@morphemecms/cms 0.1.0 → 0.2.0-next-20261104150211

package/site/site.ts

@@ -1,76 +1,76 @@
-// Name, title, phone, email, address and CVR number: contact.json; the texts of "Book en tid": booking.json (the calendar
-// is the app Calendly's, src/apps/calendly/); the menus: menu.json and mobile-menu.json; the shared texts of the other blocks: their shared.ts, with those saved in
-// blocks.json over them (`blockTexts`).
-// The site's owner edits them in the editor (/editor/); what the editor does not edit is the site's config
-// (src/site/config.ts).
-import contact from '@data/contact.json';
-import booking from '@data/booking.json';
-import menu from '@data/menu.json';
-import mobileMenu from '@data/mobile-menu.json';
-import blocks from '@data/blocks.json';
-import standardPages from '@data/standard-pages.json';
-import { config } from '@site/config';
-import { sharedTexts, type SharedTexts } from '@morphemecms/cms/src/shared';
-import { standardShared } from '@morphemecms/cms/src/standard/sharedTexts';
-
-// The number with its country code: +45 when it has none (a number in Denmark, saved without it), else
-// its own ("+46 70 12 34 56", picked in the editor).
-const phoneIntl = `${contact.phone.trim().startsWith('+') ? '+' : '+45'}${contact.phone.replace(/\D/g, '')}`;
-// The CVR number, when it is filled in ("Virksomheden" › "Kontakt").
-const { cvr = '' } = contact as typeof contact & { cvr?: string };
-
-export const site = {
-  name: contact.name,
-  role: contact.role,
-  /** The site's own address, https://<domain> (config.ts). */
-  url: `https://${config.domain}`,
-  /** The site's language (config.ts, BCP 47: "da-DK"). */
-  locale: config.locale,
-  description: config.siteDescription,
-  phone: contact.phone,
-  phoneHref: `tel:${phoneIntl}`,
-  /** For structured data: the country code and the digits. */
-  phoneIntl,
-  email: contact.email,
-  address: { street: contact.street, city: contact.city },
-  /** The CVR number, or empty: at the bottom of every page (the theme's Footer.astro) and in the structured data. */
-  cvr,
-  mapsUrl: `https://www.google.com/maps/search/?api=1&query=${`${contact.street}, ${contact.city}`.replace(/ /g, '+')}`,
-  bookingPath: config.booking.path,
-  /** The pages a booking or an order ends on (config.ts): no action bar there. */
-  thanks: config.booking.thanks,
-  /** The page about the owner, or '' (config.ts). */
-  aboutPath: config.aboutPath,
-  /** The block after every blog post, by its type, or '' (config.ts). */
-  postEnd: config.postEnd,
-  /** The page chosen as the contact page ("Indstillinger" › "Udseende" › "Standardsider", standard-pages.json). */
-  contactPath: standardPages.contact,
-  /** The shared texts of "Book en tid" (an app's booking block). */
-  booking: { heading: booking.heading, text: booking.text },
-  /** The labels of the buttons "Book en tid" and "Ring" (the number comes after). */
-  labels: { book: booking.book, call: booking.call },
-  /** The owner's picture (config.ts), or '' when the site has none. */
-  portrait: config.picture?.src ?? '',
-  portraitAlt: config.picture?.alt ?? '',
-};
-
-// Primary navigation (menu.json, "Hovedmenu"). Labels, URLs and sub-items started out as the old site's menu.
-export type NavItem = { label: string; href: string; children?: { label: string; href: string }[] };
-export const nav: NavItem[] = menu.items;
-/** Whether the header has the menu and its button ("Aktiveret" under "Hovedmenu"). */
-export const navShown = menu.enabled !== false;
-/** The links in the bar under the header on a phone (mobile-menu.json, "Mobilmenu"); none when it is turned off. */
-export const mobileNav: { label: string; href: string }[] = mobileMenu.enabled ? mobileMenu.items : [];
-// Sub-items in alphabetical order (Danish: æ, ø, å last), in both the desktop and the mobile menu.
-for (const item of nav) item.children?.sort((a, b) => a.label.localeCompare(b.label, 'da'));
-
-/** The texts every copy of a block has ("Blokke" in the editor), with {…} for what differs, by
- * the block's type: those written in its shared.ts, with the saved ones (blocks.json) over them. The
- * standard blocks' first, so an app's block (src/apps/<app>/blocks/) by the same name has its own. */
-export const blockTexts = sharedTexts(
-  {
-    ...standardShared,
-    ...import.meta.glob<SharedTexts>('/src/apps/*/blocks/*/shared.ts', { eager: true, import: 'default' }),
-  },
-  blocks,
-);
+// Name, title, phone, email, address and CVR number: contact.json; the texts of "Book en tid": booking.json (the calendar
+// is the app Calendly's, src/apps/calendly/); the menus: menu.json and mobile-menu.json; the shared texts of the other blocks: their shared.ts, with those saved in
+// blocks.json over them (`blockTexts`).
+// The site's owner edits them in the editor (/editor/); what the editor does not edit is the site's config
+// (src/site/config.ts).
+import contact from '@data/contact.json';
+import booking from '@data/booking.json';
+import menu from '@data/menu.json';
+import mobileMenu from '@data/mobile-menu.json';
+import blocks from '@data/blocks.json';
+import standardPages from '@data/standard-pages.json';
+import { config } from '@site/config';
+import { sharedTexts, type SharedTexts } from '@morphemecms/cms/src/shared';
+import { standardShared } from '@morphemecms/cms/src/standard/sharedTexts';
+
+// The number with its country code: +45 when it has none (a number in Denmark, saved without it), else
+// its own ("+46 70 12 34 56", picked in the editor).
+const phoneIntl = `${contact.phone.trim().startsWith('+') ? '+' : '+45'}${contact.phone.replace(/\D/g, '')}`;
+// The CVR number, when it is filled in ("Virksomheden" › "Kontakt").
+const { cvr = '' } = contact as typeof contact & { cvr?: string };
+
+export const site = {
+  name: contact.name,
+  role: contact.role,
+  /** The site's own address, https://<domain> (config.ts). */
+  url: `https://${config.domain}`,
+  /** The site's language (config.ts, BCP 47: "da-DK"). */
+  locale: config.locale,
+  description: config.siteDescription,
+  phone: contact.phone,
+  phoneHref: `tel:${phoneIntl}`,
+  /** For structured data: the country code and the digits. */
+  phoneIntl,
+  email: contact.email,
+  address: { street: contact.street, city: contact.city },
+  /** The CVR number, or empty: at the bottom of every page (the theme's Footer.astro) and in the structured data. */
+  cvr,
+  mapsUrl: `https://www.google.com/maps/search/?api=1&query=${`${contact.street}, ${contact.city}`.replace(/ /g, '+')}`,
+  bookingPath: config.booking.path,
+  /** The pages a booking or an order ends on (config.ts): no action bar there. */
+  thanks: config.booking.thanks,
+  /** The page about the owner, or '' (config.ts). */
+  aboutPath: config.aboutPath,
+  /** The block after every blog post, by its type, or '' (config.ts). */
+  postEnd: config.postEnd,
+  /** The page chosen as the contact page ("Indstillinger" › "Udseende" › "Standardsider", standard-pages.json). */
+  contactPath: standardPages.contact,
+  /** The shared texts of "Book en tid" (an app's booking block). */
+  booking: { heading: booking.heading, text: booking.text },
+  /** The labels of the buttons "Book en tid" and "Ring" (the number comes after). */
+  labels: { book: booking.book, call: booking.call },
+  /** The owner's picture (config.ts), or '' when the site has none. */
+  portrait: config.picture?.src ?? '',
+  portraitAlt: config.picture?.alt ?? '',
+};
+
+// Primary navigation (menu.json, "Hovedmenu"). Labels, URLs and sub-items started out as the old site's menu.
+export type NavItem = { label: string; href: string; children?: { label: string; href: string }[] };
+export const nav: NavItem[] = menu.items;
+/** Whether the header has the menu and its button ("Aktiveret" under "Hovedmenu"). */
+export const navShown = menu.enabled !== false;
+/** The links in the bar under the header on a phone (mobile-menu.json, "Mobilmenu"); none when it is turned off. */
+export const mobileNav: { label: string; href: string }[] = mobileMenu.enabled ? mobileMenu.items : [];
+// Sub-items in alphabetical order (Danish: æ, ø, å last), in both the desktop and the mobile menu.
+for (const item of nav) item.children?.sort((a, b) => a.label.localeCompare(b.label, 'da'));
+
+/** The texts every copy of a block has ("Blokke" in the editor), with {…} for what differs, by
+ * the block's type: those written in its shared.ts, with the saved ones (blocks.json) over them. The
+ * standard blocks' first, so an app's block (src/apps/<app>/blocks/) by the same name has its own. */
+export const blockTexts = sharedTexts(
+  {
+    ...standardShared,
+    ...import.meta.glob<SharedTexts>('/src/apps/*/blocks/*/shared.ts', { eager: true, import: 'default' }),
+  },
+  blocks,
+);

package/site/siteConfig.mjs

@@ -1,8 +1,8 @@
-// The site's settings (src/site/config.ts, `@site/config`) for this package's modules that also run outside Vite, where
-// @site is no alias (astro.mjs and the scripts): loaded from the site's root, the working directory, as Node loads
-// TypeScript. Its imports must be ones Node can follow (defineSite.mjs, not @site).
-import { join } from 'node:path';
-import { pathToFileURL } from 'node:url';
-
-/** @type {{ config: import('./defineSite.mjs').SiteConfig }} */
-export const { config } = await import(/* @vite-ignore */ pathToFileURL(join(process.cwd(), 'src/site/config.ts')).href);
+// The site's settings (src/site/config.ts, `@site/config`) for this package's modules that also run outside Vite, where
+// @site is no alias (astro.mjs and the scripts): loaded from the site's root, the working directory, as Node loads
+// TypeScript. Its imports must be ones Node can follow (defineSite.mjs, not @site).
+import { join } from 'node:path';
+import { pathToFileURL } from 'node:url';
+
+/** @type {{ config: import('./defineSite.mjs').SiteConfig }} */
+export const { config } = await import(/* @vite-ignore */ pathToFileURL(join(process.cwd(), 'src/site/config.ts')).href);

package/site/siteCsp.mjs

@@ -1,75 +1,75 @@
-// What this site's pages may load from elsewhere, besides what the editor's package allows on every site (the
-// videos, packages/editor/lib/csp.mjs, which writes the policy into the pages): what each installed app needs
-// (src/apps/<app>/csp.json, src/data/apps.json), Google Analytics, Google Ads and Google Tag Manager too, which load
-// Google's tag once the visitor has said yes (src/scripts/tracking.ts), and the addresses allowed in the editor after
-// the policy stopped them (src/data/csp.json, config.csp: the app "Cookiescanner"'s "Blokeret adresse").
-// Read by the build (packages/editor/astro.mjs) and by npm run check:content (appCspProblems), so no TypeScript here.
-import { existsSync, readdirSync, readFileSync } from 'node:fs';
-import { pathToFileURL } from 'node:url';
-import { allows, sourcesProblems } from '../lib/csp.mjs';
-
-// The site's src/, from its root (the working directory).
-const SRC = pathToFileURL(`${process.cwd()}/src/`);
-
-const json = (file) => JSON.parse(readFileSync(new URL(file, SRC), 'utf8'));
-
-const appSources = (app) => {
-  const file = new URL(`apps/${app}/csp.json`, SRC);
-  return existsSync(file) ? JSON.parse(readFileSync(file, 'utf8')) : {};
-};
-
-// The addresses allowed in the editor (config.csp), as an app's csp.json.
-const ALLOWED = new URL('data/csp.json', SRC);
-const allowedSources = () => (existsSync(ALLOWED) ? JSON.parse(readFileSync(ALLOWED, 'utf8')) : {});
-
-/** What the site's installed apps load from elsewhere, and the addresses allowed in the editor.
- * @returns {import('../lib/csp.mjs').Sources[]} */
-export function siteSources() {
-  return [...(json('data/apps.json').installed ?? []).map(appSources), allowedSources()];
-}
-
-/** What is wrong with the addresses allowed in the editor (src/data/csp.json): not JSON, or not written as an app's
- * csp.json must be (npm run check:content). */
-export function allowedCspProblems() {
-  try {
-    return sourcesProblems(allowedSources(), 'src/data/csp.json');
-  } catch {
-    return ['src/data/csp.json: er ikke JSON.'];
-  }
-}
-
-// A line of code that loads from an address (not a link to it): a script's or a frame's src, fetch, import …
-const LOADS = /\bsrc\b|\bsrcset\b|\bfetch\(|\bimport\(|\bsendBeacon\(|\bEventSource\(|\bWebSocket\(|\bXMLHttpRequest\b/;
-const ADDRESS = /https:\/\/[a-z0-9-]+(?:\.[a-z0-9-]+)+/gi;
-// An app's files that do not run in a browser on the site: its part of the Worker and its step after the build
-// (packages/editor/lib/apps.mjs).
-const OFF_SITE = new Set(['worker.js', 'build.mjs']);
-
-/** What is wrong with what the apps (all of them, installed or not) say they load from elsewhere: a csp.json not
- * written as it must be, or an address the app's code on the site loads from that its csp.json does not have (npm run
- * check:content). */
-export function appCspProblems() {
-  const apps = new URL('apps/', SRC);
-  if (!existsSync(apps)) return [];
-  return readdirSync(apps, { withFileTypes: true })
-    .filter((d) => d.isDirectory())
-    .flatMap(({ name: app }) => {
-      const dir = `src/apps/${app}`;
-      let sources;
-      try {
-        sources = appSources(app);
-      } catch {
-        return [`${dir}/csp.json: er ikke JSON.`];
-      }
-      const problems = sourcesProblems(sources, `${dir}/csp.json`);
-      if (problems.length) return problems;
-      const missing = new Set();
-      for (const file of readdirSync(new URL(`${app}/`, apps), { recursive: true, encoding: 'utf8' }))
-        if (/\.(tsx?|mjs|js|astro)$/.test(file) && !OFF_SITE.has(file))
-          for (const line of readFileSync(new URL(`${app}/${file}`, apps), 'utf8').split('\n'))
-            if (LOADS.test(line)) for (const [url] of line.matchAll(ADDRESS)) if (!allows(sources, url)) missing.add(new URL(url).origin);
-      return [...missing].map(
-        (origin) => `${dir}: henter fra ${origin}, men csp.json har det ikke, så sidernes Content-Security-Policy stopper det.`,
-      );
-    });
-}
+// What this site's pages may load from elsewhere, besides what the editor's package allows on every site (the
+// videos, packages/editor/lib/csp.mjs, which writes the policy into the pages): what each installed app needs
+// (src/apps/<app>/csp.json, src/data/apps.json), Google Analytics, Google Ads and Google Tag Manager too, which load
+// Google's tag once the visitor has said yes (src/scripts/tracking.ts), and the addresses allowed in the editor after
+// the policy stopped them (src/data/csp.json, config.csp: the app "Cookiescanner"'s "Blokeret adresse").
+// Read by the build (packages/editor/astro.mjs) and by npm run check:content (appCspProblems), so no TypeScript here.
+import { existsSync, readdirSync, readFileSync } from 'node:fs';
+import { pathToFileURL } from 'node:url';
+import { allows, sourcesProblems } from '../lib/csp.mjs';
+
+// The site's src/, from its root (the working directory).
+const SRC = pathToFileURL(`${process.cwd()}/src/`);
+
+const json = (file) => JSON.parse(readFileSync(new URL(file, SRC), 'utf8'));
+
+const appSources = (app) => {
+  const file = new URL(`apps/${app}/csp.json`, SRC);
+  return existsSync(file) ? JSON.parse(readFileSync(file, 'utf8')) : {};
+};
+
+// The addresses allowed in the editor (config.csp), as an app's csp.json.
+const ALLOWED = new URL('data/csp.json', SRC);
+const allowedSources = () => (existsSync(ALLOWED) ? JSON.parse(readFileSync(ALLOWED, 'utf8')) : {});
+
+/** What the site's installed apps load from elsewhere, and the addresses allowed in the editor.
+ * @returns {import('../lib/csp.mjs').Sources[]} */
+export function siteSources() {
+  return [...(json('data/apps.json').installed ?? []).map(appSources), allowedSources()];
+}
+
+/** What is wrong with the addresses allowed in the editor (src/data/csp.json): not JSON, or not written as an app's
+ * csp.json must be (npm run check:content). */
+export function allowedCspProblems() {
+  try {
+    return sourcesProblems(allowedSources(), 'src/data/csp.json');
+  } catch {
+    return ['src/data/csp.json: er ikke JSON.'];
+  }
+}
+
+// A line of code that loads from an address (not a link to it): a script's or a frame's src, fetch, import …
+const LOADS = /\bsrc\b|\bsrcset\b|\bfetch\(|\bimport\(|\bsendBeacon\(|\bEventSource\(|\bWebSocket\(|\bXMLHttpRequest\b/;
+const ADDRESS = /https:\/\/[a-z0-9-]+(?:\.[a-z0-9-]+)+/gi;
+// An app's files that do not run in a browser on the site: its part of the Worker and its step after the build
+// (packages/editor/lib/apps.mjs).
+const OFF_SITE = new Set(['worker.js', 'build.mjs']);
+
+/** What is wrong with what the apps (all of them, installed or not) say they load from elsewhere: a csp.json not
+ * written as it must be, or an address the app's code on the site loads from that its csp.json does not have (npm run
+ * check:content). */
+export function appCspProblems() {
+  const apps = new URL('apps/', SRC);
+  if (!existsSync(apps)) return [];
+  return readdirSync(apps, { withFileTypes: true })
+    .filter((d) => d.isDirectory())
+    .flatMap(({ name: app }) => {
+      const dir = `src/apps/${app}`;
+      let sources;
+      try {
+        sources = appSources(app);
+      } catch {
+        return [`${dir}/csp.json: er ikke JSON.`];
+      }
+      const problems = sourcesProblems(sources, `${dir}/csp.json`);
+      if (problems.length) return problems;
+      const missing = new Set();
+      for (const file of readdirSync(new URL(`${app}/`, apps), { recursive: true, encoding: 'utf8' }))
+        if (/\.(tsx?|mjs|js|astro)$/.test(file) && !OFF_SITE.has(file))
+          for (const line of readFileSync(new URL(`${app}/${file}`, apps), 'utf8').split('\n'))
+            if (LOADS.test(line)) for (const [url] of line.matchAll(ADDRESS)) if (!allows(sources, url)) missing.add(new URL(url).origin);
+      return [...missing].map(
+        (origin) => `${dir}: henter fra ${origin}, men csp.json har det ikke, så sidernes Content-Security-Policy stopper det.`,
+      );
+    });
+}

package/site/siteModules.mjs

@@ -1,27 +1,27 @@
-// The site's TypeScript loaded with Vite, as the build has it (its @site, @theme and apps), for the scripts that run
-// outside the build: Node itself loads no TypeScript from a package in node_modules, and follows no @site.
-import { createServer } from 'vite';
-import { appFoldersPlugin } from '../lib/apps.mjs';
-import { aliases, themePlugin } from './theme.mjs';
-
-/**
- * Runs `use` with a loader of the site's modules (`@site/collections`, `/src/apps/<id>/index.ts`), then closes it.
- * @template T
- * @param {(load: (path: string) => Promise<any>) => Promise<T>} use
- * @returns {Promise<T>}
- */
-export async function withSiteModules(use) {
-  const server = await createServer({
-    configFile: false,
-    logLevel: 'error',
-    appType: 'custom',
-    plugins: [themePlugin(), appFoldersPlugin(`${process.cwd()}/`)],
-    resolve: { alias: aliases() },
-    server: { middlewareMode: true, hmr: false, ws: false },
-  });
-  try {
-    return await use((path) => server.ssrLoadModule(path));
-  } finally {
-    await server.close();
-  }
-}
+// The site's TypeScript loaded with Vite, as the build has it (its @site, @theme and apps), for the scripts that run
+// outside the build: Node itself loads no TypeScript from a package in node_modules, and follows no @site.
+import { createServer } from 'vite';
+import { appFoldersPlugin } from '../lib/apps.mjs';
+import { aliases, themePlugin } from './theme.mjs';
+
+/**
+ * Runs `use` with a loader of the site's modules (`@site/collections`, `/src/apps/<id>/index.ts`), then closes it.
+ * @template T
+ * @param {(load: (path: string) => Promise<any>) => Promise<T>} use
+ * @returns {Promise<T>}
+ */
+export async function withSiteModules(use) {
+  const server = await createServer({
+    configFile: false,
+    logLevel: 'error',
+    appType: 'custom',
+    plugins: [themePlugin(), appFoldersPlugin(`${process.cwd()}/`)],
+    resolve: { alias: aliases() },
+    server: { middlewareMode: true, hmr: false, ws: false },
+  });
+  try {
+    return await use((path) => server.ssrLoadModule(path));
+  } finally {
+    await server.close();
+  }
+}

package/site/standardPages.ts

@@ -1,59 +1,59 @@
-// The blog page, the 404 page and the cookie policy: the pages chosen under "Indstillinger" › "Udseende" › "Standardsider"
-// (src/data/standard-pages.json, packages/editor/defaults/standardPages.ts), read for the theme's templates/Blog.astro (at /blog/) and
-// templates/NotFound.astro (the page for an address that does not exist): the page, its heading (the H1 at the top of
-// its text, else its title), its introduction (the first paragraph of the text before its first heading or block) and the
-// rest, shown, as sections: text ("text": a heading and Markdown) and each block by its type, with its fields; and where
-// the cookie banner's "Læs mere" goes (cookiesHref).
-import { slug } from 'github-slugger';
-import paths from '@data/standard-pages.json';
-import { getPages, type Page } from './content';
-import { pageH1, partsOfMarkdown, sectionsFromParts } from '@morphemecms/cms/src/sections.mjs';
-
-/** The addresses of the pages that are the front page, the blog page, the 404 page, the contact page, the privacy policy
- * and the cookie policy (their own addresses: the front page is shown at /, the blog page at /blog/, the 404 page at none,
- * the others at their own). */
-export const standardPaths: {
-  front: string;
-  blog: string;
-  notFound: string;
-  contact: string;
-  privacy: string;
-  cookies: string;
-} = paths;
-
-export type PageSection = { type: string; hidden?: boolean; heading?: string; body?: string } & Record<string, any>;
-export type StandardPageView = { page: Page; heading: string; intro?: string; sections: PageSection[] };
-
-async function read(key: 'blog' | 'notFound'): Promise<StandardPageView> {
-  const page = (await getPages({ previews: false })).find((p) => p.data.path === standardPaths[key]);
-  if (!page) throw new Error(`src/data/standard-pages.json: siden ${standardPaths[key]} findes ikke, eller den er en kladde.`);
-  const sections = (sectionsFromParts(partsOfMarkdown(page.body ?? '')) as PageSection[]).filter((s) => !s.hidden);
-  // The introduction: the first paragraph of a text without a heading at the top; the rest of that text stays a section.
-  let intro: string | undefined;
-  const first = sections[0];
-  if (first?.type === 'text' && !first.heading && first.body) {
-    const [paragraph, ...rest] = first.body.trim().split(/\n\s*\n/);
-    intro = paragraph.trim();
-    if (rest.length) first.body = rest.join('\n\n');
-    else sections.shift();
-  }
-  return { page, heading: pageH1(page.body).heading || page.data.title, intro, sections };
-}
-
-/** The blog page, shown at /blog/. */
-export const blogPage = () => read('blog');
-/** The 404 page, shown for an address that does not exist. */
-export const notFoundPage = () => read('notFound');
-
-/** The addresses the standard pages are shown at, by their own: the front page's at /, the blog page's at /blog/. */
-export const shownAt = (path: string) => (path === standardPaths.front ? '/' : path === standardPaths.blog ? '/blog/' : path);
-
-/** Where the cookie banner's "Læs mere" goes: the cookie policy, and when it is the privacy policy, its first heading about
- * cookies (its id, as Astro gives it: github-slugger), if it has one. */
-export async function cookiesHref(): Promise<string> {
-  const path = standardPaths.cookies;
-  if (path !== standardPaths.privacy) return path;
-  const page = (await getPages({ previews: false })).find((p) => p.data.path === path);
-  const heading = (page?.body ?? '').match(/^#{2,6}\s+(.*cookie.*?)\s*#*\s*$/im)?.[1];
-  return heading ? `${path}#${slug(heading)}` : path;
-}
+// The blog page, the 404 page and the cookie policy: the pages chosen under "Indstillinger" › "Udseende" › "Standardsider"
+// (src/data/standard-pages.json, packages/editor/defaults/standardPages.ts), read for the theme's templates/Blog.astro (at /blog/) and
+// templates/NotFound.astro (the page for an address that does not exist): the page, its heading (the H1 at the top of
+// its text, else its title), its introduction (the first paragraph of the text before its first heading or block) and the
+// rest, shown, as sections: text ("text": a heading and Markdown) and each block by its type, with its fields; and where
+// the cookie banner's "Læs mere" goes (cookiesHref).
+import { slug } from 'github-slugger';
+import paths from '@data/standard-pages.json';
+import { getPages, type Page } from './content';
+import { pageH1, partsOfMarkdown, sectionsFromParts } from '@morphemecms/cms/src/sections.mjs';
+
+/** The addresses of the pages that are the front page, the blog page, the 404 page, the contact page, the privacy policy
+ * and the cookie policy (their own addresses: the front page is shown at /, the blog page at /blog/, the 404 page at none,
+ * the others at their own). */
+export const standardPaths: {
+  front: string;
+  blog: string;
+  notFound: string;
+  contact: string;
+  privacy: string;
+  cookies: string;
+} = paths;
+
+export type PageSection = { type: string; hidden?: boolean; heading?: string; body?: string } & Record<string, any>;
+export type StandardPageView = { page: Page; heading: string; intro?: string; sections: PageSection[] };
+
+async function read(key: 'blog' | 'notFound'): Promise<StandardPageView> {
+  const page = (await getPages({ previews: false })).find((p) => p.data.path === standardPaths[key]);
+  if (!page) throw new Error(`src/data/standard-pages.json: siden ${standardPaths[key]} findes ikke, eller den er en kladde.`);
+  const sections = (sectionsFromParts(partsOfMarkdown(page.body ?? '')) as PageSection[]).filter((s) => !s.hidden);
+  // The introduction: the first paragraph of a text without a heading at the top; the rest of that text stays a section.
+  let intro: string | undefined;
+  const first = sections[0];
+  if (first?.type === 'text' && !first.heading && first.body) {
+    const [paragraph, ...rest] = first.body.trim().split(/\n\s*\n/);
+    intro = paragraph.trim();
+    if (rest.length) first.body = rest.join('\n\n');
+    else sections.shift();
+  }
+  return { page, heading: pageH1(page.body).heading || page.data.title, intro, sections };
+}
+
+/** The blog page, shown at /blog/. */
+export const blogPage = () => read('blog');
+/** The 404 page, shown for an address that does not exist. */
+export const notFoundPage = () => read('notFound');
+
+/** The addresses the standard pages are shown at, by their own: the front page's at /, the blog page's at /blog/. */
+export const shownAt = (path: string) => (path === standardPaths.front ? '/' : path === standardPaths.blog ? '/blog/' : path);
+
+/** Where the cookie banner's "Læs mere" goes: the cookie policy, and when it is the privacy policy, its first heading about
+ * cookies (its id, as Astro gives it: github-slugger), if it has one. */
+export async function cookiesHref(): Promise<string> {
+  const path = standardPaths.cookies;
+  if (path !== standardPaths.privacy) return path;
+  const page = (await getPages({ previews: false })).find((p) => p.data.path === path);
+  const heading = (page?.body ?? '').match(/^#{2,6}\s+(.*cookie.*?)\s*#*\s*$/im)?.[1];
+  return heading ? `${path}#${slug(heading)}` : path;
+}

package/site/storeTheme.d.mts

@@ -0,0 +1,6 @@
+/** What is wrong with the imports in a store theme's CSS file.
+ * @param {string} css the file's text
+ * @param {string} file its path in the theme, e.g. 'styles/global.css'
+ * @returns {string[]}
+ */
+export function storeImportProblems(css: string, file: string): string[];

package/site/storeTheme.mjs

@@ -0,0 +1,29 @@
+// Keeps a store theme's CSS to imports from the CMS and its own files, which is all that is there on a site that
+// installs it. Exposes storeImportProblems, the problems in one CSS file's imports. Depends on node:path only.
+import { posix } from 'node:path';
+
+/** What is wrong with the imports in a store theme's CSS file.
+ * @param {string} css the file's text
+ * @param {string} file its path in the theme, e.g. 'styles/global.css'
+ * @returns {string[]}
+ */
+export function storeImportProblems(css, file) {
+  const text = css.replace(/\/\*[\s\S]*?\*\//g, '');
+  // One pass over both forms, so the targets come in the order they appear in the text.
+  const targets = [];
+  const targetRe = /@import\s+(['"])(.*?)\1|url\(\s*(['"]?)(.*?)\3\s*\)/g;
+  let match;
+  while ((match = targetRe.exec(text))) targets.push(match[2] !== undefined ? match[2] : match[4].trim());
+
+  return targets
+    .filter((target) => {
+      if (target.startsWith('data:')) return false;
+      if (target.startsWith('@morphemecms/cms/')) return false;
+      if (target.startsWith('./') || target.startsWith('../')) {
+        const joined = posix.normalize(posix.join(posix.dirname(file), target));
+        if (joined !== '..' && !joined.startsWith('../')) return false;
+      }
+      return true;
+    })
+    .map((target) => `${file}: et tema i butikken må kun importere fra @morphemecms/cms og sine egne filer, ikke "${target}".`);
+}

package/site/storeTheme.test.d.mts

@@ -0,0 +1 @@
+export {};

package/site/storeTheme.test.mjs

@@ -0,0 +1,53 @@
+// What is wrong with a store theme's CSS imports: only the CMS and its own files are allowed.
+// Run with `node --test packages/editor/site/*.test.mjs` (part of npm run check).
+import { strict as assert } from 'node:assert';
+import { test } from 'node:test';
+import { storeImportProblems } from './storeTheme.mjs';
+
+const F = 'styles/global.css';
+const expected = (target) => `${F}: et tema i butikken må kun importere fra @morphemecms/cms og sine egne filer, ikke "${target}".`;
+
+test('an import of the CMS is allowed', () => {
+  const css = `@import '@morphemecms/cms/theme/styles/base.css';`;
+  assert.deepEqual(storeImportProblems(css, F), []);
+});
+
+test('an npm package is not there', () => {
+  const css = `@import '@fontsource-variable/outfit';`;
+  assert.deepEqual(storeImportProblems(css, F), [expected('@fontsource-variable/outfit')]);
+});
+
+test('a font in the theme is allowed', () => {
+  const css = `@font-face { src: url('../fonts/a.woff2') format('woff2'); }`;
+  assert.deepEqual(storeImportProblems(css, F), []);
+});
+
+test('a path that leaves the theme is not there', () => {
+  const css = `@font-face { src: url('../../x.woff2'); }`;
+  assert.deepEqual(storeImportProblems(css, F), [expected('../../x.woff2')]);
+});
+
+test('a font from another host is not there', () => {
+  const css = `@font-face { src: url(https://fonts.example/a.woff2); }`;
+  assert.deepEqual(storeImportProblems(css, F), [expected('https://fonts.example/a.woff2')]);
+});
+
+test('a data URI is allowed', () => {
+  const css = `@font-face { src: url(data:font/woff2;base64,AA); }`;
+  assert.deepEqual(storeImportProblems(css, F), []);
+});
+
+test('two targets outside the theme are two problems', () => {
+  const css = `@import 'https://a.example/x.css';\n@import url("other-package/x.css");`;
+  assert.deepEqual(storeImportProblems(css, F), [expected('https://a.example/x.css'), expected('other-package/x.css')]);
+});
+
+test('the problems come in the order of the text', () => {
+  const css = `@font-face { src: url(https://a.example/x); }\n@import 'b';`;
+  assert.deepEqual(storeImportProblems(css, F), [expected('https://a.example/x'), expected('b')]);
+});
+
+test('an import in a comment is not there', () => {
+  const css = `/* @import 'left-out'; */ @import './ui.css';`;
+  assert.deepEqual(storeImportProblems(css, F), []);
+});