kempo 4.8.0 → 4.9.1

package/server/utils/updates/fetchManifest.js

@@ -0,0 +1,26 @@
+import { DEFAULT_REGISTRY, PACKAGE, isVersion } from './helpers.js';
+import { NAME_PATTERN } from '../extensions/marketplaceClient.js';
+
+/*
+  Reads one version's manifest of a package (kempo by default, or an extension) from the npm registry, "latest" by default.
+  Resolves to [error, { name, version, peerDependencies }].
+*/
+export default async ({ name = PACKAGE, version = 'latest', registry = process.env.KEMPO_NPM_REGISTRY || DEFAULT_REGISTRY, fetcher = fetch } = {}) => {
+  if(typeof name !== 'string' || !NAME_PATTERN.test(name)){
+    return [{ code: 400, msg: 'Package name is not valid' }, null];
+  }
+  if(version !== 'latest' && !isVersion(version)){
+    return [{ code: 400, msg: 'Version is not valid' }, null];
+  }
+
+  try {
+    const res = await fetcher(`${registry.replace(/\/+$/, '')}/${name.replace('/', '%2F')}/${version}`, { headers: { accept: 'application/json' }, signal: AbortSignal.timeout(10000) });
+    if(res.status === 404) return [{ code: 404, msg: `${name}${version === 'latest' ? '' : ` ${version}`} was not found on npm` }, null];
+    if(!res.ok) return [{ code: 502, msg: `npm answered ${res.status}` }, null];
+    const manifest = await res.json();
+    if(!isVersion(manifest?.version)) return [{ code: 502, msg: 'npm did not return a usable version' }, null];
+    return [null, { name, version: manifest.version, peerDependencies: manifest.peerDependencies ?? {} }];
+  } catch {
+    return [{ code: 502, msg: 'npm could not be reached' }, null];
+  }
+};

package/server/utils/updates/getExtensionUpdates.js

@@ -0,0 +1,70 @@
+import { join } from 'path';
+import db from '../../db/index.js';
+import { extension } from '../../db/schema.js';
+import { compareVersions, isBreakingBump, isVersion, lowerBound } from './helpers.js';
+import fetchManifest from './fetchManifest.js';
+import readKempoConfig from '../extensions/readKempoConfig.js';
+
+/* The last answer npm gave for the installed extensions, kept for the process like the one for kempo itself. */
+let known = null;
+let checkError = null;
+
+export const resetExtensionUpdates = () => {
+  known = null;
+  checkError = null;
+};
+
+const CONCURRENCY = 4;
+
+const installedVersionOf = async (root, row) => {
+  try {
+    return (await readKempoConfig(join(root, 'node_modules', row.name))).pkg.version;
+  } catch {
+    return null;
+  }
+};
+
+/*
+  Asks npm for the newest version of every installed extension, four at a time, and lists those that are newer than what is
+  on disk: [{ name, installedVersion, latestVersion, major, kempoRequired }]. `kempoRequired` is the lowest kempo the new
+  version asks for, which can be newer than the one running (then it can only be updated together with kempo).
+  An extension that is not on npm (a git-only one) or whose answer was an error is left out; if every answer was an
+  error, `checkError` says npm could not be reached. Asks when `force` is set or the last answer is older than `maxAgeMs`;
+  `offline` never asks.
+*/
+export default async ({ force = false, offline = false, maxAgeMs = 3600000, fetcher, executor = db, root = process.cwd() } = {}) => {
+  if(!offline && (force || !known || Date.now() - known.checkedAt > maxAgeMs)){
+    const rows = await executor.select().from(extension);
+    const updates = [];
+    let failures = 0;
+    let next = 0;
+
+    const work = async () => {
+      while(next < rows.length){
+        const row = rows[next++];
+        const installedVersion = await installedVersionOf(root, row);
+        if(!isVersion(installedVersion)) continue;
+        const [error, manifest] = await fetchManifest({ name: row.name, fetcher });
+        if(error){
+          if(error.code !== 404) failures++;
+          continue;
+        }
+        if(compareVersions(manifest.version, installedVersion) > 0){
+          updates.push({
+            name: row.name,
+            installedVersion,
+            latestVersion: manifest.version,
+            major: isBreakingBump(installedVersion, manifest.version),
+            kempoRequired: manifest.peerDependencies.kempo ? lowerBound(manifest.peerDependencies.kempo) : null
+          });
+        }
+      }
+    };
+    await Promise.all(Array.from({ length: CONCURRENCY }, work));
+
+    checkError = rows.length && failures === rows.length ? 'npm could not be reached' : null;
+    if(!checkError) known = { checkedAt: Date.now(), updates: updates.sort((a, b) => a.name.localeCompare(b.name)) };
+  }
+
+  return [null, { updates: known?.updates ?? [], checkedAt: known ? new Date(known.checkedAt).toISOString() : null, checkError }];
+};

package/server/utils/updates/getInstallInfo.js

@@ -0,0 +1,25 @@
+import { readFileSync } from 'fs';
+import { join, sep } from 'path';
+import { PACKAGE } from './helpers.js';
+import { PACKAGE_ROOT } from './runtime.js';
+
+/*
+  Whether this site can update kempo by installing a new version of it. A checkout that is linked or run
+  from source (this repository, or a site using `npm run link:local`) is refused: `npm install` would
+  replace the link with the registry copy and throw the local work away.
+*/
+export default ({ cwd = process.cwd(), packageRoot = PACKAGE_ROOT } = {}) => {
+  if(!packageRoot.startsWith(join(cwd, 'node_modules') + sep)){
+    return { canUpdate: false, reason: 'Kempo is linked from a local checkout, not installed from npm.' };
+  }
+
+  try {
+    const spec = JSON.parse(readFileSync(join(cwd, 'package.json'), 'utf8')).dependencies?.[PACKAGE];
+    if(!spec) return { canUpdate: false, reason: "Kempo is not a dependency in this site's package.json." };
+    if(/^(file|link|git|github|https?):/.test(spec)) return { canUpdate: false, reason: `This site's package.json points kempo at "${spec}", not at an npm version.` };
+  } catch {
+    return { canUpdate: false, reason: "This site's package.json could not be read." };
+  }
+
+  return { canUpdate: true, reason: null };
+};

package/server/utils/updates/getUpdateStatus.js

@@ -0,0 +1,57 @@
+import { PACKAGE, compareVersions, isBreakingBump } from './helpers.js';
+import { RUNNING_VERSION, BOOT_ID } from './runtime.js';
+import fetchManifest from './fetchManifest.js';
+import getInstallInfo from './getInstallInfo.js';
+import { restartMode } from './restart.js';
+import releaseStatus from './releaseStatus.js';
+import getExtensionUpdates, { resetExtensionUpdates } from './getExtensionUpdates.js';
+import { getReconcileResult } from '../extensions/reconcileExtensions.js';
+import { getSchemaSyncResult } from '../setup/syncCoreSchema.js';
+
+/* The last answer npm gave, kept for the process so that opening the screen does not ask npm every time. */
+let known = null;
+let checkError = null;
+
+export const resetUpdateStatus = () => {
+  resetExtensionUpdates();
+  known = null;
+  checkError = null;
+};
+
+/*
+  Where this site stands: what is running, the newest version on npm and whether it can be installed here.
+  Asks npm when `force` is set or the last answer is older than `maxAgeMs`; a failed ask keeps the last
+  good answer and reports why in `checkError`. `offline` never asks, for a caller that must answer at once.
+*/
+export default async ({ force = false, offline = false, maxAgeMs = 3600000, fetcher, install = getInstallInfo(), executor } = {}) => {
+  if(!offline && (force || !known || Date.now() - known.checkedAt > maxAgeMs)){
+    const [error, manifest] = await fetchManifest({ fetcher });
+    if(error){
+      checkError = error.msg;
+    } else {
+      checkError = null;
+      known = { latestVersion: manifest.version, checkedAt: Date.now() };
+    }
+  }
+
+  const [, extensionUpdates] = await getExtensionUpdates({ force, offline, maxAgeMs, fetcher, ...(executor ? { executor } : {}) });
+  const latestVersion = known?.latestVersion ?? null;
+  const updateAvailable = latestVersion !== null && compareVersions(latestVersion, RUNNING_VERSION) > 0;
+
+  return [null, {
+    runningVersion: RUNNING_VERSION,
+    bootId: BOOT_ID,
+    latestVersion,
+    updateAvailable,
+    major: updateAvailable && isBreakingBump(RUNNING_VERSION, latestVersion),
+    checkedAt: known ? new Date(known.checkedAt).toISOString() : null,
+    checkError,
+    restart: restartMode(),
+    database: getSchemaSyncResult(),
+    extensionUpdates,
+    extensionsRun: getReconcileResult(),
+    ...releaseStatus(),
+    npmUrl: `https://www.npmjs.com/package/${PACKAGE}`,
+    ...install
+  }];
+};

package/server/utils/updates/helpers.js

@@ -0,0 +1,30 @@
+export const PACKAGE = 'kempo';
+
+export const DEFAULT_REGISTRY = 'https://registry.npmjs.org';
+
+/* Only plain releases are ever installed by an update: no tags, ranges or prereleases, so nothing here can reach a shell as anything else. */
+export const isVersion = value => typeof value === 'string' && /^\d+\.\d+\.\d+$/.test(value);
+
+/* -1, 0 or 1 for a compared with b, both plain versions. */
+export const compareVersions = (a, b) => {
+  const left = a.split('.').map(Number);
+  const right = b.split('.').map(Number);
+  for(let i = 0; i < 3; i++){
+    if(left[i] !== right[i]) return left[i] > right[i] ? 1 : -1;
+  }
+  return 0;
+};
+
+/*
+  Whether going from one plain version to a higher one may break what depended on it, by semver: a new major version, and
+  while the major is still 0 a new minor version too (0.1.x to 0.2.0 is the breaking step there, which is what npm's own ^0.1.1
+  assumes). Every extension kempo has is still 0.x, so this is what makes its updates warn.
+*/
+export const isBreakingBump = (from, to) => {
+  const [fromMajor, fromMinor] = from.split('.').map(Number);
+  const [toMajor, toMinor] = to.split('.').map(Number);
+  return fromMajor === 0 ? (toMajor > 0 || toMinor > fromMinor) : toMajor > fromMajor;
+};
+
+/* The version a peer range such as ">=2.2.5" or "^3.4.0" starts at, or null for one that names none ("*"). */
+export const lowerBound = range => String(range).match(/\d+\.\d+\.\d+/)?.[0] ?? null;

package/server/utils/updates/notifySchemaAttention.js

@@ -0,0 +1,35 @@
+import { createHash } from 'crypto';
+import { and, eq } from 'drizzle-orm';
+import db from '../../db/index.js';
+import { notification } from '../../db/schema.js';
+import createNotification from '../notifications/createNotification.js';
+import { getSchemaSyncResult } from '../setup/syncCoreSchema.js';
+import { getReconcileResult } from '../extensions/reconcileExtensions.js';
+import { PACKAGE } from './helpers.js';
+
+/*
+  After the server starts: when syncing kempo's tables left a change that the database refused, or an extension could not be
+  brought up to date, tell everyone who can update kempo, once for each distinct set of problems.
+  Raising the same notification at every start would mark it unread for everyone each time.
+*/
+export default async ({ result = getSchemaSyncResult(), extensions = getReconcileResult() } = {}) => {
+  const problems = [
+    ...result.failed.map(({ change, reason }) => `${change} (${reason})`),
+    ...extensions.failed.map(({ name, to, reason }) => `${name} ${to} could not be brought up to date (${reason})`)
+  ];
+  if(!problems.length) return [null];
+
+  const dedupeKey = `schema:${createHash('sha256').update(problems.join('\n')).digest('hex').slice(0, 16)}`;
+  const [existing] = await db.select({ id: notification.id }).from(notification).where(and(eq(notification.owner, PACKAGE), eq(notification.dedupeKey, dedupeKey))).limit(1);
+  if(existing) return [null];
+
+  return createNotification({
+    owner: PACKAGE,
+    title: 'An update needs attention',
+    message: `Kempo started, but ${problems.length === 1 ? 'one thing was' : `${problems.length} things were`} not applied: ${problems.slice(0, 3).join('; ')}${problems.length > 3 ? '; and more' : ''}.`,
+    level: 'error',
+    permission: 'system:updates:manage',
+    dedupeKey,
+    actions: [{ label: 'View details', href: '/admin/updates' }]
+  });
+};

package/server/utils/updates/npm.js

@@ -0,0 +1,41 @@
+import { execFile } from 'child_process';
+import { readFileSync } from 'fs';
+import { join } from 'path';
+import { promisify } from 'util';
+import { PACKAGE, compareVersions, lowerBound } from './helpers.js';
+import { NAME_PATTERN } from '../extensions/marketplaceClient.js';
+
+const execute = promisify(execFile);
+
+/* `npm install` of already validated targets (plain names and x.y.z or "latest") in `cwd`. */
+export const runNpm = (args, cwd) => execute('npm', ['install', ...args, '--no-audit', '--no-fund'], {
+  cwd,
+  shell: process.platform === 'win32',
+  timeout: 10 * 60 * 1000,
+  maxBuffer: 10 * 1024 * 1024
+});
+
+export const installedVersion = (dir, name) => {
+  try {
+    return JSON.parse(readFileSync(join(dir, 'node_modules', name, 'package.json'), 'utf8')).version;
+  } catch {
+    return null;
+  }
+};
+
+/*
+  What to install for a manifest of kempo: kempo itself, and any peer (kempo-server, kempo-ui, kempo-css) that is installed
+  in `dir` at a version below what the new kempo asks for at least. A peer that already meets it is left alone.
+*/
+export const targetsFor = ({ manifest, dir }) => {
+  const targets = [`${PACKAGE}@${manifest.version}`];
+  for(const [name, range] of Object.entries(manifest.peerDependencies)){
+    const bound = lowerBound(range);
+    const installed = installedVersion(dir, name);
+    if(NAME_PATTERN.test(name) && bound && installed && compareVersions(installed, bound) < 0) targets.push(`${name}@latest`);
+  }
+  return targets;
+};
+
+/* The last lines of what npm said when it failed. */
+export const npmFailure = error => String(error.stderr || error.message || '').trim().split('\n').filter(Boolean).slice(-3).join(' ');

package/server/utils/updates/prepareUpdate.js

@@ -0,0 +1,109 @@
+import { rmSync } from 'fs';
+import { join } from 'path';
+import { compareVersions } from './helpers.js';
+import { PACKAGE_ROOT, RUNNING_VERSION } from './runtime.js';
+import extensionTargets, { extensionPlan } from './extensionTargets.js';
+import fetchManifest from './fetchManifest.js';
+import getInstallInfo from './getInstallInfo.js';
+import { installedVersion, npmFailure, runNpm, targetsFor } from './npm.js';
+import { paths, stage, writeState } from './siteLayout.js';
+import { forcedFiles, planStarterFiles } from './starterFiles.js';
+import { pendingUpgrades } from '../setup/runUpgrades.js';
+
+let preparing = false;
+
+const NO_FILES = { add: [], update: [], current: [], edited: [], deleted: [], forced: [] };
+
+/*
+  What switching to a staged version would change besides the code, worked out from the staged copy: for kempo, the starter
+  files it would replace, add, keep (edited) or need confirmation for, and the data migrations it carries; for each updated
+  extension, what it adds and whether it is breaking. `breaking` is true when anything in it can only be undone from a backup.
+*/
+export const buildPlan = async ({ cwd, oldRoot, newRoot, extensions = [], executor }) => {
+  const files = newRoot ? planStarterFiles({ cwd, oldRoot, newRoot, forced: forcedFiles(newRoot) }) : NO_FILES;
+  const upgrades = newRoot ? await pendingUpgrades({ dir: join(newRoot, 'server', 'db', 'upgrades'), ...(executor ? { executor } : {}) }) : [];
+  return { files, upgrades, extensions, breaking: upgrades.some(upgrade => upgrade.breaking) || extensions.some(extension => extension.breaking) };
+};
+
+/*
+  Installs newer versions of kempo and/or of installed extensions into a staging folder next to the running site, which keeps
+  running from its own files, and works out what switching to them would change. Nothing the site uses is touched, so it
+  can fail, or be abandoned, without a trace. Applying it is applyStagedUpdate. Only for a site that runs from a Docker
+  volume (KEMPO_SITE_ROOT); any other site is updated in place, by applyUpdate.
+
+  `version` is the kempo version, "latest" by default, or null to leave kempo as it is; `extensions` are names. All are
+  installed in one npm run so they are consistent with each other. Resolves to [error, { version, packages, plan }]. `run`,
+  `install`, `oldRoot`, `fetcher` and `executor` are for tests.
+*/
+export default async ({ version = 'latest', extensions = [], siteRoot = process.env.KEMPO_SITE_ROOT, cwd = process.cwd(), oldRoot = PACKAGE_ROOT, install = getInstallInfo({ cwd }), run = runNpm, fetcher, executor } = {}) => {
+  if(!siteRoot){
+    return [{ code: 409, msg: 'This site is not set up to prepare an update ahead of switching to it' }, null];
+  }
+  if(!install.canUpdate){
+    return [{ code: 409, msg: install.reason }, null];
+  }
+  if(version === null && !extensions.length){
+    return [{ code: 400, msg: 'Choose something to update' }, null];
+  }
+  if(preparing){
+    return [{ code: 409, msg: 'An update is already being prepared' }, null];
+  }
+
+  preparing = true;
+  try {
+    let manifest = null;
+    if(version !== null){
+      const [manifestError, found] = await fetchManifest({ version, fetcher });
+      if(manifestError) return [manifestError, null];
+      if(compareVersions(found.version, RUNNING_VERSION) <= 0){
+        return [{ code: 409, msg: `Version ${RUNNING_VERSION} is already running` }, null];
+      }
+      manifest = found;
+    }
+
+    const kempoVersion = manifest?.version ?? RUNNING_VERSION;
+    const [targetsError, wanted] = await extensionTargets({ names: extensions, kempoVersion, root: cwd, fetcher, ...(executor ? { executor } : {}) });
+    if(targetsError) return [targetsError, null];
+
+    let staged;
+    try {
+      staged = stage({ siteRoot, version: kempoVersion });
+    } catch(error) {
+      return [{ code: 500, msg: `Space for the new version could not be made: ${error.message}` }, null];
+    }
+
+    const discard = () => rmSync(paths(siteRoot).staging, { recursive: true, force: true });
+    const targets = [...(manifest ? targetsFor({ manifest, dir: staged.dir }) : []), ...wanted.targets];
+    try {
+      await run(targets, staged.dir);
+    } catch(error) {
+      discard();
+      return [{ code: 500, msg: `The update could not be downloaded: ${npmFailure(error)}` }, null];
+    }
+
+    const missing = [...(manifest ? [{ name: 'kempo', to: manifest.version }] : []), ...wanted.items].find(item => installedVersion(staged.dir, item.name) !== item.to);
+    if(missing){
+      discard();
+      return [{ code: 500, msg: `npm finished but ${missing.name} ${missing.to} is not in the staged copy` }, null];
+    }
+
+    const [planError, extensionEntries] = await extensionPlan({ dir: staged.dir, items: wanted.items, executor });
+    if(planError){
+      discard();
+      return [planError, null];
+    }
+
+    let plan;
+    try {
+      plan = await buildPlan({ cwd, oldRoot, newRoot: manifest ? join(staged.dir, 'node_modules', 'kempo') : null, extensions: extensionEntries, executor });
+    } catch(error) {
+      discard();
+      return [{ code: 500, msg: `What this update would change could not be worked out: ${error.message}` }, null];
+    }
+
+    writeState(siteRoot, 'staged', { id: staged.id, dir: staged.dir, version: kempoVersion, kempoUpdate: Boolean(manifest), from: RUNNING_VERSION, packages: targets, plan, preparedAt: new Date().toISOString() });
+    return [null, { version: kempoVersion, kempoUpdate: Boolean(manifest), packages: targets, plan }];
+  } finally {
+    preparing = false;
+  }
+};

package/server/utils/updates/releaseStatus.js

@@ -0,0 +1,23 @@
+import { existsSync } from 'fs';
+import { join } from 'path';
+import { getCurrent, paths, readState } from './siteLayout.js';
+
+/*
+  The part of the update status that only a site running from a Docker volume has: whether a version is staged and what
+  switching to it would change, whether there is an earlier version to go back to, and how the last switch ended.
+*/
+export default (siteRoot = process.env.KEMPO_SITE_ROOT) => {
+  if(!siteRoot) return { mode: 'in-place' };
+
+  const staged = readState(siteRoot, 'staged');
+  const { previous } = getCurrent(siteRoot);
+  const last = readState(siteRoot, 'last');
+  return {
+    mode: 'release',
+    staged: staged && existsSync(join(staged.dir, 'node_modules')) ? { version: staged.version, kempoUpdate: Boolean(staged.kempoUpdate), packages: staged.packages ?? [], plan: staged.plan, preparedAt: staged.preparedAt } : null,
+    canGoBack: Boolean(previous?.id && existsSync(join(paths(siteRoot).releases, previous.id, 'node_modules'))),
+    previousVersion: previous?.version ?? null,
+    switching: readState(siteRoot, 'switch')?.status ?? null,
+    lastUpdate: last ? { ok: last.ok, from: last.from, to: last.to, packages: last.packages ?? [], reason: last.reason ?? null, breaking: Boolean(last.breaking), at: last.at } : null
+  };
+};

package/server/utils/updates/restart.js

@@ -0,0 +1,64 @@
+import { spawn } from 'child_process';
+import { existsSync } from 'fs';
+
+/*
+  How the server comes back after an update.
+
+    respawn  this process starts its own replacement and exits. For `npm start` or `npm run dev` run by hand.
+    exit     this process only exits and whatever started it starts it again (pm2, systemd, a container's
+             restart policy). Respawning there would fight the supervisor for the port, and a container
+             stops when its main process does.
+
+  Chosen by the KEMPO_RESTART environment variable ("respawn" or "exit"), otherwise "exit" when pm2, systemd,
+  Kubernetes or Docker is detected and "respawn" when none is.
+*/
+export const restartMode = (env = process.env, inContainer = () => existsSync('/.dockerenv')) => {
+  if(env.KEMPO_RESTART === 'exit' || env.KEMPO_RESTART === 'respawn') return env.KEMPO_RESTART;
+  return env.pm_id !== undefined || env.INVOCATION_ID || env.KUBERNETES_SERVICE_HOST || inContainer() ? 'exit' : 'respawn';
+};
+
+/*
+  The replacement cannot be started by the process it replaces: the port is still taken. A small detached
+  watcher waits for that process to be gone and then starts the same command in the same directory with
+  the same environment. It gives up waiting after a minute and starts anyway.
+*/
+const WATCHER = `
+const { spawn } = require('child_process');
+const pid = Number(process.argv[1]);
+const command = JSON.parse(process.argv[2]);
+const started = Date.now();
+const alive = () => {
+  try { process.kill(pid, 0); return true; } catch(error) { return error.code === 'EPERM'; }
+};
+const wait = () => {
+  if(alive() && Date.now() - started < 60000) return setTimeout(wait, 200);
+  setTimeout(() => {
+    spawn(command[0], command.slice(1), { detached: true, stdio: 'ignore', cwd: process.cwd(), env: process.env, windowsHide: true }).unref();
+    process.exit(0);
+  }, 500);
+};
+wait();
+`;
+
+/*
+  Under a supervisor the exit code is nonzero on purpose (75, "try again later"): a Docker `restart: on-failure` or a
+  systemd `Restart=on-failure` policy restarts only after a failure, while `always` and `unless-stopped` restart after any exit.
+*/
+export const RESTART_EXIT_CODE = 75;
+
+export const restartServer = ({ mode = restartMode(), exit = code => process.exit(code), spawner = spawn } = {}) => {
+  if(mode === 'respawn'){
+    const command = [process.execPath, ...process.execArgv, ...process.argv.slice(1)];
+    spawner(process.execPath, ['-e', WATCHER, String(process.pid), JSON.stringify(command)], {
+      detached: true,
+      stdio: 'ignore',
+      cwd: process.cwd(),
+      env: process.env,
+      windowsHide: true
+    }).unref();
+  }
+  exit(mode === 'respawn' ? 0 : RESTART_EXIT_CODE);
+};
+
+/* Restarts after `delayMs`, so the response that announced it has been sent first. */
+export const scheduleRestart = ({ delayMs = 1000, ...options } = {}) => setTimeout(() => restartServer(options), delayMs);

package/server/utils/updates/rollbackUpdate.js

@@ -0,0 +1,56 @@
+import { existsSync } from 'fs';
+import { join } from 'path';
+import { RUNNING_VERSION } from './runtime.js';
+import { restartMode, scheduleRestart } from './restart.js';
+import { getCurrent, paths, readState, requestSwitch } from './siteLayout.js';
+
+let going = false;
+
+/*
+  Puts a site that runs from a Docker volume back on the version it had before the last update: the code, and the
+  starter files the update replaced. If that update changed data, going back also restores the database from the backup
+  taken before it, which loses whatever was entered since, so that needs `confirm.data`. Otherwise (the usual case: an
+  update only added to the database) the earlier version runs on the database as it is and nothing is lost.
+
+  Resolves to [error, { from, to, restart, restoresData }].
+*/
+export default async ({ confirm = {}, siteRoot = process.env.KEMPO_SITE_ROOT, restart = scheduleRestart } = {}) => {
+  if(!siteRoot){
+    return [{ code: 409, msg: 'This site is not set up to go back to an earlier version' }, null];
+  }
+  if(going){
+    return [{ code: 409, msg: 'A switch is already under way' }, null];
+  }
+  if(readState(siteRoot, 'switch')){
+    return [{ code: 409, msg: 'The last switch has not finished proving itself yet' }, null];
+  }
+
+  const { previous, version } = getCurrent(siteRoot);
+  const source = previous?.id ? join(paths(siteRoot).releases, previous.id) : null;
+  if(!source || !existsSync(join(source, 'node_modules'))){
+    return [{ code: 409, msg: 'There is no earlier version to go back to' }, null];
+  }
+
+  const last = readState(siteRoot, 'last');
+  const restoresData = Boolean(last?.ok && last.breaking && last.to === version && last.dbBackup && existsSync(last.dbBackup));
+  if(restoresData && !confirm.data){
+    return [{ code: 409, msg: 'Going back restores the database from before the update and loses what was entered since', details: { confirm: 'data' } }, null];
+  }
+
+  going = true;
+  try {
+    requestSwitch({
+      siteRoot,
+      id: previous.id,
+      version: previous.version,
+      source,
+      kind: 'rollback',
+      filesBackup: last?.ok && last.to === version ? last.filesBackup : null,
+      dbBackup: restoresData ? last.dbBackup : null
+    });
+    restart();
+    return [null, { from: RUNNING_VERSION, to: previous.version, restart: restartMode(), restoresData }];
+  } finally {
+    going = false;
+  }
+};

package/server/utils/updates/runUpdateCheck.js

@@ -0,0 +1,52 @@
+import { createHash } from 'crypto';
+import { and, eq } from 'drizzle-orm';
+import db from '../../db/index.js';
+import { notification } from '../../db/schema.js';
+import getSetting from '../settings/getSetting.js';
+import createNotification from '../notifications/createNotification.js';
+import getUpdateStatus from './getUpdateStatus.js';
+import { PACKAGE } from './helpers.js';
+
+/*
+  Raising a notification again would mark it unread for everyone, so each one has a key that names what it is about, and
+  one that already exists is left alone: one for each new version of kempo, and one for each distinct set of extension
+  updates that are waiting.
+*/
+const raiseOnce = async ({ dedupeKey, ...notice }) => {
+  const [existing] = await db.select({ id: notification.id }).from(notification).where(and(eq(notification.owner, PACKAGE), eq(notification.dedupeKey, dedupeKey))).limit(1);
+  if(existing) return;
+  const [error] = await createNotification({ owner: PACKAGE, permission: 'system:updates:manage', dedupeKey, actions: [{ label: 'View updates', href: '/admin/updates' }], ...notice });
+  if(error) console.error(`[kempo] Update notification: ${error.msg}`);
+};
+
+/*
+  The scheduled check (kempo's `update-check` job). Asks npm for the newest version of kempo and of every installed extension
+  and tells everyone who can install them what is waiting, once for each new version of kempo and once for each distinct set
+  of extension updates. Nothing is said about a site that cannot install updates (a linked checkout). The
+  `system:update_check_enabled` setting turns this off.
+*/
+export default async ({ fetcher, install } = {}) => {
+  const [, enabled] = await getSetting('system', 'update_check_enabled', true);
+  if(enabled === false) return;
+
+  const [, status] = await getUpdateStatus({ force: true, fetcher, install });
+  if(!status?.canUpdate) return;
+
+  if(status.updateAvailable){
+    await raiseOnce({
+      dedupeKey: `update:${status.latestVersion}`,
+      title: `Kempo ${status.latestVersion} is available`,
+      message: `This site runs ${status.runningVersion}.${status.major ? ' This is a major release and may include breaking changes.' : ''}`
+    });
+  }
+
+  const { updates } = status.extensionUpdates;
+  if(updates.length){
+    const list = updates.map(update => `${update.name}@${update.latestVersion}`);
+    await raiseOnce({
+      dedupeKey: `extension-updates:${createHash('sha256').update(list.join('\n')).digest('hex').slice(0, 16)}`,
+      title: updates.length === 1 ? `${updates[0].name} ${updates[0].latestVersion} is available` : `${updates.length} extension updates are available`,
+      message: `${updates.slice(0, 5).map(update => `${update.name} ${update.installedVersion} -> ${update.latestVersion}${update.major ? ' (major)' : ''}`).join(', ')}${updates.length > 5 ? ', and more' : ''}.`
+    });
+  }
+};

package/server/utils/updates/runtime.js

@@ -0,0 +1,15 @@
+import { readFileSync } from 'fs';
+import { randomUUID } from 'crypto';
+import { dirname, join } from 'path';
+import { fileURLToPath } from 'url';
+
+/*
+  What this process is running, read once when it starts. After an update the files on disk are the new
+  version while this process is still the old one, so these are what tell the two apart: the running
+  version, and a boot id that is different in every process.
+*/
+export const PACKAGE_ROOT = join(dirname(fileURLToPath(import.meta.url)), '..', '..', '..');
+
+export const RUNNING_VERSION = JSON.parse(readFileSync(join(PACKAGE_ROOT, 'package.json'), 'utf8')).version;
+
+export const BOOT_ID = randomUUID();