caracms 0.7.0 → 0.8.1

package/src/editor/client/pane/parts.tsx

@@ -13,7 +13,7 @@
 import type { ReactNode } from 'react';
 import { useEditor, useStore } from '../context.tsx';
 import { Icon } from '../shell/Icons.tsx';
-import { docId } from '../../types.ts';
+import { docId, opensInEditor } from '../../types.ts';
 import { useTooLong } from '../nav/DocRow.tsx';
 import { DocMarksView } from '../live/marks.tsx';
 import { OfflineExtras } from '../live/session.tsx';
@@ -87,6 +87,9 @@ export function GlobalNotes() {
 	return (
 		<>
 			<GitHubAccessNote />
+			<DraftsLostNote />
+			<RolledBackNote />
+			<CommitTroubleNote />
 			<KeepNotes />
 		</>
 	);
@@ -101,10 +104,17 @@ function GitHubAccessNote() {
 	const editor = useEditor();
 	const access = useStore(editor.liveState, (s) => s.status?.githubAccess ?? null);
 	if (editor.mode !== 'live' || !access) return null;
+	// caracms-cloud adversarial review, finding 7: a rename taken in its stride is information, in the plain note.
+	const renamed = access.kind === 'renamed';
 	const expiring = access.kind === 'expiring';
 	return (
-		<div className={`note ${expiring ? 'warn' : 'danger'}`} role={expiring ? 'status' : 'alert'} data-note="github-access" data-kind={access.kind}>
-			<Icon name="warn" />
+		<div
+			className={renamed ? 'note' : `note ${expiring ? 'warn' : 'danger'}`}
+			role={renamed || expiring ? 'status' : 'alert'}
+			data-note="github-access"
+			data-kind={access.kind}
+		>
+			<Icon name={renamed ? 'check' : 'warn'} />
 			<div>
 				<b>{access.title}</b>
 				<p>{withLink(access.message, access.link ?? null)}</p>
@@ -113,6 +123,59 @@ function GitHubAccessNote() {
 	);
 }
 
+/**
+ * caracms-cloud adversarial review, finding 4: edits are kept on the server but its commits
+ * to GitHub keep failing (the bar says so too). Left out while the access note shows a
+ * problem: that one already says what's wrong and who fixes it (finding 7's rename says neither).
+ */
+function CommitTroubleNote() {
+	const editor = useEditor();
+	const trouble = useStore(editor.liveState, (s) => s.status?.commitTrouble ?? null);
+	const access = useStore(editor.liveState, (s) => s.status?.githubAccess ?? null);
+	if (editor.mode !== 'live' || !trouble || (access && access.kind !== 'renamed')) return null;
+	return (
+		<div className="note danger" role="alert" data-note="commit-trouble">
+			<Icon name="warn" />
+			<div>
+				<b>Changes aren't reaching GitHub</b>
+				<p>{trouble.message}</p>
+			</div>
+		</div>
+	);
+}
+
+/** Finding 5: the `drafts` branch went missing and was made again from `main`; the sentence is the server's. */
+function DraftsLostNote() {
+	const editor = useEditor();
+	const lost = useStore(editor.liveState, (s) => s.status?.draftsLost ?? null);
+	if (editor.mode !== 'live' || !lost) return null;
+	return (
+		<div className="note danger" role="alert" data-note="drafts-lost">
+			<Icon name="warn" />
+			<div>
+				<b>{lost.title}</b>
+				<p>{lost.message}</p>
+			</div>
+		</div>
+	);
+}
+
+/** caracms-cloud adversarial review, force-push note: `main` was rolled back past the last Publish; the sentence is the server's. */
+function RolledBackNote() {
+	const editor = useEditor();
+	const rolled = useStore(editor.liveState, (s) => s.status?.mainRolledBack ?? null);
+	if (editor.mode !== 'live' || !rolled) return null;
+	return (
+		<div className="note warn" role="alert" data-note="main-rolled-back">
+			<Icon name="warn" />
+			<div>
+				<b>{rolled.title}</b>
+				<p>{rolled.message}</p>
+			</div>
+		</div>
+	);
+}
+
 /** The sentence as it came, with `link` as a link where it names it (or after it); the words are never changed. */
 function withLink(message: string, link: string | null) {
 	if (!link) return message;
@@ -187,7 +250,7 @@ export function RecentStrip() {
 	const current = useStore(editor.doc.state, (s) => docId(s.ref));
 	const items = recent
 		.map((id) => documents.find((d) => docId(d) === id))
-		.filter((d): d is NonNullable<typeof d> => !!d && !d.warning)
+		.filter((d): d is NonNullable<typeof d> => !!d && opensInEditor(d))
 		.slice(0, 5);
 	return (
 		<div className="side-foot">

package/src/editor/client/pane/switcher.tsx

@@ -14,7 +14,7 @@ import { useEditor, useStore } from '../context.tsx';
 import { Icon } from '../shell/Icons.tsx';
 import { DocRow } from '../nav/DocRow.tsx';
 import { parentLabel, searchDocuments } from '../nav/search.ts';
-import { docId, type ListedDocument } from '../../types.ts';
+import { docId, opensInEditor, type ListedDocument } from '../../types.ts';
 
 export const SWITCHER_READY = true;
 
@@ -51,7 +51,7 @@ export function Switcher() {
 		const out: Section[] = [];
 		const recentDocs = recent
 			.map((id) => documents.find((d) => docId(d) === id))
-			.filter((d): d is ListedDocument => !!d && !d.warning)
+			.filter((d): d is ListedDocument => !!d && opensInEditor(d))
 			.slice(0, 3);
 		if (recentDocs.length) out.push({ key: 'recent', heading: 'Recent', items: recentDocs.map((d) => ({ doc: d, crumb: crumbOf(d) })), more: null });
 		for (const c of editor.site.collections) {
@@ -102,8 +102,8 @@ export function Switcher() {
 			event.preventDefault();
 			const hit = flat[activeIndex];
 			if (!hit) return;
-			if (hit.doc.warning) {
-				editor.announce(`${hit.doc.label} can't be opened. ${hit.doc.warning.message}`);
+			if (!opensInEditor(hit.doc)) {
+				editor.announce(`${hit.doc.label} can't be opened. ${hit.doc.warning?.message ?? ''}`);
 				return;
 			}
 			editor.setPop(null);

package/src/editor/client/shell/Bar.tsx

@@ -132,6 +132,8 @@ function Keep() {
 	const error = useStore(editor.keep, (k) => k.error);
 	const unsent = useStore(editor.keep, (k) => k.unsent ?? 0);
 	const signedOut = useStore(editor.liveState, (s) => !!s.signedOut);
+	// caracms-cloud adversarial review, finding 4: the server has the edits, but its commits to GitHub keep failing.
+	const trouble = useStore(editor.liveState, (s) => s.status?.commitTrouble ?? null);
 	if (state === 'signedout' || (signedOut && state !== 'offline')) {
 		return (
 			<span className="keep loud" role="status" data-keep="signedout">
@@ -174,6 +176,15 @@ function Keep() {
 			</span>
 		);
 	}
+	if (trouble && editor.mode === 'live') {
+		// Not Kept: kept in Redis, but not reaching GitHub. The pane's note says who can fix it.
+		return (
+			<span className="keep loud" role="status" data-keep="not-reaching" title={trouble.message}>
+				<Icon name="warn" size="sm" />
+				Saved here, not reaching GitHub
+			</span>
+		);
+	}
 	return (
 		<span className="keep" data-keep="kept">
 			<Icon name="check" size="sm" />

package/src/editor/client/state/keeper.ts

@@ -49,7 +49,12 @@
  *      **Another editor changed it since, or the server can't tell who did (`known:
  *      false`): not re-sent**, held as a `conflict` until Use mine (`useMine`) or
  *      Discard mine (`discard`).
- * Versions are compared for equality, never as times, so no clock is involved.
+ *   Discard changes: when the server says someone put the document back to what's live
+ *   (`lastChange.discarded`), edits stored from before then (`at`, when they were last changed)
+ *   are dropped, not re-sent, so a discard doesn't come undone from a browser that missed it.
+ *   A write the server refuses as `discarded` (this tab had the document when it was put back)
+ *   is dropped the same way, and `onDiscarded` tells the editor to read it again.
+ * Versions are compared for equality, never as times; only the discard rule compares a time.
  */
 import { documentKind, normaliseAnyDocument, type AnyDocument } from '../../../document.ts';
 import { applyDocumentEdits } from '../../../serialize.ts';
@@ -106,6 +111,8 @@ export interface StoredUnsent {
 	document: AnyDocument;
 	/** The version of the file these edits were made against (see above). */
 	fileVersion: string;
+	/** ms since the epoch: the newest change in them (the discard rule). Absent in copies stored before it was added. */
+	at?: number;
 }
 
 /** The parts of Storage the keeper uses (localStorage, or a fake in tests). */
@@ -162,6 +169,8 @@ export interface KeeperOptions {
 	keepCap?: number;
 	/** A write for this file was Kept (the server has it, and the write took or kept the lock). */
 	onKept?: (file: string) => void;
+	/** A write got 409 `discarded`: someone put the document back to what's live; this tab's edits in it are dropped. */
+	onDiscarded?: (file: string, body: { error?: string; by?: Person; at?: string }) => void;
 }
 
 /** A held record the editor may need to look at again: once the lock lapses, or the session is back. */
@@ -307,7 +316,7 @@ export function holdsEdits(text: string, stored: Pick<StoredUnsent, 'base' | 'do
  * `{ conflict: by }` (another editor changed the document since, Decision 11).
  */
 export function verdict(
-	stored: Pick<StoredUnsent, 'base' | 'document' | 'fileVersion'>,
+	stored: Pick<StoredUnsent, 'base' | 'document' | 'fileVersion' | 'at'>,
 	file: FileNow,
 	site: KeeperSite,
 	you: Person | null,
@@ -315,6 +324,9 @@ export function verdict(
 	if (stored.fileVersion === file.version) return 'send'; // nothing has written it since
 	if (holdsEdits(file.text, stored, site)) return 'drop';
 	const last = file.lastChange;
+	// Discard changes: edits from before someone put it back to what's live are what was discarded.
+	const discarded = last?.discarded;
+	if (discarded && !(typeof stored.at === 'number' && stored.at > Date.parse(discarded.at))) return 'drop';
 	if (!last) return 'send'; // local mode (M3): the last write wins
 	if (last.known === false) return { conflict: null }; // the server can't tell who changed it: never re-sent over unknown work
 	if (!last.by) return 'send'; // only merges from main are known
@@ -421,7 +433,7 @@ export function createKeeper(options: KeeperOptions): Keeper {
 		return r;
 	};
 	const stash = (r: Record) => {
-		if (r.document) storage.set(r.id, { v: 1, file: r.file, base: r.base, document: r.document, fileVersion: r.fileVersion });
+		if (r.document) storage.set(r.id, { v: 1, file: r.file, base: r.base, document: r.document, fileVersion: r.fileVersion, ...(r.lastChange ? { at: r.lastChange } : {}) });
 	};
 	/** Decision 10 (live): ms until the change waiting goes, once the document is held: the delay after the last change, capped from the first unsent one. */
 	const due = (r: Record) => {
@@ -523,6 +535,16 @@ export function createKeeper(options: KeeperOptions): Keeper {
 					r.by = refusal.lastChange?.by ?? refusal.lock?.person ?? null;
 					log(`${r.file} is locked: ${message}`);
 					options.onLocked?.(r.file, refusal);
+				} else if (options.tab && error.status === 409 && code === 'discarded') {
+					// Someone put the document back to what's live while this tab had it: these edits were discarded.
+					r.written = r.revision;
+					r.document = null;
+					r.failure = null;
+					r.refusal = null;
+					r.by = null;
+					storage.remove(r.id);
+					log(`${r.file}: ${message}`);
+					options.onDiscarded?.(r.file, error.body as { error?: string; by?: Person; at?: string });
 				} else {
 					r.failure = 'refused';
 					r.refusal = message;
@@ -562,6 +584,8 @@ export function createKeeper(options: KeeperOptions): Keeper {
 		r.document = stored.document;
 		r.fileVersion = stored.fileVersion;
 		r.revision += 1;
+		// The discard rule reads when they were made, not when they were adopted.
+		if (typeof stored.at === 'number') r.lastChange = stored.at;
 		return r;
 	}
 
@@ -727,7 +751,7 @@ export function createKeeper(options: KeeperOptions): Keeper {
 		recheck(id, file) {
 			const r = records.get(id);
 			if (!r || !dirty(r) || !r.document) return null;
-			const v = verdict({ base: r.base, document: r.document, fileVersion: r.fileVersion }, file, options.site, options.you?.() ?? null);
+			const v = verdict({ base: r.base, document: r.document, fileVersion: r.fileVersion, at: r.lastChange || undefined }, file, options.site, options.you?.() ?? null);
 			if (v === 'drop') {
 				r.written = r.revision;
 				r.failure = null;

package/src/editor/client/state/live.ts

@@ -18,7 +18,7 @@
  * - **Signed out**: any 401 (`SignedOutError`) sets `signedOut`; the next poll that
  *   answers 200 clears it (signing in from another tab brings the session back).
  */
-import { ENDPOINTS, TAB_HEADER, type HistoryResponse, type LiveProps, type LockRefusal, type LockResponse, type PublishResponse, type SignedOutError, type StatusResponse, type TryAgainResponse } from '../../types.ts';
+import { ENDPOINTS, TAB_HEADER, type DiscardRefusal, type DiscardResponse, type HistoryResponse, type LiveProps, type LockRefusal, type LockResponse, type PublishResponse, type SignedOutError, type StatusResponse, type TryAgainResponse } from '../../types.ts';
 import { createStore, type Store } from './store.ts';
 
 /**
@@ -65,6 +65,10 @@ export interface LiveSession {
 	take(file: string): Promise<{ ok: true; lock: LockResponse } | { ok: false; refusal: LockRefusal | null }>;
 	/** Take over: move anyone's lock on the document to this tab (their autosave is committed first). */
 	takeOver(file: string): Promise<{ ok: true; lock: LockResponse } | { ok: false }>;
+	/** Discard changes: put one waiting document back to what's live. A refusal carries the server's sentence. */
+	discard(file: string): Promise<{ ok: true; body: DiscardResponse } | { ok: false; error: string; code: DiscardRefusal['code'] | null }>;
+	/** This tab has let go of its copy of a document someone discarded (`open.discarded`). */
+	discardSeen(file: string): Promise<void>;
 	/** Someone typed, clicked or scrolled in this tab: each poll says how long ago (the lock's idle rule). */
 	active(): void;
 	signOut(): Promise<string>;
@@ -269,6 +273,19 @@ export function createLiveSession(options: LiveOptions): LiveSession {
 			state.set((s) => (s.status ? { ...s, status: { ...s.status, notices: s.status.notices.filter((n) => n.id !== id) } } : s));
 			await call(ENDPOINTS.notice, { method: 'POST', body: { id } });
 		},
+		async discard(file) {
+			const answer = await call<DiscardResponse | DiscardRefusal>(ENDPOINTS.discard, { method: 'POST', body: { file } });
+			void poll();
+			if (!answer) return { ok: false, error: "The server can't be reached. Nothing was discarded; try again in a moment.", code: null };
+			if (answer.status !== 200) {
+				const said = answer.body as DiscardRefusal;
+				return { ok: false, error: typeof said?.error === 'string' && said.error ? said.error : `The server said no (${answer.status}).`, code: said?.code ?? null };
+			}
+			return { ok: true, body: answer.body as DiscardResponse };
+		},
+		async discardSeen(file) {
+			await call(ENDPOINTS.discard, { method: 'POST', body: { file, seen: true } });
+		},
 		active() {
 			used();
 		},

package/src/editor/routes/_live.ts

@@ -10,7 +10,7 @@ import type { LiveEditor } from '../../live/editor.ts';
 import { personOf } from '../../live/locals.ts';
 import { liveEditorOf } from '../server/mode.ts';
 
-type Name = 'status' | 'lock' | 'publish' | 'history' | 'tryAgain' | 'notice';
+type Name = 'status' | 'lock' | 'publish' | 'history' | 'tryAgain' | 'notice' | 'discard';
 
 export const liveRoute =
 	(name: Name): APIRoute =>

package/src/editor/routes/admin.astro

@@ -20,7 +20,9 @@ import geistMono from '../fonts/geist-mono-latin-wght-normal.woff2?url';
 import instrumentSans from '../fonts/instrument-sans-latin-wght-normal.woff2?url';
 import { site } from 'virtual:caracms/config';
 import { monogramIcon } from '../brand.ts';
+import tokensCss from '../styles/tokens.css?raw';
 import { adminProps } from '../server/admin-props.ts';
+import { emptySitePage } from '../server/empty-site.ts';
 import { personOf } from '../../live/locals.ts';
 import { editorMode, editorStore } from '../server/mode.ts';
 import { renderEditor } from '../server/render.tsx';
@@ -39,6 +41,13 @@ if (editorMode().kind === 'live' && !personOf(Astro.locals)) {
 }
 
 const result = await adminProps({ site, store: await editorStore(site), url: Astro.url, cookie: (name) => Astro.cookies.get(name)?.value, person: personOf(Astro.locals) });
+if (!result.ok && result.empty) {
+	// Editor wording note (caracms-cloud adversarial review): a new site's /admin says what's missing and what to do.
+	return new Response(emptySitePage(result.empty, tokensCss), {
+		status: result.status,
+		headers: { 'Content-Type': 'text/html; charset=utf-8', 'Cache-Control': 'no-store' },
+	});
+}
 if (!result.ok) {
 	const escape = (s: string) => s.replace(/[&<>"]/g, (c) => ({ '&': '&amp;', '<': '&lt;', '>': '&gt;', '"': '&quot;' })[c]!);
 	return new Response(

package/src/editor/routes/discard.ts

@@ -0,0 +1,11 @@
+/**
+ * POST /_caracms/discard { file }: Discard changes, one waiting document back to what's live;
+ * { file, seen: true }: this tab has let go of its copy of a document someone discarded.
+ * Live mode only (local mode has no waiting list or published state to go back to); the
+ * handler is ../../live/editor.ts → `discard`. Shapes: ../types.ts → DiscardRequest.
+ */
+import { liveRoute } from './_live.ts';
+
+export const prerender = false;
+
+export const ALL = liveRoute('discard');

package/src/editor/server/admin-props.ts

@@ -72,7 +72,16 @@ export function editorSite(site: ResolvedSite, documents: readonly ListedDocumen
 	};
 }
 
-export type AdminPropsResult = { ok: true; props: AdminProps } | { ok: false; status: number; message: string };
+/**
+ * Editor wording note (caracms-cloud adversarial review): `/admin` on a site with no page to
+ * open yet (a new site, right after `init`): the file Home would be, site-relative, for the
+ * empty state (empty-site.ts) instead of a bare "no document" line.
+ */
+export interface EmptySite {
+	file: string;
+}
+
+export type AdminPropsResult = { ok: true; props: AdminProps } | { ok: false; status: number; message: string; empty?: EmptySite };
 
 export async function adminProps(input: {
 	site: ResolvedSite;
@@ -106,7 +115,14 @@ export async function adminProps(input: {
 		const inboxFirst = inbox && submissions.unread !== null ? await inboxFirstPaint(site, url, inbox.id, input.person ?? null) : null;
 		return { ok: true, props: { site: editor, documents, opened, ui, unsent, live, media: mediaSetup(), inbox, ...(arrange ? { arrange } : {}), submissions, forms: formsOf(site), inboxFirst } };
 	} catch (error) {
-		if (error instanceof DocumentError) return { ok: false, status: error.code === 'not-found' ? 404 : 400, message: error.message };
+		if (error instanceof DocumentError) {
+			// No page to open at all (homeOf found none): the empty state, at the editor's own address only.
+			const bare = url.pathname.replace(/\/+$/, '') === '/admin';
+			const home = editor.home;
+			const nothing = error.code === 'not-found' && bare && ref.collection === home.collection && ref.path === home.path && !documents.some((d) => d.kind === 'sections' && !d.warning);
+			const empty = nothing ? { file: `${relative(site.root, site.collections[home.collection]!.dir).split('\\').join('/')}/${home.path}.json` } : undefined;
+			return { ok: false, status: error.code === 'not-found' ? 404 : 400, message: error.message, ...(empty ? { empty } : {}) };
+		}
 		throw error;
 	}
 }

package/src/editor/server/arrange.ts

@@ -25,6 +25,7 @@ import type { ArrangeRequest, ArrangeResponse } from '../types.ts';
 import { refused } from './create.ts';
 import { movesUnder, type PathMove } from './move.ts';
 import { checkOrigin, seqOf, tabOf, WriteRefused, type WriteContext } from './write.ts';
+import { readCappedText } from '../../body.ts';
 
 type Site = Pick<ResolvedSite, 'root' | 'collections' | 'blocks'>;
 
@@ -225,10 +226,9 @@ export async function handleArrange(request: Request, store: Arranges, who: { pe
 		checkOrigin(request);
 		const type = request.headers.get('content-type') ?? '';
 		if (!/^application\/json\s*(;|$)/i.test(type)) throw new WriteRefused(415, 'Send JSON (Content-Type: application/json).');
-		const length = Number(request.headers.get('content-length') ?? 0);
-		if (length > MAX_ARRANGE_BODY_BYTES) throw new WriteRefused(413, 'That body is too large.');
-		const raw = await request.text();
-		if (Buffer.byteLength(raw) > MAX_ARRANGE_BODY_BYTES) throw new WriteRefused(413, 'That body is too large.');
+		// caracms-cloud adversarial review, finding 10: counted as it's read, so a chunked body stops at the cap too.
+		const raw = await readCappedText(request, MAX_ARRANGE_BODY_BYTES);
+		if (raw === null) throw new WriteRefused(413, 'That body is too large.');
 		let body: unknown;
 		try {
 			body = JSON.parse(raw);

package/src/editor/server/create.ts

@@ -54,6 +54,7 @@ import { addressProblem, INDEX_MESSAGE, isSlug, NO_ADDRESS_MESSAGE, RESERVED_SLU
 import { RELEASE_HEADER, type CreateDeleteCode, type CreateRequest, type CreateResponse, type DeleteRequest, type DeleteResponse } from '../types.ts';
 import { checkOrigin, confineDocumentFile, confinePath, seqOf, tabOf, WriteRefused, type WriteContext } from './write.ts';
 import { schemaRef, stampSchema } from '../../schema-key.ts';
+import { readCappedText } from '../../body.ts';
 
 type Site = Pick<ResolvedSite, 'root' | 'collections' | 'blocks' | 'codeRoutes'>;
 
@@ -395,10 +396,9 @@ async function handle(request: Request, who: { person?: Person | null }, run: (b
 		checkOrigin(request);
 		const type = request.headers.get('content-type') ?? '';
 		if (!/^application\/json\s*(;|$)/i.test(type)) throw new WriteRefused(415, 'Send JSON (Content-Type: application/json).');
-		const length = Number(request.headers.get('content-length') ?? 0);
-		if (length > MAX_CREATE_BODY_BYTES) throw new WriteRefused(413, 'That body is too large.');
-		const raw = await request.text();
-		if (Buffer.byteLength(raw) > MAX_CREATE_BODY_BYTES) throw new WriteRefused(413, 'That body is too large.');
+		// caracms-cloud adversarial review, finding 10: counted as it's read, so a chunked body stops at the cap too.
+		const raw = await readCappedText(request, MAX_CREATE_BODY_BYTES);
+		if (raw === null) throw new WriteRefused(413, 'That body is too large.');
 		let body: unknown;
 		try {
 			body = JSON.parse(raw);

package/src/editor/server/drafts-store.ts

@@ -26,7 +26,7 @@ export interface DraftsStore {
 	 * each with its public URL and its kind; a shared block with its `usedOn`.
 	 */
 	list(): Promise<ListedDocument[]>;
-	/** One document, of any kind (M5a). Throws content.ts's DocumentError ('not-found', 'bad-path', a warning code…). */
+	/** One document, of any kind (M5a). Throws content.ts's DocumentError ('not-found', 'bad-path', a warning code…); one with no title opens (caracms-cloud adversarial review, finding 15). */
 	read(collection: string, path: string): Promise<AnyOpenedDocument>;
 	/**
 	 * The store's content as a content.ts source (M5a Decision 9): what a preview's
@@ -107,7 +107,7 @@ export function localDraftsStore(site: Site): DraftsStore {
 			);
 		},
 		async read(collection, path) {
-			const read = await readDocument(site, collection, path);
+			const read = await readDocument(site, collection, path, diskSource, { untitled: true });
 			const { mtimeMs } = await stat(join(site.root, read.entry.file));
 			return { ...read, mtimeMs, version: fileVersion(read.text) };
 		},

package/src/editor/server/empty-site.ts

@@ -0,0 +1,23 @@
+/**
+ * `/admin` on a site with no page yet (caracms-cloud adversarial review, editor wording note):
+ * right after `caracms init`, before any page is in `content/`, the editor has nothing to
+ * open. Instead of a bare "no document" line whose link went back to `/admin` itself, a page
+ * that says what's missing and what to do next, linking to the README's Start section.
+ * `init` doesn't write pages (the `caracms-adopt` skill brings them in), so it isn't offered
+ * as the way to make one. Styled like the sign-in pages' narrow note (`.nw`, on the
+ * editor's tokens), with no script.
+ */
+import { html, LOGIN_CSS } from '../../live/auth/views.ts';
+import type { EmptySite } from './admin-props.ts';
+
+/** The package README's getting-started section, on npm. */
+export const START_URL = 'https://www.npmjs.com/package/caracms#start';
+
+const EMPTY_CSS = `.nw code{font-family:var(--font-mono);font-size:var(--text-sm);padding:1px 5px;border-radius:var(--radius-sm);background:var(--surface);border:1px solid var(--border);color:var(--text);overflow-wrap:anywhere}
+.nw a{color:var(--select-strong);font-weight:var(--weight-medium)}`;
+
+/** The whole page. `tokensCss`: the editor's tokens (styles/tokens.css), as text. */
+export function emptySitePage(empty: EmptySite, tokensCss: string): string {
+	const body = html`<main class="nw" data-empty-site=""><div class="nw-in"><h1>This site has no pages yet</h1><p>The editor opens on the home page, and there isn't one. Add <code>${empty.file}</code> (a title and no blocks is enough: <code>{ "title": "Home", "blocks": [] }</code>), then reload this page.</p><p>To bring a page the site already has into the editor, ask your coding agent to use the <code>caracms-adopt</code> skill.</p><p class="fine"><a href="${START_URL}">Getting started with caracms</a></p></div></main>`;
+	return `<!doctype html><html lang="en"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width, initial-scale=1"><meta name="robots" content="noindex"><title>No pages yet</title><style>${tokensCss}${LOGIN_CSS}${EMPTY_CSS}</style></head><body>${body}</body></html>`;
+}

package/src/editor/server/media/cloud-mux.ts

@@ -11,7 +11,9 @@
  *
  * **The cloud's refusals become `MuxRouteError`s**, so the media handler's own catch answers
  * them: `not_found` is the routes' documented 404 ('Not found.'); `video_limit` is a 403
- * with the cloud's sentence as sent; any other refusal (`video_unavailable`, the key's own
+ * with the cloud's sentence as sent; `uploads_in_flight` (the site already has two clips
+ * uploading) is a 429 with the cloud's sentence as sent, not logged: it's the cloud asking
+ * the person to wait, not a failure; any other refusal (`video_unavailable`, the key's own
  * refusals…) is a 502 with the cloud's sentence as sent. A cloud that can't be reached, or
  * an answer that isn't the shape, is a 502 with the package's own sentence. Each 502 is
  * logged with the refusal's code. The key is never logged nor put in an error.
@@ -42,6 +44,7 @@ export function cloudMux(
 			if (!isCloudRefusal(error)) throw error;
 			if (error.error === 'not_found') throw new MuxRouteError(404, 'Not found.');
 			if (error.error === 'video_limit') throw new MuxRouteError(403, error.message);
+			if (error.error === 'uploads_in_flight') throw new MuxRouteError(429, error.message);
 			log(`[caracms] video ${where}: CaraCMS Cloud (${error.error}): ${error.message}`);
 			throw new MuxRouteError(502, error.error === 'unreachable' ? CLOUD_VIDEO_UNREACHABLE : error.message);
 		}

package/src/editor/server/media/config.ts

@@ -16,9 +16,12 @@
  * - **And the clips' (caracms-cloud M4.5 Decision 15)**: with the key, clips go through the
  *   cloud's Mux (cloud-mux.ts), and the site's own `MUX_TOKEN_ID` / `MUX_TOKEN_SECRET`
  *   beside it is a problem sentence naming them (one credential, not two).
+ * - **With the config's `services`** (caracms-cloud M5 Decision 2) the other mode's variables
+ *   are never read (live/services.ts), and a cloud site without its key has neither.
  */
 import type { CloudConnection } from '../../../live/cloud.ts';
 import { CLOUD_AND_MUX_PROBLEM, OWN_MUX_VARIABLES, readCloudUrl } from '../../../live/mode.ts';
+import { bakedServices, CLOUD_KEY_MISSING_PROBLEM, servicesEnv, type Services } from '../../../live/services.ts';
 import { cloudMedia, isProductionBuild, readMediaConfig, type MediaSettings } from '../../../media.ts';
 
 type Env = Record<string, string | undefined>;
@@ -53,15 +56,17 @@ const get = (env: Env, name: string) => {
 const memory = (env: Env) => get(env, 'CARACMS_MEDIA') === 'memory';
 
 /** The image routes' settings: the bucket, and imgproxy's for the thumbnails. */
-export function readImagesConfig(env: Env = process.env, production = isProductionBuild()): ImagesConfig {
+export function readImagesConfig(env: Env = process.env, production = isProductionBuild(), services: Services | null = bakedServices()): ImagesConfig {
+	env = servicesEnv(env, services);
 	if (memory(env)) {
 		if (production) return { kind: 'unset', message: MEMORY_IN_PRODUCTION, missing: [] };
-		const signing = readMediaConfig(env, production);
+		const signing = readMediaConfig(env, production, services);
 		if (signing.kind !== 'ready') return { kind: 'unset', message: MEMORY_IN_PRODUCTION, missing: [] };
 		return { kind: 'memory', signing: signing.settings };
 	}
-	const signing = readMediaConfig(env, production);
-	const cloud = cloudMedia(env);
+	if (services === 'cloud' && !get(env, 'CARACMS_CLOUD_KEY')) return { kind: 'unset', message: CLOUD_KEY_MISSING_PROBLEM, missing: [] };
+	const signing = readMediaConfig(env, production, services);
+	const cloud = cloudMedia(env, services);
 	if (cloud) {
 		if (signing.kind === 'ready') return { kind: 'cloud', signing: signing.settings, connection: cloud.connection };
 		return { kind: 'unset', message: signing.problems.join(' '), missing: [] };
@@ -86,9 +91,11 @@ export function readImagesConfig(env: Env = process.env, production = isProducti
 }
 
 /** The clip routes' settings: the cloud's Mux (the site key), or the site's Mux environment's token. */
-export function readMuxConfig(env: Env = process.env, production = isProductionBuild()): MuxConfig {
+export function readMuxConfig(env: Env = process.env, production = isProductionBuild(), services: Services | null = bakedServices()): MuxConfig {
+	env = servicesEnv(env, services);
 	if (memory(env)) return production ? { kind: 'unset', message: MEMORY_IN_PRODUCTION, missing: [] } : { kind: 'memory' };
 	const key = get(env, 'CARACMS_CLOUD_KEY');
+	if (services === 'cloud' && !key) return { kind: 'unset', message: CLOUD_KEY_MISSING_PROBLEM, missing: [] };
 	if (key) {
 		const problems: string[] = [];
 		const both = OWN_MUX_VARIABLES.filter((name) => get(env, name));

package/src/editor/server/media/upload.ts

@@ -25,47 +25,8 @@ import { MEDIA_MAX_BYTES, MEDIA_MAX_PIXELS, MEDIA_NAME_HEADER, type MediaRefusal
 import type { Bucket, ObjectMeta } from './bucket.ts';
 import { countsPixels, sniffUpload } from './sniff.ts';
 
-/** How many bytes are read before deciding (the cap, plus one to know it was passed). */
-export interface CappedBody {
-	ok: true;
-	bytes: Uint8Array;
-}
-export interface OverCap {
-	ok: false;
-	/** The size, when the request said it (Content-Length); null when the read was stopped without knowing. */
-	size: number | null;
-}
-
-/** Read a request's body, stopping as soon as it passes `cap` bytes. */
-export async function readCapped(request: Request, cap: number): Promise<CappedBody | OverCap> {
-	const declared = Number(request.headers.get('content-length') ?? NaN);
-	const said = Number.isFinite(declared) && declared >= 0 ? declared : null;
-	if (said !== null && said > cap) {
-		await request.body?.cancel().catch(() => {});
-		return { ok: false, size: said };
-	}
-	const reader = request.body?.getReader();
-	if (!reader) return { ok: true, bytes: new Uint8Array(0) };
-	const chunks: Uint8Array[] = [];
-	let total = 0;
-	for (;;) {
-		const { done, value } = await reader.read();
-		if (done) break;
-		total += value.byteLength;
-		if (total > cap) {
-			await reader.cancel().catch(() => {});
-			return { ok: false, size: said !== null && said > total ? said : null };
-		}
-		chunks.push(value);
-	}
-	const bytes = new Uint8Array(total);
-	let at = 0;
-	for (const c of chunks) {
-		bytes.set(c, at);
-		at += c.byteLength;
-	}
-	return { ok: true, bytes };
-}
+// The capped read moved to body.ts (caracms-cloud adversarial review, finding 10), for every route that takes a body.
+export { readCapped, type CappedBody, type OverCap } from '../../../body.ts';
 
 /** "52", or "40.3" when rounding would land on the cap itself (so it never reads as allowed). */
 function amount(value: number, cap: number): string {

package/src/editor/server/mode.ts

@@ -15,6 +15,7 @@
 import type { ResolvedSite } from '../../config.ts';
 import { liveEditor, type LiveEditor } from '../../live/editor.ts';
 import { readMode, unconfiguredMessage, type Baked, type Mode } from '../../live/mode.ts';
+import { bakedServices } from '../../live/services.ts';
 import { localDraftsStore, type DraftsStore } from './drafts-store.ts';
 
 declare const __CARACMS_PRODUCTION__: boolean | undefined;
@@ -26,11 +27,12 @@ export function isProductionServer(): boolean {
 	return typeof __CARACMS_PRODUCTION__ === 'boolean' ? __CARACMS_PRODUCTION__ : false;
 }
 
-/** The site's address and the commit the build baked in (runs-anywhere Decisions 7 and 9); empty in plain Node (tests). */
+/** The site's address, the commit and the config's `services` the build baked in (runs-anywhere Decisions 7 and 9, caracms-cloud M5 Decision 1); empty in plain Node (tests). */
 export function bakedAtBuild(): Baked {
 	return {
 		site: typeof __CARACMS_SITE__ === 'string' ? __CARACMS_SITE__ : null,
 		commit: typeof __CARACMS_BUILD_COMMIT__ === 'string' ? __CARACMS_BUILD_COMMIT__ : null,
+		services: bakedServices(),
 	};
 }