astroidjs 0.8.0 → 0.8.2

package/dist/config.d.ts

@@ -305,6 +305,27 @@ export interface TenancyConfig {
      * never affected — they aren't tenant candidates at all.
      */
     unknown?: "fallthrough" | "404";
+    /**
+     * Path prefixes the host rewrite must leave alone. Default `["/api"]`.
+     *
+     * The rewrite exists to choose which PAGE renders for a host. An API route
+     * is not a page: its address is absolute, chosen by the client that calls
+     * it, and it reads the host from `locals.tenant` rather than from its own
+     * path. Rewriting it moves it somewhere no route matches — and on an app
+     * host with a catch-all page, somewhere much worse than a 404: the page
+     * catch-all answers, so `fetch("/api/…")` gets HTML (or a redirect to a
+     * sign-in) instead of JSON, and every data load on that host silently fails
+     * while the same code works on the apex.
+     *
+     * That is not hypothetical — it is why this default exists (found on
+     * themidwestartist.com's studio, where the whole admin app loaded and then
+     * fetched nothing).
+     *
+     * Set `[]` to rewrite everything, or add prefixes for other host-agnostic
+     * surfaces (`/_actions`, `/webhooks`). Matching is prefix-based on a path
+     * segment, so `/api` matches `/api/x` and `/api` but never `/apiary`.
+     */
+    rewriteExclude?: string[];
 }
 export interface AstroidCron {
     /** Standard 5-field cron, UTC — e.g. `"*/15 * * * *"`. */

package/dist/tenancy/index.d.ts

@@ -1,6 +1,19 @@
 import type { AstroidConfig, TenancyConfig } from "../config.js";
 /** Default internal prefix a tenant request is rewritten to. */
 export declare const ASTROID_TENANT_PREFIX = "/t";
+/** Path prefixes the host rewrite leaves alone unless a site says otherwise.
+ *  See {@link TenancyConfig.rewriteExclude} for why `/api` is the default. */
+export declare const ASTROID_REWRITE_EXCLUDE: string[];
+/**
+ * Whether a path is host-agnostic and must render from its own address rather
+ * than the rewritten one.
+ *
+ * Segment-aware on purpose: a prefix of `/api` must match `/api` and `/api/x`
+ * but never `/apiary`, or a site could lose a page to a coincidental name.
+ *
+ * Exported and pure so a site can unit-test its own exclusion list.
+ */
+export declare function isRewriteExcluded(pathname: string, exclude: string[]): boolean;
 /**
  * The Cloudflare zone a wildcard pattern belongs to.
  *

package/dist/tenancy/index.js

@@ -10,6 +10,21 @@
 // `src/tenancy.ts`.
 /** Default internal prefix a tenant request is rewritten to. */
 export const ASTROID_TENANT_PREFIX = "/t";
+/** Path prefixes the host rewrite leaves alone unless a site says otherwise.
+ *  See {@link TenancyConfig.rewriteExclude} for why `/api` is the default. */
+export const ASTROID_REWRITE_EXCLUDE = ["/api"];
+/**
+ * Whether a path is host-agnostic and must render from its own address rather
+ * than the rewritten one.
+ *
+ * Segment-aware on purpose: a prefix of `/api` must match `/api` and `/api/x`
+ * but never `/apiary`, or a site could lose a page to a coincidental name.
+ *
+ * Exported and pure so a site can unit-test its own exclusion list.
+ */
+export function isRewriteExcluded(pathname, exclude) {
+    return exclude.some((prefix) => pathname === prefix || pathname.startsWith(`${prefix.replace(/\/$/, "")}/`));
+}
 /**
  * The Cloudflare zone a wildcard pattern belongs to.
  *

package/dist/worker/generate.js

@@ -17,7 +17,7 @@ import { astroidPortal } from "../portal/config.js";
 import { ASTROID_HEALTH_CRON, astroidCron, astroidUsesQueues } from "../queues/messages.js";
 import { ASTROID_EDIT_SESSION_CLASS, ASTROID_REALTIME_BINDING, usesRealtime, } from "../realtime/scaffold.js";
 import { capturesInquiries } from "../schema/framework.js";
-import { ASTROID_TENANT_PREFIX } from "../tenancy/index.js";
+import { ASTROID_REWRITE_EXCLUDE, ASTROID_TENANT_PREFIX } from "../tenancy/index.js";
 import { astroidEditorRoutePlan } from "./routes.js";
 // Astroid's default editable site_settings surface — the columns the Settings
 // panel may write, and which of them hold a media-library image URL.
@@ -462,6 +462,7 @@ export function generateAstroidMiddleware(config) {
     const portal = astroidPortal(config);
     const tenancy = config.tenancy;
     const rewritePrefix = tenancy?.rewritePrefix ?? ASTROID_TENANT_PREFIX;
+    const rewriteExclude = tenancy?.rewriteExclude ?? ASTROID_REWRITE_EXCLUDE;
     return [
         "// Generated by astroidjs — do not hand-edit.",
         "// The shared Louise middleware: rate-limit the unauthenticated POST surfaces,",
@@ -479,7 +480,7 @@ export function generateAstroidMiddleware(config) {
             ...(portal ? ["astroidPortalGuardConfig"] : []),
             "astroidRateRules",
             ...(portal ? ["guardResponse", "portalGuard", "resolvePortalSession"] : []),
-            ...(tenancy ? ["tenantLabel"] : []),
+            ...(tenancy ? ["isRewriteExcluded", "tenantLabel"] : []),
         ].join(", ")} } from "astroidjs";`,
         'import astroidConfig from "../astroid.config.js";',
         ...(tenancy
@@ -591,17 +592,28 @@ export function generateAstroidMiddleware(config) {
                 "  // falls through to the ordinary site below — or 404s first, when the",
                 '  // config sets `tenancy.unknown: "404"` (see the guard above).',
                 "  rewrite: (context) => {",
+                "    // Host-agnostic paths render from their own address. An API route is",
+                "    // addressed absolutely by whatever calls it and reads the host from",
+                "    // `locals.tenant`, so rewriting it moves it where no route matches —",
+                "    // and on an app host with a catch-all page, the PAGE answers, so",
+                "    // fetch() gets HTML instead of JSON and every data load quietly fails.",
+                `    if (isRewriteExcluded(context.url.pathname, ${JSON.stringify(rewriteExclude)})) {`,
+                "      return undefined;",
+                "    }",
                 ...(Object.keys(tenancy.apps ?? {}).length
                     ? [
                         "    // First-party app hosts (config `tenancy.apps`): a static label→prefix",
                         "    // map, checked before the tenant — an app exists whether or not any",
                         "    // tenant does, and needs no lookup.",
                         "    const app = appPrefix(context.url.hostname, TENANCY);",
-                        "    if (app) return `${app}${context.url.pathname}`;",
+                        "    // `search` is preserved: the rewrite chooses which page renders, not",
+                        "    // what was asked of it. Dropping it silently loses filters, pagination,",
+                        "    // campaign tags — and every typed search param a routed island reads.",
+                        "    if (app) return `${app}${context.url.pathname}${context.url.search}`;",
                     ]
                     : []),
                 "    const tenant = context.locals.tenant;",
-                `    return tenant ? \`${rewritePrefix}/\${tenant.slug}\${context.url.pathname}\` : undefined;`,
+                `    return tenant ? \`${rewritePrefix}/\${tenant.slug}\${context.url.pathname}\${context.url.search}\` : undefined;`,
                 "  },",
             ]
             : []),

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "astroidjs",
-  "version": "0.8.0",
+  "version": "0.8.2",
   "description": "Astroid — an opinionated meta-framework over Louise Toolkit and Astro for building editable, multi-editor sites on Cloudflare Workers.",
   "keywords": [
     "astro",