create-astroid 0.5.0 → 0.7.0

package/README.md

@@ -38,6 +38,9 @@ pnpm create astroid [directory] [options]
   --host <domain>       Primary domain, e.g. example.com
   --commerce <provider> square | stripe | fourthwall — also adds the queue
                         consumer, webhook receiver, and cron safety net
+  --square-locations <n> single | multi — with --commerce square; multi is one
+                        Square Location per merchant, resolved from the request
+                        host rather than SQUARE_LOCATION_ID
   --map                 Self-hosted PMTiles/MapLibre location map
   --pwa                 Installable PWA: a scoped service worker that never
                         caches /api/* or the editor, plus a manifest

package/index.mjs

@@ -57,6 +57,11 @@ const ARCHETYPES = Object.keys(ARCHETYPE_SECTIONS);
 // consumer, the webhook receiver, and the cron safety net.
 const COMMERCE_PROVIDERS = ["square", "stripe", "fourthwall"];
 
+// Square's location model (`commerce.square.locations`). `multi` is the
+// multi-merchant shape: the location comes from the request, not the
+// environment, and the checkout route is scaffolded around resolving it.
+const SQUARE_LOCATIONS = ["single", "multi"];
+
 // --- args ------------------------------------------------------------------
 function parseArgs(argv) {
   const flags = {};
@@ -189,8 +194,17 @@ function astroidConfigSource(config) {
     `    colors: { brand: ${JSON.stringify(config.theme.colors.brand)} },`,
     "  },",
     `  sections: ${JSON.stringify(config.sections)},`,
+    // `square` must be emitted too: `astroid doctor` derives the required
+    // secrets from THIS file, so a multi-location project whose config lost the
+    // option would be told it is missing a SQUARE_LOCATION_ID it must not have.
     ...(config.commerce
-      ? [`  commerce: { provider: ${JSON.stringify(config.commerce.provider)} },`]
+      ? [
+          `  commerce: { provider: ${JSON.stringify(config.commerce.provider)}${
+            config.commerce.square?.locations
+              ? `, square: { locations: ${JSON.stringify(config.commerce.square.locations)} }`
+              : ""
+          } },`,
+        ]
       : []),
     // Must be emitted, for the same reason the portal is: `astroid generate`
     // rebuilds the middleware and CSP from THIS file, so a config that dropped
@@ -244,6 +258,9 @@ Options:
   --host <domain>       Primary domain, e.g. example.com
   --commerce <provider> ${COMMERCE_PROVIDERS.join(" | ")}
                         Also adds the queue consumer, webhook receiver, and cron
+  --square-locations <n> ${SQUARE_LOCATIONS.join(" | ")}   (default: single; needs --commerce square)
+                        multi: one Square Location per merchant, resolved from
+                        the request host — no SQUARE_LOCATION_ID
   --map                 Add the self-hosted PMTiles/MapLibre location map
   --pwa                 Add an installable PWA: a scoped service worker that
                         never caches /api/* or the editor, plus a manifest
@@ -317,6 +334,22 @@ async function main() {
     );
     process.exit(1);
   }
+  // Refused, not ignored, without Square: the checkout route is scaffolded ONCE,
+  // so a multi-merchant store that silently got the single-location route would
+  // ring every sale against one ambient SQUARE_LOCATION_ID — and look fine doing it.
+  const squareLocationsRaw = flags["square-locations"];
+  const squareLocations =
+    typeof squareLocationsRaw === "string" ? squareLocationsRaw.toLowerCase() : undefined;
+  if (squareLocationsRaw !== undefined && !SQUARE_LOCATIONS.includes(squareLocations)) {
+    process.stderr.write(
+      `create-astroid: --square-locations expects ${SQUARE_LOCATIONS.join(" | ")}\n`,
+    );
+    process.exit(1);
+  }
+  if (squareLocations && commerce !== "square") {
+    process.stderr.write("create-astroid: --square-locations needs --commerce square\n");
+    process.exit(1);
+  }
 
   if (existsSync(dir) && readdirSync(dir).length > 0) {
     process.stderr.write(`create-astroid: target directory is not empty: ${dir}\n`);
@@ -330,7 +363,14 @@ async function main() {
     ...(host ? { hosts: [host] } : {}),
     theme: { name, colors: { brand: color } },
     sections: ARCHETYPE_SECTIONS[archetype],
-    ...(commerce ? { commerce: { provider: commerce } } : {}),
+    ...(commerce
+      ? {
+          commerce: {
+            provider: commerce,
+            ...(squareLocations ? { square: { locations: squareLocations } } : {}),
+          },
+        }
+      : {}),
     // Unprefixed `user`/`session` (customers — email + password), so the studio's
     // `louise_`-prefixed tables and the portal's never collide (mirrors the
     // reference storefront). `signUp: true` because a shop lets customers register.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "create-astroid",
-  "version": "0.5.0",
+  "version": "0.7.0",
   "description": "Scaffold a new Astroid site — an editable, multi-editor Astro app on Cloudflare Workers — in one command.",
   "keywords": [
     "astro",
@@ -31,10 +31,10 @@
   },
   "dependencies": {
     "@better-auth/passkey": "^1.7.2",
-    "@louise-toolkit/astro": "^0.1.1",
+    "@louise-toolkit/astro": "^0.2.1",
     "better-auth": "^1.7.2",
-    "louise-toolkit": "^0.28.0",
-    "astroidjs": "0.10.0"
+    "louise-toolkit": "^0.30.1",
+    "astroidjs": "0.12.0"
   },
   "engines": {
     "node": ">=26.0.0"

package/template/src/pages/login.astro

@@ -45,9 +45,9 @@ const siteKey = turnstileSiteKey(env);
           </label>
           {
             siteKey && (
-              /* Turnstile injects a hidden `cf-turnstile-response` input here once
-                 it solves. The submit handler reads it out of the form. */
-              <div class="cf-turnstile" data-sitekey={siteKey} data-size="flexible" />
+              /* Rendered explicitly by the script below, which reads the key
+                 from here — a processed script can't take `define:vars`. */
+              <div id="captcha" data-sitekey={siteKey} />
             )
           }
           <button type="submit" class="btn btn-primary">Email me a sign-in link</button>
@@ -57,43 +57,45 @@ const siteKey = turnstileSiteKey(env);
     </div>
   </main>
 
-  {
-    /* Turnstile's widget script. `is:inline` because it's a remote src Astro must
-       not process; the CSP already allows challenges.cloudflare.com for script,
-       frame, and connect (astroidSecurity). Only loaded when there's a widget. */
-    siteKey && (
-      <script
-        is:inline
-        src="https://challenges.cloudflare.com/turnstile/v0/api.js"
-        async
-        defer
-      />
-    )
-  }
-
-  {/* Processed (NOT is:inline) so Astro's security.csp hashes it into script-src.
-      Keep it dependency-free and static — an is:inline or define:vars script here
-      would be unhashable and CSP-blocked. */}
+  {/* Processed (NOT is:inline) so Astro's security.csp hashes it into script-src,
+      and bundles the import. The widget's own script is loaded by
+      `renderTurnstile` from challenges.cloudflare.com, which the CSP already
+      allows for script, frame and connect (astroidSecurity). */}
   <script>
-    const form = document.getElementById("magic");
+    import { renderTurnstile, type TurnstileWidget } from "louise-toolkit/forms/turnstile";
+
+    const form = document.getElementById("magic") as HTMLFormElement | null;
     const msg = document.getElementById("msg");
+    const captcha = document.getElementById("captcha");
+
+    // Absent when no real site key is set — then the server's captcha plugin is
+    // off too, and the request goes without a token.
+    let widget: TurnstileWidget | null = null;
+    const ready = captcha?.dataset.sitekey
+      ? renderTurnstile(captcha, { siteKey: captcha.dataset.sitekey, size: "flexible" })
+          .then((w) => {
+            widget = w;
+          })
+          .catch(() => {
+            // The server will refuse a request without a token, so say so now
+            // rather than after the owner has typed their email.
+            if (msg) msg.textContent = "The sign-in check didn't load — reload the page to try again.";
+          })
+      : Promise.resolve();
+
     form?.addEventListener("submit", async (e) => {
       e.preventDefault();
       const input = document.getElementById("email") as HTMLInputElement | null;
       const email = input?.value.trim();
       if (!email || !msg) return;
+      await ready;
+      if (captcha && !widget) return; // the load failure is already on screen
       msg.textContent = "Sending…";
-      // Turnstile writes its token into a hidden input it injects into the form.
-      // Better Auth's captcha plugin reads it from the `x-captcha-response`
-      // HEADER (not the body), and rejects the request outright when it's
-      // missing — so this header is what makes a captcha-enabled sign-in work.
-      // Absent when no widget rendered, in which case the plugin isn't active
-      // either and the header is simply not sent.
-      const token = (form as HTMLFormElement).querySelector<HTMLInputElement>(
-        'input[name="cf-turnstile-response"]',
-      )?.value;
+      // Better Auth's captcha plugin reads the token from the `x-captcha-response`
+      // HEADER (not the body), and rejects the request outright when it's missing.
+      const token = widget?.token();
       try {
-        await fetch("/api/auth/sign-in/magic-link", {
+        const res = await fetch("/api/auth/sign-in/magic-link", {
           method: "POST",
           headers: {
             "content-type": "application/json",
@@ -101,9 +103,17 @@ const siteKey = turnstileSiteKey(env);
           },
           body: JSON.stringify({ email, callbackURL: "/?louise" }),
         });
-        msg.textContent = "If that email is an editor, a sign-in link is on its way.";
+        // Enumeration-safe either way: a non-editor gets the same 200 as an
+        // editor, so a failure here is the captcha, a rate limit, or an outage.
+        msg.textContent = res.ok
+          ? "If that email is an editor, a sign-in link is on its way."
+          : "That didn't go through — please try again.";
       } catch {
         msg.textContent = "Something went wrong — please try again.";
+      } finally {
+        // A token is single-use, and this one is spent whatever happened. Without
+        // a fresh one, "send it again" posts the spent token and is refused.
+        widget?.reset();
       }
     });
   </script>