@micacms/runtime 0.6.0-rc.2 → 0.7.0

package/src/services/content-store.ts

@@ -5,6 +5,7 @@
  */
 
 import { createHash } from "node:crypto";
+import { posix } from "node:path";
 
 import {
   ContentPathError,
@@ -18,9 +19,13 @@ import {
   isValidSlug,
   collectReferences,
   readCollection,
+  mapMedia,
+  readCollectionEntry,
   readSingleton,
   relativizeMedia,
+  relinkReferences,
   resolveSlugField,
+  resolveTitleField,
   serializeEntry,
   singletonPath,
   slugify,
@@ -62,8 +67,15 @@ export interface SaveEntryInput {
   slug?: string;
   /** The revision `slug` had when the editor opened it. Absent writes unconditionally. */
   expectedRevision?: string | null;
+  /** On a URL change: point the relations in other entries and settings at the new URL, in the same write. */
+  updateLinks?: boolean;
 }
 
+/** An entry or settings page that links to an entry. `readOnly`: this build cannot change its links. */
+export type Referrer =
+  | { kind: "entry"; collection: string; slug: string; title: string; readOnly?: true }
+  | { kind: "singleton"; name: string; title: string; readOnly?: true };
+
 export interface SavedEntry {
   slug: string;
   title: string;
@@ -71,6 +83,8 @@ export interface SavedEntry {
   revision: string;
   /** True when the save moved the entry's files. */
   renamed: boolean;
+  /** How many other entries and settings pages now link to the new URL. */
+  relinked: number;
 }
 
 /** `readOnly` comes from `readOnlyParts`: its collections and singletons are read, never written. */
@@ -98,7 +112,8 @@ export function createContentStore(site: Site, workspace: ContentFiles, readOnly
     data: unknown,
     what: string,
   ): Record<string, unknown> => {
-    const result = validateFields(def.fields, data);
+    // Save keeps a half-finished entry; Publish checks `required` (decision "Publish a selection").
+    const result = validateFields(def.fields, data, { enforceRequired: false });
     if (!result.ok) {
       throw new ValidationError(
         `${what} cannot be saved until these fields are correct.`,
@@ -214,6 +229,84 @@ export function createContentStore(site: Site, workspace: ContentFiles, readOnly
     return { type: "write", path, contents: `${JSON.stringify(order, null, 2)}\n` };
   };
 
+  /** Entries and settings pages whose relations point at `collection`/`slug`, with what a relink needs. */
+  const referrers = async (collection: string, slug: string) => {
+    const found: Array<{
+      referrer: Referrer;
+      fields: FieldMap;
+      base: string;
+      dataFile: string;
+      /** Reads the data again, so that a relink starts from what is on disk now. */
+      read: () => Promise<Record<string, unknown> | null>;
+    }> = [];
+    const readOnlyMark = (key: string) => (readOnly.has(key) ? { readOnly: true as const } : {});
+    const points = (fields: FieldMap, data: Record<string, unknown>) =>
+      collectReferences(fields, data).some(
+        (reference) => reference.kind === "relation" && reference.collection === collection && reference.slug === slug,
+      );
+
+    for (const [name, def] of Object.entries(site.collections)) {
+      if (!linksTo(def.fields, collection)) continue;
+      for (const entry of await readCollection(workspace, def, name)) {
+        if (!points(def.fields, entry.data)) continue;
+        found.push({
+          referrer: {
+            kind: "entry",
+            collection: name,
+            slug: entry.slug,
+            title: entryTitle(def, entry.data),
+            ...readOnlyMark(`collections.${name}`),
+          },
+          fields: def.fields,
+          base: collectionEntryPath(def.fields, name, entry.slug),
+          dataFile: dataPath(def, name, entry.slug),
+          read: () => readCollectionEntry(workspace, def, name, entry.slug),
+        });
+      }
+    }
+    for (const [name, def] of Object.entries(site.singletons)) {
+      if (!linksTo(def.fields, collection)) continue;
+      const data = await readSingleton(workspace, def, name);
+      if (!data || !points(def.fields, data)) continue;
+      found.push({
+        referrer: { kind: "singleton", name, title: def.label, ...readOnlyMark(`singletons.${name}`) },
+        fields: def.fields,
+        base: singletonPath(def.fields, name),
+        dataFile: singletonDataPath(def, name),
+        read: () => readSingleton(workspace, def, name),
+      });
+    }
+    return found;
+  };
+
+  /**
+   * Files that a new entry uses from `<collection>/<other slug>/media/`:
+   * uploads made before the URL was final. Each gets a free name in the
+   * entry's own `media/` folder. From a folder where no entry lives they move;
+   * from another entry's folder (a colleague saved that URL first) they are
+   * copied, because that entry may use them too.
+   */
+  const stagedUploads = async (def: Collection, collection: string, data: Record<string, unknown>, base: string) => {
+    const moves: Array<{ from: string; to: string; bytes: Uint8Array; keep: boolean }> = [];
+    const taken = new Set((await workspace.list(`${base}/media`)).map((item) => item.name));
+    for (const reference of collectReferences(def.fields, data)) {
+      if (reference.kind !== "media") continue;
+      const match = /^([^/]+)\/([^/]+)\/media\/([^/]+)$/.exec(reference.path);
+      if (!match || match[1] !== collection || `${collection}/${match[2]}` === base) continue;
+      if (moves.some((move) => move.from === reference.path)) continue;
+      const keep = (await workspace.read(dataPath(def, collection, match[2]!))) !== null;
+      const bytes = await workspace.readBinary(reference.path);
+      if (bytes === null) continue;
+      const extension = match[3]!.includes(".") ? match[3]!.slice(match[3]!.lastIndexOf(".")) : "";
+      const stem = match[3]!.slice(0, match[3]!.length - extension.length);
+      let name = match[3]!;
+      for (let n = 2; taken.has(name); n += 1) name = `${stem}-${n}${extension}`;
+      taken.add(name);
+      moves.push({ from: reference.path, to: `${base}/media/${name}`, bytes, keep });
+    }
+    return moves;
+  };
+
   /** Slugs already taken in a collection, so a new one can be made unique. */
   const takenSlugs = async (def: Collection, name: string, except?: string): Promise<string[]> => {
     const entries = await readCollection(workspace, def, name);
@@ -264,8 +357,17 @@ export function createContentStore(site: Site, workspace: ContentFiles, readOnly
           : uniqueSlug(requested, await takenSlugs(def, collectionName, input.slug));
 
       data[slugKey] = slug;
-
       const base = collectionEntryPath(def.fields, collectionName, slug);
+      // A new entry's uploads went into the folder of the URL it had then.
+      const staged = input.slug === undefined ? await stagedUploads(def, collectionName, data, base) : [];
+      if (staged.length > 0) {
+        const moved = new Map(staged.map((item) => [item.from, item.to]));
+        Object.assign(data, mapMedia(def.fields, data, (value) => (typeof value === "string" ? (moved.get(value) ?? value) : value)));
+      }
+      // An entry that links to itself follows its own new URL.
+      const own = previousLinks(input, slug) ? relinkReferences(def.fields, data, collectionName, input.slug!, slug) : null;
+      if (own) Object.assign(data, own);
+
       const previousBase =
         input.slug && input.slug !== slug
           ? collectionEntryPath(def.fields, collectionName, input.slug)
@@ -284,6 +386,10 @@ export function createContentStore(site: Site, workspace: ContentFiles, readOnly
         path,
         contents,
       }));
+      for (const item of staged) {
+        changes.push({ type: "write", path: item.to, contents: item.bytes });
+        if (!item.keep) changes.push({ type: "delete", path: item.from });
+      }
 
       if (previousBase) {
         changes.push(
@@ -298,19 +404,47 @@ export function createContentStore(site: Site, workspace: ContentFiles, readOnly
         changes.push(...(await staleDocuments(base, new Set(Object.keys(serialized.documents)))));
       }
 
+      // Only the data file of each referrer changes; its rich text and media stay as they are.
+      // A read-only part is left alone: this build may not write it.
+      let relinked = 0;
+      const referrerRevisions: Record<string, string | null> = {};
+      if (previousLinks(input, slug)) {
+        for (const found of await referrers(collectionName, input.slug!)) {
+          if (found.referrer.readOnly) continue;
+          if (found.referrer.kind === "entry" && found.referrer.collection === collectionName && found.referrer.slug === input.slug) continue;
+          // The revision before the read: a save in between makes the write refuse, not overwrite it.
+          const revision = await workspace.revision(found.dataFile);
+          const current = await found.read();
+          const next = current && relinkReferences(found.fields, current, collectionName, input.slug!, slug);
+          if (!next) continue;
+          const written = entryFiles(found.fields, found.base, serializeEntry(found.fields, mediaForDisk(found.fields, next, found.base)));
+          changes.push({ type: "write", path: found.dataFile, contents: written[found.dataFile]! });
+          referrerRevisions[found.dataFile] = revision;
+          relinked += 1;
+        }
+      }
+
       const title = entryTitle(def, data);
-      await workspace.apply({
-        changes,
-        expect: await expectDocument(
-          input.expectedRevision,
-          dataPath(def, collectionName, input.slug ?? slug),
-          folderOf(def.fields, previousBase ?? base),
-        ),
-      });
+      const expected = await expectDocument(
+        input.expectedRevision,
+        dataPath(def, collectionName, input.slug ?? slug),
+        folderOf(def.fields, previousBase ?? base),
+      );
+      try {
+        await workspace.apply({
+          changes,
+          expect: relinked > 0 ? { ...expected, ...referrerRevisions } : expected,
+        });
+      } catch (error) {
+        if (error instanceof ConflictError && error.paths.some((path) => path in referrerRevisions)) {
+          throw new ConflictError("An entry or page that links here changed while you saved. Save again.", error.paths);
+        }
+        throw error;
+      }
 
       const revision = await revisionAfterWrite(dataPath(def, collectionName, slug), folderOf(def.fields, base));
 
-      return { slug, title, revision, renamed: previousBase !== null };
+      return { slug, title, revision, renamed: previousBase !== null, relinked };
     },
 
     async remove(
@@ -395,30 +529,111 @@ export function createContentStore(site: Site, workspace: ContentFiles, readOnly
       return uniqueSlug(slugify(source), await takenSlugs(def, collectionName, except));
     },
 
-    /** Entries pointing at `slug`, so the editor can warn before a delete. */
-    async findReferences(collectionName: string, slug: string) {
-      const results: Array<{ collection: string; slug: string; title: string }> = [];
+    /**
+     * Where each file is used: in a media field, or as an image or a link in rich
+     * text. A file that something uses is not deleted.
+     */
+    async mediaUses(paths: string[]): Promise<{ uses: Record<string, Referrer[]>; unreadable: string[] }> {
+      const wanted = new Set(paths);
+      /** Collections and settings that could not be read: a use there cannot be ruled out. */
+      const unreadable: string[] = [];
+      const uses: Record<string, Referrer[]> = Object.fromEntries(paths.map((path) => [path, []]));
+      const check = (referrer: Referrer, fields: FieldMap, data: Record<string, unknown>, folder: string) => {
+        const found = new Set<string>();
+        for (const reference of collectReferences(fields, data)) {
+          if (reference.kind === "media" && wanted.has(reference.path)) found.add(reference.path);
+        }
+        for (const text of richTextValues(fields, data)) {
+          for (const target of markdocTargets(text)) {
+            const path = resolveTarget(target, folder);
+            if (path && wanted.has(path)) found.add(path);
+          }
+        }
+        for (const path of found) uses[path]!.push(referrer);
+      };
 
       for (const [name, def] of Object.entries(site.collections)) {
-        if (!linksTo(def.fields, collectionName)) continue;
-        for (const entry of await readCollection(workspace, def, name)) {
-          const points = collectReferences(def.fields, entry.data).some(
-            (reference) =>
-              reference.kind === "relation" && reference.collection === collectionName && reference.slug === slug,
-          );
-          if (points) {
-            results.push({ collection: name, slug: entry.slug, title: entryTitle(def, entry.data) });
-          }
+        const entries = await readCollection(workspace, def, name).catch(() => null);
+        if (!entries) {
+          unreadable.push(def.label);
+          continue;
+        }
+        for (const entry of entries) {
+          const base = collectionEntryPath(def.fields, name, entry.slug);
+          const folder = entryLayout(def.fields) === "directory" ? base : name;
+          check({ kind: "entry", collection: name, slug: entry.slug, title: entryTitle(def, entry.data) }, def.fields, entry.data, folder);
         }
       }
+      for (const [name, def] of Object.entries(site.singletons)) {
+        const data = await readSingleton(workspace, def, name).catch(() => undefined);
+        if (data === undefined) unreadable.push(def.label);
+        if (!data) continue;
+        const folder = entryLayout(def.fields) === "directory" ? singletonPath(def.fields, name) : "";
+        check({ kind: "singleton", name, title: def.label }, def.fields, data, folder);
+      }
+      return { uses, unreadable };
+    },
 
-      return results;
+    /** Entries and settings pages that link to `slug`: the warning before a delete or a URL change. */
+    async findReferences(collectionName: string, slug: string): Promise<Referrer[]> {
+      requireCollection(collectionName);
+      return (await referrers(collectionName, slug)).map((found) => found.referrer);
     },
   };
 }
 
 export type ContentStore = ReturnType<typeof createContentStore>;
 
+/** Whether a save is a URL change whose links should follow. */
+function previousLinks(input: SaveEntryInput, slug: string): boolean {
+  return input.updateLinks === true && input.slug !== undefined && input.slug !== slug;
+}
+
+/** Every rich-text value in a payload, nested fields included. */
+function richTextValues(fields: FieldMap, data: Record<string, unknown>): string[] {
+  const found: string[] = [];
+  const isRecord = (value: unknown): value is Record<string, unknown> =>
+    value !== null && typeof value === "object" && !Array.isArray(value);
+  const visit = (map: FieldMap, record: Record<string, unknown>) => {
+    for (const [key, field] of Object.entries(map)) {
+      const value = record[key];
+      if (field.kind === "richText" && typeof value === "string") found.push(value);
+      else if (field.kind === "object" && isRecord(value)) visit(field.fields, value);
+      else if (field.kind === "repeater" && Array.isArray(value)) for (const row of value) if (isRecord(row)) visit(field.fields, row);
+    }
+  };
+  visit(fields, data);
+  return found;
+}
+
+/**
+ * The targets of the images and links in Markdoc: `![alt](media/x.jpg)`,
+ * `[Price list](/media/prices.pdf)`, a reference `[x]: media/x.jpg`, and a tag
+ * attribute such as `{% figure src="media/x.jpg" %}`.
+ */
+function markdocTargets(text: string): string[] {
+  const inline = [...text.matchAll(/\]\(\s*<?([^)\s>]+)/g)].map((match) => match[1]!);
+  const references = [...text.matchAll(/^\s{0,3}\[[^\]]+\]:\s*<?([^\s>]+)/gm)].map((match) => match[1]!);
+  const attributes = [...text.matchAll(/\{%[^%]*%\}/g)].flatMap((tag) =>
+    [...tag[0].matchAll(/\b[\w-]+\s*=\s*"([^"]+)"/g)].map((match) => match[1]!),
+  );
+  return [...inline, ...references, ...attributes];
+}
+
+/** A rich-text target as a content path: from the content root with `/`, else from the document's folder. */
+function resolveTarget(target: string, folder: string): string | null {
+  if (/^[a-z][a-z0-9+.-]*:/i.test(target) || target.startsWith("#")) return null;
+  let decoded: string;
+  try {
+    decoded = decodeURI(target.split(/[?#]/)[0]!);
+  } catch {
+    return null;
+  }
+  const joined = decoded.startsWith("/") ? decoded.slice(1) : folder === "" ? decoded : `${folder}/${decoded}`;
+  const normal = posix.normalize(joined);
+  return normal.startsWith("..") ? null : normal;
+}
+
 /** Whether a field map has a relation to `collection`, nested fields included. */
 function linksTo(fields: FieldMap, collection: string): boolean {
   return Object.values(fields).some(
@@ -459,8 +674,11 @@ function pickSlug(
   const slugKey = resolveSlugField(def)!;
   const fromData = data[slugKey];
 
+  // Not `entryTitle`, whose "Untitled" would give every entry without a title the same URL.
+  const titleKey = resolveTitleField(def);
+  const title = titleKey ? data[titleKey] : undefined;
   const candidate =
-    (typeof fromData === "string" && fromData.trim()) || slugify(entryTitle(def, data));
+    (typeof fromData === "string" && fromData.trim()) || (typeof title === "string" ? slugify(title.trim()) : "");
 
   if (!candidate) {
     throw new ContentError("An entry needs a title or a URL before it can be saved.");

package/src/services/media.ts

@@ -11,7 +11,7 @@ import type { ContentFiles } from "../workspace/files.js";
 import { imageSize } from "image-size";
 
 import { ApiError, badRequest } from "../lib/errors.js";
-import { detectFileType, isAccepted, isImageType, SVG_TYPE } from "../lib/file-type.js";
+import { detectFileType, isAccepted, isImageType, SVG_TYPE, VIDEO_TYPE } from "../lib/file-type.js";
 
 /** Where uploads go when they are not attached to a particular entry. */
 export const SHARED_MEDIA_DIR = "media";
@@ -75,6 +75,12 @@ export function createMediaService(deps: MediaServiceDeps) {
         throw new ApiError("unsupported_media_type", "This file type is not supported.");
       }
       if (detected.mimeType === SVG_TYPE) throw refuseSvg();
+      if (detected.mimeType === VIDEO_TYPE) {
+        throw new ApiError(
+          "unsupported_media_type",
+          "Mica does not keep videos: they make the website's files large. Put the video on a video service, and link to it.",
+        );
+      }
       if (!isAccepted(detected.mimeType, input.accept ?? "any")) {
         throw new ApiError(
           "unsupported_media_type",

package/src/services/staging.ts

@@ -10,7 +10,10 @@
  *     retry pushes and never commits again.
  */
 
+import { stat } from "node:fs/promises";
+
 import { MANIFEST_PATH, memorySource, type ContentSource, type PublishResult, type Site } from "@micacms/core";
+import { within } from "@micacms/core/node";
 
 import { ApiError, badRequest, notFound } from "../lib/errors.js";
 import type { Logger } from "../lib/logger.js";
@@ -20,7 +23,6 @@ import { GitError } from "../workspace/git.js";
 import { createWorkspaceLocks, type WorkspaceLocks } from "../workspace/locks.js";
 import type { OwnerPolicy } from "../workspace/policy.js";
 import {
-  aheadOfUpstream,
   commitPaths,
   currentBranch,
   discardChange,
@@ -29,6 +31,8 @@ import {
   overlaySource,
   listTreeChanges,
   locateTree,
+  publicationMessage,
+  unpushedCommits,
   type GitTree,
   type TreeChange,
 } from "../workspace/tree.js";
@@ -143,9 +147,19 @@ export function createWorkingTreeStagingService(
       })),
     );
 
+  /** When each file was last saved; a deletion has no file to ask. */
+  const withSavedAt = async (changes: AnnotatedChange[]): Promise<AnnotatedChange[]> =>
+    Promise.all(
+      changes.map(async (change) => {
+        if (change.kind === "delete") return { ...change, savedAt: null };
+        const saved = await stat(within(contentRoot, change.path)).catch(() => null);
+        return { ...change, savedAt: saved ? saved.mtime.toISOString() : null };
+      }),
+    );
+
   /** Refused for the developer's checkout: Mica never fetches or merges there. */
   const managedOnly = <T>(action: T | undefined): T => {
-    if (action === undefined) throw notFound("This is the developer's checkout; Git there is theirs.");
+    if (action === undefined) throw notFound("Only a self-hosted Mica keeps its own copy of the website; the local editor leaves Git to you.");
     return action;
   };
 
@@ -160,7 +174,7 @@ export function createWorkingTreeStagingService(
           publish: { enabled: false, reason: tree.reason },
           head: null,
           branch: null,
-          ahead: null,
+          unpushed: null,
           changes: [],
           validation: emptyValidation(),
           sync,
@@ -171,7 +185,7 @@ export function createWorkingTreeStagingService(
         const analysed = await analyse(tree, await listTreeChanges(tree));
         return {
           ...analysed,
-          changes: await withRevisions(analysed.changes),
+          changes: await withSavedAt(await withRevisions(analysed.changes)),
           head: await headRevision(tree),
           branch: await currentBranch(tree),
         };
@@ -182,7 +196,8 @@ export function createWorkingTreeStagingService(
         publish: policy.publishAvailability(),
         head,
         branch,
-        ahead: await aheadOfUpstream(tree),
+        // A clone that Mica keeps holds only Mica's commits, and retries its own push.
+        unpushed: policy.owner === "developer" ? await unpushedCommits(tree) : null,
         changes,
         validation,
         sync,
@@ -191,7 +206,7 @@ export function createWorkingTreeStagingService(
 
     async publish(input: PublishInput): Promise<PublishResult> {
       const message = input.message.trim();
-      if (!message) throw badRequest("A publication needs a commit message.");
+      if (!message) throw badRequest("Say what changed before you publish.");
       const reviewed = Object.keys(input.paths);
       if (reviewed.length === 0) throw badRequest("Choose at least one change to publish.");
 
@@ -229,8 +244,7 @@ export function createWorkingTreeStagingService(
           if ((await files.revision(MANIFEST_PATH)) !== deps.schemaRevision) {
             throw new ApiError(
               "conflict",
-              "The content model changed after this server started. Restart Mica to load " +
-                "the new model, then review the pending changes and publish again.",
+              "The content model changed just now. Review the changes again, then publish.",
             );
           }
 
@@ -245,14 +259,14 @@ export function createWorkingTreeStagingService(
           }
 
           try {
-            const revision = await commitPaths(tree, reviewed, message, policy.commitAuthor(input.author));
-            logger.info("Published", { revision, files: reviewed.length, owner: policy.owner });
+            const revision = await commitPaths(tree, reviewed, publicationMessage(message), policy.commitAuthor(input.author));
+            logger.info("Published", { revision, files: reviewed.length, owner: policy.owner, editor: input.editor });
             return revision;
           } catch (error) {
             if (error instanceof GitError) {
               // Git's message is the actionable part: no identity, a hook that
               // refused, a rebase in progress.
-              throw new ApiError("conflict", `Git refused the commit: ${error.message}`);
+              throw new ApiError("conflict", `Publishing failed: ${error.message}`);
             }
             throw error;
           }
@@ -267,12 +281,12 @@ export function createWorkingTreeStagingService(
 
       return locks.remote.run(async () => {
         const revision = await headRevision(tree);
-        if (revision === null) throw badRequest("There is no commit to push yet.");
+        if (revision === null) throw badRequest("There is nothing to send to the website yet.");
         return policy.push(tree, revision);
       });
     },
 
-    async discard(requested: string[]): Promise<{ discarded: string[] }> {
+    async discard(requested: string[], editor?: string): Promise<{ discarded: string[] }> {
       const tree = await located();
 
       return locks.tree.write(async () => {
@@ -287,6 +301,7 @@ export function createWorkingTreeStagingService(
           discarded.push(path);
         }
 
+        if (discarded.length > 0) logger.info("Discarded", { paths: discarded, editor });
         return { discarded };
       });
     },
@@ -306,8 +321,9 @@ export function createWorkingTreeStagingService(
       await managedOnly(policy.sync)();
     },
 
-    async resolve(group: string, choice: "mine" | "website"): Promise<void> {
+    async resolve(group: string, choice: "mine" | "website", editor?: string): Promise<void> {
       await managedOnly(policy.resolve)(group, choice);
+      logger.info("Conflict resolved", { group, choice, editor });
     },
 
     async repository(): Promise<RepositoryInfo> {

package/src/workspace/developer.ts

@@ -2,15 +2,16 @@
  * The policy for the developer's own checkout. Mica never fetches, merges or
  * resets here. Publish pushes with the developer's `git`, credentials and
  * upstream; a new branch without one is pushed to `origin` and tracks it. A
- * failed push keeps the commit.
+ * failed push keeps the commit. A push sends only Mica's own commits: other
+ * commits that no remote has make Publish refuse.
  */
 
 import type { PublishResult } from "@micacms/core";
 
+import { ApiError } from "../lib/errors.js";
 import type { Logger } from "../lib/logger.js";
-import { GitError } from "./git.js";
 import type { OwnerPolicy, PublishAvailability } from "./policy.js";
-import type { GitTree } from "./tree.js";
+import { unpushedCommits, type GitTree } from "./tree.js";
 
 export interface DeveloperPolicyOptions {
   /** `MICA_LOCAL_PUBLISH`. */
@@ -28,13 +29,17 @@ export function developerPolicy(options: DeveloperPolicyOptions): OwnerPolicy {
         : { enabled: false, reason: "Publishing from local mode is disabled (MICA_LOCAL_PUBLISH=false)." };
     },
 
-    async prepare() {},
+    async prepare(tree: GitTree) {
+      await refuseOtherCommits(tree);
+    },
 
     // The commit keeps the developer's own Git identity.
     commitAuthor: () => undefined,
 
     async push(tree: GitTree, revision: string): Promise<PublishResult> {
       try {
+        // Checked again: a commit made in a terminal since `prepare` would go along.
+        await refuseOtherCommits(tree);
         // Publishing is the request to push, so a new branch gets its upstream here.
         const upstream = await tree.git.tryRun(["rev-parse", "--abbrev-ref", "--symbolic-full-name", "@{upstream}"]);
         const remotes = (await tree.git.tryRun(["remote"]))?.split("\n").filter(Boolean) ?? [];
@@ -43,7 +48,7 @@ export function developerPolicy(options: DeveloperPolicyOptions): OwnerPolicy {
         else await tree.git.run(["push"]);
         return { state: "published", revision };
       } catch (error) {
-        const pushError = error instanceof GitError || error instanceof Error ? error.message : String(error);
+        const pushError = error instanceof Error ? error.message : String(error);
         options.logger.warn("Publish committed but the push failed", { revision, pushError });
         return { state: "committed-pending-push", revision, pushError };
       }
@@ -51,6 +56,18 @@ export function developerPolicy(options: DeveloperPolicyOptions): OwnerPolicy {
   };
 }
 
+/** A push sends every commit that no remote has; the developer's own commits are theirs to send. */
+async function refuseOtherCommits(tree: GitTree): Promise<void> {
+  const other = (await unpushedCommits(tree))?.other ?? 0;
+  if (other === 0) return;
+  throw new ApiError(
+    "conflict",
+    `Publishing would also send ${other} change${other === 1 ? "" : "s"} that ${other === 1 ? "was" : "were"} not made in Mica ` +
+      "and that the website does not have yet. Send them with Git first (`git push`), or move them to another branch. " +
+      "Then publish again.",
+  );
+}
+
 function noUpstream(remotes: string[]): string {
   return remotes.length === 0
     ? "This repository has no remote. Add one with `git remote add origin <url>`, then publish again."

package/src/workspace/policy.ts

@@ -30,7 +30,7 @@ export interface SyncStatus {
   /** Upstream commits not yet in the clone. */
   behind: number;
   error: { code: string; message: string; since: string } | null;
-  /** The content model changed upstream; a restart applies it. */
+  /** A `.gitattributes` changed upstream; a restart applies it. A new content model needs none. */
   restartRequired: boolean;
   /** A publication committed and not yet pushed. Mica retries it. */
   pendingPush: { revision: string; reason: string } | null;

package/src/workspace/tree.ts

@@ -157,12 +157,41 @@ export function currentBranch(tree: GitTree): Promise<string | null> {
   return tree.git.tryRun(["rev-parse", "--abbrev-ref", "HEAD"]);
 }
 
-/** Commits waiting to be pushed, or null when there is no upstream to say. */
-export async function aheadOfUpstream(tree: GitTree): Promise<number | null> {
-  const counted = await tree.git.tryRun(["rev-list", "--count", "@{upstream}..HEAD"]);
-  if (counted === null) return null;
-  const ahead = Number(counted);
-  return Number.isFinite(ahead) ? ahead : null;
+/** The trailer that marks a commit that Mica made for a publication. */
+export const PUBLISHED_WITH_MICA = "Published-with: Mica";
+
+/** A publication's commit message: the editor's summary, and Mica's trailer. */
+export function publicationMessage(summary: string): string {
+  return `${summary}\n\n${PUBLISHED_WITH_MICA}`;
+}
+
+/** Commits on HEAD that no remote has, split into Mica's publications and other commits. */
+export interface UnpushedCommits {
+  mica: number;
+  other: number;
+}
+
+/**
+ * What a push of HEAD would send: the commits after the upstream branch, or,
+ * for a branch without one, the commits that no remote has. Null without a
+ * remote, because then nothing can be pushed and everything would count.
+ */
+export async function unpushedCommits(tree: GitTree): Promise<UnpushedCommits | null> {
+  const remotes = await tree.git.tryRun(["remote"]);
+  if (!remotes) return null;
+  // A commit can be on another remote branch and still be new to the upstream.
+  const upstream = await tree.git.tryRun(["rev-parse", "--verify", "--quiet", "@{upstream}"]);
+  const range = upstream ? [`${upstream}..HEAD`] : ["HEAD", "--not", "--remotes"];
+  // %x1e ends a commit, so a multi-line message stays one record.
+  const log = await tree.git.tryRun(["log", "--max-count=1000", "--format=%B%x1e", ...range]);
+  if (log === null) return { mica: 0, other: 0 };
+  const counted = { mica: 0, other: 0 };
+  for (const message of log.split("\x1e")) {
+    if (message.trim() === "") continue;
+    const lines = message.trim().split("\n");
+    counted[lines.includes(PUBLISHED_WITH_MICA) ? "mica" : "other"] += 1;
+  }
+  return counted;
 }
 
 /**