edgepress 2026.9.3

package/src/build.js

@@ -0,0 +1,277 @@
+import { createHash, randomUUID } from 'node:crypto';
+import { lstat, mkdir, open, readFile, rename, rm, stat, writeFile } from 'node:fs/promises';
+import { dirname, relative, resolve, sep } from 'node:path';
+import { hostname } from 'node:os';
+import { mapLimit } from './concurrency.js';
+import { loadConfig } from './config.js';
+import { readDocuments } from './content.js';
+import { createExtensions } from './plugin-api.js';
+import { collectAssets, rewriteAssetLinks, writeAssets } from './assets.js';
+import { loadLanguagePacks } from './i18n.js';
+import { generateBuiltinRoutes } from './generators.js';
+
+const RENDER_CACHE_VERSION = 3;
+const MARKDOWN_SECURITY_POLICY_VERSION = 3;
+
+async function readCache(file) {
+  try {
+    const parsed = JSON.parse(await readFile(file, 'utf8'));
+    return parsed.version === RENDER_CACHE_VERSION && parsed.rendered && typeof parsed.rendered === 'object'
+      ? parsed.rendered
+      : {};
+  } catch (error) {
+    if (error.code === 'ENOENT' || error instanceof SyntaxError) return {};
+    throw error;
+  }
+}
+
+async function markdownRuntimeVersion(root) {
+  const lockPath = resolve(root, 'package-lock.json');
+  const rendererSource = await readFile(new URL('./markdown.js', import.meta.url));
+  const implementation = createHash('sha256').update(rendererSource).digest('hex');
+  try {
+    const lock = JSON.parse(await readFile(lockPath, 'utf8'));
+    const marked = lock.packages?.['node_modules/marked']?.version;
+    const sanitizer = lock.packages?.['node_modules/sanitize-html']?.version;
+    if (typeof marked === 'string' && typeof sanitizer === 'string') return implementation + ':' + marked + ':' + sanitizer;
+    throw new Error('package-lock.json is missing the Markdown renderer or sanitizer version');
+  } catch (error) {
+    if (error.code !== 'ENOENT') throw error;
+    return implementation + ':unlocked';
+  }
+}
+
+function routeSegments(routePath) {
+  if (typeof routePath !== 'string' || !routePath.trim()) throw new Error('Generated routes need a non-empty path');
+  const source = routePath.trim().replace(/\\/g, '/');
+  if (/^[A-Za-z]:/.test(source) || /[?#\0]/.test(source)) {
+    throw new Error('Invalid generated route path: ' + routePath);
+  }
+  const isDirectory = source.endsWith('/');
+  const clean = source.replace(/^\/+|\/+$/g, '');
+  if (!clean) return ['index.html'];
+  const parts = clean.split('/');
+  for (const part of parts) {
+    if (!part || part === '.' || part === '..' || part.includes('%') || part.includes(':') || /[\x00-\x1f\x7f]/.test(part)) {
+      throw new Error('Invalid generated route path: ' + routePath);
+    }
+    let decoded;
+    try { decoded = decodeURIComponent(part); }
+    catch { throw new Error('Invalid generated route path encoding: ' + routePath); }
+    if (decoded === '.' || decoded === '..' || /[\\/\x00-\x1f\x7f]/.test(decoded)) {
+      throw new Error('Invalid generated route path: ' + routePath);
+    }
+  }
+  return isDirectory ? [...parts, 'index.html'] : parts;
+}
+
+function routeFile(output, routePath) {
+  const parts = routeSegments(routePath);
+  const result = resolve(output, ...parts);
+  if (!result.startsWith(output + sep)) throw new Error('Generated route escapes output directory: ' + routePath);
+  return result;
+}
+
+function publishedByLocalDate(document, now) {
+  if (document.kind !== 'posts') return true;
+  const publishDay = Date.UTC(document.date.getUTCFullYear(), document.date.getUTCMonth(), document.date.getUTCDate());
+  const currentDay = Date.UTC(now.getFullYear(), now.getMonth(), now.getDate());
+  return publishDay <= currentDay;
+}
+
+function validateRoutes(routes, output, assetBundle) {
+  if (!Array.isArray(routes)) throw new Error('routes:created filters must return an array');
+  const seen = new Set(['_headers']);
+  for (const asset of assetBundle.assets) seen.add(asset.path.toLowerCase());
+  for (const route of routes) {
+    if (!route || typeof route.body !== 'string' || typeof route.path !== 'string') {
+      throw new Error('Each route must contain string path and body properties');
+    }
+    if (route.contentType !== undefined && typeof route.contentType !== 'string') {
+      throw new Error('Route contentType must be a string when provided: ' + route.path);
+    }
+    const file = routeFile(output, route.path);
+    const relativePath = relative(output, file).split(sep).join('/').toLowerCase();
+    if (seen.has(relativePath)) throw new Error('Duplicate generated route: ' + route.path);
+    seen.add(relativePath);
+  }
+}
+
+async function processIsAlive(pid) {
+  try { process.kill(pid, 0); return true; }
+  catch (error) { return error.code !== 'ESRCH'; }
+}
+
+export async function acquireBuildLock(directory) {
+  await mkdir(directory, { recursive: true });
+  const lockPath = resolve(directory, 'build.lock');
+  for (let attempt = 0; attempt < 2; attempt += 1) {
+    try {
+      const handle = await open(lockPath, 'wx');
+      try {
+        await handle.writeFile(JSON.stringify({ pid: process.pid, host: hostname(), startedAt: new Date().toISOString() }));
+      } catch (error) {
+        await handle.close();
+        await rm(lockPath, { force: true });
+        throw error;
+      }
+      return async () => {
+        await handle.close();
+        await rm(lockPath, { force: true });
+      };
+    } catch (error) {
+      if (error.code !== 'EEXIST') throw error;
+      let previous;
+      try { previous = JSON.parse(await readFile(lockPath, 'utf8')); }
+      catch {
+        let info;
+        try { info = await stat(lockPath); }
+        catch (statError) {
+          if (statError.code === 'ENOENT') continue;
+          throw statError;
+        }
+        if (Date.now() - info.mtimeMs < 10_000) throw new Error('Another build is already starting for this project');
+        throw new Error('Another build may be running; inspect and remove ' + lockPath + ' if it is stale');
+      }
+      if (previous.host !== hostname() || !Number.isInteger(previous.pid) || await processIsAlive(previous.pid)) {
+        throw new Error('Another build is already running for this project');
+      }
+      await rm(lockPath, { force: true });
+    }
+  }
+  throw new Error('Unable to acquire the project build lock');
+}
+
+async function commitOutput(stage, output) {
+  const backup = output + '.backup-' + randomUUID();
+  let movedPrevious = false;
+  try {
+    try {
+      const info = await lstat(output);
+      if (info.isSymbolicLink() || !info.isDirectory()) {
+        throw new Error('Build output must be a real directory: ' + output);
+      }
+      await rename(output, backup);
+      movedPrevious = true;
+    } catch (error) {
+      if (error.code !== 'ENOENT') throw error;
+    }
+    await rename(stage, output);
+  } catch (error) {
+    if (movedPrevious) {
+      try { await rename(backup, output); }
+      catch (restoreError) {
+        throw new Error('Build commit failed and the previous output could not be restored from ' + backup + ': ' + restoreError.message, { cause: error });
+      }
+    }
+    throw error;
+  }
+  if (movedPrevious) {
+    try { await rm(backup, { recursive: true, force: true }); }
+    catch (error) { console.warn('Built the new site, but could not remove the previous output at ' + backup + ': ' + error.message); }
+  }
+}
+
+async function writeRoutes(routes, stage, assetBundle, extensions, site, config) {
+  await mapLimit(routes, config.concurrency, async (route) => {
+    const file = routeFile(stage, route.path);
+    await mkdir(dirname(file), { recursive: true });
+    let body = await extensions.filter('route:body', route.body, { route, site, config });
+    if (typeof body !== 'string') throw new Error('route:body filters must return a string for ' + route.path);
+    body = rewriteAssetLinks(body, assetBundle.urlMap);
+    await writeFile(file, body, 'utf8');
+  });
+}
+
+export async function buildSite(root = process.cwd(), options = {}) {
+  const started = Date.now();
+  const config = await loadConfig(root);
+  if (options.preview === true) {
+    config.preview = true;
+    config.previewBuildId = randomUUID();
+  }
+  const releaseLock = await acquireBuildLock(config.resolvedPaths.cache);
+  const output = config.resolvedPaths.output;
+  const stage = resolve(dirname(output), '.' + output.split(/[\\/]/).pop() + '.stage-' + randomUUID());
+
+  try {
+    await loadLanguagePacks(config);
+    const extensions = await createExtensions(config);
+    const assetBundle = await collectAssets(config);
+    const sourceDocuments = await readDocuments(config);
+    const loadedDocuments = await extensions.filter('content:loaded', sourceDocuments, { config });
+    if (!Array.isArray(loadedDocuments)) throw new Error('content:loaded filters must return an array');
+
+    const cacheFile = resolve(config.resolvedPaths.cache, 'render-cache.json');
+    const oldCache = await readCache(cacheFile);
+    const nextCache = Object.create(null);
+    const runtimeVersion = await markdownRuntimeVersion(config.root);
+    const renderer = extensions.renderer('.md');
+    if (!renderer) throw new Error('No renderer is registered for Markdown files');
+
+    const documents = await mapLimit(loadedDocuments, config.concurrency, async (document) => {
+      if (document.kind === 'pages') {
+        return { ...document, html: '' };
+      }
+      const signature = createHash('sha256')
+        .update(document.markdown + '\n' + JSON.stringify(config.markdown) + '\n' + document.locale + '\n' +
+          MARKDOWN_SECURITY_POLICY_VERSION + '\n' + runtimeVersion)
+        .digest('hex');
+      let html = renderer.cacheable ? oldCache[signature] : undefined;
+      if (html === undefined) html = await renderer.render(document.markdown, { config, document });
+      if (typeof html !== 'string') throw new Error('Markdown renderers must return HTML strings for ' + document.file);
+      if (renderer.cacheable) nextCache[signature] = html;
+      const rendered = { ...document, html };
+      rendered.description = rendered.description || rendered.markdown.replace(/\s+/g, ' ').slice(0, 180);
+      return rendered;
+    });
+
+    const now = new Date();
+    const visible = documents.filter((document) => !document.draft && publishedByLocalDate(document, now));
+    let site = {
+      config,
+      posts: visible.filter((document) => document.kind === 'posts').sort((a, b) => b.date - a.date),
+      pages: visible.filter((document) => document.kind === 'pages')
+    };
+    site = await extensions.filter('content:rendered', site, { config });
+    if (!site || !Array.isArray(site.posts) || !Array.isArray(site.pages)) {
+      throw new Error('content:rendered filters must return a site object with posts and pages arrays');
+    }
+
+    let routes = await generateBuiltinRoutes(site, config, extensions);
+    for (const generator of extensions.generators.values()) {
+      const generated = await generator({
+        site,
+        config,
+        renderLayout: (page, body) => import('./theme.js').then((module) => module.renderLayout(config, extensions, page, body))
+      });
+      if (generated == null) continue;
+      routes.push(...(Array.isArray(generated) ? generated : [generated]));
+    }
+    routes = await extensions.filter('routes:created', routes, { site, config });
+    validateRoutes(routes, output, assetBundle);
+
+    await mkdir(dirname(output), { recursive: true });
+    await mkdir(stage, { recursive: false });
+    await writeAssets(assetBundle, stage, config.concurrency);
+    await writeRoutes(routes, stage, assetBundle, extensions, site, config);
+    await commitOutput(stage, output);
+
+    const cacheTemporary = cacheFile + '.tmp-' + randomUUID();
+    try {
+      await writeFile(cacheTemporary, JSON.stringify({ version: RENDER_CACHE_VERSION, rendered: nextCache }), 'utf8');
+      await rename(cacheTemporary, cacheFile);
+    } catch (error) {
+      await rm(cacheTemporary, { force: true }).catch(() => {});
+      console.warn('Built the new site, but could not update the render cache: ' + error.message);
+    }
+
+    console.log('Built ' + routes.length + ' routes from ' + documents.length + ' documents in ' + (Date.now() - started) + 'ms');
+    return { routes: routes.length, documents: documents.length, output };
+  } catch (error) {
+    await rm(stage, { recursive: true, force: true }).catch(() => {});
+    throw error;
+  } finally {
+    await releaseLock();
+  }
+}

package/src/cli.js

@@ -0,0 +1,344 @@
+#!/usr/bin/env node
+import { access, cp, lstat, mkdir, mkdtemp, open, readFile, readdir, realpath, rm, writeFile } from 'node:fs/promises';
+import { dirname, join, relative, resolve, sep } from 'node:path';
+import { tmpdir } from 'node:os';
+import { fileURLToPath } from 'node:url';
+import { spawn } from 'node:child_process';
+import { acquireBuildLock, buildSite } from './build.js';
+import { loadConfig } from './config.js';
+import { slugify } from './content.js';
+import { checkPages } from './page-check.js';
+import { checkCompatibility, writeIterationPlan } from './maintenance.js';
+
+async function initializeProject() {
+  const packageRoot = resolve(dirname(fileURLToPath(import.meta.url)), '..');
+  const root = process.cwd();
+  const directories = ['content', 'languages', 'plugins', 'static', 'themes'];
+  const files = ['.gitignore', 'README.md', 'config.yml', 'edgepress.config.mjs', 'project-compatibility.json', 'wrangler.jsonc'];
+  const destinations = [...directories, ...files, 'src/worker.js'];
+  const existing = [];
+  for (const relativePath of destinations) {
+    try { await access(resolve(root, relativePath)); existing.push(relativePath); }
+    catch (error) { if (error.code !== 'ENOENT') throw error; }
+  }
+  if (existing.length) throw new Error('EdgePress init found existing project paths and made no changes: ' + existing.join(', '));
+
+  const packageData = JSON.parse(await readFile(resolve(packageRoot, 'package.json'), 'utf8'));
+  let existingManifest = {};
+  let packageManifestExists = false;
+  try {
+    const manifestPath = resolve(root, 'package.json');
+    const manifestInfo = await lstat(manifestPath);
+    if (manifestInfo.isSymbolicLink() || !manifestInfo.isFile()) throw new Error('Refusing to edit an unsafe package.json path');
+    packageManifestExists = true;
+    existingManifest = JSON.parse(await readFile(manifestPath, 'utf8'));
+    if (!existingManifest || Array.isArray(existingManifest) || typeof existingManifest !== 'object') throw new Error('package.json must contain a JSON object');
+  } catch (error) {
+    if (error.code !== 'ENOENT') throw error;
+  }
+  const projectManifest = {
+    ...existingManifest,
+    name: existingManifest.name || 'my-edgepress-site',
+    version: existingManifest.version || '1.0.0',
+    private: existingManifest.private ?? true,
+    type: 'module',
+    scripts: {
+      ...(existingManifest.scripts || {}),
+      new: 'edgepress new',
+      generate: 'edgepress generate',
+      build: 'edgepress build',
+      dev: 'edgepress server',
+      preview: 'edgepress server',
+      check: 'edgepress check',
+      doctor: 'edgepress doctor',
+      deploy: 'edgepress deploy'
+    },
+    dependencies: {
+      ...(existingManifest.dependencies || {}),
+      edgepress: packageData.version,
+      wrangler: existingManifest.dependencies?.wrangler ?? packageData.devDependencies?.wrangler ?? '^4.129.1'
+    }
+  };
+  for (const directory of directories) await cp(resolve(packageRoot, directory), resolve(root, directory), { recursive: true, errorOnExist: true });
+  for (const file of files) {
+    const source = file === '.gitignore' ? resolve(packageRoot, 'templates/gitignore') :
+      file === 'README.md' ? resolve(packageRoot, 'templates/site-readme.md') : resolve(packageRoot, file);
+    const destination = resolve(root, file);
+    await mkdir(dirname(destination), { recursive: true });
+    await cp(source, destination, { errorOnExist: true });
+  }
+  await mkdir(resolve(root, 'src'), { recursive: true });
+  await cp(resolve(packageRoot, 'src/worker.js'), resolve(root, 'src/worker.js'), { errorOnExist: true });
+  await writeFile(resolve(root, 'package.json'), JSON.stringify(projectManifest, null, 2) + '\n', { flag: packageManifestExists ? 'w' : 'wx' });
+  console.log('Created an EdgePress site. Next run npm install, then edgepress server.');
+}
+
+async function runWrangler(command, args = []) {
+  const wrangler = resolve(process.cwd(), 'node_modules/wrangler/bin/wrangler.js');
+  await access(wrangler);
+  await new Promise((resolveExit, reject) => {
+    const child = spawn(process.execPath, [wrangler, command, ...args], { cwd: process.cwd(), env: process.env, stdio: 'inherit' });
+    child.once('error', reject);
+    child.once('exit', (code) => {
+      if (code === 0) resolveExit();
+      else process.exitCode = code ?? 1, resolveExit();
+    });
+  });
+}
+
+async function runSecurityAudit() {
+  await new Promise((resolveExit, reject) => {
+    const child = spawn('npm', ['audit', '--audit-level=moderate'], {
+      cwd: process.cwd(), env: process.env, stdio: 'inherit', shell: process.platform === 'win32', windowsHide: true
+    });
+    child.once('error', reject);
+    child.once('exit', (code) => {
+      if (code === 0) resolveExit();
+      else process.exitCode = code ?? 1, resolveExit();
+    });
+  });
+}
+
+async function manageTheme(args, config) {
+  const [action, requested] = args;
+  const themesDirectory = resolve(config.root, 'themes');
+  const entries = (await readdir(themesDirectory, { withFileTypes: true }))
+    .filter((entry) => entry.isDirectory()).sort((left, right) => left.name.localeCompare(right.name));
+  const installed = [];
+  for (const entry of entries) {
+    try {
+      const metadata = JSON.parse(await readFile(resolve(themesDirectory, entry.name, 'theme.json'), 'utf8'));
+      installed.push({ id: entry.name, name: metadata.name || entry.name, path: 'themes/' + entry.name });
+    } catch (error) {
+      if (error.code !== 'ENOENT' && !(error instanceof SyntaxError)) throw error;
+    }
+  }
+  if (action === 'list') {
+    for (const theme of installed) console.log((config.resolvedPaths.theme === resolve(config.root, theme.path) ? '* ' : '  ') + theme.id + ' (' + theme.name + ')');
+    return;
+  }
+  if (action === 'create') {
+    if (!requested) throw new Error('Usage: edgepress theme create <theme-name>');
+    const id = slugify(requested);
+    if (!/^[a-z0-9]+(?:-[a-z0-9]+)*$/.test(id)) throw new Error('Theme name must contain letters or numbers and may use spaces or hyphens.');
+    const destination = resolve(themesDirectory, id);
+    try { await lstat(destination); throw new Error('Theme already exists: ' + id); }
+    catch (error) { if (error.code !== 'ENOENT') throw error; }
+    const packageRoot = resolve(dirname(fileURLToPath(import.meta.url)), '..');
+    await cp(resolve(packageRoot, 'themes/default'), destination, { recursive: true, errorOnExist: true });
+    const metadataPath = resolve(destination, 'theme.json');
+    const metadata = JSON.parse(await readFile(metadataPath, 'utf8'));
+    metadata.id = id;
+    metadata.name = requested.trim();
+    await writeFile(metadataPath, JSON.stringify(metadata, null, 2) + '\n', 'utf8');
+    const packageManifestPath = resolve(destination, 'package.json');
+    const packageManifest = {
+      name: 'edgepress-theme-' + id,
+      version: '1.0.0',
+      description: 'A custom theme for EdgePress.',
+      files: ['theme.json', 'layouts', 'assets', 'README.md'],
+      edgepress: { theme: id }
+    };
+    await writeFile(packageManifestPath, JSON.stringify(packageManifest, null, 2) + '\n', 'utf8');
+    const readmePath = resolve(destination, 'README.md');
+    const readme = '# ' + id + '\n\nAn EdgePress theme package. Edit the shared layout and partials under `layouts/` and add theme styles and assets under `assets/`.\n\n' +
+      'To install this theme in another EdgePress site, publish the package to npm and run:\n\n' +
+      '    edgepress theme install edgepress-theme-' + id + '\n\n' +
+      'Keep the skip link, one main landmark, labeled navigation, visible keyboard focus, and a page-level `h1` in the layout.\n';
+    await writeFile(readmePath, readme, 'utf8');
+    await writeFile(resolve(destination, 'assets/style.css'), '/* Add the colors, typography, spacing, and responsive rules for this theme here. */\n', 'utf8');
+    console.log('Created an empty theme at themes/' + id + '. Edit its HTML partials and assets, then run edgepress theme use ' + id + '.');
+    return;
+  }
+  if (action === 'install') {
+    if (!requested) throw new Error('Usage: edgepress theme install <npm-package>[@version]');
+    const packageSpecPattern = /^(?:@[a-z0-9][a-z0-9._-]*\/)?[a-z0-9][a-z0-9._-]*(?:@[0-9][a-z0-9.+_-]*)?$/i;
+    if (!packageSpecPattern.test(requested)) throw new Error('Theme must be an npm package name with an optional version.');
+    const packageNameEnd = requested.lastIndexOf('@');
+    const packageName = packageNameEnd > requested.indexOf('/') ? requested.slice(0, packageNameEnd) : requested;
+    const tempDirectory = await mkdtemp(join(tmpdir(), 'edgepress-theme-'));
+    try {
+      await new Promise((resolveExit, reject) => {
+        const child = spawn('npm', ['install', '--prefix', tempDirectory, '--ignore-scripts', '--no-audit', '--no-fund', requested], {
+          cwd: config.root, env: process.env, stdio: 'inherit', shell: process.platform === 'win32', windowsHide: true
+        });
+        child.once('error', reject);
+        child.once('exit', (code) => code === 0 ? resolveExit() : reject(new Error('npm could not install theme package ' + requested)));
+      });
+      const packageDirectory = resolve(tempDirectory, 'node_modules', ...packageName.split('/'));
+      const packageInfo = await lstat(packageDirectory);
+      if (!packageInfo.isDirectory() || packageInfo.isSymbolicLink()) throw new Error('Installed theme package is not a regular directory.');
+      const themeRoot = await realpath(packageDirectory);
+      const readPackageFile = async (name) => {
+        const filePath = resolve(themeRoot, name);
+        const info = await lstat(filePath);
+        if (!info.isFile() || info.isSymbolicLink()) throw new Error('Theme package ' + name + ' must be a regular file.');
+        const realPath = await realpath(filePath);
+        const relativePath = relative(themeRoot, realPath);
+        if (relativePath === '..' || relativePath.startsWith('..' + sep) || relativePath.startsWith(sep)) {
+          throw new Error('Theme package ' + name + ' resolves outside the package directory.');
+        }
+        return readFile(realPath, 'utf8');
+      };
+      const metadata = JSON.parse(await readPackageFile('theme.json'));
+      const packageManifest = JSON.parse(await readPackageFile('package.json'));
+      const declaredId = metadata.id || packageManifest.edgepress?.theme || packageName.split('/').at(-1).replace(/^edgepress-theme-/, '');
+      const id = slugify(declaredId);
+      if (!/^[a-z0-9]+(?:-[a-z0-9]+)*$/.test(id)) throw new Error('Theme package must declare a safe id in theme.json or package.json#edgepress.theme.');
+      const layoutFile = resolve(themeRoot, 'layouts/layout.html');
+      const layoutInfo = await lstat(layoutFile);
+      if (!layoutInfo.isFile() || layoutInfo.isSymbolicLink()) throw new Error('Theme package layouts/layout.html must be a regular file.');
+      const layoutPath = await realpath(layoutFile);
+      const relLayout = relative(themeRoot, layoutPath);
+      if (relLayout === '..' || relLayout.startsWith('..' + sep) || relLayout.startsWith(sep)) {
+        throw new Error('Theme package layouts/layout.html must be a regular file inside the package.');
+      }
+      const destination = resolve(themesDirectory, id);
+      try { await lstat(destination); throw new Error('Theme already exists: ' + id); }
+      catch (error) { if (error.code !== 'ENOENT') throw error; }
+      await cp(themeRoot, destination, { recursive: true, errorOnExist: true, dereference: false });
+      console.log('Installed ' + (metadata.name || packageName) + ' to themes/' + id + '. Select it with edgepress theme use ' + id + '.');
+    } finally {
+      await rm(tempDirectory, { recursive: true, force: true });
+    }
+    return;
+  }
+  if (action !== 'use' || !requested) throw new Error('Usage: edgepress theme list | edgepress theme create <name> | edgepress theme install <npm-package>[@version] | edgepress theme use <theme-name>');
+  const selected = installed.find((theme) => theme.id === requested);
+  if (!selected) throw new Error('Theme not found. Run edgepress theme list to see installed themes.');
+  const configFile = resolve(config.root, 'edgepress.config.mjs');
+  const info = await lstat(configFile);
+  if (info.isSymbolicLink() || !info.isFile()) throw new Error('Refusing to edit an unsafe edgepress.config.mjs path');
+  const source = await readFile(configFile, 'utf8');
+  const pathsBlock = source.match(/(paths\s*:\s*\{)([^}]*)(\})/s);
+  if (!pathsBlock || !/^\s*theme\s*:/m.test(pathsBlock[2])) {
+    throw new Error('Could not safely find paths.theme in edgepress.config.mjs; set it manually.');
+  }
+  const updatedPaths = pathsBlock[2].replace(/(^\s*theme\s*:\s*)(["'])[^"']*\2/m, '$1"' + selected.path + '"');
+  const updated = source.replace(pathsBlock[0], pathsBlock[1] + updatedPaths + pathsBlock[3]);
+  await writeFile(configFile, updated, 'utf8');
+  console.log('Selected theme ' + selected.id + '.');
+}
+
+async function createPost(title, config) {
+  if (!title) throw new Error('Usage: edgepress new "Post title"');
+  const releaseLock = await acquireBuildLock(config.resolvedPaths.cache);
+  try {
+    const today = new Date().toISOString().slice(0, 10);
+    const folder = resolve(config.resolvedPaths.content, 'posts', today + '-' + slugify(title));
+    const locale = config.i18n.defaultLocale;
+    const file = resolve(folder, locale.toLowerCase() + '.md');
+    await mkdir(folder, { recursive: true });
+    const body = '---\ntitle: ' + JSON.stringify(title) + '\ndate: ' + today + '\nlang: ' + locale + '\ntags: []\n---\n\n# ' + title + '\n\nWrite your post here.\n';
+    let handle;
+    try { handle = await open(file, 'wx'); }
+    catch (error) {
+      if (error.code === 'EEXIST') throw new Error('Post already exists: ' + file);
+      throw error;
+    }
+    let writeError;
+    try { await handle.writeFile(body, 'utf8'); }
+    catch (error) { writeError = error; }
+    await handle.close();
+    if (writeError) {
+      await rm(file, { force: true });
+      throw writeError;
+    }
+    console.log('Created ' + file);
+  } finally {
+    await releaseLock();
+  }
+}
+
+async function clean(config) {
+  const cache = config.resolvedPaths.cache;
+  const releaseLock = await acquireBuildLock(cache);
+  try {
+    for (const target of [config.resolvedPaths.output]) {
+      try {
+        const info = await lstat(target);
+        if (info.isSymbolicLink()) throw new Error('Refusing to clean a symbolic-link output path: ' + target);
+        await rm(target, { recursive: true, force: true });
+      } catch (error) {
+        if (error.code !== 'ENOENT') throw error;
+      }
+    }
+    const toolsDirectory = resolve(config.root, 'tools');
+    try {
+      const info = await lstat(toolsDirectory);
+      if (info.isSymbolicLink() || !info.isDirectory()) throw new Error('Refusing to clean reports through an unsafe tools path: ' + toolsDirectory);
+      for (const name of ['page-check.json', 'page-check.md', 'page-check.pdf', 'page-check-visual.html']) {
+        await rm(resolve(toolsDirectory, name), { force: true });
+      }
+      const screenshots = resolve(toolsDirectory, 'page-check-screenshots');
+      try {
+        const screenshotsInfo = await lstat(screenshots);
+        if (screenshotsInfo.isSymbolicLink() || !screenshotsInfo.isDirectory()) throw new Error('Refusing to clean an unsafe screenshot path: ' + screenshots);
+        await rm(screenshots, { recursive: true, force: true });
+      } catch (error) {
+        if (error.code !== 'ENOENT') throw error;
+      }
+    } catch (error) {
+      if (error.code !== 'ENOENT') throw error;
+    }
+    let entries = [];
+    try { entries = await readdir(cache); }
+    catch (error) { if (error.code !== 'ENOENT') throw error; }
+    await Promise.all(entries.filter((entry) => entry !== 'build.lock')
+      .map((entry) => rm(resolve(cache, entry), { recursive: true, force: true })));
+  } finally {
+    await releaseLock();
+  }
+  console.log('Removed generated output and reports.');
+}
+
+async function showReport(title, report, reportPath) {
+  console.log(title + ': ' + report.status);
+  console.log('Report: ' + reportPath);
+}
+
+const [command, ...args] = process.argv.slice(2);
+try {
+  const config = command === 'new' || command === 'clean' || command === 'check' || command === 'doctor' || command === 'iterate'
+    ? await loadConfig()
+    : null;
+  if (command === '--help' || command === '-h' || command === 'help') {
+    console.log('EdgePress commands: init, new, build, generate, server, check, doctor, iterate, theme, secret, security, deploy, clean');
+  }
+  else if (command === 'build' || command === 'generate') await buildSite();
+  else if (command === 'init') await initializeProject();
+  else if (command === 'preview' || command === 'dev' || command === 'server') await import('./preview.js');
+  else if (command === 'deploy') {
+    if (process.env.WORKERS_CI !== '1') await buildSite();
+    await runWrangler('deploy', args);
+  }
+  else if (command === 'secret') {
+    if (!['put', 'delete', 'list'].includes(args[0])) throw new Error('Usage: edgepress secret put|delete|list [name]');
+    await runWrangler('secret', args);
+  }
+  else if (command === 'theme') await manageTheme(args, await loadConfig());
+  else if (command === 'security') await runSecurityAudit();
+  else if (command === 'new') await createPost(args.join(' ').trim(), config);
+  else if (command === 'clean') await clean(config);
+  else if (command === 'check') {
+    await buildSite(config.root);
+    const pageReport = await checkPages(config);
+    const compatibilityReport = await checkCompatibility(config);
+    await showReport('Page check', pageReport, resolve(config.root, 'tools/page-check.md'));
+    await showReport('Compatibility check', compatibilityReport, resolve(config.resolvedPaths.cache, 'reports/compatibility.md'));
+    if (pageReport.errors || compatibilityReport.issues.some((issue) => issue.severity === 'error')) process.exitCode = 1;
+  } else if (command === 'doctor') {
+    const report = await checkCompatibility(config);
+    await showReport('Compatibility check', report, resolve(config.resolvedPaths.cache, 'reports/compatibility.md'));
+    if (report.issues.some((issue) => issue.severity === 'error')) process.exitCode = 1;
+  } else if (command === 'iterate') {
+    await buildSite(config.root);
+    const pageReport = await checkPages(config);
+    const compatibilityReport = await checkCompatibility(config);
+    const plan = await writeIterationPlan(config, pageReport, compatibilityReport);
+    await showReport('Safe iteration plan', plan, resolve(config.resolvedPaths.cache, 'reports/iteration-plan.md'));
+  } else throw new Error('Commands: init, build|generate, server, deploy, new, clean, check, doctor, iterate, theme list|create|install|use, security');
+} catch (error) {
+  console.error(error?.stack || error);
+  process.exitCode = 1;
+}

package/src/concurrency.js

@@ -0,0 +1,26 @@
+export async function mapLimit(items, limit, fn) {
+  if (!Number.isInteger(limit) || limit < 1) throw new TypeError('Concurrency limit must be a positive integer');
+  const results = new Array(items.length);
+  let next = 0;
+  let failure;
+  let hasFailure = false;
+
+  async function worker() {
+    while (!hasFailure) {
+      const index = next++;
+      if (index >= items.length) return;
+      try { results[index] = await fn(items[index], index); }
+      catch (error) {
+        if (!hasFailure) {
+          failure = error instanceof Error ? error : new Error(String(error));
+          hasFailure = true;
+        }
+        return;
+      }
+    }
+  }
+
+  await Promise.all(Array.from({ length: Math.min(limit, items.length) }, () => worker()));
+  if (hasFailure) throw failure;
+  return results;
+}