@morphemecms/cms 0.4.0 → 0.5.0-next-20261104215254

package/CHANGELOG.md

@@ -1,5 +1,18 @@
 # @morphemecms/cms
 
+## 0.5.0-next-20261104215254
+
+### Minor Changes
+
+- 322a404: Connect a site to the Morpheme store from the editor's Appstore. A key set by hand in MORPHEME_STORE_KEY still works.
+
+### Patch Changes
+
+- eb1f36f: A site's build reads Phosphor's icons one at a time, so it passes on Cloudflare's build image, which allows 1024 open files.
+- 6844676: The editor's start screen shows the installed CMS version before the update time, e.g. "Morpheme 0.5.0 · Updated 19.26". A pre-release shows short ("0.5.0-next"); a click shows the full version.
+- 2fa2bb3: New sites install a fixed postcss-selector-parser (6.1.5) under @tailwindcss/typography, which closes CVE-2026-104844.
+- f343523: The package has the types of the theme's `editor/looks.mjs`, so a site's type check (`tsc`) passes again.
+
 ## 0.4.0
 
 ### Minor Changes

package/bin/morpheme.mjs

@@ -12,7 +12,7 @@ const COMMANDS = {
   'after-build': ['scheduled-list', 'link-counts', 'page-colors'],
   'check:content': ['check-content'],
   'check:editor': ['editor-roundtrip'],
-  'check:worker': ['check-worker', 'check-consent', 'check-store', 'check-cms-update'],
+  'check:worker': ['check-worker', 'check-consent', 'check-store', 'check-cms-update', 'check-store-connection'],
   'check:screens': ['editor-screens'],
   'check:themes': ['check-themes'],
   'check:demo': ['check-demo'],
@@ -24,7 +24,7 @@ const COMMANDS = {
 };
 
 // Node warns that node:sqlite is experimental, which the consent log's check uses as D1.
-const QUIET = new Set(['check-consent']);
+const QUIET = new Set(['check-consent', 'check-store-connection']);
 
 const [command, ...args] = process.argv.slice(2);
 if (!COMMANDS[command]) {

package/lib/licenses.mjs

@@ -428,7 +428,7 @@ const HELPERS = [
   [/^\0vite\//, 'vite'],
   [/^\0rolldown\//, 'rolldown'],
 ];
-const OWN_VIRTUAL = [/^\0virtual:app-folders$/, /^\0site-theme-icons?(:|$)/];
+const OWN_VIRTUAL = [/^\0virtual:(app-folders|all-icons)$/, /^\0site-theme-icons?(:|$)/];
 
 /** An app or a theme as licensesIntegration takes it: its kind and id, its name, version and who made it, its manifest
  * (its defineApp or its theme.json, with `license` and `thirdParty`), its folder, and whether the site is built with it

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@morphemecms/cms",
-  "version": "0.4.0",
+  "version": "0.5.0-next-20261104215254",
   "description": "Morpheme CMS: the editor for a site built with Astro, its screens, its blocks and the rules a site gives it. See README.md.",
   "license": "MIT",
   "author": "Lars Adolfsen",
@@ -138,5 +138,10 @@
     "vite": "^8.3.4",
     "wrangler": "^4.152.0",
     "yaml": "^2.9.1"
+  },
+  "overrides": {
+    "@tailwindcss/typography": {
+      "postcss-selector-parser": "^6.1.5"
+    }
   }
 }

package/scripts/built-site.mjs

@@ -124,19 +124,36 @@ const CMS_STATUS = {
   notes: [{ version: '99.0.0', text: 'A made-up note for the checks.\n\nA second paragraph.' }],
 };
 
+// The site's key to the store (/api/store/connection, packages/editor/worker/store-connection.js), made up, in the three
+// states "Appstore" shows: a key from the button, no key and the editor may connect, no key and it may only read. A POST
+// or DELETE moves a fake store between the first two, as the Worker would.
+export const STORE_STATES = {
+  button: { connected: true, by: 'button', site: 'site_sample', since: '2026-11-04T08:00:00.000Z', mayChange: true },
+  open: { connected: false, mayChange: true },
+  readOnly: { connected: false, mayChange: false },
+};
+
 /** Opens the editor (/editor/) of the site at `site` in `page`, signed in, with GitHub answered from the files on disk
- * (`texts`: some with other texts), and waits until it has loaded the site. */
-export async function openEditor(page, site, texts = {}) {
+ * (`texts`: some with other texts), and waits until it has loaded the site. `store`: the state of the site's key to the
+ * store (a key of STORE_STATES). */
+export async function openEditor(page, site, texts = {}, store = 'button') {
+  let state = STORE_STATES[store];
   // R2 caching under "Avanceret": Cloudflare has the bucket (packages/editor/worker/r2-status.js).
   await page.route(`${site}/api/r2?**`, (r) =>
     r.fulfill({ contentType: 'application/json', body: JSON.stringify({ bound: false, bucket: 'ready' }) }),
   );
   await page.route(`${site}/api/cms`, (r) => r.fulfill({ contentType: 'application/json', body: JSON.stringify(CMS_STATUS) }));
-  await page.route(`${site}/api/store/**`, (r) =>
-    new URL(r.request().url()).pathname === '/api/store/catalog'
-      ? r.fulfill({ contentType: 'application/json', body: JSON.stringify(STORE_CATALOG) })
-      : r.fulfill({ status: 404 }),
-  );
+  await page.route(`${site}/api/store/**`, (r) => {
+    const path = new URL(r.request().url()).pathname;
+    const answer = (body) => r.fulfill({ contentType: 'application/json', body: JSON.stringify(body) });
+    if (path === '/api/store/catalog') return answer(state.connected ? STORE_CATALOG : { connected: false });
+    if (path === '/api/store/connection') {
+      if (r.request().method() === 'POST') state = STORE_STATES.button;
+      if (r.request().method() === 'DELETE') state = STORE_STATES.open;
+      return answer(state);
+    }
+    return r.fulfill({ status: 404 });
+  });
   await page.route(`${site}/api/github/**`, (r) => {
     const route = new URL(r.request().url()).pathname.slice('/api/github/'.length);
     const found = workerAnswer(route, JSON.parse(r.request().postData() || '{}'), texts);

package/scripts/check-store-connection.mjs

@@ -0,0 +1,226 @@
+// Checks how the site's Worker gets and keeps a store key from "Connect to Morpheme" (packages/editor/worker/store-connection.js):
+// /api/store/connection for GET, POST and DELETE, who may do what, the table with the key (D1 played by Node's SQLite), and
+// storeKey(). GitHub and the store are played by a fake fetch that records each request; nothing goes to either.
+// Run: npm run check:worker
+import { DatabaseSync } from 'node:sqlite';
+import { workerModules } from './worker-modules.mjs';
+
+const [{ handleConnection, storeKey, forgetKey }] = await workerModules('store-connection.js', 'session.js', 'store.js');
+
+const problems = [];
+const expect = (ok, what) => ok || problems.push(what);
+
+/** D1, as much of it as the Worker uses, on an SQLite database in memory. */
+function d1() {
+  const db = new DatabaseSync(':memory:');
+  const statement = (sql, args = []) => ({
+    bind: (...values) => statement(sql, values),
+    run: async () => ({ meta: { changes: Number(db.prepare(sql).run(...args).changes) } }),
+    all: async () => ({ results: db.prepare(sql).all(...args) }),
+    first: async (column) => db.prepare(sql).get(...args)?.[column] ?? null,
+  });
+  return { db, prepare: (sql) => statement(sql), batch: async (list) => Promise.all(list.map((s) => s.run())) };
+}
+const rowsOf = (store) => store.db.prepare('SELECT site, key FROM store_connection').all();
+
+const SITE = `site_${'a1'.repeat(12)}`;
+const KEY = 'isk_x';
+const HAND = 'hand-key-for-test';
+
+/** A fake fetch: GitHub says what `repoAccess` says; the store answers with `store(url, init)`. `storeCalls` records its requests. */
+function world({ repoAccess = { pull: true, push: true }, store = () => Response.json({ site: SITE, key: KEY }, { status: 201 }) } = {}) {
+  const storeCalls = [];
+  const ask = async (url, init = {}) => {
+    if (String(url).startsWith('https://api.github.com/')) return Response.json({ permissions: repoAccess });
+    storeCalls.push({ url: String(url), method: init.method ?? 'GET', headers: init.headers ?? {}, body: init.body });
+    return store(String(url), init);
+  };
+  return { ask, storeCalls };
+}
+
+let n = 0;
+/** A request from the editor's page; a fresh token each time (the Worker remembers what GitHub said about a token). */
+const call = async (w, method, env, { signedIn = true } = {}) => {
+  const request = new Request('https://site.example/api/store/connection', {
+    method,
+    headers: { ...(signedIn ? { cookie: `editor_session=token-${++n}` } : {}), 'sec-fetch-site': 'same-origin' },
+  });
+  const res = await handleConnection(request, env, {}, w.ask);
+  const text = await res.text();
+  return { res, text, body: text.startsWith('{') ? JSON.parse(text) : null };
+};
+/** An env with a fresh database, with a row for each [site, key] given. */
+const envWith = async (rows = [], extra = {}) => {
+  const CONSENT = d1();
+  if (rows.length) {
+    await call(world(), 'GET', { CONSENT }); // makes the table on first use
+    for (const [site, key] of rows) {
+      CONSENT.db.prepare('INSERT INTO store_connection (site, key, connected) VALUES (?, ?, ?)').run(site, key, '2026-11-04T10:00:00.000Z');
+    }
+  }
+  return { CONSENT, ...extra };
+};
+
+// Signed out: 401 for each method, and the store is not asked.
+for (const method of ['GET', 'POST', 'DELETE']) {
+  const w = world();
+  const { res } = await call(w, method, await envWith(), { signedIn: false });
+  expect(res.status === 401, `uden login var ${method} ${res.status}, ikke 401`);
+  expect(w.storeCalls.length === 0, `uden login blev butikken spurgt (${method})`);
+}
+
+// Not even allowed to read: 403.
+{
+  const w = world({ repoAccess: { pull: false, push: false } });
+  const { res } = await call(w, 'GET', await envWith());
+  expect(res.status === 403, `uden læseret var svaret ${res.status}, ikke 403`);
+}
+
+// Read-only: GET works, POST and DELETE are 403, and the store is not asked.
+{
+  const w = world({ repoAccess: { pull: true, push: false } });
+  const env = await envWith();
+  const get = await call(w, 'GET', env);
+  expect(get.res.status === 200 && get.body.connected === false && get.body.mayChange === false, `GET med kun læseret gav ${get.text}`);
+  for (const method of ['POST', 'DELETE']) {
+    const { res } = await call(w, method, env);
+    expect(res.status === 403, `${method} med kun læseret gav ${res.status}, ikke 403`);
+  }
+  expect(w.storeCalls.length === 0, 'med kun læseret blev butikken spurgt');
+  expect(rowsOf(env.CONSENT).length === 0, 'med kun læseret blev der gemt en række');
+}
+
+// Connect: the store gets the origin and owner/name; the row has the key; no answer has the key; a second connect is 409.
+{
+  const w = world();
+  const env = await envWith();
+  const { res, text, body } = await call(w, 'POST', env);
+  expect(
+    res.status === 200 &&
+      body.connected === true &&
+      body.by === 'button' &&
+      body.site === SITE &&
+      body.mayChange === true &&
+      typeof body.since === 'string',
+    `POST gav ${res.status} ${text}`,
+  );
+  expect(!text.includes(KEY), 'svaret på POST indeholdt nøglen');
+  expect(w.storeCalls.length === 1 && w.storeCalls[0].method === 'POST', `butikken blev spurgt ${w.storeCalls.length} gange`);
+  expect(w.storeCalls[0]?.url.endsWith('/store/connect'), `adressen var ${w.storeCalls[0]?.url}`);
+  const sent = JSON.parse(w.storeCalls[0]?.body ?? '{}');
+  expect(sent.address === 'https://site.example' && /^[^/]+\/[^/]+$/.test(sent.repo), `butikken fik ${w.storeCalls[0]?.body}`);
+  const rows = rowsOf(env.CONSENT);
+  expect(rows.length === 1 && rows[0].site === SITE && rows[0].key === KEY, 'rækken har ikke nøglen');
+  const get = await call(w, 'GET', env);
+  expect(get.body.by === 'button' && get.body.site === SITE && !get.text.includes(KEY), `GET efter POST gav ${get.text}`);
+  const second = await call(w, 'POST', env);
+  expect(second.res.status === 409, `en anden POST gav ${second.res.status}, ikke 409`);
+  expect(w.storeCalls.length === 1, 'en anden POST spurgte butikken');
+  // MORPHEME_STORE_URL is used when set.
+  const w2 = world();
+  await call(w2, 'POST', await envWith([], { MORPHEME_STORE_URL: 'https://store.example' }));
+  expect(w2.storeCalls[0]?.url === 'https://store.example/store/connect', `MORPHEME_STORE_URL blev ikke brugt: ${w2.storeCalls[0]?.url}`);
+}
+
+// The store's 429: 429 and no row. Its 500, an answer without a key, or a thrown fetch: 502 and no row.
+{
+  const env = await envWith();
+  const { res, body } = await call(world({ store: () => new Response('{}', { status: 429 }) }), 'POST', env);
+  expect(res.status === 429 && body.error === 'busy', `butikkens 429 gav ${res.status}`);
+  expect(rowsOf(env.CONSENT).length === 0, 'butikkens 429 gav en række');
+}
+for (const [what, store] of [
+  ['500', () => new Response(`secret ${KEY}`, { status: 500 })],
+  ['et svar uden nøgle', () => Response.json({ site: SITE }, { status: 201 })],
+  [
+    'en netværksfejl',
+    () => {
+      throw new Error(`no network, ${KEY}`);
+    },
+  ],
+]) {
+  const env = await envWith();
+  const { res, text, body } = await call(world({ store }), 'POST', env);
+  expect(res.status === 502 && body.error === 'store failed', `butikkens ${what} gav ${res.status} ${text}`);
+  expect(!text.includes(KEY), `svaret på butikkens ${what} indeholdt nøglen`);
+  expect(rowsOf(env.CONSENT).length === 0, `butikkens ${what} gav en række`);
+}
+
+// No database (a branch preview): GET says not connected, POST is 503.
+{
+  const w = world();
+  const get = await call(w, 'GET', {});
+  expect(get.res.status === 200 && get.body.connected === false, `GET uden CONSENT gav ${get.text}`);
+  const post = await call(w, 'POST', {});
+  expect(post.res.status === 503 && post.body.error === 'no database', `POST uden CONSENT gav ${post.res.status}`);
+  expect(w.storeCalls.length === 0, 'POST uden CONSENT spurgte butikken');
+}
+
+// A key set by hand: GET says so, POST and DELETE are 409, and the store is not asked.
+{
+  const w = world();
+  const env = await envWith([], { MORPHEME_STORE_KEY: HAND });
+  const get = await call(w, 'GET', env);
+  expect(get.body.connected === true && get.body.by === 'hand' && !get.text.includes(HAND), `GET med nøgle i hånden gav ${get.text}`);
+  expect((await call(w, 'DELETE', env)).res.status === 409, 'DELETE med nøgle i hånden gav ikke 409');
+  expect((await call(w, 'POST', env)).res.status === 409, 'POST med nøgle i hånden gav ikke 409');
+  expect(w.storeCalls.length === 0, 'med nøgle i hånden blev butikken spurgt');
+}
+
+// Disconnect: on the store's 200 or 401 the row goes (the bearer is the row's key); on 500 or a thrown fetch it stays.
+for (const status of [200, 401]) {
+  const w = world({ store: () => new Response('{}', { status }) });
+  const env = await envWith([[SITE, KEY]]);
+  const { res, body, text } = await call(w, 'DELETE', env);
+  expect(
+    res.status === 200 && body.connected === false && body.mayChange === true,
+    `DELETE med butikkens ${status} gav ${res.status} ${text}`,
+  );
+  expect(rowsOf(env.CONSENT).length === 0, `DELETE med butikkens ${status} lod rækken stå`);
+  expect(w.storeCalls[0]?.method === 'DELETE' && w.storeCalls[0].url.endsWith('/store/connect'), 'DELETE spurgte ikke butikken rigtigt');
+  expect(w.storeCalls[0]?.headers.authorization === `Bearer ${KEY}`, 'DELETE brugte ikke rækkens nøgle som bearer');
+}
+for (const store of [
+  () => new Response('{}', { status: 500 }),
+  () => {
+    throw new Error('no network');
+  },
+]) {
+  const env = await envWith([[SITE, KEY]]);
+  const { res, body } = await call(world({ store }), 'DELETE', env);
+  expect(res.status === 502 && body.error === 'store failed', `DELETE med en fejl i butikken gav ${res.status}`);
+  expect(rowsOf(env.CONSENT).length === 1, 'DELETE med en fejl i butikken slettede rækken');
+}
+// No key at all: DELETE is a quiet 200 and the store is not asked.
+{
+  const w = world();
+  const { res, body } = await call(w, 'DELETE', await envWith());
+  expect(res.status === 200 && body.connected === false, `DELETE uden nøgle gav ${res.status}`);
+  expect(w.storeCalls.length === 0, 'DELETE uden nøgle spurgte butikken');
+}
+
+// Other methods: 405.
+expect((await call(world(), 'PUT', await envWith())).res.status === 405, 'PUT gav ikke 405');
+
+// storeKey: the hand key first, then the row, else null; forgetKey deletes the rows.
+{
+  const env = await envWith([[SITE, KEY]], { MORPHEME_STORE_KEY: HAND });
+  const hand = await storeKey(env);
+  expect(hand?.key === HAND && hand.by === 'hand', `storeKey med begge gav ${JSON.stringify(hand)}`);
+  const row = await storeKey({ CONSENT: env.CONSENT });
+  expect(
+    row?.key === KEY && row.by === 'button' && row.site === SITE && typeof row.since === 'string',
+    `storeKey med en række gav ${JSON.stringify(row)}`,
+  );
+  expect((await storeKey({ MORPHEME_STORE_KEY: HAND }))?.by === 'hand', 'storeKey uden CONSENT gav ikke nøglen i hånden');
+  expect((await storeKey({})) === null, 'storeKey uden noget gav ikke null');
+  await forgetKey(env);
+  expect(rowsOf(env.CONSENT).length === 0, 'forgetKey slettede ikke rækken');
+  expect((await storeKey({ CONSENT: env.CONSENT })) === null, 'storeKey efter forgetKey gav ikke null');
+}
+
+if (problems.length) {
+  console.error(problems.map((p) => `- ${p}`).join('\n'));
+  process.exit(1);
+}
+console.log('Workerens nøgle fra Forbind til Morpheme er i orden.');

package/scripts/check-store.mjs

@@ -1,11 +1,13 @@
 // Checks the site's Worker's questions to the store (packages/editor/worker/store.js): /api/store/catalog and /api/store/files/<oid>,
-// who may ask, what happens without a key, and the store's refusals and failures. GitHub and the store are played by a fake
-// fetch that records each request; nothing goes to either.
+// who may ask, what happens without a key, the key from the button (in D1, played by Node's SQLite) that is forgotten when
+// the store refuses it, and the store's refusals and failures. GitHub and the store are played by a fake fetch that records
+// each request; nothing goes to either.
 // Run: npm run check:worker
 import { APP_API, THEME_API } from '../lib/contracts.mjs';
+import { DatabaseSync } from 'node:sqlite';
 import { workerModules } from './worker-modules.mjs';
 
-const [{ handleStore, STORE_URL }] = await workerModules('store.js', 'session.js');
+const [{ handleStore, STORE_URL }, , { storeKey }] = await workerModules('store.js', 'session.js', 'store-connection.js');
 
 const problems = [];
 const expect = (ok, what) => ok || problems.push(what);
@@ -25,6 +27,28 @@ function world({ repoAccess = { pull: true, push: false }, store = () => new Res
   return { ask, storeCalls };
 }
 
+/** D1, as much of it as the Worker uses, on an SQLite database in memory. */
+function d1() {
+  const db = new DatabaseSync(':memory:');
+  const statement = (sql, args = []) => ({
+    bind: (...values) => statement(sql, values),
+    run: async () => ({ meta: { changes: Number(db.prepare(sql).run(...args).changes) } }),
+    all: async () => ({ results: db.prepare(sql).all(...args) }),
+    first: async (column) => db.prepare(sql).get(...args)?.[column] ?? null,
+  });
+  return { db, prepare: (sql) => statement(sql), batch: async (list) => Promise.all(list.map((s) => s.run())) };
+}
+/** An env with a key from the button in its database (the table is made by storeKey, as on first use). */
+async function envWithRow(key) {
+  const CONSENT = d1();
+  await storeKey({ CONSENT });
+  CONSENT.db
+    .prepare('INSERT INTO store_connection (site, key, connected) VALUES (?, ?, ?)')
+    .run(`site_${'a1'.repeat(12)}`, key, '2026-11-04T10:00:00.000Z');
+  return { CONSENT };
+}
+const rowCount = (env) => env.CONSENT.db.prepare('SELECT COUNT(*) AS n FROM store_connection').get().n;
+
 let n = 0;
 /** A request from the editor's page; a fresh token each time (the Worker remembers what GitHub said about a token). */
 const request = (path, { signedIn = true, method = 'GET' } = {}) =>
@@ -145,6 +169,32 @@ for (const [status, error] of [
   expect(!text.includes(KEY), 'svaret på en netværksfejl indeholdt nøglen');
 }
 
+// A key from the button: the store gets it as the bearer; when the store refuses it, the row goes, the catalog says
+// "not connected" and a file is not found. A key set by hand that is refused stays a 502.
+{
+  const w = world();
+  await call(w, 'catalog', await envWithRow('isk_row'));
+  expect(
+    w.storeCalls[0]?.headers.authorization === 'Bearer isk_row',
+    `kataloget blev spurgt med ${w.storeCalls[0]?.headers.authorization}`,
+  );
+}
+for (const status of [401, 403]) {
+  for (const path of ['catalog', `files/${OID}`]) {
+    const env = await envWithRow('isk_row');
+    const { res, text } = await call(world({ store: () => new Response('no', { status }) }), path, env);
+    const want = path === 'catalog' ? res.status === 200 && JSON.parse(text).connected === false : res.status === 404;
+    expect(want, `butikkens ${status} på ${path} med en nøgle fra knappen gav ${res.status} ${text}`);
+    expect(rowCount(env) === 0, `butikkens ${status} på ${path} lod nøglen fra knappen stå`);
+  }
+}
+{
+  const env = { ...(await envWithRow('isk_row')), MORPHEME_STORE_KEY: KEY };
+  const { res, text } = await call(world({ store: () => new Response('no', { status: 401 }) }), 'catalog', env);
+  expect(res.status === 502 && JSON.parse(text).error === 'store refused', `en nøgle i hånden, der blev afvist, gav ${res.status} ${text}`);
+  expect(rowCount(env) === 1, 'en nøgle i hånden, der blev afvist, slettede rækken');
+}
+
 // Other methods and addresses.
 {
   const w = world();

package/scripts/editor-screens.mjs

@@ -10,6 +10,8 @@
 import { existsSync, readFileSync, readdirSync } from 'node:fs';
 import { join, relative, resolve } from 'node:path';
 import { chromium } from 'playwright';
+import { mkdirSync } from 'node:fs';
+import { tmpdir } from 'node:os';
 import { openEditor, serveBuilt } from './built-site.mjs';
 
 const ROOT = `${process.cwd()}/`;
@@ -92,6 +94,30 @@ for (const [width, height] of [
   await page.close();
 }
 
+// "Appstore" in the three states of the site's key to the store (STORE_STATES): what each shows, and a picture of it in
+// SCREENS_DIR (the temporary folder's morpheme-screens by default).
+const shots = process.env.SCREENS_DIR || join(tmpdir(), 'morpheme-screens');
+mkdirSync(shots, { recursive: true });
+const keyStates = {
+  open: { shows: ['Hjemmesiden er ikke forbundet til Morpheme', 'Forbind til Morpheme'], hides: ['Afbryd forbindelsen til Morpheme'] },
+  readOnly: { shows: ['Hjemmesiden har ingen Appstore'], hides: ['Forbind til Morpheme', 'Afbryd forbindelsen til Morpheme'] },
+  button: { shows: ['Forbundet til Morpheme', 'site_sample', 'Afbryd forbindelsen til Morpheme'], hides: ['Forbind til Morpheme'] },
+};
+for (const [state, { shows, hides }] of Object.entries(keyStates)) {
+  const page = await browser.newPage({ viewport: { width: 390, height: 844 }, locale: 'da-DK' });
+  page.on('pageerror', (e) => problems.push(`Appstore (${state}): ${e.message}`));
+  await openEditor(page, site, {}, state);
+  await page.evaluate(() => (location.hash = 'indstillinger/appstore'));
+  await page.waitForTimeout(500);
+  const text = await page.evaluate(() => document.body.innerText);
+  for (const x of shows) if (!text.includes(x)) problems.push(`Appstore (${state}): "${x}" mangler`);
+  for (const x of hides) if (text.includes(x)) problems.push(`Appstore (${state}): "${x}" skal ikke vises`);
+  const file = join(shots, `appstore-${state}.png`);
+  await page.screenshot({ path: file });
+  console.log(`Appstore (${state}): ${file}`);
+  await page.close();
+}
+
 await browser.close();
 server.close();
 if (problems.length) {

package/scripts/types-include.test.mjs

@@ -0,0 +1,93 @@
+// Tests that every .mjs module imported by TypeScript or Astro files in the package is included in tsconfig.types.json.
+// This is required because TypeScript reads no types from JavaScript in node_modules, so a site's tsc fails without a .d.mts.
+
+import assert from 'node:assert/strict';
+import fs from 'node:fs';
+import path from 'node:path';
+import test from 'node:test';
+import { fileURLToPath } from 'node:url';
+
+const PACKAGE = fileURLToPath(new URL('..', import.meta.url));
+
+const tsconfigRaw = fs.readFileSync(path.join(PACKAGE, 'tsconfig.types.json'), 'utf-8');
+const tsconfigJson = JSON.parse(
+  tsconfigRaw
+    .split('\n')
+    .filter((line) => !line.trimStart().startsWith('//'))
+    .join('\n'),
+);
+const include = tsconfigJson.include;
+
+function matches(filePath, pattern) {
+  if (pattern.includes('**')) {
+    const dir = pattern.replace('/**/*.mjs', '');
+    return filePath.startsWith(`${dir}/`) && filePath.endsWith('.mjs');
+  }
+  return filePath === pattern;
+}
+
+function sources(dir) {
+  const results = [];
+  const entries = fs.readdirSync(dir, { withFileTypes: true });
+  for (const entry of entries) {
+    if (entry.name.startsWith('.') || entry.name === 'node_modules') {
+      continue;
+    }
+    const fullPath = path.join(dir, entry.name);
+    if (entry.isDirectory()) {
+      results.push(...sources(fullPath));
+    } else if (entry.name.endsWith('.ts') || entry.name.endsWith('.tsx') || entry.name.endsWith('.astro')) {
+      if (!entry.name.endsWith('.d.ts')) {
+        results.push(path.relative(PACKAGE, fullPath).replace(/\\/g, '/'));
+      }
+    }
+  }
+  return results;
+}
+
+function mjsImports(text) {
+  const regex = /(?:from\s+|import\s*\()\s*(['"])([^'"]+\.mjs)\1/g;
+  const specs = [];
+  let match;
+  while ((match = regex.exec(text)) !== null) {
+    specs.push(match[2]);
+  }
+  return specs;
+}
+
+function resolve(file, spec) {
+  if (spec.startsWith('@theme/')) {
+    return `theme/${spec.slice('@theme/'.length)}`;
+  }
+  if (spec.startsWith('.')) {
+    const dir = path.dirname(file);
+    return path.relative(PACKAGE, path.join(dir, spec)).replace(/\\/g, '/');
+  }
+  return null;
+}
+
+test('each .mjs a .ts, .tsx or .astro file imports is in tsconfig.types.json include', () => {
+  const missing = [];
+  const files = sources(PACKAGE);
+  for (const file of files) {
+    const content = fs.readFileSync(path.join(PACKAGE, file), 'utf-8');
+    const imports = mjsImports(content);
+    for (const spec of imports) {
+      const resolvedPath = resolve(file, spec);
+      if (resolvedPath !== null) {
+        const isMatched = include.some((pattern) => matches(resolvedPath, pattern));
+        if (!isMatched) {
+          missing.push({ file, spec, path: resolvedPath });
+        }
+      }
+    }
+  }
+  assert.deepEqual(missing, []);
+});
+
+test('matches', () => {
+  assert.equal(matches('theme/editor/looks.mjs', 'theme/**/*.mjs'), true);
+  assert.equal(matches('theme/editor/looks.mjs', 'lib/**/*.mjs'), false);
+  assert.equal(matches('scripts/releases.mjs', 'scripts/releases.mjs'), true);
+  assert.equal(matches('scripts/other.mjs', 'scripts/releases.mjs'), false);
+});

package/site/theme.d.mts

@@ -30,6 +30,10 @@ export function motionProblems(): string[];
 /** What is wrong with the system's icon packs (packProblems; a theme's own are its themeProblems) and the choice of one:
  * src/data/icons.json naming one that is not there. */
 export function iconPackProblems(): string[];
+/** The module code of all Phosphor's icons in `folder` (its `regular/` folder), by the keys `import.meta.glob` gave, the
+ * theme's (`icons`, as themeIcons returns them) in place of Phosphor's own. The files are read one at a time: a glob
+ * opens them all at once, and the build image's limit of open files (1024) stops the build. */
+export function allIconsModule(folder: any, icons: any): string;
 /** What a theme is missing (the standard theme: of THEME_FILES and the look of every standard block, another: of
  * OWN_FILES), what is wrong in its theme.json (name, version, author, icon), a block of its own (a folder in its
  * blocks/ that is not the look of a standard block, or with a block's contract in it), a part nothing uses (in a
@@ -76,6 +80,8 @@ export const THEME_FILES: string[];
 export function installedThemes(): string[];
 /** What every theme has itself. */
 export const OWN_FILES: string[];
+/** The virtual module with all Phosphor's icons (regular) as text (src/allIcons.ts). */
+export const ALL_ICONS: "virtual:all-icons";
 export function aliases(): {
     '@data': string;
     '@saturn': string;

package/site/theme.mjs

@@ -4,9 +4,9 @@
 // theme or the look of a block, is the standard theme's, styled by the theme in use's CSS. The site and the editor
 // reach the theme as @theme (themePlugin: the theme in use's file, else the standard theme's), and the site's own
 // parts (src/site/) as @site (aliases): for packages/editor/astro.mjs and packages/editor/scripts/check-content.mjs. Stops with what is
-// wrong, when the theme named is not installed.
+// wrong, when the theme named is not installed. Also the virtual module with all Phosphor's icons (allIconsModule).
 import { existsSync, readdirSync, readFileSync, statSync } from 'node:fs';
-import { relative } from 'node:path';
+import { join, relative } from 'node:path';
 import { fileURLToPath, pathToFileURL } from 'node:url';
 import { svgParts } from '@morphemecms/cms/lib/svg.mjs';
 import { declarationProblems, ownerId } from '@morphemecms/cms/lib/licenses.mjs';
@@ -268,13 +268,35 @@ function reactIcons(icons) {
   return lines.join('\n');
 }
 
-/** An icon's SVG file as Phosphor's are (in the text's colour, `fill="currentColor"`), for an import of Phosphor's. */
-const fileIcon = (svg) => {
+/** The text of an icon's SVG file as Phosphor's are (in the text's colour, `fill="currentColor"`), not JSON-encoded. */
+const themedSvg = (svg) => {
   const { viewBox, inner } = svgParts(svg);
   const box = viewBox ? ` viewBox="${viewBox}"` : '';
-  return `export default ${JSON.stringify(`<svg xmlns="http://www.w3.org/2000/svg"${box} fill="currentColor">${inner}</svg>`)};`;
+  return `<svg xmlns="http://www.w3.org/2000/svg"${box} fill="currentColor">${inner}</svg>`;
 };
 
+/** An icon's SVG file as Phosphor's are, for an import of Phosphor's. */
+const fileIcon = (svg) => `export default ${JSON.stringify(themedSvg(svg))};`;
+
+/** The virtual module with all Phosphor's icons (regular) as text (src/allIcons.ts). */
+export const ALL_ICONS = 'virtual:all-icons';
+
+/** The module code of all Phosphor's icons in `folder` (its `regular/` folder), by the keys `import.meta.glob` gave, the
+ * theme's (`icons`, as themeIcons returns them) in place of Phosphor's own. The files are read one at a time: a glob
+ * opens them all at once, and the build image's limit of open files (1024) stops the build. */
+export function allIconsModule(folder, icons) {
+  const all = {};
+  for (const file of readdirSync(folder)
+    .filter((f) => f.endsWith('.svg'))
+    .sort()) {
+    const name = file.slice(0, -'.svg'.length);
+    all[`/node_modules/@phosphor-icons/core/assets/regular/${file}`] = svgParts(icons[name])
+      ? themedSvg(icons[name])
+      : readFileSync(join(folder, file), 'utf8');
+  }
+  return `export const allIcons = ${JSON.stringify(all)};`;
+}
+
 /** What a theme is missing (the standard theme: of THEME_FILES and the look of every standard block, another: of
  * OWN_FILES), what is wrong in its theme.json (name, version, author, icon), a block of its own (a folder in its
  * blocks/ that is not the look of a standard block, or with a block's contract in it), a part nothing uses (in a
@@ -444,6 +466,7 @@ export function themePlugin() {
     resolveId(source, importer) {
       // The theme's icons import Phosphor's own.
       if (source === PHOSPHOR_REACT) return own && importer !== REACT_ICONS ? REACT_ICONS : null;
+      if (source === ALL_ICONS) return '\0' + ALL_ICONS;
       const icon = source.match(PHOSPHOR_FILE)?.[1];
       if (icon) return svgParts(icons[icon]) ? FILE_ICON + icon : null;
       if (source.startsWith('@site/')) return siteFile(source.slice('@site/'.length));
@@ -458,6 +481,8 @@ export function themePlugin() {
     },
     load(id) {
       if (id === REACT_ICONS) return reactIcons(icons);
+      if (id === '\0' + ALL_ICONS)
+        return allIconsModule(fileURLToPath(new URL('node_modules/@phosphor-icons/core/assets/regular/', root)), icons);
       if (id.startsWith(FILE_ICON)) return fileIcon(icons[id.slice(FILE_ICON.length)]);
       return null;
     },