create-astroid 0.3.0 → 0.3.2

package/index.mjs

@@ -34,9 +34,15 @@ import {
 
 const TEMPLATE_DIR = join(dirname(fileURLToPath(import.meta.url)), "template");
 
-// Files whose leading `_` is stripped on copy (npm strips real dotfiles from a
-// published package, so they ship as `_gitignore` / `_env.example`).
-const DOTFILE_RENAMES = { _gitignore: ".gitignore", "_env.example": ".env.example" };
+// Files (and dirs) whose leading `_` is stripped on copy (npm strips real
+// dotfiles from a published package, so they ship as `_gitignore` /
+// `_env.example` / `_github/…`). Applied per entry in `copyTemplate`, so a
+// directory renames too — `_github` becomes `.github` and its contents follow.
+const DOTFILE_RENAMES = {
+  _gitignore: ".gitignore",
+  "_env.example": ".env.example",
+  _github: ".github",
+};
 
 // Archetype → default editable home sections. Imported from astroidjs rather
 // than duplicated here: as a literal in this file it could name a section that
@@ -173,8 +179,23 @@ function astroidConfigSource(config) {
     ...(config.modules?.length ? [`  modules: ${JSON.stringify(config.modules)},`] : []),
     // Must be emitted: `astroid generate` rebuilds the middleware from THIS
     // file, so a config that omitted the portal would regenerate a middleware
-    // with no guard while src/portal-auth.ts sat there unused.
-    ...(config.portal?.enabled ? ["  portal: { enabled: true },"] : []),
+    // with no guard while src/portal-auth.ts sat there unused. And the FULL shape
+    // (tablePrefix, signUp) — not a bare `{ enabled: true }` — so a regenerate
+    // reproduces the SAME unprefixed `user`/`session` seam the 0002_portal_auth
+    // migration created, rather than defaulting the prefix back to `portal_`.
+    ...(config.portal?.enabled
+      ? [
+          "  portal: {",
+          "    enabled: true,",
+          ...(config.portal.tablePrefix !== undefined
+            ? [`    tablePrefix: ${JSON.stringify(config.portal.tablePrefix)},`]
+            : []),
+          ...(config.portal.signUp !== undefined
+            ? [`    signUp: ${JSON.stringify(config.portal.signUp)},`]
+            : []),
+          "  },",
+        ]
+      : []),
     '  deploy: { platform: "cloudflare" },',
     "});",
     "",
@@ -243,9 +264,11 @@ async function main() {
   const archetype = ARCHETYPES.includes(archetypeRaw) ? archetypeRaw : "marketing";
   const color = flags.color || (await prompt("Brand color (hex)", "#5b4bff"));
   const host = flags.host && flags.host !== true ? flags.host : undefined;
-  // Portal + commerce are opt-in and unprompted: each pulls in real
-  // infrastructure a plain marketing site should not carry.
-  const portal = flags.portal === true || flags.portal === "true";
+  // The customer PORTAL is opt-in via --portal, but a storefront IMPLIES one — a
+  // shop has customers who sign in, reorder, and track orders — so enable it there
+  // by default. (Commerce below stays opt-in: infra a marketing site shouldn't carry.)
+  const portal =
+    flags.portal === true || flags.portal === "true" || archetype === "storefront";
   // The map module is opt-in and pulls real weight (maplibre-gl is ~1 MB), so
   // it is never on by default.
   const map = flags.map === true || flags.map === "true";
@@ -284,7 +307,10 @@ async function main() {
     theme: { name, colors: { brand: color } },
     sections: ARCHETYPE_SECTIONS[archetype],
     ...(commerce ? { commerce: { provider: commerce } } : {}),
-    ...(portal ? { portal: { enabled: true } } : {}),
+    // Unprefixed `user`/`session` (customers — email + password), so the studio's
+    // `louise_`-prefixed tables and the portal's never collide (mirrors the
+    // reference storefront). `signUp: true` because a shop lets customers register.
+    ...(portal ? { portal: { enabled: true, tablePrefix: "", signUp: true } } : {}),
     // ONE array, built from every enabled flag. Two separate `...(x ? {modules}
     // : {})` spreads would let the later one overwrite the earlier, silently
     // dropping a module whenever both were passed.
@@ -394,15 +420,17 @@ async function main() {
     // instance. Must match the `tablePrefix` in src/auth.ts and the `louise_user`
     // table the generated `editorsRoute` reads.
     write(dir, "migrations/0001_auth.sql", generateAuthSchemaSql({ tablePrefix: "louise_" }));
-    // The portal's own auth tables. A SECOND set, prefixed — the two instances
-    // share one D1 but never a row, so a portal account can't sign into the
-    // studio and an editor doesn't appear in the portal. Without this migration
-    // the portal builds fine and fails on the first sign-in.
+    // The portal's own auth tables — a SECOND Better Auth instance sharing one D1
+    // but never a row, so a portal account can't sign into the studio and an
+    // editor doesn't appear in the portal. `customers: true` (email + password)
+    // and the config's tablePrefix, so this schema matches the scaffolded
+    // portal-auth.ts exactly. Without this migration the portal builds fine and
+    // fails on the first sign-in with a missing table.
     if (config.portal?.enabled) {
       write(
         dir,
         "migrations/0002_portal_auth.sql",
-        generateAuthSchemaSql({ tablePrefix: "portal_" }),
+        generateAuthSchemaSql({ customers: true, tablePrefix: config.portal.tablePrefix ?? "" }),
       );
     }
     authMigrationOk = true;
@@ -419,8 +447,8 @@ async function main() {
       write(
         dir,
         "migrations/0002_portal_auth.sql",
-        "-- Portal Better Auth tables (prefixed) — generate after install:\n" +
-          "--   pnpm exec louise gen-auth-schema --table-prefix portal_ --out migrations/0002_portal_auth.sql\n",
+        "-- Portal Better Auth tables (customers, unprefixed) — generate after install:\n" +
+          "--   pnpm exec louise gen-auth-schema --out migrations/0002_portal_auth.sql\n",
       );
     }
   }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "create-astroid",
-  "version": "0.3.0",
+  "version": "0.3.2",
   "description": "Scaffold a new Astroid site — an editable, multi-editor Astro app on Cloudflare Workers — in one command.",
   "keywords": [
     "astro",
@@ -32,8 +32,8 @@
   "dependencies": {
     "@better-auth/passkey": "^1.6.23",
     "better-auth": "^1.6.23",
-    "louise-toolkit": "0.17.0",
-    "astroidjs": "0.3.0"
+    "louise-toolkit": "0.18.0",
+    "astroidjs": "0.3.2"
   },
   "engines": {
     "node": ">=24.0.0"

package/template/README.md

@@ -103,6 +103,20 @@ pnpm doctor         # validate config, bindings, and generated-file freshness
 wrangler deploy     # or: pnpm astroid deploy
 ```
 
+## Taking payments
+
+Storefront sites (`--commerce square`) are scaffolded with a server-authoritative
+payment route at `src/pages/api/checkout.ts` and a `<SquareCard>` input. **Keep
+its sequence** — extend it (shipping, tax, an order row, a receipt), don't replace
+it. It re-prices every line from the D1 catalog mirror (the client's price is a
+_staleness check_, never an input to the charge — accept a `unitPrice` from the
+request body and anyone buys anything for a penny) and derives the Square
+idempotency key from the verified cart **and** the cart id. Hand-rolling
+`createPayment` without a stable, cart-scoped idempotency key is the failure this
+route exists to prevent: a double-clicked Pay button charges twice, and a
+constant (or omitted) key lets two customers' identical carts collide into a
+single charge.
+
 ## Layout
 
 | Path | What |

package/template/_github/workflows/ci.yml

@@ -0,0 +1,54 @@
+name: CI
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+
+# Cancel superseded runs on the same ref (a force-push mid-run).
+concurrency:
+  group: ci-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    env:
+      # corepack pins pnpm from `packageManager` in package.json; in CI it must
+      # fetch that version without an interactive prompt.
+      COREPACK_ENABLE_DOWNLOAD_PROMPT: 0
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 24
+
+      # pnpm via corepack, pinned by `packageManager` — the same version you
+      # develop with, so `--frozen-lockfile` below always matches the committed
+      # pnpm-lock.yaml. (Commit that lockfile; this step relies on it.)
+      - name: Enable pnpm (corepack)
+        run: corepack enable
+
+      - name: Install
+        run: pnpm install --frozen-lockfile
+
+      # Validate the config, bindings, and that the generated
+      # src/schema.ts · src/worker.ts · src/middleware.ts trio is still in sync
+      # with astroid.config.ts. A fast fail before the heavier steps.
+      - name: Doctor
+        run: pnpm doctor
+
+      # No-ops on a fresh scaffold; runs automatically once you add a `lint`
+      # script (oxlint/biome) — same for `test` (vitest) further down.
+      - name: Lint
+        run: pnpm run --if-present lint
+
+      - name: Type-check
+        run: pnpm check
+
+      - name: Test
+        run: pnpm run --if-present test
+
+      - name: Build
+        run: pnpm build

package/template/package.json

@@ -39,5 +39,6 @@
   },
   "engines": {
     "node": ">=24.0.0"
-  }
+  },
+  "packageManager": "pnpm@11.13.0"
 }