edgepress 2026.9.5 → 2026.9.8

package/README.md

@@ -63,8 +63,10 @@ Posts under content/posts/ use the Markdown renderer. Themes own shared head, na
 
 The only persisted page-audit report is the accessible PDF at tools/page-check.pdf. Desktop and mobile screenshots are embedded in the PDF and removed from temporary storage afterward. Automated checks do not replace manual accessibility or legal review.
 
-The header search page filters Markdown posts from the generated local search index; it does not send search queries to an external service. The first post, “EdgePress and Markdown: a complete writing guide,” documents and verifies the supported Markdown syntax in English and Chinese.
+The main navigation includes a Posts entry to the localized article archive. The header search page filters Markdown posts from the generated local search index; it does not send search queries to an external service. Article pages show a linked table of contents and code blocks have accessible copy buttons. The first post, “EdgePress and Markdown: a complete writing guide,” documents and verifies the supported Markdown syntax in English and Chinese.
 
-Project guides are published from content/pages/: project introduction, quick start, theme development, plugin development, and privacy policy. The privacy policy intentionally reports that the starter site still needs a real site URL, operator name, and privacy contact before publication.
+Project guides are published from content/pages/: project introduction, quick start, theme development, plugin development, and privacy policy. The starter config uses `https://edgepress.js.gripe` and credits `toewpq`; the privacy policy still reports that its real operator name and working privacy contact must be added before publication.
 
-Version 2026.9.5 records the fifth requested release update for September 2026. It is available as the `edgepress` npm package. See the [request 1 notes](content/posts/2026-09-24-edgepress-release-2026-9-1/), [request 2 notes](content/posts/2026-09-25-edgepress-release-2026-9-2/), [request 3 notes](content/posts/2026-09-25-edgepress-release-2026-9-3/), [request 4 notes](content/posts/2026-09-25-edgepress-release-2026-9-4/), and [request 5 notes](content/posts/2026-09-25-edgepress-release-2026-9-5/).
+Version 2026.9.8 records the eighth requested release update for September 2026. It is available as the `edgepress` npm package. See the [request 1 notes](content/posts/2026-09-24-edgepress-release-2026-9-1/), [request 2 notes](content/posts/2026-09-25-edgepress-release-2026-9-2/), [request 3 notes](content/posts/2026-09-25-edgepress-release-2026-9-3/), [request 4 notes](content/posts/2026-09-25-edgepress-release-2026-9-4/), [request 5 notes](content/posts/2026-09-25-edgepress-release-2026-9-5/), [request 6 notes](content/posts/2026-09-25-edgepress-release-2026-9-6/), [request 7 notes](content/posts/2026-09-26-edgepress-release-2026-9-7/), and [request 8 notes](content/posts/2026-09-26-edgepress-release-2026-9-8/).
+
+This release adds Markdown video syntax for posts, locale-deduplicated chronological archives, Markdown-rendered post excerpts, date-based consent policy metadata, localized service disclosures, and separate consent-component layout checks. Optional services remain disabled until a visitor makes an explicit choice.

package/config.yml

@@ -1,8 +1,8 @@
-# Site owner settings. Replace the example URL before publishing.
+# Site owner metadata and shared website components.
 site:
   title: EdgePress
   description: A static website builder for Cloudflare Workers with editable pages, Markdown posts, themes, and plugins.
-  url: https://example.com
+  url: https://edgepress.js.gripe
   language: en
   head:
     titleSuffix: ""
@@ -32,6 +32,11 @@ site:
       labels:
         en: Quick start
         zh-CN: 快速入门
+    - key: posts
+      url: "@archives"
+      labels:
+        en: Posts
+        zh-CN: 文章
     - key: search
       url: "@search"
       labels:
@@ -50,12 +55,12 @@ site:
         zh-CN: Atom 订阅
   footer: ""
   seo:
-    author: EdgePress contributors
+    author: toewpq
     keywords:
       - Markdown website builder
       - Cloudflare Workers
       - static site generator
-    image: ""
+    image: https://edgepress.js.gripe/edgepress/brand/og-image.png
     robots: index,follow
   # GEO here means agent SEO: make authoritative project information easy to discover and interpret.
   agentSeo:
@@ -73,74 +78,121 @@ site:
       - PerplexityBot
 privacy:
   controller:
-    name: ""
-    contact: ""
+    name: toewpq
+    contact: toewpq@gmail.com
   policyUrl: /privacy-policy/
 plugins:
   consent:
     enabled: true
-    version: "1"
+    # Drafting date; set effectiveDate when a revised notice takes effect.
+    proposedDate: "2026-09-26"
+    effectiveDate: "2026-09-26"
     expiresDays: 180
-  tracking:
-    enabled: true
-    services: []
-    # Example:
-    # - id: tag-manager
-    #   provider: google-tag-manager
-    #   purpose: Load consented campaign tags.
-    #   retention: Set and disclose the applicable retention period.
-    #   containerId: GTM-ABCD123
-    # - id: social-pixel
-    #   provider: meta-pixel
-    #   purpose: Measure consented campaign traffic.
-    #   retention: Set and disclose the provider's retention period.
-    #   pixelId: "123456789012345"
-  statistics:
-    enabled: true
-    services: []
-    # Examples use public provider IDs only.
-    # - id: primary-analytics
-    #   provider: google-analytics
-    #   purpose: Measure consented site visits.
-    #   retention: Set and disclose the provider's retention period.
-    #   measurementId: G-ABC12345
-    # - id: edge-analytics
-    #   provider: cloudflare-web-analytics
-    #   purpose: Measure consented site visits.
-    #   retention: Set and disclose the applicable retention period.
-    #   token: 01234567-89ab-cdef-0123-456789abcdef
-    # - id: baidu-analytics
-    #   provider: baidu-tongji
-    #   purpose: Measure consented site visits.
-    #   retention: Set and disclose the provider's retention period.
-    #   siteId: abcdef0123456789abcdef01
-  advertising:
-    enabled: true
-    services: []
-    # Example:
-    # - id: display-ads
-    #   provider: google-adsense
-    #   purpose: Display consented advertising.
-    #   retention: Set and disclose the provider's retention period.
-    #   clientId: ca-pub-1234567890123456
-  captcha:
-    enabled: true
-    services: []
-    # Choose a provider for each CAPTCHA block. Never add its secret key here.
-    # - id: contact-form-check
-    #   provider: cloudflare-turnstile
-    #   purpose: Reduce automated contact form submissions.
-    #   retention: Configure and disclose the provider's retention period.
-    #   siteKey: 0x4AAAAAAABBBBBBBBCCCCCCDDDD
-    # - id: signup-form-check
-    #   provider: google-recaptcha
-    #   purpose: Reduce automated signup submissions.
-    #   retention: Configure and disclose the provider's retention period.
-    #   siteKey: 6LcAbCdEfGhIjKlMnOpQrStUvWxYz0123456789a
-    # - id: support-form-check
-    #   provider: hcaptcha
-    #   purpose: Reduce automated support requests.
-    #   retention: Configure and disclose the provider's retention period.
-    #   siteKey: 0123456789abcdefghijklmnopqrstuvwx
-# Add browser services under these groups after filling the real site operator details above.
+    tracking:
+      enabled: true
+      services: []
+      # Example:
+      # - id: tag-manager
+      #   provider: google-tag-manager
+      #   name: { en: Google Tag Manager, zh-CN: Google 跟踪代码管理器 }
+      #   purpose: { en: Load campaign tags after consent., zh-CN: 经同意后加载营销标签。 }
+      #   dataCategories: { en: Describe data sent by this container., zh-CN: 填写此容器发送的数据类别。 }
+      #   recipient: { en: Google LLC, zh-CN: Google LLC }
+      #   retention: { en: Configure the retention period., zh-CN: 填写适用的数据保留期限。 }
+      #   containerId: GTM-ABCD123
+      # - id: social-pixel
+      #   provider: meta-pixel
+      #   name: { en: Meta Pixel, zh-CN: Meta Pixel }
+      #   purpose: { en: Measure campaign traffic after consent., zh-CN: 经同意后衡量营销流量。 }
+      #   dataCategories: { en: Describe data sent by this pixel., zh-CN: 填写此像素发送的数据类别。 }
+      #   recipient: { en: Meta Platforms, Inc., zh-CN: Meta Platforms, Inc. }
+      #   retention: { en: Configure the provider's retention period., zh-CN: 填写供应商的数据保留期限。 }
+      #   pixelId: "123456789012345"
+    statistics:
+      enabled: true
+      services:
+        - id: cloudflare-web-analytics
+          provider: cloudflare-web-analytics
+          name:
+            en: Cloudflare Web Analytics
+            zh-CN: Cloudflare 网站分析
+          purpose:
+            en: Measure page views and page-load performance after consent.
+            zh-CN: 经访客同意后衡量页面浏览量和页面加载性能。
+          dataCategories:
+            en: Performance timing and page-view metrics. Report dimensions can include page path, referrer, device type, browser, operating system, and country.
+            zh-CN: 性能计时和页面浏览指标。报告维度可能包括页面路径、来源页、设备类型、浏览器、操作系统和国家或地区。
+          recipient:
+            en: Cloudflare, Inc.
+            zh-CN: Cloudflare, Inc.
+          retention:
+            en: Unsampled beacon data is kept for 7 days, then aggregated to about 10% for long-term storage. Dashboard history is available for 6 months.
+            zh-CN: 未采样的信标数据保留 7 天，之后会汇总为约 10% 的长期数据。仪表板可查看最近 6 个月的历史记录。
+          token: "8347d72ba9f84e6783bf441e7832a80e"
+      # Examples use public provider IDs only.
+      # - id: primary-analytics
+      #   provider: google-analytics
+      #   name: { en: Google Analytics, zh-CN: Google Analytics }
+      #   purpose: { en: Measure site visits after consent., zh-CN: 经访客同意后衡量网站访问情况。 }
+      #   dataCategories: { en: Describe the data processed by this property., zh-CN: 填写此媒体资源处理的数据类别。 }
+      #   recipient: { en: Google LLC, zh-CN: Google LLC }
+      #   retention: { en: Configure the provider's retention period., zh-CN: 填写供应商的数据保留期限。 }
+      #   measurementId: G-ABC12345
+      # - id: edge-analytics
+      #   provider: cloudflare-web-analytics
+      #   name: { en: Cloudflare Web Analytics, zh-CN: Cloudflare 网站分析 }
+      #   purpose: { en: Measure site visits after consent., zh-CN: 经访客同意后衡量网站访问情况。 }
+      #   dataCategories: { en: Describe the data processed by this site., zh-CN: 填写此站点处理的数据类别。 }
+      #   recipient: { en: Cloudflare, Inc., zh-CN: Cloudflare, Inc. }
+      #   retention: { en: Configure the retention period., zh-CN: 填写数据保留期限。 }
+      #   token: 01234567-89ab-cdef-0123-456789abcdef
+      # - id: baidu-analytics
+      #   provider: baidu-tongji
+      #   name: { en: Baidu Tongji, zh-CN: 百度统计 }
+      #   purpose: { en: Measure site visits after consent., zh-CN: 经访客同意后衡量网站访问情况。 }
+      #   dataCategories: { en: Describe data sent to this site ID., zh-CN: 填写此站点编号接收的数据类别。 }
+      #   recipient: { en: Baidu, Inc., zh-CN: 百度 }
+      #   retention: { en: Configure the provider's retention period., zh-CN: 填写供应商的数据保留期限。 }
+      #   siteId: abcdef0123456789abcdef01
+    advertising:
+      enabled: true
+      services: []
+      # Example:
+      # - id: display-ads
+      #   provider: google-adsense
+      #   name: { en: Google AdSense, zh-CN: Google AdSense }
+      #   purpose: { en: Display ads after consent., zh-CN: 经访客同意后展示广告。 }
+      #   dataCategories: { en: Describe the data processed for ad delivery., zh-CN: 填写广告投放处理的数据类别。 }
+      #   recipient: { en: Google LLC, zh-CN: Google LLC }
+      #   retention: { en: Configure the provider's retention period., zh-CN: 填写供应商的数据保留期限。 }
+      #   clientId: ca-pub-1234567890123456
+    captcha:
+      enabled: true
+      services: []
+      # Choose a provider for each CAPTCHA block. Never add its secret key here.
+      # - id: contact-form-check
+      #   provider: cloudflare-turnstile
+      #   name: { en: Cloudflare Turnstile, zh-CN: Cloudflare Turnstile }
+      #   purpose: { en: Reduce automated contact form submissions., zh-CN: 减少联系表单中的自动化提交。 }
+      #   dataCategories: { en: Describe challenge and response data., zh-CN: 填写验证挑战和响应处理的数据类别。 }
+      #   recipient: { en: Cloudflare, Inc., zh-CN: Cloudflare, Inc. }
+      #   retention: { en: Configure the provider's retention period., zh-CN: 填写供应商的数据保留期限。 }
+      #   siteKey: 0x4AAAAAAABBBBBBBBCCCCCCDDDD
+      # - id: signup-form-check
+      #   provider: google-recaptcha
+      #   name: { en: Google reCAPTCHA, zh-CN: Google reCAPTCHA }
+      #   purpose: { en: Reduce automated signup submissions., zh-CN: 减少注册表单中的自动化提交。 }
+      #   dataCategories: { en: Describe challenge and response data., zh-CN: 填写验证挑战和响应处理的数据类别。 }
+      #   recipient: { en: Google LLC, zh-CN: Google LLC }
+      #   retention: { en: Configure the provider's retention period., zh-CN: 填写供应商的数据保留期限。 }
+      #   siteKey: 6LcAbCdEfGhIjKlMnOpQrStUvWxYz0123456789a
+      # - id: support-form-check
+      #   provider: hcaptcha
+      #   name: { en: hCaptcha, zh-CN: hCaptcha }
+      #   purpose: { en: Reduce automated support requests., zh-CN: 减少自动化的支持请求。 }
+      #   dataCategories: { en: Describe challenge and response data., zh-CN: 填写验证挑战和响应处理的数据类别。 }
+      #   recipient: { en: Intuition Machines, Inc., zh-CN: Intuition Machines, Inc. }
+      #   retention: { en: Configure the provider's retention period., zh-CN: 填写供应商的数据保留期限。 }
+      #   siteKey: 0123456789abcdefghijklmnopqrstuvwx
+# Add browser services under plugins.consent after filling the real site operator details above.
 # Every configured service waits for the visitor's explicit consent before its vendor code loads.

package/content/pages/home/en.md

@@ -17,6 +17,16 @@ blocks:
           eyebrow: A project built for the edge
           title: Build a fast website from clear, editable source files.
           text: EdgePress turns Markdown posts, page layouts, themes, and consent-aware integrations into a static site served by Cloudflare Workers.
+          mascotSrc: /edgepress/brand/mascot-418.png
+          mascotAlt: A curious sparrow folded from layered paper pages, EdgePress's project mascot.
+          mascotWidth: 418
+          mascotHeight: 440
+          mascotSizes: 209px
+          mascotWebpSrcset:
+            - src: /edgepress/brand/mascot-209.webp
+              width: 209
+            - src: /edgepress/brand/mascot-418.webp
+              width: 418
           cta:
             label: Start with the quick guide
             url: /quick-start/
@@ -31,15 +41,19 @@ blocks:
           title: A clear place for each part of a site
           items:
             - title: Pages use editable elements
+              icon: layout-grid
               text: Set the number of columns first, then choose elements and edit their content in each page file.
               url: /theme-development/
             - title: Posts use Markdown
+              icon: file-text
               text: Write long-form articles in Markdown and let the built-in renderer sanitize and format them.
               url: /project-introduction/
             - title: Themes own the design
+              icon: palette
               text: Build layouts with HTML partials and keep each theme's color palette in its stylesheet.
               url: /theme-development/
             - title: Integrations wait for consent
+              icon: shield-check
               text: Add tracking, statistics, advertising, or CAPTCHA services with provider details in configuration.
               url: /plugin-development/
   - columns: 2
@@ -81,4 +95,5 @@ blocks:
         - type: latest-posts
           title: Latest project updates
           count: 3
+          paginate: true
 ---

package/content/pages/home/zh-cn.md

@@ -17,6 +17,16 @@ blocks:
           eyebrow: 为边缘网络构建
           title: 用清晰、可编辑的源文件构建快速网站。
           text: EdgePress 将 Markdown 文章、页面布局、主题和遵循同意状态的集成构建为由 Cloudflare Workers 提供服务的静态网站。
+          mascotSrc: /edgepress/brand/mascot-418.png
+          mascotAlt: EdgePress 吉祥物，一只由层叠折页构成、神情好奇的小鸟。
+          mascotWidth: 418
+          mascotHeight: 440
+          mascotSizes: 209px
+          mascotWebpSrcset:
+            - src: /edgepress/brand/mascot-209.webp
+              width: 209
+            - src: /edgepress/brand/mascot-418.webp
+              width: 418
           cta:
             label: 从快速入门开始
             url: /quick-start/
@@ -31,15 +41,19 @@ blocks:
           title: 网站各部分各有清晰位置
           items:
             - title: 页面使用可编辑元素
+              icon: layout-grid
               text: 先设置栏数，再选择元素类型，并在各页面文件中编辑对应内容。
               url: /theme-development/
             - title: 文章使用 Markdown
+              icon: file-text
               text: 使用 Markdown 撰写长文，由内置渲染器进行清理和排版。
               url: /project-introduction/
             - title: 主题负责视觉设计
+              icon: palette
               text: 使用 HTML 局部模板构建布局，并将各主题的配色保留在样式表中。
               url: /theme-development/
             - title: 集成遵循用户同意
+              icon: shield-check
               text: 配置跟踪、统计、广告或人机验证服务及其供应商信息。
               url: /plugin-development/
   - columns: 2
@@ -81,4 +95,5 @@ blocks:
         - type: latest-posts
           title: 最新项目动态
           count: 3
----
+          paginate: true
+---

package/content/pages/plugin-development/en.md

@@ -43,9 +43,10 @@ blocks:
           blocks:
             - type: text
               paragraphs:
-                - Add browser providers in config.yml under plugins.tracking, plugins.statistics, plugins.advertising, or plugins.captcha. Each entry needs a unique ID, purpose, retention description, and a public provider identifier.
+                - Add browser providers in config.yml under plugins.consent.tracking, plugins.consent.statistics, plugins.consent.advertising, or plugins.consent.captcha. Each service needs a unique ID, provider, purpose, dataCategories, recipient, retention, and its public site identifier. Localized fields are maps keyed by every enabled locale, such as en and zh-CN.
                 - Available providers include Google Tag Manager and Meta Pixel; Cloudflare Web Analytics, Google Analytics, and Baidu Tongji; Google AdSense; and Cloudflare Turnstile, Google reCAPTCHA, and hCaptcha.
-                - Provider code is imported only after the visitor accepts that integration. Keep CAPTCHA secret keys out of config.yml and client code. The server must submit each CAPTCHA response to the provider verification API before accepting a form.
+                - Set plugins.consent.proposedDate to the YYYY-MM-DD date the notice was drafted. Set effectiveDate when the notice takes effect; omit it while no effective date has been set. Updating either date makes saved consent stale, so visitors are asked again.
+                - Provider code is imported only after the visitor accepts that integration. The first layer offers accept and reject together; service data and individual switches are available in its details. Keep CAPTCHA secret keys out of config.yml and client code. The server must submit each CAPTCHA response to the provider verification API before accepting a form.
             - type: notice
               title: Operator details
               text: Fill privacy.controller.name, privacy.controller.contact, and privacy.policyUrl before configuring any browser provider. The build rejects provider services when the controller name or contact is blank.
@@ -85,8 +86,8 @@ blocks:
               items:
                 - label: Cloudflare Turnstile Siteverify
                   url: https://developers.cloudflare.com/turnstile/get-started/server-side-validation/
-                - label: Consent guidelines from the EDPB
-                  url: https://www.edpb.europa.eu/sites/default/files/files/file1/edpb_guidelines_202005_consent_en.pdf
+                - label: EDPB consent summary
+                  url: https://www.edpb.europa.eu/system/files/2026-04/edpb-summary-consent_en.pdf
   - columns: 1
     cells:
       -

package/content/pages/plugin-development/zh-cn.md

@@ -43,9 +43,10 @@ blocks:
           blocks:
             - type: text
               paragraphs:
-                - 在 config.yml 的 plugins.tracking、plugins.statistics、plugins.advertising 或 plugins.captcha 下添加浏览器供应商。每项需要唯一 ID、用途、保留期限说明和公开供应商标识。
+                - 在 config.yml 的 plugins.consent.tracking、plugins.consent.statistics、plugins.consent.advertising 或 plugins.consent.captcha 下添加浏览器供应商。每项需要唯一 ID、provider、purpose、dataCategories、recipient、retention 和公开站点标识。多语言字段需使用语言映射，覆盖已启用的每种语言，例如 en 与 zh-CN。
                 - 可用供应商包括 Google Tag Manager 和 Meta Pixel；Cloudflare Web Analytics、Google Analytics 和百度统计；Google AdSense；以及 Cloudflare Turnstile、Google reCAPTCHA 和 hCaptcha。
-                - 只有访客接受对应集成后才会导入供应商代码。不要把 CAPTCHA 密钥放入 config.yml 或客户端代码。服务器必须在接受表单前将每个 CAPTCHA 响应提交给供应商验证 API。
+                - plugins.consent.proposedDate 必须设置为 YYYY-MM-DD 格式的告知拟定日期。告知生效后再设置 effectiveDate；尚未生效时可以省略。修改任一日期都会使旧的同意记录失效，并重新询问访客。
+                - 只有访客接受对应集成后才会导入供应商代码。首层同时提供接受和拒绝，数据详情与逐项开关位于展开内容中。不要把 CAPTCHA 密钥放入 config.yml 或客户端代码。服务器必须在接受表单前将每个 CAPTCHA 响应提交给供应商验证 API。
             - type: notice
               title: 运营者信息
               text: 配置浏览器供应商前，请填写 privacy.controller.name、privacy.controller.contact 和 privacy.policyUrl。控制者名称或联系方式为空时，构建器会拒绝启用供应商服务。
@@ -85,8 +86,8 @@ blocks:
               items:
                 - label: Cloudflare Turnstile Siteverify
                   url: https://developers.cloudflare.com/turnstile/get-started/server-side-validation/
-                - label: EDPB 同意指南
-                  url: https://www.edpb.europa.eu/sites/default/files/files/file1/edpb_guidelines_202005_consent_en.pdf
+                - label: EDPB 同意摘要
+                  url: https://www.edpb.europa.eu/system/files/2026-04/edpb-summary-consent_en.pdf
   - columns: 1
     cells:
       -

package/content/pages/privacy-policy/en.md

@@ -15,7 +15,7 @@ blocks:
               nameLabel: Controller
               contactLabel: Privacy contact
               missingTitle: Publication setup required
-              missingText: The current config.yml has no real operator name or privacy contact, and site.url still uses example.com. Replace these values before publishing this policy.
+              missingText: config.yml still needs the site's real operator name and a working privacy contact. Add both before publishing this policy.
   - columns: 2
     cells:
       -
@@ -32,7 +32,7 @@ blocks:
           title: Optional browser services
           blocks:
             - type: text
-              text: The current configuration has no tracking, statistics, advertising, or human-verification providers in its service lists. If the operator adds a service, the list below is generated from its configured provider, purpose, and retention description.
+              text: This list is regenerated on each build from enabled browser services in config.yml under plugins.consent. It shows each service name, provider category, purpose, data categories, recipient, and configured retention period.
             - type: privacy-services
               emptyText: No optional third-party browser services are configured in this source build.
   - columns: 1
@@ -44,12 +44,14 @@ blocks:
           blocks:
             - type: text
               paragraphs:
-                - Browser integrations are loaded only after the visitor accepts a configured service. The consent interface stores a first-party preference in local browser storage when a choice can be saved. It is not a server-side audit log.
-                - Visitors can reopen Privacy settings to change a choice. If they withdraw a previously active service, the page reloads so that the integration can stop running.
+                - Optional browser integrations stay off until a visitor actively accepts them. No service is selected on a first visit. Accept and reject are both available at the same level; visitors can also open the service details and save a granular choice.
+                - The interface stores the selected service IDs in first-party browser storage for the configured period. This preference record is stored on the visitor's device; it is not a server-side audit log.
+                - Visitors can reopen Privacy settings to change or withdraw a choice. If they withdraw a previously active service, the page reloads so the integration can stop running.
             - type: privacy-consent
               storageLabel: Browser storage key
               expiryLabel: Preference expiry
-              versionLabel: Consent configuration version
+              proposedDateLabel: Notice proposed
+              effectiveDateLabel: Notice effective
               expiryText: "{days} days after saving"
   - columns: 1
     cells:
@@ -61,6 +63,7 @@ blocks:
               paragraphs:
                 - Before enabling a provider, the operator must document the information it receives, purposes, recipients, applicable retention, and any cross-border transfers. Public site identifiers may be configured in the browser; CAPTCHA secret keys must stay on a trusted server, which must verify each response token.
                 - This starter configuration cannot determine the operator's jurisdiction, legal bases, retention obligations, or the rights that apply to a particular deployment. Complete this policy for the actual site and seek qualified advice where needed.
+                - Review the current privacy information and terms for every provider listed above. Confirm that its actual data collection, recipients, retention, and transfer practices match this policy before publication and whenever the configuration changes.
             - type: link-list
               title: Primary legal references
               items:

package/content/pages/privacy-policy/zh-cn.md

@@ -15,7 +15,7 @@ blocks:
               nameLabel: 个人信息处理者
               contactLabel: 隐私联系
               missingTitle: 发布前需要补充信息
-              missingText: 当前 config.yml 尚未填写真实运营者名称和隐私联系方式，site.url 仍为 example.com。正式发布前请替换这些值。
+              missingText: config.yml 尚未填写真实运营者名称和有效的隐私联系方式。正式发布前请补充这两项信息。
   - columns: 2
     cells:
       -
@@ -32,7 +32,7 @@ blocks:
           title: 可选浏览器服务
           blocks:
             - type: text
-              text: 当前配置的跟踪、统计、广告和人机验证服务列表均为空。运营者添加服务后，下方列表会根据所配置的供应商、用途和保留期限自动生成。
+              text: 下方列表会在每次构建时根据 config.yml 中 plugins.consent 下已启用的浏览器服务重新生成，显示服务名称、供应商类别、用途、数据类别、接收方和配置的保留期限。
             - type: privacy-services
               emptyText: 此源项目当前没有配置可选的第三方浏览器服务。
   - columns: 1
@@ -44,12 +44,14 @@ blocks:
           blocks:
             - type: text
               paragraphs:
-                - 浏览器集成只有在访客接受已配置服务后才会加载。存在可保存的选择时，同意界面会将第一方偏好存储在本地浏览器中；它不是服务器端审计日志。
-                - 访客可以重新打开“隐私设置”更改选择。撤回之前已启用的服务后，页面会重新载入，以停止该集成继续运行。
+                - 可选浏览器集成只有在访客主动接受后才会加载。首次访问时没有预先选中的服务；接受和拒绝选项处于同一层级，访客也可以展开服务详情并保存逐项选择。
+                - 同意界面会在第一方浏览器存储中保存访客选择的服务 ID，并遵循下方配置的有效期限。该偏好记录只保存在访客设备上，不是服务器端审计日志。
+                - 访客可以重新打开“隐私设置”更改或撤回选择。撤回之前已启用的服务后，页面会重新载入，以停止该集成继续运行。
             - type: privacy-consent
               storageLabel: 浏览器存储键
               expiryLabel: 偏好过期时间
-              versionLabel: 同意配置版本
+              proposedDateLabel: 隐私告知拟定日期
+              effectiveDateLabel: 隐私告知生效日期
               expiryText: "保存后 {days} 天"
   - columns: 1
     cells:
@@ -61,6 +63,7 @@ blocks:
               paragraphs:
                 - 启用供应商前，运营者应记录供应商接收的信息、处理目的、接收方、适用保留期限和跨境传输情况。浏览器配置中只能填写公开站点标识；CAPTCHA 密钥必须保存在可信服务器中，并由服务器验证每个响应令牌。
                 - 此起始配置无法确定实际部署的运营者所在地、法律依据、数据保留义务或适用的个人权利。请根据实际网站完成政策，必要时咨询合格的专业人员。
+                - 请核对上方每个供应商当前的隐私说明和适用条款，确认其实际收集的数据、接收方、保留期限和传输方式与本政策一致。发布前以及配置变更后都应重新检查。
             - type: link-list
               title: 主要法律资料
               items:

package/content/pages/theme-development/en.md

@@ -39,6 +39,7 @@ blocks:
                 - The shared layout renders every page and post. The head, header, and footer partials provide common site components. Configure the page-title suffix and separator, site title, shared navigation, language links, footer text, and component visibility in config.yml.
                 - Use double-brace placeholders for escaped values. The approved raw placeholders are generated page content, JSON-LD, and EdgePress-generated navigation markup. Keep the skip link, one main landmark, labeled navigation, visible focus, and one page-level h1.
                 - Keep the body as a full-height vertical layout and let main grow so the footer stays at the bottom on short pages.
+                - Style shared code blocks, copy buttons, and article contents in the theme. Code lines wrap on small viewports, copy controls have visible keyboard focus, and the generated post contents list links to heading anchors.
       -
         - type: section
           title: Choose a theme palette
@@ -65,6 +66,7 @@ blocks:
                 - Each page and locale is a Markdown file, but the page body after front matter must stay empty. The editor data lives in its blocks YAML.
                 - "Order the data from the outside inward: set each row's columns count first, provide one cells entry per column, select an element type inside a cell, then edit that element's fields. The validator rejects mismatched column counts and empty cells."
                 - Pages do not use the post Markdown renderer. Posts remain Markdown articles and use the built-in sanitizing renderer.
+                - Hero blocks can use mascotWebpSrcset with ascending path-and-width candidates, mascotSizes matching the rendered width, and mascotWidth/mascotHeight matching the fallback image. mascotSrc remains the fallback for browsers without WebP support.
             - type: data-table
               title: Available element families
               headers:
@@ -103,4 +105,26 @@ blocks:
                 - title: Preview the site
                   text: The server watches source files, rebuilds the output, refreshes the browser, and updates the accessibility and agent-friendliness report.
                   command: edgepress server
+  - columns: 1
+    cells:
+      -
+        - type: section
+          title: Use the shared icon library
+          tone: soft
+          text: EdgePress ships 22 local SVG icons at /edgepress/icons.svg. Theme navigation uses them automatically; feature-grid items can also name an icon, with no runtime package or third-party request.
+          blocks:
+            - type: code
+              title: Add a decorative icon to a theme partial
+              language: html
+              code: |
+                <svg class="icon" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="1.75" stroke-linecap="round" stroke-linejoin="round" aria-hidden="true">
+                  <use href="/edgepress/icons.svg#layers"></use>
+                </svg>
+            - type: code
+              title: Choose an icon for a feature card
+              language: yaml
+              code: |
+                - title: Posts use Markdown
+                  icon: file-text
+                  text: Write and publish an article.
 ---

package/content/pages/theme-development/zh-cn.md

@@ -39,6 +39,7 @@ blocks:
                 - 共享布局会渲染所有页面和文章。head、header 和 footer 局部模板提供常见网站组件。在 config.yml 中配置页面标题后缀与分隔符、站点标题、全站导航、语言链接、页脚内容和组件显示状态。
                 - 使用双花括号占位符输出经过转义的值。唯一允许的原样占位符是生成的页面内容、JSON-LD 和 EdgePress 生成的导航标记。保留跳转链接、唯一 main 主区域、带标签的导航、可见焦点和一个页面级 h1。
                 - 将 body 保持为全高纵向布局，并让 main 延伸，这样短页面的页脚也会留在视口底部。
+                - 在主题中统一设计代码块、复制按钮和文章目录。窄屏代码行会自动折行，复制控件具有清晰的键盘焦点，生成的文章目录会链接到标题锚点。
       -
         - type: section
           title: 选择主题配色
@@ -65,6 +66,7 @@ blocks:
                 - 每个页面和语言版本都是一个 Markdown 文件，但 front matter 之后必须保持空白。页面编辑数据放在 YAML blocks 中。
                 - 数据从外向内排列：先设每行的 columns 栏数，再为每栏设置一个 cells 项，然后在栏内选择元素类型，最后编辑该元素字段。验证器会拒绝栏数不匹配或空白的栏。
                 - 页面不使用文章 Markdown 渲染器。文章仍使用 Markdown 撰写，并由内置安全渲染器输出。
+                - hero 元素可用 mascotWebpSrcset 提供按宽度递增的路径候选项，并设置与显示宽度一致的 mascotSizes，以及匹配备用图片尺寸的 mascotWidth 和 mascotHeight。mascotSrc 会留作不支持 WebP 的浏览器备用图。
             - type: data-table
               title: 可用元素类别
               headers:
@@ -103,4 +105,26 @@ blocks:
                 - title: 预览网站
                   text: server 会监视源文件、重新构建输出、刷新浏览器，并更新无障碍化和 agent 友好度报告。
                   command: edgepress server
+  - columns: 1
+    cells:
+      -
+        - type: section
+          title: 使用共享图标库
+          tone: soft
+          text: EdgePress 随站点提供 22 个本地 SVG 图标 /edgepress/icons.svg。主题导航会自动使用图标；feature-grid 也可为功能卡片指定图标，不增加运行时依赖，也不会请求第三方服务器。
+          blocks:
+            - type: code
+              title: 在主题局部模板中添加装饰图标
+              language: html
+              code: |
+                <svg class="icon" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="1.75" stroke-linecap="round" stroke-linejoin="round" aria-hidden="true">
+                  <use href="/edgepress/icons.svg#layers"></use>
+                </svg>
+            - type: code
+              title: 为功能卡片指定图标
+              language: yaml
+              code: |
+                - title: 文章使用 Markdown
+                  icon: file-text
+                  text: 撰写并发布文章。
 ---

package/content/posts/2026-09-23-edgepress-on-the-edge/en.md

@@ -1,5 +1,6 @@
 ---
 title: "EdgePress and Markdown: a complete writing guide"
+author: toewpq
 date: 2026-09-23
 lang: en
 slug: markdown-syntax-guide
@@ -8,6 +9,7 @@ tags:
   - Markdown
   - writing guide
 description: "A hands-on guide to the Markdown syntax EdgePress renders, including GitHub Flavored Markdown, safe HTML, nested formatting, and its supported limits."
+
 ---
 
 EdgePress keeps **pages** and **posts** deliberately different. Pages use ordered, editable element blocks from their Markdown front matter. Posts use the Markdown renderer, so this article is also a working reference: every example below is rendered from a real post.
@@ -102,6 +104,14 @@ Images use the same shape as links, with an exclamation mark and useful alternat
 
 ![A diagram showing Markdown source passing through EdgePress rendering and HTML sanitization to a published post](/edgepress-markdown-guide.svg "The EdgePress post pipeline")
 
+Posts also accept a direct video file in the same image-shaped syntax. The alt text describes the video for assistive technology, and the optional title becomes its caption:
+
+```markdown
+![A kite passing over a field](https://media.example.org/field-recording.mp4 "Wind test, early morning")
+```
+
+MP4, WebM, OGV, and OGG files are rendered in a native video player with controls. Media uses `preload="none"` so the browser waits for playback before downloading the video. Embedded video players and arbitrary iframe markup are not supported.
+
 ## Lists, including nested combinations
 
 Start unordered items with `-`, `+`, or `*`; start ordered items with a number and a period. Indent child items by at least two spaces. Inline emphasis, code, and links work inside either level:
@@ -158,12 +168,12 @@ Small semantic HTML elements such as <kbd>Ctrl</kbd> can be useful inside Markdo
 
 <script>alert('unsafe');</script>
 
-Use a page's media-text element for video; embedded frames and arbitrary scripts are not allowed in posts.
+Use the Markdown image-shaped syntax above for a direct video file; embedded frames and arbitrary scripts are not allowed in posts.
 
 This is the complete enabled post dialect: CommonMark block and inline syntax plus GFM tables, autolinks, task lists, and strikethrough. Extensions such as footnotes, math notation, Mermaid diagrams, underline syntax, and definition lists are not enabled by this project. They remain ordinary text unless you add a trusted renderer extension.
 
 ## Writing posts in EdgePress
 
-Create a post directory under `content/posts/` with one lowercase locale file such as `en.md` or `zh-cn.md`. Keep the `lang` front matter value matched to the locale filename. Add title, date, slug, tags, and an optional description above the Markdown body. Then run `edgepress build` to render the post, or `edgepress check` to build the site and generate the accessibility, agent-friendliness, responsive screenshot, and Markdown-rendering report.
+Create a post directory under `content/posts/` with one lowercase locale file such as `en.md` or `zh-cn.md`. Keep the `lang` front matter value matched to the locale filename. Add title, author, date, slug, tags, and an optional description above the Markdown body. The author appears in article cards, article bylines, feeds, search data, and BlogPosting metadata. Then run `edgepress build` to render the post, or `edgepress check` to build the site and generate the accessibility, agent-friendliness, responsive screenshot, and Markdown-rendering report.
 
 The local article search reads the generated `search.json` file from this site and searches post titles and text in the browser. It does not send a query to a third-party service.