@morphemecms/cms 0.3.0 → 0.4.0-next-20261104182038

package/CHANGELOG.md

@@ -1,5 +1,19 @@
 # @morphemecms/cms
 
+## 0.4.0-next-20261104182038
+
+### Minor Changes
+
+- cf46cb1: An app's block and pop-up name their view module `viewOf.ts` (it was `view.ts`), so it no longer collides with `View.tsx` on Windows.
+- 1fcbd56: The site updates Morpheme by itself: a new minor or patch version on npm is installed within the hour and undone when the site cannot be built. See Settings › Morpheme.
+
+### Patch Changes
+
+- dd9ab22: Settings › Morpheme says when the site has no KV storage (PUSH), and no longer fails to open when the site runs a pre-release of Morpheme.
+- cf9f144: Keep the line breaks of a file's front matter (CRLF or LF) when the editor writes it back.
+- 6cb2c17: `check:worker` passes when the site runs a pre-release of Morpheme (as the staging site does).
+- 682da97: New sites from the starter can reach the Morpheme store on the same Cloudflare account, and Prettier skips store theme files.
+
 ## 0.3.0
 
 ### Minor Changes

package/README.md

@@ -41,7 +41,7 @@ Hele vejledningen står i `docs/editor.md` i sitets repo. Her er kun det, et sit
   - `@site/config`: sitets navn, domæne, GitHub-repo og mapper.
   - `@site/worker` (til Workeren): `apps`, `contact`, `moved`, `standard`, `oldAddresses` (sitets videresendelser fra gamle adresser, `{ ids, paths }`) og appenes del af Workeren (`appWorkers`, `appTexts`).
 - **`@site`** for `src/site/`, ellers `defaults/`: i Vite (`siteFile` i `themePlugin`, `site/theme.mjs`, brugt af `astro.mjs` og `scripts/check-content.mjs`, der indlæser reglerne med Vite) og i TypeScript (`paths` i `tsconfig.json`: `"@site/*": ["./src/site/*", "./node_modules/@morphemecms/cms/defaults/*"]`); til Workeren `@site/config` og `@site/worker` i `alias` i `wrangler.jsonc`, med `main` sat til pakkens `worker/index.js`.
-- **Sitets egne blokke** i appenes `blocks/<type>/` (`src/apps/<app>/blocks/<type>/`), hver med `index.tsx` (`defineBlock` fra `@morphemecms/cms/src/blocks`), `view.ts` og `load.ts` (det, blokken viser, i editoren og på sitet) og `View.tsx` (tegningen, begge steder). Pakken finder dem selv.
+- **Sitets egne blokke** i appenes `blocks/<type>/` (`src/apps/<app>/blocks/<type>/`), hver med `index.tsx` (`defineBlock` fra `@morphemecms/cms/src/blocks`), `viewOf.ts` og `load.ts` (det, blokken viser, i editoren og på sitet) og `View.tsx` (tegningen, begge steder). Pakken finder dem selv.
 - **Et standardtema**, som alle sitets temaer bygger på, med standardblokkenes udseende (`blocks/<type>/View.tsx`, én tegning til sitet og editoren), som pakken selv finder (dette site: `packages/editor/theme/`, `packages/editor/src/standard/siteLooks.ts` og `packages/editor/src/standard/themeBlocks.ts`).
 - **Siderne** er pakkens (`pages/`, sat ind af `siteConfig()` i `astro.mjs`): sitets sider, bloggen, 404, `/ny/` og editoren (siden, der viser `src/App.tsx`, manifestet, `version.json` og billederne, sitets egen kode bruger). Sitets `astro.config.mjs` er kun `export default await siteConfig()`, og `src/content.config.ts` henter samlingerne fra `site/content.config`.
 - **Standardblokkenes stil:** `blocks.css` i standardtemaet (dette site: `packages/editor/theme/styles/blocks.css`), importeret i hvert temas CSS, og variablerne `--block-*` sat til temaets farver og former.

package/bin/morpheme.mjs

@@ -12,7 +12,7 @@ const COMMANDS = {
   'after-build': ['scheduled-list', 'link-counts', 'page-colors'],
   'check:content': ['check-content'],
   'check:editor': ['editor-roundtrip'],
-  'check:worker': ['check-worker', 'check-consent', 'check-store'],
+  'check:worker': ['check-worker', 'check-consent', 'check-store', 'check-cms-update'],
   'check:screens': ['editor-screens'],
   'check:themes': ['check-themes'],
   'check:demo': ['check-demo'],

package/defaults/editor.ts

@@ -43,6 +43,7 @@ import {
   Signpost,
   Smiley,
   SlidersHorizontal,
+  Sparkle,
   SquareHalfBottom,
   SquaresFour,
   Sticker,
@@ -126,6 +127,7 @@ export const icons: Record<string, Icon> = {
   blokvalg: ToggleRight,
   apps: PuzzlePiece,
   appstore: Storefront,
+  morpheme: Sparkle,
   avanceret: Wrench,
   licenser: Certificate,
   // The screens under "Udseende" (Library.tsx Theme).
@@ -156,7 +158,18 @@ export const groups: { title: string; ids: string[] }[] = [
 
 /** The settings of the whole site, not on the start screen but on "Indstillinger" (#indstillinger, Library.tsx
  * Settings), which the gear in the top bar opens (Screen.tsx SettingsLink); A–Å as a group's. */
-export const settings: string[] = ['udseende', 'apps', 'appstore', 'maaling', 'promovering', 'privatliv', 'seo', 'avanceret', 'licenser'];
+export const settings: string[] = [
+  'udseende',
+  'apps',
+  'appstore',
+  'morpheme',
+  'maaling',
+  'promovering',
+  'privatliv',
+  'seo',
+  'avanceret',
+  'licenser',
+];
 
 /** The site's own short lists, on a screen of their own under "Lister" (#lister), with those the standard blocks
  * bring ("Udtalelser") and the apps (their lists.ts). */

package/icons/lucide/LICENSE-material-design-icons

@@ -1,20 +1,20 @@
-Pictogrammers Free License
---------------------------
-
-This icon collection is released as free, open source, and GPL friendly by
-the [Pictogrammers](http://pictogrammers.com/) icon group. You may use it
-for commercial projects, open source projects, or anything really.
-
-# Icons: Apache 2.0 (https://www.apache.org/licenses/LICENSE-2.0)
-Some of the icons are redistributed under the Apache 2.0 license. All other
-icons are either redistributed under their respective licenses or are
-distributed under the Apache 2.0 license.
-
-# Fonts: Apache 2.0 (https://www.apache.org/licenses/LICENSE-2.0)
-All web and desktop fonts are distributed under the Apache 2.0 license. Web
-and desktop fonts contain some icons that are redistributed under the Apache
-2.0 license. All other icons are either redistributed under their respective
-licenses or are distributed under the Apache 2.0 license.
-
-# Code: MIT (https://opensource.org/licenses/MIT)
+Pictogrammers Free License
+--------------------------
+
+This icon collection is released as free, open source, and GPL friendly by
+the [Pictogrammers](http://pictogrammers.com/) icon group. You may use it
+for commercial projects, open source projects, or anything really.
+
+# Icons: Apache 2.0 (https://www.apache.org/licenses/LICENSE-2.0)
+Some of the icons are redistributed under the Apache 2.0 license. All other
+icons are either redistributed under their respective licenses or are
+distributed under the Apache 2.0 license.
+
+# Fonts: Apache 2.0 (https://www.apache.org/licenses/LICENSE-2.0)
+All web and desktop fonts are distributed under the Apache 2.0 license. Web
+and desktop fonts contain some icons that are redistributed under the Apache
+2.0 license. All other icons are either redistributed under their respective
+licenses or are distributed under the Apache 2.0 license.
+
+# Code: MIT (https://opensource.org/licenses/MIT)
 The MIT license applies to all non-font and non-icon files.

package/icons/material-symbols/LICENSE-material-design-icons

@@ -1,20 +1,20 @@
-Pictogrammers Free License
---------------------------
-
-This icon collection is released as free, open source, and GPL friendly by
-the [Pictogrammers](http://pictogrammers.com/) icon group. You may use it
-for commercial projects, open source projects, or anything really.
-
-# Icons: Apache 2.0 (https://www.apache.org/licenses/LICENSE-2.0)
-Some of the icons are redistributed under the Apache 2.0 license. All other
-icons are either redistributed under their respective licenses or are
-distributed under the Apache 2.0 license.
-
-# Fonts: Apache 2.0 (https://www.apache.org/licenses/LICENSE-2.0)
-All web and desktop fonts are distributed under the Apache 2.0 license. Web
-and desktop fonts contain some icons that are redistributed under the Apache
-2.0 license. All other icons are either redistributed under their respective
-licenses or are distributed under the Apache 2.0 license.
-
-# Code: MIT (https://opensource.org/licenses/MIT)
+Pictogrammers Free License
+--------------------------
+
+This icon collection is released as free, open source, and GPL friendly by
+the [Pictogrammers](http://pictogrammers.com/) icon group. You may use it
+for commercial projects, open source projects, or anything really.
+
+# Icons: Apache 2.0 (https://www.apache.org/licenses/LICENSE-2.0)
+Some of the icons are redistributed under the Apache 2.0 license. All other
+icons are either redistributed under their respective licenses or are
+distributed under the Apache 2.0 license.
+
+# Fonts: Apache 2.0 (https://www.apache.org/licenses/LICENSE-2.0)
+All web and desktop fonts are distributed under the Apache 2.0 license. Web
+and desktop fonts contain some icons that are redistributed under the Apache
+2.0 license. All other icons are either redistributed under their respective
+licenses or are distributed under the Apache 2.0 license.
+
+# Code: MIT (https://opensource.org/licenses/MIT)
 The MIT license applies to all non-font and non-icon files.

package/icons/phosphor/LICENSE

@@ -1,21 +1,21 @@
-MIT License
-
-Copyright (c) 2023 Phosphor Icons
-
-Permission is hereby granted, free of charge, to any person obtaining a copy
-of this software and associated documentation files (the "Software"), to deal
-in the Software without restriction, including without limitation the rights
-to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-copies of the Software, and to permit persons to whom the Software is
-furnished to do so, subject to the following conditions:
-
-The above copyright notice and this permission notice shall be included in all
-copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+MIT License
+
+Copyright (c) 2023 Phosphor Icons
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
 SOFTWARE.

package/lib/changelog.d.mts

@@ -0,0 +1,24 @@
+/**
+ * Unzips gzip bytes.
+ * @param {Uint8Array} bytes
+ * @returns {Promise<Uint8Array>}
+ */
+export function gunzip(bytes: Uint8Array): Promise<Uint8Array>;
+/**
+ * The UTF-8 text of the entry named exactly `path` in a tar, or null when there is none.
+ * @param {Uint8Array} tar
+ * @param {string} path
+ * @returns {string | null}
+ */
+export function fileFromTar(tar: Uint8Array, path: string): string | null;
+/**
+ * The changelog's sections for versions after `from` up to and including `to`, newest first, without empty ones.
+ * @param {string} changelog
+ * @param {string} from
+ * @param {string} to
+ * @returns {{ version: string, text: string }[]}
+ */
+export function sectionsBetween(changelog: string, from: string, to: string): {
+    version: string;
+    text: string;
+}[];

package/lib/changelog.mjs

@@ -0,0 +1,65 @@
+// A version's release notes, read from its npm tarball: unzips the tarball, finds CHANGELOG.md in the tar and cuts out the
+// sections between two versions. Exposes gunzip, fileFromTar and sectionsBetween. Depends on ./cms-version.mjs; no node: imports
+// (runs in a Cloudflare Worker and in Node 18+).
+import { compareVersions } from './cms-version.mjs';
+
+/**
+ * Unzips gzip bytes.
+ * @param {Uint8Array} bytes
+ * @returns {Promise<Uint8Array>}
+ */
+export async function gunzip(bytes) {
+  const stream = new Blob([bytes]).stream().pipeThrough(new DecompressionStream('gzip'));
+  return new Uint8Array(await new Response(stream).arrayBuffer());
+}
+
+/** The text of a NUL-terminated field of a tar header. */
+function field(header, start, end) {
+  const bytes = header.subarray(start, end);
+  const nul = bytes.indexOf(0);
+  return new TextDecoder().decode(nul === -1 ? bytes : bytes.subarray(0, nul));
+}
+
+/**
+ * The UTF-8 text of the entry named exactly `path` in a tar, or null when there is none.
+ * @param {Uint8Array} tar
+ * @param {string} path
+ * @returns {string | null}
+ */
+export function fileFromTar(tar, path) {
+  let offset = 0;
+  while (offset + 512 <= tar.length) {
+    const header = tar.subarray(offset, offset + 512);
+    if (header.every((byte) => byte === 0)) return null;
+    const name = field(header, 0, 100);
+    const prefix = field(header, 345, 500);
+    const size = parseInt(field(header, 124, 136).trim(), 8) || 0;
+    const data = tar.subarray(offset + 512, offset + 512 + size);
+    if ((prefix ? prefix + '/' + name : name) === path) return new TextDecoder().decode(data);
+    offset += 512 + Math.ceil(size / 512) * 512;
+  }
+  return null;
+}
+
+/**
+ * The changelog's sections for versions after `from` up to and including `to`, newest first, without empty ones.
+ * @param {string} changelog
+ * @param {string} from
+ * @param {string} to
+ * @returns {{ version: string, text: string }[]}
+ */
+export function sectionsBetween(changelog, from, to) {
+  const sections = [];
+  let current = null;
+  for (const line of changelog.split(/\r?\n/)) {
+    if (line.startsWith('## ')) {
+      current = { version: line.slice(3).trim(), lines: [] };
+      sections.push(current);
+    } else if (current) current.lines.push(line);
+  }
+  return sections
+    .filter(({ version }) => /^\d+\.\d+\.\d+$/.test(version) && compareVersions(version, from) === 1 && compareVersions(version, to) <= 0)
+    .map(({ version, lines }) => ({ version, text: lines.join('\n').trim() }))
+    .filter(({ text }) => text !== '')
+    .sort((a, b) => compareVersions(b.version, a.version));
+}

package/lib/changelog.test.d.mts

@@ -0,0 +1 @@
+export {};

package/lib/changelog.test.mjs

@@ -0,0 +1,67 @@
+// Tests for lib/changelog.mjs: a version's release notes read from its npm tarball.
+// Run: node --test packages/editor/lib/changelog.test.mjs
+import { test } from 'node:test';
+import assert from 'node:assert/strict';
+import { gzipSync } from 'node:zlib';
+import { gunzip, fileFromTar, sectionsBetween } from './changelog.mjs';
+
+/** One tar entry: a 512-byte header, then the data padded to a multiple of 512. */
+function tarEntry(name, text, prefix = '') {
+  const data = Buffer.from(text);
+  const header = Buffer.alloc(512);
+  header.write(name, 0, 'ascii');
+  header.write('0000644\0', 100, 'ascii');
+  header.write('0000000\0', 108, 'ascii');
+  header.write('0000000\0', 116, 'ascii');
+  header.write(data.length.toString(8).padStart(11, '0') + '\0', 124, 'ascii');
+  header.write('00000000000\0', 136, 'ascii');
+  header.write('0', 156, 'ascii');
+  header.write('ustar\0', 257, 'ascii');
+  header.write('00', 263, 'ascii');
+  header.write(prefix, 345, 'ascii');
+  header.fill(' ', 148, 156);
+  const sum = header.reduce((total, byte) => total + byte, 0);
+  header.write(sum.toString(8).padStart(6, '0') + '\0 ', 148, 'ascii');
+  return Buffer.concat([header, data, Buffer.alloc(Math.ceil(data.length / 512) * 512 - data.length)]);
+}
+
+const tarball = (...entries) => new Uint8Array(Buffer.concat([...entries, Buffer.alloc(1024)]));
+
+const changelogText = '# x\n\n## 0.1.1\n';
+const tar = tarball(tarEntry('package/package.json', '{"name":"x"}'), tarEntry('package/CHANGELOG.md', changelogText));
+
+test('fileFromTar finds a file by its name', () => assert.equal(fileFromTar(tar, 'package/CHANGELOG.md'), changelogText));
+test('fileFromTar returns null for a missing file', () => assert.equal(fileFromTar(tar, 'package/missing.md'), null));
+test('fileFromTar joins the prefix of a long name', () => {
+  const prefix = 'package/' + 'a'.repeat(120);
+  const long = tarball(tarEntry('CHANGELOG.md', 'long one', prefix));
+  assert.equal(fileFromTar(long, prefix + '/CHANGELOG.md'), 'long one');
+});
+
+test('gunzip gives the input back', async () => {
+  const bytes = await gunzip(new Uint8Array(gzipSync(Buffer.from('hello tar'))));
+  assert.equal(new TextDecoder().decode(bytes), 'hello tar');
+});
+
+/** A changelog with one `### Patch Changes` line and one bullet under each version. */
+const changelogOf = (...versions) =>
+  ['# @morphemecms/cms', '', ...versions.flatMap((v) => [`## ${v}`, '', '### Patch Changes', '', `- Change ${v}`, ''])].join('\n');
+
+const full = changelogOf('0.3.0', '0.2.1', '0.2.0', '0.1.1');
+const versionsOf = (sections) => sections.map((section) => section.version);
+
+test('sectionsBetween returns the versions after from up to to, newest first', () => {
+  const sections = sectionsBetween(full, '0.1.1', '0.3.0');
+  assert.deepEqual(versionsOf(sections), ['0.3.0', '0.2.1', '0.2.0']);
+  assert.equal(sections[0].text, '### Patch Changes\n\n- Change 0.3.0');
+});
+test('sectionsBetween is empty when from equals to', () => assert.deepEqual(sectionsBetween(full, '0.2.1', '0.2.1'), []));
+test('sectionsBetween includes to but not from', () => assert.deepEqual(versionsOf(sectionsBetween(full, '0.1.0', '0.1.1')), ['0.1.1']));
+test('sectionsBetween drops a section with only blank lines', () => {
+  const text = '# x\n\n## 0.2.0\n\n\n';
+  assert.deepEqual(sectionsBetween(text, '0.1.0', '0.2.0'), []);
+});
+test('sectionsBetween ignores pre-release headings', () => {
+  const text = `## 0.2.0-next-1\n\n- Next\n\n${changelogOf('0.1.1')}`;
+  assert.deepEqual(versionsOf(sectionsBetween(text, '0.1.0', '0.2.0')), ['0.1.1']);
+});

package/lib/cms-version.d.mts

@@ -0,0 +1,56 @@
+/**
+ * Compares two plain X.Y.Z versions number by number; throws Error('pre-release') for a version with a pre-release part.
+ * @param {string} a
+ * @param {string} b
+ * @returns {-1 | 0 | 1}
+ */
+export function compareVersions(a: string, b: string): -1 | 0 | 1;
+/**
+ * The version of the CMS a site's package.json pins exactly, or why the site does not let the CMS manage it.
+ * @param {{ dependencies?: Record<string, string>, devDependencies?: Record<string, string> }} packageJson
+ * @param {{ packages?: Record<string, { link?: boolean }> } | null | undefined} lock
+ * @returns {{ version: string } | { reason: 'missing' | 'workspace' | 'tag' | 'range' | 'link' }}
+ */
+export function managedVersion(packageJson: {
+    dependencies?: Record<string, string>;
+    devDependencies?: Record<string, string>;
+}, lock: {
+    packages?: Record<string, {
+        link?: boolean;
+    }>;
+} | null | undefined): {
+    version: string;
+} | {
+    reason: "missing" | "workspace" | "tag" | "range" | "link";
+};
+/**
+ * The version to move to, and whether it is taken by itself; null when there is nothing newer to take.
+ * @param {string} current
+ * @param {string} latest
+ * @param {string[]} skipped
+ * @returns {null | { version: string, auto: boolean, why?: 'major' | 'skipped' }}
+ */
+export function nextVersion(current: string, latest: string, skipped: string[]): null | {
+    version: string;
+    auto: boolean;
+    why?: "major" | "skipped";
+};
+/**
+ * What to do next with an update being watched (state 'waiting') or an undo being watched (state 'undoing').
+ * @param {{ state: string, to: string, from: string, at: string, undoAt?: string }} update times are ISO strings
+ * @param {string} running the version the site runs now
+ * @param {'success' | 'failure' | null} check the result of the commit's check run
+ * @param {number} now milliseconds
+ * @returns {'wait' | 'done' | 'undo' | 'undone' | 'stuck'}
+ */
+export function watchStep(update: {
+    state: string;
+    to: string;
+    from: string;
+    at: string;
+    undoAt?: string;
+}, running: string, check: "success" | "failure" | null, now: number): "wait" | "done" | "undo" | "undone" | "stuck";
+/** The npm package of the CMS. */
+export const PACKAGE: "@morphemecms/cms";
+/** How long an update or its undo is watched before it counts as over, in milliseconds (20 minutes). */
+export const WATCH_LIMIT: number;

package/lib/cms-version.mjs

@@ -0,0 +1,85 @@
+// Which version of the CMS a site takes, and when an update that did not build is undone: reads the site's package.json,
+// compares versions and steps the update's watch. Exposes PACKAGE, WATCH_LIMIT, compareVersions, managedVersion,
+// nextVersion and watchStep. No dependencies, no I/O (runs in a Worker and in Node).
+
+/** The npm package of the CMS. */
+export const PACKAGE = '@morphemecms/cms';
+
+/** How long an update or its undo is watched before it counts as over, in milliseconds (20 minutes). */
+export const WATCH_LIMIT = 20 * 60 * 1000;
+
+const PLAIN = /^\d+\.\d+\.\d+$/;
+
+/** True when a version has anything after X.Y.Z. */
+const isPreRelease = (version) => !PLAIN.test(version);
+
+/**
+ * Compares two plain X.Y.Z versions number by number; throws Error('pre-release') for a version with a pre-release part.
+ * @param {string} a
+ * @param {string} b
+ * @returns {-1 | 0 | 1}
+ */
+export function compareVersions(a, b) {
+  if (isPreRelease(a) || isPreRelease(b)) throw new Error('pre-release');
+  const x = a.split('.').map(Number);
+  const y = b.split('.').map(Number);
+  for (let i = 0; i < 3; i++) {
+    if (x[i] !== y[i]) return x[i] < y[i] ? -1 : 1;
+  }
+  return 0;
+}
+
+/**
+ * The version of the CMS a site's package.json pins exactly, or why the site does not let the CMS manage it.
+ * @param {{ dependencies?: Record<string, string>, devDependencies?: Record<string, string> }} packageJson
+ * @param {{ packages?: Record<string, { link?: boolean }> } | null | undefined} lock
+ * @returns {{ version: string } | { reason: 'missing' | 'workspace' | 'tag' | 'range' | 'link' }}
+ */
+export function managedVersion(packageJson, lock) {
+  const value = packageJson?.dependencies?.[PACKAGE] ?? packageJson?.devDependencies?.[PACKAGE];
+  if (value === undefined) return { reason: 'missing' };
+  if (value === '*' || value.startsWith('workspace:') || value.startsWith('file:')) return { reason: 'workspace' };
+  if (lock?.packages?.['node_modules/@morphemecms/cms']?.link === true) return { reason: 'link' };
+  if (!/\d+\.\d+/.test(value)) return { reason: 'tag' };
+  if (!PLAIN.test(value)) return { reason: 'range' };
+  return { version: value };
+}
+
+/**
+ * The version to move to, and whether it is taken by itself; null when there is nothing newer to take.
+ * @param {string} current
+ * @param {string} latest
+ * @param {string[]} skipped
+ * @returns {null | { version: string, auto: boolean, why?: 'major' | 'skipped' }}
+ */
+export function nextVersion(current, latest, skipped) {
+  if (isPreRelease(latest)) return null;
+  if (compareVersions(latest, current) !== 1) return null;
+  if (latest.split('.')[0] !== current.split('.')[0]) return { version: latest, auto: false, why: 'major' };
+  if (skipped.includes(latest)) return { version: latest, auto: false, why: 'skipped' };
+  return { version: latest, auto: true };
+}
+
+/**
+ * What to do next with an update being watched (state 'waiting') or an undo being watched (state 'undoing').
+ * @param {{ state: string, to: string, from: string, at: string, undoAt?: string }} update times are ISO strings
+ * @param {string} running the version the site runs now
+ * @param {'success' | 'failure' | null} check the result of the commit's check run
+ * @param {number} now milliseconds
+ * @returns {'wait' | 'done' | 'undo' | 'undone' | 'stuck'}
+ */
+export function watchStep(update, running, check, now) {
+  if (update.state === 'waiting') {
+    if (running === update.to) return 'done';
+    if (check === 'failure') return 'undo';
+    if (now - Date.parse(update.at) > WATCH_LIMIT) return 'undo';
+    return 'wait';
+  }
+  if (update.state === 'undoing') {
+    if (check === 'success') return 'undone';
+    if (check === 'failure') return 'stuck';
+    if (now - Date.parse(update.undoAt) > WATCH_LIMIT) return 'undone';
+    return 'wait';
+  }
+  return 'wait';
+}

package/lib/cms-version.test.d.mts

@@ -0,0 +1 @@
+export {};

package/lib/cms-version.test.mjs

@@ -0,0 +1,68 @@
+// Tests for lib/cms-version.mjs: which CMS version a site takes, and when an update is undone.
+// Run: node --test packages/editor/lib/cms-version.test.mjs
+import { test } from 'node:test';
+import assert from 'node:assert/strict';
+import { PACKAGE, WATCH_LIMIT, compareVersions, managedVersion, nextVersion, watchStep } from './cms-version.mjs';
+
+test('the package is the CMS', () => assert.equal(PACKAGE, '@morphemecms/cms'));
+test('the watch limit is 20 minutes', () => assert.equal(WATCH_LIMIT, 20 * 60 * 1000));
+
+test('compareVersions: older is -1', () => assert.equal(compareVersions('0.1.0', '0.1.1'), -1));
+test('compareVersions: compares number by number', () => assert.equal(compareVersions('0.10.0', '0.9.9'), 1));
+test('compareVersions: equal is 0', () => assert.equal(compareVersions('0.1.1', '0.1.1'), 0));
+test('compareVersions: a pre-release throws', () =>
+  assert.throws(() => compareVersions('0.2.0-next-1', '0.1.0'), { message: 'pre-release' }));
+
+const lock = { packages: {} };
+const dep = (value) => ({ dependencies: { [PACKAGE]: value } });
+
+test('managedVersion: an exact version is managed', () => assert.deepEqual(managedVersion(dep('0.1.1'), lock), { version: '0.1.1' }));
+test('managedVersion: * is a workspace', () => assert.deepEqual(managedVersion(dep('*'), lock), { reason: 'workspace' }));
+test('managedVersion: workspace:* is a workspace', () =>
+  assert.deepEqual(managedVersion(dep('workspace:*'), lock), { reason: 'workspace' }));
+test('managedVersion: a tag is a tag', () => assert.deepEqual(managedVersion(dep('next'), lock), { reason: 'tag' }));
+test('managedVersion: ^ is a range', () => assert.deepEqual(managedVersion(dep('^0.1.0'), lock), { reason: 'range' }));
+test('managedVersion: ~ is a range', () => assert.deepEqual(managedVersion(dep('~0.1.0'), lock), { reason: 'range' }));
+test('managedVersion: a linked lock entry is a link', () => {
+  const linked = { packages: { 'node_modules/@morphemecms/cms': { link: true } } };
+  assert.deepEqual(managedVersion(dep('0.1.1'), linked), { reason: 'link' });
+});
+test('managedVersion: no dependency is missing', () => assert.deepEqual(managedVersion({}, lock), { reason: 'missing' }));
+test('managedVersion: devDependencies count', () => {
+  assert.deepEqual(managedVersion({ devDependencies: { [PACKAGE]: '0.1.0' } }, lock), { version: '0.1.0' });
+});
+
+test('nextVersion: a patch is taken by itself', () =>
+  assert.deepEqual(nextVersion('0.1.0', '0.1.1', []), { version: '0.1.1', auto: true }));
+test('nextVersion: a minor is taken by itself', () =>
+  assert.deepEqual(nextVersion('0.1.1', '0.2.0', []), { version: '0.2.0', auto: true }));
+test('nextVersion: a major is not', () => {
+  assert.deepEqual(nextVersion('0.9.0', '1.0.0', []), { version: '1.0.0', auto: false, why: 'major' });
+});
+test('nextVersion: a skipped version is not', () => {
+  assert.deepEqual(nextVersion('0.1.0', '0.1.1', ['0.1.1']), { version: '0.1.1', auto: false, why: 'skipped' });
+});
+test('nextVersion: the same version is null', () => assert.equal(nextVersion('0.1.1', '0.1.1', []), null));
+test('nextVersion: an older version is null', () => assert.equal(nextVersion('0.2.0', '0.1.9', []), null));
+test('nextVersion: a pre-release is null', () => assert.equal(nextVersion('0.1.0', '0.2.0-next-20261103', []), null));
+
+const at = '2026-11-03T12:00:00.000Z';
+const min = 60 * 1000;
+const t0 = Date.parse(at);
+const waiting = { state: 'waiting', from: '0.1.0', to: '0.1.1', at };
+const undoing = { state: 'undoing', from: '0.1.0', to: '0.1.1', at, undoAt: at };
+
+test('watchStep waiting: the running version wins', () => assert.equal(watchStep(waiting, '0.1.1', null, t0 + 5 * min), 'done'));
+test('watchStep waiting: the running version wins over a failure', () => assert.equal(watchStep(waiting, '0.1.1', 'failure', t0), 'done'));
+test('watchStep waiting: a failed check undoes', () => assert.equal(watchStep(waiting, '0.1.0', 'failure', t0 + 5 * min), 'undo'));
+test('watchStep waiting: 19 minutes waits', () => assert.equal(watchStep(waiting, '0.1.0', null, t0 + 19 * min), 'wait'));
+test('watchStep waiting: 21 minutes undoes', () => assert.equal(watchStep(waiting, '0.1.0', null, t0 + 21 * min), 'undo'));
+test('watchStep waiting: a success that is not online yet waits', () =>
+  assert.equal(watchStep(waiting, '0.1.0', 'success', t0 + 5 * min), 'wait'));
+
+test('watchStep undoing: success is undone', () => assert.equal(watchStep(undoing, '0.1.0', 'success', t0), 'undone'));
+test('watchStep undoing: failure is stuck', () => assert.equal(watchStep(undoing, '0.1.0', 'failure', t0), 'stuck'));
+test('watchStep undoing: 21 minutes is undone', () => assert.equal(watchStep(undoing, '0.1.0', null, t0 + 21 * min), 'undone'));
+test('watchStep undoing: 5 minutes waits', () => assert.equal(watchStep(undoing, '0.1.0', null, t0 + 5 * min), 'wait'));
+test('watchStep: any other state waits', () =>
+  assert.equal(watchStep({ ...waiting, state: 'done' }, '0.1.0', 'failure', t0 + 30 * min), 'wait'));

package/lib/lockfile.d.mts

@@ -0,0 +1,19 @@
+/**
+ * package.json and package-lock.json (parsed) with the version the manifest describes (from the store's registry,
+ * with its dist), as new objects. The version is written exactly ("1.4.0", not "^1.4.0"): the editor decides when to
+ * update. Throws NeedsNpm when only `npm install` can do it.
+ */
+export function addToLock(packageJson: any, lock: any, manifest: any): {
+    packageJson: any;
+    lock: any;
+};
+/**
+ * package.json and package-lock.json (parsed) without the package, as new objects: what `npm uninstall` writes for a
+ * package from the store, which has nothing of its own in the lock. Throws NeedsNpm when another package still needs it.
+ */
+export function removeFromLock(packageJson: any, lock: any, name: any): {
+    packageJson: any;
+    lock: any;
+};
+export class NeedsNpm extends Error {
+}