edgepress 2026.9.3

package/README.md

@@ -0,0 +1,70 @@
+# EdgePress
+
+[![Deploy to Cloudflare](https://deploy.workers.cloudflare.com/button)](https://deploy.workers.cloudflare.com/?url=https://github.com/jsw-teams/edgepress)
+
+The button deploys this repository's demo site to your Cloudflare account. To create a new site, follow the npm quick start below.
+
+EdgePress builds static websites for Cloudflare Workers. Write posts in Markdown, compose pages from editable rows and elements, choose a shared theme, and build the site into dist/.
+
+## Quick start
+
+Install EdgePress from npm and initialize a new project directory:
+
+    mkdir my-edgepress-site
+    cd my-edgepress-site
+    npm install edgepress
+    edgepress init
+    npm install
+    edgepress server
+
+Use Node.js 22.12 or newer. Set the real site URL and operator contact in config.yml before publishing. Deploy with edgepress deploy. When developing EdgePress itself, use `npm ci`, then `npm link` to expose the local CLI.
+
+Run `edgepress init` in a new project directory to scaffold a site pinned to the installed EdgePress release. The initializer keeps the existing package name and scripts.
+
+## Page editing
+
+Each page has a folder under content/pages/ and one lowercase locale Markdown file per language. Keep the file body empty after its YAML front matter. Edit the ordered blocks there:
+
+- Choose a row column count first.
+- Add one cell per column.
+- Choose element types inside each cell.
+- Edit each element's copy, media, links, and presentation options in that page file.
+
+Posts under content/posts/ use the Markdown renderer. Themes own shared head, navigation, footer, error-page layout, and their CSS color palettes.
+
+## Project files
+
+- content/posts/<post-id>/: Markdown articles with one file per locale.
+- content/pages/<page-id>/: page layouts and all page element content.
+- themes/default/, themes/atelier/, themes/signal/: shared HTML layouts, partials, and theme styles. Themes installed from npm or created as a blank scaffold live here too.
+- config.yml: site metadata, navigation, privacy settings, and consent-gated browser services.
+- edgepress.config.mjs: paths, permalink, locales, and trusted build-time plugins.
+- languages/base/ and languages/packs/: interface dictionaries.
+- src/: CLI, builder, Markdown renderer, element renderer, page auditor, and Worker entry.
+- dist/: generated output. Never edit generated files by hand.
+
+## Commands
+
+- edgepress init: scaffold a new site in a project directory.
+- edgepress new "Article title": create a Markdown post.
+- edgepress build and edgepress generate: run the same generator and write static files to dist/ for Cloudflare Workers or static hosting.
+- edgepress server: start live local preview, rebuild on source changes, and refresh the audit report.
+- edgepress check: build, generate accessibility, agent-friendliness, and Markdown rendering findings, capture post/page desktop and mobile screenshots, and write the PDF report under tools/.
+- edgepress doctor: inspect runtime and Worker compatibility.
+- edgepress theme list and edgepress theme use <name>: inspect or select an installed theme.
+- edgepress theme install <npm-package>[@version]: install a theme package from npm without running its install scripts.
+- edgepress theme create <name>: make an empty, accessible HTML theme skeleton with editable partials and a blank stylesheet.
+- edgepress secret put BACKEND_TOKEN: store the backend token in Wrangler.
+- edgepress deploy: build and deploy to Cloudflare Workers.
+- Connect a GitHub repository to Cloudflare Workers Builds to deploy on pushes to main. The build and deploy scripts are detected from package.json.
+- edgepress clean: remove generated site and report files.
+- edgepress iterate: create a report-only maintenance plan.
+- edgepress security: check dependency advisories.
+
+The generated report is written to tools/page-check.md and tools/page-check.json. The accessible HTML source is tools/page-check-visual.html; the tagged PDF report is tools/page-check.pdf, with desktop and mobile post/page screenshots in tools/page-check-screenshots/. The mobile entries include their measured viewport and document widths. These automated checks do not replace manual accessibility or legal review.
+
+The header search page filters Markdown posts from the generated local search index; it does not send search queries to an external service. The first post, “EdgePress and Markdown: a complete writing guide,” documents and verifies the supported Markdown syntax in English and Chinese.
+
+Project guides are published from content/pages/: project introduction, quick start, theme development, plugin development, and privacy policy. The privacy policy intentionally reports that the starter site still needs a real site URL, operator name, and privacy contact before publication.
+
+Version 2026.9.3 records the third requested release update for September 2026. It is available as the `edgepress` npm package. See the [request 1 notes](content/posts/2026-09-24-edgepress-release-2026-9-1/), [request 2 notes](content/posts/2026-09-25-edgepress-release-2026-9-2/), and [request 3 notes](content/posts/2026-09-25-edgepress-release-2026-9-3/).

package/config.yml

@@ -0,0 +1,146 @@
+# Site owner settings. Replace the example URL before publishing.
+site:
+  title: EdgePress
+  description: A static website builder for Cloudflare Workers with editable pages, Markdown posts, themes, and plugins.
+  url: https://example.com
+  language: en
+  head:
+    titleSuffix: ""
+    titleSeparator: " · "
+  header:
+    showBrand: true
+    brandLabel: ""
+  components:
+    header: true
+    primaryNavigation: true
+    languageNavigation: true
+    footer: true
+    footerNavigation: true
+  navigation:
+    - key: home
+      url: "@home"
+      labels:
+        en: Home
+        zh-CN: 首页
+    - key: guides
+      url: /project-introduction/
+      labels:
+        en: Guides
+        zh-CN: 项目指南
+    - key: quick-start
+      url: /quick-start/
+      labels:
+        en: Quick start
+        zh-CN: 快速入门
+    - key: search
+      url: "@search"
+      labels:
+        en: Search
+        zh-CN: 搜索
+  footerNavigation:
+    - key: privacy
+      url: /privacy-policy/
+      labels:
+        en: Privacy policy
+        zh-CN: 隐私政策
+    - key: feed
+      url: "@feed"
+      labels:
+        en: Atom feed
+        zh-CN: Atom 订阅
+  footer: ""
+  seo:
+    author: EdgePress contributors
+    keywords:
+      - Markdown website builder
+      - Cloudflare Workers
+      - static site generator
+    image: ""
+    robots: index,follow
+  # GEO here means agent SEO: make authoritative project information easy to discover and interpret.
+  agentSeo:
+    enabled: true
+    summary: A static website builder for Cloudflare Workers, with row-based editable pages, Markdown posts, themes, plugins, and consent-gated integrations.
+    topics:
+      - Markdown website builder
+      - Cloudflare Workers
+      - composable page blocks
+      - plugin development
+    llmsTxt: true
+    agentCrawlers:
+      - GPTBot
+      - ClaudeBot
+      - PerplexityBot
+privacy:
+  controller:
+    name: ""
+    contact: ""
+  policyUrl: /privacy-policy/
+plugins:
+  consent:
+    enabled: true
+    version: "1"
+    expiresDays: 180
+  tracking:
+    enabled: true
+    services: []
+    # Example:
+    # - id: tag-manager
+    #   provider: google-tag-manager
+    #   purpose: Load consented campaign tags.
+    #   retention: Set and disclose the applicable retention period.
+    #   containerId: GTM-ABCD123
+    # - id: social-pixel
+    #   provider: meta-pixel
+    #   purpose: Measure consented campaign traffic.
+    #   retention: Set and disclose the provider's retention period.
+    #   pixelId: "123456789012345"
+  statistics:
+    enabled: true
+    services: []
+    # Examples use public provider IDs only.
+    # - id: primary-analytics
+    #   provider: google-analytics
+    #   purpose: Measure consented site visits.
+    #   retention: Set and disclose the provider's retention period.
+    #   measurementId: G-ABC12345
+    # - id: edge-analytics
+    #   provider: cloudflare-web-analytics
+    #   purpose: Measure consented site visits.
+    #   retention: Set and disclose the applicable retention period.
+    #   token: 01234567-89ab-cdef-0123-456789abcdef
+    # - id: baidu-analytics
+    #   provider: baidu-tongji
+    #   purpose: Measure consented site visits.
+    #   retention: Set and disclose the provider's retention period.
+    #   siteId: abcdef0123456789abcdef01
+  advertising:
+    enabled: true
+    services: []
+    # Example:
+    # - id: display-ads
+    #   provider: google-adsense
+    #   purpose: Display consented advertising.
+    #   retention: Set and disclose the provider's retention period.
+    #   clientId: ca-pub-1234567890123456
+  captcha:
+    enabled: true
+    services: []
+    # Choose a provider for each CAPTCHA block. Never add its secret key here.
+    # - id: contact-form-check
+    #   provider: cloudflare-turnstile
+    #   purpose: Reduce automated contact form submissions.
+    #   retention: Configure and disclose the provider's retention period.
+    #   siteKey: 0x4AAAAAAABBBBBBBBCCCCCCDDDD
+    # - id: signup-form-check
+    #   provider: google-recaptcha
+    #   purpose: Reduce automated signup submissions.
+    #   retention: Configure and disclose the provider's retention period.
+    #   siteKey: 6LcAbCdEfGhIjKlMnOpQrStUvWxYz0123456789a
+    # - id: support-form-check
+    #   provider: hcaptcha
+    #   purpose: Reduce automated support requests.
+    #   retention: Configure and disclose the provider's retention period.
+    #   siteKey: 0123456789abcdefghijklmnopqrstuvwx
+# Add browser services under these groups after filling the real site operator details above.
+# Every configured service waits for the visitor's explicit consent before its vendor code loads.

package/content/pages/home/en.md

@@ -0,0 +1,84 @@
+---
+title: EdgePress website builder
+lang: en
+slug: home
+homepage: true
+description: Build fast, secure websites on Cloudflare Workers with Markdown posts and editable page elements.
+keywords:
+  - website builder
+  - Cloudflare Workers
+  - page elements
+  - website plugins
+blocks:
+  - columns: 1
+    cells:
+      -
+        - type: hero
+          eyebrow: A project built for the edge
+          title: Build a fast website from clear, editable source files.
+          text: EdgePress turns Markdown posts, page layouts, themes, and consent-aware integrations into a static site served by Cloudflare Workers.
+          cta:
+            label: Start with the quick guide
+            url: /quick-start/
+          highlights:
+            - Editable pages in localized Markdown front matter
+            - Articles written in Markdown
+            - Shared layouts and theme-defined palettes
+  - columns: 1
+    cells:
+      -
+        - type: feature-grid
+          title: A clear place for each part of a site
+          items:
+            - title: Pages use editable elements
+              text: Set the number of columns first, then choose elements and edit their content in each page file.
+              url: /theme-development/
+            - title: Posts use Markdown
+              text: Write long-form articles in Markdown and let the built-in renderer sanitize and format them.
+              url: /project-introduction/
+            - title: Themes own the design
+              text: Build layouts with HTML partials and keep each theme's color palette in its stylesheet.
+              url: /theme-development/
+            - title: Integrations wait for consent
+              text: Add tracking, statistics, advertising, or CAPTCHA services with provider details in configuration.
+              url: /plugin-development/
+  - columns: 2
+    cells:
+      -
+        - type: section
+          title: Learn the project
+          tone: soft
+          blocks:
+            - type: text
+              paragraphs:
+                - Start with the project introduction and quick start. The guides cover the feature lifecycle, supported runtimes, and the recommended publishing workflow.
+            - type: link-list
+              title: Project guides
+              items:
+                - label: Project introduction
+                  url: /project-introduction/
+                - label: Quick start
+                  url: /quick-start/
+      -
+        - type: section
+          title: Extend the project
+          tone: soft
+          blocks:
+            - type: text
+              paragraphs:
+                - Use theme partials for shared head metadata, navigation, footer, and error-page layout. Page-specific rows and element content stay in localized page files.
+                - Build plugins run in Node. Browser services wait for explicit consent before requesting vendor code.
+            - type: link-list
+              title: Development guides
+              items:
+                - label: Theme development
+                  url: /theme-development/
+                - label: Plugin development
+                  url: /plugin-development/
+  - columns: 1
+    cells:
+      -
+        - type: latest-posts
+          title: Latest project updates
+          count: 3
+---

package/content/pages/home/zh-cn.md

@@ -0,0 +1,84 @@
+---
+title: EdgePress 网站构建器
+lang: zh-CN
+slug: home
+homepage: true
+description: 使用 Markdown 文章和可编辑页面元素，在 Cloudflare Workers 上构建快速、安全的网站。
+keywords:
+  - 网站构建器
+  - Cloudflare Workers
+  - 页面元素
+  - 网站插件
+blocks:
+  - columns: 1
+    cells:
+      -
+        - type: hero
+          eyebrow: 为边缘网络构建
+          title: 用清晰、可编辑的源文件构建快速网站。
+          text: EdgePress 将 Markdown 文章、页面布局、主题和遵循同意状态的集成构建为由 Cloudflare Workers 提供服务的静态网站。
+          cta:
+            label: 从快速入门开始
+            url: /quick-start/
+          highlights:
+            - 在本地化 Markdown 前置数据中编辑页面
+            - 使用 Markdown 撰写文章
+            - 复用布局，配色由主题定义
+  - columns: 1
+    cells:
+      -
+        - type: feature-grid
+          title: 网站各部分各有清晰位置
+          items:
+            - title: 页面使用可编辑元素
+              text: 先设置栏数，再选择元素类型，并在各页面文件中编辑对应内容。
+              url: /theme-development/
+            - title: 文章使用 Markdown
+              text: 使用 Markdown 撰写长文，由内置渲染器进行清理和排版。
+              url: /project-introduction/
+            - title: 主题负责视觉设计
+              text: 使用 HTML 局部模板构建布局，并将各主题的配色保留在样式表中。
+              url: /theme-development/
+            - title: 集成遵循用户同意
+              text: 配置跟踪、统计、广告或人机验证服务及其供应商信息。
+              url: /plugin-development/
+  - columns: 2
+    cells:
+      -
+        - type: section
+          title: 了解项目
+          tone: soft
+          blocks:
+            - type: text
+              paragraphs:
+                - 从项目介绍和快速入门开始。指南涵盖功能生命周期、支持的运行环境和建议的发布流程。
+            - type: link-list
+              title: 项目指南
+              items:
+                - label: 项目介绍
+                  url: /project-introduction/
+                - label: 快速入门
+                  url: /quick-start/
+      -
+        - type: section
+          title: 扩展项目
+          tone: soft
+          blocks:
+            - type: text
+              paragraphs:
+                - 使用主题局部模板复用 head 元数据、导航、页脚和错误页布局。每个页面的行布局和元素内容保存在本地化页面文件中。
+                - 构建插件在 Node 中运行。浏览器服务会等到访客明确同意后才请求供应商代码。
+            - type: link-list
+              title: 开发指南
+              items:
+                - label: 主题开发
+                  url: /theme-development/
+                - label: 插件开发
+                  url: /plugin-development/
+  - columns: 1
+    cells:
+      -
+        - type: latest-posts
+          title: 最新项目动态
+          count: 3
+---

package/content/pages/plugin-development/en.md

@@ -0,0 +1,108 @@
+---
+title: Plugin development
+lang: en
+slug: plugin-development
+description: Extend EdgePress with trusted build plugins, consent-gated browser integrations, and private backend forwarding.
+blocks:
+  - columns: 1
+    cells:
+      -
+        - type: hero
+          eyebrow: Extension guide
+          title: Connect trusted build code, browser providers, and backend services.
+          text: Build-time plugins run in Node. Browser integrations wait for visitor consent. Runtime backend requests stay behind the Worker.
+  - columns: 2
+    cells:
+      -
+        - type: section
+          title: Build-time plugins
+          tone: soft
+          blocks:
+            - type: text
+              paragraphs:
+                - Local JavaScript modules in plugins/ may transform source documents, register hooks or renderers, and generate routes. They execute with the build process permissions, so only load code reviewed by the project owner.
+                - The starter consent plugin adds a privacy panel after the shared page layout. Build plugins are trusted code and are not deployed as browser scripts.
+            - type: code
+              title: Register a route generator
+              language: js
+              code: |
+                export default function projectMeta(api) {
+                  api.registerGenerator('project-meta', ({ site }) => ({
+                    path: 'project-meta.json',
+                    body: JSON.stringify({
+                      title: site.config.site.title,
+                      posts: site.posts.length
+                    }),
+                    contentType: 'application/json; charset=utf-8'
+                  }));
+                }
+      -
+        - type: section
+          title: Tracking, statistics, advertising, and CAPTCHA
+          tone: soft
+          blocks:
+            - type: text
+              paragraphs:
+                - Add browser providers in config.yml under plugins.tracking, plugins.statistics, plugins.advertising, or plugins.captcha. Each entry needs a unique ID, purpose, retention description, and a public provider identifier.
+                - Available providers include Google Tag Manager and Meta Pixel; Cloudflare Web Analytics, Google Analytics, and Baidu Tongji; Google AdSense; and Cloudflare Turnstile, Google reCAPTCHA, and hCaptcha.
+                - Provider code is imported only after the visitor accepts that integration. Keep CAPTCHA secret keys out of config.yml and client code. The server must submit each CAPTCHA response to the provider verification API before accepting a form.
+            - type: notice
+              title: Operator details
+              text: Fill privacy.controller.name, privacy.controller.contact, and privacy.policyUrl before configuring any browser provider. The build rejects provider services when the controller name or contact is blank.
+              tone: warning
+  - columns: 1
+    cells:
+      -
+        - type: section
+          title: Forward requests to a URL and token backend
+          blocks:
+            - type: text
+              paragraphs:
+                - The Worker exposes /api/v1/* for GET, POST, PUT, PATCH, and DELETE. With BACKEND_URL and BACKEND_TOKEN configured, it appends the request path and query to the backend URL, sends a Bearer token, forwards a small allowlist of request headers, and marks responses no-store.
+                - BACKEND_URL must use HTTPS. Plain HTTP is accepted only for localhost development. Request bodies are limited to 1 MB. The backend still needs to authenticate the scoped token, validate user input, authorize every action, and enforce rate and size limits.
+                - Prefer a Cloudflare BACKEND Service Binding for private Worker-to-Worker calls. A browser must never receive BACKEND_TOKEN. This generic proxy does not create application accounts, forms, or data models by itself.
+            - type: steps
+              items:
+                - title: Set the backend base URL
+                  text: Add vars.BACKEND_URL in wrangler.jsonc. Use an HTTPS base URL without credentials or a token in its URL.
+                - title: Store the secret
+                  text: Wrangler prompts for the secret value. Use a narrowly scoped backend token and rotate it under the operator's process.
+                  command: edgepress secret put BACKEND_TOKEN
+                - title: Configure and deploy
+                  text: Confirm the backend accepts the forwarded path and Bearer token, then deploy the Worker.
+                  command: edgepress deploy
+            - type: code
+              title: Local development
+              language: sh
+              code: |
+                # .dev.vars is local and must not be committed
+                BACKEND_URL=http://127.0.0.1:8788
+                BACKEND_TOKEN=replace-with-a-local-token
+            - type: text
+              text: The Worker returns 503 when no backend binding or URL and token are configured. It rejects unsupported methods and oversized request bodies.
+            - type: link-list
+              title: Provider validation reference
+              items:
+                - label: Cloudflare Turnstile Siteverify
+                  url: https://developers.cloudflare.com/turnstile/get-started/server-side-validation/
+                - label: Consent guidelines from the EDPB
+                  url: https://www.edpb.europa.eu/sites/default/files/files/file1/edpb_guidelines_202005_consent_en.pdf
+  - columns: 1
+    cells:
+      -
+        - type: section
+          title: Content security and maintenance
+          blocks:
+            - type: text
+              paragraphs:
+                - The built-in Markdown renderer sanitizes post output. Custom renderers, plugins, themes, and files in static/ are trusted project code; review changes before building or deploying. Do not put secrets in posts, themes, or public assets.
+                - edgepress iterate writes a report-only review plan under .edgepress/reports/. It does not edit source files, update dependencies, or deploy. edgepress security checks dependency advisories. Review the lockfile and generated page report before deployment, and keep a known-good deployment for rollback.
+            - type: code
+              title: Review project changes
+              language: sh
+              code: |
+                edgepress security
+                edgepress iterate
+                edgepress check
+                edgepress server
+---

package/content/pages/plugin-development/zh-cn.md

@@ -0,0 +1,108 @@
+---
+title: 插件开发
+lang: zh-CN
+slug: plugin-development
+description: 使用可信构建插件、遵循同意设置的浏览器集成和私有后端转发扩展 EdgePress。
+blocks:
+  - columns: 1
+    cells:
+      -
+        - type: hero
+          eyebrow: 扩展指南
+          title: 连接可信构建代码、浏览器供应商和后端服务。
+          text: 构建插件在 Node 中运行。浏览器集成需等待访客同意。运行时后端请求由 Worker 转发。
+  - columns: 2
+    cells:
+      -
+        - type: section
+          title: 构建插件
+          tone: soft
+          blocks:
+            - type: text
+              paragraphs:
+                - plugins/ 中的本地 JavaScript 模块可以转换源文档、注册钩子或渲染器，并生成路由。它们拥有构建进程的权限，因此只应加载项目负责人审查过的代码。
+                - 起始同意插件会在共享页面布局后添加隐私面板。构建插件属于可信代码，不会作为浏览器脚本发布。
+            - type: code
+              title: 注册路由生成器
+              language: js
+              code: |
+                export default function projectMeta(api) {
+                  api.registerGenerator('project-meta', ({ site }) => ({
+                    path: 'project-meta.json',
+                    body: JSON.stringify({
+                      title: site.config.site.title,
+                      posts: site.posts.length
+                    }),
+                    contentType: 'application/json; charset=utf-8'
+                  }));
+                }
+      -
+        - type: section
+          title: 跟踪、统计、广告和人机验证
+          tone: soft
+          blocks:
+            - type: text
+              paragraphs:
+                - 在 config.yml 的 plugins.tracking、plugins.statistics、plugins.advertising 或 plugins.captcha 下添加浏览器供应商。每项需要唯一 ID、用途、保留期限说明和公开供应商标识。
+                - 可用供应商包括 Google Tag Manager 和 Meta Pixel；Cloudflare Web Analytics、Google Analytics 和百度统计；Google AdSense；以及 Cloudflare Turnstile、Google reCAPTCHA 和 hCaptcha。
+                - 只有访客接受对应集成后才会导入供应商代码。不要把 CAPTCHA 密钥放入 config.yml 或客户端代码。服务器必须在接受表单前将每个 CAPTCHA 响应提交给供应商验证 API。
+            - type: notice
+              title: 运营者信息
+              text: 配置浏览器供应商前，请填写 privacy.controller.name、privacy.controller.contact 和 privacy.policyUrl。控制者名称或联系方式为空时，构建器会拒绝启用供应商服务。
+              tone: warning
+  - columns: 1
+    cells:
+      -
+        - type: section
+          title: 通过 URL 和令牌转发后端请求
+          blocks:
+            - type: text
+              paragraphs:
+                - Worker 为 GET、POST、PUT、PATCH 和 DELETE 提供 /api/v1/* 接口。配置 BACKEND_URL 和 BACKEND_TOKEN 后，Worker 会将请求路径及查询参数附加到后端 URL，发送 Bearer 令牌，转发有限的请求头，并为响应设置 no-store。
+                - BACKEND_URL 必须使用 HTTPS。只有 localhost 开发环境允许普通 HTTP。请求正文最大为 1 MB。后端仍需验证受限令牌、校验用户输入、授权每项操作，并执行自己的请求频率和大小限制。
+                - 私有 Worker 间调用优先使用 Cloudflare BACKEND Service Binding。浏览器绝不能获得 BACKEND_TOKEN。此通用代理本身不会创建应用账户、表单或数据模型。
+            - type: steps
+              items:
+                - title: 设置后端基础 URL
+                  text: 在 wrangler.jsonc 中添加 vars.BACKEND_URL。基础 URL 应使用 HTTPS，且不能包含凭据或令牌。
+                - title: 保存密钥
+                  text: Wrangler 会提示输入密钥值。请使用权限范围有限的后端令牌，并依照运营者流程定期轮换。
+                  command: edgepress secret put BACKEND_TOKEN
+                - title: 配置并部署
+                  text: 确认后端接受转发路径和 Bearer 令牌，再部署 Worker。
+                  command: edgepress deploy
+            - type: code
+              title: 本地开发
+              language: sh
+              code: |
+                # .dev.vars 仅供本地使用，不要提交到版本库
+                BACKEND_URL=http://127.0.0.1:8788
+                BACKEND_TOKEN=replace-with-a-local-token
+            - type: text
+              text: 未配置后端绑定，或 URL 和令牌时，Worker 会返回 503。它会拒绝不支持的方法和过大的请求正文。
+            - type: link-list
+              title: 供应商验证参考
+              items:
+                - label: Cloudflare Turnstile Siteverify
+                  url: https://developers.cloudflare.com/turnstile/get-started/server-side-validation/
+                - label: EDPB 同意指南
+                  url: https://www.edpb.europa.eu/sites/default/files/files/file1/edpb_guidelines_202005_consent_en.pdf
+  - columns: 1
+    cells:
+      -
+        - type: section
+          title: 内容安全与维护
+          blocks:
+            - type: text
+              paragraphs:
+                - 内置 Markdown 渲染器会清理文章输出。自定义渲染器、插件、主题和 static/ 中的文件都属于可信项目代码；构建或部署前应审查变更。不要将密钥放在文章、主题或公开资源中。
+                - edgepress iterate 会在 .edgepress/reports/ 下生成只读维护计划，不会修改源文件、更新依赖或部署。edgepress security 检查依赖安全公告。部署前请审查锁文件和页面报告，并保留可用于回滚的已知稳定部署。
+            - type: code
+              title: 审查项目变更
+              language: sh
+              code: |
+                edgepress security
+                edgepress iterate
+                edgepress check
+                edgepress server
+---

package/content/pages/privacy-policy/en.md

@@ -0,0 +1,73 @@
+---
+title: Privacy policy
+lang: en
+slug: privacy-policy
+description: Current data handling, consent controls, configured integrations, and publication details for this EdgePress site.
+blocks:
+  - columns: 1
+    cells:
+      -
+        - type: section
+          title: Site operator
+          tone: soft
+          blocks:
+            - type: privacy-controller
+              nameLabel: Controller
+              contactLabel: Privacy contact
+              missingTitle: Publication setup required
+              missingText: The current config.yml has no real operator name or privacy contact, and site.url still uses example.com. Replace these values before publishing this policy.
+  - columns: 2
+    cells:
+      -
+        - type: section
+          title: What this starter site does
+          blocks:
+            - type: text
+              paragraphs:
+                - This source build contains public pages, posts, search data, a sitemap, and an Atom feed. It does not include a visitor account system, comments, or a contact form.
+                - The Worker exposes an optional /api/v1/ proxy for a backend. It forwards requests only when the deployer configures a Service Binding or BACKEND_URL together with the BACKEND_TOKEN secret. This starter site does not submit page content to that API.
+                - Hosting and delivery providers may process connection and request data to operate the site. The operator must identify the providers and describe their applicable terms and retention before publication.
+      -
+        - type: section
+          title: Optional browser services
+          blocks:
+            - type: text
+              text: The current configuration has no tracking, statistics, advertising, or human-verification providers in its service lists. If the operator adds a service, the list below is generated from its configured provider, purpose, and retention description.
+            - type: privacy-services
+              emptyText: No optional third-party browser services are configured in this source build.
+  - columns: 1
+    cells:
+      -
+        - type: section
+          title: Consent preferences
+          tone: accent
+          blocks:
+            - type: text
+              paragraphs:
+                - Browser integrations are loaded only after the visitor accepts a configured service. The consent interface stores a first-party preference in local browser storage when a choice can be saved. It is not a server-side audit log.
+                - Visitors can reopen Privacy settings to change a choice. If they withdraw a previously active service, the page reloads so that the integration can stop running.
+            - type: privacy-consent
+              storageLabel: Browser storage key
+              expiryLabel: Preference expiry
+              versionLabel: Consent configuration version
+              expiryText: "{days} days after saving"
+  - columns: 1
+    cells:
+      -
+        - type: section
+          title: Provider and legal details
+          blocks:
+            - type: text
+              paragraphs:
+                - Before enabling a provider, the operator must document the information it receives, purposes, recipients, applicable retention, and any cross-border transfers. Public site identifiers may be configured in the browser; CAPTCHA secret keys must stay on a trusted server, which must verify each response token.
+                - This starter configuration cannot determine the operator's jurisdiction, legal bases, retention obligations, or the rights that apply to a particular deployment. Complete this policy for the actual site and seek qualified advice where needed.
+            - type: link-list
+              title: Primary legal references
+              items:
+                - label: GDPR text on EUR-Lex
+                  url: https://eur-lex.europa.eu/eli/reg/2016/679
+                - label: UK ICO information notice guidance
+                  url: https://ico.org.uk/for-organisations/advice-for-small-organisations/getting-started-with-gdpr/data-protection-self-assessment/what-information-you-must-supply-under-the-gdpr/
+                - label: China Personal Information Protection Law
+                  url: https://www.miit.gov.cn/jgsj/zfs/fl/art/2022/art_515a4b20c12f430eab54bb4f56d89f56.html
+---