edgepress 2026.10.1 → 2026.10.13

package/src/cli.js

@@ -1,4 +1,6 @@
 #!/usr/bin/env node
+import {reportDirectory} from './report-path.js';
+import {publicationTimestamp} from './publication-time.js';
 import { access, cp, lstat, mkdir, mkdtemp, open, readFile, readdir, realpath, rm, writeFile } from 'node:fs/promises';
 import { dirname, join, relative, resolve, sep } from 'node:path';
 import { tmpdir } from 'node:os';
@@ -9,8 +11,12 @@ import { loadConfig } from './config.js';
 import { slugify } from './content.js';
 import { checkPages } from './page-check.js';
 import { checkCompatibility, writeIterationPlan } from './maintenance.js';
+import { loadLanguagePacks, translate } from './i18n.js';
+import { postTemplate } from './post-template.js';
+import {deploySite} from './deploy.js';
+import {formatPages} from '../tools/assets/format-pages.mjs';
 
-const siteGitignore = ['node_modules/', 'dist/', '.edgepress/', '.wrangler/', '.dev.vars', '*.tgz', ''].join('\n');
+const siteGitignore = ['node_modules/', 'dist/', '.edgepress/', '.wrangler/', '.dev.vars', '.vercel/', '.netlify/', '.edgeone/', '.esa/', '.env', '.env.*', '!.env.example', '*.tgz', ''].join('\n');
 const siteReadme = [
   '# My EdgePress site',
   '',
@@ -19,19 +25,21 @@ const siteReadme = [
   '## Start locally',
   '',
   '    npm install',
-  '    edgepress server',
+  '    npm run dev',
   '',
-  'Edit localized pages in `content/pages/` and Markdown posts in `content/posts/`. Choose a shared layout with `edgepress theme list` and `edgepress theme use <name>`.',
+  'Create an article with `npm run new -- post "My first article"`. Open the printed file path and write Markdown below the second `---` line. The command fills the title, date, and language. Run `npm run dev` to preview and `npm run build` before publishing.',
   '',
-  '## Deploy to Cloudflare Workers',
+  'Pages use localized JSON files such as `content/pages/home/en.json`; VS Code can fold each row, cell and element and read the local schema. Articles stay in Markdown. Page layouts and theme customization are optional for everyday writing.',
   '',
-  'Push this source repository to GitHub, then connect the repository to Cloudflare Workers Builds. The `build` and `deploy` scripts in `package.json` generate the static files and deploy the Worker. Set a unique Worker name in `wrangler.jsonc` first.',
+  '## Deploy a static website',
   '',
-  'For a local deployment, run `npx wrangler login`, then `edgepress deploy`.',
+  'Push this source repository to GitHub, then connect the repository to Cloudflare Workers Builds. The `build` and `deploy` scripts in `package.json` generate and deploy the static files. Set a unique Worker name in `wrangler.jsonc` first.',
+  '',
+  'Authenticate with the chosen platform, then run `edgepress deploy cloudflare`, `edgepress deploy vercel`, `edgepress deploy edgeone -n my-site`, `edgepress deploy netlify`, or `edgepress deploy esa --name my-site`.',
   '',
   '## Use another static web server',
   '',
-  'Run `edgepress generate` and upload the contents of `dist/` to the server document root. OpenResty and Nginx can serve the generated directories as static files. Worker API routes and service bindings need a Worker or an equivalent server-side route.',
+  'Run `edgepress generate` and upload the contents of `dist/` to the server document root. OpenResty and Nginx can serve the generated directories as static files. Optional backends live in separate projects and are registered under plugins.consent.services in config.yml.',
   ''
 ].join('\n');
 
@@ -39,8 +47,8 @@ async function initializeProject() {
   const packageRoot = resolve(dirname(fileURLToPath(import.meta.url)), '..');
   const root = process.cwd();
   const directories = ['content', 'languages', 'plugins', 'static', 'themes'];
-  const files = ['.gitignore', 'README.md', 'config.yml', 'edgepress.config.mjs', 'project-compatibility.json', 'wrangler.jsonc'];
-  const destinations = [...directories, ...files, 'src/worker.js'];
+  const files = ['.gitignore', 'README.md', 'config.yml', 'edgepress.config.mjs', 'project-compatibility.json', 'wrangler.jsonc', 'vercel.json', 'edgeone.json', 'esa.jsonc', 'netlify.toml'];
+  const destinations = [...directories, ...files];
   const existing = [];
   for (const relativePath of destinations) {
     try { await access(resolve(root, relativePath)); existing.push(relativePath); }
@@ -76,7 +84,16 @@ async function initializeProject() {
       preview: 'edgepress server',
       check: 'edgepress check',
       doctor: 'edgepress doctor',
-      deploy: 'edgepress deploy'
+      deploy: 'edgepress deploy',
+      'deploy:cloudflare': 'edgepress deploy cloudflare',
+      'deploy:netlify': 'edgepress deploy netlify',
+      'deploy:vercel': 'edgepress deploy vercel',
+      'deploy:edgeone': 'edgepress deploy edgeone',
+      'deploy:esa': 'edgepress deploy esa'
+    },
+    overrides: {
+      ...(packageData.overrides || {}),
+      ...(existingManifest.overrides || {})
     },
     dependencies: {
       ...(existingManifest.dependencies || {}),
@@ -85,6 +102,7 @@ async function initializeProject() {
     }
   };
   for (const directory of directories) await cp(resolve(packageRoot, directory), resolve(root, directory), { recursive: true, errorOnExist: true });
+  await formatPages(root, {write: true, schemaPath: resolve(root, 'node_modules/edgepress/schemas/pages.schema.json')});
   for (const file of files) {
     const destination = resolve(root, file);
     await mkdir(dirname(destination), { recursive: true });
@@ -92,23 +110,8 @@ async function initializeProject() {
     else if (file === 'README.md') await writeFile(destination, siteReadme, { flag: 'wx' });
     else await cp(resolve(packageRoot, file), destination, { errorOnExist: true });
   }
-  await mkdir(resolve(root, 'src'), { recursive: true });
-  await cp(resolve(packageRoot, 'src/worker.js'), resolve(root, 'src/worker.js'), { errorOnExist: true });
   await writeFile(resolve(root, 'package.json'), JSON.stringify(projectManifest, null, 2) + '\n', { flag: packageManifestExists ? 'w' : 'wx' });
-  console.log('Created an EdgePress site. Next run npm install, then edgepress server.');
-}
-
-async function runWrangler(command, args = []) {
-  const wrangler = resolve(process.cwd(), 'node_modules/wrangler/bin/wrangler.js');
-  await access(wrangler);
-  await new Promise((resolveExit, reject) => {
-    const child = spawn(process.execPath, [wrangler, command, ...args], { cwd: process.cwd(), env: process.env, stdio: 'inherit' });
-    child.once('error', reject);
-    child.once('exit', (code) => {
-      if (code === 0) resolveExit();
-      else process.exitCode = code ?? 1, resolveExit();
-    });
-  });
+  console.log('Created an EdgePress site. Next run npm install, then npm run dev. Create an article with npm run new -- post "My first article".');
 }
 
 async function runSecurityAudit() {
@@ -246,15 +249,18 @@ async function manageTheme(args, config) {
 }
 
 async function createPost(title, config) {
-  if (!title) throw new Error('Usage: edgepress new "Post title"');
+  if (!title) throw new Error('Usage: edgepress new post "Post title"');
   const releaseLock = await acquireBuildLock(config.resolvedPaths.cache);
   try {
-    const today = new Date().toISOString().slice(0, 10);
+    if (title.length > 160 || /[\x00-\x1f\x7f]/.test(title)) throw new Error('Post title must be one line of at most 160 characters.');
+    await loadLanguagePacks(config);
+    const timestamp = publicationTimestamp(new Date(), config.site.timeZone);
+    const today = timestamp.slice(0, 10);
     const folder = resolve(config.resolvedPaths.content, 'posts', today + '-' + slugify(title));
     const locale = config.i18n.defaultLocale;
     const file = resolve(folder, locale.toLowerCase() + '.md');
     await mkdir(folder, { recursive: true });
-    const body = '---\ntitle: ' + JSON.stringify(title) + '\ndate: ' + today + '\nlang: ' + locale + '\ntags: []\n---\n\n# ' + title + '\n\nWrite your post here.\n';
+    const body = postTemplate(title, timestamp, locale, translate(config, locale, 'postStarter'));
     let handle;
     try { handle = await open(file, 'wx'); }
     catch (error) {
@@ -269,7 +275,9 @@ async function createPost(title, config) {
       await rm(file, { force: true });
       throw writeError;
     }
-    console.log('Created ' + file);
+    console.log(translate(config, locale, 'postCreated').replace('{file}', relative(config.root, file)));
+    console.log(translate(config, locale, 'postNextSteps'));
+    console.log(translate(config, locale, 'postPreview'));
   } finally {
     await releaseLock();
   }
@@ -288,8 +296,8 @@ async function clean(config) {
         if (error.code !== 'ENOENT') throw error;
       }
     }
-    const toolsDirectory = resolve(config.root, 'tools');
-    try {
+    const toolsDirectory = await reportDirectory(config.root, false);
+    if (toolsDirectory) try {
       const info = await lstat(toolsDirectory);
       if (info.isSymbolicLink() || !info.isDirectory()) throw new Error('Refusing to clean reports through an unsafe tools path: ' + toolsDirectory);
       await rm(resolve(toolsDirectory, 'page-check.pdf'), { force: true });
@@ -323,28 +331,25 @@ try {
     ? await loadConfig()
     : null;
   if (command === '--help' || command === '-h' || command === 'help') {
-    console.log('EdgePress commands: init, new, build, generate, server, check, doctor, iterate, theme, secret, security, deploy, clean');
+    console.log('EdgePress commands: init, new, build, generate, server, check, doctor, iterate, theme, security, deploy, clean');
   }
   else if (command === 'build' || command === 'generate') await buildSite();
   else if (command === 'init') await initializeProject();
   else if (command === 'preview' || command === 'dev' || command === 'server') await import('./preview.js');
   else if (command === 'deploy') {
-    if (process.env.WORKERS_CI !== '1') await buildSite();
-    await runWrangler('deploy', args);
-  }
-  else if (command === 'secret') {
-    if (!['put', 'delete', 'list'].includes(args[0])) throw new Error('Usage: edgepress secret put|delete|list [name]');
-    await runWrangler('secret', args);
+    const platform = args[0] && !args[0].startsWith('-') ? args.shift() : 'cloudflare';
+    const built = process.env.WORKERS_CI === '1' ? {output:(await loadConfig()).resolvedPaths.output} : await buildSite();
+    await deploySite(platform, built.output, args);
   }
   else if (command === 'theme') await manageTheme(args, await loadConfig());
   else if (command === 'security') await runSecurityAudit();
-  else if (command === 'new') await createPost(args.join(' ').trim(), config);
+  else if (command === 'new') await createPost((args[0] === 'post' ? args.slice(1) : args).join(' ').trim(), config);
   else if (command === 'clean') await clean(config);
   else if (command === 'check') {
     await buildSite(config.root);
     const pageReport = await checkPages(config);
     const compatibilityReport = await checkCompatibility(config);
-    await showReport('Page check', pageReport, resolve(config.root, 'tools/page-check.pdf'));
+    await showReport('Page check', pageReport, resolve(config.root, 'tools/reports/page-check.pdf'));
     showStatus('Compatibility check', compatibilityReport);
     if (pageReport.errors || compatibilityReport.issues.some((issue) => issue.severity === 'error')) process.exitCode = 1;
   } else if (command === 'doctor') {

package/src/config.js

@@ -1,15 +1,23 @@
+import {defaultTimeZone,validateTimeZone} from './publication-time.js';
+import { categoryFilter, safeAvatar } from './post-details.js';
 import { access, readFile, realpath, stat } from 'node:fs/promises';
 import { basename, dirname, isAbsolute, relative, resolve, sep } from 'node:path';
 import { pathToFileURL } from 'node:url';
 import { parse as parseYaml } from 'yaml';
+import {validateServiceCsp} from './consent-csp.js';
+import {linkOrigin} from '../static/edgepress/external-links-policy.js';
 
 const defaults = {
   site: {
-    title: 'EdgePress', description: '', url: '', language: 'en',
+    title: 'EdgePress', description: '', url: '', language: 'en', timeZone: defaultTimeZone,
     head: { titleSuffix: '', titleSeparator: ' · ' },
     header: { showBrand: true, brandLabel: '' },
     components: { header: true, primaryNavigation: true, languageNavigation: true, footer: true, footerNavigation: true },
+    author: { name: '', avatar: '' },
+    archive: { categories: [] },
     navigation: [],
+    externalLinks: { enabled: false, trustedOrigins: [] },
+    dataSaver: { enabled: false, debug: false, mode: 'auto', detectSlowConnection: false, respectBrowserPreference: false, promptAfterMs: 5000 },
     footerNavigation: [],
     footer: '',
     seo: { author: '', keywords: [], image: '', robots: 'index,follow' },
@@ -21,10 +29,7 @@ const defaults = {
   },
   browserPlugins: {
     consent: { enabled: true, proposedDate: '', effectiveDate: '', expiresDays: 180 },
-    tracking: { enabled: true, services: [] },
-    statistics: { enabled: true, services: [] },
-    advertising: { enabled: true, services: [] },
-    captcha: { enabled: true, services: [] }
+    services: []
   },
   paths: { content: 'content', static: 'static', theme: 'themes/default', output: 'dist', cache: '.edgepress' },
   permalink: '/:year/:month/:slug/',
@@ -77,15 +82,18 @@ function validateLocalizedServiceText(value, label, maxLength, locales) {
 }
 
 const integrationProviders = {
-  'google-tag-manager': { group: 'tracking', credential: 'containerId', pattern: /^GTM-[A-Z0-9]{4,20}$/i },
-  'meta-pixel': { group: 'tracking', credential: 'pixelId', pattern: /^[0-9]{6,20}$/ },
-  'cloudflare-web-analytics': { group: 'statistics', credential: 'token', pattern: /^[A-Fa-f0-9-]{20,64}$/ },
-  'google-analytics': { group: 'statistics', credential: 'measurementId', pattern: /^(?:G|GT)-[A-Z0-9]{4,24}$/i },
-  'baidu-tongji': { group: 'statistics', credential: 'siteId', pattern: /^[A-Fa-f0-9]{16,64}$/ },
-  'google-adsense': { group: 'advertising', credential: 'clientId', pattern: /^ca-pub-[0-9]{10,24}$/ },
-  'cloudflare-turnstile': { group: 'captcha', credential: 'siteKey', pattern: /^[A-Za-z0-9_-]{20,128}$/ },
-  'google-recaptcha': { group: 'captcha', credential: 'siteKey', pattern: /^[A-Za-z0-9_-]{20,256}$/ },
-  'hcaptcha': { group: 'captcha', credential: 'siteKey', pattern: /^[A-Za-z0-9_-]{20,256}$/ }
+  'oembed': { credential: 'backendUrl', pattern: /^https:\/\/[^\s]+$/ },
+  'external-widget': { credential: 'backendUrl', pattern: /^https:\/\/[^\s]+$/ },
+  'external-api': { credential: 'backendUrl', pattern: /^https:\/\/[^\s]+$/ },
+  'google-tag-manager': { credential: 'containerId', pattern: /^GTM-[A-Z0-9]{4,20}$/i },
+  'meta-pixel': { credential: 'pixelId', pattern: /^[0-9]{6,20}$/ },
+  'cloudflare-web-analytics': { credential: 'token', pattern: /^[A-Fa-f0-9-]{20,64}$/ },
+  'google-analytics': { credential: 'measurementId', pattern: /^(?:G|GT)-[A-Z0-9]{4,24}$/i },
+  'baidu-tongji': { credential: 'siteId', pattern: /^[A-Fa-f0-9]{16,64}$/ },
+  'google-adsense': { credential: 'clientId', pattern: /^ca-pub-[0-9]{10,24}$/ },
+  'cloudflare-turnstile': { credential: 'siteKey', pattern: /^[A-Za-z0-9_-]{20,128}$/ },
+  'google-recaptcha': { credential: 'siteKey', pattern: /^[A-Za-z0-9_-]{20,256}$/ },
+  'hcaptcha': { credential: 'siteKey', pattern: /^[A-Za-z0-9_-]{20,256}$/ }
 };
 
 async function readSiteYaml(root) {
@@ -101,11 +109,21 @@ async function readSiteYaml(root) {
   try { parsed = parseYaml(source.toString('utf8'), { uniqueKeys: true, maxAliasCount: 20 }) ?? {}; }
   catch (error) { throw new Error('Invalid YAML in config.yml: ' + error.message, { cause: error }); }
   if (!parsed || typeof parsed !== 'object' || Array.isArray(parsed)) throw new Error('config.yml must contain an object');
-  for (const key of Object.keys(parsed)) if (!['site', 'privacy', 'plugins'].includes(key)) throw new Error('Unsupported config.yml section: ' + key);
+  for (const key of Object.keys(parsed)) if (!['theme', 'site', 'privacy', 'plugins'].includes(key)) throw new Error('Unsupported config.yml section: ' + key);
+  if (parsed.theme !== undefined && (typeof parsed.theme !== 'string' || !/^[a-z0-9]+(?:-[a-z0-9]+)*$/.test(parsed.theme))) {
+    throw new Error('config.yml theme must be a lowercase theme name such as lumen');
+  }
   return parsed;
 }
 
 function validateSiteConfig(config) {
+  const dataSaver = config.site.dataSaver;
+  if (!dataSaver || typeof dataSaver !== 'object' || Array.isArray(dataSaver) || ['enabled', 'debug', 'detectSlowConnection', 'respectBrowserPreference'].some(key => typeof dataSaver[key] !== 'boolean') || !['auto', 'text', 'full'].includes(dataSaver.mode) || !Number.isInteger(dataSaver.promptAfterMs) || dataSaver.promptAfterMs < 100 || dataSaver.promptAfterMs > 60000 || Object.keys(dataSaver).some(key => !['enabled', 'debug', 'mode', 'detectSlowConnection', 'respectBrowserPreference', 'promptAfterMs'].includes(key))) throw new Error('Invalid site.dataSaver settings or promptAfterMs (100–60000)');
+  const externalLinks = config.site.externalLinks;
+  if (!externalLinks || typeof externalLinks !== 'object' || Array.isArray(externalLinks) || typeof externalLinks.enabled !== 'boolean' || !Array.isArray(externalLinks.trustedOrigins) || externalLinks.trustedOrigins.length > 100 || Object.keys(externalLinks).some(key => !['enabled', 'trustedOrigins'].includes(key))) throw new Error('site.externalLinks needs enabled and a trustedOrigins list');
+  if (externalLinks.trustedOrigins.some(origin => typeof origin !== 'string')) throw new Error('site.externalLinks.trustedOrigins must contain exact origins');
+  externalLinks.trustedOrigins = [...new Set(externalLinks.trustedOrigins.map(linkOrigin))];
+  if (externalLinks.enabled && !/^https?:\/\//i.test(config.site.url)) throw new Error('External link prompts need an HTTP(S) site.url');
   if (!config.site.seo || typeof config.site.seo !== 'object' || Array.isArray(config.site.seo)) throw new Error('site.seo must be an object');
   if (typeof config.site.footer !== 'string') throw new Error('site.footer must be a string');
   for (const field of ['author', 'image', 'robots']) {
@@ -139,7 +157,14 @@ function validateSiteConfig(config) {
   for (const key of Object.keys(components)) if (!componentKeys.includes(key)) throw new Error('Unsupported site.components option: ' + key);
   for (const key of componentKeys) if (typeof components[key] !== 'boolean') throw new Error('site.components.' + key + ' must be a boolean');
 
-  function validateNavigation(items, field) {
+  const { author, archive } = config.site;
+  if (!author || typeof author !== 'object' || Array.isArray(author) || typeof author.name !== 'string' || author.name.length > 160 ||
+      Object.keys(author).some(key => !['name', 'avatar'].includes(key))) throw new Error('site.author needs name and an optional avatar');
+  safeAvatar(author.avatar, 'site.author.avatar');
+  if (!archive || typeof archive !== 'object' || Array.isArray(archive) || Object.keys(archive).some(key => key !== 'categories')) throw new Error('site.archive needs categories');
+  categoryFilter(archive.categories);
+
+  function validateNavigation(items, field, depth = 0) {
     if (!Array.isArray(items) || items.length > 30) throw new Error(field + ' must be an array with at most 30 items');
     const keys = new Set();
     for (const item of items) {
@@ -148,7 +173,12 @@ function validateSiteConfig(config) {
         throw new Error(field + ' items need a unique key and URL');
       }
       keys.add(item.key);
-      for (const key of Object.keys(item)) if (!['key', 'url', 'labels'].includes(key)) throw new Error('Unsupported ' + field + ' item option: ' + key);
+      if (item.children !== undefined) {
+        if (depth || !item.children.length) throw new Error('Navigation children allow one non-empty level');
+        validateNavigation(item.children, field + '.children', depth + 1);
+      }
+      for (const key of Object.keys(item)) if (!['key', 'url', 'labels', 'children', 'target'].includes(key)) throw new Error('Unsupported ' + field + ' item option: ' + key);
+      if (item.target !== undefined && !['_self','_blank'].includes(item.target)) throw new Error(field + '.target must be _self or _blank');
       const url = item.url.trim();
       if (!['@home', '@archives', '@feed', '@search'].includes(url)) {
         const safeLocal = url.startsWith('/') && !url.startsWith('//') && !/[\\\x00-\x20]/.test(url) && !/^(?:javascript|data|vbscript):/i.test(url);
@@ -199,29 +229,26 @@ function normalizeBrowserPlugins(value) {
   if (!value || typeof value !== 'object' || Array.isArray(value)) throw new Error('config.yml plugins must be an object');
   for (const key of Object.keys(value)) {
     if (key !== 'consent') {
-      throw new Error('Unsupported plugin configuration group: ' + key + '; place browser services under plugins.consent.' + key);
+      throw new Error('Unsupported plugin configuration group: ' + key + '; place browser services under plugins.consent.services');
     }
   }
   if (value.consent === undefined) return {};
   const input = value.consent;
   if (!input || typeof input !== 'object' || Array.isArray(input)) throw new Error('plugins.consent must be an object');
   const consent = {};
-  const normalized = {};
-  const groups = ['tracking', 'statistics', 'advertising', 'captcha'];
-  for (const [key, section] of Object.entries(input)) {
-    if (groups.includes(key)) normalized[key] = section;
-    else if (['enabled', 'proposedDate', 'effectiveDate', 'expiresDays'].includes(key)) consent[key] = section;
-    else throw new Error('Unsupported plugins.consent option: ' + key);
-  }
-  normalized.consent = consent;
-  return normalized;
+  const allowed = ['enabled', 'proposedDate', 'effectiveDate', 'expiresDays', 'services'];
+  for (const [key, option] of Object.entries(input)) {
+    if (!allowed.includes(key)) throw new Error('Unsupported plugins.consent option: ' + key + '; configure individual services in plugins.consent.services');
+    if (key !== 'services') consent[key] = option;
+  }
+  return {consent, services:input.services ?? []};
 }
 
 function validateBrowserPlugins(config) {
   const plugins = config.browserPlugins;
-  const allowedGroups = ['consent', 'tracking', 'statistics', 'advertising', 'captcha'];
+  const allowedKeys = ['consent', 'services'];
   if (!plugins || typeof plugins !== 'object' || Array.isArray(plugins)) throw new Error('plugins in config.yml must be an object');
-  for (const key of Object.keys(plugins)) if (!allowedGroups.includes(key)) throw new Error('Unsupported plugin configuration group: ' + key);
+  for (const key of Object.keys(plugins)) if (!allowedKeys.includes(key)) throw new Error('Unsupported plugin configuration group: ' + key);
   const consent = plugins.consent;
   if (!consent || typeof consent !== 'object' || Array.isArray(consent) || typeof consent.enabled !== 'boolean' ||
       !isDateOnly(consent.proposedDate) ||
@@ -237,43 +264,65 @@ function validateBrowserPlugins(config) {
     throw new Error('Unsupported plugins.consent option: ' + key);
   }
   const ids = new Set();
-  let servicesCount = 0;
-  for (const group of ['tracking', 'statistics', 'advertising', 'captcha']) {
-    const groupPath = 'plugins.consent.' + group;
-    const section = plugins[group];
-    if (!section || typeof section !== 'object' || Array.isArray(section) || typeof section.enabled !== 'boolean' || !Array.isArray(section.services)) {
-      throw new Error(groupPath + ' needs enabled and a services array');
+  if (!Array.isArray(plugins.services)) throw new Error('plugins.consent.services must be an array');
+  const servicesCount = plugins.services.filter(service => service?.enabled !== false).length;
+  for (const service of plugins.services) {
+    validateServiceCsp(service || {});
+    if (!service || typeof service !== 'object' || Array.isArray(service)) throw new Error('Each plugins.consent.services item must be an object');
+    if (service.enabled !== undefined && typeof service.enabled !== 'boolean') throw new Error('Service enabled must be a boolean');
+    const { id, provider, purpose } = service;
+    if (typeof id !== 'string' || !/^[a-z][a-z0-9-]{1,63}$/.test(id) || ids.has(id)) throw new Error('Each configured service needs a unique lowercase id');
+    ids.add(id);
+    const definition = integrationProviders[provider];
+    if (!definition) throw new Error('Unsupported service provider: ' + provider);
+    const locales = config.i18n.locales;
+    validateLocalizedServiceText(service.name || provider, 'Service ' + id + '.name', 120, locales);
+    validateLocalizedServiceText(purpose, 'Service ' + id + '.purpose', 500, locales);
+    validateLocalizedServiceText(service.dataCategories, 'Service ' + id + '.dataCategories', 600, locales);
+    validateLocalizedServiceText(service.recipient, 'Service ' + id + '.recipient', 200, locales);
+    validateLocalizedServiceText(service.retention, 'Service ' + id + '.retention', 300, locales);
+    if (typeof service.privacyUrl !== 'string' || service.privacyUrl.length > 2048 || /[\x00-\x20]/.test(service.privacyUrl)) {
+      throw new Error('Service ' + id + '.privacyUrl must be a safe HTTPS URL');
     }
-    for (const key of Object.keys(section)) if (!['enabled', 'services'].includes(key)) throw new Error('Unsupported ' + groupPath + ' option: ' + key);
-    if (!section.enabled && section.services.length) throw new Error('Clear ' + groupPath + '.services or enable the plugin group');
-    servicesCount += section.services.length;
-    for (const service of section.services) {
-      if (!service || typeof service !== 'object' || Array.isArray(service)) throw new Error('Each ' + groupPath + '.services item must be an object');
-      const { id, provider, purpose } = service;
-      if (typeof id !== 'string' || !/^[a-z][a-z0-9-]{1,63}$/.test(id) || ids.has(id)) throw new Error('Each configured service needs a unique lowercase id');
-      ids.add(id);
-      const definition = integrationProviders[provider];
-      if (!definition || definition.group !== group) throw new Error('Unsupported provider for ' + groupPath + ': ' + provider);
-      const locales = config.i18n.locales;
-      validateLocalizedServiceText(service.name || provider, 'Service ' + id + '.name', 120, locales);
-      validateLocalizedServiceText(purpose, 'Service ' + id + '.purpose', 500, locales);
-      validateLocalizedServiceText(service.dataCategories, 'Service ' + id + '.dataCategories', 600, locales);
-      validateLocalizedServiceText(service.recipient, 'Service ' + id + '.recipient', 200, locales);
-      validateLocalizedServiceText(service.retention, 'Service ' + id + '.retention', 300, locales);
-      if (typeof service.privacyUrl !== 'string' || service.privacyUrl.length > 2048 || /[\x00-\x20]/.test(service.privacyUrl)) {
-        throw new Error('Service ' + id + '.privacyUrl must be a safe HTTPS URL');
+    let safePrivacyUrl = false;
+    try {
+      const parsed = new URL(service.privacyUrl);
+      safePrivacyUrl = parsed.protocol === 'https:' && !parsed.username && !parsed.password;
+    } catch { safePrivacyUrl = false; }
+    if (!safePrivacyUrl) throw new Error('Service ' + id + '.privacyUrl must be a safe HTTPS URL');
+    const allowedKeys = new Set(['id', 'enabled', 'provider', 'name', 'purpose', 'dataCategories', 'recipient', 'retention', 'privacyUrl', 'csp', ...(definition.credential ? [definition.credential] : []), ...(provider === 'external-widget' ? ['moduleUrl', 'placement'] : []), ...(provider === 'oembed' ? ['runtimeApi','oembedEndpoint','embedTemplate','embedPathPattern','sourceOrigins','embedOrigins','embedScripts'] : [])]);
+    for (const key of Object.keys(service)) if (!allowedKeys.has(key)) throw new Error('Unsupported option for service ' + id + ': ' + key);
+    if (provider === 'external-widget' || provider === 'external-api' || provider === 'oembed') {
+      let valid=false;try {const url=new URL(service.backendUrl);valid=url.protocol==='https:' && !url.username && !url.password && !url.search && !url.hash;}catch{}
+      if(!valid)throw new Error('Service '+id+' needs an exact HTTPS backendUrl origin');
+      if(provider === 'oembed') {
+        for(const field of ['sourceOrigins','embedOrigins','embedScripts']) {
+          if(service[field] === undefined)continue;
+          if(!Array.isArray(service[field]) || service[field].length>24)throw new Error('Service '+id+'.'+field+' must be a URL array');
+          for(const value of service[field]) {
+            let safe=false;try{const url=new URL(value);safe=url.protocol==='https:'&&!url.username&&!url.password&&!url.hash&&(field==='embedScripts'?!url.search:url.origin===value);}catch{}
+            if(!safe)throw new Error('Service '+id+'.'+field+' needs exact HTTPS '+(field==='embedScripts'?'script URLs':'origins'));
+          }
+        }
+        if(service.oembedEndpoint !== undefined) {
+          let safe=false;try{const url=new URL(service.oembedEndpoint);safe=url.protocol==='https:'&&!url.username&&!url.password&&!url.hash;}catch{}
+          if(!safe)throw new Error('Service '+id+' needs a public HTTPS oembedEndpoint');
+        }
+        if(service.embedTemplate !== undefined) {
+          let safe=false;try{const url=new URL(service.embedTemplate.replaceAll('{url}','https%3A%2F%2Fexample.com').replaceAll('{path}','/p/example/').replaceAll('{id}','example'));safe=url.protocol==='https:'&&!url.username&&!url.password&&!url.hash&&(service.embedOrigins || [new URL(service.backendUrl).origin]).includes(url.origin);}catch{}
+          if(!safe || service.oembedEndpoint || service.embedScripts?.length)throw new Error('embedTemplate needs an allowed HTTPS iframe origin and cannot use oembedEndpoint or scripts');
+          if(service.embedPathPattern !== undefined){if(typeof service.embedPathPattern!=='string'||service.embedPathPattern.length>200)throw new Error('embedPathPattern must be a short path expression');new RegExp(service.embedPathPattern);}
+          if(service.embedTemplate.includes('{id}')&&!service.embedPathPattern)throw new Error('The {id} template requires embedPathPattern with a capture group');
+      }else if(!service.oembedEndpoint&&!service.embedTemplate&&!service.runtimeApi&&(service.sourceOrigins || service.embedOrigins || service.embedScripts))throw new Error('Third-party oEmbed options require oembedEndpoint, embedTemplate or runtimeApi');
+      }
+      if (provider === 'external-widget') {
+        const module = new URL(service.moduleUrl);
+        if (module.protocol !== 'https:' || module.username || module.password || module.origin !== new URL(service.backendUrl).origin || !module.pathname.endsWith('.js') || module.hash) throw new Error('Widget moduleUrl must be a same-service HTTPS JavaScript URL');
+        if (service.placement !== undefined && service.placement !== 'posts') throw new Error('Widget placement supports posts');
       }
-      let safePrivacyUrl = false;
-      try {
-        const parsed = new URL(service.privacyUrl);
-        safePrivacyUrl = parsed.protocol === 'https:' && !parsed.username && !parsed.password;
-      } catch { safePrivacyUrl = false; }
-      if (!safePrivacyUrl) throw new Error('Service ' + id + '.privacyUrl must be a safe HTTPS URL');
-      const allowedKeys = new Set(['id', 'provider', 'name', 'purpose', 'dataCategories', 'recipient', 'retention', 'privacyUrl', definition.credential]);
-      for (const key of Object.keys(service)) if (!allowedKeys.has(key)) throw new Error('Unsupported option for service ' + id + ': ' + key);
-      const credential = service[definition.credential];
-      if (typeof credential !== 'string' || !definition.pattern.test(credential)) throw new Error('Service ' + id + ' needs a valid public ' + definition.credential);
     }
+    const credential = service[definition.credential];
+    if (definition.credential && (typeof credential !== 'string' || !definition.pattern.test(credential))) throw new Error('Service ' + id + ' needs a valid public ' + definition.credential);
   }
   if (servicesCount && !consent.enabled) throw new Error('plugins.consent must be enabled when browser services are configured');
   if (servicesCount) {
@@ -342,6 +391,7 @@ export async function loadConfig(root = process.cwd()) {
   }
 
   const config = merge(defaults, userConfig);
+  validateTimeZone(config.site.timeZone);
   const siteYaml = await readSiteYaml(root);
   if (siteYaml.site !== undefined && (!siteYaml.site || typeof siteYaml.site !== 'object' || Array.isArray(siteYaml.site))) {
     throw new Error('config.yml site must be an object');
@@ -355,6 +405,7 @@ export async function loadConfig(root = process.cwd()) {
   config.site = merge(config.site, siteYaml.site);
   config.privacy = merge(config.privacy, siteYaml.privacy);
   config.browserPlugins = merge(config.browserPlugins, normalizeBrowserPlugins(siteYaml.plugins));
+  if (siteYaml.theme !== undefined) config.paths.theme = 'themes/' + siteYaml.theme;
   assertString(config.site.title, 'site.title');
   assertString(config.site.language, 'site.language');
   if (!isCanonicalLocale(config.site.language)) throw new Error('site.language must be a valid canonical language tag');

package/src/consent-csp.js

@@ -0,0 +1,137 @@
+import { dataSaverInlineAssets } from './data-saver.js';
+
+// Network permission is not consent: browser loaders still require the visitor's choice.
+const defaults = "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data: blob:; font-src 'self' data:; media-src 'self' blob:; connect-src 'self'; frame-src 'self'; worker-src 'self' blob:; object-src 'none'; base-uri 'self'; form-action 'self'";
+const providers = {
+  'cloudflare-web-analytics': {script:['https://static.cloudflareinsights.com'],connect:['https://cloudflareinsights.com']},
+  'google-analytics': {script:['https://www.googletagmanager.com'],connect:['https://*.google-analytics.com','https://*.analytics.google.com','https://www.googletagmanager.com'],img:['https://*.google-analytics.com']},
+  'baidu-tongji': {script:['https://hm.baidu.com'],connect:['https://hm.baidu.com'],img:['https://hm.baidu.com']},
+  'google-tag-manager': {script:['https://www.googletagmanager.com'],connect:['https://www.googletagmanager.com']},
+  'meta-pixel': {script:['https://connect.facebook.net'],connect:['https://www.facebook.com'],img:['https://www.facebook.com']},
+  'cloudflare-turnstile': {script:['https://challenges.cloudflare.com'],connect:['https://challenges.cloudflare.com'],frame:['https://challenges.cloudflare.com']},
+  'google-recaptcha': {script:['https://www.google.com','https://www.gstatic.com'],connect:['https://www.google.com','https://www.gstatic.com'],frame:['https://www.google.com','https://recaptcha.google.com']},
+  'hcaptcha': {script:['https://js.hcaptcha.com','https://*.hcaptcha.com'],connect:['https://hcaptcha.com','https://*.hcaptcha.com'],frame:['https://hcaptcha.com','https://*.hcaptcha.com'],style:['https://*.hcaptcha.com']},
+  'google-adsense': {script:['https://pagead2.googlesyndication.com','https://*.googlesyndication.com','https://*.doubleclick.net'],connect:['https://*.googlesyndication.com','https://*.doubleclick.net','https://www.google.com'],frame:['https://*.googlesyndication.com','https://*.doubleclick.net','https://www.google.com'],img:['https://*.googlesyndication.com','https://*.doubleclick.net','https://www.google.com']}
+};
+const directiveNames = new Set(['script-src','connect-src','frame-src','img-src','style-src','font-src','media-src','worker-src']);
+export function validateServiceCsp(service) {
+  if (service.csp === undefined) return;
+  if (!service.csp || typeof service.csp !== 'object' || Array.isArray(service.csp)) throw new Error('Service csp must be a directive map');
+  for (const [name,sources] of Object.entries(service.csp)) {
+    if (!directiveNames.has(name) || !Array.isArray(sources) || sources.length > 24 || sources.some(source => typeof source !== 'string' || !/^https:\/\/(?:\*\.)?[a-z0-9.-]+(?::[0-9]{1,5})?$/i.test(source))) throw new Error('Service csp needs supported directives and HTTPS origins');
+  }
+}
+function permissions(config) {
+  const result = new Map();
+  const add=(name,values)=>result.set(name,[...new Set([...(result.get(name)||[]),...values])]);
+  for (const service of config.browserPlugins?.services || []) {
+    if (service.enabled === false || config.browserPlugins?.consent?.enabled === false) continue;
+    for (const [name,values] of Object.entries(providers[service.provider] || {})) add(name+'-src',values);
+    if (['external-widget','external-api','oembed'].includes(service.provider)) {
+      const backend=new URL(service.backendUrl).origin;
+      add('connect-src',[backend]);
+      if (service.provider==='external-widget') {add('script-src',[new URL(service.moduleUrl).origin]);add('frame-src',[backend]);}
+      if (service.provider==='oembed') {
+        const media=service.embedOrigins || [backend];
+        for (const name of ['frame-src','img-src','connect-src','media-src']) add(name,media);
+        if (service.embedScripts?.length) {add('script-src',[...service.embedScripts.map(value=>new URL(value).origin),...media]);add('style-src',media);}
+      }
+    }
+    validateServiceCsp(service);
+    for(const [name,values] of Object.entries(service.csp || {})) add(name,values);
+  }
+  for(const [name,values] of Object.entries(config.contentCsp || {})) add(name,values);
+  return result;
+}
+function extend(policy,config) {
+  const directives=new Map(policy.split(';').map(value=>value.trim().split(/\s+/)).filter(parts=>parts[0]).map(([name,...sources])=>[name,sources]));
+  const inline = dataSaverInlineAssets(config);
+  if (inline) {
+    for (const name of ['script-src', ...(directives.has('script-src-elem') ? ['script-src-elem'] : [])]) {
+      const inherited = directives.get(name) || directives.get('script-src') || directives.get('default-src') || ["'self'"];
+      directives.set(name, [...new Set([...inherited.filter(value => value !== "'none'"), inline.scriptHash])]);
+    }
+    for (const name of ['style-src', ...(directives.has('style-src-elem') ? ['style-src-elem'] : [])]) {
+      const inherited = directives.get(name) || directives.get('style-src') || directives.get('default-src') || ["'self'"];
+      if (!inherited.includes("'unsafe-inline'")) directives.set(name, [...new Set([...inherited.filter(value => value !== "'none'"), inline.styleHash])]);
+    }
+  }
+  for(const [name,sources] of permissions(config)) {
+    if (!sources.length) continue;
+    const inherited=directives.get(name) || directives.get('default-src') || ["'self'"];
+    directives.set(name,[...new Set([...inherited.filter(source=>source!=="'none'"),...sources])]);
+  }
+  return [...directives].map(([name,sources])=>name+' '+sources.join(' ')).join('; ');
+}
+export function extendConsentPolicy(headers,config) {
+  if (!globalPolicy(headers)) headers += '\n\n/*\n  Content-Security-Policy: '+defaults;
+  return headers.replace(/(Content-Security-Policy:\s*)([^\r\n]+)/gi,(_match,prefix,policy)=>prefix+extend(policy,config));
+}
+// Content images/videos are independent of optional services. Inert embed metadata
+// must never expand the allowlist, especially when a service has been disabled.
+export function contentPermissions(routes) {
+  const result={};
+  for(const route of routes) {
+    if(route.contentType && !/^text\/html\b/i.test(route.contentType))continue;
+    const html=route.body.replace(/<template\b[^>]*>[\s\S]*?<\/template>/gi,'').replace(/<script\b[^>]*>[\s\S]*?<\/script>/gi,'');
+    if (/data-edgepress-document(?:\s|=|>)/i.test(html)) {
+      result['script-src'] = ["'wasm-unsafe-eval'"];
+      result['font-src'] = ['blob:'];
+    }
+    for(const match of html.matchAll(/<(img|video|audio|source)\b[^>]*\bsrc\s*=\s*["'](https:\/\/[^"']+)["']/gi)) {
+      try {const origin=new URL(match[2]).origin;const name=match[1].toLowerCase()==='img'?'img-src':'media-src';result[name]=[...new Set([...(result[name]||[]),origin])];}catch{}
+    }
+    for(const match of html.matchAll(/<img\b[^>]*\bdata-original\s*=\s*["'](https:\/\/[^"']+)["']/gi)){try{const origin=new URL(match[1]).origin;result['img-src']=[...new Set([...(result['img-src']||[]),origin])];}catch{}}
+  }
+  return result;
+}
+export function injectConsentPolicy(html,headers) {
+  if (!/^\s*(?:<!doctype html>\s*)?<html\b/i.test(html) || !/<head\b/i.test(html)) return html;
+  // Use the global source policy when provided (e.g. first-party upload endpoints).
+  let policy=globalPolicy(headers);
+  if (!policy) return html.replace(/(<head\b[^>]*>)([\s\S]*?)<\/head>/i,(_match,head,content)=>head+'\n<meta charset="utf-8">'+content.replace(/<meta\b[^>]*\bcharset\s*=\s*["']?[^\s"'>]+["']?[^>]*>/gi,'')+'</head>');
+  policy=policy.split(';').filter(part=>!/^\s*(?:frame-ancestors|sandbox|report-uri|report-to)\b/i.test(part)).join(';');
+  const escaped=policy.replaceAll('&','&amp;').replaceAll('"','&quot;').replaceAll('<','&lt;');
+  return html.replace(/(<head\b[^>]*>)([\s\S]*?)<\/head>/i,(_match,head,content)=>head+'\n<meta charset="utf-8">\n<meta http-equiv="Content-Security-Policy" content="'+escaped+'">'+content.replace(/<meta\b[^>]*\bcharset\s*=\s*["']?[^\s"'>]+["']?[^>]*>/gi,'')+'</head>');
+}
+function globalPolicy(headers) {
+  let scope='';
+  for(const line of headers.split(/\r?\n/)){if(line&&!/^\s/.test(line))scope=line.trim();else if(scope==='/*'&&/^\s*Content-Security-Policy:/i.test(line))return line.replace(/^\s*Content-Security-Policy:\s*/i,'');}
+}
+// Static hosts join repeated header values with commas. CSP treats each value
+// as a separate policy, so first expand default fallbacks, then partition only
+// disjoint directives. Splitting an origin list would incorrectly intersect it.
+export function serializeConsentHeaders(headers) {
+  return headers.replace(/^([ \t]*Content-Security-Policy:[ \t]*)([^\r\n]+)$/gim,(line,prefix,policy)=>{
+    if(line.length<=2000)return line;
+    const directives=new Map(policy.split(';').map(part=>part.trim().split(/\s+/)).filter(parts=>parts[0]).map(([name,...sources])=>[name,sources]));
+    const fallback=directives.get('default-src');
+    if(fallback) {
+      for(const name of ['script-src','style-src','img-src','connect-src','font-src','media-src','frame-src','worker-src','manifest-src','child-src','object-src']) {
+        if(directives.has(name))continue;
+        const inherited=name==='worker-src'?(directives.get('child-src')||directives.get('script-src')||fallback):name==='frame-src'?(directives.get('child-src')||fallback):fallback;
+        directives.set(name,inherited);
+      }
+      directives.delete('default-src');
+    }
+    // child-src only supplies frame/worker fallbacks. Separate policies would
+    // apply those fallbacks again and incorrectly block explicit permissions.
+    const child=directives.get('child-src');
+    if(child){if(!directives.has('frame-src'))directives.set('frame-src',child);if(!directives.has('worker-src'))directives.set('worker-src',child);directives.delete('child-src');}
+    const groups=[];
+    for(const names of [['script-src','script-src-elem','script-src-attr','worker-src'],['style-src','style-src-elem','style-src-attr']]) {
+      const parts=[];
+      for(const name of names){if(directives.has(name)){parts.push(name+' '+directives.get(name).join(' '));directives.delete(name);}}
+      if(parts.length)groups.push(parts.join('; '));
+    }
+    for(const [name,sources] of directives)groups.push(name+' '+sources.join(' '));
+    const chunks=[];let chunk='';
+    for(const directive of groups) {
+      if(prefix.length+directive.length>2000)throw new Error('CSP directive group exceeds the static host line limit; reduce its configured origins.');
+      if(prefix.length+chunk.length+(chunk?2:0)+directive.length>2000){chunks.push(prefix+chunk);chunk='';}
+      chunk+=(chunk?'; ':'')+directive;
+    }
+    if(chunk)chunks.push(prefix+chunk);
+    return chunks.join('\n');
+  });
+}