astroidjs 0.1.1 → 0.2.0

package/dist/analytics/index.js

@@ -0,0 +1,108 @@
+// Copyright (c) 2026 BowenLabs. Astroid is MIT licensed.
+//
+// Real-visitor Core Web Vitals (#106 CWV) — the field-data half of the health
+// co-pilot.
+//
+// `HealthSummary` has carried an optional `cwv` field since the health module
+// landed, and the Health panel renders a "not measured yet" badge when it's
+// absent. Astroid never populated it, so that badge was permanently accurate and
+// permanently useless — the same dead-UI shape as the missing overview route.
+//
+// The loop has three parts and needs all three to close:
+//
+//   1. INGEST — a beacon in the page POSTs LCP/CLS/INP to `/api/louise/vitals`,
+//      which writes a data point to an Analytics Engine dataset.
+//   2. STORE — the `analytics_engine_datasets` binding. Free, and the route
+//      degrades to accept-and-drop without it.
+//   3. READ BACK — the daily health scan queries the p75 over the last day via
+//      the Analytics Engine SQL API and folds it into the summary.
+//
+// Step 3 is the one with credentials: the SQL API is account-scoped and needs an
+// API token, which no binding provides. So it follows the dormant-until-
+// provisioned convention — collection runs regardless, and the badge stays "not
+// measured yet" until the pair is real, rather than the scan erroring.
+/** The Analytics Engine dataset binding name. */
+export const ASTROID_VITALS_BINDING = "VITALS";
+/** The dataset name, derived from the project key so two Astroid sites on one
+ *  account don't write into the same table. */
+export function astroidVitalsDataset(config) {
+    return `${config.key.replace(/[^a-z0-9_]/gi, "_")}_web_vitals`;
+}
+/**
+ * Credentials the CWV READ-BACK needs — not the collection.
+ *
+ * The Analytics Engine SQL API is account-scoped and has no binding, so a token
+ * is unavoidable. Both are required together: an account id without a token (or
+ * vice versa) can't query, so partial provisioning reads as dormant exactly like
+ * every other Astroid module.
+ */
+export const ASTROID_VITALS_SECRET_NAMES = ["CF_ACCOUNT_ID", "CF_API_TOKEN"];
+/**
+ * The public beacon, as a static `public/vitals.js`.
+ *
+ * A FILE rather than an inline script, and that is a CSP decision, not a style
+ * one: Astro hashes the scripts it processes into `script-src`, and an
+ * `is:inline` script carrying generated content cannot be hashed — it would be
+ * blocked. Served from `public/`, it is same-origin and covered by
+ * `script-src 'self'` with no policy change at all.
+ */
+export function generateAstroidVitalsBeacon(config, beacon) {
+    void config;
+    return {
+        path: "public/vitals.js",
+        contents: [
+            "// Real-visitor Core Web Vitals beacon — generated by astroidjs.",
+            "//",
+            "// A static file, not an inline script: Astro hashes processed scripts into",
+            "// script-src, and an is:inline script with generated content can't be",
+            "// hashed, so it would be CSP-blocked. From public/ it is same-origin and",
+            "// already covered by script-src 'self'.",
+            "//",
+            "// It reports once per page, on visibilitychange → hidden, via sendBeacon —",
+            "// so it costs nothing on the critical path and never blocks unload.",
+            beacon,
+            "",
+        ].join("\n"),
+    };
+}
+/**
+ * The health scan's CWV read-back, as source for the generated worker.
+ *
+ * Returns `undefined` — so the badge stays "not measured yet" — when the API
+ * credentials aren't set, the query fails, or there is no field data yet. Never
+ * throws: a failed vitals query must not take down the rest of the health scan,
+ * which is mostly cheap COUNTs that have nothing to do with it.
+ */
+export function generateAstroidCwvQuery(config) {
+    const dataset = astroidVitalsDataset(config);
+    return [
+        "// Real-visitor CWV over the last day, from the Analytics Engine SQL API.",
+        "//",
+        "// The SQL API is account-scoped and has no binding, so it needs a token.",
+        "// Unprovisioned (or a failed query, or no field data yet) → undefined, and",
+        "// the Health panel shows 'not measured yet' rather than the scan failing.",
+        "async function queryCwv(env: CloudflareEnv) {",
+        "  const accountId = await readModuleSecret(env.CF_ACCOUNT_ID);",
+        "  const token = await readModuleSecret(env.CF_API_TOKEN);",
+        "  if (!accountId || !token) return undefined;",
+        "  try {",
+        "    const res = await fetch(",
+        "      `https://api.cloudflare.com/client/v4/accounts/${accountId}/analytics_engine/sql`,",
+        "      {",
+        '        method: "POST",',
+        "        headers: { authorization: `Bearer ${token}` },",
+        `        body: cwvSqlQuery(${JSON.stringify(dataset)}, 24),`,
+        "      },",
+        "    );",
+        "    if (!res.ok) return undefined;",
+        "    const body = (await res.json()) as {",
+        "      data?: { metric?: unknown; p75?: unknown; samples?: unknown }[];",
+        "    };",
+        "    const summary = summarizeCwv(parseCwvRows(body.data ?? []));",
+        "    return summary.sampleSize > 0 ? summary : undefined;",
+        "  } catch {",
+        "    return undefined;",
+        "  }",
+        "}",
+    ];
+}

package/dist/astro/csp.d.ts

@@ -0,0 +1,64 @@
+import type { AstroidConfig, CspOrigins } from "../config.js";
+/** A `sha256-…` CSP hash, in the shape Astro's `security.csp.hashes` takes. */
+export type CspHash = `${"sha256" | "sha384" | "sha512"}-${string}`;
+/**
+ * The directives Astro lets a config own. `script-src` and `style-src` are
+ * absent by design — Astro owns the first (it hashes what it processes) and the
+ * middleware owns the second.
+ *
+ * Mirrored from Astro's own union rather than imported, so `astroidjs/astro`
+ * needs no `astro` dependency. Two things fall out of matching it exactly: the
+ * returned config is assignable to `defineConfig`'s `security` without a cast,
+ * and a typo like `"img-srcs 'self'"` fails to compile *here* rather than
+ * silently producing a directive no browser enforces.
+ */
+type CspDirectiveName = "base-uri" | "child-src" | "connect-src" | "default-src" | "fenced-frame-src" | "font-src" | "form-action" | "frame-ancestors" | "frame-src" | "img-src" | "manifest-src" | "media-src" | "object-src" | "referrer" | "report-to" | "report-uri" | "require-trusted-types-for" | "sandbox" | "trusted-types" | "upgrade-insecure-requests" | "worker-src";
+/** One rendered directive line, e.g. `"default-src 'self'"`. */
+export type CspDirective = `${CspDirectiveName}${string}`;
+/** The `security` block for `astro.config.mjs`, structurally typed so Astroid
+ *  doesn't take a hard dependency on Astro's types. */
+export interface AstroidSecurityConfig {
+    csp: {
+        algorithm: "SHA-256";
+        scriptDirective: {
+            resources: string[];
+            hashes: CspHash[];
+        };
+        directives: CspDirective[];
+    };
+}
+/**
+ * Hash of Solid's inline hydration bootstrap.
+ *
+ * `@astrojs/solid-js` injects this script on every page with an island, but
+ * Astro's CSP tracker only hashes scripts it processed itself — so without this
+ * the bootstrap is blocked under `script-src 'self'` and every island silently
+ * fails to hydrate. Computed from `generateHydrationScript()` (the same call the
+ * renderer makes), so a solid-js upgrade that changes the bootstrap updates the
+ * hash on the next build.
+ */
+export declare function solidHydrationHash(): CspHash;
+/**
+ * Every origin the project's enabled modules need, merged with the config's own
+ * `security.cspOrigins`. Exported so a site (or `astroid doctor`) can inspect
+ * what a config implies without rebuilding the whole policy.
+ */
+export declare function astroidCspOrigins(config: AstroidConfig): Required<CspOrigins>;
+/**
+ * The `security` block for `astro.config.mjs` — Astro's half of the split.
+ *
+ * `style-src` is deliberately absent: the generated middleware rewrites it per
+ * response, and declaring it here would be the hash-vs-`'unsafe-inline'`
+ * conflict described at the top of this file.
+ */
+export declare function astroidSecurity(config: AstroidConfig): AstroidSecurityConfig;
+/**
+ * Vite build options the CSP depends on. `assetsInlineLimit: 0` stops Vite from
+ * inlining small assets as `data:` URLs — an inlined script would be inline, and
+ * therefore unhashed, and therefore blocked by `script-src 'self'`. Spread this
+ * into `vite.build` rather than remembering why the number is zero.
+ */
+export declare const ASTROID_VITE_BUILD: {
+    readonly assetsInlineLimit: 0;
+};
+export {};

package/dist/astro/csp.js

@@ -0,0 +1,173 @@
+// Copyright (c) 2026 BowenLabs. Astroid is MIT licensed.
+//
+// Content-Security-Policy composition, owned by Astroid rather than re-derived
+// per site.
+//
+// The split is the non-obvious part, and all three consuming sites arrived at it
+// the hard way:
+//
+//   - **Astro owns `script-src`.** Its `security.csp` hashes every script it
+//     processes, so the policy can be `'self'` with no `'unsafe-inline'`. What it
+//     does NOT hash is Solid's hydration bootstrap, which `@astrojs/solid-js`
+//     injects on every page carrying an island — Astro only tracks its own inline
+//     scripts. So we compute that hash from the very function the renderer calls,
+//     which means it follows solid-js upgrades instead of going stale as a
+//     copy-pasted literal.
+//   - **The middleware owns `style-src`.** Louise's data-driven `style=""`
+//     carriers and the editor's runtime-injected `<style>` need
+//     `'unsafe-inline'`, and per spec a single hash in `style-src` VOIDS
+//     `'unsafe-inline'` — so the two cannot coexist in one directive. The
+//     generated middleware rewrites that one directive after the fact
+//     (`cspStyleSrc`), leaving Astro's script hashes verbatim.
+//
+// Modules contribute origins; this module owns the composition seam.
+//
+// This subpath is build-time only (Node, `node:crypto`, `solid-js/web`) and is
+// deliberately NOT re-exported from the `astroidjs` entry the generated Worker
+// imports.
+import { createHash } from "node:crypto";
+import { generateHydrationScript } from "solid-js/web";
+import { astroidCommerceProviders } from "../commerce/roles.js";
+/**
+ * Hash of Solid's inline hydration bootstrap.
+ *
+ * `@astrojs/solid-js` injects this script on every page with an island, but
+ * Astro's CSP tracker only hashes scripts it processed itself — so without this
+ * the bootstrap is blocked under `script-src 'self'` and every island silently
+ * fails to hydrate. Computed from `generateHydrationScript()` (the same call the
+ * renderer makes), so a solid-js upgrade that changes the bootstrap updates the
+ * hash on the next build.
+ */
+export function solidHydrationHash() {
+    const inner = generateHydrationScript().match(/<script[^>]*>([\s\S]*?)<\/script>/)?.[1] ?? "";
+    return `sha256-${createHash("sha256").update(inner).digest("base64")}`;
+}
+/** Origins a commerce provider's client-side SDK needs. Server-only providers
+ *  (Fourthwall's storefront API) contribute nothing but their image host. */
+const COMMERCE_ORIGINS = {
+    // Square Web Payments renders the card form in an iframe from the squarecdn
+    // hosts, tokenizes against pci-connect, and pulls its own fonts. Both the
+    // sandbox and production hosts are listed so ONE build serves either
+    // environment — which environment you're in is a runtime secret, not a
+    // build-time one.
+    square: {
+        script: ["https://sandbox.web.squarecdn.com", "https://web.squarecdn.com"],
+        frame: [
+            "https://sandbox.web.squarecdn.com",
+            "https://web.squarecdn.com",
+            "https://connect.squareupsandbox.com",
+            "https://connect.squareup.com",
+        ],
+        connect: [
+            "https://pci-connect.squareupsandbox.com",
+            "https://pci-connect.squareup.com",
+            "https://sandbox.web.squarecdn.com",
+            "https://web.squarecdn.com",
+        ],
+        font: [
+            "https://square-fonts-production-f.squarecdn.com",
+            "https://d1g145x70srn7h.cloudfront.net",
+        ],
+    },
+    // Stripe.js and its Elements/Checkout iframes.
+    stripe: {
+        script: ["https://js.stripe.com"],
+        frame: ["https://js.stripe.com", "https://hooks.stripe.com"],
+        connect: ["https://api.stripe.com"],
+    },
+    // Fourthwall is read server-side; nothing runs in the browser.
+    fourthwall: {},
+};
+// Turnstile. Always allowed, not gated on the captcha being configured: the
+// scaffold ships the widget dormant (see the dormant-until-provisioned
+// convention) and it must not need a rebuild to switch on — CSP is baked at
+// build time, the secret is a runtime value.
+const TURNSTILE = {
+    script: ["https://challenges.cloudflare.com"],
+    frame: ["https://challenges.cloudflare.com"],
+    connect: ["https://challenges.cloudflare.com"],
+};
+// The map module. MapLibre spins its tile-decoding workers up from blob: URLs,
+// so `worker-src blob:` is not optional — without it the map renders an empty
+// canvas and the console fills with worker-construction errors.
+//
+// Nothing else is needed, and that's the whole argument for the self-hosted
+// basemap: the PMTiles archive is served same-origin, so `connect-src` stays
+// `'self'` with no tile host and no API key to allow.
+const MAP = { worker: ["blob:"] };
+const DIRECTIVE_KEYS = ["script", "frame", "connect", "font", "img", "worker"];
+/** Merge origin lists, de-duplicated, order preserved. */
+function mergeOrigins(...sets) {
+    const out = {};
+    for (const key of DIRECTIVE_KEYS) {
+        out[key] = [...new Set(sets.flatMap((set) => set[key] ?? []))];
+    }
+    return out;
+}
+/**
+ * Every origin the project's enabled modules need, merged with the config's own
+ * `security.cspOrigins`. Exported so a site (or `astroid doctor`) can inspect
+ * what a config implies without rebuilding the whole policy.
+ */
+export function astroidCspOrigins(config) {
+    return mergeOrigins(TURNSTILE, ...((config.modules ?? []).includes("map") ? [MAP] : []), 
+    // EVERY provider in play, not "the" provider: a site can run Stripe for
+    // invoicing beside Fourthwall for the storefront, and a policy that allowed
+    // only one of them blocks the other's SDK at runtime.
+    ...astroidCommerceProviders(config.commerce).map((p) => COMMERCE_ORIGINS[p] ?? {}), config.security?.cspOrigins ?? {});
+}
+/**
+ * Render one directive. The name is a literal from the union above, so the
+ * concatenation is a valid `CspDirective` by construction — which is what the
+ * assertion is standing in for (TS widens template concatenation to `string`).
+ */
+function directive(name, ...sources) {
+    const list = sources.flat().filter(Boolean).join(" ");
+    return (list ? `${name} ${list}` : name);
+}
+/**
+ * The `security` block for `astro.config.mjs` — Astro's half of the split.
+ *
+ * `style-src` is deliberately absent: the generated middleware rewrites it per
+ * response, and declaring it here would be the hash-vs-`'unsafe-inline'`
+ * conflict described at the top of this file.
+ */
+export function astroidSecurity(config) {
+    const origins = astroidCspOrigins(config);
+    return {
+        csp: {
+            algorithm: "SHA-256",
+            scriptDirective: {
+                resources: ["'self'", ...origins.script],
+                hashes: [solidHydrationHash()],
+            },
+            directives: [
+                directive("default-src", "'self'"),
+                // Editor-authored content may embed any https image (the sanitizer
+                // already gates that), and provider catalogs serve images from hosts
+                // that aren't ours to pin. `data:`/`blob:` cover canvas + object URLs.
+                directive("img-src", "'self' https: data: blob:", origins.img),
+                // Louise base64-inlines its brand font, hence `data:`.
+                directive("font-src", "'self' data:", origins.font),
+                directive("connect-src", "'self'", origins.connect),
+                // A bare `frame-src` with no source list is invalid CSP, so an empty
+                // origin set has to become an explicit `'none'`.
+                directive("frame-src", origins.frame.length ? origins.frame : "'none'"),
+                // Clickjacking + injection floor. `frame-ancestors 'none'` is the one
+                // that can't be set from a meta tag, so it has to live here.
+                directive("frame-ancestors", "'none'"),
+                directive("base-uri", "'self'"),
+                directive("form-action", "'self'"),
+                directive("object-src", "'none'"),
+                directive("worker-src", "'self'", origins.worker),
+            ],
+        },
+    };
+}
+/**
+ * Vite build options the CSP depends on. `assetsInlineLimit: 0` stops Vite from
+ * inlining small assets as `data:` URLs — an inlined script would be inline, and
+ * therefore unhashed, and therefore blocked by `script-src 'self'`. Spread this
+ * into `vite.build` rather than remembering why the number is zero.
+ */
+export const ASTROID_VITE_BUILD = { assetsInlineLimit: 0 };

package/dist/astro/index.d.ts

@@ -0,0 +1 @@
+export { ASTROID_VITE_BUILD, astroidCspOrigins, astroidSecurity, type AstroidSecurityConfig, type CspHash, solidHydrationHash, } from "./csp.js";

package/dist/astro/index.js

@@ -0,0 +1,7 @@
+// Copyright (c) 2026 BowenLabs. Astroid is MIT licensed.
+//
+// `astroidjs/astro` — the BUILD-TIME surface, imported from `astro.config.mjs`.
+// Kept off the main entry on purpose: it reaches for `node:crypto` and
+// `solid-js/web`, neither of which belongs in the Worker bundle the generated
+// `worker.ts` produces.
+export { ASTROID_VITE_BUILD, astroidCspOrigins, astroidSecurity, solidHydrationHash, } from "./csp.js";

package/dist/commerce/adapters.d.ts

@@ -0,0 +1,60 @@
+import type { CatalogItem } from "./sync.js";
+/** The subset of `SquareCatalogItem` the mirror reads. */
+export interface SquareItemLike {
+    id: string;
+    name: string;
+    imageUrl?: string | null;
+    variations?: {
+        id: string;
+        name: string;
+        sku?: string | null;
+        priceCents: number;
+        currency?: string;
+    }[];
+}
+/** The subset of `FwProduct` the mirror reads. */
+export interface FourthwallProductLike {
+    id: string;
+    name: string;
+    slug?: string;
+    images?: {
+        url?: string;
+    }[];
+    variants?: {
+        id: string;
+        name: string;
+        sku?: string;
+        unitPrice?: {
+            value?: number;
+            currency?: string;
+        } | null;
+        stock?: unknown;
+        attributes?: unknown;
+    }[];
+}
+/**
+ * Square item → `CatalogItem`.
+ *
+ * `price` is the LOWEST variation price. A Square item is a family ("Bag of
+ * beans" with 12oz and 2lb variations), so a single headline number has to mean
+ * "from" — taking the first variation's price instead would change with Square's
+ * ordering and quietly misprice the card.
+ */
+export declare function squareToCatalogItem(item: SquareItemLike): CatalogItem;
+/**
+ * Fourthwall product → `CatalogItem`. Same "lowest variant wins" rule as Square,
+ * for the same reason.
+ *
+ * Fourthwall already prices in major units, so there's no conversion — mirroring
+ * `lowestPrice` in `louise-toolkit/commerce/fourthwall`.
+ */
+export declare function fourthwallToCatalogItem(product: FourthwallProductLike): CatalogItem;
+/**
+ * The normalizer for a storefront provider.
+ *
+ * Stripe is absent on purpose, not by omission: its client has no catalog API,
+ * so it can only hold the invoicing role and never reaches a catalog sync. The
+ * config validation in `assertCommerceRoles` makes that unreachable anyway; this
+ * returns null rather than throwing so a caller can degrade.
+ */
+export declare function catalogNormalizer(provider: string): ((item: never) => CatalogItem) | null;

package/dist/commerce/adapters.js

@@ -0,0 +1,90 @@
+// Copyright (c) 2026 BowenLabs. Astroid is MIT licensed.
+//
+// Provider → `CatalogItem` normalizers.
+//
+// This is the file the whole module exists for. themidwestartist.com's loader
+// says it outright: coracle runs the same helper over Square, "only the
+// content/repo reads differ — issue: repo drift." Two sites, one intent, two
+// hand-written translations that drifted apart. The translation is mechanical,
+// so it belongs here once.
+//
+// Each provider's client already returns a normalized-for-that-provider shape
+// (`SquareCatalogItem`, `FwProduct`); these functions take that last step to the
+// shape the mirror stores. Deliberately pure — they take the provider's objects,
+// not credentials or an `env`, so they're trivially testable and the caller
+// keeps control of how the fetch happens (cached, paged, rate-limited).
+/** Minor units → major. Square prices in cents; the mirror stores dollars, since
+ *  that's what a template renders and what an owner types into an overlay. */
+const toMajor = (cents) => Math.round(cents) / 100;
+/**
+ * Square item → `CatalogItem`.
+ *
+ * `price` is the LOWEST variation price. A Square item is a family ("Bag of
+ * beans" with 12oz and 2lb variations), so a single headline number has to mean
+ * "from" — taking the first variation's price instead would change with Square's
+ * ordering and quietly misprice the card.
+ */
+export function squareToCatalogItem(item) {
+    const prices = (item.variations ?? []).map((v) => v.priceCents).filter((c) => Number.isFinite(c));
+    return {
+        externalId: item.id,
+        name: item.name,
+        price: prices.length ? toMajor(Math.min(...prices)) : 0,
+        images: item.imageUrl ? [item.imageUrl] : [],
+        variants: (item.variations ?? []).map((v) => ({
+            id: v.id,
+            name: v.name,
+            sku: v.sku ?? null,
+            price: toMajor(v.priceCents),
+            currency: v.currency ?? "USD",
+        })),
+    };
+}
+/**
+ * Fourthwall product → `CatalogItem`. Same "lowest variant wins" rule as Square,
+ * for the same reason.
+ *
+ * Fourthwall already prices in major units, so there's no conversion — mirroring
+ * `lowestPrice` in `louise-toolkit/commerce/fourthwall`.
+ */
+export function fourthwallToCatalogItem(product) {
+    const prices = (product.variants ?? [])
+        .map((v) => v.unitPrice?.value)
+        .filter((v) => typeof v === "number" && Number.isFinite(v));
+    return {
+        externalId: product.id,
+        name: product.name,
+        price: prices.length ? Math.min(...prices) : 0,
+        images: (product.images ?? [])
+            .map((i) => i.url)
+            .filter((u) => typeof u === "string" && u.length > 0),
+        variants: (product.variants ?? []).map((v) => ({
+            id: v.id,
+            name: v.name,
+            sku: v.sku ?? null,
+            price: v.unitPrice?.value ?? 0,
+            currency: v.unitPrice?.currency ?? "USD",
+            attributes: v.attributes ?? null,
+            stock: v.stock ?? null,
+        })),
+        externalSlug: product.slug,
+    };
+}
+/**
+ * The normalizer for a storefront provider.
+ *
+ * Stripe is absent on purpose, not by omission: its client has no catalog API,
+ * so it can only hold the invoicing role and never reaches a catalog sync. The
+ * config validation in `assertCommerceRoles` makes that unreachable anyway; this
+ * returns null rather than throwing so a caller can degrade.
+ */
+export function catalogNormalizer(provider) {
+    switch (provider) {
+        case "square":
+            return squareToCatalogItem;
+        case "fourthwall":
+            return fourthwallToCatalogItem;
+        default:
+            return null;
+    }
+}

package/dist/commerce/checkout-scaffold.d.ts

@@ -0,0 +1,42 @@
+import type { AstroidConfig } from "../config.js";
+/** Does this project take card payments in-page? Square storefront only. */
+export declare function usesCardCheckout(config: AstroidConfig): boolean;
+/**
+ * `src/pages/api/checkout.ts` — the server-authoritative payment route.
+ *
+ * Scaffold-once: a real store adds shipping, tax, an order record, a receipt
+ * email. What Astroid fixes is the sequence, because every step of it is a place
+ * where getting it wrong costs money rather than throwing an error.
+ *
+ * Returns null unless this project takes card payments.
+ */
+export declare function generateAstroidCheckoutRoute(config: AstroidConfig): string | null;
+/**
+ * `src/components/SquareCard.astro` — the card input.
+ *
+ * Square's Web Payments SDK renders the field in an iframe from their CDN and
+ * hands back a single-use token, so the raw card number never touches the Worker
+ * and the site stays out of PCI scope. That is the entire reason this is a
+ * component and not an `<input>`.
+ *
+ * Returns null unless this project takes card payments.
+ */
+export declare function generateAstroidSquareCard(config: AstroidConfig): string | null;
+/**
+ * The wrangler `vars` the card input needs, or `[]`.
+ *
+ * PUBLIC values, so they are vars rather than entries in the secret roster: the
+ * application id is shipped to the browser by design, and the environment is a
+ * choice, not a credential. Putting them in `credentials` would also fold them
+ * into the dormancy gate, which is about whether the module can safely CALL
+ * Square — a different question from whether the card field can render.
+ */
+export declare function astroidCheckoutVars(config: AstroidConfig): {
+    name: string;
+    value: string;
+}[];
+/**
+ * The `CloudflareEnv` members the card input adds, as a block `create-astroid`
+ * substitutes into `src/env.d.ts`. Empty without card checkout.
+ */
+export declare function generateAstroidCheckoutEnv(config: AstroidConfig): string;