@morphemecms/cms 0.3.0 → 0.4.0-next-20261104182038

package/lib/lockfile.mjs

@@ -0,0 +1,135 @@
+// What a site's editor writes when it installs or updates a package from the store (the editor, @morphemecms/cms),
+// without npm: the package in package.json and its entry in package-lock.json, as `npm install` would write them, from
+// the version's manifest in the store's registry. It can, because a package in the store has no dependencies of its
+// own and no install scripts (src/registry.js), so its entry is all there is to change; npm ci checks its integrity.
+// When it cannot (the package wants peers the site does not have in those versions), it says so with NeedsNpm, and
+// the update is done with `npm install` instead. Moved here from morpheme-appstore (lib/lockfile.js), which
+// keeps its copy until it uses this one.
+import { satisfies, Unsupported } from './range.mjs';
+
+export class NeedsNpm extends Error {}
+
+const OWN_DEPENDENCIES = ['dependencies', 'optionalDependencies', 'bundleDependencies', 'bundledDependencies'];
+const INSTALL_SCRIPTS = ['preinstall', 'install', 'postinstall'];
+
+/** The object with key set to value, the keys sorted as npm sorts them. */
+function sortedWith(object, key, value) {
+  const all = { ...object, [key]: value };
+  return Object.fromEntries(
+    Object.keys(all)
+      .sort((a, b) => a.localeCompare(b, 'en'))
+      .map((k) => [k, all[k]]),
+  );
+}
+
+/** The lock's packages with one entry set: an existing one stays where it is, a new one goes where npm puts it. */
+function packagesWith(packages, key, entry) {
+  if (key in packages) return { ...packages, [key]: entry };
+  const out = {};
+  let placed = false;
+  for (const [k, v] of Object.entries(packages)) {
+    if (!placed && k !== '' && k.localeCompare(key, 'en') > 0) {
+      out[key] = entry;
+      placed = true;
+    }
+    out[k] = v;
+  }
+  if (!placed) out[key] = entry;
+  return out;
+}
+
+/** A manifest's bin as npm keeps it in the lock: { name: path }, without a leading ./. */
+function binOf(manifest) {
+  const bin = typeof manifest.bin === 'string' ? { [manifest.name.split('/').pop()]: manifest.bin } : manifest.bin;
+  if (!bin || typeof bin !== 'object') return undefined;
+  return Object.fromEntries(Object.entries(bin).map(([k, v]) => [k, String(v).replace(/^(\.\/)+/, '')]));
+}
+
+/** Why the peers the package asks for are not what the site has, or null. */
+function peerProblem(manifest, packages) {
+  const optional = manifest.peerDependenciesMeta ?? {};
+  for (const [peer, range] of Object.entries(manifest.peerDependencies ?? {})) {
+    const have = packages[`node_modules/${peer}`]?.version;
+    if (!have) {
+      if (optional[peer]?.optional) continue;
+      return `${manifest.name} ${manifest.version} skal have ${peer} ${range}, som sitet ikke har.`;
+    }
+    try {
+      if (!satisfies(have, range)) return `${manifest.name} ${manifest.version} skal have ${peer} ${range}; sitet har ${have}.`;
+    } catch (e) {
+      if (e instanceof Unsupported)
+        return `${manifest.name} ${manifest.version} skal have ${peer} ${range}, som ikke kan tjekkes uden npm.`;
+      throw e;
+    }
+  }
+  return null;
+}
+
+/**
+ * package.json and package-lock.json (parsed) with the version the manifest describes (from the store's registry,
+ * with its dist), as new objects. The version is written exactly ("1.4.0", not "^1.4.0"): the editor decides when to
+ * update. Throws NeedsNpm when only `npm install` can do it.
+ */
+export function addToLock(packageJson, lock, manifest) {
+  if (lock.lockfileVersion !== 3 || !lock.packages?.[''])
+    throw new NeedsNpm('package-lock.json er ikke i den udgave, npm 9 og nyere skriver.');
+  const { name, version, dist } = manifest;
+  if (!dist?.tarball || !/^sha512-/.test(dist.integrity ?? '')) throw new NeedsNpm(`${name} ${version} har ingen checksum.`);
+  for (const field of OWN_DEPENDENCIES) {
+    const value = manifest[field];
+    if (value && (Array.isArray(value) ? value.length : Object.keys(value).length)) throw new NeedsNpm(`${name} ${version} har ${field}.`);
+  }
+  if (INSTALL_SCRIPTS.some((s) => manifest.scripts?.[s])) throw new NeedsNpm(`${name} ${version} har scripts, der kører ved installation.`);
+  const key = `node_modules/${name}`;
+  for (const [path, entry] of Object.entries(lock.packages)) {
+    // Another package that needs it, or a copy of it further down: npm decides where it goes then.
+    if (path !== '' && path !== key && (path.endsWith(`/${key}`) || entry.dependencies?.[name] || entry.peerDependencies?.[name]))
+      throw new NeedsNpm(`${name} bruges også af ${path.slice('node_modules/'.length)}.`);
+  }
+  const problem = peerProblem(manifest, lock.packages);
+  if (problem) throw new NeedsNpm(problem);
+
+  const entry = { version, resolved: dist.tarball, integrity: dist.integrity };
+  if (manifest.license) entry.license = manifest.license;
+  const bin = binOf(manifest);
+  if (bin) entry.bin = bin;
+  for (const field of ['engines', 'funding', 'peerDependencies', 'peerDependenciesMeta'])
+    if (manifest[field]) entry[field] = manifest[field];
+
+  const root = lock.packages[''];
+  const packages = packagesWith(lock.packages, key, entry);
+  packages[''] = { ...root, dependencies: sortedWith(root.dependencies ?? {}, name, version) };
+  return {
+    packageJson: { ...packageJson, dependencies: sortedWith(packageJson.dependencies ?? {}, name, version) },
+    lock: { ...lock, packages },
+  };
+}
+
+/** The object without key, or the object itself when it has no such key. */
+function without(object, key) {
+  if (!object || !(key in object)) return object;
+  const { [key]: _, ...rest } = object;
+  return rest;
+}
+
+/**
+ * package.json and package-lock.json (parsed) without the package, as new objects: what `npm uninstall` writes for a
+ * package from the store, which has nothing of its own in the lock. Throws NeedsNpm when another package still needs it.
+ */
+export function removeFromLock(packageJson, lock, name) {
+  if (lock.lockfileVersion !== 3 || !lock.packages?.[''])
+    throw new NeedsNpm('package-lock.json er ikke i den udgave, npm 9 og nyere skriver.');
+  const key = `node_modules/${name}`;
+  for (const [path, entry] of Object.entries(lock.packages)) {
+    if (path === '' || path === key) continue;
+    if (path.endsWith(`/${key}`) || entry.dependencies?.[name] || entry.peerDependencies?.[name])
+      throw new NeedsNpm(`${name} bruges stadig af ${path.slice('node_modules/'.length)}.`);
+  }
+  const root = lock.packages[''];
+  const packages = { ...without(lock.packages, key) };
+  packages[''] = { ...root, dependencies: without(root.dependencies, name) };
+  if (!packages[''].dependencies) delete packages[''].dependencies;
+  const out = { ...packageJson };
+  if (packageJson.dependencies) out.dependencies = without(packageJson.dependencies, name);
+  return { packageJson: out, lock: { ...lock, packages } };
+}

package/lib/lockfile.test.d.mts

@@ -0,0 +1 @@
+export {};

package/lib/lockfile.test.mjs

@@ -0,0 +1,88 @@
+// Tests for lib/lockfile.mjs (moved from morpheme-appstore's test/unit/lockfile.test.mjs). Run: node --test packages/editor/lib/lockfile.test.mjs
+import assert from 'node:assert/strict';
+import { test } from 'node:test';
+import { addToLock, NeedsNpm, removeFromLock } from './lockfile.mjs';
+
+const site = () => ({
+  packageJson: { name: 'site', dependencies: { astro: '^7.3.7', yaml: '^2.9.1' } },
+  lock: {
+    name: 'site',
+    lockfileVersion: 3,
+    requires: true,
+    packages: {
+      '': { name: 'site', dependencies: { astro: '^7.3.7', yaml: '^2.9.1' } },
+      'node_modules/astro': { version: '7.3.7' },
+      'node_modules/yaml': { version: '2.9.1' },
+    },
+  },
+});
+
+const manifest = (over = {}) => ({
+  name: '@morpheme/cms',
+  version: '1.0.0',
+  license: 'UNLICENSED',
+  peerDependencies: { astro: '^7.3.2', yaml: '^2.0.0' },
+  bin: { 'site-editor': './bin/cli.mjs' },
+  dist: {
+    tarball: 'https://morpheme-appstore.larsadolfsen.workers.dev/npm/@morpheme/cms/-/cms-1.0.0.tgz',
+    integrity: 'sha512-abc',
+    shasum: 'def',
+  },
+  ...over,
+});
+
+test('a new package goes into package.json and the lock where npm puts it', () => {
+  const { packageJson, lock } = addToLock(site().packageJson, site().lock, manifest());
+  assert.deepEqual(Object.keys(packageJson.dependencies), ['@morpheme/cms', 'astro', 'yaml']);
+  assert.equal(packageJson.dependencies['@morpheme/cms'], '1.0.0');
+  assert.deepEqual(Object.keys(lock.packages), ['', 'node_modules/@morpheme/cms', 'node_modules/astro', 'node_modules/yaml']);
+  assert.equal(lock.packages[''].dependencies['@morpheme/cms'], '1.0.0');
+  assert.deepEqual(lock.packages['node_modules/@morpheme/cms'], {
+    version: '1.0.0',
+    resolved: manifest().dist.tarball,
+    integrity: 'sha512-abc',
+    license: 'UNLICENSED',
+    bin: { 'site-editor': 'bin/cli.mjs' },
+    peerDependencies: { astro: '^7.3.2', yaml: '^2.0.0' },
+  });
+});
+
+test('an update changes only its own entry', () => {
+  const first = addToLock(site().packageJson, site().lock, manifest());
+  const next = addToLock(first.packageJson, first.lock, manifest({ version: '1.1.0' }));
+  assert.equal(next.lock.packages['node_modules/@morpheme/cms'].version, '1.1.0');
+  assert.deepEqual(next.lock.packages['node_modules/yaml'], first.lock.packages['node_modules/yaml']);
+});
+
+test('peers the site does not have, in those versions, need npm', () => {
+  assert.throws(() => addToLock(site().packageJson, site().lock, manifest({ peerDependencies: { yaml: '^3.0.0' } })), NeedsNpm);
+  assert.throws(() => addToLock(site().packageJson, site().lock, manifest({ peerDependencies: { react: '^19.0.0' } })), NeedsNpm);
+  assert.doesNotThrow(() =>
+    addToLock(
+      site().packageJson,
+      site().lock,
+      manifest({ peerDependencies: { react: '^19.0.0' }, peerDependenciesMeta: { react: { optional: true } } }),
+    ),
+  );
+});
+
+test('dependencies of its own and install scripts need npm', () => {
+  assert.throws(() => addToLock(site().packageJson, site().lock, manifest({ dependencies: { yaml: '^2.0.0' } })), NeedsNpm);
+  assert.throws(() => addToLock(site().packageJson, site().lock, manifest({ scripts: { postinstall: 'node x.js' } })), NeedsNpm);
+});
+
+test('removing a package undoes adding it, and leaves the input alone', () => {
+  const added = addToLock(site().packageJson, site().lock, manifest());
+  const snapshot = structuredClone(added);
+  const { packageJson, lock } = removeFromLock(added.packageJson, added.lock, '@morpheme/cms');
+  assert.deepEqual(packageJson, site().packageJson);
+  assert.deepEqual(lock, site().lock);
+  assert.deepEqual(added, snapshot);
+});
+
+test('removing a package another one needs, or from an old lock, needs npm', () => {
+  const added = addToLock(site().packageJson, site().lock, manifest());
+  added.lock.packages['node_modules/@morpheme/theme'] = { version: '1.0.0', peerDependencies: { '@morpheme/cms': '^1.0.0' } };
+  assert.throws(() => removeFromLock(added.packageJson, added.lock, '@morpheme/cms'), NeedsNpm);
+  assert.throws(() => removeFromLock(site().packageJson, { ...site().lock, lockfileVersion: 2 }, 'yaml'), NeedsNpm);
+});

package/lib/range.d.mts

@@ -0,0 +1,4 @@
+/** Whether version satisfies range; throws Unsupported for what this does not read. */
+export function satisfies(version: any, range: any): any;
+export class Unsupported extends Error {
+}

package/lib/range.mjs

@@ -0,0 +1,104 @@
+// Whether a version satisfies an npm range, for the ranges packages write in peerDependencies: exact versions,
+// x-ranges (1, 1.2, 1.2.x, *), ^, ~, the comparators (>=, >, <=, <, =), hyphen ranges and ||. Anything else (and a
+// version with a pre-release) throws Unsupported, so the caller can say that `npm install` must do it instead of
+// guessing.
+// Moved here from morpheme-appstore (lib/range.js), which keeps its copy until it uses this one.
+
+export class Unsupported extends Error {}
+
+const PART = '(0|[1-9]\\d*|[xX*])';
+const PARTIAL = new RegExp(`^v?${PART}(?:\\.${PART}(?:\\.${PART})?)?$`);
+const VERSION = /^v?(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)$/;
+
+const wild = (p) => p === undefined || /^[xX*]$/.test(p);
+
+/** [major, minor, patch] of a version, or Unsupported. */
+function parse(version) {
+  const m = VERSION.exec(version);
+  if (!m) throw new Unsupported(`version ${version}`);
+  return m.slice(1, 4).map(Number);
+}
+
+function compare(a, b) {
+  for (let i = 0; i < 3; i++) if (a[i] !== b[i]) return a[i] < b[i] ? -1 : 1;
+  return 0;
+}
+
+/** A partial version as [numbers given] (1.2 → [1, 2]); x, X and * end it. */
+function partial(text) {
+  const m = PARTIAL.exec(text);
+  if (!m) throw new Unsupported(`range ${text}`);
+  const parts = [];
+  for (const p of m.slice(1, 4)) {
+    if (wild(p)) break;
+    parts.push(Number(p));
+  }
+  return parts;
+}
+
+const pad = (parts) => [parts[0] ?? 0, parts[1] ?? 0, parts[2] ?? 0];
+/** The first version above everything a partial version covers (1.2 → 1.3.0, 1 → 2.0.0). */
+function above(parts) {
+  if (parts.length === 0) return null;
+  if (parts.length === 1) return [parts[0] + 1, 0, 0];
+  if (parts.length === 2) return [parts[0], parts[1] + 1, 0];
+  return null;
+}
+
+/** One comparator as [low, lowInclusive, high, highInclusive] bounds (null: none). */
+function bounds(token) {
+  const op = /^(>=|<=|>|<|=|\^|~)?(.*)$/.exec(token);
+  const [, sign = '', rest] = op;
+  const parts = partial(rest);
+  const full = pad(parts);
+  const next = above(parts);
+  switch (sign) {
+    case '':
+    case '=':
+      if (parts.length === 3) return [full, true, full, true];
+      return [parts.length ? full : null, true, next, false];
+    case '>=':
+      return [parts.length ? full : null, true, null, false];
+    case '>':
+      if (!parts.length) throw new Unsupported(`range ${token}`);
+      return parts.length === 3 ? [full, false, null, false] : [next, true, null, false];
+    case '<':
+      if (!parts.length) throw new Unsupported(`range ${token}`);
+      return [null, true, full, false];
+    case '<=':
+      if (!parts.length) return [null, true, null, false];
+      return parts.length === 3 ? [null, true, full, true] : [null, true, next, false];
+    case '~':
+      if (!parts.length) return [null, true, null, false];
+      return [full, true, parts.length === 1 ? [parts[0] + 1, 0, 0] : [parts[0], parts[1] + 1, 0], false];
+    case '^': {
+      if (!parts.length) return [null, true, null, false];
+      const [a, b, c] = full;
+      if (a > 0 || parts.length === 1) return [full, true, [a + 1, 0, 0], false];
+      if (b > 0 || parts.length === 2) return [full, true, [0, b + 1, 0], false];
+      return [full, true, [0, 0, c + 1], false];
+    }
+  }
+  throw new Unsupported(`range ${token}`);
+}
+
+function within(v, [low, lowIn, high, highIn]) {
+  if (low && (lowIn ? compare(v, low) < 0 : compare(v, low) <= 0)) return false;
+  if (high && (highIn ? compare(v, high) > 0 : compare(v, high) >= 0)) return false;
+  return true;
+}
+
+/** Whether version satisfies range; throws Unsupported for what this does not read. */
+export function satisfies(version, range) {
+  const v = parse(version);
+  return range.split('||').some((set) => {
+    const text = set.trim().replace(/(>=|<=|>|<|=|\^|~)\s+/g, '$1');
+    if (text === '' || text === '*') return true;
+    const hyphen = /^(\S+)\s+-\s+(\S+)$/.exec(text);
+    if (hyphen) {
+      const [from, to] = [partial(hyphen[1]), partial(hyphen[2])];
+      return within(v, [pad(from), true, to.length === 3 ? pad(to) : above(to), to.length === 3]);
+    }
+    return text.split(/\s+/).every((token) => within(v, bounds(token)));
+  });
+}

package/lib/range.test.d.mts

@@ -0,0 +1 @@
+export {};

package/lib/range.test.mjs

@@ -0,0 +1,46 @@
+// Tests for lib/range.mjs (moved from morpheme-appstore's test/unit/range.test.mjs). Run: node --test packages/editor/lib/range.test.mjs
+import assert from 'node:assert/strict';
+import { test } from 'node:test';
+import { satisfies, Unsupported } from './range.mjs';
+
+const cases = [
+  ['1.2.3', '1.2.3', true],
+  ['1.2.4', '1.2.3', false],
+  ['1.9.0', '^1.2.3', true],
+  ['2.0.0', '^1.2.3', false],
+  ['1.2.2', '^1.2.3', false],
+  ['0.2.9', '^0.2.3', true],
+  ['0.3.0', '^0.2.3', false],
+  ['0.0.3', '^0.0.3', true],
+  ['0.0.4', '^0.0.3', false],
+  ['1.2.9', '~1.2.3', true],
+  ['1.3.0', '~1.2.3', false],
+  ['1.9.9', '~1', true],
+  ['19.3.0', '^18.0.0 || ^19.0.0', true],
+  ['17.0.0', '^18.0.0 || ^19.0.0', false],
+  ['7.3.7', '>=7.0.0 <8', true],
+  ['8.0.0', '>=7.0.0 <8', false],
+  ['1.5.0', '1.x', true],
+  ['2.0.0', '1.x', false],
+  ['1.2.7', '1.2', true],
+  ['1.3.0', '1.2', false],
+  ['5.0.0', '*', true],
+  ['5.0.0', '', true],
+  ['2.0.0', '>1', true],
+  ['1.9.9', '>1', false],
+  ['1.2.9', '<=1.2', true],
+  ['1.3.0', '<=1.2', false],
+  ['1.5.0', '1.2.3 - 1.6', true],
+  ['1.7.0', '1.2.3 - 1.6', false],
+  ['2.1.0', '>= 2.0.0', true],
+];
+
+test('satisfies reads the ranges peerDependencies use', () => {
+  for (const [version, range, expected] of cases) assert.equal(satisfies(version, range), expected, `${version} in ${range}`);
+});
+
+test('what it does not read throws Unsupported', () => {
+  assert.throws(() => satisfies('1.0.0-beta.1', '^1.0.0'), Unsupported);
+  assert.throws(() => satisfies('1.0.0', 'latest'), Unsupported);
+  assert.throws(() => satisfies('1.0.0', 'npm:other@1'), Unsupported);
+});

package/lib/side-block.test.mjs

@@ -54,7 +54,7 @@ test('besideInSource reads export const beside = true', () => {
   assert.equal(besideInSource('export const beside = false;'), false);
   assert.equal(besideInSource('// export const beside = true;'), false);
   assert.equal(besideInSource('export const load = 1;'), false);
-}); 
+});
 
 test('sideChoices lists installed blocks with beside, by label', () => {
   const blocks = [

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@morphemecms/cms",
-  "version": "0.3.0",
+  "version": "0.4.0-next-20261104182038",
   "description": "Morpheme CMS: the editor for a site built with Astro, its screens, its blocks and the rules a site gives it. See README.md.",
   "license": "MIT",
   "author": "Lars Adolfsen",
@@ -41,6 +41,9 @@
   "scripts": {
     "build": "node scripts/demo-build.mjs",
     "icons": "node scripts/icon-packs.mjs",
+    "format": "prettier --write .",
+    "format:check": "prettier --check .",
+    "release:version": "changeset version && node scripts/starter.mjs",
     "prepack": "node scripts/types.mjs write",
     "postpack": "node scripts/types.mjs clean"
   },
@@ -117,6 +120,9 @@
     "jsdom": "^29.1.1",
     "motion": "^14.0.0",
     "playwright": "^1.64.1",
+    "prettier": "^3.9.10",
+    "prettier-plugin-astro": "^1.1.2",
+    "prettier-plugin-tailwindcss": "^0.8.1",
     "react": "^19.3.0",
     "react-dom": "^19.3.0",
     "rehype-raw": "^7.0.0",

package/scripts/built-site.mjs

@@ -111,6 +111,19 @@ const STORE_CATALOG = {
   ],
 };
 
+/** What the Worker's GET /api/cms answers (worker/cms-update.js cmsStatus), made up so "Morpheme" (#morpheme) opens with
+ * a new major version and its notes, an undone update, and two problems (no token, no check runs to read). The other
+ * states (up to date, waiting, skipped, needs npm) are covered by src/cmsView.test.mjs. */
+const CMS_STATUS = {
+  running: JSON.parse(readFileSync(`${import.meta.dirname}/../package.json`, 'utf8')).version,
+  token: false,
+  kv: true,
+  checked: { at: '2026-11-03T08:00:00.000Z', latest: '99.0.0', problem: { kind: 'major' }, noChecks: true },
+  update: { state: 'undone', to: '0.0.1', at: '2026-11-02T10:30:00.000Z' },
+  skipped: ['0.0.1'],
+  notes: [{ version: '99.0.0', text: 'A made-up note for the checks.\n\nA second paragraph.' }],
+};
+
 /** Opens the editor (/editor/) of the site at `site` in `page`, signed in, with GitHub answered from the files on disk
  * (`texts`: some with other texts), and waits until it has loaded the site. */
 export async function openEditor(page, site, texts = {}) {
@@ -118,6 +131,7 @@ export async function openEditor(page, site, texts = {}) {
   await page.route(`${site}/api/r2?**`, (r) =>
     r.fulfill({ contentType: 'application/json', body: JSON.stringify({ bound: false, bucket: 'ready' }) }),
   );
+  await page.route(`${site}/api/cms`, (r) => r.fulfill({ contentType: 'application/json', body: JSON.stringify(CMS_STATUS) }));
   await page.route(`${site}/api/store/**`, (r) =>
     new URL(r.request().url()).pathname === '/api/store/catalog'
       ? r.fulfill({ contentType: 'application/json', body: JSON.stringify(STORE_CATALOG) })