astroidjs 0.19.0 → 0.20.0

package/dist/project/scaffold.js

@@ -31,6 +31,7 @@ import { cwvBeaconScript } from "louise-toolkit/analytics";
 import { generateMapEmbedComponent, generateMapTileRoute } from "../map/scaffold.js";
 import { generateAstroidGalleryPage } from "../portfolio/scaffold.js";
 import { astroidPortal } from "../portal/config.js";
+import { astroidHasEditor } from "../shape.js";
 import { generateAstroidPortalAuth, generateAstroidPortalAuthRoute } from "../portal/scaffold.js";
 import { generateAstroidTenancy } from "../tenancy/index.js";
 import { generateAstroidEditSession } from "../realtime/scaffold.js";
@@ -154,6 +155,10 @@ function generateAstroidSettingsHooks() {
  */
 export function generateAstroidScaffoldFiles(config) {
     const files = [];
+    // An app with no editor gets none of the editor's files: the content
+    // migrations, the CWV beacon its Health panel reads, the Actions surface
+    // over pages and settings, and the gallery page over the media library.
+    const editor = astroidHasEditor(config);
     // --- commerce: the catalog table's migration ------------------------------
     // Numbered 0003 so it lands after the template's 0000_content and the auth
     // pair (0001, 0002) that `create-astroid` writes. Without it `--commerce`
@@ -170,21 +175,25 @@ export function generateAstroidScaffoldFiles(config) {
     // filename. The CLI moves each into the site's `migrations_dir` and past
     // the site's own numbers (see migrations.ts), so a site that already has its
     // own 0004 gets the next free number instead of a second 0004.
-    files.push({
-        path: "migrations/0004_page_redirects.sql",
-        contents: ASTROID_PAGE_REDIRECTS_MIGRATION,
-        migration: true,
-    }, {
-        path: "migrations/0005_media_alt_undecided.sql",
-        contents: ASTROID_MEDIA_ALT_MIGRATION,
-        migration: true,
-    });
+    if (editor) {
+        files.push({
+            path: "migrations/0004_page_redirects.sql",
+            contents: ASTROID_PAGE_REDIRECTS_MIGRATION,
+            migration: true,
+        }, {
+            path: "migrations/0005_media_alt_undecided.sql",
+            contents: ASTROID_MEDIA_ALT_MIGRATION,
+            migration: true,
+        });
+    }
     // --- the CWV beacon -------------------------------------------------------
     // A static file under public/, so it is same-origin and covered by
     // `script-src 'self'`—an inline script carrying generated content could not
     // be hashed into the CSP and would be blocked.
-    const beacon = generateAstroidVitalsBeacon(config, cwvBeaconScript());
-    files.push({ path: beacon.path, contents: beacon.contents });
+    if (editor) {
+        const beacon = generateAstroidVitalsBeacon(config, cwvBeaconScript());
+        files.push({ path: beacon.path, contents: beacon.contents });
+    }
     // --- site-owned schema tables --------------------------------------------
     // Always: the generated src/schema.ts re-exports `./schema.site.js`, so the
     // file must exist even when empty. A project declares tables Astroid doesn't
@@ -218,10 +227,12 @@ export function generateAstroidScaffoldFiles(config) {
         files.push({ path: "src/settings-hooks.ts", contents: generateAstroidSettingsHooks() });
     }
     // --- the typed Astro Actions surface --------------------------------------
-    // Always: every project has editable pages, and the routes alone leave the
-    // Astro-native half of ADR 0001 unbuilt. Scaffold-once because it is meant to
-    // be added to.
-    files.push({ path: "src/actions/index.ts", contents: generateAstroidActions(config) });
+    // Every project with an editor: it has editable pages, and the routes alone
+    // leave the Astro-native half of ADR 0001 unbuilt. Scaffold-once because it
+    // is meant to be added to.
+    if (editor) {
+        files.push({ path: "src/actions/index.ts", contents: generateAstroidActions(config) });
+    }
     // --- commerce: the server-authoritative payment seam ----------------------
     // Scaffold-once: a real store adds shipping, tax, an order row, a receipt.
     // What's fixed is the sequence that keeps a charge correct.
@@ -243,7 +254,7 @@ export function generateAstroidScaffoldFiles(config) {
     }
     // --- portfolio: the gallery page -----------------------------------------
     // "Which assets appear, in what order" is the first thing a portfolio changes.
-    const gallery = generateAstroidGalleryPage(config);
+    const gallery = editor ? generateAstroidGalleryPage(config) : null;
     if (gallery)
         files.push({ path: "src/pages/work.astro", contents: gallery });
     // --- pwa: the service worker, manifest, and its headers -------------------

package/dist/queues/index.d.ts

@@ -1,4 +1,4 @@
 export { astroidQueueHandler, type QueueHandlerOptions } from "./consumer.js";
-export { affectsCatalog, ASTROID_DEFAULT_CRON, ASTROID_HEALTH_CRON, ASTROID_QUEUE_BINDING, ASTROID_QUEUE_RETRY_DELAY, type AstroidQueueMessage, astroidCron, astroidCrons, astroidQueueNames, astroidUsesQueues, type CatalogRefreshMessage, type WebhookMessage, } from "./messages.js";
+export { affectsCatalog, ASTROID_DEFAULT_CRON, ASTROID_HEALTH_CRON, ASTROID_QUEUE_BINDING, ASTROID_QUEUE_RETRY_DELAY, type AstroidQueueMessage, astroidCommercePipeline, astroidCron, astroidCrons, astroidQueueNames, astroidUsesQueues, type CatalogRefreshMessage, type WebhookMessage, } from "./messages.js";
 export { generateAstroidEnvBindings, generateAstroidQueueSeam, generateAstroidWebhookRoute, generateAstroidWebhookRoutes, } from "./scaffold.js";
 export { astroidQueue, handleWebhook, type QueueProducer, type WebhookRouteOptions, type WebhookVerifyInput, } from "./webhook.js";

package/dist/queues/index.js

@@ -1,5 +1,5 @@
 // Copyright (c) 2026 BowenLabs. Astroid is MIT licensed.
 export { astroidQueueHandler } from "./consumer.js";
-export { affectsCatalog, ASTROID_DEFAULT_CRON, ASTROID_HEALTH_CRON, ASTROID_QUEUE_BINDING, ASTROID_QUEUE_RETRY_DELAY, astroidCron, astroidCrons, astroidQueueNames, astroidUsesQueues, } from "./messages.js";
+export { affectsCatalog, ASTROID_DEFAULT_CRON, ASTROID_HEALTH_CRON, ASTROID_QUEUE_BINDING, ASTROID_QUEUE_RETRY_DELAY, astroidCommercePipeline, astroidCron, astroidCrons, astroidQueueNames, astroidUsesQueues, } from "./messages.js";
 export { generateAstroidEnvBindings, generateAstroidQueueSeam, generateAstroidWebhookRoute, generateAstroidWebhookRoutes, } from "./scaffold.js";
 export { astroidQueue, handleWebhook, } from "./webhook.js";

package/dist/queues/messages.d.ts

@@ -7,6 +7,12 @@ import type { AstroidConfig } from "../config.js";
  * provider's delivery timeout is shorter than your catalog sync.
  */
 export declare function astroidUsesQueues(config: AstroidConfig): boolean;
+/**
+ * Whether this project runs the commerce pipeline: the webhook receivers and the
+ * catalog re-sync. On whenever commerce is configured, unless the config sets
+ * `commerce.pipeline: false` because another project runs it.
+ */
+export declare function astroidCommercePipeline(config: AstroidConfig): boolean;
 /** Hourly. Frequent enough that stale data has a bounded lifetime, rare enough
  *  to be free. */
 export declare const ASTROID_DEFAULT_CRON = "0 * * * *";

package/dist/queues/messages.js

@@ -1,6 +1,7 @@
 // Copyright (c) 2026 BowenLabs. Astroid is MIT licensed.
 //
 // What flows through the project's queue, and when it matters.
+import { astroidHasEditor } from "../shape.js";
 /**
  * Whether this project runs a queue consumer + cron.
  *
@@ -9,7 +10,15 @@
  * provider's delivery timeout is shorter than your catalog sync.
  */
 export function astroidUsesQueues(config) {
-    return config.queues?.enabled ?? Boolean(config.commerce);
+    return config.queues?.enabled ?? astroidCommercePipeline(config);
+}
+/**
+ * Whether this project runs the commerce pipeline: the webhook receivers and the
+ * catalog re-sync. On whenever commerce is configured, unless the config sets
+ * `commerce.pipeline: false` because another project runs it.
+ */
+export function astroidCommercePipeline(config) {
+    return Boolean(config.commerce) && config.commerce?.pipeline !== false;
 }
 /** Hourly. Frequent enough that stale data has a bounded lifetime, rare enough
  *  to be free. */
@@ -18,6 +27,10 @@ export const ASTROID_DEFAULT_CRON = "0 * * * *";
 export function astroidCron(config) {
     if (!astroidUsesQueues(config))
         return null;
+    // The re-sync is part of the pipeline, so a project that leaves the pipeline
+    // to another one leaves this to it too, even when its queue runs for crons.
+    if (config.commerce && !astroidCommercePipeline(config))
+        return null;
     const cron = config.queues?.cron;
     if (cron === false)
         return null;
@@ -40,7 +53,9 @@ export const ASTROID_HEALTH_CRON = "17 4 * * *";
  * agree exactly, and a mismatch is a job that silently never runs.
  */
 export function astroidCrons(config) {
-    const crons = [ASTROID_HEALTH_CRON];
+    // The health scan reports to the editor's Health panel, over the editor's
+    // pages and media, so an app with no editor has nothing to scan or show.
+    const crons = astroidHasEditor(config) ? [ASTROID_HEALTH_CRON] : [];
     const catalog = astroidCron(config);
     if (catalog)
         crons.push(catalog);

package/dist/queues/scaffold.js

@@ -11,7 +11,7 @@
 import { astroidCatalogMirror } from "../commerce/mirror.js";
 import { astroidCommerceProviders, astroidCommerceRoles } from "../commerce/roles.js";
 import { COMMERCE_PROVIDER_SECRETS } from "../commerce/secrets.js";
-import { ASTROID_QUEUE_BINDING } from "./messages.js";
+import { ASTROID_QUEUE_BINDING, astroidCommercePipeline } from "./messages.js";
 /**
  * Per-provider webhook facts: the header, the verifier, and how it's called.
  *
@@ -244,6 +244,10 @@ export function generateAstroidWebhookRoute(config, forProvider) {
  * two roles still has one endpoint and one secret.
  */
 export function generateAstroidWebhookRoutes(config) {
+    // A project that leaves the pipeline to another one receives no webhooks: the
+    // provider delivers each event to one endpoint, and it's the other project's.
+    if (!astroidCommercePipeline(config))
+        return [];
     return astroidCommerceProviders(config.commerce).flatMap((provider) => {
         const contents = generateAstroidWebhookRoute(config, provider);
         return contents ? [{ path: `src/pages/api/webhooks/${provider}.ts`, contents }] : [];

package/dist/schema/generate.js

@@ -11,7 +11,51 @@
 // result to disk and formats it. Import ordering matches the site's schema.ts so
 // a formatter never re-flags the generated file.
 import { generateCatalogTable } from "../commerce/mirror.js";
+import { astroidHasEditor } from "../shape.js";
 import { astroidFrameworkTables } from "./framework.js";
+/** The Drizzle column builders a catalog table's source uses. */
+function catalogBuilders(catalog) {
+    const builders = ["integer", "sqliteTable", "text"];
+    if (catalog?.includes("real("))
+        builders.push("real");
+    return builders.sort();
+}
+/**
+ * The schema of an app with no editor (`editor: false`): no `pages`, no
+ * versions, and no framework tables, because nothing here edits them. What's
+ * left is what the config itself implies, the commerce catalog, and the site's
+ * own tables.
+ *
+ * A framework table the app only READS, such as `siteSettings` in a database
+ * another app owns, is imported straight from `louise-toolkit/db` where it's
+ * queried. Re-exporting it here would put it in front of drizzle-kit, which
+ * would then write migrations for a table this app doesn't own.
+ */
+function generateAppSchema(config) {
+    const catalog = generateCatalogTable(config);
+    return [
+        "// Generated by astroidjs—do not hand-edit.",
+        "// Source: your defineAstroid config. This app has no editor (`editor: false`),",
+        "// so it owns no content tables. To read one that another app owns, such as",
+        '// `siteSettings`, import it from "louise-toolkit/db" where you query it.',
+        ...(catalog
+            ? [
+                `import { ${catalogBuilders(catalog).join(", ")} } from "drizzle-orm/sqlite-core";`,
+                // The catalog's JSON columns are typed with it; the editor schema
+                // imports it for `pages.sections` anyway.
+                ...(catalog.includes("JsonValue")
+                    ? ['import type { JsonValue } from "louise-toolkit/content";']
+                    : []),
+                "",
+                catalog,
+            ]
+            : [""]),
+        "// Site-owned tables, declared in src/schema.site.ts and re-exported here so",
+        "// drizzle-kit and the worker see them. Empty until the app adds one.",
+        'export * from "./schema.site.js";',
+        "",
+    ].join("\n");
+}
 /**
  * Generate the TypeScript source of a site's Drizzle schema from an Astroid
  * config. The output is a drop-in replacement for the hand-written `schema.ts`:
@@ -19,6 +63,8 @@ import { astroidFrameworkTables } from "./framework.js";
  * table, and the re-exported framework tables the config selects.
  */
 export function generateAstroidSchema(config) {
+    if (!astroidHasEditor(config))
+        return generateAppSchema(config);
     const framework = astroidFrameworkTables(config); // sorted
     // pagesColumns is spread into `pages`; the framework tables are re-exported.
     // One import brings them all in (matching the site) so nothing is unused.
@@ -27,13 +73,11 @@ export function generateAstroidSchema(config) {
     // Only import the column builders the emitted source actually uses—an
     // unused import is a lint error in the project we're generating into, and a
     // missing one (`real`, from the catalog's price/sortOrder) is a type error.
-    const drizzleImports = ["integer", "sqliteTable", "text"];
-    if (catalog?.includes("real("))
-        drizzleImports.push("real");
+    const drizzleImports = catalogBuilders(catalog);
     return [
         "// Generated by astroidjs—do not hand-edit.",
         "// Source: your defineAstroid config.",
-        `import { ${drizzleImports.sort().join(", ")} } from "drizzle-orm/sqlite-core";`,
+        `import { ${drizzleImports.join(", ")} } from "drizzle-orm/sqlite-core";`,
         'import { collectionVersionsTable, type JsonValue } from "louise-toolkit/content";',
         `import { ${dbImports.join(", ")} } from "louise-toolkit/db";`,
         "",

package/dist/security/index.d.ts

@@ -1 +1 @@
-export { ASTROID_CHECKOUT_PATH, ASTROID_PORTAL_BASE_PATH, astroidRateRules, type RateRule, } from "./rate-rules.js";
+export { ASTROID_API_PREFIX, ASTROID_CHECKOUT_PATH, ASTROID_PORTAL_BASE_PATH, astroidRateRules, type RateRule, } from "./rate-rules.js";

package/dist/security/index.js

@@ -1,2 +1,2 @@
 // Copyright (c) 2026 BowenLabs. Astroid is MIT licensed.
-export { ASTROID_CHECKOUT_PATH, ASTROID_PORTAL_BASE_PATH, astroidRateRules, } from "./rate-rules.js";
+export { ASTROID_API_PREFIX, ASTROID_CHECKOUT_PATH, ASTROID_PORTAL_BASE_PATH, astroidRateRules, } from "./rate-rules.js";

package/dist/security/rate-rules.d.ts

@@ -9,10 +9,17 @@ export type { RateRule };
 export declare const ASTROID_PORTAL_BASE_PATH = "/api/portal-auth";
 /** Path the commerce module's checkout POSTs to. */
 export declare const ASTROID_CHECKOUT_PATH = "/api/checkout";
+/**
+ * Where an app with no editor (`editor: false`) serves its versioned JSON API.
+ * A web client and a later native client call the same routes, so a new
+ * version is a new prefix rather than a change to the one clients already use.
+ */
+export declare const ASTROID_API_PREFIX = "/api/v1";
 /**
  * The rule set for a project, derived from its config: the editor sign-in
- * surface always, the portal's credential surfaces when a portal is enabled, and
- * checkout when commerce is configured.
+ * surface unless the project has no editor, the portal's credential surfaces
+ * when a portal is enabled, checkout when commerce is configured, and the
+ * versioned API for an app with no editor.
  *
  * Rules are matched first-wins, and `security.rateRules` from the config are
  * placed FIRST—so a site tightens or loosens any default by declaring its own

package/dist/security/rate-rules.js

@@ -16,6 +16,7 @@
 // The contact form is also absent by design: it's a worker route with its own
 // per-form limiter, and worker routes are matched before Astro's middleware ever
 // runs, so a rule here would never fire.
+import { astroidHasEditor } from "../shape.js";
 /**
  * Base path the customer/portal Better Auth instance mounts at—its own
  * handler, separate from the editor's `/api/auth`. Fixed by Astroid so the rate
@@ -24,14 +25,21 @@
 export const ASTROID_PORTAL_BASE_PATH = "/api/portal-auth";
 /** Path the commerce module's checkout POSTs to. */
 export const ASTROID_CHECKOUT_PATH = "/api/checkout";
+/**
+ * Where an app with no editor (`editor: false`) serves its versioned JSON API.
+ * A web client and a later native client call the same routes, so a new
+ * version is a new prefix rather than a change to the one clients already use.
+ */
+export const ASTROID_API_PREFIX = "/api/v1";
 /** Ten minutes. Every default budget uses this window—long enough that a
  *  burst can't wait it out, short enough that a false positive self-heals. */
 const WINDOW = 600;
 const exact = (path) => (p) => p === path;
 /**
  * The rule set for a project, derived from its config: the editor sign-in
- * surface always, the portal's credential surfaces when a portal is enabled, and
- * checkout when commerce is configured.
+ * surface unless the project has no editor, the portal's credential surfaces
+ * when a portal is enabled, checkout when commerce is configured, and the
+ * versioned API for an app with no editor.
  *
  * Rules are matched first-wins, and `security.rateRules` from the config are
  * placed FIRST—so a site tightens or loosens any default by declaring its own
@@ -39,26 +47,29 @@ const exact = (path) => (p) => p === path;
  */
 export function astroidRateRules(config) {
     const rules = [...(config.security?.rateRules ?? [])];
-    // Magic-link sign-in is the email-bombing target: without a cap, anyone who
-    // knows an editor's address can trigger unbounded sign-in mail (their inbox,
-    // your Email + Worker spend). Tightest budget in the set.
-    rules.push({
-        name: "magic-link",
-        method: "POST",
-        match: exact("/api/auth/sign-in/magic-link"),
-        limit: 5,
-        windowSec: WINDOW,
-    });
-    // Everything else Better Auth serves (passkey challenges, sign-out, callbacks)
-    // behind a looser catch-all. Ordered after the specific rule above, which
-    // matters: `matchRateRule` takes the first match.
-    rules.push({
-        name: "auth",
-        method: "POST",
-        match: (p) => p.startsWith("/api/auth/"),
-        limit: 30,
-        windowSec: WINDOW,
-    });
+    // The editor's sign-in, which an app with no editor doesn't serve.
+    if (astroidHasEditor(config)) {
+        // Magic-link sign-in is the email-bombing target: without a cap, anyone who
+        // knows an editor's address can trigger unbounded sign-in mail (their inbox,
+        // your Email + Worker spend). Tightest budget in the set.
+        rules.push({
+            name: "magic-link",
+            method: "POST",
+            match: exact("/api/auth/sign-in/magic-link"),
+            limit: 5,
+            windowSec: WINDOW,
+        });
+        // Everything else Better Auth serves (passkey challenges, sign-out, callbacks)
+        // behind a looser catch-all. Ordered after the specific rule above, which
+        // matters: `matchRateRule` takes the first match.
+        rules.push({
+            name: "auth",
+            method: "POST",
+            match: (p) => p.startsWith("/api/auth/"),
+            limit: 30,
+            windowSec: WINDOW,
+        });
+    }
     if (config.portal?.enabled) {
         // The portal's mount is configurable (a site may already ship a second
         // instance at its own path), so the credential-surface rules must track the
@@ -106,5 +117,18 @@ export function astroidRateRules(config) {
             windowSec: WINDOW,
         });
     }
+    if (!astroidHasEditor(config)) {
+        // An app's own JSON API: quotes, orders, account changes. Looser than
+        // checkout because a client posts here as a cart changes, not once per
+        // purchase, so this is abuse control rather than flow control. After the
+        // specific rules, so a tighter budget for one route wins.
+        rules.push({
+            name: "api",
+            method: "POST",
+            match: (p) => p.startsWith(`${ASTROID_API_PREFIX}/`),
+            limit: 120,
+            windowSec: WINDOW,
+        });
+    }
     return rules;
 }

package/dist/seo/routes.js

@@ -13,6 +13,7 @@
 // rules are: which routes exist is a function of which modules are enabled, and
 // a hand-maintained list drifts the moment someone turns a portal on.
 import { ASTROID_PORTAL_BASE_PATH } from "../security/rate-rules.js";
+import { astroidHasEditor } from "../shape.js";
 /**
  * Paths that must never be indexed, derived from the config: the editor and its
  * API always, plus the portal's account + auth surfaces and checkout when those
@@ -25,8 +26,8 @@ export function astroidNoindexPaths(config) {
     const paths = [
         // Every worker route (editor CRUD, media, forms) and Better Auth.
         "/api/",
-        // The editor entry point.
-        "/louise",
+        // The editor entry point, when there is an editor.
+        ...(astroidHasEditor(config) ? ["/louise"] : []),
     ];
     if (config.portal?.enabled) {
         paths.push(ASTROID_PORTAL_BASE_PATH, "/account", "/login", "/register", "/reset-password");

package/dist/shape.d.ts

@@ -0,0 +1,6 @@
+import type { AstroidConfig } from "./config.js";
+/**
+ * Whether the project has a Louise editor: its routes, its sign-in, and the
+ * content tables it edits. True unless the config sets `editor: false`.
+ */
+export declare function astroidHasEditor(config: AstroidConfig): boolean;

package/dist/shape.js

@@ -0,0 +1,14 @@
+// Copyright (c) 2026 BowenLabs. Astroid is MIT licensed.
+//
+// The project's shape: a Louise-edited site, or an app with no pages to edit.
+//
+// Its own module, and dependency-free, because nearly every generator asks the
+// question and `config.ts` imports some of them at runtime. A type-only import
+// of the config keeps that from becoming a cycle.
+/**
+ * Whether the project has a Louise editor: its routes, its sign-in, and the
+ * content tables it edits. True unless the config sets `editor: false`.
+ */
+export function astroidHasEditor(config) {
+    return config.editor !== false;
+}

package/dist/status.js

@@ -19,6 +19,7 @@
 import { commerceSecretNames, resolveCommerceStatus } from "./commerce/secrets.js";
 import { ASTROID_VITALS_SECRET_NAMES } from "./analytics/index.js";
 import { EMAIL_SECRET_NAMES, resolveMailerStatus } from "./email/send.js";
+import { astroidHasEditor } from "./shape.js";
 /**
  * Secrets every Astroid site has, independent of which modules are on.
  *
@@ -40,17 +41,25 @@ export const ASTROID_CORE_SECRET_NAMES = [
  * and a marketing site shouldn't be told to provision a Square token.
  */
 export function astroidSecretNames(config) {
-    const groups = {
-        core: [...ASTROID_CORE_SECRET_NAMES],
-        email: [...EMAIL_SECRET_NAMES],
-    };
+    // An app with no editor signs nobody in unless it has a portal, which needs
+    // the session secret and mail, not the editor's Turnstile pair.
+    const editor = astroidHasEditor(config);
+    const portal = Boolean(config.portal?.enabled);
+    const groups = {};
+    if (editor)
+        groups.core = [...ASTROID_CORE_SECRET_NAMES];
+    else if (portal)
+        groups.core = ["SESSION_SECRET"];
+    if (editor || portal)
+        groups.email = [...EMAIL_SECRET_NAMES];
     const commerce = commerceSecretNames(config.commerce);
     if (commerce.length > 0)
         groups.commerce = commerce;
     // The CWV read-back's API credentials. Collection needs none of this—only
     // querying the p75 back out does, because the Analytics Engine SQL API is
-    // account-scoped and has no binding.
-    groups.vitals = [...ASTROID_VITALS_SECRET_NAMES];
+    // account-scoped and has no binding. The editor's Health panel reads it.
+    if (editor)
+        groups.vitals = [...ASTROID_VITALS_SECRET_NAMES];
     return groups;
 }
 /**
@@ -68,8 +77,11 @@ export async function astroidModuleStatus(config, env) {
         resolveCommerceStatus(config.commerce, secretEnv),
         resolveMailerStatus(env),
     ]);
-    const reports = [
-        {
+    const reports = [];
+    // Mail is for signing in: the editor's magic link, or a portal's password
+    // reset. An app with neither sends none, so there's nothing to report.
+    if (astroidHasEditor(config) || config.portal?.enabled) {
+        reports.push({
             module: "email",
             enabled: true,
             configured: mailer.configured,
@@ -79,8 +91,8 @@ export async function astroidModuleStatus(config, env) {
                 : // Naming the log is the useful part: the magic link IS in the console,
                     // and someone who doesn't know that concludes sign-in is broken.
                     "dormant — messages are logged to the console (the magic link is in the log), not sent",
-        },
-    ];
+        });
+    }
     if (commerce.enabled) {
         reports.push({
             module: "commerce",