//
+// The project's shape: a Louise-edited site, or an app with no pages to edit.
+//
+// Its own module, and dependency-free, because nearly every generator asks the
+// question and `config.ts` imports some of them at runtime. A type-only import
+// of the config keeps that from becoming a cycle.
+/**
+ * Whether the project has a Louise editor: its routes, its sign-in, and the
+ * content tables it edits. True unless the config sets `editor: false`.
+ */
+export function astroidHasEditor(config) {
+    return config.editor !== false;
+}

package/dist/status.js

@@ -19,6 +19,7 @@
 import { commerceSecretNames, resolveCommerceStatus } from "./commerce/secrets.js";
 import { ASTROID_VITALS_SECRET_NAMES } from "./analytics/index.js";
 import { EMAIL_SECRET_NAMES, resolveMailerStatus } from "./email/send.js";
+import { astroidHasEditor } from "./shape.js";
 /**
  * Secrets every Astroid site has, independent of which modules are on.
  *
@@ -40,17 +41,25 @@ export const ASTROID_CORE_SECRET_NAMES = [
  * and a marketing site shouldn't be told to provision a Square token.
  */
 export function astroidSecretNames(config) {
-    const groups = {
-        core: [...ASTROID_CORE_SECRET_NAMES],
-        email: [...EMAIL_SECRET_NAMES],
-    };
+    // An app with no editor signs nobody in unless it has a portal, which needs
+    // the session secret and mail, not the editor's Turnstile pair.
+    const editor = astroidHasEditor(config);
+    const portal = Boolean(config.portal?.enabled);
+    const groups = {};
+    if (editor)
+        groups.core = [...ASTROID_CORE_SECRET_NAMES];
+    else if (portal)
+        groups.core = ["SESSION_SECRET"];
+    if (editor || portal)
+        groups.email = [...EMAIL_SECRET_NAMES];
     const commerce = commerceSecretNames(config.commerce);
     if (commerce.length > 0)
         groups.commerce = commerce;
     // The CWV read-back's API credentials. Collection needs none of this—only
     // querying the p75 back out does, because the Analytics Engine SQL API is
-    // account-scoped and has no binding.
-    groups.vitals = [...ASTROID_VITALS_SECRET_NAMES];
+    // account-scoped and has no binding. The editor's Health panel reads it.
+    if (editor)
+        groups.vitals = [...ASTROID_VITALS_SECRET_NAMES];
     return groups;
 }
 /**
@@ -68,8 +77,11 @@ export async function astroidModuleStatus(config, env) {
         resolveCommerceStatus(config.commerce, secretEnv),
         resolveMailerStatus(env),
     ]);
-    const reports = [
-        {
+    const reports = [];
+    // Mail is for signing in: the editor's magic link, or a portal's password
+    // reset. An app with neither sends none, so there's nothing to report.
+    if (astroidHasEditor(config) || config.portal?.enabled) {
+        reports.push({
             module: "email",
             enabled: true,
             configured: mailer.configured,
@@ -79,8 +91,8 @@ export async function astroidModuleStatus(config, env) {
                 : // Naming the log is the useful part: the magic link IS in the console,
                     // and someone who doesn't know that concludes sign-in is broken.
                     "dormant — messages are logged to the console (the magic link is in the log), not sent",
-        },
-    ];
+        });
+    }
     if (commerce.enabled) {
         reports.push({
             module: "commerce",

package/dist/worker/generate.js

@@ -18,6 +18,7 @@ import { ASTROID_HEALTH_CRON, astroidCron, astroidUsesQueues } from "../queues/m
 import { ASTROID_EDIT_SESSION_CLASS, ASTROID_REALTIME_BINDING, usesRealtime, } from "../realtime/scaffold.js";
 import { capturesInquiries } from "../schema/framework.js";
 import { astroidCspStyleSrc } from "../security/csp-origins.js";
+import { astroidHasEditor } from "../shape.js";
 import { ASTROID_REWRITE_EXCLUDE, ASTROID_TENANT_PREFIX } from "../tenancy/index.js";
 import { astroidEditorRoutePlan } from "./routes.js";
 // Astroid's default editable site_settings surface—the columns the Settings
@@ -52,6 +53,8 @@ export const ASTROID_SETTINGS_IMAGE_KEYS = ["logoUrl", "faviconUrl", "defaultOgI
  * emitted only when a brand captures inquiries.
  */
 export function generateAstroidWorker(config) {
+    if (!astroidHasEditor(config))
+        return generateAppWorker(config);
     const inquiries = capturesInquiries(config);
     const queues = astroidUsesQueues(config);
     const cron = astroidCron(config);
@@ -564,6 +567,111 @@ export function generateAstroidWorker(config) {
     }
     return lines.join("\n");
 }
+/**
+ * The worker of an app with no editor (`editor: false`): the public status
+ * route, the SSR fallback, and whatever the config's modules add (a queue
+ * consumer, the crons), with no editor route and no auth seam.
+ *
+ * The gate stays, with a resolver that never finds an editor. Nothing under
+ * `/api/louise` belongs to one here, so it refuses everything there except the
+ * public status probe, and it gives route responses the security headers the
+ * middleware never sees.
+ */
+function generateAppWorker(config) {
+    const queues = astroidUsesQueues(config);
+    const cron = astroidCron(config);
+    const customCrons = config.crons ?? [];
+    const scheduled = cron !== null || customCrons.length > 0;
+    const lines = [];
+    const p = (s = "") => lines.push(s);
+    p("// Generated by astroidjs—do not hand-edit.");
+    p("// Source: your defineAstroid config. This app has no editor (`editor: false`),");
+    p("// so it serves no editor routes and resolves no editor session.");
+    p('import { handle } from "@astrojs/cloudflare/handler";');
+    p('import { d1Check, statusRoute } from "louise-toolkit/editor";');
+    if (queues)
+        p('import { processBatch } from "louise-toolkit/queues";');
+    p('import { composeWorker, type WorkerRoute, withEdgeCache } from "louise-toolkit/worker";');
+    if (queues)
+        p('import type { AstroidQueueMessage } from "astroidjs";');
+    if (config.status?.checks) {
+        p("// Your STATUS seam: the app's own checks for the public status route.");
+        p("// Scaffolded once and yours to edit.");
+        p('import { statusChecks } from "./status-checks.js";');
+    }
+    if (queues) {
+        p("// Your QUEUE seam: what each message actually does. Scaffolded once and");
+        p("// yours to edit.");
+        p('import { handleQueueMessage } from "./queue.js";');
+    }
+    p();
+    p("// --- public status ---------------------------------------------------------");
+    p("// What statusRoute answers an outside probe with: 200 when every check");
+    p("// passes, 503 when any fails, throws, or takes over two seconds. Anyone can");
+    p("// make these run, so each is one cheap read, and a burst of probes reuses one");
+    p("// result per isolate for STATUS_REUSE_MS.");
+    p("const STATUS_REUSE_MS = 10_000;");
+    p("const STATUS_CHECKS = {");
+    p("  // D1 answers `SELECT 1`.");
+    p("  d1: d1Check((env: CloudflareEnv) => env.DB),");
+    if (config.status?.checks) {
+        p("  // The app's own, from src/status-checks.ts. Spread last, so a check with");
+        p("  // the same name replaces Astroid's on purpose.");
+        p("  ...statusChecks,");
+    }
+    p("};");
+    p();
+    p("const routes: WorkerRoute<CloudflareEnv>[] = [");
+    p("  // Public status for an outside probe (GET/HEAD /api/louise/status). A");
+    p("  // publicRoute, so the gate below lets an anonymous probe through.");
+    p("  statusRoute({ checks: STATUS_CHECKS, reuseMs: STATUS_REUSE_MS }),");
+    p("];");
+    p();
+    p(queues
+        ? "export default composeWorker<CloudflareEnv, AstroidQueueMessage>({"
+        : "export default composeWorker<CloudflareEnv>({");
+    p("  routes,");
+    p("  // No editor, so no request under /api/louise resolves to one. The gate");
+    p("  // refuses everything there except the public status probe, and gives route");
+    p("  // responses the security headers the middleware never sees.");
+    p("  gate: { resolveEditor: () => null },");
+    p("  // The SSR fallback, in the Worker cache (ADR 0004). It stores only a");
+    p("  // response that opts in with `Astro.cache.set(...)`, and it strips the CDN");
+    p("  // directive from every other one, so Cloudflare's cookie-blind edge cache");
+    p("  // never stores a signed-in customer's page.");
+    p("  fetch: withEdgeCache((request, env, ctx) => handle(request, env, ctx)),");
+    if (queues) {
+        p("  // Queue consumer. `processBatch` acks or retries each message");
+        p("  // INDEPENDENTLY, so one poisoned message can't block the rest of the");
+        p("  // batch; Cloudflare routes it to the DLQ once it exceeds max_retries.");
+        p("  queue: (batch, env) => processBatch(batch, (message) => handleQueueMessage(env, message)),");
+    }
+    if (scheduled) {
+        p("  // Cron. Cloudflare fires this for EVERY trigger in wrangler.jsonc and");
+        p("  // identifies which by `controller.cron`, so dispatch on it.");
+        p("  scheduled: (controller, env, ctx) => {");
+        if (cron) {
+            p(`    if (controller.cron === ${JSON.stringify(cron)}) {`);
+            p("      // Catalog safety net: a missed webhook leaves the catalog stale only");
+            p("      // until the next tick. Enqueued, so it takes the retry + DLQ path.");
+            p('      ctx.waitUntil(env.COMMERCE_QUEUE.send({ kind: "catalog_refresh" }));');
+            p("      return;");
+            p("    }");
+        }
+        for (const custom of customCrons) {
+            p(`    if (controller.cron === ${JSON.stringify(custom.expression)}) {`);
+            p("      // Enqueued, not run inline: same retry + DLQ path as everything");
+            p("      // else, and a slow job can't hold the scheduled handler open.");
+            p(`      ctx.waitUntil(env.COMMERCE_QUEUE.send(${JSON.stringify(custom.message)}));`);
+            p("      return;");
+            p("    }");
+        }
+        p("  },");
+    }
+    p("});");
+    p();
+    return lines.join("\n");
+}
 /**
  * Generate the Astro middleware (`middleware.ts`) from an Astroid config: the
  * shared Louise flow (rate-limit the unauthenticated POST surface → resolve editor
@@ -592,6 +700,8 @@ export function generateAstroidMiddleware(config) {
     // origins (the Square SDK's stylesheet) are baked in here; `astroid build`
     // regenerates this file, so a config change lands on the next deploy.
     const cspStyleSrc = astroidCspStyleSrc(config);
+    // An app with no editor has no auth seam and no pages to redirect between.
+    const editor = astroidHasEditor(config);
     const portal = astroidPortal(config);
     const tenancy = config.tenancy;
     const rewritePrefix = tenancy?.rewritePrefix ?? ASTROID_TENANT_PREFIX;
@@ -599,13 +709,17 @@ export function generateAstroidMiddleware(config) {
     return [
         "// Generated by astroidjs—do not hand-edit.",
         "// The shared Louise middleware: rate-limit the unauthenticated POST surfaces,",
-        "// then resolve the editor session + sticky ?louise edit mode, then apply",
+        ...(editor
+            ? ["// then resolve the editor session + sticky ?louise edit mode, then apply"]
+            : ["// then (this app has no editor, so there's no session to resolve) apply"]),
         "// content-freshness + transport-security headers, and rewrite the style-src of",
         "// the CSP header Astro's security.csp emits so Louise's data-driven inline",
         "// styles + inlined data: brand font are allowed.",
         'import { env } from "cloudflare:workers";',
         'import { createLouiseMiddleware } from "@louise-toolkit/astro";',
-        'import { db, pageRedirects, resolvePageRedirect } from "louise-toolkit/db";',
+        ...(editor
+            ? ['import { db, pageRedirects, resolvePageRedirect } from "louise-toolkit/db";']
+            : []),
         // One `astroidjs` import, composed from what this config actually uses—two
         // import statements for the same module is legal and reads as an
         // oversight in a file nobody is supposed to hand-edit.
@@ -623,15 +737,21 @@ export function generateAstroidMiddleware(config) {
                 'import { resolveTenant } from "./tenancy.js";',
             ]
             : []),
-        "// TODO(astroid): your AUTH seam—same resolveEditor as the generated worker.ts.",
-        'import { resolveEditor } from "./auth.js";',
+        ...(editor
+            ? [
+                "// TODO(astroid): your AUTH seam—same resolveEditor as the generated worker.ts.",
+                'import { resolveEditor } from "./auth.js";',
+            ]
+            : []),
         // The portal's resolver lives in its OWN module, not the editor's auth
         // seam—they're separate Better Auth instances and must not share a file.
         ...(portal ? ['import { resolvePortalUser } from "./portal-auth.js";'] : []),
         "",
         "// Rate-limit the public, unauthenticated POST surface, keyed by client IP",
         "// (fixed-window KV counter that fails open). Derived from your config: the",
-        "// editor magic-link always, plus the portal credential surfaces and checkout",
+        ...(editor
+            ? ["// editor magic-link always, plus the portal credential surfaces and checkout"]
+            : ["// versioned API under /api/v1, plus the portal credential surfaces and checkout"]),
         "// when those are enabled. Add your own via `security.rateRules` in the config—",
         "// they're matched first, so they can also override a default's budget.",
         "// `env.RL` is read per request (a getter)—a KV binding is only valid in",
@@ -657,15 +777,27 @@ export function generateAstroidMiddleware(config) {
             : []),
         "",
         "export const onRequest = createLouiseMiddleware({",
-        "  resolveEditor: (request) => resolveEditor(request),",
+        ...(editor
+            ? ["  resolveEditor: (request) => resolveEditor(request),"]
+            : [
+                "  // No editor (`editor: false`), so no request resolves to one and edit",
+                "  // mode never turns on.",
+                "  resolveEditor: () => null,",
+            ]),
         "  rateLimit: { rules: RATE_RULES, kv: () => env.RL },",
         "  // The same deny-by-default gate for /api/louise routes that reach Astro—",
         "  // anything the worker's routes didn't answer. A second check behind the",
-        "  // worker's gate, and free: the editor is resolved here on every request.",
+        editor
+            ? "  // worker's gate, and free: the editor is resolved here on every request."
+            : "  // worker's gate: with no editor, it refuses all but the public routes.",
         "  apiGate: true,",
-        "  // A renamed page's old URL answers a 301 to the new one. It runs only after",
-        "  // the page answered 404, so a page later created on the old path wins.",
-        "  redirectFor: (path) => resolvePageRedirect(db(env.DB), pageRedirects, path),",
+        ...(editor
+            ? [
+                "  // A renamed page's old URL answers a 301 to the new one. It runs only after",
+                "  // the page answered 404, so a page later created on the old path wins.",
+                "  redirectFor: (path) => resolvePageRedirect(db(env.DB), pageRedirects, path),",
+            ]
+            : []),
         // `extend` runs once and may need to populate BOTH—a tenanted site with a
         // portal resolves a tenant and a customer on the same request.
         ...(portal || tenancy

package/dist/workflow/advance.js

@@ -10,7 +10,7 @@
 // expected—`UPDATE … SET stage = ? WHERE id = ? AND stage = ?`—and treat "0 rows
 // changed" as the conflict signal rather than checking first and hoping.
 //
-// ORDERING MATTERS, and the reference gets it wrong. ghostfire's floor route
+// ORDERING MATTERS, and the reference gets it wrong. Its floor route
 // inserts the sign-off row and THEN runs the guarded update, so a double submit
 // writes two audit rows even though only one advance lands. Here the guarded
 // update goes first and the audit row is written only if it actually moved the

package/dist/workflow/config.js

@@ -2,7 +2,7 @@
 //
 // `defineWorkflow`—staged, audited pipelines.
 //
-// The shape this generalizes is ghostfire.coffee's production floor, and the
+// The shape this generalizes is a client site's production floor, and the
 // framing correction in #256 is the important part: despite the name "order
 // tracker", it is NOT queue- or Durable-Object-driven. It is a synchronous SSR
 // + D1 state machine—an integer `stage` column advanced by sign-off rows,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "astroidjs",
-  "version": "0.18.0",
+  "version": "0.20.0",
   "description": "Astroid — an opinionated meta-framework over Louise Toolkit and Astro for building editable, multi-editor sites on Cloudflare Workers.",
   "keywords": [
     "astro",
@@ -64,14 +64,14 @@
     "@typescript/native-preview": "7.0.0-dev.20260707.2",
     "@vitest/coverage-v8": "4.1.11",
     "astro": "^7.2.9",
-    "louise-toolkit": "^0.36.0",
+    "louise-toolkit": "^0.37.0",
     "solid-js": "^1.9.15",
     "typescript": "^6.0.3",
     "vitest": "^4.1.11"
   },
   "peerDependencies": {
     "astro": "^7.0.9",
-    "louise-toolkit": "^0.36.0",
+    "louise-toolkit": "^0.37.0",
     "solid-js": "^1.9.0"
   },
   "peerDependenciesMeta": {