astroidjs 0.19.0 → 0.20.0

package/bin/astroid.mjs

@@ -172,6 +172,7 @@ async function cmdDoctor(cwd, flags) {
     generateAstroidScaffoldFiles,
     astroidUsesQueues,
     astroidCrons,
+    astroidHasEditor,
     checkWranglerPreviews,
     astroidRunsMigrations,
     migrationsOwnershipError,
@@ -235,9 +236,15 @@ async function cmdDoctor(cwd, flags) {
     //
     // So check every binding the GENERATED code actually dereferences, not just
     // the three the baseline happens to have.
+    // An app with no editor (`editor: false`) uses none of the editor's
+    // bindings, so it isn't held to them: no draft buffer, no media bucket, and
+    // no mail unless its portal sends password resets.
+    const editor = astroidHasEditor(config);
     const requiredBindings = [
       { name: "RL", what: "KV namespace", why: "the rate limiter in src/middleware.ts" },
-      { name: "DRAFTS", what: "KV namespace", why: "the autosave draft buffer" },
+      ...(editor
+        ? [{ name: "DRAFTS", what: "KV namespace", why: "the autosave draft buffer" }]
+        : []),
       ...(astroidUsesQueues(config)
         ? [
             {
@@ -263,17 +270,24 @@ async function cmdDoctor(cwd, flags) {
     // it: the magic link is console-logged in dev and EMAILED in production, so
     // a missing binding is a site nobody can sign in to—and it fails only once
     // deployed, which is the one place nothing in this repo exercises.
-    if (/"send_email"\s*:/.test(w)) ok("wrangler: Email Sending `EMAIL` binding present");
-    else
+    // An app with no editor and no portal signs nobody in, so it sends no mail.
+    const sendsMail = editor || Boolean(config.portal?.enabled);
+    if (sendsMail && /"send_email"\s*:/.test(w))
+      ok("wrangler: Email Sending `EMAIL` binding present");
+    else if (sendsMail)
       err(
-        "wrangler.jsonc has no `send_email` binding, but production sign-in emails the " +
-          'magic link (it is only console-logged in dev). Add: "send_email": [{ "name": "EMAIL" }]',
+        editor
+          ? "wrangler.jsonc has no `send_email` binding, but production sign-in emails the " +
+              'magic link (it is only console-logged in dev). Add: "send_email": [{ "name": "EMAIL" }]'
+          : "wrangler.jsonc has no `send_email` binding, but the portal emails password resets " +
+              'in production (they are only console-logged in dev). Add: "send_email": [{ "name": "EMAIL" }]',
       );
 
     if (hasBinding("DB")) ok("wrangler: D1 `DB` binding present");
     else err("wrangler.jsonc has no D1 `DB` binding.");
-    if (hasBinding("MEDIA")) ok("wrangler: R2 `MEDIA` binding present");
-    else err("wrangler.jsonc has no R2 `MEDIA` binding.");
+    // An app with no editor has no media library, so no bucket to hold it.
+    if (editor && hasBinding("MEDIA")) ok("wrangler: R2 `MEDIA` binding present");
+    else if (editor) err("wrangler.jsonc has no R2 `MEDIA` binding.");
     if (/"main"\s*:\s*"src\/worker\.ts"/.test(w)) ok("wrangler: `main` → src/worker.ts");
     else warn("wrangler.jsonc `main` does not point at src/worker.ts.");
 
@@ -287,7 +301,17 @@ async function cmdDoctor(cwd, flags) {
     // JSON.parse (comments/trailing commas), matching the binding checks above.
     const expectedCrons = astroidCrons(config);
     const cronsMatch = w.match(/"crons"\s*:\s*\[([^\]]*)\]/);
-    if (!cronsMatch) {
+    const declaredAny = cronsMatch && /"[^"]+"/.test(cronsMatch[1]);
+    if (expectedCrons.length === 0) {
+      // Nothing scheduled, so the generated worker has no `scheduled` handler,
+      // and a declared trigger would fail every time it fired.
+      if (declaredAny)
+        warn(
+          "wrangler.jsonc declares `triggers.crons`, but nothing in your config is scheduled, " +
+            "so the generated worker has no `scheduled` handler for them. Remove the triggers.",
+        );
+      else ok("wrangler: no crons, and nothing is scheduled");
+    } else if (!cronsMatch) {
       err(
         "wrangler.jsonc has no `triggers.crons`, but the generated `scheduled` handler " +
           `dispatches on ${expectedCrons.map((c) => `"${c}"`).join(", ")}. ` +

package/dist/commerce/secrets.d.ts

@@ -50,6 +50,13 @@ export declare function commerceProviderCredentials(provider: CommerceProvider,
  * `.dev.vars` would be a bug rather than a redundancy.
  */
 export declare function commerceSecretNames(commerce: CommerceConfig | undefined): string[];
+/**
+ * The webhook signing secret a provider needs, or none when the project runs no
+ * pipeline (`commerce.pipeline: false`). With no receiver there is nothing to
+ * verify, so requiring the secret would hold checkout dormant for a value no
+ * code reads.
+ */
+export declare function commerceProviderWebhookSecrets(provider: CommerceProvider, commerce: CommerceConfig | undefined): readonly string[];
 /** One provider's resolved gate. */
 export interface ProviderStatus {
     provider: CommerceProvider;

package/dist/commerce/secrets.js

@@ -101,19 +101,28 @@ export function commerceProviderCredentials(provider, commerce) {
 export function commerceSecretNames(commerce) {
     const names = astroidCommerceProviders(commerce).flatMap((provider) => [
         ...commerceProviderCredentials(provider, commerce),
-        COMMERCE_PROVIDER_SECRETS[provider].webhook,
+        ...commerceProviderWebhookSecrets(provider, commerce),
     ]);
     return [...new Set(names)];
 }
+/**
+ * The webhook signing secret a provider needs, or none when the project runs no
+ * pipeline (`commerce.pipeline: false`). With no receiver there is nothing to
+ * verify, so requiring the secret would hold checkout dormant for a value no
+ * code reads.
+ */
+export function commerceProviderWebhookSecrets(provider, commerce) {
+    return commerce?.pipeline === false ? [] : [COMMERCE_PROVIDER_SECRETS[provider].webhook];
+}
 /** Read one provider's secrets off an env-shaped record. */
 async function resolveProvider(provider, roles, env, commerce) {
-    const spec = COMMERCE_PROVIDER_SECRETS[provider];
     const pick = (names) => Object.fromEntries(names.map((n) => [n, env[n]]));
     const [credentials, webhook] = await Promise.all([
         // Config-aware: a multi-location project must not be held dormant waiting
         // for a SQUARE_LOCATION_ID it will never legitimately have.
         resolveModuleSecrets(pick(commerceProviderCredentials(provider, commerce))),
-        resolveModuleSecrets(pick([spec.webhook])),
+        // Empty without a pipeline, which resolves as configured: nothing to verify.
+        resolveModuleSecrets(pick(commerceProviderWebhookSecrets(provider, commerce))),
     ]);
     return {
         provider,

package/dist/config.d.ts

@@ -175,6 +175,18 @@ export interface CommerceConfig {
     catalog?: CatalogMirrorConfig;
     /** Square-specific options. Only meaningful when Square fills some role. */
     square?: SquareCommerceConfig;
+    /**
+     * Whether this project runs the commerce pipeline: the webhook receivers, the
+     * queue consumer that processes them, and the hourly catalog re-sync. Default
+     * `true`.
+     *
+     * Set `false` for a project that only takes payments while another project,
+     * or another Worker in the same repository, runs the pipeline against the
+     * same account. It keeps what a checkout needs, the provider's CSP origins,
+     * the checkout rate rule, and the checkout route, and drops the rest, along
+     * with the webhook signing secret nothing would verify.
+     */
+    pipeline?: boolean;
 }
 export interface SquareCommerceConfig {
     /**
@@ -195,8 +207,9 @@ export interface SquareCommerceConfig {
 export interface QueuesConfig {
     /**
      * Force the queue consumer + cron on or off. Defaults to on whenever
-     * `commerce` is configured: a commerce provider means webhooks, and a webhook
-     * you process inline is a webhook you drop when the provider times out.
+     * `commerce` is configured with its pipeline: a commerce provider means
+     * webhooks, and a webhook you process inline is a webhook you drop when the
+     * provider times out.
      */
     enabled?: boolean;
     /**
@@ -497,6 +510,28 @@ export interface DeployConfig {
      */
     migrations?: boolean;
 }
+/**
+ * A small "Site by …" line the footer renders for the agency that built the
+ * site. A site fact, so it has no default: omit it and nothing renders.
+ */
+export interface CreditConfig {
+    /** Who built the site, for example `"Example Organization"`. */
+    name: string;
+    /** Where the credit links, as an absolute `http` or `https` URL. */
+    href: string;
+    /**
+     * An optional mark shown before the name: a root-relative path (for example
+     * `"/credit-mark.svg"`) or an `https:` URL. It's drawn as a mask filled with
+     * the text color, so one single-color SVG works on every theme. Only its
+     * shape counts; its own fill is ignored.
+     */
+    logo?: string;
+    /** The link's `rel`, for example `"noopener"` or `"noopener nofollow"`. The
+     *  site decides; omitted, the link carries none. */
+    rel?: string;
+    /** The words before the name. Default `"Site by"`. */
+    label?: string;
+}
 export interface AstroidConfig {
     /**
      * Stable project slug—the worker/D1/R2 base name and default subdomain (for example,
@@ -513,6 +548,21 @@ export interface AstroidConfig {
     tenancy?: TenancyConfig;
     /** Starting shape; sets section/module/nav defaults the site can override. */
     archetype: Archetype;
+    /**
+     * Whether the project has a Louise editor. Default `true`.
+     *
+     * Set `false` for an app with no pages to edit, such as an order app whose
+     * menu comes from a commerce provider and whose few settings another site's
+     * editor owns. The generated worker and middleware then carry no editor
+     * routes and no sign-in, the schema carries no content tables, and
+     * `wrangler.jsonc` binds no draft buffer, media bucket, or AI. What stays is
+     * the rate limiter, the CSP, the security headers, the public status route,
+     * and the `portal`, `pwa`, `commerce`, and `tenancy` modules.
+     *
+     * `defineAstroid` refuses every option that configures the editor
+     * alongside it, such as `sections` or `media`, rather than ignore it.
+     */
+    editor?: boolean;
     /** The single brand's theme (display name + color tokens + font). */
     theme: Theme;
     /** The editable home page, top to bottom. Omit to take the archetype default. */
@@ -583,6 +633,8 @@ export interface AstroidConfig {
     inquiries?: boolean;
     /** Installable-app settings. Only read when `modules` includes `"pwa"`. */
     pwa?: PwaConfig;
+    /** The agency credit `<Credit>` renders in the footer. Omit for none. */
+    credit?: CreditConfig;
     deploy?: DeployConfig;
 }
 export declare function defineAstroid(config: AstroidConfig): AstroidConfig;

package/dist/config.js

@@ -34,6 +34,7 @@ import { AstroidConfigError } from "./errors.js";
 // type-only, so the cycle erases at build and nothing circular exists at runtime.
 // It is also dependency-free, so `create-astroid`'s graph is unchanged.
 import { ASTROID_HEALTH_CRON, astroidCron, astroidUsesQueues } from "./queues/messages.js";
+import { astroidHasEditor } from "./shape.js";
 /**
  * Each archetype's default home-page sections.
  *
@@ -88,6 +89,13 @@ export const ASTROID_SCAFFOLD_ROUTE_SLUGS = ["contact", "login", "work"];
  * the unreachable-trigger failure `config.crons` exists to prevent.
  */
 function assertCrons(config) {
+    // `queues.cron` schedules the catalog re-sync, which belongs to the pipeline.
+    // Without one it would be accepted and never scheduled.
+    if (config.commerce?.pipeline === false && typeof config.queues?.cron === "string") {
+        throw new AstroidConfigError("`queues.cron` schedules the catalog re-sync, which `commerce.pipeline: false` " +
+            "leaves to the project that runs the pipeline. Remove `queues.cron`, or use " +
+            "`crons` for a job of this project's own.");
+    }
     const crons = config.crons ?? [];
     if (crons.length === 0)
         return;
@@ -96,7 +104,7 @@ function assertCrons(config) {
             "without it the generated handler would `send` to a binding this project never creates. " +
             "Set `queues: { enabled: true }`, or drop the crons.");
     }
-    const seen = new Map([[ASTROID_HEALTH_CRON, "the daily health scan"]]);
+    const seen = new Map(astroidHasEditor(config) ? [[ASTROID_HEALTH_CRON, "the daily health scan"]] : []);
     const catalog = astroidCron(config);
     if (catalog)
         seen.set(catalog, "the catalog re-sync (`queues.cron`)");
@@ -196,6 +204,79 @@ function assertMediaConfig(media) {
             "would fail with an error the media route never sees.");
     }
 }
+/**
+ * A credit that would render as a broken link or an empty mark.
+ *
+ * The logo is limited to a root-relative path or `https:` because it lands in a
+ * CSS `url()`: a `data:` or `javascript:` value there is at best unrenderable,
+ * and a relative one resolves against each page's path rather than the site.
+ */
+function assertCredit(credit) {
+    if (!credit)
+        return;
+    if (!credit.name?.trim()) {
+        throw new AstroidConfigError("`credit.name` is required: the name the footer credits");
+    }
+    let href;
+    try {
+        href = new URL(credit.href);
+    }
+    catch {
+        // Reported below with the value that failed.
+    }
+    if (!href || (href.protocol !== "https:" && href.protocol !== "http:")) {
+        throw new AstroidConfigError(`\`credit.href\` must be an absolute http or https URL, such as "https://example.com", ` +
+            `but it's "${credit.href}"`);
+    }
+    const logo = credit.logo;
+    if (logo !== undefined &&
+        !(logo.startsWith("/") && !logo.startsWith("//")) &&
+        !logo.startsWith("https://")) {
+        throw new AstroidConfigError(`\`credit.logo\` must be a root-relative path such as "/credit-mark.svg" or an ` +
+            `https URL, but it's "${logo}"`);
+    }
+}
+/**
+ * The options an app with no editor can't honor. Each configures the editor, a
+ * table it edits, or a surface only an editor reviews, so accepting one would
+ * be accepting a setting nothing reads.
+ */
+const EDITOR_ONLY_OPTIONS = [
+    ["sections", "the editable home page"],
+    ["sectionCatalog", "the page editor's sections"],
+    ["blockCatalog", "the page editor's blocks"],
+    ["media", "the media library"],
+    ["pages", "the editable pages"],
+    ["settings", "the Settings panel"],
+];
+/** Modules that only work with an editor, and why. */
+const EDITOR_ONLY_MODULES = {
+    realtime: "it syncs editors editing one page",
+    wholesaleInquiry: "its inquiries are reviewed in the editor",
+};
+function assertEditorFree(config) {
+    if (astroidHasEditor(config))
+        return;
+    const without = "An app with `editor: false` has no editor";
+    for (const [key, what] of EDITOR_ONLY_OPTIONS) {
+        if (config[key] !== undefined) {
+            throw new AstroidConfigError(`${without}, so \`${key}\` (${what}) would do nothing. Remove it, or drop \`editor: false\`.`);
+        }
+    }
+    if (config.inquiries === true) {
+        throw new AstroidConfigError(`${without} to review inquiries in, so \`inquiries: true\` would collect messages ` +
+            "nobody reads. Remove it, or drop `editor: false`.");
+    }
+    for (const module of [...(config.modules ?? []), ...(config.portal?.features ?? [])]) {
+        const why = EDITOR_ONLY_MODULES[module];
+        if (why) {
+            throw new AstroidConfigError(`${without}, so the \`${module}\` module can't work: ${why}. Remove it, or drop \`editor: false\`.`);
+        }
+    }
+    if (config.deploy?.mediaBase !== undefined) {
+        throw new AstroidConfigError(`${without} and no media library, so \`deploy.mediaBase\` would do nothing. Remove it.`);
+    }
+}
 export function defineAstroid(config) {
     if (!config.key || config.key.trim().length === 0) {
         throw new AstroidConfigError("Astroid config requires a non-empty `key` (it names the generated worker/D1/R2 bindings)");
@@ -231,6 +312,8 @@ export function defineAstroid(config) {
     assertCrons(config);
     assertTenancy(config);
     assertAllowSlugs(config);
+    assertEditorFree(config);
+    assertCredit(config.credit);
     if (config.portal?.gated) {
         throw new AstroidConfigError("`portal.gated` is not implemented: it is accepted but wires no guard, so the site " +
             "would be fully public while appearing gated. Remove it, and gate the whole site by " +

package/dist/index.d.ts

@@ -15,6 +15,7 @@ export * from "./queues/index.js";
 export * from "./schema/index.js";
 export * from "./security/index.js";
 export * from "./seo/index.js";
+export * from "./shape.js";
 export * from "./status.js";
 export * from "./tenancy/index.js";
 export * from "./worker/index.js";

package/dist/index.js

@@ -20,6 +20,7 @@ export * from "./queues/index.js";
 export * from "./schema/index.js";
 export * from "./security/index.js";
 export * from "./seo/index.js";
+export * from "./shape.js";
 export * from "./status.js";
 export * from "./tenancy/index.js";
 export * from "./worker/index.js";

package/dist/project/generate.js

@@ -17,10 +17,11 @@
 import { ASTROID_VITALS_BINDING, astroidVitalsDataset } from "../analytics/index.js";
 import { astroidCheckoutVars } from "../commerce/checkout-scaffold.js";
 import { astroidCommerceProviders } from "../commerce/roles.js";
-import { COMMERCE_PROVIDER_SECRETS, COMMERCE_PROVIDER_SETUP, commerceSecretNames, } from "../commerce/secrets.js";
+import { COMMERCE_PROVIDER_SECRETS, COMMERCE_PROVIDER_SETUP, commerceProviderWebhookSecrets, commerceSecretNames, } from "../commerce/secrets.js";
 import { ASTROID_QUEUE_BINDING, ASTROID_QUEUE_RETRY_DELAY, astroidCrons, astroidQueueNames, astroidUsesQueues, } from "../queues/messages.js";
 import { ASTROID_EDIT_SESSION_CLASS, ASTROID_REALTIME_BINDING, ASTROID_REALTIME_MIGRATION_TAG, usesRealtime, } from "../realtime/scaffold.js";
 import { ASTROID_SECRET_PLACEHOLDER } from "../secrets.js";
+import { astroidHasEditor } from "../shape.js";
 import { tenancyZone } from "../tenancy/index.js";
 import { generateAstroidSchema } from "../schema/generate.js";
 import { ASTROID_AI_GATEWAY_VAR } from "../worker/gateway.js";
@@ -93,7 +94,10 @@ export function generateAstroidSecretsEnv(config) {
     for (const provider of providers) {
         const spec = COMMERCE_PROVIDER_SECRETS[provider];
         lines.push("#", `# ${provider}: ${COMMERCE_PROVIDER_SETUP[provider]}`);
-        for (const name of [...spec.credentials, spec.webhook]) {
+        for (const name of [
+            ...spec.credentials,
+            ...commerceProviderWebhookSecrets(provider, config.commerce),
+        ]) {
             lines.push(`${name}=${ASTROID_SECRET_PLACEHOLDER}`);
         }
     }
@@ -116,6 +120,12 @@ const COMPATIBILITY_DATE = "2026-06-20";
  */
 export function generateAstroidWrangler(config) {
     const key = config.key;
+    // An app with no editor binds none of what the editor uses: the media bucket
+    // and Images, the draft buffer, Workers AI, and the CWV dataset. It sends mail
+    // only for a portal's password resets.
+    const editor = astroidHasEditor(config);
+    const mail = editor || Boolean(config.portal?.enabled);
+    const crons = astroidCrons(config);
     const mediaBase = config.deploy?.mediaBase ?? "/media";
     const hosts = config.hosts ?? [];
     const primaryHost = hosts[0];
@@ -184,7 +194,10 @@ export function generateAstroidWrangler(config) {
     // Daily: the site-health scan (broken links, missing alt text, SEO gaps).
     // Hourly (commerce only): the catalog re-sync safety net, so a missed or DLQ'd
     // webhook can only leave the site stale until the next tick.
-    p(`  "triggers": { "crons": ${JSON.stringify(astroidCrons(config))} },`);
+    // None at all for an app with nothing scheduled: a trigger with no handler
+    // is an invocation that fails every time it fires.
+    if (crons.length > 0)
+        p(`  "triggers": { "crons": ${JSON.stringify(crons)} },`);
     if (astroidUsesQueues(config)) {
         const { queue, dlq } = astroidQueueNames(config);
         p("  // Provider webhooks are verified at the edge, then enqueued here so the");
@@ -208,41 +221,59 @@ export function generateAstroidWrangler(config) {
         p("    ],");
         p("  },");
     }
-    p("  // D1 holds pages / site_settings / media / inquiries (schema in src/schema.ts,");
-    p("  // migrations in ./migrations). Create it: `wrangler d1 create <name>`.");
+    if (editor) {
+        p("  // D1 holds pages / site_settings / media / inquiries (schema in src/schema.ts,");
+        p("  // migrations in ./migrations). Create it: `wrangler d1 create <name>`.");
+    }
+    else {
+        p("  // D1: this app's tables (src/schema.ts), or the database of the app that");
+        p("  // owns the schema, bound by its id. Create one: `wrangler d1 create <name>`.");
+    }
     p('  "d1_databases": [');
     p("    {");
     p('      "binding": "DB",');
     p(`      "database_name": ${JSON.stringify(key)},`);
     p('      "database_id": "<run: wrangler d1 create ' + key + '>",');
-    p('      "migrations_dir": "migrations",');
+    // Left out when another app migrates this database (`deploy.migrations:
+    // false`), which `astroid doctor` would otherwise report as a contradiction.
+    if (config.deploy?.migrations !== false)
+        p('      "migrations_dir": "migrations",');
     p("    },");
     p("  ],");
-    p("  // R2 bucket for uploaded media, streamed back through the Worker at MEDIA_URL");
-    p("  // (no public bucket). Create it: `wrangler r2 bucket create <name>-media`.");
-    p(`  "r2_buckets": [{ "binding": "MEDIA", "bucket_name": ${JSON.stringify(`${key}-media`)} }],`);
-    p("  // Cloudflare Images: the media route reads upload dimensions + backs server-");
-    p("  // side re-encode. Also @astrojs/cloudflare's production image service.");
-    p('  "images": { "binding": "IMAGES" },');
-    p("  // Analytics Engine: real-visitor Core Web Vitals. Free, and the ingest");
-    p("  // route accepts-and-drops without it, so it costs nothing unused. Reading");
-    p("  // the p75 back out needs CF_ACCOUNT_ID + CF_API_TOKEN (see .env.example)—");
-    p("  // until those are real the Health badge reads 'not measured yet'.");
-    p(`  "analytics_engine_datasets": [{ "binding": ${JSON.stringify(ASTROID_VITALS_BINDING)}, "dataset": ${JSON.stringify(astroidVitalsDataset(config))} }],`);
-    p("  // Workers AI. Powers the editor's rewrite + SEO-suggest buttons and alt-text");
-    p("  // generation on upload—all of which SHIP IN THE EDITOR DRAWER already and,");
-    p("  // without this binding, were permanently invisible: their routes answer 503");
-    p("  // and the client hides the button. No account setup beyond the binding, and");
-    p("  // every call is editor-gated, so a visitor can never spend your AI budget.");
-    p('  "ai": { "binding": "AI" },');
-    p("  // KV: RL = the security rate limiter (it also holds the daily site-health");
-    p("  // summary under its own key—one small singleton blob, not worth a binding");
-    p("  // someone has to remember to provision); DRAFTS = the autosave write-buffer.");
-    p("  // Named for the project, so two sites in one account don't collide.");
-    p("  // `astroid provision` creates each and fills in its id.");
+    if (editor) {
+        p("  // R2 bucket for uploaded media, streamed back through the Worker at MEDIA_URL");
+        p("  // (no public bucket). Create it: `wrangler r2 bucket create <name>-media`.");
+        p(`  "r2_buckets": [{ "binding": "MEDIA", "bucket_name": ${JSON.stringify(`${key}-media`)} }],`);
+        p("  // Cloudflare Images: the media route reads upload dimensions + backs server-");
+        p("  // side re-encode. Also @astrojs/cloudflare's production image service.");
+        p('  "images": { "binding": "IMAGES" },');
+        p("  // Analytics Engine: real-visitor Core Web Vitals. Free, and the ingest");
+        p("  // route accepts-and-drops without it, so it costs nothing unused. Reading");
+        p("  // the p75 back out needs CF_ACCOUNT_ID + CF_API_TOKEN (see .env.example)—");
+        p("  // until those are real the Health badge reads 'not measured yet'.");
+        p(`  "analytics_engine_datasets": [{ "binding": ${JSON.stringify(ASTROID_VITALS_BINDING)}, "dataset": ${JSON.stringify(astroidVitalsDataset(config))} }],`);
+        p("  // Workers AI. Powers the editor's rewrite + SEO-suggest buttons and alt-text");
+        p("  // generation on upload—all of which SHIP IN THE EDITOR DRAWER already and,");
+        p("  // without this binding, were permanently invisible: their routes answer 503");
+        p("  // and the client hides the button. No account setup beyond the binding, and");
+        p("  // every call is editor-gated, so a visitor can never spend your AI budget.");
+        p('  "ai": { "binding": "AI" },');
+        p("  // KV: RL = the security rate limiter (it also holds the daily site-health");
+        p("  // summary under its own key—one small singleton blob, not worth a binding");
+        p("  // someone has to remember to provision); DRAFTS = the autosave write-buffer.");
+        p("  // Named for the project, so two sites in one account don't collide.");
+        p("  // `astroid provision` creates each and fills in its id.");
+    }
+    else {
+        p("  // KV: RL = the security rate limiter. Named for the project, so two apps in");
+        p("  // one account don't collide. `astroid provision` creates it and fills in");
+        p("  // its id.");
+    }
     p('  "kv_namespaces": [');
     p(`    { "binding": "RL", "id": "<run: wrangler kv namespace create ${key}-rl>" },`);
-    p(`    { "binding": "DRAFTS", "id": "<run: wrangler kv namespace create ${key}-drafts>" },`);
+    if (editor) {
+        p(`    { "binding": "DRAFTS", "id": "<run: wrangler kv namespace create ${key}-drafts>" },`);
+    }
     p("  ],");
     // Email Sending. NOT optional decoration: `src/env.d.ts` declares EMAIL as a
     // required member, and Better Auth's magic-link path console-logs the link in
@@ -251,31 +282,44 @@ export function generateAstroidWrangler(config) {
     // sign-in was impossible on every DEPLOYED site, while every local build
     // and every CI scaffold passed. Nothing in this repo runs a deployed scaffold,
     // which is why it survived.
-    p("  // Cloudflare Email Sending—magic-link sign-in + inquiry notifications.");
-    p("  // Sign-in DEPENDS on this: in production the magic link is emailed, not logged.");
-    p("  // Enable Email Sending for your zone, then verify the address in MAIL_FROM.");
-    p('  "send_email": [{ "name": "EMAIL" }],');
-    p("  // Public base for media URLs; same-origin keeps media self-contained. Read off");
-    p("  // the runtime env by the framework-agnostic media route, so it stays a `var`.");
+    if (editor) {
+        p("  // Cloudflare Email Sending—magic-link sign-in + inquiry notifications.");
+        p("  // Sign-in DEPENDS on this: in production the magic link is emailed, not logged.");
+    }
+    else if (mail) {
+        p("  // Cloudflare Email Sending—the portal's password-reset mail, which is");
+        p("  // logged in dev and emailed in production.");
+    }
+    if (mail) {
+        p("  // Enable Email Sending for your zone, then verify the address in MAIL_FROM.");
+        p('  "send_email": [{ "name": "EMAIL" }],');
+    }
+    if (editor) {
+        p("  // Public base for media URLs; same-origin keeps media self-contained. Read off");
+        p("  // the runtime env by the framework-agnostic media route, so it stays a `var`.");
+    }
     p('  "vars": {');
-    p(`    "MEDIA_URL": ${JSON.stringify(mediaBase)},`);
+    if (editor)
+        p(`    "MEDIA_URL": ${JSON.stringify(mediaBase)},`);
     p(`    "SITE_URL": ${JSON.stringify(primaryHost ? `https://${primaryHost}` : `https://${key}.workers.dev`)},`);
-    p("    // The editor allowlist / owner. Wire this into your auth seam (src/auth.ts).");
-    p('    "OWNER_EMAIL": "",');
-    p("    // AI Gateway for the editor's AI assists: request logs, latency and error");
-    p("    // rates, and caching. Empty calls Workers AI directly. Create a gateway,");
-    p("    // put its id here, and first say on the privacy page that its log holds");
-    p("    // the text editors send to the assists.");
-    p(`    "${ASTROID_AI_GATEWAY_VAR}": "",`);
-    p("    // Edge caching for published pages (ADR 0004). OFF by default, and the");
-    p("    // default is the safe state: with it off every render is `no-store` and");
-    p("    // the Worker cache layer stores nothing.");
-    p("    //");
-    p("    // Turn it on for a PREVIEW deploy first and walk the activation runbook");
-    p("    // (docs/adr/0004-edge-caching.md). `caches.default` is not cleared by");
-    p("    // Cloudflare Dev Mode or Purge Everything, so a bad prod flip is hard to");
-    p("    // undo—this feature was reverted twice for exactly that.");
-    p('    "ASTROID_EDGE_CACHE": "false",');
+    if (editor) {
+        p("    // The editor allowlist / owner. Wire this into your auth seam (src/auth.ts).");
+        p('    "OWNER_EMAIL": "",');
+        p("    // AI Gateway for the editor's AI assists: request logs, latency and error");
+        p("    // rates, and caching. Empty calls Workers AI directly. Create a gateway,");
+        p("    // put its id here, and first say on the privacy page that its log holds");
+        p("    // the text editors send to the assists.");
+        p(`    "${ASTROID_AI_GATEWAY_VAR}": "",`);
+        p("    // Edge caching for published pages (ADR 0004). OFF by default, and the");
+        p("    // default is the safe state: with it off every render is `no-store` and");
+        p("    // the Worker cache layer stores nothing.");
+        p("    //");
+        p("    // Turn it on for a PREVIEW deploy first and walk the activation runbook");
+        p("    // (docs/adr/0004-edge-caching.md). `caches.default` is not cleared by");
+        p("    // Cloudflare Dev Mode or Purge Everything, so a bad prod flip is hard to");
+        p("    // undo—this feature was reverted twice for exactly that.");
+        p('    "ASTROID_EDGE_CACHE": "false",');
+    }
     for (const v of astroidCheckoutVars(config)) {
         // Public, not secret—the app id ships to the browser to mount the card
         // field, and the environment is a choice. Keeping them out of the secret