@morphemecms/cms 0.3.0 → 0.4.0-next-20261104164754

package/CHANGELOG.md

@@ -1,5 +1,17 @@
 # @morphemecms/cms
 
+## 0.4.0-next-20261104164754
+
+### Minor Changes
+
+- cf46cb1: An app's block and pop-up name their view module `viewOf.ts` (it was `view.ts`), so it no longer collides with `View.tsx` on Windows.
+- 1fcbd56: The site updates Morpheme by itself: a new minor or patch version on npm is installed within the hour and undone when the site cannot be built. See Settings › Morpheme.
+
+### Patch Changes
+
+- cf9f144: Keep the line breaks of a file's front matter (CRLF or LF) when the editor writes it back.
+- 682da97: New sites from the starter can reach the Morpheme store on the same Cloudflare account, and Prettier skips store theme files.
+
 ## 0.3.0
 
 ### Minor Changes

package/README.md

@@ -41,7 +41,7 @@ Hele vejledningen står i `docs/editor.md` i sitets repo. Her er kun det, et sit
   - `@site/config`: sitets navn, domæne, GitHub-repo og mapper.
   - `@site/worker` (til Workeren): `apps`, `contact`, `moved`, `standard`, `oldAddresses` (sitets videresendelser fra gamle adresser, `{ ids, paths }`) og appenes del af Workeren (`appWorkers`, `appTexts`).
 - **`@site`** for `src/site/`, ellers `defaults/`: i Vite (`siteFile` i `themePlugin`, `site/theme.mjs`, brugt af `astro.mjs` og `scripts/check-content.mjs`, der indlæser reglerne med Vite) og i TypeScript (`paths` i `tsconfig.json`: `"@site/*": ["./src/site/*", "./node_modules/@morphemecms/cms/defaults/*"]`); til Workeren `@site/config` og `@site/worker` i `alias` i `wrangler.jsonc`, med `main` sat til pakkens `worker/index.js`.
-- **Sitets egne blokke** i appenes `blocks/<type>/` (`src/apps/<app>/blocks/<type>/`), hver med `index.tsx` (`defineBlock` fra `@morphemecms/cms/src/blocks`), `view.ts` og `load.ts` (det, blokken viser, i editoren og på sitet) og `View.tsx` (tegningen, begge steder). Pakken finder dem selv.
+- **Sitets egne blokke** i appenes `blocks/<type>/` (`src/apps/<app>/blocks/<type>/`), hver med `index.tsx` (`defineBlock` fra `@morphemecms/cms/src/blocks`), `viewOf.ts` og `load.ts` (det, blokken viser, i editoren og på sitet) og `View.tsx` (tegningen, begge steder). Pakken finder dem selv.
 - **Et standardtema**, som alle sitets temaer bygger på, med standardblokkenes udseende (`blocks/<type>/View.tsx`, én tegning til sitet og editoren), som pakken selv finder (dette site: `packages/editor/theme/`, `packages/editor/src/standard/siteLooks.ts` og `packages/editor/src/standard/themeBlocks.ts`).
 - **Siderne** er pakkens (`pages/`, sat ind af `siteConfig()` i `astro.mjs`): sitets sider, bloggen, 404, `/ny/` og editoren (siden, der viser `src/App.tsx`, manifestet, `version.json` og billederne, sitets egen kode bruger). Sitets `astro.config.mjs` er kun `export default await siteConfig()`, og `src/content.config.ts` henter samlingerne fra `site/content.config`.
 - **Standardblokkenes stil:** `blocks.css` i standardtemaet (dette site: `packages/editor/theme/styles/blocks.css`), importeret i hvert temas CSS, og variablerne `--block-*` sat til temaets farver og former.

package/bin/morpheme.mjs

@@ -12,7 +12,7 @@ const COMMANDS = {
   'after-build': ['scheduled-list', 'link-counts', 'page-colors'],
   'check:content': ['check-content'],
   'check:editor': ['editor-roundtrip'],
-  'check:worker': ['check-worker', 'check-consent', 'check-store'],
+  'check:worker': ['check-worker', 'check-consent', 'check-store', 'check-cms-update'],
   'check:screens': ['editor-screens'],
   'check:themes': ['check-themes'],
   'check:demo': ['check-demo'],

package/defaults/editor.ts

@@ -43,6 +43,7 @@ import {
   Signpost,
   Smiley,
   SlidersHorizontal,
+  Sparkle,
   SquareHalfBottom,
   SquaresFour,
   Sticker,
@@ -126,6 +127,7 @@ export const icons: Record<string, Icon> = {
   blokvalg: ToggleRight,
   apps: PuzzlePiece,
   appstore: Storefront,
+  morpheme: Sparkle,
   avanceret: Wrench,
   licenser: Certificate,
   // The screens under "Udseende" (Library.tsx Theme).
@@ -156,7 +158,7 @@ export const groups: { title: string; ids: string[] }[] = [
 
 /** The settings of the whole site, not on the start screen but on "Indstillinger" (#indstillinger, Library.tsx
  * Settings), which the gear in the top bar opens (Screen.tsx SettingsLink); A–Å as a group's. */
-export const settings: string[] = ['udseende', 'apps', 'appstore', 'maaling', 'promovering', 'privatliv', 'seo', 'avanceret', 'licenser'];
+export const settings: string[] = ['udseende', 'apps', 'appstore', 'morpheme', 'maaling', 'promovering', 'privatliv', 'seo', 'avanceret', 'licenser'];
 
 /** The site's own short lists, on a screen of their own under "Lister" (#lister), with those the standard blocks
  * bring ("Udtalelser") and the apps (their lists.ts). */

package/lib/changelog.d.mts

@@ -0,0 +1,24 @@
+/**
+ * Unzips gzip bytes.
+ * @param {Uint8Array} bytes
+ * @returns {Promise<Uint8Array>}
+ */
+export function gunzip(bytes: Uint8Array): Promise<Uint8Array>;
+/**
+ * The UTF-8 text of the entry named exactly `path` in a tar, or null when there is none.
+ * @param {Uint8Array} tar
+ * @param {string} path
+ * @returns {string | null}
+ */
+export function fileFromTar(tar: Uint8Array, path: string): string | null;
+/**
+ * The changelog's sections for versions after `from` up to and including `to`, newest first, without empty ones.
+ * @param {string} changelog
+ * @param {string} from
+ * @param {string} to
+ * @returns {{ version: string, text: string }[]}
+ */
+export function sectionsBetween(changelog: string, from: string, to: string): {
+    version: string;
+    text: string;
+}[];

package/lib/changelog.mjs

@@ -0,0 +1,65 @@
+// A version's release notes, read from its npm tarball: unzips the tarball, finds CHANGELOG.md in the tar and cuts out the
+// sections between two versions. Exposes gunzip, fileFromTar and sectionsBetween. Depends on ./cms-version.mjs; no node: imports
+// (runs in a Cloudflare Worker and in Node 18+).
+import { compareVersions } from './cms-version.mjs';
+
+/**
+ * Unzips gzip bytes.
+ * @param {Uint8Array} bytes
+ * @returns {Promise<Uint8Array>}
+ */
+export async function gunzip(bytes) {
+  const stream = new Blob([bytes]).stream().pipeThrough(new DecompressionStream('gzip'));
+  return new Uint8Array(await new Response(stream).arrayBuffer());
+}
+
+/** The text of a NUL-terminated field of a tar header. */
+function field(header, start, end) {
+  const bytes = header.subarray(start, end);
+  const nul = bytes.indexOf(0);
+  return new TextDecoder().decode(nul === -1 ? bytes : bytes.subarray(0, nul));
+}
+
+/**
+ * The UTF-8 text of the entry named exactly `path` in a tar, or null when there is none.
+ * @param {Uint8Array} tar
+ * @param {string} path
+ * @returns {string | null}
+ */
+export function fileFromTar(tar, path) {
+  let offset = 0;
+  while (offset + 512 <= tar.length) {
+    const header = tar.subarray(offset, offset + 512);
+    if (header.every((byte) => byte === 0)) return null;
+    const name = field(header, 0, 100);
+    const prefix = field(header, 345, 500);
+    const size = parseInt(field(header, 124, 136).trim(), 8) || 0;
+    const data = tar.subarray(offset + 512, offset + 512 + size);
+    if ((prefix ? prefix + '/' + name : name) === path) return new TextDecoder().decode(data);
+    offset += 512 + Math.ceil(size / 512) * 512;
+  }
+  return null;
+}
+
+/**
+ * The changelog's sections for versions after `from` up to and including `to`, newest first, without empty ones.
+ * @param {string} changelog
+ * @param {string} from
+ * @param {string} to
+ * @returns {{ version: string, text: string }[]}
+ */
+export function sectionsBetween(changelog, from, to) {
+  const sections = [];
+  let current = null;
+  for (const line of changelog.split(/\r?\n/)) {
+    if (line.startsWith('## ')) {
+      current = { version: line.slice(3).trim(), lines: [] };
+      sections.push(current);
+    } else if (current) current.lines.push(line);
+  }
+  return sections
+    .filter(({ version }) => /^\d+\.\d+\.\d+$/.test(version) && compareVersions(version, from) === 1 && compareVersions(version, to) <= 0)
+    .map(({ version, lines }) => ({ version, text: lines.join('\n').trim() }))
+    .filter(({ text }) => text !== '')
+    .sort((a, b) => compareVersions(b.version, a.version));
+}

package/lib/changelog.test.d.mts

@@ -0,0 +1 @@
+export {};

package/lib/changelog.test.mjs

@@ -0,0 +1,67 @@
+// Tests for lib/changelog.mjs: a version's release notes read from its npm tarball.
+// Run: node --test packages/editor/lib/changelog.test.mjs
+import { test } from 'node:test';
+import assert from 'node:assert/strict';
+import { gzipSync } from 'node:zlib';
+import { gunzip, fileFromTar, sectionsBetween } from './changelog.mjs';
+
+/** One tar entry: a 512-byte header, then the data padded to a multiple of 512. */
+function tarEntry(name, text, prefix = '') {
+  const data = Buffer.from(text);
+  const header = Buffer.alloc(512);
+  header.write(name, 0, 'ascii');
+  header.write('0000644\0', 100, 'ascii');
+  header.write('0000000\0', 108, 'ascii');
+  header.write('0000000\0', 116, 'ascii');
+  header.write(data.length.toString(8).padStart(11, '0') + '\0', 124, 'ascii');
+  header.write('00000000000\0', 136, 'ascii');
+  header.write('0', 156, 'ascii');
+  header.write('ustar\0', 257, 'ascii');
+  header.write('00', 263, 'ascii');
+  header.write(prefix, 345, 'ascii');
+  header.fill(' ', 148, 156);
+  const sum = header.reduce((total, byte) => total + byte, 0);
+  header.write(sum.toString(8).padStart(6, '0') + '\0 ', 148, 'ascii');
+  return Buffer.concat([header, data, Buffer.alloc(Math.ceil(data.length / 512) * 512 - data.length)]);
+}
+
+const tarball = (...entries) => new Uint8Array(Buffer.concat([...entries, Buffer.alloc(1024)]));
+
+const changelogText = '# x\n\n## 0.1.1\n';
+const tar = tarball(tarEntry('package/package.json', '{"name":"x"}'), tarEntry('package/CHANGELOG.md', changelogText));
+
+test('fileFromTar finds a file by its name', () => assert.equal(fileFromTar(tar, 'package/CHANGELOG.md'), changelogText));
+test('fileFromTar returns null for a missing file', () => assert.equal(fileFromTar(tar, 'package/missing.md'), null));
+test('fileFromTar joins the prefix of a long name', () => {
+  const prefix = 'package/' + 'a'.repeat(120);
+  const long = tarball(tarEntry('CHANGELOG.md', 'long one', prefix));
+  assert.equal(fileFromTar(long, prefix + '/CHANGELOG.md'), 'long one');
+});
+
+test('gunzip gives the input back', async () => {
+  const bytes = await gunzip(new Uint8Array(gzipSync(Buffer.from('hello tar'))));
+  assert.equal(new TextDecoder().decode(bytes), 'hello tar');
+});
+
+/** A changelog with one `### Patch Changes` line and one bullet under each version. */
+const changelogOf = (...versions) =>
+  ['# @morphemecms/cms', '', ...versions.flatMap((v) => [`## ${v}`, '', '### Patch Changes', '', `- Change ${v}`, ''])].join('\n');
+
+const full = changelogOf('0.3.0', '0.2.1', '0.2.0', '0.1.1');
+const versionsOf = (sections) => sections.map((section) => section.version);
+
+test('sectionsBetween returns the versions after from up to to, newest first', () => {
+  const sections = sectionsBetween(full, '0.1.1', '0.3.0');
+  assert.deepEqual(versionsOf(sections), ['0.3.0', '0.2.1', '0.2.0']);
+  assert.equal(sections[0].text, '### Patch Changes\n\n- Change 0.3.0');
+});
+test('sectionsBetween is empty when from equals to', () => assert.deepEqual(sectionsBetween(full, '0.2.1', '0.2.1'), []));
+test('sectionsBetween includes to but not from', () => assert.deepEqual(versionsOf(sectionsBetween(full, '0.1.0', '0.1.1')), ['0.1.1']));
+test('sectionsBetween drops a section with only blank lines', () => {
+  const text = '# x\n\n## 0.2.0\n\n\n';
+  assert.deepEqual(sectionsBetween(text, '0.1.0', '0.2.0'), []);
+});
+test('sectionsBetween ignores pre-release headings', () => {
+  const text = `## 0.2.0-next-1\n\n- Next\n\n${changelogOf('0.1.1')}`;
+  assert.deepEqual(versionsOf(sectionsBetween(text, '0.1.0', '0.2.0')), ['0.1.1']);
+});

package/lib/cms-version.d.mts

@@ -0,0 +1,56 @@
+/**
+ * Compares two plain X.Y.Z versions number by number; throws Error('pre-release') for a version with a pre-release part.
+ * @param {string} a
+ * @param {string} b
+ * @returns {-1 | 0 | 1}
+ */
+export function compareVersions(a: string, b: string): -1 | 0 | 1;
+/**
+ * The version of the CMS a site's package.json pins exactly, or why the site does not let the CMS manage it.
+ * @param {{ dependencies?: Record<string, string>, devDependencies?: Record<string, string> }} packageJson
+ * @param {{ packages?: Record<string, { link?: boolean }> } | null | undefined} lock
+ * @returns {{ version: string } | { reason: 'missing' | 'workspace' | 'tag' | 'range' | 'link' }}
+ */
+export function managedVersion(packageJson: {
+    dependencies?: Record<string, string>;
+    devDependencies?: Record<string, string>;
+}, lock: {
+    packages?: Record<string, {
+        link?: boolean;
+    }>;
+} | null | undefined): {
+    version: string;
+} | {
+    reason: "missing" | "workspace" | "tag" | "range" | "link";
+};
+/**
+ * The version to move to, and whether it is taken by itself; null when there is nothing newer to take.
+ * @param {string} current
+ * @param {string} latest
+ * @param {string[]} skipped
+ * @returns {null | { version: string, auto: boolean, why?: 'major' | 'skipped' }}
+ */
+export function nextVersion(current: string, latest: string, skipped: string[]): null | {
+    version: string;
+    auto: boolean;
+    why?: "major" | "skipped";
+};
+/**
+ * What to do next with an update being watched (state 'waiting') or an undo being watched (state 'undoing').
+ * @param {{ state: string, to: string, from: string, at: string, undoAt?: string }} update times are ISO strings
+ * @param {string} running the version the site runs now
+ * @param {'success' | 'failure' | null} check the result of the commit's check run
+ * @param {number} now milliseconds
+ * @returns {'wait' | 'done' | 'undo' | 'undone' | 'stuck'}
+ */
+export function watchStep(update: {
+    state: string;
+    to: string;
+    from: string;
+    at: string;
+    undoAt?: string;
+}, running: string, check: "success" | "failure" | null, now: number): "wait" | "done" | "undo" | "undone" | "stuck";
+/** The npm package of the CMS. */
+export const PACKAGE: "@morphemecms/cms";
+/** How long an update or its undo is watched before it counts as over, in milliseconds (20 minutes). */
+export const WATCH_LIMIT: number;

package/lib/cms-version.mjs

@@ -0,0 +1,85 @@
+// Which version of the CMS a site takes, and when an update that did not build is undone: reads the site's package.json,
+// compares versions and steps the update's watch. Exposes PACKAGE, WATCH_LIMIT, compareVersions, managedVersion,
+// nextVersion and watchStep. No dependencies, no I/O (runs in a Worker and in Node).
+
+/** The npm package of the CMS. */
+export const PACKAGE = '@morphemecms/cms';
+
+/** How long an update or its undo is watched before it counts as over, in milliseconds (20 minutes). */
+export const WATCH_LIMIT = 20 * 60 * 1000;
+
+const PLAIN = /^\d+\.\d+\.\d+$/;
+
+/** True when a version has anything after X.Y.Z. */
+const isPreRelease = (version) => !PLAIN.test(version);
+
+/**
+ * Compares two plain X.Y.Z versions number by number; throws Error('pre-release') for a version with a pre-release part.
+ * @param {string} a
+ * @param {string} b
+ * @returns {-1 | 0 | 1}
+ */
+export function compareVersions(a, b) {
+  if (isPreRelease(a) || isPreRelease(b)) throw new Error('pre-release');
+  const x = a.split('.').map(Number);
+  const y = b.split('.').map(Number);
+  for (let i = 0; i < 3; i++) {
+    if (x[i] !== y[i]) return x[i] < y[i] ? -1 : 1;
+  }
+  return 0;
+}
+
+/**
+ * The version of the CMS a site's package.json pins exactly, or why the site does not let the CMS manage it.
+ * @param {{ dependencies?: Record<string, string>, devDependencies?: Record<string, string> }} packageJson
+ * @param {{ packages?: Record<string, { link?: boolean }> } | null | undefined} lock
+ * @returns {{ version: string } | { reason: 'missing' | 'workspace' | 'tag' | 'range' | 'link' }}
+ */
+export function managedVersion(packageJson, lock) {
+  const value = packageJson?.dependencies?.[PACKAGE] ?? packageJson?.devDependencies?.[PACKAGE];
+  if (value === undefined) return { reason: 'missing' };
+  if (value === '*' || value.startsWith('workspace:') || value.startsWith('file:')) return { reason: 'workspace' };
+  if (lock?.packages?.['node_modules/@morphemecms/cms']?.link === true) return { reason: 'link' };
+  if (!/\d+\.\d+/.test(value)) return { reason: 'tag' };
+  if (!PLAIN.test(value)) return { reason: 'range' };
+  return { version: value };
+}
+
+/**
+ * The version to move to, and whether it is taken by itself; null when there is nothing newer to take.
+ * @param {string} current
+ * @param {string} latest
+ * @param {string[]} skipped
+ * @returns {null | { version: string, auto: boolean, why?: 'major' | 'skipped' }}
+ */
+export function nextVersion(current, latest, skipped) {
+  if (isPreRelease(latest)) return null;
+  if (compareVersions(latest, current) !== 1) return null;
+  if (latest.split('.')[0] !== current.split('.')[0]) return { version: latest, auto: false, why: 'major' };
+  if (skipped.includes(latest)) return { version: latest, auto: false, why: 'skipped' };
+  return { version: latest, auto: true };
+}
+
+/**
+ * What to do next with an update being watched (state 'waiting') or an undo being watched (state 'undoing').
+ * @param {{ state: string, to: string, from: string, at: string, undoAt?: string }} update times are ISO strings
+ * @param {string} running the version the site runs now
+ * @param {'success' | 'failure' | null} check the result of the commit's check run
+ * @param {number} now milliseconds
+ * @returns {'wait' | 'done' | 'undo' | 'undone' | 'stuck'}
+ */
+export function watchStep(update, running, check, now) {
+  if (update.state === 'waiting') {
+    if (running === update.to) return 'done';
+    if (check === 'failure') return 'undo';
+    if (now - Date.parse(update.at) > WATCH_LIMIT) return 'undo';
+    return 'wait';
+  }
+  if (update.state === 'undoing') {
+    if (check === 'success') return 'undone';
+    if (check === 'failure') return 'stuck';
+    if (now - Date.parse(update.undoAt) > WATCH_LIMIT) return 'undone';
+    return 'wait';
+  }
+  return 'wait';
+}

package/lib/cms-version.test.d.mts

@@ -0,0 +1 @@
+export {};

package/lib/cms-version.test.mjs

@@ -0,0 +1,68 @@
+// Tests for lib/cms-version.mjs: which CMS version a site takes, and when an update is undone.
+// Run: node --test packages/editor/lib/cms-version.test.mjs
+import { test } from 'node:test';
+import assert from 'node:assert/strict';
+import { PACKAGE, WATCH_LIMIT, compareVersions, managedVersion, nextVersion, watchStep } from './cms-version.mjs';
+
+test('the package is the CMS', () => assert.equal(PACKAGE, '@morphemecms/cms'));
+test('the watch limit is 20 minutes', () => assert.equal(WATCH_LIMIT, 20 * 60 * 1000));
+
+test('compareVersions: older is -1', () => assert.equal(compareVersions('0.1.0', '0.1.1'), -1));
+test('compareVersions: compares number by number', () => assert.equal(compareVersions('0.10.0', '0.9.9'), 1));
+test('compareVersions: equal is 0', () => assert.equal(compareVersions('0.1.1', '0.1.1'), 0));
+test('compareVersions: a pre-release throws', () =>
+  assert.throws(() => compareVersions('0.2.0-next-1', '0.1.0'), { message: 'pre-release' }));
+
+const lock = { packages: {} };
+const dep = (value) => ({ dependencies: { [PACKAGE]: value } });
+
+test('managedVersion: an exact version is managed', () => assert.deepEqual(managedVersion(dep('0.1.1'), lock), { version: '0.1.1' }));
+test('managedVersion: * is a workspace', () => assert.deepEqual(managedVersion(dep('*'), lock), { reason: 'workspace' }));
+test('managedVersion: workspace:* is a workspace', () =>
+  assert.deepEqual(managedVersion(dep('workspace:*'), lock), { reason: 'workspace' }));
+test('managedVersion: a tag is a tag', () => assert.deepEqual(managedVersion(dep('next'), lock), { reason: 'tag' }));
+test('managedVersion: ^ is a range', () => assert.deepEqual(managedVersion(dep('^0.1.0'), lock), { reason: 'range' }));
+test('managedVersion: ~ is a range', () => assert.deepEqual(managedVersion(dep('~0.1.0'), lock), { reason: 'range' }));
+test('managedVersion: a linked lock entry is a link', () => {
+  const linked = { packages: { 'node_modules/@morphemecms/cms': { link: true } } };
+  assert.deepEqual(managedVersion(dep('0.1.1'), linked), { reason: 'link' });
+});
+test('managedVersion: no dependency is missing', () => assert.deepEqual(managedVersion({}, lock), { reason: 'missing' }));
+test('managedVersion: devDependencies count', () => {
+  assert.deepEqual(managedVersion({ devDependencies: { [PACKAGE]: '0.1.0' } }, lock), { version: '0.1.0' });
+});
+
+test('nextVersion: a patch is taken by itself', () =>
+  assert.deepEqual(nextVersion('0.1.0', '0.1.1', []), { version: '0.1.1', auto: true }));
+test('nextVersion: a minor is taken by itself', () =>
+  assert.deepEqual(nextVersion('0.1.1', '0.2.0', []), { version: '0.2.0', auto: true }));
+test('nextVersion: a major is not', () => {
+  assert.deepEqual(nextVersion('0.9.0', '1.0.0', []), { version: '1.0.0', auto: false, why: 'major' });
+});
+test('nextVersion: a skipped version is not', () => {
+  assert.deepEqual(nextVersion('0.1.0', '0.1.1', ['0.1.1']), { version: '0.1.1', auto: false, why: 'skipped' });
+});
+test('nextVersion: the same version is null', () => assert.equal(nextVersion('0.1.1', '0.1.1', []), null));
+test('nextVersion: an older version is null', () => assert.equal(nextVersion('0.2.0', '0.1.9', []), null));
+test('nextVersion: a pre-release is null', () => assert.equal(nextVersion('0.1.0', '0.2.0-next-20261103', []), null));
+
+const at = '2026-11-03T12:00:00.000Z';
+const min = 60 * 1000;
+const t0 = Date.parse(at);
+const waiting = { state: 'waiting', from: '0.1.0', to: '0.1.1', at };
+const undoing = { state: 'undoing', from: '0.1.0', to: '0.1.1', at, undoAt: at };
+
+test('watchStep waiting: the running version wins', () => assert.equal(watchStep(waiting, '0.1.1', null, t0 + 5 * min), 'done'));
+test('watchStep waiting: the running version wins over a failure', () => assert.equal(watchStep(waiting, '0.1.1', 'failure', t0), 'done'));
+test('watchStep waiting: a failed check undoes', () => assert.equal(watchStep(waiting, '0.1.0', 'failure', t0 + 5 * min), 'undo'));
+test('watchStep waiting: 19 minutes waits', () => assert.equal(watchStep(waiting, '0.1.0', null, t0 + 19 * min), 'wait'));
+test('watchStep waiting: 21 minutes undoes', () => assert.equal(watchStep(waiting, '0.1.0', null, t0 + 21 * min), 'undo'));
+test('watchStep waiting: a success that is not online yet waits', () =>
+  assert.equal(watchStep(waiting, '0.1.0', 'success', t0 + 5 * min), 'wait'));
+
+test('watchStep undoing: success is undone', () => assert.equal(watchStep(undoing, '0.1.0', 'success', t0), 'undone'));
+test('watchStep undoing: failure is stuck', () => assert.equal(watchStep(undoing, '0.1.0', 'failure', t0), 'stuck'));
+test('watchStep undoing: 21 minutes is undone', () => assert.equal(watchStep(undoing, '0.1.0', null, t0 + 21 * min), 'undone'));
+test('watchStep undoing: 5 minutes waits', () => assert.equal(watchStep(undoing, '0.1.0', null, t0 + 5 * min), 'wait'));
+test('watchStep: any other state waits', () =>
+  assert.equal(watchStep({ ...waiting, state: 'done' }, '0.1.0', 'failure', t0 + 30 * min), 'wait'));

package/lib/lockfile.d.mts

@@ -0,0 +1,19 @@
+/**
+ * package.json and package-lock.json (parsed) with the version the manifest describes (from the store's registry,
+ * with its dist), as new objects. The version is written exactly ("1.4.0", not "^1.4.0"): the editor decides when to
+ * update. Throws NeedsNpm when only `npm install` can do it.
+ */
+export function addToLock(packageJson: any, lock: any, manifest: any): {
+    packageJson: any;
+    lock: any;
+};
+/**
+ * package.json and package-lock.json (parsed) without the package, as new objects: what `npm uninstall` writes for a
+ * package from the store, which has nothing of its own in the lock. Throws NeedsNpm when another package still needs it.
+ */
+export function removeFromLock(packageJson: any, lock: any, name: any): {
+    packageJson: any;
+    lock: any;
+};
+export class NeedsNpm extends Error {
+}

package/lib/lockfile.mjs

@@ -0,0 +1,135 @@
+// What a site's editor writes when it installs or updates a package from the store (the editor, @morphemecms/cms),
+// without npm: the package in package.json and its entry in package-lock.json, as `npm install` would write them, from
+// the version's manifest in the store's registry. It can, because a package in the store has no dependencies of its
+// own and no install scripts (src/registry.js), so its entry is all there is to change; npm ci checks its integrity.
+// When it cannot (the package wants peers the site does not have in those versions), it says so with NeedsNpm, and
+// the update is done with `npm install` instead. Moved here from morpheme-appstore (lib/lockfile.js), which
+// keeps its copy until it uses this one.
+import { satisfies, Unsupported } from './range.mjs';
+
+export class NeedsNpm extends Error {}
+
+const OWN_DEPENDENCIES = ['dependencies', 'optionalDependencies', 'bundleDependencies', 'bundledDependencies'];
+const INSTALL_SCRIPTS = ['preinstall', 'install', 'postinstall'];
+
+/** The object with key set to value, the keys sorted as npm sorts them. */
+function sortedWith(object, key, value) {
+  const all = { ...object, [key]: value };
+  return Object.fromEntries(
+    Object.keys(all)
+      .sort((a, b) => a.localeCompare(b, 'en'))
+      .map((k) => [k, all[k]]),
+  );
+}
+
+/** The lock's packages with one entry set: an existing one stays where it is, a new one goes where npm puts it. */
+function packagesWith(packages, key, entry) {
+  if (key in packages) return { ...packages, [key]: entry };
+  const out = {};
+  let placed = false;
+  for (const [k, v] of Object.entries(packages)) {
+    if (!placed && k !== '' && k.localeCompare(key, 'en') > 0) {
+      out[key] = entry;
+      placed = true;
+    }
+    out[k] = v;
+  }
+  if (!placed) out[key] = entry;
+  return out;
+}
+
+/** A manifest's bin as npm keeps it in the lock: { name: path }, without a leading ./. */
+function binOf(manifest) {
+  const bin = typeof manifest.bin === 'string' ? { [manifest.name.split('/').pop()]: manifest.bin } : manifest.bin;
+  if (!bin || typeof bin !== 'object') return undefined;
+  return Object.fromEntries(Object.entries(bin).map(([k, v]) => [k, String(v).replace(/^(\.\/)+/, '')]));
+}
+
+/** Why the peers the package asks for are not what the site has, or null. */
+function peerProblem(manifest, packages) {
+  const optional = manifest.peerDependenciesMeta ?? {};
+  for (const [peer, range] of Object.entries(manifest.peerDependencies ?? {})) {
+    const have = packages[`node_modules/${peer}`]?.version;
+    if (!have) {
+      if (optional[peer]?.optional) continue;
+      return `${manifest.name} ${manifest.version} skal have ${peer} ${range}, som sitet ikke har.`;
+    }
+    try {
+      if (!satisfies(have, range)) return `${manifest.name} ${manifest.version} skal have ${peer} ${range}; sitet har ${have}.`;
+    } catch (e) {
+      if (e instanceof Unsupported)
+        return `${manifest.name} ${manifest.version} skal have ${peer} ${range}, som ikke kan tjekkes uden npm.`;
+      throw e;
+    }
+  }
+  return null;
+}
+
+/**
+ * package.json and package-lock.json (parsed) with the version the manifest describes (from the store's registry,
+ * with its dist), as new objects. The version is written exactly ("1.4.0", not "^1.4.0"): the editor decides when to
+ * update. Throws NeedsNpm when only `npm install` can do it.
+ */
+export function addToLock(packageJson, lock, manifest) {
+  if (lock.lockfileVersion !== 3 || !lock.packages?.[''])
+    throw new NeedsNpm('package-lock.json er ikke i den udgave, npm 9 og nyere skriver.');
+  const { name, version, dist } = manifest;
+  if (!dist?.tarball || !/^sha512-/.test(dist.integrity ?? '')) throw new NeedsNpm(`${name} ${version} har ingen checksum.`);
+  for (const field of OWN_DEPENDENCIES) {
+    const value = manifest[field];
+    if (value && (Array.isArray(value) ? value.length : Object.keys(value).length)) throw new NeedsNpm(`${name} ${version} har ${field}.`);
+  }
+  if (INSTALL_SCRIPTS.some((s) => manifest.scripts?.[s])) throw new NeedsNpm(`${name} ${version} har scripts, der kører ved installation.`);
+  const key = `node_modules/${name}`;
+  for (const [path, entry] of Object.entries(lock.packages)) {
+    // Another package that needs it, or a copy of it further down: npm decides where it goes then.
+    if (path !== '' && path !== key && (path.endsWith(`/${key}`) || entry.dependencies?.[name] || entry.peerDependencies?.[name]))
+      throw new NeedsNpm(`${name} bruges også af ${path.slice('node_modules/'.length)}.`);
+  }
+  const problem = peerProblem(manifest, lock.packages);
+  if (problem) throw new NeedsNpm(problem);
+
+  const entry = { version, resolved: dist.tarball, integrity: dist.integrity };
+  if (manifest.license) entry.license = manifest.license;
+  const bin = binOf(manifest);
+  if (bin) entry.bin = bin;
+  for (const field of ['engines', 'funding', 'peerDependencies', 'peerDependenciesMeta'])
+    if (manifest[field]) entry[field] = manifest[field];
+
+  const root = lock.packages[''];
+  const packages = packagesWith(lock.packages, key, entry);
+  packages[''] = { ...root, dependencies: sortedWith(root.dependencies ?? {}, name, version) };
+  return {
+    packageJson: { ...packageJson, dependencies: sortedWith(packageJson.dependencies ?? {}, name, version) },
+    lock: { ...lock, packages },
+  };
+}
+
+/** The object without key, or the object itself when it has no such key. */
+function without(object, key) {
+  if (!object || !(key in object)) return object;
+  const { [key]: _, ...rest } = object;
+  return rest;
+}
+
+/**
+ * package.json and package-lock.json (parsed) without the package, as new objects: what `npm uninstall` writes for a
+ * package from the store, which has nothing of its own in the lock. Throws NeedsNpm when another package still needs it.
+ */
+export function removeFromLock(packageJson, lock, name) {
+  if (lock.lockfileVersion !== 3 || !lock.packages?.[''])
+    throw new NeedsNpm('package-lock.json er ikke i den udgave, npm 9 og nyere skriver.');
+  const key = `node_modules/${name}`;
+  for (const [path, entry] of Object.entries(lock.packages)) {
+    if (path === '' || path === key) continue;
+    if (path.endsWith(`/${key}`) || entry.dependencies?.[name] || entry.peerDependencies?.[name])
+      throw new NeedsNpm(`${name} bruges stadig af ${path.slice('node_modules/'.length)}.`);
+  }
+  const root = lock.packages[''];
+  const packages = { ...without(lock.packages, key) };
+  packages[''] = { ...root, dependencies: without(root.dependencies, name) };
+  if (!packages[''].dependencies) delete packages[''].dependencies;
+  const out = { ...packageJson };
+  if (packageJson.dependencies) out.dependencies = without(packageJson.dependencies, name);
+  return { packageJson: out, lock: { ...lock, packages } };
+}

package/lib/lockfile.test.d.mts

@@ -0,0 +1 @@
+export {};