edgepress 2026.10.12 → 2026.10.14

package/README.md

@@ -8,7 +8,7 @@ EdgePress automatically registers page-specific native WebMCP tools for reading
 
 Document previews use the browser-only `document-viewer` package: PDF, DOC/DOCX, PPT/PPTX and XLS/XLSX render inside the page automatically without moving keyboard focus. Articles accept `!document[Report](/documents/report.docx)`; Pages support `type: document`. Remote direct-file URLs require a configured consent service and CORS. See the theme-development guide.
 
-The dependency is pinned to a full commit in the public [document-viewer repository](https://github.com/jsw-teams/document-viewer). Cloud `npm ci` needs no sibling checkout, bundled source snapshot or Office conversion software. Publish and validate document-viewer first, then update the dependency URL and lockfile here. Sites can consume the resulting pinned EdgePress commit without copying either implementation.
+The dependency is pinned to a full commit in the public [document-viewer repository](https://github.com/jsw-teams/document-viewer). Cloud `npm install` needs no sibling checkout, bundled source snapshot or Office conversion software. Publish and validate document-viewer first, then update the dependency URL and lockfile here. Sites can consume the resulting pinned EdgePress commit without copying either implementation.
 
 [![Deploy to Cloudflare](https://deploy.workers.cloudflare.com/button)](https://deploy.workers.cloudflare.com/?url=https://github.com/jsw-teams/edgepress)
 [![Deploy to EdgeOne Pages](https://cdnstatic.tencentcs.com/edgeone/pages/deploy.svg)](https://edgeone.ai/pages/new?repository-url=https%3A%2F%2Fgithub.com%2Fjsw-teams%2Fedgepress&build-command=npm%20run%20build&install-command=npm%20ci&output-directory=dist)
@@ -36,7 +36,7 @@ Buttons open repository setup. Cloudflare, Vercel, Netlify and EdgeOne support r
 
 ## Quick start
 
-The commands below install the published npm release and initialize a new project directory. For the latest GitHub changes, use the deployment buttons or clone this repository, then run `npm ci` and `npm run dev` from its root:
+The commands below install the published npm release and initialize a new project directory. For the latest GitHub changes, use the deployment buttons or clone this repository, then run `npm install` and `npm run dev` from its root:
 
     mkdir my-edgepress-site
     cd my-edgepress-site
@@ -45,10 +45,37 @@ The commands below install the published npm release and initialize a new projec
     npm install
     npm run dev
 
-Use Node.js 22.12 or newer. Set the real site URL and operator contact in config.yml before publishing. Deploy with edgepress deploy. When developing EdgePress itself, use `npm ci`, then `npm link` to expose the local CLI.
+Use Node.js 22.12 or newer. Set the real site URL and operator contact in config.yml before publishing. Deploy with edgepress deploy. When developing EdgePress itself, use `npm install`, then `npm link` to expose the local CLI.
 
 Run `edgepress init` in a new project directory to scaffold a site pinned to the installed EdgePress release. The initializer keeps the existing package name and scripts.
 
+## Maintainer npm and GitHub releases
+
+Releases use **year.month.number of updates in that month**, not the calendar day. For example, `2026.10.12` is the twelfth update in October 2026; `2026.10.13` follows it, and November starts at `2026.11.1`. The release workflow uses **UTC** for the month boundary and checks `package.json`, existing `vYYYY.M.N` tags and published npm versions to avoid reusing a version.
+
+Once the npm package owner has configured **Trusted Publishing** at [npmjs.com](https://www.npmjs.com/package/edgepress/access), choose GitHub Actions with owner `jsw-teams`, repository `edgepress`, workflow filename **`publish.yml`**, and allow **`npm publish`** (not only staging). No environment name is used. This is a one-time npm-side setup; no long-lived `NPM_TOKEN` is required. Restrict traditional publish tokens after confirming the first successful trusted publish.
+
+To publish new source, a repository maintainer opens **Actions → Publish npm and GitHub Release → Run workflow** on `main`. The manual-only job installs Node 22 and npm 11, determines the next monthly update number, updates both package manifests, audits dependencies, runs the full browser test suite, builds the project and packs the source. Only after all checks pass does it push a non-force release commit and tag, publish that exact archive to npm with provenance, and create a GitHub Release containing the same `.tgz` and SHA-256 checksum. Ordinary pushes and PRs cannot trigger a publish.
+
+**Recovery:** If a run fails *after* pushing its version tag, do not launch a new release blindly: check whether the tag, npm version or GitHub Release already exists and reconcile the incomplete publish first. npm versions cannot be overwritten. Protected branches must explicitly permit the GitHub Actions bot to create the release commit/tag or use a maintainer-approved release branch process.
+
+## Visual Pages editor / 可视化页面编辑器
+
+Run `npm run editor` (or `npx edgepress editor` in an initialized site), then open **http://127.0.0.1:4178/**. The editor now supports **＋ 新建页面**: choose a title, optional URL slug and configured language; the new JSON Page opens immediately in the visual canvas. Existing Pages can still be selected, arranged into 1–4 columns and edited without touching JSON.
+
+从命令行也可以新建页面：
+
+```sh
+edgepress new pages "About our project" --lang en --slug about
+edgepress new pages "关于我们" --lang zh-cn --slug about
+```
+
+The shortcut `edgepress new page` is also accepted. By default, the CLI creates `content/pages/<slug>/<locale>.json` in the site's default language. Existing pages, legacy `.md` equivalents, and symlinked directories cannot be overwritten. The generated `$schema` reference points to the installed framework (or the local development schema). Run `npm run editor` to continue editing, and `npm run build` to validate the actual generated site.
+
+**Shared block catalog:** `src/page-block-catalog.json` ships with the npm package and defines starter templates for **all 30 supported Pages block types**. This includes site-reusable `link-directory`, `media-text`, `feature-grid`, `privacy-controller`, `document`, `media-viewer` and consent-controlled integrations used by other frontends. Reuse the public EdgePress catalog from site projects (including private ones); do not copy private pages or integrate site-specific services into the framework. Third-party service, CAPTCHA, ad and local-tool blocks are available as templates but **require site configuration and valid resource URLs** before a build; inserting the template does not activate a service.
+
+The editor runs **only on 127.0.0.1**, never on deployed static sites. It enforces origin checks, path restrictions, revision-conflict detection and atomic saves. Unrecognized block properties are kept; complex nested fields can still be edited in the inspector's advanced JSON input. The canvas previews structure, not theme-perfect output. Articles remain Markdown.
+
 ## External link prompts
 
 The optional local prompt shows the complete destination URL (including path, query and fragment) once, with no duplicate hostname, and lets the visitor return or continue. It makes no request to the destination before confirmation. Configure exact origins, not wildcard domains:
@@ -173,7 +200,7 @@ Project guides are published from content/pages/: project introduction, quick st
 
 Version 2026.10.1 starts the October 2026 release series. Read the [October release notes](content/posts/2026-10-01-edgepress-release-2026-10-1/). The September updates are recorded in the [request 1 notes](content/posts/2026-09-24-edgepress-release-2026-9-1/), [request 2 notes](content/posts/2026-09-25-edgepress-release-2026-9-2/), [request 3 notes](content/posts/2026-09-25-edgepress-release-2026-9-3/), [request 4 notes](content/posts/2026-09-25-edgepress-release-2026-9-4/), [request 5 notes](content/posts/2026-09-25-edgepress-release-2026-9-5/), [request 6 notes](content/posts/2026-09-25-edgepress-release-2026-9-6/), [request 7 notes](content/posts/2026-09-26-edgepress-release-2026-9-7/), [request 8 notes](content/posts/2026-09-26-edgepress-release-2026-9-8/), [request 9 notes](content/posts/2026-09-26-edgepress-release-2026-9-9/), and [request 10 notes](content/posts/2026-09-27-edgepress-release-2026-9-10/).
 
-This release publishes page media from content/assets/, updates Wrangler to 4.144.0, and adds scheduled dependency checks and version-scoped Codex Security scans. Optional services remain disabled until a visitor makes an explicit choice.
+This release publishes page media from content/assets/ and updates Wrangler to 4.144.0. GitHub Actions retains only scheduled and lockfile-change dependency security audits. Optional services remain disabled until a visitor makes an explicit choice.
 
 ## Journal categories, navigation, and author profiles
 
@@ -227,7 +254,7 @@ Multiple post lists on the same page share a displayed-article set: an article a
 
 ## Static platform deployment
 
-Run npm run deploy:cloudflare, npm run deploy:vercel, npm run deploy:netlify, npm run deploy:edgeone -- -n my-site, or npm run deploy:esa -- --name my-site. Platform authentication is required. GitHub Actions also provides a manual Deploy static website workflow using repository Secrets.
+Run npm run deploy:cloudflare, npm run deploy:vercel, npm run deploy:netlify, npm run deploy:edgeone -- -n my-site, or npm run deploy:esa -- --name my-site. Platform authentication is required. Deployments run locally; GitHub Actions is limited to dependency security audits.
 
 
 All platforms build dist/. CSS and JS are fingerprinted, with one-year immutable cache policies for Cloudflare, Vercel, Netlify and EdgeOne. ESA uses the same assets; set its browser and edge cache rules for hashed CSS/JS while leaving HTML short-lived. See the [deployment guide](content/pages/deployment/en.json) and [ESA build configuration](https://help.aliyun.com/en/edge-security-acceleration/esa/user-guide/build-pages).
@@ -261,3 +288,5 @@ Real static website output demonstrates what the builder produces. Product recor
 Project recordings use manual play/pause and a seekable progress bar, with theme colors and keyboard support. The reproducible CLI/editor workbench lives in [tools/recordings/demo-workbench.mjs](tools/recordings/demo-workbench.mjs); see [the recording guide](content/guides/product-demos.md). Built-in navigation and page icons come from the pinned Lucide 1.52 library, bundled locally with its license.
 
 Development files: tests/ contains regression tests and fixtures; tools/assets/ maintains source assets; tools/recordings/ contains desktop capture workflows; tools/verification/ contains browser audits; tools/reports/ holds generated evidence. Run npm test and npm run check after changes.
+
+Dependency maintenance uses compatible release ranges without retained lockfiles. The media and document viewers follow Git semver release ranges; audits resolve fresh dependency snapshots outside the checkout and remove them after use. Dependabot checks daily, including security updates; changed dependencies must pass the full browser suite before release.

package/config.yml

@@ -1,10 +1,10 @@
 # Site configuration (site, theme, privacy, optional consent services).
 # Build paths and enabled locales belong to edgepress.config.mjs.
-site:
-  timeZone: Asia/Taipei
-  title: EdgePress
-  description: A static website builder for Cloudflare Workers with editable pages, Markdown posts, themes, and plugins.
-  url: https://example.org
+site:
+  timeZone: Asia/Taipei
+  title: EdgePress
+  description: A static website builder for Cloudflare Workers with editable pages, Markdown posts, themes, and plugins.
+  url: https://example.org
   language: en
   dataSaver: # site (optional text view; requires the theme dataSaver assets)
     enabled: false
@@ -13,169 +13,169 @@ site:
     detectSlowConnection: false
     respectBrowserPreference: false
     promptAfterMs: 5000
-  head:
-    titleSuffix: ""
-    titleSeparator: " · "
-  header:
-    showBrand: true
-    brandLabel: ""
-  components:
-    header: true
-    primaryNavigation: true
-    languageNavigation: true
-    footer: true
-    footerNavigation: true
-  navigation:
-    - key: home
-      url: "@home"
-      labels:
-        en: Home
-        zh-CN: 首页
-    - key: guides
-      url: /project-introduction/
-      labels:
-        en: Guides
-        zh-CN: 项目指南
-    - key: quick-start
-      url: /quick-start/
-      labels:
-        en: Quick start
-        zh-CN: 快速入门
-    - key: posts
-      url: "@archives"
-      labels:
-        en: Posts
-        zh-CN: 文章
-    - key: search
-      url: "@search"
-      labels:
-        en: Search
-        zh-CN: 搜索
-  footerNavigation:
-    - key: privacy
-      url: /privacy-policy/
-      labels:
-        en: Privacy policy
-        zh-CN: 隐私政策
-    - key: feed
-      url: "@feed"
-      labels:
-        en: Atom feed
-        zh-CN: Atom 订阅
-  footer: ""
-  author:
-    name: toewpq
-    avatar: /edgepress/brand/avatar.png
-  seo:
-    author: toewpq
-    keywords:
-      - Markdown website builder
-      - Cloudflare Workers
-      - static site generator
-    image: https://example.org/edgepress/brand/og-image.png
-    robots: index,follow
-  agentSeo:
-    enabled: true
-    summary: A static website builder for Cloudflare Workers, with row-based editable pages, Markdown posts,
-      themes, plugins, and consent-gated integrations.
-    topics:
-      - Markdown website builder
-      - Cloudflare Workers
-      - composable page blocks
-      - plugin development
-    llmsTxt: true
-    agentCrawlers:
-      - GPTBot
-      - ClaudeBot
-      - PerplexityBot
-privacy:
-  controller:
-    name: toewpq
-    contact: toewpq@gmail.com
-  policyUrl: /privacy-policy/
-plugins:
-  consent:
-    enabled: true
-    proposedDate: 2026-09-26
-    effectiveDate: 2026-09-26
-    expiresDays: 180
-    services:
-      - id: cloudflare-web-analytics
-        provider: cloudflare-web-analytics
-        name:
-          en: Cloudflare Web Analytics
-          zh-CN: Cloudflare 网站分析
-        purpose:
-          en: Measure visits and page performance to improve this site, only after you opt in.
-          zh-CN: 在你同意后统计访问与页面性能，用于改进本站。
-        dataCategories:
-          en: Performance timing and page-view metrics; dimensions can include path, referrer, device, browser,
-            operating system, and country. Cloudflare receives the beacon request's source IP and says it
-            discards it at the nearest data center without storing it in core databases or logs.
-          zh-CN: 性能计时和页面浏览指标，维度可能包括页面路径、来源页、设备、浏览器、操作系统和国家或地区。Cloudflare 会在信标请求中接收来源 IP，并表示会在最近的数据中心将其丢弃，不保存到核心数据库或日志中。
-        recipient:
-          en: Cloudflare, Inc.
-          zh-CN: Cloudflare, Inc.
-        retention:
-          en: Unsampled beacon data is kept for 7 days, then aggregated to about 10% for long-term storage. Dashboard
-            history is available for 6 months.
-          zh-CN: 未采样的信标数据保留 7 天，之后会汇总为约 10% 的长期数据。仪表板可查看最近 6 个月的历史记录。
-        privacyUrl: https://developers.cloudflare.com/speed/observatory/rum-beacon/
-        token: 8347d72ba9f84e6783bf441e7832a80e
-      - id: youtube
-        provider: oembed
-        enabled: true
-        name: YouTube
-        purpose:
-          en: With your permission, load YouTube media and its player on request.
-          zh-CN: 在你同意后，按你的请求加载 YouTube 分享内容及播放器。
-        dataCategories:
-          en: Requested content URL, IP address, browser information; provider cookies may be used after loading.
-          zh-CN: 请求的内容链接、IP 地址、浏览器信息；加载后平台可能使用其 Cookie。
-        recipient: YouTube
-        retention:
-          en: The site keeps the consent choice for 180 days; provider retention follows its linked privacy policy.
-          zh-CN: 本站保存授权选择 180 天；平台处理与保留规则见所链接的隐私政策。
-        privacyUrl: https://policies.google.com/privacy
-        backendUrl: https://www.youtube.com
-        oembedEndpoint: https://www.youtube.com/oembed
-        sourceOrigins:
-          - https://www.youtube.com
-          - https://youtu.be
-          - https://youtube.com
-          - https://m.youtube.com
-        embedOrigins:
-          - https://www.youtube.com
-          - https://www.youtube-nocookie.com
-      - id: x-posts
-        provider: oembed
-        enabled: true
-        name: X
-        purpose:
-          en: With your permission, load X media and its player on request.
-          zh-CN: 在你同意后，按你的请求加载 X 分享内容及播放器。
-        dataCategories:
-          en: Requested content URL, IP address, browser information; provider cookies may be used after loading.
-          zh-CN: 请求的内容链接、IP 地址、浏览器信息；加载后平台可能使用其 Cookie。
-        recipient: X
-        retention:
-          en: The site keeps the consent choice for 180 days; provider retention follows its linked privacy policy.
-          zh-CN: 本站保存授权选择 180 天；平台处理与保留规则见所链接的隐私政策。
-        privacyUrl: https://x.com/en/privacy
-        backendUrl: https://x.com
-        oembedEndpoint: https://publish.x.com/oembed
-        sourceOrigins:
-          - https://x.com
-          - https://twitter.com
-          - https://www.x.com
-          - https://www.twitter.com
-        embedOrigins:
-          - https://platform.x.com
-          - https://platform.twitter.com
-          - https://syndication.twitter.com
-          - https://cdn.syndication.twimg.com
-          - https://pbs.twimg.com
-          - https://abs.twimg.com
-          - https://video.twimg.com
-        embedScripts:
-          - https://platform.x.com/widgets.js
+  head:
+    titleSuffix: ""
+    titleSeparator: " · "
+  header:
+    showBrand: true
+    brandLabel: ""
+  components:
+    header: true
+    primaryNavigation: true
+    languageNavigation: true
+    footer: true
+    footerNavigation: true
+  navigation:
+    - key: home
+      url: "@home"
+      labels:
+        en: Home
+        zh-CN: 首页
+    - key: guides
+      url: /project-introduction/
+      labels:
+        en: Guides
+        zh-CN: 项目指南
+    - key: quick-start
+      url: /quick-start/
+      labels:
+        en: Quick start
+        zh-CN: 快速入门
+    - key: posts
+      url: "@archives"
+      labels:
+        en: Posts
+        zh-CN: 文章
+    - key: search
+      url: "@search"
+      labels:
+        en: Search
+        zh-CN: 搜索
+  footerNavigation:
+    - key: privacy
+      url: /privacy-policy/
+      labels:
+        en: Privacy policy
+        zh-CN: 隐私政策
+    - key: feed
+      url: "@feed"
+      labels:
+        en: Atom feed
+        zh-CN: Atom 订阅
+  footer: ""
+  author:
+    name: toewpq
+    avatar: /edgepress/brand/avatar.png
+  seo:
+    author: toewpq
+    keywords:
+      - Markdown website builder
+      - Cloudflare Workers
+      - static site generator
+    image: https://example.org/edgepress/brand/og-image.png
+    robots: index,follow
+  agentSeo:
+    enabled: true
+    summary: A static website builder for Cloudflare Workers, with row-based editable pages, Markdown posts,
+      themes, plugins, and consent-gated integrations.
+    topics:
+      - Markdown website builder
+      - Cloudflare Workers
+      - composable page blocks
+      - plugin development
+    llmsTxt: true
+    agentCrawlers:
+      - GPTBot
+      - ClaudeBot
+      - PerplexityBot
+privacy:
+  controller:
+    name: toewpq
+    contact: toewpq@gmail.com
+  policyUrl: /privacy-policy/
+plugins:
+  consent:
+    enabled: true
+    proposedDate: 2026-09-26
+    effectiveDate: 2026-09-26
+    expiresDays: 180
+    services:
+      - id: cloudflare-web-analytics
+        provider: cloudflare-web-analytics
+        name:
+          en: Cloudflare Web Analytics
+          zh-CN: Cloudflare 网站分析
+        purpose:
+          en: Measure visits and page performance to improve this site, only after you opt in.
+          zh-CN: 在你同意后统计访问与页面性能，用于改进本站。
+        dataCategories:
+          en: Performance timing and page-view metrics; dimensions can include path, referrer, device, browser,
+            operating system, and country. Cloudflare receives the beacon request's source IP and says it
+            discards it at the nearest data center without storing it in core databases or logs.
+          zh-CN: 性能计时和页面浏览指标，维度可能包括页面路径、来源页、设备、浏览器、操作系统和国家或地区。Cloudflare 会在信标请求中接收来源 IP，并表示会在最近的数据中心将其丢弃，不保存到核心数据库或日志中。
+        recipient:
+          en: Cloudflare, Inc.
+          zh-CN: Cloudflare, Inc.
+        retention:
+          en: Unsampled beacon data is kept for 7 days, then aggregated to about 10% for long-term storage. Dashboard
+            history is available for 6 months.
+          zh-CN: 未采样的信标数据保留 7 天，之后会汇总为约 10% 的长期数据。仪表板可查看最近 6 个月的历史记录。
+        privacyUrl: https://developers.cloudflare.com/speed/observatory/rum-beacon/
+        token: 8347d72ba9f84e6783bf441e7832a80e
+      - id: youtube
+        provider: oembed
+        enabled: true
+        name: YouTube
+        purpose:
+          en: With your permission, load YouTube media and its player on request.
+          zh-CN: 在你同意后，按你的请求加载 YouTube 分享内容及播放器。
+        dataCategories:
+          en: Requested content URL, IP address, browser information; provider cookies may be used after loading.
+          zh-CN: 请求的内容链接、IP 地址、浏览器信息；加载后平台可能使用其 Cookie。
+        recipient: YouTube
+        retention:
+          en: The site keeps the consent choice for 180 days; provider retention follows its linked privacy policy.
+          zh-CN: 本站保存授权选择 180 天；平台处理与保留规则见所链接的隐私政策。
+        privacyUrl: https://policies.google.com/privacy
+        backendUrl: https://www.youtube.com
+        oembedEndpoint: https://www.youtube.com/oembed
+        sourceOrigins:
+          - https://www.youtube.com
+          - https://youtu.be
+          - https://youtube.com
+          - https://m.youtube.com
+        embedOrigins:
+          - https://www.youtube.com
+          - https://www.youtube-nocookie.com
+      - id: x-posts
+        provider: oembed
+        enabled: true
+        name: X
+        purpose:
+          en: With your permission, load X media and its player on request.
+          zh-CN: 在你同意后，按你的请求加载 X 分享内容及播放器。
+        dataCategories:
+          en: Requested content URL, IP address, browser information; provider cookies may be used after loading.
+          zh-CN: 请求的内容链接、IP 地址、浏览器信息；加载后平台可能使用其 Cookie。
+        recipient: X
+        retention:
+          en: The site keeps the consent choice for 180 days; provider retention follows its linked privacy policy.
+          zh-CN: 本站保存授权选择 180 天；平台处理与保留规则见所链接的隐私政策。
+        privacyUrl: https://x.com/en/privacy
+        backendUrl: https://x.com
+        oembedEndpoint: https://publish.x.com/oembed
+        sourceOrigins:
+          - https://x.com
+          - https://twitter.com
+          - https://www.x.com
+          - https://www.twitter.com
+        embedOrigins:
+          - https://platform.x.com
+          - https://platform.twitter.com
+          - https://syndication.twitter.com
+          - https://cdn.syndication.twimg.com
+          - https://pbs.twimg.com
+          - https://abs.twimg.com
+          - https://video.twimg.com
+        embedScripts:
+          - https://platform.x.com/widgets.js