caracms 0.7.0 → 0.8.0

package/src/editor/server/media/config.ts

@@ -16,9 +16,12 @@
  * - **And the clips' (caracms-cloud M4.5 Decision 15)**: with the key, clips go through the
  *   cloud's Mux (cloud-mux.ts), and the site's own `MUX_TOKEN_ID` / `MUX_TOKEN_SECRET`
  *   beside it is a problem sentence naming them (one credential, not two).
+ * - **With the config's `services`** (caracms-cloud M5 Decision 2) the other mode's variables
+ *   are never read (live/services.ts), and a cloud site without its key has neither.
  */
 import type { CloudConnection } from '../../../live/cloud.ts';
 import { CLOUD_AND_MUX_PROBLEM, OWN_MUX_VARIABLES, readCloudUrl } from '../../../live/mode.ts';
+import { bakedServices, CLOUD_KEY_MISSING_PROBLEM, servicesEnv, type Services } from '../../../live/services.ts';
 import { cloudMedia, isProductionBuild, readMediaConfig, type MediaSettings } from '../../../media.ts';
 
 type Env = Record<string, string | undefined>;
@@ -53,15 +56,17 @@ const get = (env: Env, name: string) => {
 const memory = (env: Env) => get(env, 'CARACMS_MEDIA') === 'memory';
 
 /** The image routes' settings: the bucket, and imgproxy's for the thumbnails. */
-export function readImagesConfig(env: Env = process.env, production = isProductionBuild()): ImagesConfig {
+export function readImagesConfig(env: Env = process.env, production = isProductionBuild(), services: Services | null = bakedServices()): ImagesConfig {
+	env = servicesEnv(env, services);
 	if (memory(env)) {
 		if (production) return { kind: 'unset', message: MEMORY_IN_PRODUCTION, missing: [] };
-		const signing = readMediaConfig(env, production);
+		const signing = readMediaConfig(env, production, services);
 		if (signing.kind !== 'ready') return { kind: 'unset', message: MEMORY_IN_PRODUCTION, missing: [] };
 		return { kind: 'memory', signing: signing.settings };
 	}
-	const signing = readMediaConfig(env, production);
-	const cloud = cloudMedia(env);
+	if (services === 'cloud' && !get(env, 'CARACMS_CLOUD_KEY')) return { kind: 'unset', message: CLOUD_KEY_MISSING_PROBLEM, missing: [] };
+	const signing = readMediaConfig(env, production, services);
+	const cloud = cloudMedia(env, services);
 	if (cloud) {
 		if (signing.kind === 'ready') return { kind: 'cloud', signing: signing.settings, connection: cloud.connection };
 		return { kind: 'unset', message: signing.problems.join(' '), missing: [] };
@@ -86,9 +91,11 @@ export function readImagesConfig(env: Env = process.env, production = isProducti
 }
 
 /** The clip routes' settings: the cloud's Mux (the site key), or the site's Mux environment's token. */
-export function readMuxConfig(env: Env = process.env, production = isProductionBuild()): MuxConfig {
+export function readMuxConfig(env: Env = process.env, production = isProductionBuild(), services: Services | null = bakedServices()): MuxConfig {
+	env = servicesEnv(env, services);
 	if (memory(env)) return production ? { kind: 'unset', message: MEMORY_IN_PRODUCTION, missing: [] } : { kind: 'memory' };
 	const key = get(env, 'CARACMS_CLOUD_KEY');
+	if (services === 'cloud' && !key) return { kind: 'unset', message: CLOUD_KEY_MISSING_PROBLEM, missing: [] };
 	if (key) {
 		const problems: string[] = [];
 		const both = OWN_MUX_VARIABLES.filter((name) => get(env, name));

package/src/editor/server/mode.ts

@@ -15,6 +15,7 @@
 import type { ResolvedSite } from '../../config.ts';
 import { liveEditor, type LiveEditor } from '../../live/editor.ts';
 import { readMode, unconfiguredMessage, type Baked, type Mode } from '../../live/mode.ts';
+import { bakedServices } from '../../live/services.ts';
 import { localDraftsStore, type DraftsStore } from './drafts-store.ts';
 
 declare const __CARACMS_PRODUCTION__: boolean | undefined;
@@ -26,11 +27,12 @@ export function isProductionServer(): boolean {
 	return typeof __CARACMS_PRODUCTION__ === 'boolean' ? __CARACMS_PRODUCTION__ : false;
 }
 
-/** The site's address and the commit the build baked in (runs-anywhere Decisions 7 and 9); empty in plain Node (tests). */
+/** The site's address, the commit and the config's `services` the build baked in (runs-anywhere Decisions 7 and 9, caracms-cloud M5 Decision 1); empty in plain Node (tests). */
 export function bakedAtBuild(): Baked {
 	return {
 		site: typeof __CARACMS_SITE__ === 'string' ? __CARACMS_SITE__ : null,
 		commit: typeof __CARACMS_BUILD_COMMIT__ === 'string' ? __CARACMS_BUILD_COMMIT__ : null,
+		services: bakedServices(),
 	};
 }
 

package/src/email.ts

@@ -10,6 +10,8 @@
  * reaches anyone's inbox. It never throws: an unset key or sender, Resend's refusal
  * or a timeout all come back as a result with a sentence.
  */
+import { bakedServices, servicesEnv } from './live/services.ts';
+
 export const RESEND_URL = 'https://api.resend.com/emails';
 export const SEND_TIMEOUT_MS = 10_000;
 
@@ -30,7 +32,8 @@ export async function sendEmail(
 	email: Email,
 	options: { env?: Record<string, string | undefined>; fetch?: typeof fetch; timeoutMs?: number } = {},
 ): Promise<SendResult> {
-	const env = options.env ?? process.env;
+	// caracms-cloud M5 Decision 2: on a cloud site RESEND_API_KEY and FORMS_FROM are never read (the cloud sends).
+	const env = servicesEnv(options.env ?? process.env, bakedServices());
 	const timeoutMs = options.timeoutMs ?? SEND_TIMEOUT_MS;
 	const apiKey = (env['RESEND_API_KEY'] ?? '').trim();
 	const from = (env['FORMS_FROM'] ?? '').trim();

package/src/forms/store.ts

@@ -36,6 +36,7 @@ import { mkdir, readdir, readFile, rmdir, unlink, writeFile } from 'node:fs/prom
 import { dirname, join, resolve, sep } from 'node:path';
 import { AwsClient } from 'aws4fetch';
 import { cloudForms } from '../live/mode.ts';
+import { bakedServices, CLOUD_KEY_MISSING_PROBLEM, servicesEnv, type Services } from '../live/services.ts';
 import { cloudStore } from './cloud-store.ts';
 import { isSubmissionId, shownFileName } from './rules.ts';
 
@@ -459,17 +460,21 @@ const list = (names: readonly string[]) => (names.length <= 1 ? names.join('') :
 export const isProductionEnv = (env: Env): boolean => env['NODE_ENV'] === 'production';
 
 /** Decision 7's rule, from the environment. Read on each call (cheap). */
-export function readSubmissionsConfig(root: string, env: Env = process.env, production = isProductionEnv(env)): SubmissionsConfig {
+export function readSubmissionsConfig(root: string, env: Env = process.env, production = isProductionEnv(env), services: Services | null = bakedServices()): SubmissionsConfig {
+	// caracms-cloud M5 Decision 2: with the config's `services`, the other mode's variables are never read.
+	env = servicesEnv(env, services);
 	const get = (name: string) => env[name]?.trim() || '';
 	const mode = get('CARACMS_SUBMISSIONS');
 	if (mode === 'memory') return production ? { kind: 'unset', message: SUBMISSIONS_MEMORY_IN_PRODUCTION, missing: [] } : { kind: 'memory' };
 	if (mode) return { kind: 'unset', message: `CARACMS_SUBMISSIONS must be "memory" or unset (got "${mode}").`, missing: [] };
 	// The key with the site's own variables is a mistake everywhere (M4 Decision 22), as the media's is.
-	const cloud = cloudForms(env);
+	const cloud = cloudForms(env, services);
 	if (cloud?.problems.length) return { kind: 'unset', message: cloud.problems.join(' '), missing: [] };
 	// Outside production: the folder, even with the cloud key (M4's Core framing).
 	if (!production) return { kind: 'folder', dir: join(root, LOCAL_SUBMISSIONS_FOLDER) };
 	if (cloud) return { kind: 'cloud', connection: cloud.connection };
+	// M5 Decision 4: a cloud site without its key, never the site's own bucket instead.
+	if (services === 'cloud') return { kind: 'unset', message: CLOUD_KEY_MISSING_PROBLEM, missing: ['CARACMS_CLOUD_KEY'] };
 	const missing = [...SUBMISSIONS_ENV, ...SHARED_ENV].filter((name) => !get(name));
 	if (missing.length) {
 		return {

package/src/index.ts

@@ -466,6 +466,8 @@ export default function caracms(config: SiteConfig): AstroIntegration {
 							// Runs-anywhere Decisions 7 and 9: the address and the commit the build was made with (editor/server/mode.ts → bakedAtBuild).
 							__CARACMS_SITE__: JSON.stringify(astroConfig.site ?? address.url ?? null),
 							__CARACMS_BUILD_COMMIT__: JSON.stringify(commit),
+							// caracms-cloud M5 Decision 1: the config's `services`, for the key-or-own readers (live/services.ts → bakedServices).
+							__CARACMS_SERVICES__: JSON.stringify(site.services),
 							__CARACMS_TOKENS_CSS__: JSON.stringify(readFileSync(new URL('./editor/styles/tokens.css', import.meta.url), 'utf8')),
 						},
 						// Installed from npm, the package ships TypeScript and .astro source.
@@ -518,7 +520,7 @@ export default function caracms(config: SiteConfig): AstroIntegration {
 			// caracms-cloud M3 Decision 20: a cloud site's settings, fetched once before any page renders; a refusal fails the build.
 			'astro:build:start': async () => {
 				shareBuildReads(true);
-				await cloudSettingsForBuild();
+				await cloudSettingsForBuild(process.env, site.services);
 			},
 			'astro:build:done': () => {
 				shareBuildReads(false);

package/src/live/mode.ts

@@ -17,12 +17,20 @@
  *   browser runs, never against the site's own repo. It's live mode with no App and
  *   no repo, and it's **refused in production**.
  *
+ * - **The config's `services`** (caracms-cloud M5, live/services.ts, baked in as `Baked.services`):
+ *   with it, the other mode's variables are removed before anything here reads them, so the
+ *   "not both" sentences below only ever apply to a config without the field (Decision 3);
+ *   `'cloud'` without the key is `CLOUD_KEY_MISSING_PROBLEM` on a production server (Decision 4).
+ *
  * This only reads; it doesn't wire anything (Phase 2 switches the routes on it,
  * Phase 3 guards with it).
  */
 import { CLOUD_KEY_SHAPE, DEFAULT_CLOUD_URL } from './cloud.ts';
 import { DEFAULT_BRANCHES, type BranchNames } from './branches.ts';
 import { DEFAULT_TIMINGS, type LiveTimings } from './timings.ts';
+import { bakedServices, CLOUD_KEY_MISSING_PROBLEM, OWN_FORMS_VARIABLES, OWN_MEDIA_VARIABLES, OWN_MUX_VARIABLES, servicesEnv, type Services } from './services.ts';
+
+export { OWN_FORMS_VARIABLES, OWN_MEDIA_VARIABLES, OWN_MUX_VARIABLES };
 
 export interface LiveSettings {
 	/** `memory`: the in-memory GitHub backend (Decision 2). `token`: CARACMS_GITHUB_TOKEN (runs-anywhere Decision 3). */
@@ -81,6 +89,8 @@ export interface Baked {
 	site?: string | null;
 	/** The commit the build was made from (runs-anywhere Decision 9). */
 	commit?: string | null;
+	/** The config's `services` (caracms-cloud M5 Decision 1; live/services.ts). Null or missing: the key decides (Decision 3). */
+	services?: Services | null;
 }
 
 // The sentences the configuration problems print, kept here so the docs can quote them.
@@ -97,15 +107,9 @@ export const CLOUD_KEY_PROBLEM =
 	"CARACMS_CLOUD_KEY isn't a CaraCMS Cloud site key: a key is cck_ followed by 43 letters, digits, - and _. Copy it again from app.caracms.com.";
 export const CLOUD_AND_GITHUB_PROBLEM = (other: string) =>
 	`Both CARACMS_CLOUD_KEY and ${other} are set: a site uses one GitHub credential, so remove ${other}.`;
-/** The site's own media variables, which `CARACMS_CLOUD_KEY` replaces (caracms-cloud M3 Decision 19). */
-export const OWN_MEDIA_VARIABLES = ['S3_ENDPOINT', 'S3_REGION', 'S3_BUCKET', 'S3_ACCESS_KEY_ID', 'S3_SECRET_ACCESS_KEY', 'IMGPROXY_KEY', 'IMGPROXY_SALT', 'CARACMS_MEDIA_URL'] as const;
 const listed = (names: readonly string[]) => (names.length <= 1 ? names.join('') : `${names.slice(0, -1).join(', ')} and ${names[names.length - 1]}`);
 export const CLOUD_AND_MEDIA_PROBLEM = (names: readonly string[]) => `Set CARACMS_CLOUD_KEY or the site's own media variables, not both: remove ${listed(names)}.`;
-/** The site's own Mux token, which `CARACMS_CLOUD_KEY` replaces (caracms-cloud M4.5 Decision 15). */
-export const OWN_MUX_VARIABLES = ['MUX_TOKEN_ID', 'MUX_TOKEN_SECRET'] as const;
 export const CLOUD_AND_MUX_PROBLEM = (names: readonly string[]) => `Set CARACMS_CLOUD_KEY or the site's own Mux variables, not both: remove ${listed(names)}.`;
-/** The site's own forms and email variables, which `CARACMS_CLOUD_KEY` replaces (caracms-cloud M4 Decision 22). */
-export const OWN_FORMS_VARIABLES = ['SUBMISSIONS_S3_BUCKET', 'SUBMISSIONS_S3_ACCESS_KEY_ID', 'SUBMISSIONS_S3_SECRET_ACCESS_KEY', 'RESEND_API_KEY', 'FORMS_FROM'] as const;
 export const CLOUD_AND_FORMS_PROBLEM = (names: readonly string[]) => `Set CARACMS_CLOUD_KEY or the site's own forms and email variables, not both: remove ${listed(names)}.`;
 
 /** The key beside any of the site's own forms and email variables: Decision 22's sentence, or null. */
@@ -121,7 +125,8 @@ export function cloudFormsConflict(env: Env): string | null {
  * email variables beside it, a bad `CARACMS_CLOUD_URL`). Null: not a cloud site. Whether
  * the cloud is *used* is the caller's (only on a production server; the Core framing).
  */
-export function cloudForms(env: Env): { connection: { key: string; url: string }; problems: string[] } | null {
+export function cloudForms(env: Env, services: Services | null = bakedServices()): { connection: { key: string; url: string }; problems: string[] } | null {
+	env = servicesEnv(env, services);
 	const get = (name: string) => env[name]?.trim() || null;
 	const key = get('CARACMS_CLOUD_KEY');
 	if (!key) return null;
@@ -192,6 +197,9 @@ const isLocalhost = (host: string) => host === 'localhost' || host.endsWith('.lo
  * `baked` is what the build baked in (the address and the commit).
  */
 export function readMode(env: Env = process.env, production = env.NODE_ENV === 'production', baked: Baked = {}): Mode {
+	// caracms-cloud M5 Decision 2: with the config's `services`, the other mode's variables are never read.
+	const services = baked.services ?? null;
+	env = servicesEnv(env, services);
 	const get = (name: string) => {
 		const v = env[name]?.trim();
 		return v ? v : null;
@@ -215,7 +223,10 @@ export function readMode(env: Env = process.env, production = env.NODE_ENV === '
 	if (other && other !== 'memory') problems.push(`CARACMS_GITHUB must be "memory" or unset (got "${other}").`);
 
 	let github: LiveSettings['github'] = { kind: 'memory' };
-	if (cloudKey && (!memory || production)) {
+	if (services === 'cloud' && !cloudKey && (!memory || production)) {
+		// M5 Decision 4: never the self-hosted variables instead (they were removed above).
+		problems.push(CLOUD_KEY_MISSING_PROBLEM);
+	} else if (cloudKey && (!memory || production)) {
 		// The cloud names the repo (Decision 13), so GITHUB_REPO is a mistake and Railway's own variables are ignored.
 		if (!CLOUD_KEY_SHAPE.test(cloudKey)) problems.push(CLOUD_KEY_PROBLEM);
 		if (ghToken) problems.push(CLOUD_AND_GITHUB_PROBLEM('CARACMS_GITHUB_TOKEN'));

package/src/live/services.ts

@@ -0,0 +1,114 @@
+/**
+ * Where the site's services come from (caracms-cloud M5): the config's `services` field,
+ * not whichever variables happen to be set.
+ *
+ * - **`'cloud'`**: `CARACMS_CLOUD_KEY` is the one credential. The self-hosted variables
+ *   (`REPLACED_VARIABLES`) are **removed from the environment the readers see**, so none is
+ *   ever read, not even as a fallback (Decision 2, check 5), and each is named once per
+ *   process as ignored.
+ * - **`'self-hosted'`**: the site's own variables; `CARACMS_CLOUD_KEY` is removed and named
+ *   as ignored the same way.
+ * - **Unset**: the environment as it is, so the key decides and the "not both" refusals
+ *   stand (Decision 3).
+ *
+ * Every key-or-own reader (live/mode.ts `readMode` and `cloudForms`, media.ts, the editor's
+ * media config, forms/store.ts, cloud-middleware.ts, and `media import` in bin/media.mjs)
+ * starts from `servicesEnv`. The running site's value is baked in at build
+ * (`__CARACMS_SERVICES__`, a Vite define from the config: `bakedServices`), since the readers
+ * are synchronous and have no config in hand.
+ */
+import type { Services } from '../config.ts';
+
+export type { Services };
+type Env = Record<string, string | undefined>;
+
+/** The site's own media variables, which `CARACMS_CLOUD_KEY` replaces (caracms-cloud M3 Decision 19). */
+export const OWN_MEDIA_VARIABLES = ['S3_ENDPOINT', 'S3_REGION', 'S3_BUCKET', 'S3_ACCESS_KEY_ID', 'S3_SECRET_ACCESS_KEY', 'IMGPROXY_KEY', 'IMGPROXY_SALT', 'CARACMS_MEDIA_URL'] as const;
+/** The site's own Mux token, which `CARACMS_CLOUD_KEY` replaces (caracms-cloud M4.5 Decision 15). */
+export const OWN_MUX_VARIABLES = ['MUX_TOKEN_ID', 'MUX_TOKEN_SECRET'] as const;
+/** The site's own forms and email variables, which `CARACMS_CLOUD_KEY` replaces (caracms-cloud M4 Decision 22). */
+export const OWN_FORMS_VARIABLES = ['SUBMISSIONS_S3_BUCKET', 'SUBMISSIONS_S3_ACCESS_KEY_ID', 'SUBMISSIONS_S3_SECRET_ACCESS_KEY', 'RESEND_API_KEY', 'FORMS_FROM'] as const;
+
+/** The site's own GitHub variables, which the cloud key replaces (caracms-cloud M2 Decision 11). `GITHUB_WEBHOOK_SECRET` is harmless and not here. */
+export const OWN_GITHUB_VARIABLES = ['CARACMS_GITHUB_TOKEN', 'GITHUB_APP_ID', 'GITHUB_APP_PRIVATE_KEY', 'GITHUB_REPO'] as const;
+
+/** Every variable the cloud replaces, by group, in the move list's order of retiring (M5 Contracts). */
+export const REPLACED_VARIABLES = {
+	media: OWN_MEDIA_VARIABLES,
+	video: OWN_MUX_VARIABLES,
+	forms: OWN_FORMS_VARIABLES,
+	github: OWN_GITHUB_VARIABLES,
+} as const;
+
+/** What each group's ignored line ends with: when it can go. */
+const RETIRE: Record<keyof typeof REPLACED_VARIABLES, string> = {
+	media: 'Remove them once the old bucket and imgproxy are retired.',
+	video: 'Remove them once every clip is uploaded again in the editor.',
+	forms: 'Remove them once the old submissions are exported or no longer wanted.',
+	github: 'Remove them: the cloud gives the site its repo and access.',
+};
+
+/** The sentence Decision 4 fails a production build and `/admin` with. */
+export const CLOUD_KEY_MISSING_PROBLEM = "This site runs on CaraCMS Cloud (caracms.config.ts), but CARACMS_CLOUD_KEY isn't set. Make a key for it in app.caracms.com.";
+
+const listed = (names: readonly string[]) => (names.length <= 1 ? names.join('') : `${names.slice(0, -1).join(', ')} and ${names[names.length - 1]}`);
+
+/** The ignored line for some of one group's variables (cloud), or for the key (self-hosted). */
+export function ignoredMessage(names: readonly string[], services: Services, group?: keyof typeof REPLACED_VARIABLES): string {
+	const one = names.length === 1;
+	const set = `${listed(names)} ${one ? 'is' : 'are'} set`;
+	if (services === 'self-hosted') return `${set}, but this site is self-hosted (caracms.config.ts): ${one ? "it's" : "they're"} ignored. Remove ${one ? 'it' : 'them'}, or run \`caracms init --cloud\` to move the site to CaraCMS Cloud.`;
+	const tail = group ? RETIRE[group] : 'Remove them once the move is done.';
+	return `${set}, but this site runs on CaraCMS Cloud (caracms.config.ts): ${one ? "it's" : "they're"} ignored. ${one ? tail.replace(/them/g, 'it') : tail}`;
+}
+
+const WARNED = Symbol.for('caracms.ignoredVariables');
+type Shared = { [WARNED]?: Set<string> };
+const warned = () => ((globalThis as Shared)[WARNED] ??= new Set());
+
+/** Forget which variables were named (tests). */
+export function resetIgnoredWarnings(): void {
+	delete (globalThis as Shared)[WARNED];
+}
+
+const set = (env: Env, name: string) => Boolean(env[name]?.trim());
+
+/**
+ * The environment the readers see for this `services` (null: the environment as it is),
+ * with the other mode's variables removed. Each removed variable is named once per process
+ * (shared on globalThis, so the build's own module and its bundled chunks warn once between them).
+ */
+export function servicesEnv(env: Env, services: Services | null | undefined, log: (line: string) => void = (line) => console.warn(line)): Env {
+	if (!services) return env;
+	const seen = warned();
+	const out: Env = { ...env };
+	if (services === 'self-hosted') {
+		if (!set(env, 'CARACMS_CLOUD_KEY')) return env;
+		delete out.CARACMS_CLOUD_KEY;
+		if (!seen.has('CARACMS_CLOUD_KEY')) log(`[caracms] ${ignoredMessage(['CARACMS_CLOUD_KEY'], services)}`);
+		seen.add('CARACMS_CLOUD_KEY');
+		return out;
+	}
+	for (const [group, names] of Object.entries(REPLACED_VARIABLES) as [keyof typeof REPLACED_VARIABLES, readonly string[]][]) {
+		const found = names.filter((name) => set(env, name));
+		for (const name of found) delete out[name];
+		const fresh = found.filter((name) => !seen.has(name));
+		if (fresh.length) log(`[caracms] ${ignoredMessage(fresh, services, group)}`);
+		for (const name of fresh) seen.add(name);
+	}
+	return out;
+}
+
+/** The names `servicesEnv` would ignore in `env` for `services` (init's move list, tests). */
+export function ignoredVariables(env: Env, services: Services | null | undefined): string[] {
+	if (!services) return [];
+	if (services === 'self-hosted') return set(env, 'CARACMS_CLOUD_KEY') ? ['CARACMS_CLOUD_KEY'] : [];
+	return Object.values(REPLACED_VARIABLES).flatMap((names) => names.filter((name) => set(env, name)));
+}
+
+declare const __CARACMS_SERVICES__: Services | null | undefined;
+
+/** The config's `services` as the build baked it in; null in plain Node (tests) and for a config without one. */
+export function bakedServices(): Services | null {
+	return typeof __CARACMS_SERVICES__ === 'string' ? __CARACMS_SERVICES__ : null;
+}

package/src/media.ts

@@ -35,6 +35,7 @@ import { createHmac } from 'node:crypto';
 import type { ImageFormat } from './fields.ts';
 import { CLOUD_NO_MEDIA, heldCloudSettings, type CloudConnection } from './live/cloud.ts';
 import { CLOUD_AND_MEDIA_PROBLEM, OWN_MEDIA_VARIABLES, readCloudUrl } from './live/mode.ts';
+import { bakedServices, CLOUD_KEY_MISSING_PROBLEM, servicesEnv, type Services } from './live/services.ts';
 import { renderMedia, type RenderImage } from './media-value.ts';
 
 /** The srcset width ladder every fluid image draws from (Decision 2). 1920 at the top: imgproxy doesn't upscale. */
@@ -92,8 +93,10 @@ export const CLOUD_MEDIA_UNREACHABLE = "CaraCMS Cloud couldn't be reached, so im
  * The cloud as the media credential: the connection when `CARACMS_CLOUD_KEY` is set and
  * `CARACMS_MEDIA` isn't `memory` (which wins over everything), with any problems (the
  * site's own media variables beside it, a bad `CARACMS_CLOUD_URL`). Null: not a cloud site's media.
+ * With the config's `services` (caracms-cloud M5), the other mode's variables aren't read.
  */
-export function cloudMedia(env: Env = process.env): { connection: Pick<CloudConnection, 'key' | 'url'>; problems: string[] } | null {
+export function cloudMedia(env: Env = process.env, services: Services | null = bakedServices()): { connection: Pick<CloudConnection, 'key' | 'url'>; problems: string[] } | null {
+	env = servicesEnv(env, services);
 	const get = (name: string) => env[name]?.trim() || null;
 	const key = get('CARACMS_CLOUD_KEY');
 	if (!key || get('CARACMS_MEDIA') === 'memory') return null;
@@ -117,7 +120,8 @@ function cloudMediaConfig(cloud: NonNullable<ReturnType<typeof cloudMedia>>, pro
 }
 
 /** The media variables (Decision 5). Read on each call (cheap), so tests can change them. */
-export function readMediaConfig(env: Env = process.env, production = isProductionBuild()): MediaConfig {
+export function readMediaConfig(env: Env = process.env, production = isProductionBuild(), services: Services | null = bakedServices()): MediaConfig {
+	env = servicesEnv(env, services);
 	const get = (name: string) => {
 		const v = env[name]?.trim();
 		return v ? v : null;
@@ -129,7 +133,9 @@ export function readMediaConfig(env: Env = process.env, production = isProductio
 		return { kind: 'ready', settings: { ...MEMORY_MEDIA, memory: true } };
 	}
 	if (mode) problems.push(`CARACMS_MEDIA must be "memory" or unset (got "${mode}").`);
-	const cloud = cloudMedia(env);
+	// M5 Decision 4: a cloud site without its key has no media, never the site's own instead.
+	if (services === 'cloud' && !get('CARACMS_CLOUD_KEY')) return { kind: 'unset', missing: [], problems: [...problems, CLOUD_KEY_MISSING_PROBLEM] };
+	const cloud = cloudMedia(env, services);
 	if (cloud) return cloudMediaConfig(cloud, problems);
 	const missing: string[] = [];
 	const need = (name: string) => {