Make it your system.

• Kits

  A kit is a self-contained package: blocks, central settings, design tokens, conditional CSS per block and structured data. New kit: php bin/console kit:create <name> [--from=…] – the starter kit is the default. Technically a kit lives in themes/{name}/theme.php – the folder name stays for compatibility (theme:create still works).

  'jsonld' => 'essenz_jsonld',
  'conditional_css' => [
      'css/b-faq.css' => ['faq'],
      'js/video.js' => ['video'],
  ],
  'design' => require __DIR__ . '/design.php',

• Blocks as PHP templates

  One renderer per block type in themes/{name}/blocks – with inline editing via $b->edit(). The block automatically appears in the editor, the REST API and the MCP server.

  <div class="wrap wrap--text">
    <?= basis_head($b) ?>
    <div class="prose"<?= $b->edit('text', 'rich') ?>><?= rich($d['text']) ?></div>
  </div>

• Block builder

  Custom blocks without PHP: fields, a safe template language with escaping and scoped CSS; export as a kit block. Excerpt from this website’s “command line” block:

  <ol class="cli-list">
    {% for c in commands %}<li class="cli-row">
      <code class="cli-cmd">{{ c.cmd }}</code>
      <span class="cli-text">{{ c.text }}</span>
    </li>{% endfor %}
  </ol>

• Extensions

  An extension ships features, permissions, migrations, menu entries, routes, blocks, proxy sources and CLI commands – enabled per website via 'extensions' => ['dav']. Extensions live in extensions/{name} or come as Composer packages of type “mycms-extension” (composer require vendor/package), which the core discovers automatically.

  'boot' => function (Core\Extension $x): void {
      $x->feature('dav', 'CalDAV/CardDAV (Kalender und Kontakte in Apps)', ['dav.use']);
      $x->permissions('CalDAV/CardDAV', ['dav.use' => '…']);
      $x->migration(1, fn(Core\Database $db) => MyCms\Dav\Dav::migrate($db));
      $x->nav('/admin/dav', 'Kalender & Kontakte in Apps', 'dav', 'dav.use');

• Example: Consent Kit

  A complete extension with its own README, LICENSE (MIT) and THIRD-PARTY-NOTICES: consent management with 38 templates, a web component in Shadow DOM, Consent Mode v2 and a CSP that only widens after consent. Ported from KLXM’s REDAXO add-on consent_kit.

  // config/sites/{key}.php bzw. config/config.local.php
  'extensions' => ['consent_kit'],
  // abschalten, ohne die Erweiterung zu entfernen:
  'features' => ['consent' => false],

• Output hooks

  Extensions can post-process the website HTML, add sources to the CSP (never unsafe-inline) and add links to the legal line.

  $x->htmlFilter(fn(string $html, array $ctx) => $html)
  $x->csp(fn() => ['script-src' => ['https://…']])
  $x->footerLinks(fn() => [['label' => …, 'href' => '#…']])

• REST-API

  OpenAPI 3.1 at /api/v1/openapi.json. Tokens with read or write level, expiry and mode “apply directly” or “for approval” – only a SHA-256 hash is stored.

  curl -H "Authorization: Bearer $TOKEN" https://ihre-domain.de/api/v1/me

• MCP server

  Model Context Protocol over Streamable HTTP with 42 tools, including list_pages, update_block, save_entry, upload_media, set_design, publish_page – with the same tokens and rules as the API.

  claude mcp add --transport http mycms https://ihre-domain.de/mcp --header "Authorization: Bearer cms_…"

• Command line

  Around 50 commands for accounts, websites, network, kits, fonts, migration, backups, shared data, search and AI; extensions add their own.

  php bin/console site:create kunde www.kunde.de,kunde.de basis
  php bin/console migrate --all
  php bin/console health
  php bin/console blocks:selftest

• Data tables

  Custom tables with 23 field types, conditions, detail pages and public forms – shared between several websites of an installation.

  php bin/console data:share <handle> --members=a,b [--see-members] [--merge]
  php bin/console shared:list

• External sources

  RSS 2.0/1.0, Atom, JSON (path), XML (XPath) and OpenImmo 1.2 (XML, ZIP or pull URL) are fetched server-side, mapped with transforms into entries of a data table and synced; images go to the media library, synced entries are read-only. Protected against SSRF, XXE and ZIP slip.

  {"id_path": "guid | link",
   "rows": {"titel": {"path": "title", "tx": "text"},
            "datum": {"path": "pubDate | dc:date", "tx": "date"},
            "bild":  {"path": "enclosure@url | media:content@url", "alt": "title"}}}
  
  */15 * * * * php bin/console sources:sync --all

• Languages

  Fixed texts use lt('…') (website) or __('…') (admin); translations are a PHP array per language, i18n:missing lists gaps.

  'Datenschutz' => 'Privacy',
  
  # php bin/console i18n:missing en --site-texts

• Design tokens

  Every token becomes a CSS variable or class; the style editor shows presets and checks contrast, also via API and MCP (get_design/set_design).

  $color('accent', 'Signal (Füllfarbe)', '--e-a', '#D85B19', '#F0782F', ['with' => 'background', 'min' => 3],

• Feature flags per website

  Presets and individual features per website; disabled features lock their permissions – navigation, API and MCP follow automatically.

  'preset'   => 'full' | 'content' | 'minimal',
  'features' => ['data.schema' => false, 'api' => false],
  'blocks'   => ['deny' => ['video'], 'allow' => null],

Anatomy of a kit →