edgepress 2026.10.1 → 2026.10.13

package/tools/verification/verify-brand.mjs

@@ -0,0 +1,180 @@
+import assert from 'node:assert/strict';
+import { createServer } from 'node:http';
+import { readFile, writeFile, readdir, mkdir, stat } from 'node:fs/promises';
+import { resolve, relative, sep, extname } from 'node:path';
+import { spawn } from 'node:child_process';
+import { chromium } from 'playwright';
+
+const site = resolve(process.argv[2] || process.cwd());
+const output = resolve(site, 'dist');
+const evidence = resolve(site, 'tools/reports/brand-verification');
+await mkdir(evidence, { recursive: true });
+const configFile = resolve(site, 'edgepress.config.mjs');
+const siteFile = resolve(site, 'config.yml');
+const originalConfig = await readFile(configFile, 'utf8');
+const originalSite = await readFile(siteFile, 'utf8');
+const configuredTheme = originalSite.match(/^theme:\s*(\S+)/m)?.[1];
+const defaultLocale = originalConfig.match(/defaultLocale:\s*["']([^"']+)/)?.[1];
+assert.ok(defaultLocale, 'Default language must be declared.');
+const themes = (await readdir(resolve(site, 'themes'), { withFileTypes: true })).filter((entry) => entry.isDirectory()).map((entry) => entry.name);
+const locales = (await Promise.all((await readdir(resolve(site, 'content/pages/home'))).filter((name) => /\.(?:md|json)$/.test(name)).map(async (name) => {
+  const text = await readFile(resolve(site, 'content/pages/home', name), 'utf8');
+  return name.endsWith('.json') ? JSON.parse(text).lang : text.match(/^lang:\s*(\S+)/m)?.[1];
+}))).filter(Boolean);
+const cli = await stat(resolve(site, 'src/cli.js')).then(() => resolve(site, 'src/cli.js')).catch(() => resolve(site, 'node_modules/edgepress/src/cli.js'));
+async function build() {
+  await new Promise((done, reject) => {
+    const child = spawn(process.execPath, [cli, 'build'], { cwd: site, windowsHide: true });
+    let text = '';
+    child.stdout.on('data', (chunk) => { text += chunk; });
+    child.stderr.on('data', (chunk) => { text += chunk; });
+    child.once('error', reject);
+    child.once('exit', (code) => code === 0 ? done() : reject(new Error(text)));
+  });
+}
+async function filesIn(directory) {
+  const entries = await readdir(directory, { withFileTypes: true });
+  return (await Promise.all(entries.map((entry) => entry.isDirectory() ? filesIn(resolve(directory, entry.name)) : resolve(directory, entry.name)))).flat();
+}
+const server = createServer(async (request, response) => {
+  try {
+    const pathname = decodeURIComponent(new URL(request.url, 'http://local.test').pathname);
+    let path = resolve(output, '.' + pathname);
+    const rel = relative(output, path);
+    if (rel === '..' || rel.startsWith('..' + sep)) throw new Error('Invalid path');
+    if ((await stat(path)).isDirectory()) path = resolve(path, 'index.html');
+    const types = { '.html': 'text/html; charset=utf-8', '.js': 'text/javascript', '.css': 'text/css', '.png': 'image/png', '.webp': 'image/webp', '.svg': 'image/svg+xml', '.json': 'application/json', '.ico': 'image/x-icon' };
+    response.writeHead(200, { 'Content-Type': types[extname(path)] || 'application/octet-stream', 'Cache-Control': 'no-store' });
+    response.end(await readFile(path));
+  } catch { response.writeHead(404); response.end('Not found'); }
+});
+await new Promise((done) => server.listen(0, '127.0.0.1', done));
+const base = 'http://127.0.0.1:' + server.address().port;
+const browser = await chromium.launch({ executablePath: 'C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe', headless: true });
+const results = [];
+const failures = [];
+try {
+  for (const theme of themes) {
+    if (configuredTheme) await writeFile(siteFile, originalSite.replace(/^theme:\s*\S+/m, 'theme: ' + theme));
+    else await writeFile(configFile, originalConfig.replace(/(theme:\s*["'])themes\/[^"']+(["'])/, '$1themes/' + theme + '$2'));
+    await build();
+    const htmlFiles = (await filesIn(output)).filter((file) => file.endsWith('.html'));
+    for (const file of htmlFiles) {
+      const html = await readFile(file, 'utf8');
+      assert.doesNotMatch(html, /<use\b|\/icons\.svg(?:#|["'])/i, 'Old sprite remains in ' + file);
+      for (const match of html.matchAll(/<img\b[^>]*\bsrc="(\/[^"]+)"/g)) {
+        const path = resolve(output, '.' + new URL(match[1], base).pathname);
+        await stat(path);
+      }
+    }
+    const article = await (async () => {
+      for (const file of htmlFiles) if ((await readFile(file, 'utf8')).includes('<article class="post">')) return '/' + relative(output, file).split(sep).join('/').replace(/index\.html$/, '');
+      return null;
+    })();
+    for (const scheme of ['light', 'dark']) {
+      for (const width of [390, 1440]) {
+        const context = await browser.newContext({ viewport: { width, height: 920 }, colorScheme: scheme });
+        await context.route('**/*', (route) => route.request().url().startsWith(base) ? route.continue() : route.abort());
+        const page = await context.newPage();
+        for (const locale of locales) {
+          const prefix = locale === defaultLocale ? '/' : '/' + locale + '/';
+          const paths = [prefix, prefix + 'archives/'];
+          if (await stat(resolve(output, '.' + prefix + 'archives/page/2/index.html')).then(() => true).catch(() => false)) paths.push(prefix + 'archives/page/2/');
+          if (await stat(resolve(output, '.' + prefix + 'edgepress/index.html')).then(() => true).catch(() => false)) paths.push(prefix + 'edgepress/');
+          for (const path of paths) {
+            await page.goto(base + path, { waitUntil: 'networkidle' });
+            const measured = await page.evaluate(async () => {
+              const images = [...document.querySelectorAll('img')];
+              for (const image of images) image.loading = 'eager';
+              await Promise.all(images.map((image) => image.decode().catch(() => {})));
+              const icons = [...document.querySelectorAll('.icon-library')];
+              return {
+                colorScheme: getComputedStyle(document.documentElement).colorScheme,
+                overflow: document.documentElement.scrollWidth > innerWidth + 1,
+                brokenImages: images.filter((image) => !image.complete || !image.naturalWidth).map((image) => image.src),
+                inlineSvg: document.querySelectorAll('svg,use').length,
+                iconSemantics: icons.every((image) => image.tagName === 'IMG' && image.alt === '' && image.getAttribute('aria-hidden') === 'true' && /\/edgepress\/icons\/[a-z-]+\.svg$/.test(image.src)),
+                rawLanguageCodes: [...document.querySelectorAll('.post-language')].some((element) => /^(?:en|zh-(?:CN|TW|SG))$/.test(element.textContent.trim())),
+                cardGap: document.querySelector('.post-list') ? parseFloat(getComputedStyle(document.querySelector('.post-list')).rowGap) : null,
+                cellGap: document.querySelector('.page-builder-cell') ? parseFloat(getComputedStyle(document.querySelector('.page-builder-cell')).rowGap) : null,
+                filter: icons.length ? getComputedStyle(icons[0]).filter : null,
+                h1: document.querySelectorAll('h1').length,
+                ogImage: document.querySelector('meta[property="og:image"]')?.content,
+                currentPage: document.querySelector('.pagination-current')?.getAttribute('aria-current')
+              };
+            });
+            assert.equal(measured.overflow, false, theme + ' ' + path + ' overflows at ' + width);
+            assert.deepEqual(measured.brokenImages, [], theme + ' ' + path + ' has broken images');
+            assert.equal(measured.inlineSvg, 0);
+            assert.equal(measured.iconSemantics, true);
+            assert.equal(measured.rawLanguageCodes, false);
+            assert.equal(measured.h1, 1);
+            assert.match(measured.ogImage || '', /^https:\/\/.+\.png$/);
+            if (measured.cardGap !== null) assert.ok(measured.cardGap >= 16);
+            if (measured.cellGap !== null) assert.ok(measured.cellGap >= 16);
+            if (measured.currentPage) assert.equal(measured.currentPage, 'page');
+            if (theme === 'signal' && measured.colorScheme === 'dark' || theme === 'lumen' && scheme === 'dark') assert.notEqual(measured.filter, 'none');
+            results.push({ theme, scheme, width, locale, path, ...measured });
+            if (path === prefix && locale === defaultLocale) {
+              await page.screenshot({ path: resolve(evidence, 'home-' + theme + '-' + width + '-' + scheme + '.png'), fullPage: true });
+              await page.keyboard.press('Tab');
+              assert.equal(await page.evaluate(() => document.activeElement.classList.contains('skip-link')), true, 'Skip link must be first keyboard target');
+              if (await page.locator('.privacy-settings-button').count()) {
+                if (await page.locator('.privacy-panel').isVisible()) await page.locator('.privacy-close').click();
+                await page.locator('.privacy-settings-button').click();
+                assert.equal(await page.locator('.privacy-settings-button').getAttribute('aria-expanded'), 'true');
+                assert.equal(await page.locator('.privacy-panel').isVisible(), true);
+                assert.equal(await page.locator('.privacy-panel svg').count(), 0);
+                const contrasts = await page.evaluate(() => {
+                  const luminance = (color) => {
+                    const values = color.match(/[\d.]+/g).slice(0, 3).map(Number).map((value) => {
+                      value /= 255;
+                      return value <= 0.04045 ? value / 12.92 : ((value + 0.055) / 1.055) ** 2.4;
+                    });
+                    return values[0] * 0.2126 + values[1] * 0.7152 + values[2] * 0.0722;
+                  };
+                  return [...document.querySelectorAll('.privacy-settings-button,.privacy-accept,.privacy-reject')].map((button) => {
+                    const style = getComputedStyle(button);
+                    const foreground = luminance(style.color);
+                    const background = luminance(style.backgroundColor);
+                    return (Math.max(foreground, background) + 0.05) / (Math.min(foreground, background) + 0.05);
+                  });
+                });
+                assert.ok(contrasts.every((ratio) => ratio >= 4.5), theme + ' privacy button contrast: ' + contrasts.join(', '));
+                await page.locator('.privacy-close').click();
+                assert.equal(await page.locator('.privacy-panel').isVisible(), false);
+                await page.screenshot({ path: resolve(evidence, 'home-' + theme + '-' + width + '-' + scheme + '.png'), fullPage: true });
+              }
+            }
+          }
+        }
+        if (article) {
+          await page.goto(base + article, { waitUntil: 'networkidle' });
+          if (await page.locator('.privacy-panel').isVisible()) await page.locator('.privacy-close').click();
+          if (await page.locator('.post-toc-toggle').count()) {
+            await page.evaluate(() => window.scrollTo(0, 400));
+            await page.locator('.post-toc-toggle').waitFor({ state: 'visible' });
+            assert.equal(await page.locator('.post-toc-toggle img').count(), 1);
+            await page.locator('.post-toc-toggle').click();
+            assert.equal(await page.locator('.post-toc-panel').isVisible(), true);
+            await page.locator('.post-toc-close').click();
+          }
+        }
+        await context.close();
+      }
+    }
+    console.log(theme + ': image references, layouts, locales, light/dark, keyboard and library icon controls passed.');
+  }
+} catch (error) {
+  failures.push(error.message);
+  process.exitCode = 1;
+  console.error(error.stack);
+} finally {
+  await writeFile(configFile, originalConfig);
+  await writeFile(siteFile, originalSite);
+  await build();
+  await browser.close();
+  await new Promise((done) => server.close(done));
+  await writeFile(resolve(evidence, 'browser-report.json'), JSON.stringify({ status: failures.length ? 'fail' : 'pass', cases: results.length, results, failures,
+    limitations: ['Browser measurements use desktop Edge and simulated viewports/color schemes. Physical devices and assistive screen readers were not tested.'] }, null, 2) + '\n');
+}

package/vercel.json

@@ -0,0 +1,36 @@
+{
+  "$schema": "https://openapi.vercel.sh/vercel.json",
+  "framework": null,
+  "installCommand": "npm ci",
+  "buildCommand": "npm run build",
+  "outputDirectory": "dist",
+  "trailingSlash": true,
+  "headers": [
+    {
+      "source": "/(.*)",
+      "headers": [
+        {
+          "key": "Cache-Control",
+          "value": "public, max-age=0, must-revalidate"
+        },
+        {
+          "key": "X-Content-Type-Options",
+          "value": "nosniff"
+        },
+        {
+          "key": "Referrer-Policy",
+          "value": "strict-origin-when-cross-origin"
+        }
+      ]
+    },
+    {
+      "source": "/:asset(.*\\.[a-f0-9]{16}\\..*)",
+      "headers": [
+        {
+          "key": "Cache-Control",
+          "value": "public, max-age=31536000, immutable"
+        }
+      ]
+    }
+  ]
+}

package/wrangler.jsonc

@@ -1,13 +1,11 @@
-// For the optional URL/token backend, add vars.BACKEND_URL (for example, https://api.example.org) and run `edgepress secret put BACKEND_TOKEN`.
 {
-  "$schema": "./node_modules/wrangler/config-schema.json",
   "name": "edgepress",
-  "main": "./src/worker.js",
-  "compatibility_date": "2026-09-01",
+  "compatibility_date": "2026-10-03",
   "assets": {
     "directory": "./dist",
-    "binding": "ASSETS",
     "html_handling": "auto-trailing-slash",
-    "run_worker_first": ["/api/*"]
-  }
+    "not_found_handling": "404-page"
+  },
+  "workers_dev": false,
+  "preview_urls": false
 }

package/content/pages/home/en.md

@@ -1,99 +0,0 @@
----
-title: EdgePress website builder
-lang: en
-slug: home
-homepage: true
-description: Build fast, secure websites on Cloudflare Workers with Markdown posts and editable page elements.
-keywords:
-  - website builder
-  - Cloudflare Workers
-  - page elements
-  - website plugins
-blocks:
-  - columns: 1
-    cells:
-      -
-        - type: hero
-          eyebrow: A project built for the edge
-          title: Build a fast website from clear, editable source files.
-          text: EdgePress turns Markdown posts, page layouts, themes, and consent-aware integrations into a static site served by Cloudflare Workers.
-          mascotSrc: /edgepress/brand/mascot-418.png
-          mascotAlt: A curious sparrow folded from layered paper pages, EdgePress's project mascot.
-          mascotWidth: 418
-          mascotHeight: 440
-          mascotSizes: 209px
-          mascotWebpSrcset:
-            - src: /edgepress/brand/mascot-209.webp
-              width: 209
-            - src: /edgepress/brand/mascot-418.webp
-              width: 418
-          cta:
-            label: Start with the quick guide
-            url: /quick-start/
-          highlights:
-            - Editable pages in localized Markdown front matter
-            - Articles written in Markdown
-            - Shared layouts and theme-defined palettes
-  - columns: 1
-    cells:
-      -
-        - type: feature-grid
-          title: A clear place for each part of a site
-          items:
-            - title: Pages use editable elements
-              icon: layout-grid
-              text: Set the number of columns first, then choose elements and edit their content in each page file.
-              url: /theme-development/
-            - title: Posts use Markdown
-              icon: file-text
-              text: Write long-form articles in Markdown and let the built-in renderer sanitize and format them.
-              url: /project-introduction/
-            - title: Themes own the design
-              icon: palette
-              text: Build layouts with HTML partials and keep each theme's color palette in its stylesheet.
-              url: /theme-development/
-            - title: Integrations wait for consent
-              icon: shield-check
-              text: Add tracking, statistics, advertising, or CAPTCHA services with provider details in configuration.
-              url: /plugin-development/
-  - columns: 2
-    cells:
-      -
-        - type: section
-          title: Learn the project
-          tone: soft
-          blocks:
-            - type: text
-              paragraphs:
-                - Start with the project introduction and quick start. The guides cover the feature lifecycle, supported runtimes, and the recommended publishing workflow.
-            - type: link-list
-              title: Project guides
-              items:
-                - label: Project introduction
-                  url: /project-introduction/
-                - label: Quick start
-                  url: /quick-start/
-      -
-        - type: section
-          title: Extend the project
-          tone: soft
-          blocks:
-            - type: text
-              paragraphs:
-                - Use theme partials for shared head metadata, navigation, footer, and error-page layout. Page-specific rows and element content stay in localized page files.
-                - Build plugins run in Node. Browser services wait for explicit consent before requesting vendor code.
-            - type: link-list
-              title: Development guides
-              items:
-                - label: Theme development
-                  url: /theme-development/
-                - label: Plugin development
-                  url: /plugin-development/
-  - columns: 1
-    cells:
-      -
-        - type: latest-posts
-          title: Latest project updates
-          count: 3
-          paginate: true
----

package/content/pages/home/zh-cn.md

@@ -1,99 +0,0 @@
----
-title: EdgePress 网站构建器
-lang: zh-CN
-slug: home
-homepage: true
-description: 使用 Markdown 文章和可编辑页面元素，在 Cloudflare Workers 上构建快速、安全的网站。
-keywords:
-  - 网站构建器
-  - Cloudflare Workers
-  - 页面元素
-  - 网站插件
-blocks:
-  - columns: 1
-    cells:
-      -
-        - type: hero
-          eyebrow: 为边缘网络构建
-          title: 用清晰、可编辑的源文件构建快速网站。
-          text: EdgePress 将 Markdown 文章、页面布局、主题和遵循同意状态的集成构建为由 Cloudflare Workers 提供服务的静态网站。
-          mascotSrc: /edgepress/brand/mascot-418.png
-          mascotAlt: EdgePress 吉祥物，一只由层叠折页构成、神情好奇的小鸟。
-          mascotWidth: 418
-          mascotHeight: 440
-          mascotSizes: 209px
-          mascotWebpSrcset:
-            - src: /edgepress/brand/mascot-209.webp
-              width: 209
-            - src: /edgepress/brand/mascot-418.webp
-              width: 418
-          cta:
-            label: 从快速入门开始
-            url: /[launge]/quick-start/
-          highlights:
-            - 在本地化 Markdown 前置数据中编辑页面
-            - 使用 Markdown 撰写文章
-            - 复用布局，配色由主题定义
-  - columns: 1
-    cells:
-      -
-        - type: feature-grid
-          title: 网站各部分各有清晰位置
-          items:
-            - title: 页面使用可编辑元素
-              icon: layout-grid
-              text: 先设置栏数，再选择元素类型，并在各页面文件中编辑对应内容。
-              url: /[launge]/theme-development/
-            - title: 文章使用 Markdown
-              icon: file-text
-              text: 使用 Markdown 撰写长文，由内置渲染器进行清理和排版。
-              url: /[launge]/project-introduction/
-            - title: 主题负责视觉设计
-              icon: palette
-              text: 使用 HTML 局部模板构建布局，并将各主题的配色保留在样式表中。
-              url: /[launge]/theme-development/
-            - title: 集成遵循用户同意
-              icon: shield-check
-              text: 配置跟踪、统计、广告或人机验证服务及其供应商信息。
-              url: /[launge]/plugin-development/
-  - columns: 2
-    cells:
-      -
-        - type: section
-          title: 了解项目
-          tone: soft
-          blocks:
-            - type: text
-              paragraphs:
-                - 从项目介绍和快速入门开始。指南涵盖功能生命周期、支持的运行环境和建议的发布流程。
-            - type: link-list
-              title: 项目指南
-              items:
-                - label: 项目介绍
-                  url: /[launge]/project-introduction/
-                - label: 快速入门
-                  url: /[launge]/quick-start/
-      -
-        - type: section
-          title: 扩展项目
-          tone: soft
-          blocks:
-            - type: text
-              paragraphs:
-                - 使用主题局部模板复用 head 元数据、导航、页脚和错误页布局。每个页面的行布局和元素内容保存在本地化页面文件中。
-                - 构建插件在 Node 中运行。浏览器服务会等到访客明确同意后才请求供应商代码。
-            - type: link-list
-              title: 开发指南
-              items:
-                - label: 主题开发
-                  url: /[launge]/theme-development/
-                - label: 插件开发
-                  url: /[launge]/plugin-development/
-  - columns: 1
-    cells:
-      -
-        - type: latest-posts
-          title: 最新项目动态
-          count: 3
-          paginate: true
----

package/content/pages/plugin-development/en.md

@@ -1,109 +0,0 @@
----
-title: Plugin development
-lang: en
-slug: plugin-development
-description: Extend EdgePress with trusted build plugins, consent-gated browser integrations, and private backend forwarding.
-blocks:
-  - columns: 1
-    cells:
-      -
-        - type: hero
-          eyebrow: Extension guide
-          title: Connect trusted build code, browser providers, and backend services.
-          text: Build-time plugins run in Node. Browser integrations wait for visitor consent. Runtime backend requests stay behind the Worker.
-  - columns: 2
-    cells:
-      -
-        - type: section
-          title: Build-time plugins
-          tone: soft
-          blocks:
-            - type: text
-              paragraphs:
-                - Local JavaScript modules in plugins/ may transform source documents, register hooks or renderers, and generate routes. They execute with the build process permissions, so only load code reviewed by the project owner.
-                - The starter consent plugin adds a privacy panel after the shared page layout. Build plugins are trusted code and are not deployed as browser scripts.
-            - type: code
-              title: Register a route generator
-              language: js
-              code: |
-                export default function projectMeta(api) {
-                  api.registerGenerator('project-meta', ({ site }) => ({
-                    path: 'project-meta.json',
-                    body: JSON.stringify({
-                      title: site.config.site.title,
-                      posts: site.posts.length
-                    }),
-                    contentType: 'application/json; charset=utf-8'
-                  }));
-                }
-      -
-        - type: section
-          title: Tracking, statistics, advertising, and CAPTCHA
-          tone: soft
-          blocks:
-            - type: text
-              paragraphs:
-                - Add browser providers in config.yml under plugins.consent.tracking, plugins.consent.statistics, plugins.consent.advertising, or plugins.consent.captcha. Each service needs a unique ID, provider, purpose, dataCategories, recipient, retention, a privacyUrl pointing to the provider's current privacy information, and its public site identifier. privacyUrl must be an HTTPS URL. Localized fields are maps keyed by every enabled locale, such as en and zh-CN.
-                - Available providers include Google Tag Manager and Meta Pixel; Cloudflare Web Analytics, Google Analytics, and Baidu Tongji; Google AdSense; and Cloudflare Turnstile, Google reCAPTCHA, and hCaptcha.
-                - Set plugins.consent.proposedDate to the YYYY-MM-DD date the notice was drafted. Set effectiveDate when the notice takes effect; omit it while no effective date has been set. Updating either date makes saved consent stale, so visitors are asked again.
-                - Provider code is imported only after the visitor accepts that integration. The first layer offers accept and reject together; service data and individual switches are available in its details. Keep CAPTCHA secret keys out of config.yml and client code. The server must submit each CAPTCHA response to the provider verification API before accepting a form.
-            - type: notice
-              title: Operator details
-              text: Fill privacy.controller.name, privacy.controller.contact, and privacy.policyUrl before configuring any browser provider. The build rejects provider services when the controller name or contact is blank.
-              tone: warning
-  - columns: 1
-    cells:
-      -
-        - type: section
-          title: Forward requests to a URL and token backend
-          blocks:
-            - type: text
-              paragraphs:
-                - The Worker exposes /api/v1/* for GET, POST, PUT, PATCH, and DELETE. With BACKEND_URL and BACKEND_TOKEN configured, it appends the request path and query to the backend URL, sends a Bearer token, forwards a small allowlist of request headers, and marks responses no-store.
-                - BACKEND_URL must use HTTPS. Plain HTTP is accepted only for localhost development. Request bodies are limited to 1 MB. The backend still needs to authenticate the scoped token, validate user input, authorize every action, and enforce rate and size limits.
-                - Prefer a Cloudflare BACKEND Service Binding for private Worker-to-Worker calls. A browser must never receive BACKEND_TOKEN. This generic proxy does not create application accounts, forms, or data models by itself.
-            - type: steps
-              items:
-                - title: Set the backend base URL
-                  text: Add vars.BACKEND_URL in wrangler.jsonc. Use an HTTPS base URL without credentials or a token in its URL.
-                - title: Store the secret
-                  text: Wrangler prompts for the secret value. Use a narrowly scoped backend token and rotate it under the operator's process.
-                  command: edgepress secret put BACKEND_TOKEN
-                - title: Configure and deploy
-                  text: Confirm the backend accepts the forwarded path and Bearer token, then deploy the Worker.
-                  command: edgepress deploy
-            - type: code
-              title: Local development
-              language: sh
-              code: |
-                # .dev.vars is local and must not be committed
-                BACKEND_URL=http://127.0.0.1:8788
-                BACKEND_TOKEN=replace-with-a-local-token
-            - type: text
-              text: The Worker returns 503 when no backend binding or URL and token are configured. It rejects unsupported methods and oversized request bodies.
-            - type: link-list
-              title: Provider validation reference
-              items:
-                - label: Cloudflare Turnstile Siteverify
-                  url: https://developers.cloudflare.com/turnstile/get-started/server-side-validation/
-                - label: EDPB consent summary
-                  url: https://www.edpb.europa.eu/system/files/2026-04/edpb-summary-consent_en.pdf
-  - columns: 1
-    cells:
-      -
-        - type: section
-          title: Content security and maintenance
-          blocks:
-            - type: text
-              paragraphs:
-                - The built-in Markdown renderer sanitizes post output. Custom renderers, plugins, themes, and files in static/ are trusted project code; review changes before building or deploying. Do not put secrets in posts, themes, or public assets.
-                - edgepress iterate writes a report-only review plan under .edgepress/reports/. It does not edit source files, update dependencies, or deploy. edgepress security checks dependency advisories. Review the lockfile and generated page report before deployment, and keep a known-good deployment for rollback.
-            - type: code
-              title: Review project changes
-              language: sh
-              code: |
-                edgepress security
-                edgepress iterate
-                edgepress check
-                edgepress server
----

package/content/pages/plugin-development/zh-cn.md

@@ -1,109 +0,0 @@
----
-title: 插件开发
-lang: zh-CN
-slug: plugin-development
-description: 使用可信构建插件、遵循同意设置的浏览器集成和私有后端转发扩展 EdgePress。
-blocks:
-  - columns: 1
-    cells:
-      -
-        - type: hero
-          eyebrow: 扩展指南
-          title: 连接可信构建代码、浏览器供应商和后端服务。
-          text: 构建插件在 Node 中运行。浏览器集成需等待访客同意。运行时后端请求由 Worker 转发。
-  - columns: 2
-    cells:
-      -
-        - type: section
-          title: 构建插件
-          tone: soft
-          blocks:
-            - type: text
-              paragraphs:
-                - plugins/ 中的本地 JavaScript 模块可以转换源文档、注册钩子或渲染器，并生成路由。它们拥有构建进程的权限，因此只应加载项目负责人审查过的代码。
-                - 起始同意插件会在共享页面布局后添加隐私面板。构建插件属于可信代码，不会作为浏览器脚本发布。
-            - type: code
-              title: 注册路由生成器
-              language: js
-              code: |
-                export default function projectMeta(api) {
-                  api.registerGenerator('project-meta', ({ site }) => ({
-                    path: 'project-meta.json',
-                    body: JSON.stringify({
-                      title: site.config.site.title,
-                      posts: site.posts.length
-                    }),
-                    contentType: 'application/json; charset=utf-8'
-                  }));
-                }
-      -
-        - type: section
-          title: 跟踪、统计、广告和人机验证
-          tone: soft
-          blocks:
-            - type: text
-              paragraphs:
-                - 在 config.yml 的 plugins.consent.tracking、plugins.consent.statistics、plugins.consent.advertising 或 plugins.consent.captcha 下添加浏览器供应商。每项需要唯一 ID、provider、purpose、dataCategories、recipient、retention、指向供应商当前隐私说明的 privacyUrl，以及公开站点标识。privacyUrl 必须是 HTTPS 地址。多语言字段需使用语言映射，覆盖已启用的每种语言，例如 en 与 zh-CN。
-                - 可用供应商包括 Google Tag Manager 和 Meta Pixel；Cloudflare Web Analytics、Google Analytics 和百度统计；Google AdSense；以及 Cloudflare Turnstile、Google reCAPTCHA 和 hCaptcha。
-                - plugins.consent.proposedDate 必须设置为 YYYY-MM-DD 格式的告知拟定日期。告知生效后再设置 effectiveDate；尚未生效时可以省略。修改任一日期都会使旧的同意记录失效，并重新询问访客。
-                - 只有访客接受对应集成后才会导入供应商代码。首层同时提供接受和拒绝，数据详情与逐项开关位于展开内容中。不要把 CAPTCHA 密钥放入 config.yml 或客户端代码。服务器必须在接受表单前将每个 CAPTCHA 响应提交给供应商验证 API。
-            - type: notice
-              title: 运营者信息
-              text: 配置浏览器供应商前，请填写 privacy.controller.name、privacy.controller.contact 和 privacy.policyUrl。控制者名称或联系方式为空时，构建器会拒绝启用供应商服务。
-              tone: warning
-  - columns: 1
-    cells:
-      -
-        - type: section
-          title: 通过 URL 和令牌转发后端请求
-          blocks:
-            - type: text
-              paragraphs:
-                - Worker 为 GET、POST、PUT、PATCH 和 DELETE 提供 /api/v1/* 接口。配置 BACKEND_URL 和 BACKEND_TOKEN 后，Worker 会将请求路径及查询参数附加到后端 URL，发送 Bearer 令牌，转发有限的请求头，并为响应设置 no-store。
-                - BACKEND_URL 必须使用 HTTPS。只有 localhost 开发环境允许普通 HTTP。请求正文最大为 1 MB。后端仍需验证受限令牌、校验用户输入、授权每项操作，并执行自己的请求频率和大小限制。
-                - 私有 Worker 间调用优先使用 Cloudflare BACKEND Service Binding。浏览器绝不能获得 BACKEND_TOKEN。此通用代理本身不会创建应用账户、表单或数据模型。
-            - type: steps
-              items:
-                - title: 设置后端基础 URL
-                  text: 在 wrangler.jsonc 中添加 vars.BACKEND_URL。基础 URL 应使用 HTTPS，且不能包含凭据或令牌。
-                - title: 保存密钥
-                  text: Wrangler 会提示输入密钥值。请使用权限范围有限的后端令牌，并依照运营者流程定期轮换。
-                  command: edgepress secret put BACKEND_TOKEN
-                - title: 配置并部署
-                  text: 确认后端接受转发路径和 Bearer 令牌，再部署 Worker。
-                  command: edgepress deploy
-            - type: code
-              title: 本地开发
-              language: sh
-              code: |
-                # .dev.vars 仅供本地使用，不要提交到版本库
-                BACKEND_URL=http://127.0.0.1:8788
-                BACKEND_TOKEN=replace-with-a-local-token
-            - type: text
-              text: 未配置后端绑定，或 URL 和令牌时，Worker 会返回 503。它会拒绝不支持的方法和过大的请求正文。
-            - type: link-list
-              title: 供应商验证参考
-              items:
-                - label: Cloudflare Turnstile Siteverify
-                  url: https://developers.cloudflare.com/turnstile/get-started/server-side-validation/
-                - label: EDPB 同意摘要
-                  url: https://www.edpb.europa.eu/system/files/2026-04/edpb-summary-consent_en.pdf
-  - columns: 1
-    cells:
-      -
-        - type: section
-          title: 内容安全与维护
-          blocks:
-            - type: text
-              paragraphs:
-                - 内置 Markdown 渲染器会清理文章输出。自定义渲染器、插件、主题和 static/ 中的文件都属于可信项目代码；构建或部署前应审查变更。不要将密钥放在文章、主题或公开资源中。
-                - edgepress iterate 会在 .edgepress/reports/ 下生成只读维护计划，不会修改源文件、更新依赖或部署。edgepress security 检查依赖安全公告。部署前请审查锁文件和页面报告，并保留可用于回滚的已知稳定部署。
-            - type: code
-              title: 审查项目变更
-              language: sh
-              code: |
-                edgepress security
-                edgepress iterate
-                edgepress check
-                edgepress server
----