@morphemecms/cms 0.1.0 → 0.2.0-next-20261104150211

package/scripts/check-content.mjs

@@ -1,149 +1,151 @@
-// Checks the site's content by the editor's own rules before it is built (prebuild, and
-// `npm run check:content`): every block in the text of the pages and the data files the editor writes
-// (checkSite.ts in the editor, packages/editor/). Stops with what is wrong, so a broken page never goes
-// out; the site that is out stays as it is; among it every theme (themeProblems, with the icon packs it brings) and
-// the system's icon packs and the choice of one (iconPackProblems), and so an icon the site or the editor draws that a
-// pack has none for, and the choice of motion scheme (motionProblems). Says too which of the site's texts the
-// editor has no translation of (@site/texts, a block's texts.ts); that does not stop the build. The editor's
-// code is TypeScript and TSX, so it is loaded with Vite, as the site's own build does.
-import { existsSync, readFileSync, readdirSync } from 'node:fs';
-import { join, relative } from 'node:path';
-import { fileURLToPath } from 'node:url';
-import { config } from '../site/siteConfig.mjs';
-import { createServer } from 'vite';
-import {
-  aliases,
-  blockProblems,
-  iconPackProblems,
-  motionProblems,
-  installedThemes,
-  themeFolder,
-  themePlugin,
-  themeProblems,
-} from '@morphemecms/cms/site/theme.mjs';
-import { appFoldersPlugin, appIds, appWorkersProblems } from '@morphemecms/cms/lib/apps.mjs';
-import { codePackageProblems, declarationProblems, ownerId } from '@morphemecms/cms/lib/licenses.mjs';
-import { notesOf, releaseProblems } from './releases.mjs';
-
-const root = `${process.cwd()}/`;
-// This package's own code, from the site's root (packages/editor/ or node_modules/@morphemecms/cms/).
-const own = relative(root, fileURLToPath(new URL('..', import.meta.url)));
-const { allowedCspProblems, appCspProblems } = await import('../site/siteCsp.mjs');
-const { appCookieProblems } = await import('../site/appCookies.mjs');
-
-// With the redirects' other two files (siteRedirects in src/site/config.ts): none may send on through another.
-const files = ['src/content', 'src/data']
-  .filter((dir) => existsSync(dir))
-  .flatMap((dir) =>
-    readdirSync(dir, { recursive: true, withFileTypes: true })
-      .filter((e) => e.isFile() && /\.(md|json)$/.test(e.name))
-      .map((e) => join(e.parentPath, e.name)),
-  )
-  .concat([config.siteRedirects.rules, config.siteRedirects.map])
-  .map((path) => ({ path, text: readFileSync(path, 'utf8') }));
-
-const server = await createServer({
-  configFile: false,
-  logLevel: 'error',
-  appType: 'custom',
-  // As in packages/editor/astro.mjs: the editor takes the site from src/site/ as @site, and the theme in use as @theme.
-  plugins: [themePlugin(), appFoldersPlugin(process.cwd())],
-  resolve: { alias: aliases() },
-  server: { middlewareMode: true, hmr: false, ws: false },
-});
-let result, missing;
-// The licences ("Licenser" under "Indstillinger", @morphemecms/cms/lib/licenses.mjs): each app's own and those of the
-// third-party work it brings (its defineApp), installed or not, as each theme's (themeProblems), with the packages they
-// declare, which they give what a package lacks for.
-const licenses = [];
-const declared = new Set();
-// The apps and themes of the app store, against what the catalog has released of them (releases.mjs).
-let catalog = {};
-const releases = [];
-try {
-  const { problemsOf, untranslated } = await server.ssrLoadModule('@morphemecms/cms/src/checkSite.ts');
-  result = problemsOf(files);
-  missing = untranslated();
-  const { config } = await server.ssrLoadModule('/src/site/config.ts');
-  if (config.store && existsSync(config.store.catalog)) catalog = JSON.parse(readFileSync(config.store.catalog, 'utf8'));
-  for (const id of appIds(root)) {
-    const app = (await server.ssrLoadModule(`/src/apps/${id}/index.ts`)).default;
-    for (const x of app.thirdParty ?? []) if (x?.package) declared.add(x.package);
-    if (app.version)
-      releases.push(
-        ...releaseProblems(catalog, {
-          kind: 'apps',
-          id,
-          folder: `src/apps/${id}`,
-          version: app.version,
-          notes: notesOf(app.releaseNotes),
-          where: `src/apps/${id}/index.ts`,
-        }),
-      );
-    licenses.push(
-      ...declarationProblems({
-        license: app.license,
-        thirdParty: app.thirdParty,
-        folder: join(root, 'src/apps', id),
-        where: `src/apps/${id}/index.ts`,
-        what: `appen ${app.label}`,
-        owner: ownerId('app', id),
-        root,
-      }),
-    );
-  }
-} finally {
-  await server.close();
-}
-
-for (const [locale, files] of Object.entries(missing)) {
-  for (const [file, texts] of Object.entries(files)) {
-    console.warn(`\nEditoren viser ${texts.length} af sitets tekster uoversat på ${locale}. Skriv dem i ${file}:\n`);
-    for (const text of texts) console.warn(`  ${JSON.stringify(text)}`);
-  }
-}
-
-// Every theme installed has what a theme must have (the standard theme all of it), so the owner can swap to any of them
-// on "Udseende".
-result.problems.push(...installedThemes().flatMap(themeProblems), ...iconPackProblems(), ...motionProblems());
-// Every block is drawn from its view, on the site and in the editor alike.
-result.problems.push(...blockProblems());
-// What each app loads from elsewhere is in its csp.json, so the pages' Content-Security-Policy lets it through.
-result.problems.push(...appCspProblems());
-// The addresses allowed in the editor after the policy stopped them are written as an app's csp.json.
-result.problems.push(...allowedCspProblems());
-// The cookies each app sets are in its cookies.json, for the cookie list in the cookie policy.
-result.problems.push(...appCookieProblems());
-// The Worker has the part of each app that has one (worker/apps.js).
-result.problems.push(...appWorkersProblems(root));
-// Every app and theme says what its licence is and what it brings (the icon packs say theirs, themeProblems), and
-// every package the site's and the editor's code imports, and those they depend on, has a licence the editor can show
-// under "Licenser" (more than the build ships, which stops on its own when something it ships has none).
-for (const theme of installedThemes())
-  for (const x of JSON.parse(readFileSync(`${themeFolder(theme)}/theme.json`, 'utf8')).thirdParty ?? [])
-    if (x?.package) declared.add(x.package);
-result.problems.push(...licenses, ...codePackageProblems(root, [join(own, 'src'), join(own, 'lib'), 'src'], declared));
-// What is changed in an app or a theme of the store since it was released has its next version, once, with its note.
-for (const theme of installedThemes()) {
-  const manifest = JSON.parse(readFileSync(`${themeFolder(theme)}/theme.json`, 'utf8'));
-  if (manifest.store === true)
-    releases.push(
-      ...releaseProblems(catalog, {
-        kind: 'themes',
-        id: theme,
-        folder: themeFolder(theme),
-        version: manifest.version,
-        notes: notesOf(manifest.releaseNotes, true),
-        where: `${themeFolder(theme)}/theme.json`,
-      }),
-    );
-}
-result.problems.push(...releases);
-
-if (result.problems.length) {
-  console.error(`\nIndholdet følger ikke editorens regler (${result.problems.length}):\n`);
-  for (const line of result.problems) console.error(`  ${line}`);
-  console.error('\nRet filerne (eller blokkens felter i src/apps/<app>/blocks/), så bygges sitet igen.\n');
-  process.exit(1);
-}
-console.log(`${result.files} filer og ${result.blocks} blokke følger editorens regler.`);
+// Checks the site's content by the editor's own rules before it is built (prebuild, and
+// `npm run check:content`): every block in the text of the pages and the data files the editor writes
+// (checkSite.ts in the editor, packages/editor/). Stops with what is wrong, so a broken page never goes
+// out; the site that is out stays as it is; among it every theme (themeProblems, with the icon packs it brings) and
+// the system's icon packs and the choice of one (iconPackProblems), and so an icon the site or the editor draws that a
+// pack has none for, and the choice of motion scheme (motionProblems). Says too which of the site's texts the
+// editor has no translation of (@site/texts, a block's texts.ts); that does not stop the build. The editor's
+// code is TypeScript and TSX, so it is loaded with Vite, as the site's own build does.
+import { existsSync, readFileSync, readdirSync } from 'node:fs';
+import { join, relative } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { config } from '../site/siteConfig.mjs';
+import { createServer } from 'vite';
+import {
+  aliases,
+  blockProblems,
+  iconPackProblems,
+  motionProblems,
+  installedThemes,
+  themeFolder,
+  themePlugin,
+  themeProblems,
+} from '@morphemecms/cms/site/theme.mjs';
+import { appFoldersPlugin, appIds, appWorkersProblems } from '@morphemecms/cms/lib/apps.mjs';
+import { caseCollisionProblems } from '@morphemecms/cms/lib/caseCollisions.mjs';
+import { codePackageProblems, declarationProblems, ownerId } from '@morphemecms/cms/lib/licenses.mjs';
+import { notesOf, releaseProblems } from './releases.mjs';
+
+const root = `${process.cwd()}/`;
+// This package's own code, from the site's root (packages/editor/ or node_modules/@morphemecms/cms/).
+const own = relative(root, fileURLToPath(new URL('..', import.meta.url)));
+const { allowedCspProblems, appCspProblems } = await import('../site/siteCsp.mjs');
+const { appCookieProblems } = await import('../site/appCookies.mjs');
+
+// With the redirects' other two files (siteRedirects in src/site/config.ts): none may send on through another.
+const files = ['src/content', 'src/data']
+  .filter((dir) => existsSync(dir))
+  .flatMap((dir) =>
+    readdirSync(dir, { recursive: true, withFileTypes: true })
+      .filter((e) => e.isFile() && /\.(md|json)$/.test(e.name))
+      .map((e) => join(e.parentPath, e.name)),
+  )
+  .concat([config.siteRedirects.rules, config.siteRedirects.map])
+  .map((path) => ({ path, text: readFileSync(path, 'utf8') }));
+
+const server = await createServer({
+  configFile: false,
+  logLevel: 'error',
+  appType: 'custom',
+  // As in packages/editor/astro.mjs: the editor takes the site from src/site/ as @site, and the theme in use as @theme.
+  plugins: [themePlugin(), appFoldersPlugin(process.cwd())],
+  resolve: { alias: aliases() },
+  server: { middlewareMode: true, hmr: false, ws: false },
+});
+let result, missing;
+// The licences ("Licenser" under "Indstillinger", @morphemecms/cms/lib/licenses.mjs): each app's own and those of the
+// third-party work it brings (its defineApp), installed or not, as each theme's (themeProblems), with the packages they
+// declare, which they give what a package lacks for.
+const licenses = [];
+const declared = new Set();
+// The apps and themes of the app store, against what the catalog has released of them (releases.mjs).
+let catalog = {};
+const releases = [];
+try {
+  const { problemsOf, untranslated } = await server.ssrLoadModule('@morphemecms/cms/src/checkSite.ts');
+  result = problemsOf(files);
+  missing = untranslated();
+  if (existsSync('store/catalog.json')) catalog = JSON.parse(readFileSync('store/catalog.json', 'utf8'));
+  for (const id of appIds(root)) {
+    const app = (await server.ssrLoadModule(`/src/apps/${id}/index.ts`)).default;
+    for (const x of app.thirdParty ?? []) if (x?.package) declared.add(x.package);
+    if (app.version)
+      releases.push(
+        ...releaseProblems(catalog, {
+          kind: 'apps',
+          id,
+          folder: `src/apps/${id}`,
+          version: app.version,
+          notes: notesOf(app.releaseNotes),
+          where: `src/apps/${id}/index.ts`,
+        }),
+      );
+    licenses.push(
+      ...declarationProblems({
+        license: app.license,
+        thirdParty: app.thirdParty,
+        folder: join(root, 'src/apps', id),
+        where: `src/apps/${id}/index.ts`,
+        what: `appen ${app.label}`,
+        owner: ownerId('app', id),
+        root,
+      }),
+    );
+  }
+} finally {
+  await server.close();
+}
+
+for (const [locale, files] of Object.entries(missing)) {
+  for (const [file, texts] of Object.entries(files)) {
+    console.warn(`\nEditoren viser ${texts.length} af sitets tekster uoversat på ${locale}. Skriv dem i ${file}:\n`);
+    for (const text of texts) console.warn(`  ${JSON.stringify(text)}`);
+  }
+}
+
+// Every theme installed has what a theme must have (the standard theme all of it), so the owner can swap to any of them
+// on "Udseende".
+result.problems.push(...installedThemes().flatMap(themeProblems), ...iconPackProblems(), ...motionProblems());
+// Every block is drawn from its view, on the site and in the editor alike.
+result.problems.push(...blockProblems());
+// What each app loads from elsewhere is in its csp.json, so the pages' Content-Security-Policy lets it through.
+result.problems.push(...appCspProblems());
+// The addresses allowed in the editor after the policy stopped them are written as an app's csp.json.
+result.problems.push(...allowedCspProblems());
+// The cookies each app sets are in its cookies.json, for the cookie list in the cookie policy.
+result.problems.push(...appCookieProblems());
+// The Worker has the part of each app that has one (worker/apps.js).
+result.problems.push(...appWorkersProblems(root));
+// No two files of the package or the site differ only by case (an import would find the wrong one on Windows).
+result.problems.push(...caseCollisionProblems(root, [own, 'src']));
+// Every app and theme says what its licence is and what it brings (the icon packs say theirs, themeProblems), and
+// every package the site's and the editor's code imports, and those they depend on, has a licence the editor can show
+// under "Licenser" (more than the build ships, which stops on its own when something it ships has none).
+for (const theme of installedThemes())
+  for (const x of JSON.parse(readFileSync(`${themeFolder(theme)}/theme.json`, 'utf8')).thirdParty ?? [])
+    if (x?.package) declared.add(x.package);
+result.problems.push(...licenses, ...codePackageProblems(root, [join(own, 'src'), join(own, 'lib'), 'src'], declared));
+// What is changed in an app or a theme of the store since it was released has its next version, once, with its note.
+for (const theme of installedThemes()) {
+  const manifest = JSON.parse(readFileSync(`${themeFolder(theme)}/theme.json`, 'utf8'));
+  if (manifest.store === true)
+    releases.push(
+      ...releaseProblems(catalog, {
+        kind: 'themes',
+        id: theme,
+        folder: themeFolder(theme),
+        version: manifest.version,
+        notes: notesOf(manifest.releaseNotes, true),
+        where: `${themeFolder(theme)}/theme.json`,
+      }),
+    );
+}
+result.problems.push(...releases);
+
+if (result.problems.length) {
+  console.error(`\nIndholdet følger ikke editorens regler (${result.problems.length}):\n`);
+  for (const line of result.problems) console.error(`  ${line}`);
+  console.error('\nRet filerne (eller blokkens felter i src/apps/<app>/blocks/), så bygges sitet igen.\n');
+  process.exit(1);
+}
+console.log(`${result.files} filer og ${result.blocks} blokke følger editorens regler.`);

package/scripts/check-demo.mjs

@@ -1,24 +1,24 @@
-// The CMS's demo site (demo/, demo-site.mjs) still works with the CMS: its content checked by the editor's rules
-// (check-content.mjs), each file the same after a save in the editor (editor-roundtrip.mjs) and the site built, with the
-// standard theme, in a folder of its own. Run it when the CMS, the
-// standard theme or the demo has changed: npx morpheme check:demo.
-import { execFileSync } from 'node:child_process';
-import { rmSync } from 'node:fs';
-import { join } from 'node:path';
-import { fileURLToPath } from 'node:url';
-import { binOf } from './bin.mjs';
-import { demoSite } from './demo-site.mjs';
-
-const dir = demoSite();
-try {
-  const run = (args) => execFileSync(process.execPath, args, { cwd: dir, stdio: 'inherit' });
-  run([fileURLToPath(new URL('check-content.mjs', import.meta.url))]);
-  run([fileURLToPath(new URL('editor-roundtrip.mjs', import.meta.url))]);
-  run([binOf('astro'), 'build', '--outDir', join(dir, 'dist')]);
-  console.log('\nDemoen virker med CMS’et.');
-} catch {
-  console.error('\nDemoen virker ikke med CMS’et (se ovenfor).');
-  process.exitCode = 1;
-} finally {
-  rmSync(dir, { recursive: true, force: true });
-}
+// The CMS's demo site (demo/, demo-site.mjs) still works with the CMS: its content checked by the editor's rules
+// (check-content.mjs), each file the same after a save in the editor (editor-roundtrip.mjs) and the site built, with the
+// standard theme, in a folder of its own. Run it when the CMS, the
+// standard theme or the demo has changed: npx morpheme check:demo.
+import { execFileSync } from 'node:child_process';
+import { rmSync } from 'node:fs';
+import { join } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { binOf } from './bin.mjs';
+import { demoSite } from './demo-site.mjs';
+
+const dir = demoSite();
+try {
+  const run = (args) => execFileSync(process.execPath, args, { cwd: dir, stdio: 'inherit' });
+  run([fileURLToPath(new URL('check-content.mjs', import.meta.url))]);
+  run([fileURLToPath(new URL('editor-roundtrip.mjs', import.meta.url))]);
+  run([binOf('astro'), 'build', '--outDir', join(dir, 'dist')]);
+  console.log('\nDemoen virker med CMS’et.');
+} catch {
+  console.error('\nDemoen virker ikke med CMS’et (se ovenfor).');
+  process.exitCode = 1;
+} finally {
+  rmSync(dir, { recursive: true, force: true });
+}

package/scripts/check-store.mjs

@@ -0,0 +1,160 @@
+// Checks the site's Worker's questions to the store (packages/editor/worker/store.js): /api/store/catalog and /api/store/files/<oid>,
+// who may ask, what happens without a key, and the store's refusals and failures. GitHub and the store are played by a fake
+// fetch that records each request; nothing goes to either.
+// Run: npm run check:worker
+import { APP_API, THEME_API } from '../lib/contracts.mjs';
+import { workerModules } from './worker-modules.mjs';
+
+const [{ handleStore, STORE_URL }] = await workerModules('store.js', 'session.js');
+
+const problems = [];
+const expect = (ok, what) => ok || problems.push(what);
+
+const KEY = 'site-key-for-test';
+const OID = 'a'.repeat(40);
+const BYTES = new Uint8Array([1, 2, 3, 250]);
+
+/** A fake fetch: GitHub says what `repoAccess` says for a token; the store answers with `store(url, init)`. `storeCalls` records the store's requests. */
+function world({ repoAccess = { pull: true, push: false }, store = () => new Response('{}', { status: 200 }) } = {}) {
+  const storeCalls = [];
+  const ask = async (url, init = {}) => {
+    if (String(url).startsWith('https://api.github.com/')) return Response.json({ permissions: repoAccess });
+    storeCalls.push({ url: String(url), headers: init.headers ?? {} });
+    return store(String(url), init);
+  };
+  return { ask, storeCalls };
+}
+
+let n = 0;
+/** A request from the editor's page; a fresh token each time (the Worker remembers what GitHub said about a token). */
+const request = (path, { signedIn = true, method = 'GET' } = {}) =>
+  new Request(`https://editor.example/api/store/${path}`, {
+    method,
+    headers: { ...(signedIn ? { cookie: `editor_session=token-${++n}` } : {}), 'sec-fetch-site': 'same-origin' },
+  });
+const call = async (w, path, env = { MORPHEME_STORE_KEY: KEY }, options) => {
+  const res = await handleStore(request(path, options), env, {}, w.ask);
+  const bytes = new Uint8Array(await res.clone().arrayBuffer());
+  return { res, bytes, text: new TextDecoder().decode(bytes) };
+};
+
+// Signed out: 401, and the store is not asked.
+{
+  const w = world();
+  const { res } = await call(w, 'catalog', undefined, { signedIn: false });
+  expect(res.status === 401, `uden login var svaret ${res.status}, ikke 401`);
+  expect(w.storeCalls.length === 0, 'uden login blev butikken spurgt');
+}
+
+// Signed in without the right to read the repository: 403.
+{
+  const w = world({ repoAccess: { pull: false, push: false } });
+  const { res } = await call(w, 'catalog');
+  expect(res.status === 403, `uden læseret var svaret ${res.status}, ikke 403`);
+  expect(w.storeCalls.length === 0, 'uden læseret blev butikken spurgt');
+}
+
+// Without a key: the catalog says "not connected" and files are not found; the store is not asked.
+{
+  const w = world();
+  const catalog = await call(w, 'catalog', {});
+  expect(catalog.res.status === 200 && JSON.parse(catalog.text).connected === false, `uden nøgle var kataloget ${catalog.text}`);
+  const file = await call(w, `files/${OID}`, {});
+  expect(file.res.status === 404, `uden nøgle var en fil ${file.res.status}, ikke 404`);
+  expect(w.storeCalls.length === 0, 'uden nøgle blev butikken spurgt');
+}
+
+// With a key: one request to the catalog with the contract versions and the bearer, and the store's JSON back.
+{
+  const w = world({ store: () => Response.json({ apps: [{ id: 'x' }] }) });
+  const { res, text } = await call(w, 'catalog');
+  expect(res.status === 200 && JSON.parse(text).apps?.[0]?.id === 'x', `kataloget var ${res.status} ${text}`);
+  expect(w.storeCalls.length === 1, `butikken blev spurgt ${w.storeCalls.length} gange, ikke 1`);
+  expect(w.storeCalls[0]?.url === `${STORE_URL}/store/catalog?app=${APP_API}&theme=${THEME_API}`, `adressen var ${w.storeCalls[0]?.url}`);
+  expect(w.storeCalls[0]?.headers.authorization === `Bearer ${KEY}`, 'kataloget blev spurgt uden nøglen som bearer');
+  expect(!text.includes(KEY), 'kataloget indeholdt nøglen');
+}
+
+// MORPHEME_STORE_URL is used when set.
+{
+  const w = world();
+  await call(w, 'catalog', { MORPHEME_STORE_KEY: KEY, MORPHEME_STORE_URL: 'https://store.example' });
+  expect(
+    w.storeCalls[0]?.url === `https://store.example/store/catalog?app=${APP_API}&theme=${THEME_API}`,
+    `MORPHEME_STORE_URL blev ikke brugt: ${w.storeCalls[0]?.url}`,
+  );
+}
+
+// A file: only a 40-character oid; the bytes, content-type and cache-control go through.
+{
+  const w = world();
+  const bad = await call(w, 'files/xyz');
+  expect(bad.res.status === 404, `oid xyz gav ${bad.res.status}, ikke 404`);
+  expect(w.storeCalls.length === 0, 'oid xyz blev spurgt om i butikken');
+}
+{
+  const w = world({
+    store: () =>
+      new Response(BYTES, {
+        status: 200,
+        headers: { 'content-type': 'image/png', 'cache-control': 'public, max-age=31536000, immutable' },
+      }),
+  });
+  const { res, bytes } = await call(w, `files/${OID}`);
+  expect(res.status === 200 && bytes.join() === BYTES.join(), `filens bytes var ${bytes.join()}`);
+  expect(
+    res.headers.get('cache-control') === 'public, max-age=31536000, immutable',
+    `cache-control var ${res.headers.get('cache-control')}`,
+  );
+  expect(res.headers.get('content-type') === 'image/png', `content-type var ${res.headers.get('content-type')}`);
+  expect(w.storeCalls[0]?.url === `${STORE_URL}/store/files/${OID}`, `filens adresse var ${w.storeCalls[0]?.url}`);
+  expect(w.storeCalls[0]?.headers.authorization === `Bearer ${KEY}`, 'filen blev spurgt uden nøglen som bearer');
+}
+{
+  const w = world({ store: () => new Response('no', { status: 404 }) });
+  const { res } = await call(w, `files/${OID}`);
+  expect(res.status === 404, `en fil butikken ikke har gav ${res.status}, ikke 404`);
+}
+
+// The store refuses or fails: 502, and never the key.
+for (const [status, error] of [
+  [401, 'store refused'],
+  [403, 'store refused'],
+  [500, 'store failed'],
+  [400, 'store failed'],
+  [404, 'store failed'],
+]) {
+  for (const path of ['catalog', ...(status === 404 || status === 400 ? [] : [`files/${OID}`])]) {
+    const w = world({ store: () => new Response(`secret ${KEY}`, { status }) });
+    const { res, text } = await call(w, path);
+    expect(res.status === 502 && JSON.parse(text).error === error, `butikkens ${status} på ${path} gav ${res.status} ${text}`);
+    expect(
+      !text.includes(KEY) && ![...res.headers.values()].some((v) => v.includes(KEY)),
+      `svaret på butikkens ${status} indeholdt nøglen`,
+    );
+  }
+}
+{
+  const w = world({
+    store: () => {
+      throw new Error(`no network, ${KEY}`);
+    },
+  });
+  const { res, text } = await call(w, 'catalog');
+  expect(res.status === 502 && JSON.parse(text).error === 'store failed', `en netværksfejl gav ${res.status} ${text}`);
+  expect(!text.includes(KEY), 'svaret på en netværksfejl indeholdt nøglen');
+}
+
+// Other methods and addresses.
+{
+  const w = world();
+  expect((await call(w, 'catalog', undefined, { method: 'POST' })).res.status === 405, 'POST gav ikke 405');
+  expect((await call(w, 'other')).res.status === 404, 'en ukendt adresse gav ikke 404');
+  expect(w.storeCalls.length === 0, 'en forkert metode eller adresse blev spurgt om i butikken');
+}
+
+if (problems.length) {
+  console.error(problems.map((p) => `- ${p}`).join('\n'));
+  process.exit(1);
+}
+console.log('Workerens spørgsmål til butikken er i orden.');

package/scripts/check-themes.mjs

@@ -1,45 +1,45 @@
-// Every theme installed (src/themes/) works as the site's theme, so the owner can swap to any of them: with each of the
-// others than the one in use (src/data/theme.json), the editor's check of the content (check-content.mjs), the site
-// built (in a folder of its own, so dist/ stays the theme in use's) and every screen of the editor opened
-// (editor-screens.mjs). The theme in use is checked by the steps before (npm run build, npm run check:screens).
-// src/data/theme.json is the theme being checked while it runs, and as it was after.
-import { execFileSync } from 'node:child_process';
-import { mkdtempSync, readFileSync, rmSync, writeFileSync } from 'node:fs';
-import { tmpdir } from 'node:os';
-import { join } from 'node:path';
-import { fileURLToPath } from 'node:url';
-import { activeTheme, installedThemes } from '@morphemecms/cms/site/theme.mjs';
-import { binOf } from './bin.mjs';
-
-const ROOT = `${process.cwd()}/`;
-const file = join(ROOT, 'src/data/theme.json');
-const before = readFileSync(file, 'utf8');
-const others = installedThemes().filter((t) => t !== activeTheme());
-const run = (cmd, args) => execFileSync(cmd, args, { cwd: ROOT, stdio: 'inherit' });
-
-const failed = [];
-try {
-  for (const theme of others) {
-    console.log(`\nTemaet ${theme}:`);
-    writeFileSync(file, `${JSON.stringify({ theme }, null, 2)}\n`);
-    const out = mkdtempSync(join(tmpdir(), `theme-${theme}-`));
-    try {
-      run(process.execPath, [fileURLToPath(new URL('check-content.mjs', import.meta.url))]);
-      run(process.execPath, [binOf('astro'), 'build', '--outDir', out]);
-      run(process.execPath, [fileURLToPath(new URL('editor-screens.mjs', import.meta.url)), out]);
-    } catch {
-      failed.push(theme);
-    } finally {
-      rmSync(out, { recursive: true, force: true });
-    }
-  }
-} finally {
-  writeFileSync(file, before);
-}
-
-if (failed.length) {
-  console.error(`\nDet virker ikke med ${failed.length === 1 ? 'temaet' : 'temaerne'} ${failed.join(', ')} (se ovenfor).`);
-  process.exit(1);
-}
-if (!others.length) console.log('Der er ingen andre temaer installeret i src/themes/.');
-else console.log(`\n${others.length === 1 ? 'Temaet' : 'Temaerne'} ${others.join(', ')} virker også som sitets tema.`);
+// Every theme installed (src/themes/) works as the site's theme, so the owner can swap to any of them: with each of the
+// others than the one in use (src/data/theme.json), the editor's check of the content (check-content.mjs), the site
+// built (in a folder of its own, so dist/ stays the theme in use's) and every screen of the editor opened
+// (editor-screens.mjs). The theme in use is checked by the steps before (npm run build, npm run check:screens).
+// src/data/theme.json is the theme being checked while it runs, and as it was after.
+import { execFileSync } from 'node:child_process';
+import { mkdtempSync, readFileSync, rmSync, writeFileSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { activeTheme, installedThemes } from '@morphemecms/cms/site/theme.mjs';
+import { binOf } from './bin.mjs';
+
+const ROOT = `${process.cwd()}/`;
+const file = join(ROOT, 'src/data/theme.json');
+const before = readFileSync(file, 'utf8');
+const others = installedThemes().filter((t) => t !== activeTheme());
+const run = (cmd, args) => execFileSync(cmd, args, { cwd: ROOT, stdio: 'inherit' });
+
+const failed = [];
+try {
+  for (const theme of others) {
+    console.log(`\nTemaet ${theme}:`);
+    writeFileSync(file, `${JSON.stringify({ theme }, null, 2)}\n`);
+    const out = mkdtempSync(join(tmpdir(), `theme-${theme}-`));
+    try {
+      run(process.execPath, [fileURLToPath(new URL('check-content.mjs', import.meta.url))]);
+      run(process.execPath, [binOf('astro'), 'build', '--outDir', out]);
+      run(process.execPath, [fileURLToPath(new URL('editor-screens.mjs', import.meta.url)), out]);
+    } catch {
+      failed.push(theme);
+    } finally {
+      rmSync(out, { recursive: true, force: true });
+    }
+  }
+} finally {
+  writeFileSync(file, before);
+}
+
+if (failed.length) {
+  console.error(`\nDet virker ikke med ${failed.length === 1 ? 'temaet' : 'temaerne'} ${failed.join(', ')} (se ovenfor).`);
+  process.exit(1);
+}
+if (!others.length) console.log('Der er ingen andre temaer installeret i src/themes/.');
+else console.log(`\n${others.length === 1 ? 'Temaet' : 'Temaerne'} ${others.join(', ')} virker også som sitets tema.`);