@acms-subir/core 0.0.2 → 0.2.0

package/CHANGELOG.md

@@ -0,0 +1,75 @@
+# @acms-subir/core
+
+## 0.2.0
+
+### Minor Changes
+
+- c568c1d: Manual publish: nothing goes live until you press Update
+
+  - Posts & pages (incl. the homepage): editing a live (published or scheduled)
+    document no longer pushes autosaves to the public site. Edits stage in a
+    private pending draft (new `draft` column, migration v22); the editor shows
+    "Published · edited — Saved, not live yet", the publish popover gains
+    **Update — push changes live** and **Discard pending changes**, and admin
+    lists mark pending documents with an `edited` pill. `/preview/…` (and share
+    links) render the pending version — exactly what Update will publish.
+    Deferred side-effects: the slug-rename 301 and the search index only update
+    at Update time, so staged edits can never leak through search or move a
+    live URL early. Unpublishing folds pending edits into the document; the
+    scheduled-publish sweep publishes the live copy and keeps pending edits
+    pending. Drafts survive backup/restore.
+  - Design screen: theme, token, logo, favicon and share-image changes stage in
+    `settings.draftDesign` (migration v23). The preview iframe renders the
+    staged design via the admin-only `?designPreview=1` flag while visitors
+    keep the live one; **Publish design** applies it, **Discard** reverts.
+  - Navigation & Links managers: the auto-save debounce is gone. Edits stay
+    local with an "Unsaved changes — not live yet" bar; **Save changes**
+    commits everything at once (add/edit/delete/reorder + links profile),
+    **Discard** restores the saved state, and leaving the page with unsaved
+    edits warns first.
+
+## 0.1.0
+
+### Minor Changes
+
+- d2d4761: Calendar card: embed a Google Calendar (or any ICS feed) as a native, themeable widget instead of an iframe. One card renders one view — month grid, week strip, or upcoming list — server-side at request time from the feed (5-minute cache, recurring events expanded, site timezone honored), with a small vanilla script for month/week navigation and an event-details popover. Paste an embed URL, calendar ID, or .ics link in the editor; add up to six color-coded feeds per card, plus an optional title/subtitle. Styling is driven by scoped `--cal-*` custom properties defaulting to theme tokens and stable `.pc-cal-*` class hooks, so themes and Settings → Code injection can restyle it freely.
+- 769f9de: Code-first content config: `acms({ content })` renames the post collection per project
+
+  - `content.posts.{singular,plural,base}` changes every user-visible label
+    (site nav, admin sidebar, headings, buttons, feeds) and moves the public
+    routes off `/blog` — validated at build time, defaults unchanged.
+  - Tag archives moved to a standalone `/tag/[slug]` (configurable via
+    `content.tags.base`); `<postsBase>/tag/*` always 301s to the new location.
+  - When `base` is renamed, `/blog/*` (plus any `content.posts.redirectFrom`
+    entries) 301s to the new base — only on requests that would otherwise 404,
+    so rules never shadow real content.
+  - Internal identifiers (DB rows, backup format, `/admin/posts`) are never
+    renamed, so existing backups and sessions survive.
+  - Scaffolder: new "What do you call your posts?" prompt (`--content
+articles|releases|notes`) writes the block into `astro.config.mjs`.
+
+- 769f9de: Multiple content collections: `acms({ content: { collections } })`
+
+  - Each key in the `collections` map gets its own public routes at `base`,
+    admin section at `/admin/c/<key>`, sidebar entry, dashboard stat, and
+    feed/sitemap entries. `posts` is the built-in collection; `content.posts`
+    stays as shorthand for `collections.posts`. Labels default from the key.
+  - Migration v19 rebuilds the posts table: new `collection` column (existing
+    rows land in `posts`) and slug uniqueness becomes per-collection, so the
+    same slug can exist in different collections. Pre-v19 backups restore
+    cleanly.
+  - One shared tag registry; tag archives group entries by collection when
+    more than one is configured. `/rss.xml` stays the everything-feed with a
+    collection `<category>` per item.
+  - The editor gains a collection switcher (multi-collection sites only);
+    moving a published entry between collections leaves a 301. Post-list cards
+    can target a collection.
+  - `/admin/posts` and `/admin/posts/[id]` 308 to their `/admin/c/posts`
+    equivalents. Removing a collection key hides its routes but never deletes
+    rows — the dashboard shows a restore notice.
+
+- 8e1f688: The update story: `acms update` now prints the release notes it crossed and deploy instructions matched to your target — `npm run deploy` for Cloudflare, `docker compose up -d --build` for Docker — plus a `--check` flag that exits 1 when behind, for CI or cron. Notes come from the `CHANGELOG.md` that now ships inside the package, so nothing depends on a git host or an API token. The admin dashboard shows a dismissible banner when a new release is out (checked at most daily, straight from the npm registry, fail-open), and `astro dev` logs a once-a-day nudge (opt out with `ACMS_NO_UPDATE_CHECK=1`). The scaffolder no longer freezes silently during `npm install` — the spinner animates with elapsed time — and its Next-steps box now mentions `npx acms update`.
+
+### Patch Changes
+
+- 19bf3c7: Enforce the documented "project-local routes win" rule at injection time. Astro registers injected and file-based routes at equal priority and serves the injected one on a collision (with a deprecation warning that this becomes a hard error), so the integration now skips injecting any route whose pattern the consumer already defines in `src/pages/` — checked as `<pattern>.astro`, `<pattern>.ts`, `<pattern>/index.astro`, or `<pattern>/index.ts`. Shell overrides of `/`, collection indexes, feeds, and any other public route now actually take effect.

package/cli.mjs

@@ -1,51 +1,152 @@
 #!/usr/bin/env node
 // `acms` — tiny maintenance CLI installed with @acms-subir/core.
 //   acms update           check the registry, install the latest core, print what's new
+//   acms update --check   just report whether an update exists (exit 1 if behind)
+//   acms update --next    follow the canary channel (`next` dist-tag); sticky once installed
+//   acms update --latest  leave the canary channel and go back to stable
 //   acms doctor           sanity-check the project setup
 //   acms add cloudflare   retrofit Workers deployment (wrangler.jsonc, deps, D1/R2)
 //   acms add docker       retrofit self-hosting (Dockerfile, compose.yml)
 import { spawnSync } from 'node:child_process';
 import { readFileSync, writeFileSync, existsSync } from 'node:fs';
 import { createRequire } from 'node:module';
-import { join } from 'node:path';
+import { dirname, join } from 'node:path';
 
 const PKG = '@acms-subir/core';
 const cmd = process.argv[2];
 
 const read = (p) => { try { return readFileSync(p, 'utf8'); } catch { return ''; } };
-const installedVersion = () => {
+const installedPkgJson = () => {
   try {
-    const require = createRequire(join(process.cwd(), 'package.json'));
-    return JSON.parse(readFileSync(require.resolve(`${PKG}/package.json`), 'utf8')).version;
+    return createRequire(join(process.cwd(), 'package.json')).resolve(`${PKG}/package.json`);
   } catch { return null; }
 };
-const latestVersion = async () => {
-  const res = await fetch(`https://registry.npmjs.org/${encodeURIComponent(PKG)}/latest`);
+const installedVersion = () => {
+  const p = installedPkgJson();
+  try { return p ? JSON.parse(readFileSync(p, 'utf8')).version : null; } catch { return null; }
+};
+const latestVersion = async (tag = 'latest') => {
+  const res = await fetch(`https://registry.npmjs.org/${encodeURIComponent(PKG)}/${tag}`, {
+    signal: AbortSignal.timeout(10_000),
+  });
+  if (res.status === 404 && tag !== 'latest') {
+    throw Object.assign(new Error(`the '${tag}' channel has no releases yet`), { noTag: true });
+  }
   if (!res.ok) throw new Error(`registry responded ${res.status}`);
   return (await res.json()).version;
 };
+const splitPre = (v) => {
+  const i = v.indexOf('-');
+  return i === -1 ? [v, ''] : [v.slice(0, i), v.slice(i + 1)];
+};
+const isCanary = (v) => splitPre(v)[1] !== '';
 const semverLt = (a, b) => {
-  const pa = a.split('.').map(Number), pb = b.split('.').map(Number);
+  const [aBase, aPre] = splitPre(a), [bBase, bPre] = splitPre(b);
+  const pa = aBase.split('.').map(Number), pb = bBase.split('.').map(Number);
   for (let i = 0; i < 3; i++) { if ((pa[i] ?? 0) < (pb[i] ?? 0)) return true; if ((pa[i] ?? 0) > (pb[i] ?? 0)) return false; }
+  // equal bases: a release outranks any of its prereleases; two prereleases
+  // compare identifier by identifier, numerically where both sides are numbers
+  if (!aPre) return false;
+  if (!bPre) return true;
+  const as = aPre.split('.'), bs = bPre.split('.');
+  for (let i = 0; i < Math.max(as.length, bs.length); i++) {
+    const x = as[i], y = bs[i];
+    if (x === undefined) return true;
+    if (y === undefined) return false;
+    const nx = /^\d+$/.test(x), ny = /^\d+$/.test(y);
+    if (nx && ny) { if (Number(x) !== Number(y)) return Number(x) < Number(y); }
+    else if (nx !== ny) return nx;
+    else if (x !== y) return x < y;
+  }
   return false;
 };
 
+// Release notes come from the CHANGELOG that changesets writes into the
+// package itself, read after the install from the freshly unpacked copy. No
+// git-host API is involved on purpose: the repository lives on a private
+// OneDev instance, so anything API-based would need a token on every site
+// that runs this command.
+const changelogFor = (pkgJsonPath) => (pkgJsonPath ? read(join(dirname(pkgJsonPath), 'CHANGELOG.md')) : '');
+// Entries newer than `current` up to `latest`, oldest first. Changesets writes
+// one "## X.Y.Z" heading per release.
+const releaseNotes = (md, current, latest) => {
+  // split on every "## " heading, not just the version ones, so a hand-written
+  // "## Unreleased" section cannot get swallowed into the entry above it
+  const heads = [...md.matchAll(/^## +(.*)$/gm)];
+  return heads
+    .map((h, i) => ({
+      version: h[1].trim().match(/^\d+\.\d+\.\d+$/)?.[0],
+      body: md.slice(h.index + h[0].length, heads[i + 1]?.index ?? md.length).trim(),
+    }))
+    .filter((r) => r.version && semverLt(current, r.version) && !semverLt(latest, r.version))
+    .sort((a, b) => (semverLt(a.version, b.version) ? -1 : 1));
+};
+const deployTargets = () => ({
+  cloudflare: ['wrangler.jsonc', 'wrangler.json', 'wrangler.toml'].some((f) => existsSync(f)),
+  docker: ['compose.yml', 'compose.yaml', 'docker-compose.yml', 'Dockerfile'].some((f) => existsSync(f)),
+});
+
 if (cmd === 'update') {
+  const checkOnly = process.argv.includes('--check');
   const current = installedVersion();
   if (!current) { console.error(`✗ ${PKG} is not installed here — run this from your site's folder.`); process.exit(1); }
+  // Channel: --next opts into canary prereleases and is sticky — once a canary
+  // is installed, a plain `acms update` keeps following the next tag until
+  // --latest switches back to stable.
+  const backToStable = process.argv.includes('--latest') && isCanary(current);
+  const channel = process.argv.includes('--latest') ? 'latest'
+    : process.argv.includes('--next') || isCanary(current) ? 'next'
+    : 'latest';
   let latest;
-  try { latest = await latestVersion(); } catch (e) { console.error(`✗ Could not reach the npm registry (${e.message}).`); process.exit(1); }
-  if (!semverLt(current, latest)) {
-    console.log(`✓ Already up to date (${current}).`);
+  try { latest = await latestVersion(channel); } catch (e) {
+    console.error(e.noTag ? `✗ ${e.message[0].toUpperCase()}${e.message.slice(1)}.` : `✗ Could not reach the npm registry (${e.message}).`);
+    process.exit(1);
+  }
+  // Leaving the canary channel is usually a downgrade (0.1.1-next.x → 0.1.0),
+  // so "am I behind" is the wrong question there — switch unconditionally.
+  if (!backToStable && !semverLt(current, latest)) {
+    console.log(`✓ Already up to date (${current}${channel === 'next' ? ', canary channel' : ''}).`);
     process.exit(0);
   }
-  console.log(`Updating ${PKG} ${current} → ${latest}…`);
-  const res = spawnSync('npm', ['install', `${PKG}@latest`, '--no-audit', '--no-fund'], { stdio: 'inherit' });
+  if (checkOnly) {
+    console.log(`Update available: ${current} → ${latest}. Run: npx acms update${channel === 'next' ? ' --next' : backToStable ? ' --latest' : ''}`);
+    process.exit(1);
+  }
+  console.log(backToStable
+    ? `Returning to the stable channel: ${PKG} ${current} → ${latest}…`
+    : `Updating ${PKG} ${current} → ${latest}${channel === 'next' ? ' (canary)' : ''}…`);
+  const res = spawnSync('npm', ['install', `${PKG}@${channel}`, '--no-audit', '--no-fund'], { stdio: 'inherit' });
   if (res.status !== 0) process.exit(res.status ?? 1);
-  console.log(`
-✓ Updated to ${latest}. What's new: https://github.com/zurielbm/acms-subir/releases
-  Deploy when ready:  npm run deploy
-  (the database migrates itself on the first request — no manual steps)`);
+  console.log(`\n✓ Updated to ${latest}.`);
+  const notes = releaseNotes(changelogFor(installedPkgJson()), current, latest);
+  if (notes.length) {
+    console.log(`\nWhat's new:`);
+    for (const r of notes) {
+      console.log(`\n  ${PKG} ${r.version}`);
+      if (r.body) console.log(r.body.split('\n').map((l) => `    ${l}`).join('\n'));
+    }
+  } else if (channel === 'next') {
+    console.log(`\nWhat's new: canary build — notes arrive with the next stable release.`);
+  } else {
+    console.log(`\nWhat's new: https://www.npmjs.com/package/${PKG}/v/${latest}`);
+  }
+  if (channel === 'next') {
+    console.log(`\nYou're on the canary channel; \`npx acms update --latest\` returns to stable.`);
+  }
+  const t = deployTargets();
+  const steps = [
+    ...(t.cloudflare ? ['  npm run deploy                       # Cloudflare Workers'] : []),
+    ...(t.docker ? ['  git push, then on your server:       docker compose up -d --build'] : []),
+  ];
+  console.log([
+    '',
+    'Deploy when ready:',
+    ...(steps.length ? steps : ['  rebuild and redeploy your host']),
+    '  (the database migrates itself on the first request — no manual steps)',
+  ].join('\n'));
+  // the registry fetch leaves a keep-alive socket in undici's pool, which can
+  // hold the event loop open for seconds after there is nothing left to do
+  process.exit(0);
 } else if (cmd === 'add') {
   // Retrofit a deployment target onto an existing project. Both targets share
   // one codebase — astro.config picks the adapter via DEPLOY_TARGET — so
@@ -212,6 +313,14 @@ data
 .dev.vars
 .wrangler
 .git
+`);
+    writeNew('.env.example', `# Copy to .env and fill in real values — compose.yml reads .env automatically.
+# .env itself is gitignored; this file is the committed record of what to set.
+ADMIN_PASSWORD=change-me
+# Random secret used to sign the session cookie (openssl rand -hex 32)
+SESSION_SECRET=
+# SQLite file used by the Node target (a volume mounts /app/data in Docker)
+SQLITE_URL=file:./data/acms.db
 `);
     setScript('build:node', 'DEPLOY_TARGET=node astro build');
     writeFileSync('package.json', JSON.stringify(pkg, null, 2) + '\n');
@@ -251,6 +360,9 @@ data
 
 Usage:
   acms update           Update the CMS core to the latest release
+  acms update --check   Report whether an update exists (exit 1 if behind)
+  acms update --next    Follow the canary channel (prereleases); later updates stay on it
+  acms update --latest  Leave the canary channel and return to stable releases
   acms doctor           Check this project's setup
   acms add cloudflare   Add Workers deployment to this project (--provision creates D1 + R2)
   acms add docker       Add Docker self-hosting to this project`);

package/integration.mjs

@@ -1,4 +1,5 @@
-import { readFileSync } from 'node:fs';
+import { existsSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs';
+import { dirname, join } from 'node:path';
 import { fileURLToPath } from 'node:url';
 
 // This file is loaded by Node while Astro evaluates the consumer's
@@ -27,7 +28,6 @@ const ROUTES = [
   ['/[...slug]', '[...slug].astro'],
   ['/author/[slug]', 'author/[slug].astro'],
   ['/links', 'links.astro'],
-  ['/search', 'search.astro'],
   ['/go/[id]', 'go/[id].ts'],
   ['/media/[...key]', 'media/[...key].ts'],
   ['/embed/[pageId]/[blockId]', 'embed/[pageId]/[blockId].ts'],
@@ -180,6 +180,55 @@ function resolveI18n(i18n, contentBases) {
   return { locales, defaultLocale };
 }
 
+// Defaults + validation for acms({ search }). Search ships on; disabling it
+// removes the /search page(s) and /api/search from the route table, and the
+// layout skips the header trigger + modal (lib/search-config.ts).
+function resolveSearch(search) {
+  if (search === undefined) return { enabled: true };
+  const unknown = Object.keys(search).filter((k) => k !== 'enabled');
+  if (unknown.length > 0) {
+    throw new Error(
+      `acms: unknown search key${unknown.length > 1 ? 's' : ''} ${unknown.map((k) => `"${k}"`).join(', ')} — ` +
+        'the only valid key is search.enabled'
+    );
+  }
+  const enabled = search.enabled ?? true;
+  if (typeof enabled !== 'boolean') {
+    throw new Error('acms: search.enabled must be true or false');
+  }
+  return { enabled };
+}
+
+const semverLt = (a, b) => {
+  const pa = a.split('.').map(Number), pb = b.split('.').map(Number);
+  for (let i = 0; i < 3; i++) { if ((pa[i] ?? 0) < (pb[i] ?? 0)) return true; if ((pa[i] ?? 0) > (pb[i] ?? 0)) return false; }
+  return false;
+};
+
+// Dev-only update nudge: one log line when a newer core is on npm, checked at
+// most once per 24h (stamp file in Astro's cache dir). Fire-and-forget — it
+// never delays startup and swallows every failure. ACMS_NO_UPDATE_CHECK=1
+// disables it entirely.
+async function devUpdateNudge(cacheDir, logger) {
+  const stampFile = join(cacheDir, 'acms-update-check.json');
+  try {
+    const stamp = JSON.parse(readFileSync(stampFile, 'utf8'));
+    if (Date.now() - stamp.at < 86_400_000) return;
+  } catch {}
+  try {
+    const res = await fetch('https://registry.npmjs.org/@acms-subir%2Fcore/latest', {
+      signal: AbortSignal.timeout(3000),
+    });
+    if (!res.ok) return;
+    const latest = (await res.json()).version ?? '';
+    mkdirSync(dirname(stampFile), { recursive: true });
+    writeFileSync(stampFile, JSON.stringify({ at: Date.now(), latest }));
+    if (latest && semverLt(CORE_VERSION, latest)) {
+      logger.info(`v${latest} is available (you're on ${CORE_VERSION}) — npx acms update`);
+    }
+  } catch {}
+}
+
 const CONFIG_ID = 'virtual:acms-config';
 const THEMES_ID = 'virtual:acms-user-themes';
 
@@ -231,6 +280,10 @@ function acmsVitePlugin(userConfig) {
  *   Home page content per language is authored in /admin as a normal page
  *   marked "home" with that language selected. Omit for monolingual sites —
  *   nothing changes.
+ * @param {{enabled?: boolean}} [options.search]
+ *   Public site search: the /search page, the /api/search JSON endpoint, and
+ *   the header search modal. On by default — set `enabled: false` to remove
+ *   all three.
  * @returns {import('astro').AstroIntegration}
  */
 export default function acms(options = {}) {
@@ -240,12 +293,14 @@ export default function acms(options = {}) {
     [content.tags.base, 'content.tags.base'],
   ]);
   const i18n = resolveI18n(options.i18n, contentBases);
+  const search = resolveSearch(options.search);
   const userConfig = {
     coreVersion: CORE_VERSION,
     brand: options.brand ?? {},
     seed: options.seed ?? {},
     content,
     i18n,
+    search,
   };
   const routes = [...ROUTES];
   for (const c of Object.values(content.collections)) {
@@ -257,13 +312,35 @@ export default function acms(options = {}) {
   for (const l of i18n.locales) {
     if (l !== i18n.defaultLocale) routes.push([`/${l}`, 'index.astro']);
   }
+  if (search.enabled) {
+    routes.push(['/search', 'search.astro'], ['/api/search', 'api/search.ts']);
+    // a locale-prefixed search page per non-default locale, mirroring the
+    // per-locale home routes; search.astro derives its locale from the path
+    for (const l of i18n.locales) {
+      if (l !== i18n.defaultLocale) routes.push([`/${l}/search`, 'search.astro']);
+    }
+  }
+  let cacheDir = '';
   return {
     name: 'acms',
     hooks: {
-      'astro:config:setup': ({ command, injectRoute, addMiddleware, updateConfig }) => {
+      'astro:config:setup': ({ config, command, injectRoute, addMiddleware, updateConfig }) => {
+        if (config.cacheDir) cacheDir = fileURLToPath(config.cacheDir);
         updateConfig({ vite: { plugins: [acmsVitePlugin(userConfig)] } });
 
+        // "Project-local routes win" is enforced here: Astro registers
+        // injected and file-based routes at equal priority (and the injected
+        // one is served on a collision), so a route is only injected when the
+        // consumer has no file at the same pattern in src/pages.
+        const pagesDir = fileURLToPath(new URL('./pages/', config.srcDir));
+        const overridden = (pattern) => {
+          const rel = pattern === '/' ? 'index' : pattern.slice(1);
+          return ['.astro', '.ts', '/index.astro', '/index.ts'].some((suffix) =>
+            existsSync(`${pagesDir}${rel}${suffix}`)
+          );
+        };
         for (const [pattern, file] of routes) {
+          if (overridden(pattern)) continue;
           injectRoute({ pattern, entrypoint: entry(`./src/pages/${file}`) });
         }
         // Auth gate, trailing-slash canonicalization, redirect fallback,
@@ -280,6 +357,22 @@ export default function acms(options = {}) {
             vite: { resolve: { alias: { 'react-dom/server': 'react-dom/server.edge' } } },
           });
         }
+        // The Docker runtime image installs only @libsql/client, so the
+        // standalone bundle must carry every other dependency. Left to its
+        // default, Vite externalizes package imports (react-dom, astro's
+        // runtime, zod, marked, …) and the server crashes on its first
+        // import in the container. @libsql/client stays external: it is
+        // dynamically imported and ships native bindings.
+        if (target === 'node' && command === 'build') {
+          updateConfig({
+            vite: { ssr: { noExternal: true, external: ['@libsql/client'] } },
+          });
+        }
+      },
+      // fires only for `astro dev` — builds and previews never phone anywhere
+      'astro:server:start': ({ logger }) => {
+        if (!cacheDir || process.env.ACMS_NO_UPDATE_CHECK) return;
+        void devUpdateNudge(cacheDir, logger);
       },
     },
   };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@acms-subir/core",
-  "version": "0.0.2",
+  "version": "0.2.0",
   "publishConfig": {
     "access": "public"
   },
@@ -10,7 +10,7 @@
   "homepage": "https://acms.subir.dev",
   "repository": {
     "type": "git",
-    "url": "git+https://github.com/zurielbm/acms-subir.git",
+    "url": "git+https://onedev.subir.dev/acms-subir.git",
     "directory": "packages/core"
   },
   "keywords": [
@@ -22,7 +22,7 @@
     "workers"
   ],
   "bin": {
-    "acms": "./cli.mjs"
+    "acms": "cli.mjs"
   },
   "exports": {
     ".": "./integration.mjs",
@@ -40,20 +40,22 @@
   "files": [
     "integration.mjs",
     "cli.mjs",
-    "src"
+    "src",
+    "CHANGELOG.md"
   ],
   "dependencies": {
     "@dnd-kit/core": "^6.3.1",
     "@dnd-kit/sortable": "^10.0.0",
     "@dnd-kit/utilities": "^3.2.2",
     "@libsql/client": "^0.15.0",
-    "@tiptap/extension-code-block-lowlight": "^3.29.2",
-    "@tiptap/extension-table": "^3.29.2",
-    "@tiptap/extensions": "^3.29.2",
-    "@tiptap/pm": "^3.29.2",
-    "@tiptap/react": "^3.29.2",
-    "@tiptap/starter-kit": "^3.29.2",
-    "@tiptap/suggestion": "^3.29.2",
+    "@tiptap/extension-code-block-lowlight": "^3.30.1",
+    "@tiptap/extension-highlight": "3.30.1",
+    "@tiptap/extension-table": "^3.30.1",
+    "@tiptap/extensions": "^3.30.1",
+    "@tiptap/pm": "^3.30.1",
+    "@tiptap/react": "^3.30.1",
+    "@tiptap/starter-kit": "^3.30.1",
+    "@tiptap/suggestion": "^3.30.1",
     "hast-util-to-html": "^9.0.5",
     "lowlight": "^3.3.0",
     "marked": "^15.0.0",
@@ -64,7 +66,7 @@
   "peerDependencies": {
     "@astrojs/cloudflare": "^12.6.13",
     "@astrojs/node": "^9.2.0",
-    "@astrojs/react": "^6.0.2",
+    "@astrojs/react": "^4.4.2",
     "astro": "^5.7.0",
     "react": "^19.0.0",
     "react-dom": "^19.0.0"