astroidjs 0.19.0 → 0.21.0

package/dist/security/rate-rules.js

@@ -16,6 +16,7 @@
 // The contact form is also absent by design: it's a worker route with its own
 // per-form limiter, and worker routes are matched before Astro's middleware ever
 // runs, so a rule here would never fire.
+import { astroidHasEditor } from "../shape.js";
 /**
  * Base path the customer/portal Better Auth instance mounts at—its own
  * handler, separate from the editor's `/api/auth`. Fixed by Astroid so the rate
@@ -24,14 +25,21 @@
 export const ASTROID_PORTAL_BASE_PATH = "/api/portal-auth";
 /** Path the commerce module's checkout POSTs to. */
 export const ASTROID_CHECKOUT_PATH = "/api/checkout";
+/**
+ * Where an app with no editor (`editor: false`) serves its versioned JSON API.
+ * A web client and a later native client call the same routes, so a new
+ * version is a new prefix rather than a change to the one clients already use.
+ */
+export const ASTROID_API_PREFIX = "/api/v1";
 /** Ten minutes. Every default budget uses this window—long enough that a
  *  burst can't wait it out, short enough that a false positive self-heals. */
 const WINDOW = 600;
 const exact = (path) => (p) => p === path;
 /**
  * The rule set for a project, derived from its config: the editor sign-in
- * surface always, the portal's credential surfaces when a portal is enabled, and
- * checkout when commerce is configured.
+ * surface unless the project has no editor, the portal's credential surfaces
+ * when a portal is enabled, checkout when commerce is configured, and the
+ * versioned API for an app with no editor.
  *
  * Rules are matched first-wins, and `security.rateRules` from the config are
  * placed FIRST—so a site tightens or loosens any default by declaring its own
@@ -39,26 +47,29 @@ const exact = (path) => (p) => p === path;
  */
 export function astroidRateRules(config) {
     const rules = [...(config.security?.rateRules ?? [])];
-    // Magic-link sign-in is the email-bombing target: without a cap, anyone who
-    // knows an editor's address can trigger unbounded sign-in mail (their inbox,
-    // your Email + Worker spend). Tightest budget in the set.
-    rules.push({
-        name: "magic-link",
-        method: "POST",
-        match: exact("/api/auth/sign-in/magic-link"),
-        limit: 5,
-        windowSec: WINDOW,
-    });
-    // Everything else Better Auth serves (passkey challenges, sign-out, callbacks)
-    // behind a looser catch-all. Ordered after the specific rule above, which
-    // matters: `matchRateRule` takes the first match.
-    rules.push({
-        name: "auth",
-        method: "POST",
-        match: (p) => p.startsWith("/api/auth/"),
-        limit: 30,
-        windowSec: WINDOW,
-    });
+    // The editor's sign-in, which an app with no editor doesn't serve.
+    if (astroidHasEditor(config)) {
+        // Magic-link sign-in is the email-bombing target: without a cap, anyone who
+        // knows an editor's address can trigger unbounded sign-in mail (their inbox,
+        // your Email + Worker spend). Tightest budget in the set.
+        rules.push({
+            name: "magic-link",
+            method: "POST",
+            match: exact("/api/auth/sign-in/magic-link"),
+            limit: 5,
+            windowSec: WINDOW,
+        });
+        // Everything else Better Auth serves (passkey challenges, sign-out, callbacks)
+        // behind a looser catch-all. Ordered after the specific rule above, which
+        // matters: `matchRateRule` takes the first match.
+        rules.push({
+            name: "auth",
+            method: "POST",
+            match: (p) => p.startsWith("/api/auth/"),
+            limit: 30,
+            windowSec: WINDOW,
+        });
+    }
     if (config.portal?.enabled) {
         // The portal's mount is configurable (a site may already ship a second
         // instance at its own path), so the credential-surface rules must track the
@@ -106,5 +117,18 @@ export function astroidRateRules(config) {
             windowSec: WINDOW,
         });
     }
+    if (!astroidHasEditor(config)) {
+        // An app's own JSON API: quotes, orders, account changes. Looser than
+        // checkout because a client posts here as a cart changes, not once per
+        // purchase, so this is abuse control rather than flow control. After the
+        // specific rules, so a tighter budget for one route wins.
+        rules.push({
+            name: "api",
+            method: "POST",
+            match: (p) => p.startsWith(`${ASTROID_API_PREFIX}/`),
+            limit: 120,
+            windowSec: WINDOW,
+        });
+    }
     return rules;
 }

package/dist/seo/routes.js

@@ -13,6 +13,7 @@
 // rules are: which routes exist is a function of which modules are enabled, and
 // a hand-maintained list drifts the moment someone turns a portal on.
 import { ASTROID_PORTAL_BASE_PATH } from "../security/rate-rules.js";
+import { astroidHasEditor } from "../shape.js";
 /**
  * Paths that must never be indexed, derived from the config: the editor and its
  * API always, plus the portal's account + auth surfaces and checkout when those
@@ -25,8 +26,8 @@ export function astroidNoindexPaths(config) {
     const paths = [
         // Every worker route (editor CRUD, media, forms) and Better Auth.
         "/api/",
-        // The editor entry point.
-        "/louise",
+        // The editor entry point, when there is an editor.
+        ...(astroidHasEditor(config) ? ["/louise"] : []),
     ];
     if (config.portal?.enabled) {
         paths.push(ASTROID_PORTAL_BASE_PATH, "/account", "/login", "/register", "/reset-password");

package/dist/shape.d.ts

@@ -0,0 +1,6 @@
+import type { AstroidConfig } from "./config.js";
+/**
+ * Whether the project has a Louise editor: its routes, its sign-in, and the
+ * content tables it edits. True unless the config sets `editor: false`.
+ */
+export declare function astroidHasEditor(config: AstroidConfig): boolean;

package/dist/shape.js

@@ -0,0 +1,14 @@
+// Copyright (c) 2026 BowenLabs. Astroid is MIT licensed.
+//
+// The project's shape: a Louise-edited site, or an app with no pages to edit.
+//
+// Its own module, and dependency-free, because nearly every generator asks the
+// question and `config.ts` imports some of them at runtime. A type-only import
+// of the config keeps that from becoming a cycle.
+/**
+ * Whether the project has a Louise editor: its routes, its sign-in, and the
+ * content tables it edits. True unless the config sets `editor: false`.
+ */
+export function astroidHasEditor(config) {
+    return config.editor !== false;
+}

package/dist/status.js

@@ -19,6 +19,7 @@
 import { commerceSecretNames, resolveCommerceStatus } from "./commerce/secrets.js";
 import { ASTROID_VITALS_SECRET_NAMES } from "./analytics/index.js";
 import { EMAIL_SECRET_NAMES, resolveMailerStatus } from "./email/send.js";
+import { astroidHasEditor } from "./shape.js";
 /**
  * Secrets every Astroid site has, independent of which modules are on.
  *
@@ -40,17 +41,25 @@ export const ASTROID_CORE_SECRET_NAMES = [
  * and a marketing site shouldn't be told to provision a Square token.
  */
 export function astroidSecretNames(config) {
-    const groups = {
-        core: [...ASTROID_CORE_SECRET_NAMES],
-        email: [...EMAIL_SECRET_NAMES],
-    };
+    // An app with no editor signs nobody in unless it has a portal, which needs
+    // the session secret and mail, not the editor's Turnstile pair.
+    const editor = astroidHasEditor(config);
+    const portal = Boolean(config.portal?.enabled);
+    const groups = {};
+    if (editor)
+        groups.core = [...ASTROID_CORE_SECRET_NAMES];
+    else if (portal)
+        groups.core = ["SESSION_SECRET"];
+    if (editor || portal)
+        groups.email = [...EMAIL_SECRET_NAMES];
     const commerce = commerceSecretNames(config.commerce);
     if (commerce.length > 0)
         groups.commerce = commerce;
     // The CWV read-back's API credentials. Collection needs none of this—only
     // querying the p75 back out does, because the Analytics Engine SQL API is
-    // account-scoped and has no binding.
-    groups.vitals = [...ASTROID_VITALS_SECRET_NAMES];
+    // account-scoped and has no binding. The editor's Health panel reads it.
+    if (editor)
+        groups.vitals = [...ASTROID_VITALS_SECRET_NAMES];
     return groups;
 }
 /**
@@ -68,8 +77,11 @@ export async function astroidModuleStatus(config, env) {
         resolveCommerceStatus(config.commerce, secretEnv),
         resolveMailerStatus(env),
     ]);
-    const reports = [
-        {
+    const reports = [];
+    // Mail is for signing in: the editor's magic link, or a portal's password
+    // reset. An app with neither sends none, so there's nothing to report.
+    if (astroidHasEditor(config) || config.portal?.enabled) {
+        reports.push({
             module: "email",
             enabled: true,
             configured: mailer.configured,
@@ -79,8 +91,8 @@ export async function astroidModuleStatus(config, env) {
                 : // Naming the log is the useful part: the magic link IS in the console,
                     // and someone who doesn't know that concludes sign-in is broken.
                     "dormant — messages are logged to the console (the magic link is in the log), not sent",
-        },
-    ];
+        });
+    }
     if (commerce.enabled) {
         reports.push({
             module: "commerce",

package/dist/worker/generate.js

@@ -12,12 +12,14 @@
 // beforeChange hook, and pagesRoute (which takes no collection config) through
 // the `astroidPagesWriteHooks` spread, so both write paths enforce one contract.
 import { ASTROID_VITALS_BINDING, generateAstroidCwvQuery } from "../analytics/index.js";
+import { ASTROID_INCIDENT_EVENTS_BINDING, ASTROID_SENTRY_DSN_BINDING, ASTROID_VERSION_METADATA_BINDING, } from "../incidents/names.js";
 import { astroidEditorTable } from "../auth/index.js";
 import { astroidPortal } from "../portal/config.js";
-import { ASTROID_HEALTH_CRON, astroidCron, astroidUsesQueues } from "../queues/messages.js";
+import { ASTROID_HEALTH_CRON, astroidCron, astroidQueueNames, astroidUsesQueues, } from "../queues/messages.js";
 import { ASTROID_EDIT_SESSION_CLASS, ASTROID_REALTIME_BINDING, usesRealtime, } from "../realtime/scaffold.js";
 import { capturesInquiries } from "../schema/framework.js";
 import { astroidCspStyleSrc } from "../security/csp-origins.js";
+import { astroidHasEditor } from "../shape.js";
 import { ASTROID_REWRITE_EXCLUDE, ASTROID_TENANT_PREFIX } from "../tenancy/index.js";
 import { astroidEditorRoutePlan } from "./routes.js";
 // Astroid's default editable site_settings surface—the columns the Settings
@@ -52,6 +54,8 @@ export const ASTROID_SETTINGS_IMAGE_KEYS = ["logoUrl", "faviconUrl", "defaultOgI
  * emitted only when a brand captures inquiries.
  */
 export function generateAstroidWorker(config) {
+    if (!astroidHasEditor(config))
+        return generateAppWorker(config);
     const inquiries = capturesInquiries(config);
     const queues = astroidUsesQueues(config);
     const cron = astroidCron(config);
@@ -205,6 +209,7 @@ export function generateAstroidWorker(config) {
     p('import { cwvSqlQuery, parseCwvRows, summarizeCwv, vitalsRoute } from "louise-toolkit/analytics";');
     if (inquiries)
         p('import { defineForm } from "louise-toolkit/forms";');
+    p(incidentsImport(queues));
     if (queues)
         p('import { processBatch } from "louise-toolkit/queues";');
     // Only when a route actually takes a runner—a project with no AI assists
@@ -227,6 +232,7 @@ export function generateAstroidWorker(config) {
         "setAstroidMediaBase",
         ...(inquiries ? ["sendInquiryMail"] : []),
         ...(queues ? ["type AstroidQueueMessage"] : []),
+        ...(config.incidents?.sentry ? ["sentryIncidents", "type SecretSource"] : []),
     ].sort();
     p(`import { ${astroidImports.join(", ")} } from "astroidjs";`);
     // The config lives at the PROJECT ROOT (create-astroid writes it there); this
@@ -472,6 +478,7 @@ export function generateAstroidWorker(config) {
     p("  return new Response(obj.body, { headers });");
     p("};");
     p();
+    emitIncidentPreamble(p, config, queues);
     // The queue message type parameter is what gives the `queue` consumer below a
     // typed `MessageBatch` instead of `MessageBatch<unknown>`.
     p(queues
@@ -507,13 +514,9 @@ export function generateAstroidWorker(config) {
     p("    // An editor never reads from, and never writes to, the shared entry.");
     p("    bypass: isEditRequest,");
     p("  }),");
-    if (queues) {
-        p("  // Queue consumer. `processBatch` acks or retries each message");
-        p("  // INDEPENDENTLY, so one poisoned message can't block the rest of the");
-        p("  // batch from acking; Cloudflare routes it to the DLQ once it exceeds");
-        p("  // max_retries (see wrangler.jsonc).");
-        p("  queue: (batch, env) => processBatch(batch, (message) => handleQueueMessage(env, message)),");
-    }
+    emitIncidentOption(p, config);
+    if (queues)
+        emitQueueOption(p, config);
     // ONE scheduled handler for every cron, dispatching on `controller.cron`.
     // Cloudflare gives no other way to tell them apart, and the strings here have
     // to match `astroidCrons` exactly—which is why both read the same constants
@@ -564,6 +567,118 @@ export function generateAstroidWorker(config) {
     }
     return lines.join("\n");
 }
+/**
+ * The worker of an app with no editor (`editor: false`): the public status
+ * route, the SSR fallback, and whatever the config's modules add (a queue
+ * consumer, the crons), with no editor route and no auth seam.
+ *
+ * The gate stays, with a resolver that never finds an editor. Nothing under
+ * `/api/louise` belongs to one here, so it refuses everything there except the
+ * public status probe, and it gives route responses the security headers the
+ * middleware never sees.
+ */
+function generateAppWorker(config) {
+    const queues = astroidUsesQueues(config);
+    const cron = astroidCron(config);
+    const customCrons = config.crons ?? [];
+    const scheduled = cron !== null || customCrons.length > 0;
+    const lines = [];
+    const p = (s = "") => lines.push(s);
+    p("// Generated by astroidjs—do not hand-edit.");
+    p("// Source: your defineAstroid config. This app has no editor (`editor: false`),");
+    p("// so it serves no editor routes and resolves no editor session.");
+    p('import { handle } from "@astrojs/cloudflare/handler";');
+    p('import { d1Check, statusRoute } from "louise-toolkit/editor";');
+    p(incidentsImport(queues));
+    if (queues)
+        p('import { processBatch } from "louise-toolkit/queues";');
+    p('import { composeWorker, type WorkerRoute, withEdgeCache } from "louise-toolkit/worker";');
+    const astroidImports = [
+        ...(queues ? ["type AstroidQueueMessage"] : []),
+        ...(config.incidents?.sentry ? ["sentryIncidents", "type SecretSource"] : []),
+    ].sort();
+    if (astroidImports.length > 0) {
+        const typeOnly = astroidImports.every((name) => name.startsWith("type "));
+        p(typeOnly
+            ? `import type { ${astroidImports.map((name) => name.slice(5)).join(", ")} } from "astroidjs";`
+            : `import { ${astroidImports.join(", ")} } from "astroidjs";`);
+    }
+    if (config.status?.checks) {
+        p("// Your STATUS seam: the app's own checks for the public status route.");
+        p("// Scaffolded once and yours to edit.");
+        p('import { statusChecks } from "./status-checks.js";');
+    }
+    if (queues) {
+        p("// Your QUEUE seam: what each message actually does. Scaffolded once and");
+        p("// yours to edit.");
+        p('import { handleQueueMessage } from "./queue.js";');
+    }
+    p();
+    p("// --- public status ---------------------------------------------------------");
+    p("// What statusRoute answers an outside probe with: 200 when every check");
+    p("// passes, 503 when any fails, throws, or takes over two seconds. Anyone can");
+    p("// make these run, so each is one cheap read, and a burst of probes reuses one");
+    p("// result per isolate for STATUS_REUSE_MS.");
+    p("const STATUS_REUSE_MS = 10_000;");
+    p("const STATUS_CHECKS = {");
+    p("  // D1 answers `SELECT 1`.");
+    p("  d1: d1Check((env: CloudflareEnv) => env.DB),");
+    if (config.status?.checks) {
+        p("  // The app's own, from src/status-checks.ts. Spread last, so a check with");
+        p("  // the same name replaces Astroid's on purpose.");
+        p("  ...statusChecks,");
+    }
+    p("};");
+    p();
+    p("const routes: WorkerRoute<CloudflareEnv>[] = [");
+    p("  // Public status for an outside probe (GET/HEAD /api/louise/status). A");
+    p("  // publicRoute, so the gate below lets an anonymous probe through.");
+    p("  statusRoute({ checks: STATUS_CHECKS, reuseMs: STATUS_REUSE_MS }),");
+    p("];");
+    p();
+    emitIncidentPreamble(p, config, queues);
+    p(queues
+        ? "export default composeWorker<CloudflareEnv, AstroidQueueMessage>({"
+        : "export default composeWorker<CloudflareEnv>({");
+    p("  routes,");
+    p("  // No editor, so no request under /api/louise resolves to one. The gate");
+    p("  // refuses everything there except the public status probe, and gives route");
+    p("  // responses the security headers the middleware never sees.");
+    p("  gate: { resolveEditor: () => null },");
+    p("  // The SSR fallback, in the Worker cache (ADR 0004). It stores only a");
+    p("  // response that opts in with `Astro.cache.set(...)`, and it strips the CDN");
+    p("  // directive from every other one, so Cloudflare's cookie-blind edge cache");
+    p("  // never stores a signed-in customer's page.");
+    p("  fetch: withEdgeCache((request, env, ctx) => handle(request, env, ctx)),");
+    emitIncidentOption(p, config);
+    if (queues)
+        emitQueueOption(p, config);
+    if (scheduled) {
+        p("  // Cron. Cloudflare fires this for EVERY trigger in wrangler.jsonc and");
+        p("  // identifies which by `controller.cron`, so dispatch on it.");
+        p("  scheduled: (controller, env, ctx) => {");
+        if (cron) {
+            p(`    if (controller.cron === ${JSON.stringify(cron)}) {`);
+            p("      // Catalog safety net: a missed webhook leaves the catalog stale only");
+            p("      // until the next tick. Enqueued, so it takes the retry + DLQ path.");
+            p('      ctx.waitUntil(env.COMMERCE_QUEUE.send({ kind: "catalog_refresh" }));');
+            p("      return;");
+            p("    }");
+        }
+        for (const custom of customCrons) {
+            p(`    if (controller.cron === ${JSON.stringify(custom.expression)}) {`);
+            p("      // Enqueued, not run inline: same retry + DLQ path as everything");
+            p("      // else, and a slow job can't hold the scheduled handler open.");
+            p(`      ctx.waitUntil(env.COMMERCE_QUEUE.send(${JSON.stringify(custom.message)}));`);
+            p("      return;");
+            p("    }");
+        }
+        p("  },");
+    }
+    p("});");
+    p();
+    return lines.join("\n");
+}
 /**
  * Generate the Astro middleware (`middleware.ts`) from an Astroid config: the
  * shared Louise flow (rate-limit the unauthenticated POST surface → resolve editor
@@ -592,6 +707,8 @@ export function generateAstroidMiddleware(config) {
     // origins (the Square SDK's stylesheet) are baked in here; `astroid build`
     // regenerates this file, so a config change lands on the next deploy.
     const cspStyleSrc = astroidCspStyleSrc(config);
+    // An app with no editor has no auth seam and no pages to redirect between.
+    const editor = astroidHasEditor(config);
     const portal = astroidPortal(config);
     const tenancy = config.tenancy;
     const rewritePrefix = tenancy?.rewritePrefix ?? ASTROID_TENANT_PREFIX;
@@ -599,13 +716,17 @@ export function generateAstroidMiddleware(config) {
     return [
         "// Generated by astroidjs—do not hand-edit.",
         "// The shared Louise middleware: rate-limit the unauthenticated POST surfaces,",
-        "// then resolve the editor session + sticky ?louise edit mode, then apply",
+        ...(editor
+            ? ["// then resolve the editor session + sticky ?louise edit mode, then apply"]
+            : ["// then (this app has no editor, so there's no session to resolve) apply"]),
         "// content-freshness + transport-security headers, and rewrite the style-src of",
         "// the CSP header Astro's security.csp emits so Louise's data-driven inline",
         "// styles + inlined data: brand font are allowed.",
         'import { env } from "cloudflare:workers";',
         'import { createLouiseMiddleware } from "@louise-toolkit/astro";',
-        'import { db, pageRedirects, resolvePageRedirect } from "louise-toolkit/db";',
+        ...(editor
+            ? ['import { db, pageRedirects, resolvePageRedirect } from "louise-toolkit/db";']
+            : []),
         // One `astroidjs` import, composed from what this config actually uses—two
         // import statements for the same module is legal and reads as an
         // oversight in a file nobody is supposed to hand-edit.
@@ -623,15 +744,21 @@ export function generateAstroidMiddleware(config) {
                 'import { resolveTenant } from "./tenancy.js";',
             ]
             : []),
-        "// TODO(astroid): your AUTH seam—same resolveEditor as the generated worker.ts.",
-        'import { resolveEditor } from "./auth.js";',
+        ...(editor
+            ? [
+                "// TODO(astroid): your AUTH seam—same resolveEditor as the generated worker.ts.",
+                'import { resolveEditor } from "./auth.js";',
+            ]
+            : []),
         // The portal's resolver lives in its OWN module, not the editor's auth
         // seam—they're separate Better Auth instances and must not share a file.
         ...(portal ? ['import { resolvePortalUser } from "./portal-auth.js";'] : []),
         "",
         "// Rate-limit the public, unauthenticated POST surface, keyed by client IP",
         "// (fixed-window KV counter that fails open). Derived from your config: the",
-        "// editor magic-link always, plus the portal credential surfaces and checkout",
+        ...(editor
+            ? ["// editor magic-link always, plus the portal credential surfaces and checkout"]
+            : ["// versioned API under /api/v1, plus the portal credential surfaces and checkout"]),
         "// when those are enabled. Add your own via `security.rateRules` in the config—",
         "// they're matched first, so they can also override a default's budget.",
         "// `env.RL` is read per request (a getter)—a KV binding is only valid in",
@@ -657,15 +784,27 @@ export function generateAstroidMiddleware(config) {
             : []),
         "",
         "export const onRequest = createLouiseMiddleware({",
-        "  resolveEditor: (request) => resolveEditor(request),",
+        ...(editor
+            ? ["  resolveEditor: (request) => resolveEditor(request),"]
+            : [
+                "  // No editor (`editor: false`), so no request resolves to one and edit",
+                "  // mode never turns on.",
+                "  resolveEditor: () => null,",
+            ]),
         "  rateLimit: { rules: RATE_RULES, kv: () => env.RL },",
         "  // The same deny-by-default gate for /api/louise routes that reach Astro—",
         "  // anything the worker's routes didn't answer. A second check behind the",
-        "  // worker's gate, and free: the editor is resolved here on every request.",
+        editor
+            ? "  // worker's gate, and free: the editor is resolved here on every request."
+            : "  // worker's gate: with no editor, it refuses all but the public routes.",
         "  apiGate: true,",
-        "  // A renamed page's old URL answers a 301 to the new one. It runs only after",
-        "  // the page answered 404, so a page later created on the old path wins.",
-        "  redirectFor: (path) => resolvePageRedirect(db(env.DB), pageRedirects, path),",
+        ...(editor
+            ? [
+                "  // A renamed page's old URL answers a 301 to the new one. It runs only after",
+                "  // the page answered 404, so a page later created on the old path wins.",
+                "  redirectFor: (path) => resolvePageRedirect(db(env.DB), pageRedirects, path),",
+            ]
+            : []),
         // `extend` runs once and may need to populate BOTH—a tenanted site with a
         // portal resolves a tenant and a customer on the same request.
         ...(portal || tenancy
@@ -765,3 +904,78 @@ export function generateAstroidMiddleware(config) {
         "",
     ].join("\n");
 }
+/** The `louise-toolkit/incidents` import both worker shapes emit. */
+function incidentsImport(queues) {
+    const names = ["analyticsIncidents", "d1Incidents", ...(queues ? ["deadLetterConsumer"] : [])];
+    return `import { ${names.join(", ")} } from "louise-toolkit/incidents";`;
+}
+/**
+ * The declarations incident capture needs ahead of `composeWorker`, shared by
+ * both shapes (louise-toolkit ADR 0022). Its bindings are read through a local
+ * type rather than `CloudflareEnv`, because `src/env.d.ts` is scaffold-once: a
+ * site made before them still type-checks, and each sink skips what isn't bound.
+ */
+function emitIncidentPreamble(p, config, queues) {
+    p("// --- incidents --------------------------------------------------------------");
+    p("// Every failure this worker sees becomes an incident: counted into the site's");
+    p("// own D1 (the `incidents` table), and into Analytics Engine for counts over");
+    p("// time (louise-toolkit ADR 0022). These bindings are optional. A site whose");
+    p("// wrangler.jsonc predates them still type-checks, and a sink skips what isn't");
+    p("// bound.");
+    p("type IncidentBindings = {");
+    p(`  ${ASTROID_INCIDENT_EVENTS_BINDING}?: AnalyticsEngineDataset;`);
+    p(`  ${ASTROID_VERSION_METADATA_BINDING}?: WorkerVersionMetadata;`);
+    if (config.incidents?.sentry)
+        p(`  ${ASTROID_SENTRY_DSN_BINDING}?: SecretSource;`);
+    p("};");
+    p("const incidentBindings = (env: CloudflareEnv) => env as CloudflareEnv & IncidentBindings;");
+    if (queues) {
+        const { dlq } = astroidQueueNames(config);
+        p("// The dead-letter queue's consumer: it keeps each message the queue gave up on");
+        p("// in the `dead_letters` table, counts it as an incident, and acks it, so a");
+        p("// failed webhook event is never lost unseen.");
+        p(`const DEAD_LETTER_QUEUE = ${JSON.stringify(dlq)};`);
+        p("const keepDeadLetters = deadLetterConsumer<CloudflareEnv, AstroidQueueMessage>(");
+        p("  (env) => env.DB,");
+        p(");");
+    }
+    p();
+}
+/** The `onIncident` option both shapes pass `composeWorker`. */
+function emitIncidentOption(p, config) {
+    const critical = config.incidents?.critical ?? [];
+    p("  // Incident capture (louise-toolkit ADR 0022). A throw is reported, then");
+    p("  // re-thrown, so responses don't change; the sinks run after the response.");
+    p("  onIncident: {");
+    p("    sinks: [");
+    p("      // The record: one row per failure, with a count, in the site's own D1.");
+    p("      d1Incidents((env: CloudflareEnv) => env.DB),");
+    p(`      analyticsIncidents((env: CloudflareEnv) => incidentBindings(env).${ASTROID_INCIDENT_EVENTS_BINDING}),`);
+    if (config.incidents?.sentry) {
+        p("      // A copy for the operator's issue system, with the stack. Dormant until");
+        p(`      // the ${ASTROID_SENTRY_DSN_BINDING} secret holds a real DSN.`);
+        p(`      sentryIncidents((env: CloudflareEnv) => incidentBindings(env).${ASTROID_SENTRY_DSN_BINDING}, { site: ${JSON.stringify(config.key)} }),`);
+    }
+    p("    ],");
+    if (critical.length > 0) {
+        p("    // What alerts, from `incidents.critical` in your config.");
+        p(`    critical: ${JSON.stringify(critical)},`);
+    }
+    p(`    release: (env) => incidentBindings(env).${ASTROID_VERSION_METADATA_BINDING}?.id,`);
+    p("  },");
+}
+/** The queue consumer both shapes emit: the dead-letter queue's batches to its
+ *  consumer, and the rest through `processBatch`, which reports a message's
+ *  last failed delivery as an incident. */
+function emitQueueOption(p, config) {
+    p("  // Queue consumer. `processBatch` acks or retries each message");
+    p("  // INDEPENDENTLY, so one poisoned message can't block the rest of the");
+    p("  // batch; Cloudflare routes it to the DLQ once it exceeds max_retries,");
+    p("  // which `maxRetries` matches, so its last failure counts as an incident.");
+    p("  queue: (batch, env, ctx) =>");
+    p("    batch.queue === DEAD_LETTER_QUEUE");
+    p("      ? keepDeadLetters(batch, env, ctx)");
+    p("      : processBatch(batch, (message) => handleQueueMessage(env, message), {");
+    p(`          maxRetries: ${config.queues?.maxRetries ?? 5},`);
+    p("        }),");
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "astroidjs",
-  "version": "0.19.0",
+  "version": "0.21.0",
   "description": "Astroid — an opinionated meta-framework over Louise Toolkit and Astro for building editable, multi-editor sites on Cloudflare Workers.",
   "keywords": [
     "astro",
@@ -37,6 +37,11 @@
       "import": "./dist/astro/index.js",
       "default": "./dist/astro/index.js"
     },
+    "./pages": {
+      "types": "./dist/pages/index.d.ts",
+      "import": "./dist/pages/index.js",
+      "default": "./dist/pages/index.js"
+    },
     "./components/*.astro": "./src/components/*.astro",
     "./components/Collection": {
       "types": "./src/components/Collection.tsx",
@@ -64,14 +69,16 @@
     "@typescript/native-preview": "7.0.0-dev.20260707.2",
     "@vitest/coverage-v8": "4.1.11",
     "astro": "^7.2.9",
-    "louise-toolkit": "^0.36.0",
+    "drizzle-orm": "^0.45.2",
+    "louise-toolkit": "^0.37.0",
     "solid-js": "^1.9.15",
     "typescript": "^6.0.3",
     "vitest": "^4.1.11"
   },
   "peerDependencies": {
     "astro": "^7.0.9",
-    "louise-toolkit": "^0.36.0",
+    "drizzle-orm": "^0.45.0",
+    "louise-toolkit": "^0.37.0",
     "solid-js": "^1.9.0"
   },
   "peerDependenciesMeta": {