astroidjs 0.2.0 → 0.3.0

package/dist/auth/index.d.ts

@@ -0,0 +1,27 @@
+import type { AstroidConfig } from "../config.js";
+/**
+ * The editor Better Auth instance's table prefix — `louise_user`,
+ * `louise_session`, … The unprefixed names are left free for a second (portal)
+ * instance. Consumed by the generated `editorsRoute` and mirrored by the
+ * scaffolded `src/auth.ts` (`getLouiseAuth({ tablePrefix })`) + its migration.
+ */
+export declare const ASTROID_EDITOR_TABLE_PREFIX = "louise_";
+/**
+ * The editor instance keeps Better Auth's default cookie prefix (the Louise
+ * editor client is built against it). Named here so the isolation guard can
+ * reject a portal that would collide with it.
+ */
+export declare const ASTROID_EDITOR_COOKIE_PREFIX = "better-auth";
+/** The editor's Better Auth table name for a given model (e.g. `louise_user`). */
+export declare function astroidEditorTable(model: string): string;
+/**
+ * Reject a portal whose isolation would collide with the editor instance on the
+ * same origin. Called from `defineAstroid`. A no-op when there is no portal.
+ *
+ * The two dangerous overlaps:
+ *  - a shared cookie prefix → signing into one instance signs you out of the
+ *    other (the intermittent-prod-logout the fixed defaults exist to prevent);
+ *  - a shared table prefix → the two instances read/write one `user` table, so
+ *    an editor and a customer can become the same account.
+ */
+export declare function assertAuthIsolation(config: AstroidConfig): void;

package/dist/auth/index.js

@@ -0,0 +1,59 @@
+// Copyright (c) 2026 BowenLabs. Astroid is MIT licensed.
+//
+// Editor-auth convention + the two-instance isolation guard.
+//
+// Astroid runs up to TWO Better Auth instances on one origin: the EDITOR (the
+// studio — magic-link + passkey, a DB-managed admin allowlist) and, optionally, a
+// second PORTAL instance (customers/members/a shop account — see `portal/`). The
+// editor owns Better Auth's default mount (`/api/auth`) and cookie because the
+// Louise editor client hardcodes them; its tables are namespaced with the
+// `louise_` prefix so a second instance can take the unprefixed `user`/`session`
+// tables without collision. The portal is the one that MOVES — a distinct mount,
+// cookie prefix, and (by default) table prefix.
+//
+// The failure this guards against is subtle and intermittent: two instances that
+// share a cookie prefix silently sign you out of one when you sign into the other,
+// in production, looking like a session bug rather than a config one. So the
+// isolation is asserted at config load, naming the collision.
+import { AstroidConfigError } from "../errors.js";
+import { astroidPortal } from "../portal/config.js";
+/**
+ * The editor Better Auth instance's table prefix — `louise_user`,
+ * `louise_session`, … The unprefixed names are left free for a second (portal)
+ * instance. Consumed by the generated `editorsRoute` and mirrored by the
+ * scaffolded `src/auth.ts` (`getLouiseAuth({ tablePrefix })`) + its migration.
+ */
+export const ASTROID_EDITOR_TABLE_PREFIX = "louise_";
+/**
+ * The editor instance keeps Better Auth's default cookie prefix (the Louise
+ * editor client is built against it). Named here so the isolation guard can
+ * reject a portal that would collide with it.
+ */
+export const ASTROID_EDITOR_COOKIE_PREFIX = "better-auth";
+/** The editor's Better Auth table name for a given model (e.g. `louise_user`). */
+export function astroidEditorTable(model) {
+    return `${ASTROID_EDITOR_TABLE_PREFIX}${model}`;
+}
+/**
+ * Reject a portal whose isolation would collide with the editor instance on the
+ * same origin. Called from `defineAstroid`. A no-op when there is no portal.
+ *
+ * The two dangerous overlaps:
+ *  - a shared cookie prefix → signing into one instance signs you out of the
+ *    other (the intermittent-prod-logout the fixed defaults exist to prevent);
+ *  - a shared table prefix → the two instances read/write one `user` table, so
+ *    an editor and a customer can become the same account.
+ */
+export function assertAuthIsolation(config) {
+    const portal = astroidPortal(config);
+    if (!portal)
+        return;
+    if (!portal.cookiePrefix || portal.cookiePrefix === ASTROID_EDITOR_COOKIE_PREFIX) {
+        throw new AstroidConfigError(`portal.cookiePrefix must be set and distinct from the editor's (${JSON.stringify(ASTROID_EDITOR_COOKIE_PREFIX)}). Two instances sharing a cookie prefix silently sign you out of one when ` +
+            "you sign into the other. Pick a project-specific prefix (e.g. \"acme_shop\").");
+    }
+    if (portal.tablePrefix === ASTROID_EDITOR_TABLE_PREFIX) {
+        throw new AstroidConfigError(`portal.tablePrefix must differ from the editor's (${JSON.stringify(ASTROID_EDITOR_TABLE_PREFIX)}) — a shared table prefix merges the two instances into one user table. ` +
+            'Leave it unset (the unprefixed `user`/`session` tables) or use a distinct prefix.');
+    }
+}

package/dist/commerce/mirror.d.ts

@@ -12,13 +12,15 @@ export interface OwnedColumn {
 export interface CatalogMirrorConfig {
     /**
      * `mirror` keeps the provider's catalog fields in D1 (fast reads, briefly
-     * stale); `overlay` keeps only the owner's fields and reads the catalog live.
-     * Default `mirror`.
+     * stale); `overlay` keeps only the owner's fields and reads the catalog live;
+     * `live` manages no catalog table at all (the site owns any overlay table and
+     * reads the catalog live from a cache). Default `mirror`.
      */
-    mode?: "mirror" | "overlay";
-    /** Table name. Default `products`. */
+    mode?: "mirror" | "overlay" | "live";
+    /** Table name. Default `products`. Ignored in `live` mode (no table). */
     table?: string;
-    /** The owner-editable columns, on top of the built-ins below. */
+    /** The owner-editable columns, on top of the built-ins below. Ignored in
+     *  `live` mode (the overlay table, if any, is the site's own). */
     owned?: Record<string, OwnedColumn>;
 }
 /**

package/dist/commerce/mirror.js

@@ -14,13 +14,18 @@
 //
 //   mirror   — pulled + owned columns both live in D1 (themidwestartist.com).
 //              Reads are one local query. The catalog can be stale between syncs.
-//   overlay  — only the owned columns live in D1, keyed by the provider's id
-//              (coracle.coffee's `product_display_meta`). The catalog is read
-//              live from the provider and joined at read time: never stale,
-//              but every read costs a provider round-trip (cache accordingly).
+//   overlay  — only the owned columns live in D1, keyed by the provider's id.
+//              The catalog is read live from the provider and joined at read
+//              time: never stale, but every read costs a provider round-trip
+//              (cache accordingly).
+//   live     — Astroid manages NO catalog table at all: the catalog is read live
+//              from the provider (cached), and any owner-side overlay table is
+//              the SITE's own (coracle.coffee's `product_display_meta`, declared
+//              in schema.site.ts and joined in the site's loader). Use when the
+//              existing overlay shape predates Astroid and must be preserved 1:1.
 //
-// `overlay` is just `mirror` with an empty pulled set, so one generator serves
-// both and a project can switch by changing one word.
+// `overlay` is just `mirror` with an empty pulled set; `live` emits neither table
+// nor migration. One generator serves all three and a project switches by one word.
 /**
  * Columns Astroid always PULLS, overwriting each sync. Fixed rather than
  * configurable because they're the intersection of what every provider returns —
@@ -101,6 +106,9 @@ export function generateCatalogTable(config) {
     if (!config.commerce)
         return null;
     const { mode, table, owned } = astroidCatalogMirror(config);
+    // `live` mode: Astroid manages no catalog table (the site owns any overlay).
+    if (mode === "live")
+        return null;
     const lines = [];
     const p = (s = "") => lines.push(s);
     p(`// The catalog ${mode}. The provider is the source of truth; these rows are`);
@@ -177,6 +185,9 @@ export function generateCatalogMigrationSql(config) {
     if (!config.commerce)
         return null;
     const { mode, table, owned } = astroidCatalogMirror(config);
+    // `live` mode: no Astroid-managed table, so no migration.
+    if (mode === "live")
+        return null;
     const cols = [
         "  `id` integer PRIMARY KEY AUTOINCREMENT NOT NULL",
         "  `external_id` text NOT NULL",

package/dist/config.d.ts

@@ -1,3 +1,4 @@
+import type { SectionCatalog } from "louise-toolkit/content";
 import type { RateRule } from "louise-toolkit/security";
 import type { CatalogMirrorConfig } from "./commerce/mirror.js";
 import type { astroidSectionCatalog } from "./components/sections.js";
@@ -119,6 +120,26 @@ export interface Portal {
      * accounts by hand, and a portal is usually for people you already know.
      */
     signUp?: boolean;
+    /**
+     * Where the portal's Better Auth instance mounts — its own handler, separate
+     * from the editor's `/api/auth`. Default `/api/portal-auth`. Override when a
+     * site already ships a second instance at a different path (e.g. a shop
+     * account at `/api/shop-auth`) whose live cookies must not change.
+     */
+    basePath?: string;
+    /**
+     * Cookie prefix for the portal instance — MUST differ from the editor's
+     * (Better Auth's default), or signing into one instance signs you out of the
+     * other. Default `"portal"`. `defineAstroid` rejects a colliding value.
+     */
+    cookiePrefix?: string;
+    /**
+     * Table-name prefix for the portal's Better Auth tables. Default `"portal_"`
+     * (`portal_user`, …); set `""` to take the unprefixed `user`/`session` tables
+     * (the editor owns `louise_*`, so they don't collide). MUST differ from the
+     * editor's `louise_` prefix.
+     */
+    tablePrefix?: string;
 }
 export interface CommerceConfig {
     /**
@@ -203,6 +224,29 @@ export interface CspOrigins {
     img?: string[];
     worker?: string[];
 }
+export interface SettingsConfig {
+    /**
+     * Override the editable base `site_settings` columns. Defaults to Astroid's
+     * standard set (`ASTROID_SETTINGS_COLUMNS`). A **custom-heavy** site whose
+     * settings shape doesn't align with the base column names keeps everything in
+     * `custom` by passing `[]` — otherwise a key that happens to match a base
+     * column name (e.g. `contactEmail`) would route to that column instead of
+     * `custom`, where the site's render reads it.
+     */
+    columns?: string[];
+    /**
+     * Site-specific settings keys stored in the `site_settings.custom` JSON column,
+     * on top of (or, with `columns: []`, instead of) Astroid's base columns. The
+     * generated `settingsRoute` + Action accept these; the Settings panel writes
+     * them through the `settingsExtension` groups a site supplies to
+     * `mountSettings`. A site with a rich settings shape (coracle's footer columns,
+     * hours table, ui strings, shop/order config) lists their top-level keys here.
+     */
+    customKeys?: string[];
+    /** Extra media-library image keys beyond the base logo/favicon/OG defaults —
+     *  settings values validated as media-library URLs on write. */
+    imageKeys?: string[];
+}
 export interface DeployConfig {
     platform: "cloudflare";
     /** Media base for R2 + `cf-image` resizing — matches Louise's media route
@@ -223,6 +267,17 @@ export interface AstroidConfig {
     theme: Theme;
     /** The editable home page, top to bottom. Omit to take the archetype default. */
     sections?: SectionKind[];
+    /**
+     * A site-provided section catalog that REPLACES the built-in one for
+     * SERVER-side validation + sanitization of `pages.sections` (the generated
+     * pages route + versions route). A site with bespoke section designs — its own
+     * `.astro` components and field defs (coracle's 13 sections) — registers them
+     * here so writes to its custom `_type`s validate instead of 422-ing against the
+     * built-in vocabulary. The on-canvas editor already uses the site's catalog
+     * (its `mountSections` call passes it); this closes the server half so both
+     * write paths agree. Omit to use Astroid's built-in catalog.
+     */
+    sectionCatalog?: SectionCatalog;
     /** Optional capabilities switched on for this site. */
     modules?: ModuleKind[];
     /** Gated account/portal area (order tracking, client galleries). */
@@ -235,6 +290,16 @@ export interface AstroidConfig {
     seo?: SeoConfig;
     /** Additions to the rate-limit rules + CSP origins Astroid derives. */
     security?: SecurityConfig;
+    /** Site-specific editable settings — extra `custom` keys + image keys on top
+     *  of Astroid's base `site_settings` columns. */
+    settings?: SettingsConfig;
+    /**
+     * Force the contact form + `inquiries` table on or off. Omit to detect from
+     * the config (a `contact` section, or a wholesale-inquiry module). Set `true`
+     * when a bespoke section captures inquiries under a name Astroid can't see
+     * (coracle's custom `contactForm`); set `false` to suppress it entirely.
+     */
+    inquiries?: boolean;
     /** Installable-app settings. Only read when `modules` includes `"pwa"`. */
     pwa?: PwaConfig;
     deploy?: DeployConfig;

package/dist/config.js

@@ -19,6 +19,7 @@
 // `ModuleKind` are extracted from the real sites Astroid targets — a storefront
 // (coracle), a wholesale front (ghostfire), an artist portfolio (megbowen), and a
 // plain marketing baseline (louise-web).
+import { assertAuthIsolation } from "./auth/index.js";
 import { assertCommerceRoles } from "./commerce/roles.js";
 import { AstroidConfigError } from "./errors.js";
 /**
@@ -74,6 +75,11 @@ export function defineAstroid(config) {
     // Fourthwall, a storefront over Stripe) fails here rather than at runtime on
     // the first invoice, as a missing function.
     assertCommerceRoles(config.commerce);
+    // A portal is a SECOND Better Auth instance beside the editor's. Reject any
+    // isolation that would collide with the editor on the same origin (a shared
+    // cookie prefix silently cross-signs-out; a shared table prefix merges the two
+    // user tables) — the intermittent-prod failure the fixed defaults prevent.
+    assertAuthIsolation(config);
     // `portal.gated` is declared and resolved but read by NOTHING — the guard
     // table is built from `portal.routes` alone, and `portalGuard` allows any
     // unmatched path. So a site that set it believed the whole site sat behind a

package/dist/index.d.ts

@@ -1,4 +1,5 @@
 export * from "./analytics/index.js";
+export * from "./auth/index.js";
 export * from "./commerce/index.js";
 export * from "./config.js";
 export * from "./email/index.js";

package/dist/index.js

@@ -4,6 +4,7 @@
 // Public entry. The configuration surface (`defineAstroid`) is the first
 // inhabitant; the generator, theme system, and section library follow.
 export * from "./analytics/index.js";
+export * from "./auth/index.js";
 export * from "./commerce/index.js";
 export * from "./config.js";
 export * from "./email/index.js";

package/dist/portal/config.js

@@ -26,9 +26,15 @@ export function astroidPortal(config) {
     const roles = portal.roles?.length ? portal.roles : ["customer"];
     return {
         enabled: true,
-        basePath: ASTROID_PORTAL_BASE_PATH,
-        cookiePrefix: ASTROID_PORTAL_COOKIE_PREFIX,
-        tablePrefix: ASTROID_PORTAL_TABLE_PREFIX,
+        // Isolation is configurable so a site with an existing second instance
+        // (coracle's shop account at /api/shop-auth, cookie `coracle_shop`, the
+        // unprefixed `user` tables) keeps its live mount + cookies unchanged. The
+        // defaults stay the safe distinct-from-editor values; `defineAstroid`'s
+        // `assertAuthIsolation` rejects a resolved value that collides with the
+        // editor. `?? ""` is respected for tablePrefix (empty = unprefixed tables).
+        basePath: portal.basePath ?? ASTROID_PORTAL_BASE_PATH,
+        cookiePrefix: portal.cookiePrefix ?? ASTROID_PORTAL_COOKIE_PREFIX,
+        tablePrefix: portal.tablePrefix ?? ASTROID_PORTAL_TABLE_PREFIX,
         roles,
         defaultRole: roles[0],
         routes: portal.routes?.length ? portal.routes : DEFAULT_ROUTES,

package/dist/portal/guard.d.ts

@@ -1,5 +1,11 @@
-/** A signed-in portal user, as far as the guard is concerned. */
+/** A signed-in portal user. The guard only reads `role`; `id` + `email` are the
+ *  universal identity fields every instance resolves, typed so consumers
+ *  (`locals.portalUser`) read them without a cast. Anything else a project's
+ *  resolver returns (name, phone, a linked commerce id) is reachable via the
+ *  index signature. */
 export interface PortalUser {
+    id: string;
+    email: string;
     role: string;
     [key: string]: unknown;
 }

package/dist/project/actions.d.ts

@@ -1,3 +1,3 @@
 import type { AstroidConfig } from "../config.js";
 /** `src/actions/index.ts` — the typed mutation surface, scaffolded once. */
-export declare function generateAstroidActions(_config: AstroidConfig): string;
+export declare function generateAstroidActions(config: AstroidConfig): string;

package/dist/project/actions.js

@@ -16,7 +16,23 @@
 // pre-wired against the same tables and the same collection config the generated
 // worker uses.
 /** `src/actions/index.ts` — the typed mutation surface, scaffolded once. */
-export function generateAstroidActions(_config) {
+export function generateAstroidActions(config) {
+    const customKeys = config.settings?.customKeys ?? [];
+    const extraImageKeys = config.settings?.imageKeys ?? [];
+    const columnsOverride = config.settings?.columns;
+    // Kept in step with the generated worker's settingsRoute: site-specific keys go
+    // to site_settings.custom, extra image keys widen the media-strict set, a
+    // custom-heavy site can override the base columns. Emitted as literals only
+    // when present, so a stock project's Action is unchanged.
+    const settingsExtra = [
+        columnsOverride
+            ? `        columns: ${JSON.stringify(columnsOverride)},`
+            : "        columns: ASTROID_SETTINGS_COLUMNS,",
+        ...(customKeys.length ? [`        customKeys: ${JSON.stringify(customKeys)},`] : []),
+        extraImageKeys.length
+            ? `        imageKeys: [...ASTROID_SETTINGS_IMAGE_KEYS, ...${JSON.stringify(extraImageKeys)}],`
+            : "        imageKeys: ASTROID_SETTINGS_IMAGE_KEYS,",
+    ];
     return [
         "// The typed Astro Actions surface — ADR 0001 layer 2.",
         "//",
@@ -94,8 +110,7 @@ export function generateAstroidActions(_config) {
         "        // The SAME allowlist the generated worker enforces, imported rather",
         "        // than copied — a second literal here is a list that drifts from the",
         "        // one the routes check against, and nothing would fail when it did.",
-        "        columns: ASTROID_SETTINGS_COLUMNS,",
-        "        imageKeys: ASTROID_SETTINGS_IMAGE_KEYS,",
+        ...settingsExtra,
         '        mediaBase: astroidConfig.deploy?.mediaBase ?? "/media",',
         "      }),",
         "    ),",

package/dist/project/scaffold.js

@@ -30,6 +30,7 @@ import { generateAstroidActions } from "./actions.js";
 import { cwvBeaconScript } from "louise-toolkit/analytics";
 import { generateMapEmbedComponent, generateMapTileRoute } from "../map/scaffold.js";
 import { generateAstroidGalleryPage } from "../portfolio/scaffold.js";
+import { astroidPortal } from "../portal/config.js";
 import { generateAstroidPortalAuth, generateAstroidPortalAuthRoute } from "../portal/scaffold.js";
 import { generateAstroidEditSession } from "../realtime/scaffold.js";
 import { generatePwaHeaders, generateServiceWorker, generateWebManifest } from "../pwa/generate.js";
@@ -58,6 +59,23 @@ export function generateAstroidScaffoldFiles(config) {
     // be hashed into the CSP and would be blocked.
     const beacon = generateAstroidVitalsBeacon(config, cwvBeaconScript());
     files.push({ path: beacon.path, contents: beacon.contents });
+    // --- site-owned schema tables --------------------------------------------
+    // Always: the generated src/schema.ts re-exports `./schema.site.js`, so the
+    // file must exist even when empty. A project declares tables Astroid doesn't
+    // manage here (an existing overlay predating Astroid, a redirects map, a
+    // customer address book) and they flow to drizzle-kit + the worker for free.
+    files.push({
+        path: "src/schema.site.ts",
+        contents: [
+            "// Site-owned Drizzle tables — the ones Astroid doesn't manage. Declare them",
+            "// here; the generated src/schema.ts re-exports everything from this file, so",
+            "// drizzle-kit sees them and the worker can import them. Empty by default.",
+            "//",
+            "// e.g.  export const redirects = sqliteTable(\"redirects\", { … });",
+            "export {};",
+            "",
+        ].join("\n"),
+    });
     // --- the typed Astro Actions surface --------------------------------------
     // Always: every project has editable pages, and the routes alone leave the
     // Astro-native half of ADR 0001 unbuilt. Scaffold-once because it is meant to
@@ -133,8 +151,16 @@ export function generateAstroidScaffoldFiles(config) {
         // Always non-null alongside portalAuth (same `astroidPortal` gate), but the
         // types don't know that and a silent drop here is a portal that cannot
         // authenticate — so assert it rather than `?.`-ing it away.
-        if (route)
-            files.push({ path: "src/pages/api/portal-auth/[...all].ts", contents: route });
+        //
+        // The route file lives at the mount path, because Astro routing is
+        // file-path-based: a portal mounted at `/api/shop-auth` needs its catch-all
+        // at `src/pages/api/shop-auth/[...all].ts`, not the default `/api/portal-auth`.
+        // Derive it from the resolved basePath so a configured mount and its route
+        // can't drift.
+        const portal = astroidPortal(config);
+        if (route) {
+            files.push({ path: `src/pages${portal.basePath}/[...all].ts`, contents: route });
+        }
     }
     return files;
 }

package/dist/schema/collections.js

@@ -38,6 +38,15 @@ import { astroidSectionCatalog } from "../components/sections.js";
 function pageMediaBase(config) {
     return config.deploy?.mediaBase ?? "/media";
 }
+/**
+ * The section catalog a `pages` write is validated + sanitized against: the
+ * site's own (`config.sectionCatalog`) when it registered bespoke sections, else
+ * Astroid's built-in vocabulary. This is what lets a site with its own section
+ * designs (coracle's 13) keep the same write contract as a stock Astroid site.
+ */
+function resolveSectionCatalog(config) {
+    return config.sectionCatalog ?? astroidSectionCatalog;
+}
 /**
  * Return a copy of a `pages` write payload with its `sections` rich-text fields
  * sanitized against the project media base — a no-op when the write carries no
@@ -52,7 +61,7 @@ export function sanitizeAstroidPageSections(config, data) {
     if (data.sections === undefined)
         return data;
     const mediaBase = pageMediaBase(config);
-    const sections = sanitizeSectionsRichText(data.sections, astroidSectionCatalog, (html) => sanitizeRichHtml(html, { mediaBase }));
+    const sections = sanitizeSectionsRichText(data.sections, resolveSectionCatalog(config), (html) => sanitizeRichHtml(html, { mediaBase }));
     return { ...data, sections };
 }
 /**
@@ -65,7 +74,7 @@ export function sanitizeAstroidPageSections(config, data) {
 export async function assertAstroidPageSections(config, data, operation = "update") {
     if (data.sections === undefined)
         return;
-    await assertValidSections(astroidSectionCatalog, data.sections, {
+    await assertValidSections(resolveSectionCatalog(config), data.sections, {
         operation,
         mediaBase: pageMediaBase(config),
     });

package/dist/schema/framework.js

@@ -9,6 +9,11 @@
  *  wholesale-inquiry module. Shared by table selection (here) and route selection
  *  (the worker route plan). */
 export function capturesInquiries(config) {
+    // Explicit override wins — a site whose inquiry surface is a bespoke section
+    // (coracle's custom `contactForm`) can't be detected from the built-in
+    // vocabulary, so it says so directly.
+    if (typeof config.inquiries === "boolean")
+        return config.inquiries;
     const wantsWholesale = (mods) => (mods ?? []).includes("wholesaleInquiry");
     return ((config.sections ?? []).includes("contact") ||
         wantsWholesale(config.modules) ||

package/dist/schema/generate.js

@@ -53,5 +53,12 @@ export function generateAstroidSchema(config) {
         ...(catalog ? [catalog] : []),
         `export { ${framework.join(", ")} };`,
         "",
+        "// Site-owned tables (the ones Astroid doesn't manage): a project declares",
+        "// its own Drizzle tables in src/schema.site.ts and they're re-exported here",
+        "// so drizzle-kit sees them and the generated worker can import them. The file",
+        "// is scaffold-once — empty until a project adds a table — so this re-export is",
+        "// always safe.",
+        'export * from "./schema.site.js";',
+        "",
     ].join("\n");
 }

package/dist/security/rate-rules.js

@@ -60,7 +60,10 @@ export function astroidRateRules(config) {
         windowSec: WINDOW,
     });
     if (config.portal?.enabled) {
-        const base = ASTROID_PORTAL_BASE_PATH;
+        // The portal's mount is configurable (a site may already ship a second
+        // instance at its own path), so the credential-surface rules must track the
+        // resolved base path, not the default constant — mirrors `astroidPortal`.
+        const base = config.portal.basePath ?? ASTROID_PORTAL_BASE_PATH;
         // Customer credentials, unlike the editor's, are password-based — so these
         // guard credential stuffing and enumeration, not just mail volume.
         rules.push({

package/dist/worker/generate.js

@@ -12,6 +12,7 @@
 // beforeChange hook, and pagesRoute (which takes no collection config) through
 // the `astroidPagesWriteHooks` spread, so both write paths enforce one contract.
 import { ASTROID_VITALS_BINDING, generateAstroidCwvQuery, } from "../analytics/index.js";
+import { astroidEditorTable } from "../auth/index.js";
 import { astroidPortal } from "../portal/config.js";
 import { ASTROID_HEALTH_CRON, astroidCron, astroidUsesQueues } from "../queues/messages.js";
 import { ASTROID_EDIT_SESSION_CLASS, ASTROID_REALTIME_BINDING, usesRealtime, } from "../realtime/scaffold.js";
@@ -102,8 +103,15 @@ export function generateAstroidWorker(config) {
                 // writes live field saves (title, SEO) straight through, and the draft
                 // buffer belongs to the versioned body — i.e. to versionsRoute.
                 return 'saveRoute({ resolveEditor, collections: { pages: { table: pages, fields: ["title", "seoTitle", "seoDescription"] } } })';
-            case "settings":
-                return "settingsRoute({ table: siteSettings, resolveEditor, columns: SETTINGS_COLUMNS, imageKeys: SETTINGS_IMAGE_KEYS, mediaBase: MEDIA_BASE })";
+            case "settings": {
+                // Site-specific keys (config.settings.customKeys) are merged into
+                // site_settings.custom; omitted entirely when a project has none, so a
+                // stock site's route call is unchanged.
+                const customArg = (config.settings?.customKeys ?? []).length
+                    ? ", customKeys: SETTINGS_CUSTOM_KEYS"
+                    : "";
+                return `settingsRoute({ table: siteSettings, resolveEditor, columns: SETTINGS_COLUMNS, imageKeys: SETTINGS_IMAGE_KEYS, mediaBase: MEDIA_BASE${customArg} })`;
+            }
             case "ai":
                 return "aiRoute({ resolveEditor, ai: (env) => env.AI })";
             case "seoFix":
@@ -114,9 +122,11 @@ export function generateAstroidWorker(config) {
                 // upload — so it costs nothing on a project that doesn't want it.
                 return "mediaRoute({ table: media, resolveEditor, referenceSources: MEDIA_REFERENCE_SOURCES, altText: (env) => env.AI })";
             case "editors":
-                // Better Auth owns the `user` table (a NAME, not a Drizzle table), so this
-                // route takes the default `"user"`; a `tablePrefix` would rename it.
-                return 'editorsRoute({ table: "user", resolveEditor })';
+                // The editor instance's user table is `louise_`-prefixed (the editor
+                // convention — the unprefixed `user` table is left for a second/portal
+                // instance). This route takes the table NAME, matching the
+                // `tablePrefix` the scaffolded `src/auth.ts` passes to `getLouiseAuth`.
+                return `editorsRoute({ table: ${JSON.stringify(astroidEditorTable("user"))}, resolveEditor })`;
             case "form":
                 // `onSubmit` fires AFTER the insert and off the response path, so the
                 // notify + confirm pair is store-and-forward by construction: the
@@ -184,8 +194,21 @@ export function generateAstroidWorker(config) {
     p();
     p("// Editable site_settings columns the Settings panel may write, and which of");
     p("// them resolve to a media-library asset.");
-    p(`const SETTINGS_COLUMNS = ${JSON.stringify(ASTROID_SETTINGS_COLUMNS)};`);
-    p(`const SETTINGS_IMAGE_KEYS = ${JSON.stringify(ASTROID_SETTINGS_IMAGE_KEYS)};`);
+    const settingsImageKeys = [
+        ...ASTROID_SETTINGS_IMAGE_KEYS,
+        ...(config.settings?.imageKeys ?? []),
+    ];
+    const settingsCustomKeys = config.settings?.customKeys ?? [];
+    // A custom-heavy site can override (or empty) the editable base columns.
+    const settingsColumns = config.settings?.columns ?? ASTROID_SETTINGS_COLUMNS;
+    // Annotated because a custom-heavy site's `columns: []` would otherwise infer
+    // `any[]` (implicit-any under strict).
+    p(`const SETTINGS_COLUMNS: string[] = ${JSON.stringify(settingsColumns)};`);
+    p(`const SETTINGS_IMAGE_KEYS = ${JSON.stringify(settingsImageKeys)};`);
+    if (settingsCustomKeys.length) {
+        p("// Site-specific keys stored in the site_settings.custom JSON column.");
+        p(`const SETTINGS_CUSTOM_KEYS = ${JSON.stringify(settingsCustomKeys)};`);
+    }
     p();
     p("// Delete-safety for the media library: where a media key can be REFERENCED,");
     p("// so deleting an asset that's live on a page warns instead of silently");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "astroidjs",
-  "version": "0.2.0",
+  "version": "0.3.0",
   "description": "Astroid — an opinionated meta-framework over Louise Toolkit and Astro for building editable, multi-editor sites on Cloudflare Workers.",
   "keywords": [
     "astro",
@@ -60,7 +60,7 @@
     "access": "public"
   },
   "dependencies": {
-    "louise-toolkit": "0.16.0"
+    "louise-toolkit": "0.17.0"
   },
   "peerDependencies": {
     "solid-js": "^1.9.0"