astroidjs 0.9.5 → 0.10.1

package/dist/astro/csp.d.ts

@@ -1,4 +1,5 @@
-import type { AstroidConfig, CspOrigins } from "../config.js";
+import type { AstroidConfig } from "../config.js";
+export { astroidCspOrigins } from "../security/csp-origins.js";
 /** A `sha256-…` CSP hash, in the shape Astro's `security.csp.hashes` takes. */
 export type CspHash = `${"sha256" | "sha384" | "sha512"}-${string}`;
 /**
@@ -38,12 +39,6 @@ export interface AstroidSecurityConfig {
  * hash on the next build.
  */
 export declare function solidHydrationHash(): CspHash;
-/**
- * Every origin the project's enabled modules need, merged with the config's own
- * `security.cspOrigins`. Exported so a site (or `astroid doctor`) can inspect
- * what a config implies without rebuilding the whole policy.
- */
-export declare function astroidCspOrigins(config: AstroidConfig): Required<CspOrigins>;
 /**
  * The `security` block for `astro.config.mjs` — Astro's half of the split.
  *
@@ -61,4 +56,3 @@ export declare function astroidSecurity(config: AstroidConfig): AstroidSecurityC
 export declare const ASTROID_VITE_BUILD: {
     readonly assetsInlineLimit: 0;
 };
-export {};

package/dist/astro/csp.js

@@ -27,7 +27,8 @@
 // imports.
 import { createHash } from "node:crypto";
 import { generateHydrationScript } from "solid-js/web";
-import { astroidCommerceProviders } from "../commerce/roles.js";
+import { astroidCspOrigins } from "../security/csp-origins.js";
+export { astroidCspOrigins } from "../security/csp-origins.js";
 /**
  * Hash of Solid's inline hydration bootstrap.
  *
@@ -42,80 +43,6 @@ export function solidHydrationHash() {
     const inner = generateHydrationScript().match(/<script[^>]*>([\s\S]*?)<\/script>/)?.[1] ?? "";
     return `sha256-${createHash("sha256").update(inner).digest("base64")}`;
 }
-/** Origins a commerce provider's client-side SDK needs. Server-only providers
- *  (Fourthwall's storefront API) contribute nothing but their image host. */
-const COMMERCE_ORIGINS = {
-    // Square Web Payments renders the card form in an iframe from the squarecdn
-    // hosts, tokenizes against pci-connect, and pulls its own fonts. Both the
-    // sandbox and production hosts are listed so ONE build serves either
-    // environment — which environment you're in is a runtime secret, not a
-    // build-time one.
-    square: {
-        script: ["https://sandbox.web.squarecdn.com", "https://web.squarecdn.com"],
-        frame: [
-            "https://sandbox.web.squarecdn.com",
-            "https://web.squarecdn.com",
-            "https://connect.squareupsandbox.com",
-            "https://connect.squareup.com",
-        ],
-        connect: [
-            "https://pci-connect.squareupsandbox.com",
-            "https://pci-connect.squareup.com",
-            "https://sandbox.web.squarecdn.com",
-            "https://web.squarecdn.com",
-        ],
-        font: [
-            "https://square-fonts-production-f.squarecdn.com",
-            "https://d1g145x70srn7h.cloudfront.net",
-        ],
-    },
-    // Stripe.js and its Elements/Checkout iframes.
-    stripe: {
-        script: ["https://js.stripe.com"],
-        frame: ["https://js.stripe.com", "https://hooks.stripe.com"],
-        connect: ["https://api.stripe.com"],
-    },
-    // Fourthwall is read server-side; nothing runs in the browser.
-    fourthwall: {},
-};
-// Turnstile. Always allowed, not gated on the captcha being configured: the
-// scaffold ships the widget dormant (see the dormant-until-provisioned
-// convention) and it must not need a rebuild to switch on — CSP is baked at
-// build time, the secret is a runtime value.
-const TURNSTILE = {
-    script: ["https://challenges.cloudflare.com"],
-    frame: ["https://challenges.cloudflare.com"],
-    connect: ["https://challenges.cloudflare.com"],
-};
-// The map module. MapLibre spins its tile-decoding workers up from blob: URLs,
-// so `worker-src blob:` is not optional — without it the map renders an empty
-// canvas and the console fills with worker-construction errors.
-//
-// Nothing else is needed, and that's the whole argument for the self-hosted
-// basemap: the PMTiles archive is served same-origin, so `connect-src` stays
-// `'self'` with no tile host and no API key to allow.
-const MAP = { worker: ["blob:"] };
-const DIRECTIVE_KEYS = ["script", "frame", "connect", "font", "img", "worker"];
-/** Merge origin lists, de-duplicated, order preserved. */
-function mergeOrigins(...sets) {
-    const out = {};
-    for (const key of DIRECTIVE_KEYS) {
-        out[key] = [...new Set(sets.flatMap((set) => set[key] ?? []))];
-    }
-    return out;
-}
-/**
- * Every origin the project's enabled modules need, merged with the config's own
- * `security.cspOrigins`. Exported so a site (or `astroid doctor`) can inspect
- * what a config implies without rebuilding the whole policy.
- */
-export function astroidCspOrigins(config) {
-    return mergeOrigins(TURNSTILE, ...((config.modules ?? []).includes("map") ? [MAP] : []), 
-    // EVERY provider in play, not "the" provider: a site can run Stripe for
-    // invoicing beside Fourthwall for the storefront, and a policy that allowed
-    // only one of them blocks the other's SDK at runtime.
-    ...astroidCommerceProviders(config.commerce).map((p) => COMMERCE_ORIGINS[p] ?? {}), config.security?.cspOrigins ?? {});
-}
 /**
  * Render one directive. The name is a literal from the union above, so the
  * concatenation is a valid `CspDirective` by construction — which is what the

package/dist/astro/index.d.ts

@@ -1 +1 @@
-export { ASTROID_VITE_BUILD, astroidCspOrigins, astroidSecurity, type AstroidSecurityConfig, type CspHash, solidHydrationHash, } from "./csp.js";
+export { ASTROID_VITE_BUILD, astroidCspOrigins, astroidSecurity, type AstroidSecurityConfig, type CspDirective, type CspHash, solidHydrationHash, } from "./csp.js";

package/dist/config.d.ts

@@ -378,6 +378,8 @@ export interface SecurityConfig {
 /** Per-directive origin lists contributed to the CSP. */
 export interface CspOrigins {
     script?: string[];
+    /** Rendered by the generated middleware (it owns `style-src`), not by Astro. */
+    style?: string[];
     frame?: string[];
     connect?: string[];
     font?: string[];

package/dist/security/csp-origins.d.ts

@@ -0,0 +1,16 @@
+import type { AstroidConfig, CspOrigins } from "../config.js";
+/**
+ * Every origin the project's enabled modules need, merged with the config's own
+ * `security.cspOrigins`. Exported so a site (or `astroid doctor`) can inspect
+ * what a config implies without rebuilding the whole policy.
+ */
+export declare function astroidCspOrigins(config: AstroidConfig): Required<CspOrigins>;
+/**
+ * The `style-src` value the generated middleware rewrites every response to.
+ *
+ * `'unsafe-inline'` is required (Louise's data-driven `style=""` carriers and
+ * the editor's runtime `<style>`), which is why Astro can't own this directive:
+ * per spec a single hash here voids `'unsafe-inline'`. Module and config
+ * `style` origins ride along, e.g. the Square SDK's own stylesheet.
+ */
+export declare function astroidCspStyleSrc(config: AstroidConfig): string;

package/dist/security/csp-origins.js

@@ -0,0 +1,99 @@
+// Copyright (c) 2026 BowenLabs. Astroid is MIT licensed.
+//
+// The CSP origins a config implies, as plain data.
+//
+// Split out of `astro/csp.ts` (build-time only: `node:crypto`, `solid-js/web`)
+// so the worker generator can read it too: Astro's `security.csp` renders every
+// directive except `style-src`, and the generated middleware renders that one.
+// Both have to see the same origin set, or a module's stylesheet host lands in
+// one half of the policy and not the other.
+import { astroidCommerceProviders } from "../commerce/roles.js";
+/** Origins a commerce provider's client-side SDK needs. Server-only providers
+ *  (Fourthwall's storefront API) contribute nothing but their image host. */
+const COMMERCE_ORIGINS = {
+    // Square Web Payments renders the card form in an iframe from the squarecdn
+    // hosts, tokenizes against pci-connect, and pulls its own fonts. Both the
+    // sandbox and production hosts are listed so ONE build serves either
+    // environment — which environment you're in is a runtime secret, not a
+    // build-time one.
+    square: {
+        script: ["https://sandbox.web.squarecdn.com", "https://web.squarecdn.com"],
+        frame: [
+            "https://sandbox.web.squarecdn.com",
+            "https://web.squarecdn.com",
+            "https://connect.squareupsandbox.com",
+            "https://connect.squareup.com",
+        ],
+        connect: [
+            "https://pci-connect.squareupsandbox.com",
+            "https://pci-connect.squareup.com",
+            "https://sandbox.web.squarecdn.com",
+            "https://web.squarecdn.com",
+        ],
+        // Web Payments SDK 1.85+ attaches its own `card-wrapper.css` to the HOST
+        // page (not just inside the iframe). Block it and `card.attach()` rejects,
+        // so the card form never mounts.
+        style: ["https://sandbox.web.squarecdn.com", "https://web.squarecdn.com"],
+        font: [
+            "https://square-fonts-production-f.squarecdn.com",
+            "https://d1g145x70srn7h.cloudfront.net",
+        ],
+    },
+    // Stripe.js and its Elements/Checkout iframes.
+    stripe: {
+        script: ["https://js.stripe.com"],
+        frame: ["https://js.stripe.com", "https://hooks.stripe.com"],
+        connect: ["https://api.stripe.com"],
+    },
+    // Fourthwall is read server-side; nothing runs in the browser.
+    fourthwall: {},
+};
+// Turnstile. Always allowed, not gated on the captcha being configured: the
+// scaffold ships the widget dormant (see the dormant-until-provisioned
+// convention) and it must not need a rebuild to switch on — CSP is baked at
+// build time, the secret is a runtime value.
+const TURNSTILE = {
+    script: ["https://challenges.cloudflare.com"],
+    frame: ["https://challenges.cloudflare.com"],
+    connect: ["https://challenges.cloudflare.com"],
+};
+// The map module. MapLibre spins its tile-decoding workers up from blob: URLs,
+// so `worker-src blob:` is not optional — without it the map renders an empty
+// canvas and the console fills with worker-construction errors.
+//
+// Nothing else is needed, and that's the whole argument for the self-hosted
+// basemap: the PMTiles archive is served same-origin, so `connect-src` stays
+// `'self'` with no tile host and no API key to allow.
+const MAP = { worker: ["blob:"] };
+const DIRECTIVE_KEYS = ["script", "style", "frame", "connect", "font", "img", "worker"];
+/** Merge origin lists, de-duplicated, order preserved. */
+function mergeOrigins(...sets) {
+    const out = {};
+    for (const key of DIRECTIVE_KEYS) {
+        out[key] = [...new Set(sets.flatMap((set) => set[key] ?? []))];
+    }
+    return out;
+}
+/**
+ * Every origin the project's enabled modules need, merged with the config's own
+ * `security.cspOrigins`. Exported so a site (or `astroid doctor`) can inspect
+ * what a config implies without rebuilding the whole policy.
+ */
+export function astroidCspOrigins(config) {
+    return mergeOrigins(TURNSTILE, ...((config.modules ?? []).includes("map") ? [MAP] : []), 
+    // EVERY provider in play, not "the" provider: a site can run Stripe for
+    // invoicing beside Fourthwall for the storefront, and a policy that allowed
+    // only one of them blocks the other's SDK at runtime.
+    ...astroidCommerceProviders(config.commerce).map((p) => COMMERCE_ORIGINS[p] ?? {}), config.security?.cspOrigins ?? {});
+}
+/**
+ * The `style-src` value the generated middleware rewrites every response to.
+ *
+ * `'unsafe-inline'` is required (Louise's data-driven `style=""` carriers and
+ * the editor's runtime `<style>`), which is why Astro can't own this directive:
+ * per spec a single hash here voids `'unsafe-inline'`. Module and config
+ * `style` origins ride along, e.g. the Square SDK's own stylesheet.
+ */
+export function astroidCspStyleSrc(config) {
+    return ["'self'", "'unsafe-inline'", ...astroidCspOrigins(config).style].join(" ");
+}

package/dist/worker/generate.js

@@ -17,6 +17,7 @@ import { astroidPortal } from "../portal/config.js";
 import { ASTROID_HEALTH_CRON, astroidCron, astroidUsesQueues } from "../queues/messages.js";
 import { ASTROID_EDIT_SESSION_CLASS, ASTROID_REALTIME_BINDING, usesRealtime, } from "../realtime/scaffold.js";
 import { capturesInquiries } from "../schema/framework.js";
+import { astroidCspStyleSrc } from "../security/csp-origins.js";
 import { ASTROID_REWRITE_EXCLUDE, ASTROID_TENANT_PREFIX } from "../tenancy/index.js";
 import { astroidEditorRoutePlan } from "./routes.js";
 // Astroid's default editable site_settings surface — the columns the Settings
@@ -470,8 +471,10 @@ export function generateAstroidWorker(config) {
 export function generateAstroidMiddleware(config) {
     // Louise's brand font is bundled + base64-inlined (no Google Fonts host to
     // allow); createLouiseMiddleware auto-allows `data:` fonts in the CSP, so the
-    // inlined @font-face needs no manual `font-src` entry.
-    const cspStyleSrc = "'self' 'unsafe-inline'";
+    // inlined @font-face needs no manual `font-src` entry. Module + config `style`
+    // origins (the Square SDK's stylesheet) are baked in here; `astroid build`
+    // regenerates this file, so a config change lands on the next deploy.
+    const cspStyleSrc = astroidCspStyleSrc(config);
     const portal = astroidPortal(config);
     const tenancy = config.tenancy;
     const rewritePrefix = tenancy?.rewritePrefix ?? ASTROID_TENANT_PREFIX;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "astroidjs",
-  "version": "0.9.5",
+  "version": "0.10.1",
   "description": "Astroid — an opinionated meta-framework over Louise Toolkit and Astro for building editable, multi-editor sites on Cloudflare Workers.",
   "keywords": [
     "astro",
@@ -14,7 +14,7 @@
   "author": "BowenLabs",
   "repository": {
     "type": "git",
-    "url": "git+https://github.com/bowenlabs/louise-toolkit.git",
+    "url": "git+https://github.com/bowenlabs/astroidjs.git",
     "directory": "packages/astroid"
   },
   "bin": {
@@ -60,7 +60,7 @@
     "access": "public"
   },
   "dependencies": {
-    "louise-toolkit": "0.27.0"
+    "louise-toolkit": "^0.28.0"
   },
   "devDependencies": {
     "@types/node": "^24.13.3",
@@ -83,12 +83,11 @@
     }
   },
   "engines": {
-    "node": ">=24.0.0"
+    "node": ">=26.0.0"
   },
   "scripts": {
     "build": "tsgo -p tsconfig.build.json",
-    "check": "vp check",
-    "test": "vp test",
+    "test": "vitest run",
     "typecheck": "tsgo --noEmit"
   }
 }